Inside ath9k_hif_usb_firmware_fail(), the instance of
'struct struct hif_device_usb' may be freed by
ath9k_hif_usb_disconnect() after

	complete(&hif_dev->fw_done);

But 'hif_dev' is still accessed after the line code
above is executed.

This patch fixes the issue by not accessing 'hif_dev'
after 'complete(&hif_dev->fw_done)' inside
ath9k_hif_usb_firmware_fail().

Cc: ath9k-devel@lists.ath9k.org
Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com>
Cc: Jouni Malinen <jouni@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: NMing Lei <ming.lei@canonical.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It is not necessary to hold the firmware memory during the whole
driver lifetime, and obviously it does waste memory. Suppose there
are 4 ath9k-htc usb dongles working, kernel has to consume about
4*50KBytes RAM to cache firmware for all dongles. After applying the
patch, kernel only caches one single firmware image in RAM for
all ath9k-htc devices just during system suspend/resume cycle.

When system is ready for loading firmware, ath9k-htc can request
the loading from usersapce. During system resume, ath9k-htc still
can load the firmware which was cached in kernel memory before
system suspend.

Cc: ath9k-devel@lists.ath9k.org
Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com>
Cc: Jouni Malinen <jouni@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: NMing Lei <ming.lei@canonical.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Hub-initiated LPM is not good for USB communications devices.  Comms
devices should be able to tell when their link can go into a lower power
state, because they know when an incoming transmission is finished.
Ideally, these devices would slam their links into a lower power state,
using the device-initiated LPM, after finishing the last packet of their
data transfer.

If we enable the idle timeouts for the parent hubs to enable
hub-initiated LPM, we will get a lot of useless LPM packets on the bus
as the devices reject LPM transitions when they're in the middle of
receiving data.  Worse, some devices might blindly accept the
hub-initiated LPM and power down their radios while they're in the
middle of receiving a transmission.

The Intel Windows folks are disabling hub-initiated LPM for all USB
communications devices under a xHCI USB 3.0 host.  In order to keep
the Linux behavior as close as possible to Windows, we need to do the
same in Linux.

Set the disable_hub_initiated_lpm flag for for all USB communications
drivers.  I know there aren't currently any USB 3.0 devices that
implement these class specifications, but we should be ready if they do.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: Hansjoerg Lipp <hjlipp@web.de>
Cc: Tilman Schmidt <tilman@imap.cc>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: Peter Korsgaard <jacmet@sunsite.dk>
Cc: Jan Dumon <j.dumon@option.com>
Cc: Petko Manolov <petkan@users.sourceforge.net>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: Kalle Valo <kvalo@qca.qualcomm.com>
Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com>
Cc: Jouni Malinen <jouni@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
Cc: Christian Lamparter <chunkeey@googlemail.com>
Cc: Brett Rudley <brudley@broadcom.com>
Cc: Roland Vossen <rvossen@broadcom.com>
Cc: Arend van Spriel <arend@broadcom.com>
Cc: "Franky (Zhenhui) Lin" <frankyl@broadcom.com>
Cc: Kan Yan <kanyan@broadcom.com>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Cc: Ivo van Doorn <IvDoorn@gmail.com>
Cc: Gertjan van Wingerde <gwingerde@gmail.com>
Cc: Helmut Schaa <helmut.schaa@googlemail.com>
Cc: Herton Ronaldo Krzesinski <herton@canonical.com>
Cc: Hin-Tak Leung <htl10@users.sourceforge.net>
Cc: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Chaoming Li <chaoming_li@realsil.com.cn>
Cc: Daniel Drake <dsd@gentoo.org>
Cc: Ulrich Kunitz <kune@deine-taler.de>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>

Reported-by: NRyan Roper <ryan.roper@gmail.com>
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If the firmware was over 2G, it would cause memory corruption and the
system would die here.  Obviously we all know the firmware isn't going
to be that large but static checkers get upset.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch modifies ath9k_htc to load the needed
firmware in an asynchronous manner, fixing timeouts
that were introduced with the new udev changes.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This was reported and tested by Martin Walter over at AVM GmbH Berlin.
This also applies to 3.0.1 so sendint to stable.

Cc: s.kirste@avm.de
Cc: d.friedel@avm.de
Cc: Martin Walter <m.walter@avm.de>
Cc: Peter Grabienski <pgrabien@qca.qualcomm.com>
Cc: stable@kernel.org
Tested-by: NMartin Walter <m.walter@avm.de>
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

drivers/net/wireless/ath/ath9k/hif_usb.c +135 hif_usb_mgmt_cb(6) warn:
variable dereferenced before check 'cmd'
drivers/net/wireless/ath/ath9k/btcoex.c +77 ath9k_hw_init_btcoex_hw(38)
error: buffer overflow 'ah->hw_gen_timers.gen_timer_index' 32 <=
2009813776
Signed-off-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NPavel Roskin <proski@gnu.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

for more details please take a look at:
http://comments.gmane.org/gmane.linux.drivers.ath9k.devel/6541
http://www.wikidevi.com/wiki/Sony_UWA-BR100Reported-by: NThomas Novin <thomas@xyz.pp.se>
Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The Times They Are a-Changin'.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Otherwise, you get this:

