The sta_list_spinlock looks to be used to control locking of the
list. Specifically when someone has the lock they may be allowed
to modify or delete elements of the list.

That implies that we shouldn't access the fields of the elements
returned by mwifiex_get_sta_entry() after we've released the
spinlock. Let's make some small changes so this is true.

It's unlikely that this matters since it looks to be just error
handling, but it's nice to be clean.
Signed-off-by: NDouglas Anderson <dianders@chromium.org>
Signed-off-by: NGanapathi Bhat <gbhat@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

There's absolutely no reason to check to see if a list is empty
before iterating through it.  It's just like writing code like
this:

if (count != 0) {
  for (i = 0; i < count; i++) {
     ...
  }
}

The loop will already be avoided if "count == 0" so there was no
reason to check.
Signed-off-by: NDouglas Anderson <dianders@chromium.org>
Signed-off-by: NGanapathi Bhat <gbhat@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use "if BCMA"/"endif" around all Kconfig symbols so that they are
kept together in *config menus instead of showing up in unexpected
places. Also remove "depends on BCMA" since this is handled by the
"if BCMA" addition.

Tested with ARCH={x86_64,MIPS} using make {n,menu,g,x}config.
Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
Cc: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Merge tag 'iwlwifi-next-for-kalle-2017-10-06-2' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next

First batch of iwlwifi patches for 4.15 (v2)

* Cleanups: - remove an unused value that we read from the NVM;
            - remove link quality measurement code that was never used;
* One FW command API update;
* A fix and an addition for PCI devices for the A000 family;
* Tiny refactor of ref/unref code used by runtime-PM;
* Some debugging improvements;
* Implementation of a more flexible way to define command queue sizes;
* ACPI code refactoring;
* Some coding-style fixes;
* Avoid redundant command to the firmware;
* Add a struct with the format of one FW command;
* Change an error log to a warning when the FW API is not aligned with
  the driver (important during development);
* Change a WARN_ON to WARN_ONCE to make it more descriptive and less
  noisy (i.e. no repeated warnings on a firmware triggered error);
* Dump PCI registers when an error occurs, to make it easier to debug;

Driver will advertise RANDOM_MAC support only if the device
supports this feature.
Signed-off-by: NKarthik Ananthapadmanabha <karthida@marvell.com>
Signed-off-by: NGanapathi Bhat <gbhat@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

My static checker complains that we have an upper bound but no lower
bound.  I suspect neither are really required but it doesn't hurt to add
a check for negatives.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

ieee80211_register_hw() in p54_register_common() may fail and leds won't
get initialized. Currently p54_unregister_common() doesn't check that and
always calls p54_unregister_leds(). The fix is to check priv->registered
flag before calling p54_unregister_leds().

Found by syzkaller.

INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 1 PID: 1404 Comm: kworker/1:1 Not tainted
4.14.0-rc1-42251-gebb2c243-dirty #205
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:16
 dump_stack+0x292/0x395 lib/dump_stack.c:52
 register_lock_class+0x6c4/0x1a00 kernel/locking/lockdep.c:769
 __lock_acquire+0x27e/0x4550 kernel/locking/lockdep.c:3385
 lock_acquire+0x259/0x620 kernel/locking/lockdep.c:4002
 flush_work+0xf0/0x8c0 kernel/workqueue.c:2886
 __cancel_work_timer+0x51d/0x870 kernel/workqueue.c:2961
 cancel_delayed_work_sync+0x1f/0x30 kernel/workqueue.c:3081
 p54_unregister_leds+0x6c/0xc0 drivers/net/wireless/intersil/p54/led.c:160
 p54_unregister_common+0x3d/0xb0 drivers/net/wireless/intersil/p54/main.c:856
 p54u_disconnect+0x86/0x120 drivers/net/wireless/intersil/p54/p54usb.c:1073
 usb_unbind_interface+0x21c/0xa90 drivers/usb/core/driver.c:423
 __device_release_driver drivers/base/dd.c:861
 device_release_driver_internal+0x4f4/0x5c0 drivers/base/dd.c:893
 device_release_driver+0x1e/0x30 drivers/base/dd.c:918
 bus_remove_device+0x2f4/0x4b0 drivers/base/bus.c:565
 device_del+0x5c4/0xab0 drivers/base/core.c:1985
 usb_disable_device+0x1e9/0x680 drivers/usb/core/message.c:1170
 usb_disconnect+0x260/0x7a0 drivers/usb/core/hub.c:2124
 hub_port_connect drivers/usb/core/hub.c:4754
 hub_port_connect_change drivers/usb/core/hub.c:5009
 port_event drivers/usb/core/hub.c:5115
 hub_event+0x1318/0x3740 drivers/usb/core/hub.c:5195
 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
 process_scheduled_works kernel/workqueue.c:2179
 worker_thread+0xb2b/0x1850 kernel/workqueue.c:2255
 kthread+0x3a1/0x470 kernel/kthread.c:231
 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

Cc: stable@vger.kernel.org
Signed-off-by: NAndrey Konovalov <andreyknvl@google.com>
Acked-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The default power limit read from the SPLC method in ACPI doesn't
have anything to do with the transport and is only used in the opmode,
so we can remove it from the trans.  Additionally, this value is only
user when the opmode is starting, so we don't need to store it
anywhere.

