Add new 8265 series SDIO ID.
Signed-off-by: NMordechai Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Support sending P2P device frames should be sent from
queue #2, as required in DQA mode.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In DQA mode, allocate a dedicated queue (#9) for P2P GO/soft
AP probe responses.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The TSO code creates A-MSDUs from a single large send. Each
A-MSDU is an skb and skb->len doesn't include the number of
bytes which need to be added for the headers being added
(subframe header, TCP header, IP header, SNAP, padding).

To be able to set the right value in the Tx command, we
put the number of bytes added by those headers in
driver_data in iwl_mvm_tx_tso and use this value in
iwl_mvm_set_tx_cmd.

The problem by setting this value in driver_data is that
it overrides the ieee80211_tx_info. The bug manifested
itself when we send P2P related frames in CCK since the
rate in ieee80211_tx_info is zero-ed. This of course is
a violation of the P2P specification.

To fix this, copy the original ieee80211_tx_info to the
stack and pass it to the functions which need it.
Assign the number of bytes added by the headers to the
driver_data inside the skb itself.

Fixes: a6d5e32f ("iwlwifi: mvm: send large SKBs to the transport")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This enum is already perfectly aliased to enum nl80211_band, and
the only reason for it is that we get IEEE80211_NUM_BANDS out of
it. There's no really good reason to not declare the number of
bands in nl80211 though, so do that and remove the cfg80211 one.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The firwmare file can come with data that is relevant for paging. This
data is availablet to the firmware upon request, but it stored in the
host's memory. During the firmware init flow, the driver configures the
firmware so that the firwmare knows where is the data.
When paging is used, the variable paging_mem_size is the number of bytes
that are available through paging. This variable is not zeror-ed if the
driver fails to configure the paging in the firmware, but the memory is
freed which is inconsistent.
This inconsistency led to a NULL pointer dereference in the code that
collects the debug data.

Fix this by zero-ing the paging_mem_size variable and NULLify the
relevant pointers, so that the code that collects the debug data will
know that the paging data is not available.
Signed-off-by: NMatti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The firwmare name for 8000 is iwlwifi-8000C. The C is
appended based on a value read from a register. This
allows to load different firwmare versions based on
the hardware step during development. Now that the
hardware development is completed, we can hard code
the 'C' and along the way, fix the input to
MODULE_FIRMWARE.

This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=116041Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Gscan capabilities were updated with new capabilities supported
by the device. Update GSCAN capabilities TLV and avoid to WARN
if the firmware does not have the new capabilities.
Signed-off-by: NAyala Beker <ayala.beker@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add new 8265 series PCI IDs.
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This patch prints pcie scratch registers during firmware dump. They
will be useful for analysing firmware status.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch processes sub AMSDU frame received in AP mode.

If a packet is multicast/broadcast, it is sent to kernel/upper
layer as well as queued back to AP TX queue so that it can be
sent to other associated stations.

If a packet is unicast and RA is present in associated station list,
it is again requeued into AP TX queue.

If a packet is unicast and RA is not in associated station list,
packet is forwarded to kernel to handle routing logic.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Bridge packets are enqueued to wmm tx queue, but will not be sent
until main workqeue is scheduled for new interrupt or other
reason. This adds unnecessary delay during traffic.

We will schedule main workqueue when bridge packet is queued.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

skb forwarded to TCP/IP stack doesn't need to allocate in DMA ZONE.
This patch removes GFP_DMA flag in this case to save precious DMA
memory.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Some of the chipsets have two revisions. This patch
selects appropriate firmware by checking revision id.
Signed-off-by: NShengzhen Li <szli@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

User can configure wakeup on GTK rekey fail with wowlan.
Added corresponding wakeup reason.
Signed-off-by: NGanapathi Bhat <gbhat@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Added driver functionality to offload GTK rekey to firmware. When
AP sends new GTK, firmware will update it.
Signed-off-by: NGanapathi Bhat <gbhat@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Per the vendor driver, it looks like the 8192eu doesn't have LDOA15 /
LDOV12 registers.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The 8192eu uses the same H2C API as the 8723bu. Call the correct
functions for update_rate_mask() and report_connect().
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

8192eu A/B cut parts were incorrectly identified as 8192cu devices.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With support for more chips being added, use an enum to specify the
chip version.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Improve descriptive names of some registers and add some additional
registers only found on nextgen chips.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

8192eu uses the new TX descriptor format
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This is no short GI bit in the txdesc40 format.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

txdesc40 dword2 gid is a 6 bit field, not a single bit
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With the size based naming of TX descriptors. Change the bit
definition namings to indicate which descriptor format they match,
rather than having a device name in the bit name.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

