A few configuration structures were either not referenced anymore or
assigned to devices IDs that were not in use anymore.  Remove them.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Validate that the queue ID is in range before trying to use it as
an index or for test_bit() - the previous bug showed that this has
in fact happened, and it was lucky that we caught it there, had the
bit been set then we'd have actually used the value despite being
far out of range.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

If we have only 2k RBs like on the latest (AX210) hardware, then
even on x86 where PAGE_SIZE is 4k we currently waste half of the
memory.

If this is the case, return partial pages from the allocator and
track the offset in each RBD (to be able to find the data in them
and remap them later.)

This might also address other platforms with larger PAGE_SIZE by
putting more RBs into a single large page.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

We don't need to map *everything* of the RX buffers, we won't use
that much, map only the part we're going to use. This save some
IOMMU space (if applicable and it can deal with that) and also
prepares a bit for mapping partial pages for 2K buffers later.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

For HE-capable devices, we need to allocate more receive buffers as
there could be 256 frames aggregated into a single A-MPDU, and then
they might contain A-MSDUs as well. Until 22000 family, the devices
are able to put multiple frames into a single RB and the default RB
size is 4k, but starting from AX210 family this is no longer true.
On the other hand, those newer devices only use 2k receive buffers
(by default).

Modify the code and configuration to allocate an appropriate number
of RBs depending on the device capabilities:

 * 4096 for AX210 HE devices, which use 2k buffers by default,
 * 2048 for 22000 family devices which use 4k buffers by default,
 * 512 for existing 9000 family devices, which doesn't really
   change anything since that's the default before this patch,
 * 512 also for AX210/22000 family devices that don't do HE.

Theoretically, for devices lower than AX210, we wouldn't have to
allocate that many RBs if the RB size was manually increased, but
to support that the code got more complex, and it didn't really
seem necessary as that's a use case for monitor mode only, where
hopefully the wasted memory isn't really much of a concern.

Note that AX210 devices actually support bigger than 12-bit VID,
which is required here as we want to allocate 4096 buffers plus
some for quick recycling, so adjust the code for that as well.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The new API requires the driver to config the supported frame format
(legacy, HT, VHT etc.).
Signed-off-by: NAvraham Stern <avraham.stern@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The new API requires the driver to set the frame format
(legacy, HT, VHT etc.) to be used for the measurement.

The new API also supports 11az and secured measurement, but
these are not supported by the driver for now.
Signed-off-by: NAvraham Stern <avraham.stern@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The fw already support scan api v12,
v11 is not needed anymore.
Signed-off-by: NTova Mussai <tova.mussai@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Before we start looping over the internal TX FIFOs increase the fifo
number, but that's incorrect and causes a FIFO to be skipped.  This is
probably due to a copy and paste from the previous loop.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

This fixes a long-standing bug - we haven't been able to check the
firmware image that was loaded for D3/not-D3 since the introduction
of the unified image...

Fix this by keeping a status flag for D3 instead of checking for
the firmware image that's loaded.

This reduces occurrences of checks for IWL_UCODE_WOWLAN to just the
code that actually loads the image or deals with it in other ways.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The FIELD_SIZEOF() macro was redundant, and is being removed from the
kernel. Since commit c593642c ("treewide: Use sizeof_field() macro")
this is one of the last users of the old macro, so replace it.
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Three of the WMI command handlers were not casting to the right data type.
Lets make the code consistent with the other handlers.
Signed-off-by: NJohn Crispin <john@phrozen.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

set_cqm_rssi_config() is used by the kernel to configure connection
quality monitor RSSI threshold.
wil6210 uses WMI_SET_LINK_MONITOR_CMDID to set the RSSI threshold to
FW which in turn reports RSSI threshold changes with
WMI_LINK_MONITOR_EVENTID.
Signed-off-by: NDedy Lansky <dlansky@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Wil6210 AP has a separate ring for transmitting multicast packets,
multicast packets are transmitted without an ack from the receiver side.
Therefore, 802.11 spec defines some low MCS rates for multicat packets.
However, there is no guarantee that these packets were really received
and handled on the client side.

Some applications that rely on multicast packets, may prefer to
transmit these packets as a unicast to ensure reliability, and also
to ensure better performance with high MCS rates.
multicast to unicast is done by duplicating multicast packets to all
clients and changing the DA (multicast) to the MAC address of the
client.
see NL80211_CMD_SET_MULTICAST_TO_UNICAST for more info.
Signed-off-by: NAhmad Masri <amasri@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Fix incorrect definitions of MAC ID bits inside Rx status message.
Signed-off-by: NDedy Lansky <dlansky@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

ucode_debug memory region defined as 4K bytes. Fix this according to
Talyn device memory map.
Signed-off-by: NDedy Lansky <dlansky@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

max_assoc_sta can receive values (from the user or from the FW)
that are higher than WIL6210_MAX_CID.
Verify that cid doesn't exceed the upper bound of WIL6210_MAX_CID.
Signed-off-by: NAlexei Avshalom Lazar <ailizaro@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

On some crash dump cases mem_lock is already taken, error
returns and crash dump copy fails.
In this case wait until mem_lock available instead of failing
the operation.
Also take the mem_lock for writing to prevent other threads from
altering the state of the device while collecting crash dump.
Signed-off-by: NAlexei Avshalom Lazar <ailizaro@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

mem_lock is taken for the entire wil_reset().
Optimize this by taking mem_lock just before device is
being reset and release the lock after FW download.
Signed-off-by: NAlexei Avshalom Lazar <ailizaro@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Dump all the Rx status message on different errors to allow more
visibility of the case.
Signed-off-by: NAhmad Masri <amasri@codeaurora.org>
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In ezusb_init, if upriv is NULL, the code crashes. However, the caller
in ezusb_probe can handle the error and print the failure message.
The patch replaces the BUG_ON call to error return.
Signed-off-by: NAditya Pakki <pakki001@umn.edu>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

NVIDIA Tegra SoCs do not like when OOB wake is enabled and WiFi interface
is in DOWN state during suspend. This results in a CPU hang on programming
OOB wake-up state of the GPIO controller during of system's suspend.