Remove the dflt_pwr_limit element from the trans and move call to
iwl_acpi_get_pwr_limit() call to mvm.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Getting the wrong statistics size is a problem, having a warning
will help us catch it quicker during firmware/driver development.
In released firmware/driver versions, we obviously make sure this
won't happen.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Move most of the set_dflt_pwr_limit() function to acpi.c and make it
return the pwr_limit value instead of setting directly.  Also rename
it to iwl_acpi_get_pwr_limit().
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Fix the double indentation in the configuration structs
for a000 family devices.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The iwl_get_bios_mcc() function was in the iwl-nvm-parse.c file, but
it has nothing to do with the NVM.  Move it to fw/acpi.c and rename it
to iwl_acpi_get_mcc().
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Some of the #ifdef CONFIG_ACPI are not needed anymore, so they can be
removed.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The way iwl_get_bios_mcc() gets the WiFi package and checks for its
integrity is almost identical to the new iwl_acpi_get_wifi_pkg()
function.  Instead of having duplicate code, convert it to use the
common code.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Instead of finding the wifi package with its own code, we can reuse
the new iwl_acpi_get_wifi_pkg() function when reading the default
power limit from SPLC.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Move this function to acpi.c, renaming it to iwl_acpi_get_wifi_pkg(),
because it can also be used with other methods (i.e. SPLC and WRDD).
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The ACPI table size definitions were spread around the different files
that used them.  Move them all to a common place.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Instead of defining each method where they are used and re-defining
WIFI_DOMAIN in each one of them, move all the definitions to a central
place and define the domain only a single time.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

There are many places where the same process of invoking a method from
ACPI is used, causing a lot of duplicate code.  To improve this,
introduce a new function to get an ACPI object by invoking an ACPI
method that can be reused.

Additionally, since this function needs to be called when we only have
the trans, the opmode or the device, introduce a new debug macro that
gets the device as a parameter so it can be used in the new function.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In case there is a FW bug where the BAID value in the
metadata is not properly initialized we hit the warning for
every RX packet.
Change it to warn once and add elaborate message.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

We conclude the HW became inaccessible when we timeout waiting for
a bit to be set in a memory mapped register (CSR_GP_CNTRL). This
conclusion may not be true because the bit may not get set due to:
- a firmware issue
- a driver issue
- a PCI bus issue
- a platform issue
There are a lot of such reports with really no good debug information
beyond this message to help us.

Add some debug information and attempt to dump the different register
spaces at such a failure:

* Dump some configuration space of device - this will tell us if
something very basic is broken in the PCIe bus (so that configuration
accesses are failing). If this works, the PCIe bus seems OK. If this
does not work, it is definitely an PCIe issue.

* Dump some memory mapped registers - if we're reading some sane'ish
values, this will tell us that the PCIe bus is OK, but may be a firmware
/ driver issue. If this does not work, it may be a PCI configuration
issue or a driver/firmware issue.

* Dump parent and device's AER registers, will give us some straws to
chew on.

This is the sample output:
[   13.082651] ------------[ cut here ]------------
[   13.086791] iwlwifi 0000:01:00.0: iwlwifi transaction failed, dumping registers
[   13.086793] iwlwifi 0000:01:00.0: iwlwifi device config registers:
[   13.086893] iwlwifi 0000:01:00.0: 00000000: 095a8086 00100406 02800059 00000000 00000004 00000000 00000000 00000000
[   13.086895] iwlwifi 0000:01:00.0: 00000020: 00000000 00000000 00000000 50108086 00000000 000000c8 00000000 00000100
[   13.086901] iwlwifi 0000:01:00.0: iwlwifi device memory mapped registers:
[   13.086989] iwlwifi 0000:01:00.0: 00000000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
[   13.086991] iwlwifi 0000:01:00.0: 00000020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
[   13.086999] iwlwifi 0000:01:00.0: iwlwifi device AER capability structure:
[   13.087033] iwlwifi 0000:01:00.0: 00000000: 14010001 00100000 00000000 00462031 00002000 00002000 00000014 40000001
[   13.087034] iwlwifi 0000:01:00.0: 00000020: 0000000f d140000c 00000000
[   13.087036] iwlwifi 0000:01:00.0: iwlwifi parent port (0000:00:1c.0) config registers:
[   13.087074] iwlwifi 0000:00:1c.0: 00000000: 9d108086 00100506 060400f1 00810010 00000000 00000000 00010100 200000f0
[   13.087075] iwlwifi 0000:00:1c.0: 00000020: d140d140 0001fff1 00000000 00000000 00000000 00000040 00000000 0006010b
[   13.087087] ------------[ cut here ]------------
[   13.087095] WARNING: CPU: 0 PID: 1759 at drivers/net/wireless/iwl7000/iwlwifi/pcie/trans.c:2082 iwl_trans_pcie_reclaim+0x1ee4/0x2b9a [iwlwifi]()
[   13.087096] Timeout waiting for hardware access (CSR_GP_CNTRL 0xffffffff)
Signed-off-by: NRajat Jain <rajatja@google.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Fixes three trivial issues as reported by checkpatch.pl, namely two
switch/case indentation issues and one alignment issue in a multiline
comment.
Signed-off-by: NChristoph Böhmwalder <christoph@boehmwalder.at>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

