ieee80211_rx_status::chains was always set to zero.
That caused rate scaling to always start with the
lowest rate possible (rs_get_initial_rate).
Set it correctly according to the MPDU response.
Signed-off-by: NShaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Fix child-node lookup during probe, which ended up searching the whole
device tree depth-first starting at the parent rather than just matching
on its children.

To make things worse, the parent mmio node was also prematurely freed.

Fixes: fd52bdae ("wcn36xx: Disable 5GHz for wcn3620")
Cc: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Make sure 16-byte mic is removed from the rx data packet
tail when CCMP-256, GCMP and GCMP-256 ciphers are used
in raw decap mode. This fixed rx traffic failures in those
ciphers in raw mode. Split the helper returning crypto
tail length into two, one to get the ICV length and other
to get the mic lengh for the cipher to make it clean.

Fixes: 2ea9f12c ("ath10k: add new cipher suite support")
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

In the cases where len is too long, the error return path fails to
kfree allocated buffers buf and usb_reg_buf.  The simplest fix is to
perform the sanity check on len before the allocations to avoid having
to do the kfree'ing in the first place.

Detected by CoverityScan, CID#1452258,1452259 ("Resource Leak")

Fixes: 59f73e2a ("rsi: check length before USB read/write register")
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

iwlwifi 9000 and a0000 series hw contains an extra dash in firmware
file name as seeen in modinfo output for kernel 4.14:

firmware:       iwlwifi-9260-th-b0-jf-b0--34.ucode
firmware:       iwlwifi-9260-th-a0-jf-a0--34.ucode
firmware:       iwlwifi-9000-pu-a0-jf-b0--34.ucode
firmware:       iwlwifi-9000-pu-a0-jf-a0--34.ucode
firmware:       iwlwifi-QuQnj-a0-hr-a0--34.ucode
firmware:       iwlwifi-QuQnj-a0-jf-b0--34.ucode
firmware:       iwlwifi-QuQnj-f0-hr-a0--34.ucode
firmware:       iwlwifi-Qu-a0-jf-b0--34.ucode
firmware:       iwlwifi-Qu-a0-hr-a0--34.ucode

Fix that by dropping the extra adding of '"-"'.
Signed-off-by: NThomas Backlund <tmb@mageia.org>
Cc: stable@vger.kernel.org # 4.13
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

A lot of PCI IDs were missing and there were some problems with the
configuration and firmware selection for devices on the 9000 series.
Fix the firmware selection by adding files for the B-steps; add
configuration for some integrated devices; and add a bunch of PCI IDs
(mostly for integrated devices) that were missing from the driver's
list.

Without this patch, a lot of devices will not be recognized or will
try to load the wrong firmware file.

Cc: stable@vger.kernel.org # 4.13
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

According to the description, first argument of genlmsg_nlhdr() points to
what genlmsg_put() returns, i.e. beginning of user header. Therefore we
should only subtract size of genetlink header and netlink message header,
not user header.

This also means we don't need to pass the pointer to genetlink family and
the same is true for genl_dump_check_consistent() which is the only caller
of genlmsg_nlhdr(). (Note that at the moment, these functions are only
used for families which do not have user header so that they are not
affected.)

Fixes: 670dc283 ("netlink: advertise incomplete dumps")
Signed-off-by: NMichal Kubecek <mkubecek@suse.cz>
Reviewed-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Newer firmware versions (such as iwlwifi-8000C-34.ucode) have
introduced an API change in the SCAN_REQ_UMAC command that is not
backwards compatible.  The driver needs to detect and use the new API
format when the firmware reports it, otherwise the scan command will
not work properly, causing a command timeout.

Fix this by adding a TLV that tells the driver that the new API is in
use and use the correct structures for it.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=197591

Fixes: d7a5b3e9 ("iwlwifi: mvm: bump API to 34 for 8000 and up")
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The firmware for brcmfmac devices includes information regarding
regulatory constraints. For certain devices this information is kept
separately in a binary form that needs to be downloaded to the device.
This patch adds support to download this so-called CLM blob file. It
uses the same naming scheme as the other firmware files with extension
of .clm_blob.

The CLM blob file is optional. If the file does not exist, the download
process will be bypassed. It will not affect the driver loading.
Reviewed-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NChung-Hsien Hsu <stanley.hsu@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

"INVALID_STATE" is already being returned in the default case and this
code cannot be reached.