The solution is trivial: don't enable wake for the OOB interrupt when it
should be disabled.

This fixes hang on Tegra20 (Acer A500) and Tegra30 (Nexus 7) devices which
are using BCM4329 and BCM4330 WiFi chips respectively.
Signed-off-by: NDmitry Osipenko <digetx@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In the implementation of brcmf_usbdev_qinit() the allocated memory for
reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
handling path.

Fixes: 71bb244b ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
Signed-off-by: NNavid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With RSDB mode, FMAC and firmware are able to create 2 or more AP,
so we should not set mbss in vif structure if firmware does not
support MBSS feature.
Signed-off-by: NWright Feng <wright.feng@cypress.com>
Signed-off-by: NSoeren Moch <smoch@web.de>
Reviewed-by: NChi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With firmware RSDB feature
1. The maximum support interface is four.
2. The maximum difference channel is two.
3. The maximum interfaces of {station/p2p client/AP} are two.
4. The maximum interface of p2p device is one.
Signed-off-by: NWright Feng <wright.feng@cypress.com>
Signed-off-by: NSoeren Moch <smoch@web.de>
Reviewed-by: NChi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

BCM4359 is a 2x2 802.11 abgn+ac Dual-Band HT80 combo chip and it
supports Real Simultaneous Dual Band feature.

Based on a similar patch by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: NSoeren Moch <smoch@web.de>
Acked-by: NChi-Hsien Lin <chi-hsien.lin@cypress.com>
Acked-by: NUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

4359 dongles do not support setting roaming parameters (error -52).
Do not fail the 80211 configuration in this case.
Signed-off-by: NSoeren Moch <smoch@web.de>
Acked-by: NChi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Newer 4359 chip revisions need a different rambase address.
This fixes firmware download on such devices which fails otherwise.
Signed-off-by: NSoeren Moch <smoch@web.de>
Acked-by: NChi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Set F2 blocksize to 256 bytes and watermark to 0x40 for 4359. Also
enable and configure F1 MesBusyCtrl. It fixes DMA error while having
UDP bi-directional traffic.
Signed-off-by: NChung-Hsien Hsu <stanley.hsu@cypress.com>
[slightly adapted for rebase on mainline linux]
Signed-off-by: NSoeren Moch <smoch@web.de>
Reviewed-by: NChi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

There are two D11 cores in RSDB chips like 4359. We have to reset two
D11 cores simutaneously before firmware download, or the firmware may
not be initialized correctly and cause "fw initialized failed" error.
Signed-off-by: NWright Feng <wright.feng@cypress.com>
Signed-off-by: NSoeren Moch <smoch@web.de>
Reviewed-by: NChi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Function _rtl92de_signal_scale_mapping is identical to the generic
version rtl_signal_scale_mapping. Remove _rtl92de_signal_scale_mapping
and use the generic function.
Signed-off-by: NMichael Straube <straube.linux@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Function _rtl92c_signal_scale_mapping is identical to the generic
version rtl_signal_scale_mapping. Remove _rtl92c_signal_scale_mapping
and use the generic function.
Signed-off-by: NMichael Straube <straube.linux@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Function _rtl92ce_signal_scale_mapping is identical to the generic
version rtl_signal_scale_mapping. Remove _rtl92ce_signal_scale_mapping
and use the generic function.
Signed-off-by: NMichael Straube <straube.linux@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Function _rtl92d_query_rxpwrpercentage is identical to the generic
version rtl_query_rxpwrpercentage. Remove _rtl92d_query_rxpwrpercentage
and use the generic function.
Signed-off-by: NMichael Straube <straube.linux@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Function _rtl92c_query_rxpwrpercentage is identical to the generic
version rtl_query_rxpwrpercentage. Remove _rtl92c_query_rxpwrpercentage
and use the generic function.
Signed-off-by: NMichael Straube <straube.linux@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Function _rtl92c_query_rxpwrpercentage is identical to the generic
version rtl_query_rxpwrpercentage. Remove _rtl92c_query_rxpwrpercentage
and use the generic function.
Signed-off-by: NMichael Straube <straube.linux@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Make sure to use the current alternate setting when verifying the
storage interface descriptors to avoid submitting an URB to an invalid
endpoint.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: a1030e92 ("[PATCH] zd1211rw: Convert installer CDROM device into WLAN device")
Cc: stable <stable@vger.kernel.org>     # 2.6.19
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: dad0d04f ("rsi: Add RS9113 wireless driver")
Cc: stable <stable@vger.kernel.org>     # 3.15
Cc: Fariya Fatima <fariyaf@gmail.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 26f1fad2 ("New driver: rtl8xxxu (mac80211)")
Cc: stable <stable@vger.kernel.org>     # 4.4
Cc: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 9afac70a ("orinoco: add orinoco_usb driver")
Cc: stable <stable@vger.kernel.org>     # 2.6.35
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>