Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

New Broadcom drivers don't upload it anymore. It was probably a copy & paste
mistake in early N-PHY rev 3+ days.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Register B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b
functions isn't safe. On my machine it causes delayed (!) CPU exception:

Disabling lock debugging due to kernel taint
mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f
mce: [Hardware Error]: TSC 164083803dc
mce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0
mce: [Hardware Error]: Run the above through 'mcelog --ascii'
mce: [Hardware Error]: Machine check: Processor context corrupt
Kernel panic - not syncing: Fatal machine check on current CPU
Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org> [2.6.35+]
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Instead of an explicit cast, use the min_t macro.
Signed-off-by: NSilvan Jegen <s.jegen@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NZhao, Gang <gamerh2o@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Logically, config B43_BCMA_PIO should depend on B43. This also solves
the problem that sub options of b43 driver didn't indent correctly in
make menuconfig's ncurses window.
Signed-off-by: NZhao, Gang <gamerh2o@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use ieee80211_channel_to_frequency() to replace b43_channel_to_freq_{2,5}ghz(),
and remove unused b43_freq_to_channel_{2,5}ghz().
Signed-off-by: NZHAO Gang <gamerh2o@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use the right function to update frequency value.

If rx skb is probe response or beacon, the wrong frequency value can
cause problem that bss info can't be updated when it should be.

Cc: <stable@vger.kernel.org>
Fixes: 8318d78a ("cfg80211 API for channels/bitrates, mac80211
and driver conversion")
Signed-off-by: NZHAO Gang <gamerh2o@gmail.com>
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The asyncronous firmware load uses a completion struct to hold firmware
processing until the user-space routines are up and running. There is.
however, a problem in that the waiter is nevered canceled during teardown.
As a result, unloading the driver when firmware is not available causes an oops.

To be able to access the completion structure at teardown, it had to be moved
into the b43_wldev structure.

This patch also fixes a typo in a comment.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported
when b43 is used with hostapd, and rfkill is used to kill the radio output.

The lockdep splat (in part) is as follows:

======================================================
[ INFO: possible circular locking dependency detected ]
3.12.0 #1 Not tainted
-------------------------------------------------------
rfkill/10040 is trying to acquire lock:
 (rtnl_mutex){+.+.+.}, at: [<ffffffff8146f282>] rtnl_lock+0x12/0x20

but task is already holding lock:
 (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa04832ca>] rfkill_fop_write+0x6a/0x170 [rfkill]

--snip--

Chain exists of:
  rtnl_mutex --> misc_mtx --> rfkill_global_mutex

The fix is to move the initialization of the hardware random number generator
outside the code range covered by the rtnl_mutex.
Reported-by: Nyury <urykhy@gmail.com>
Tested-by: Nyury <urykhy@gmail.com>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On the ternary expression the 'e' variable could be NULL dereferenced,
when b43_nphy_get_rf_ctl_over_rev7 function returns NULL.
Signed-off-by: NFelipe Pena <felipensp@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Convert the memset/memcpy uses of 6 to ETH_ALEN
where appropriate.

Also convert some struct definitions and u8 array
declarations of [6] to ETH_ALEN.
Signed-off-by: NJoe Perches <joe@perches.com>
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Replace the following sequence:

	dma_set_mask(dev, mask);
	dma_set_coherent_mask(dev, mask);

with a call to the new helper dma_set_mask_and_coherent().
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

__GFP_ZERO is an uncommon flag and perhaps is better
not used.  static inline dma_zalloc_coherent exists
so convert the uses of dma_alloc_coherent with __GFP_ZERO
to the more common kernel style with zalloc.

Remove memset from the static inline dma_zalloc_coherent
and add just one use of __GFP_ZERO instead.

Trivially reduces the size of the existing uses of
dma_zalloc_coherent.

Realign arguments as appropriate.
Signed-off-by: NJoe Perches <joe@perches.com>
Acked-by: NNeil Horman <nhorman@tuxdriver.com>
Acked-by: NJesse Brandeburg <jesse.brandeburg@intel.com>
Acked-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Tell the PCIe host core when the wifi is activated.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This allows enabling support for extra hardware with just a module
param, without kernel/module recompilation.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

N-PHY and HT-PHY support is more or less stable and should be activated
by default.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When b43 gets build into the kernel and it should use bcma we have to
ensure that bcma was also build into the kernel and not as a module.
In this patch this is also done for SSB, although you can not
build b43 without ssb support for now.

This fixes a build problem reported by Randy Dunlap in
5187EB95.2060605@infradead.org
Reported-By: NRandy Dunlap <rdunlap@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.

CVE-2013-2852
Signed-off-by: NKees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add handling of rx descriptor underflow. This fixes a fault that could
happen on slow machines, where data is received faster than the CPU can
handle. In such a case the device will use up all rx descriptors and
refuse to send any more data before confirming that it is ok. This
patch enables necessary interrupt to discover such a situation and will
handle them by dropping everything in the ring buffer.
Reviewed-by: NMichael Buesch <m@bues.ch>
Signed-off-by: NThommy Jakobsson <thommyj@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All radio ops are 16b (there is only 1 exception for reg 0x1), so we
deprecated b43_radio_read16 and b43_radio_write16 long time ago.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Sort defines, use one macro for all revs, support for 5GHz when
uploading antenna table.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Also make a function name shorter so we can easily fit 80 chars.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Thanks to Broadcom releasing some code we can use better names.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

In MMIO dumps of ndiswrapper there are following PHY ops:
phy_read(0x0118) -> 0x013d
phy_read(0x01ed) -> 0x993d
phy_read(0x0119) -> 0x012f
phy_read(0x01ee) -> 0x992f
phy_read(0x011a) -> 0x0139
phy_read(0x0969) -> 0x9939
It matches the code of wlc_phy_txpower_est_power_nphy (from brcm80211),
so we know the registers meaning.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

After b43_phy_ht_tx_power_ctl_setup there are some extra radio ops:
 radio_read(0x08bf) -> 0x0001
radio_write(0x08bf) <- 0x0001
radio_write(0x0159) <- 0x0011
On N-PHY we write 0x11 to TSSI regs, so it's probably sth similar.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>