Addresses-Coverity-ID: 1398384
Signed-off-by: NGustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

rt2x00 uses the deprecated do_gettimeofday() function to get a timestamp
for its debugfs "dump" file interface.

The timestamp is using an unsigned 32-bit value, so we could make it
work until 2106 by using ktime_get_real_ts64(), but it seems better to
use monotonic times, as we normally want for timestamps.

Since this is an interface change, I'm incrementing the
DUMP_HEADER_VERSION number, so user space can figure out whether the
timestamps are monotonic or not. Most likely the tools won't care either
way.

Generally speaking, ABI version numbers and in particular changing them
is a bad idea. However since this is in debugfs, we don't put any
API stability rules on the interface according to
Documentation/filesystems/debugfs.txt, and we can take the easy way
out here; anyone using the frame dump feature can probably work out
the differences here.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

ENOENT usb error mean "specified interface or endpoint does not exist or
is not enabled". Mark device not present when we encounter this error
similar like we do with ENODEV error.

Otherwise we can have infinite loop in rt2x00usb_work_rxdone(), because
we remove and put again RX entries to the queue infinitely.

We can have similar situation when submit urb will fail all the time
with other error, so we need consider to limit number of entries
processed by rxdone work. But for now, since the patch fixes
reproducible soft lockup issue on single processor systems
and taken ENOENT error meaning, let apply this fix.

Patch adds additional ENOENT check not only in rx kick routine, but
also on other places where we check for ENODEV error.
Reported-by: NRichard Genoud <richard.genoud@gmail.com>
Debugged-by: NRichard Genoud <richard.genoud@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Tested-by: NRichard Genoud <richard.genoud@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Specifically, following parameters are needed for wireless device
configuration but were not available to it before:
- HT/VHT capabilities and capabilities masks.
- full channel info (not just IEEE number)
- BSSID hint
- previous BSSID for reassoc request

Move Management Frame Protection setting from common encr info
structure into STA-specific .connect command parameters.

Make sure that all new qlink structure definitions are alignment-safe.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Reviewed-by: NSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Include HT/VHT caps directly into command so that they won't have
to be searched for in IEs.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Current logic artificially divides "start AP" procedure into three
stages:
- generic interface configuration (security, channel etc)
- IE's processing
- enable AP mode on interface

This separation would not allow to do a proper device configuration as
first stage needs to use information from IEs that are processed on
a second stage. Which means first and second stages have to be meged.
In that case there is no point anymore to keep third stage either, so
merge all three into a single command.

This new command carries all the same info as contained in
"struct cfg80211_ap_settings".
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Data contained within "Append IEs" command (QLINK_CMD_MGMT_SET_APPIE)
duplicates QTN_TLV_ID_IE_SET TLV. Convert the command to use that TLV
instead.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

"IE set" TLV carries the same information as
qlink_event_scan_result::frame_type. Convert the event to make use of
TLV and drop frame_type member.
While at it, make qlink_event_scan_result structure alignement-safe.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Specifying frame type for "IE set" TLV will allow to use several
TLVs in a single message.
Modify users accordingly.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Supported WiFi operation modes are now identified per-band based on
HT/VHT capabilities of each band.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Information on which HT/VHT capabilities can be overridden is reported
per-MAC by wireless device.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

HT/VHT capabilities must be reported per each band supported by a radio,
not for all bands on a radio. Furthermore, driver better not assume
any capabilities and just use whetever is reported by device itself.

To support this, convert "get channels" command into "get band info"
command. Difference is that it may also carry HT/VHT capabilities along
with channels information.

While at it, also add "num_bitrates" field to "get band info" command,
for future use.
Signed-off-by: NIgor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The configuration of the IEs for probe requests was done in a P2P
related function, which is not very obvious. Moving it to
.scan callback function, ie. brcmf_cfg80211_scan().
Reviewed-by: NHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: NFranky Lin <franky.lin@broadcom.com>
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The field struct brcmf_cfg80211_info::active_scan is set to true upon
initializing the driver instance, but it is never changed so simply
get rid of it.
Reviewed-by: NHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: NFranky Lin <franky.lin@broadcom.com>
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The function brcmf_cfg80211_escan() is only called by brcmf_cfg80211_scan()
so there is no reason to split in two function especially since the latter
does not do an awful lot.
Reviewed-by: NHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: NFranky Lin <franky.lin@broadcom.com>
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Minor cleanup using provided macro to convert milliseconds interval
to jiffies in brcmf_cfg80211_escan().
Reviewed-by: NHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: NFranky Lin <franky.lin@broadcom.com>
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The function brcmf_cfg80211_escan() was always called with a non-null
request parameter and null pointer for this_ssid parameter. Clean up
the function removing the dead code path.
Reviewed-by: NHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: NFranky Lin <franky.lin@broadcom.com>
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Disable arp and nd offload to allow all packets sending to host.
Reported-by: NPhil Elwell <phil@raspberrypi.org>
Tested-by: NPhil Elwell <phil@raspberrypi.org>
Reviewed-by: NArend Van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NFranky Lin <franky.lin@broadcom.com>
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The firmware uses a mailbox to communicate to the host what is going
on. In the driver we validate the bit received. Various people seen
the following message:

 brcmfmac: brcmf_sdio_hostmail: Unknown mailbox data content: 0x40012

Bit 4 is cause of this message, but this actually indicates the firmware
has halted. Handle this bit by giving a more meaningful error message.
Reviewed-by: NHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: NFranky Lin <franky.lin@broadcom.com>
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Variable framelen is assigned but never read, hence it is redundant
and can be removed. Cleans up clang warning:

drivers/net/wireless/zydas/zd1201.c:234:3: warning: Value stored
to 'framelen' is never read
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The pointer dev is assigned but never read, hence it is redundant
and can be removed. Cleans up clang warning:

drivers/net/wireless/intersil/orinoco/orinoco_usb.c:1468:2: warning:
Value stored to 'dev' is never read
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Pointer sta_priv is assigned but never read, hence it is redundant
and can be removed. Cleans up clang warning:

drivers/net/wireless/intel/iwlegacy/4965-rs.c:2163:2: warning: Value
stored to 'sta_priv' is never read
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

cfg_cmd is initialized to zero and this value is never read, instead
it is over-written in the start of a do-while loop. Remove the
redundant initialization. Cleans up clang warning:

drivers/net/wireless/realtek/rtlwifi/core.c:1750:22: warning: Value
stored to 'cfg_cmd' during its initialization is never read
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

tid_data is assigned but never read, hence it is redundant
and can be removed. Cleans up clang warning:

drivers/net/wireless/realtek/rtlwifi/base.c:1581:2: warning: Value
stored to 'tid_data' is never read
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The calculation of ppsc->last_wakeup_time is not y2038-safe, but
the variable is not used at all, so we can simply drop it.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

do_gettimeofday() is deprecated and slower than necessary for the purpose
of reading the seconds. This changes rtl_op_suspend/resume to use
ktime_get_real_seconds() instead, which is simpler and avoids confusion
about whether it is y2038-safe or not.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

We set rtlhal->last_suspend_sec to an uninitialized stack variable,
but unfortunately gcc never warned about this, I only found it
while working on another patch. I opened a gcc bug for this.

Presumably the value of rtlhal->last_suspend_sec is not all that
important, but it does get used, so we probably want the
patch backported to stable kernels.

Cc: stable@vger.kernel.org
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82839Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

8822be checks H2CQ by int_d, so we extend to four ISR.
Also, irq_mask is extended to four.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Yan-Hsuan Chuang <yhchuang@realtek.com>
Cc: Birming Chiu <birming@realtek.com>
Cc: Shaofu <shaofu@realtek.com>
Cc: Steven Ting <steventing@realtek.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When the driver for the RTL8822BE is added, it will need an ID for
further use.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Yan-Hsuan Chuang <yhchuang@realtek.com>
Cc: Birming Chiu <birming@realtek.com>
Cc: Shaofu <shaofu@realtek.com>
Cc: Steven Ting <steventing@realtek.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With the RTL8822BE, an H2C tx queue is added to download FW and special
data. This change implements the support code in rtl_pci.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Yan-Hsuan Chuang <yhchuang@realtek.com>
Cc: Birming Chiu <birming@realtek.com>
Cc: Shaofu <shaofu@realtek.com>
Cc: Steven Ting <steventing@realtek.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The number of TX/RX BD desc for 8822BE is 512.
The TX/RX BD architecture of 8822BE is the same as 8192EE.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Yan-Hsuan Chuang <yhchuang@realtek.com>
Cc: Birming Chiu <birming@realtek.com>
Cc: Shaofu <shaofu@realtek.com>
Cc: Steven Ting <steventing@realtek.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>