There are two major types of TX descriptor formats for the RTL parts,
the old 32 byte descriptor, and the newer 40 byte descriptor used by
the 8723bu, 8192eu, and 88xx series.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In mwifiex_enable_hs, we need to check if
priv->wdev.wiphy->wowlan_config is NULL before accessing its member.
This sometimes cause kernel panic when suspend/resume.
Signed-off-by: NWei-Ning Huang <wnhuang@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

ap_ie->ie_list is an array of struct mwifiex_ie and can never
be null, so the null check on this array is redundant and can
be removed.
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In some of the non-success return paths, the memory allocated by
iwl4965_sta_alloc_lq() in iwl4965_alloc_bcast_station() is not freed.

In particular:
 - if the card isn't ready after il4965_prepare_card_hw()
 - if the card is hardware-rfkilled

In the hardware rfkilled path, the driver enables the rfkill
interrupt. When the card is unrfkilled and this interrupt is raised
we end up calling il4965_bg_restart() which calls __il4965_up() which
calls iwl4965_alloc_bcast_station() again.
Suggested-by: NJia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Acked-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When il4965_hw_nic_init in __il4965_up fails, the memory allocated by
iwl4965_sta_alloc_lq in iwl4965_alloc_bcast_station is not freed.

This patches adds il_dealloc_bcast_stations in the error handling code of
__il4965_up to fix this problem.

This patch has been tested in real device, and it actually fixes the bug.
Signed-off-by: NJia-Ju Bai <baijiaju1990@163.com>
Acked-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In rsi_send_data_pkt(), it's a little more logical to assign 'status' in
the actual error handling code as opposed to at the top of the functon.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
[Deleted controversial bits, rewrote commit message]
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In rsi_send_data_pkt(), the following variables are assigned to
before they're used:

 * tmp_hdr - Assigned on line 47, first used on line 48
 * bss - Assigned on line 41, first used on line 44
 * extnd_size - Assigned on line 50, first used on line 52
 * seq_num - Assigned on line 48, first used on line 96
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
[Rewrote commit message]
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In rsi_send_mgmt_pkt(), the following variables are assigned to
before they're used:

 * wh - Assigned on line 161, first used on line 180
 * bss - Assigned on line 160, first used on line 196
 * msg - Assigned on line 168, first used on line 175
 * extnd_size - Assigned on line 139, first used on line 142
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
[Rewrote commit message]
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When pci_request_regions in rtl8180_probe fails, pci_disable_device is not
called to disable the device which is enabled by pci_enbale_device.

This patch fixes the problem by adding a new lable in error handling code.
Signed-off-by: NJia-Ju Bai <baijiaju1990@163.com>
Acked-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The memory allocated by kzalloc in b43_bus_dev_ssb_init and
b43_bus_dev_bcma_init is not freed.
This patch fixes the bug by adding kfree in b43_ssb_remove,
b43_bcma_remove and error handling code of b43_bcma_probe.

Thanks Michael for his suggestion.
Signed-off-by: NJia-Ju Bai <baijiaju1990@163.com>
Tested-by: NSudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

If "txq->cmd = kzalloc(...)" in il_tx_queue_init fails,
"kfree(txq->cmd[i])" in il_tx_queue_free and il_cmd_queue_free
in iwl4965_hw_txq_ctx_free will causes a null pointer dereference,
because txq->cmd is NULL at that time.

This patch fixes this problem by adding a if-check before kfree.
To avoid double free in il_tx_queue_free and il_cmd_queue_free
caused by the fixing, txq->meta and txq->cmd in error handling code
of il_tx_queue_init are assigned null values.
Otherwise, a double free will occur.

This patch has been tested in real device, and it actually fixes the bug.
Thanks Stanislaw for his suggestion.
Signed-off-by: NJia-Ju Bai <baijiaju1990@163.com>
Acked-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Also remove an unused label.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Acked-by: NStanislaw Gruszka <sgruszka@redhat.com>
[Rewrote commit message]
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In brcmf_sdio_download_firmware(), bcmerror is set by the call to
brcmf_sdio_download_code_file(), before it's checked in the following
line.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Acked-by: NArend van Spriel <arend@broadcom.com>
[Rewrote commit message]
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In ath9k_hif_usb_rx_stream(), i is initialised in the for loop it's
used in.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Reviewed-by: NOleksij Rempel <linux@rempel-privat.de>
[Rewrote commit message]
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use to_delayed_work() instead of open-coding it.
Signed-off-by: NGeliang Tang <geliangtang@163.com>
[Update commit message]
Signed-off-by: NJulian Calaby <julian.calaby@gmail.com>
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>