  CC [M]  drivers/net/wireless/ath/ath9k/hif_usb.o
drivers/net/wireless/ath/ath9k/hif_usb.c: In function ‘ath9k_skb_queue_complete’:
drivers/net/wireless/ath/ath9k/hif_usb.c:230:12: error: expected expression before ‘do’
make[2]: *** [drivers/net/wireless/ath/ath9k/hif_usb.o] Error 1
make[1]: *** [drivers/net/wireless/ath/ath9k] Error 2
make: *** [drivers/net/wireless/ath/] Error 2

The TX_STAT_INC macro should probably be changed to accomodate such
usage, although using a trinary operator in place of an if-else seems
questionable to me anyway.
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
Acked-by: NSujith Manoharan <Sujith.Manoharan@Atheros.com>

Beacon transmission needs to involve as little latency
as possible after receiving a SWBA event from the target.
Since packets are buffered to use TX stream mode, beacon
frames sometimes gets queued up and are not sent out immediately.
Fix this by decoupling management frame transmission from the
normal data path and send them out immediately.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When a station entry is removed, there could still be
pending packets destined for that station in the HIF layer.
Sending these to the target is not necessary, so drain them
in the driver itself.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There is no point in looping over all the endpoints,
since the HIF layer uses the start/stop APIs only
for the TX pipe. Simplify the API accordingly.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When doing a channel set or a reset operation the pending
frames queued up for transmission have to be flushed and
sent to mac80211. Fixing this has to be done in two separate
steps:

  * Flush queued frames and kill the URB TX completion handler.
  * Complete all the frames that in the TX pending queue.

This patch adds proper support for draining and all the callsites
namely, channel change/reset/idle/stop are fixed. A separate queue
is used for handling failed frames.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Using a single URB for receiving WMI events is
insufficient, increase it to 64 to not lose
WMI events in high throughput situations.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

For all packets sent through the USB_WLAN_TX_PIPE endpoint,
the private area of the SKB's tx_info can be used to store
driver-specific information. For packets sent through USB_REG_OUT_PIPE,
this will not make a difference since they are routed through a
separate routine that doesn't access the private region.

This would help in situations where TX information is required
in the URB callback.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since the new FW requires backward incompatible host driver changes,
rename the FW to allow older driver versions to work with the
older FW.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All the AR7010 devices supoprted by ath9k_htc are based
on version v1.1, so remove support for v1.0.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Pass the correct module name and device interface so that
ethtool can display the proper values.

The firmware version will be fixed later on when the FW
can actually report a version. :)
Reported-by: NRichard Farina <sidhayn@gmail.com>
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Tested-by: NRichard Farina <sidhayn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The stream length/tag fields have to be in little endian
format. Fixing this makes the driver work on big-endian
platforms.

Cc: stable@kernel.org
Tested-by: raghunathan.kailasanathan@wipro.com
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

ath9k_hif_usb_alloc_urbs() takes care of freeing
all the allocated URBs for the various endpoints when
an error occurs. Calling ath9k_hif_usb_dealloc_urbs() would
cause a panic since the URBs have already been freed.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Some AR7010 based devices are recognized as storage media.
Sending a CD-EJECT command to the device will 'convert' it into
a WLAN device. Do this within the driver itself, removing the
dependancy on an external program (usb_modeswitch).
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When doing a channel change, the pending URBs have to be killed
properly on calling htc_stop().

This fixes the probe response timeout seen when sending UDP traffic at
a high rate and running background scan at the same time.

Cc: stable <stable@kernel.org>
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The commit "ath9k_hw: warn if we cannot change the power to the chip"
introduced a new warning to indicate chip powerup failures, but this
is not required for devices that have been removed. Handle USB device
removal properly by checking for unplugged status.

For PCI devices, this warning will still be seen when the card is pulled
out, not sure how to check for card removal.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The HW has to be set to FULLSLEEP mode during suspend,
when no interface has been brought up. Not doing this would
break resume, as the chip won't be powered up at all.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use the correct error condition exit in case firmware download
fails for some reason. Not doing so results in a panic:

usb 1-3: ath9k_htc: Transferred FW: ar9271.fw, size: 51280
usb 1-3: ath9k_htc: Firmware - ar9271.fw download failed
usb 1-3: ath9k_htc: Target is unresponsive
Failed to initialize the device
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
Pid: 2823, comm: insmod Tainted: G        W   2.6.37-rc4-wl #11
Call Trace:
[<ffffffff81090d7e>] __lock_acquire+0xe3e/0x1d00
[<ffffffff813a9f14>] ? restore_args+0x0/0x30
[<ffffffff81058af1>] ? vprintk+0x321/0x500
[<ffffffff81092290>] lock_acquire+0xa0/0x190
[<ffffffffa02a0eac>] ? usb_kill_anchored_urbs+0x1c/0x80 [usbcore]
[<ffffffff813a8ea8>] _raw_spin_lock_irq+0x48/0x60
[<ffffffffa02a0eac>] ? usb_kill_anchored_urbs+0x1c/0x80 [usbcore]
[<ffffffff813a53fd>] ? printk+0x3c/0x3f
[<ffffffffa02a0eac>] usb_kill_anchored_urbs+0x1c/0x80 [usbcore]
[<ffffffffa0055388>] ath9k_hif_usb_dealloc_urbs+0x18/0x40 [ath9k_htc]
[<ffffffffa00557d7>] ath9k_hif_usb_probe+0x227/0x3d0 [ath9k_htc]
[<ffffffffa02a56ac>] usb_probe_interface+0x10c/0x210 [usbcore]
[<ffffffff812ae826>] driver_probe_device+0x96/0x1c0
[<ffffffff812ae9f3>] __driver_attach+0xa3/0xb0
[<ffffffff812ae950>] ? __driver_attach+0x0/0xb0
[<ffffffff812ad6ae>] bus_for_each_dev+0x5e/0x90
[<ffffffff812ae4c9>] driver_attach+0x19/0x20
[<ffffffff812ae038>] bus_add_driver+0x168/0x320
[<ffffffff812aec71>] driver_register+0x71/0x140
[<ffffffff811fc338>] ? __raw_spin_lock_init+0x38/0x70
[<ffffffffa02a438c>] usb_register_driver+0xdc/0x190 [usbcore]
[<ffffffffa0063000>] ? ath9k_htc_init+0x0/0x4f [ath9k_htc]
[<ffffffffa005599e>] ath9k_hif_usb_init+0x1e/0x20 [ath9k_htc]
[<ffffffffa006302b>] ath9k_htc_init+0x2b/0x4f [ath9k_htc]
[<ffffffff8100212f>] do_one_initcall+0x3f/0x180
[<ffffffff8109ef9b>] sys_init_module+0xbb/0x200
[<ffffffff8100bf52>] system_call_fastpath+0x16/0x1b
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

ath.ko is a common module shared between ath5k, ar9170usb, ath9k and ath9k_htc.
Adding driver specific data to the shared structure would impact all the
drivers. Handling USB device recognition for devices specific to ath9k_htc
can be handled within the driver itself.

Also, AR7010 refers to the processor used in both AR9280/AR9287 based
devices. Rename the device enumerations accordingly.

While at it, check properly for the bus type when choosing the EEPROM
base address for UB95.
Signed-off-by: NSujith Manoharan <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Invert test and return early.
Move variable declarations to local scope.
Don't initialize variables to 0 unnecessarily.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Categorize AR7010 & AR9287 devices based on driver_info
of usb_device_id, instead of PIDs. This avoids per-device cases
and minimize code changes for new device addition.
Signed-off-by: NRajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Added driver_info to identify AR7010, R9287 HTC devices.
Signed-off-by: NRajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Treat new PIDs (0xA704, 0x1200) as AR7010 devices.

Cc: stable@kernel.org
Signed-off-by: NRajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Added new VID/PIDs into supported devices list

Cc: stable@kernel.org
Signed-off-by: NRajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since the endpoint descriptors (EP3 & EP4) were changed from Interrupt
to Bulk type by firmware, the urb submission done on Bulk pipes.
And the recent commit "check the endpoint type against the pipe type"
added aditional error checking against pipe types under CONFIG_USB_DEBUG.

So bmAttribute has to be updated for both EP3 & EP4 before submitting
urbs on that pipe. This patch resolves the following failure.

[ 2215.710936] usb 1-1: usb_probe_device
[ 2215.710945] usb 1-1: configuration #1 chosen from 1 choice
[ 2215.711152] usb 1-1: adding 1-1:1.0 (config #1, interface 0)
[ 2215.711252] ath9k_hif_usb 1-1:1.0: usb_probe_interface
[ 2215.711255] ath9k_hif_usb 1-1:1.0: usb_probe_interface - got id
[ 2215.712780] usb 1-1: BOGUS urb xfer, pipe 3 != type 1
[ 2215.713782] usb 1-1: ath9k_htc: Unable to allocate URBs
[ 2215.713801] ath9k_hif_usb: probe of 1-1:1.0 failed with error -22
Reported-by: NMing Lei <tom.leiming@gmail.com>
Signed-off-by: NRajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch adds support for USB dongle with device ID 3346 from IMC Networks.
Signed-off-by: NHaitao Zhang <minipanda@linuxrobot.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Netgear WNDA3200 device uses ar7010 firmware but it is failed to set
correct firmware offset on firmware download which causes device initialization
failure.

Cc: stable@kernel.org
Signed-off-by: NRajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

To optimize register read/write operations, the HTC firmwares were patched
to change EP3 and EP4 pipe types from Interrupt to Bulk. So register writes
are submitted as bulk urbs, but register reads are not. Also changing the
register read endpoint pipe as bulk type when URBs are filled improves the
register reads considerably which results in reduced scan time and CPU
utilization.
Signed-off-by: NRajkumar Manoharan <rmanoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>