This helps for documentation and clarifies the code by defining the
exact response struct for the marker command.
Signed-off-by: NMordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

These enum values don't exist, so remove their documentation as well.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When we have an AP which supports HT and a single HT
station is connected, we change the min_width from
NL80211_CHAN_WIDTH_20_NOHT to NL80211_CHAN_WIDTH_20. This
of course has no implication on the channel width but still
sends a command to the firmware.
Remember the last width that was sent and refrain from
sending unnecessary commands to the firmware.

Sending a PHY_CTXT_CMD to the firmware has a cost since it
recalculates the presence on the medium and because of that
it closes the transmit queues for a short while.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The driver reads xtal_calib from NVM file, but actually never uses it.
This is only used in dvm driver.
Signed-off-by: NChaya Rachel Ivgi <chaya.rachel.ivgi@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Devices in the A000 family can use a different size for the command queue.
To allow this, make the command queue size configurable and set the size
for A000 devices to 32.
Signed-off-by: NShahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

This would enable to better catch timing issues with
cases that WRT dump takes too much time.
Signed-off-by: NIlan Peer <ilan.peer@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The trigger that collects data when a frame is released
because of the timer of the reordering buffer was not
implemented for 9000 devices.
Fix this.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

This was never used by any product. Remove it.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

New quota command adds a field indicating low latency
direction per quota.

A TLV API bit was added to indicate the new API.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Add a new a000 device with PCI ID (0x2720, 0x0030).
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The PCI ID (0x2720, 0x0070) was set with the config struct
iwla000_2ax_cfg_hr instead of iwla000_2ac_cfg_hr_cdb.

Fixes: 175b87c6 ("iwlwifi: add the new a000_2ax series")
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

De-inline iwl_trans_ref/unref and move it to common transport code
in preparation for more common code to come to these functions.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Add a dbgfs entry for an easy way during runtime to
check what FW file was loaded, and get some general
FW-related data.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

brcmf_fweh_process_event() sets event->datalen to the
endian-swapped value of event_packet->msg.datalen, which is the
same as emsg.datalen.  This length is already validated in
brcmf_fweh_process_event(), so there is no need to check it
again upon dequeuing the event.
Suggested-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKevin Cernekee <cernekee@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before
the length of rxframe is validated.  This could lead to uninitialized
data being accessed (but not printed).  Since we already have a
perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec,
and ch.chspec is not modified by decchspec(), avoid the extra
assignment and use ch.chspec in the debug print.
Suggested-by: NMattias Nissler <mnissler@chromium.org>
Signed-off-by: NKevin Cernekee <cernekee@chromium.org>
Reviewed-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Don't populate const arrays on the stack, instead make them static.
Makes the object code smaller by over 60 bytes:

Before:
   text	   data	    bss	    dec	    hex	filename
  14816	   1296	      0	  16112	   3ef0	b43/phy_ht.o

After:
   text	   data	    bss	    dec	    hex	filename
  14551	   1496	      0	  16047	   3eaf	b43/phy_ht.o

(gcc 6.3.0, x86-64)
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Don't populate const array ac_to_fifo on the stack in an inlined
function, instead make it static.  Makes the object code smaller
by over 800 bytes:

   text	   data	    bss	    dec	    hex	filename
 159029	  33154	   1216	 193399	  2f377	4965-mac.o

   text	   data	    bss	    dec	    hex	filename
 158122	  33250	   1216	 192588	  2f04c	4965-mac.o

(gcc version 7.2.0 x86_64)
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Acked-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Wireless device may send "channel changed" event before driver
registered this device with wireless core, which will result in
warnings.
Once device is registered, higher layer will query channel info
manually using .get_channel callback.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>