The asyncronous firmware load uses a completion struct to hold firmware
processing until the user-space routines are up and running. There is.
however, a problem in that the waiter is nevered canceled during teardown.
As a result, unloading the driver when firmware is not available causes an oops.

To be able to access the completion structure at teardown, it had to be moved
into the b43_wldev structure.

This patch also fixes a typo in a comment.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported
when b43 is used with hostapd, and rfkill is used to kill the radio output.

The lockdep splat (in part) is as follows:

======================================================
[ INFO: possible circular locking dependency detected ]
3.12.0 #1 Not tainted
-------------------------------------------------------
rfkill/10040 is trying to acquire lock:
 (rtnl_mutex){+.+.+.}, at: [<ffffffff8146f282>] rtnl_lock+0x12/0x20

but task is already holding lock:
 (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa04832ca>] rfkill_fop_write+0x6a/0x170 [rfkill]

--snip--

Chain exists of:
  rtnl_mutex --> misc_mtx --> rfkill_global_mutex

The fix is to move the initialization of the hardware random number generator
outside the code range covered by the rtnl_mutex.
Reported-by: Nyury <urykhy@gmail.com>
Tested-by: Nyury <urykhy@gmail.com>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On the ternary expression the 'e' variable could be NULL dereferenced,
when b43_nphy_get_rf_ctl_over_rev7 function returns NULL.
Signed-off-by: NFelipe Pena <felipensp@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Convert the memset/memcpy uses of 6 to ETH_ALEN
where appropriate.

Also convert some struct definitions and u8 array
declarations of [6] to ETH_ALEN.
Signed-off-by: NJoe Perches <joe@perches.com>
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Replace the following sequence:

	dma_set_mask(dev, mask);
	dma_set_coherent_mask(dev, mask);

with a call to the new helper dma_set_mask_and_coherent().
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

__GFP_ZERO is an uncommon flag and perhaps is better
not used.  static inline dma_zalloc_coherent exists
so convert the uses of dma_alloc_coherent with __GFP_ZERO
to the more common kernel style with zalloc.

Remove memset from the static inline dma_zalloc_coherent
and add just one use of __GFP_ZERO instead.

Trivially reduces the size of the existing uses of
dma_zalloc_coherent.

Realign arguments as appropriate.
Signed-off-by: NJoe Perches <joe@perches.com>
Acked-by: NNeil Horman <nhorman@tuxdriver.com>
Acked-by: NJesse Brandeburg <jesse.brandeburg@intel.com>
Acked-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Tell the PCIe host core when the wifi is activated.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This allows enabling support for extra hardware with just a module
param, without kernel/module recompilation.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

N-PHY and HT-PHY support is more or less stable and should be activated
by default.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When b43 gets build into the kernel and it should use bcma we have to
ensure that bcma was also build into the kernel and not as a module.
In this patch this is also done for SSB, although you can not
build b43 without ssb support for now.

This fixes a build problem reported by Randy Dunlap in
5187EB95.2060605@infradead.org
Reported-By: NRandy Dunlap <rdunlap@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.

CVE-2013-2852
Signed-off-by: NKees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add handling of rx descriptor underflow. This fixes a fault that could
happen on slow machines, where data is received faster than the CPU can
handle. In such a case the device will use up all rx descriptors and
refuse to send any more data before confirming that it is ok. This
patch enables necessary interrupt to discover such a situation and will
handle them by dropping everything in the ring buffer.
Reviewed-by: NMichael Buesch <m@bues.ch>
Signed-off-by: NThommy Jakobsson <thommyj@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All radio ops are 16b (there is only 1 exception for reg 0x1), so we
deprecated b43_radio_read16 and b43_radio_write16 long time ago.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Sort defines, use one macro for all revs, support for 5GHz when
uploading antenna table.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Also make a function name shorter so we can easily fit 80 chars.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Thanks to Broadcom releasing some code we can use better names.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

In MMIO dumps of ndiswrapper there are following PHY ops:
phy_read(0x0118) -> 0x013d
phy_read(0x01ed) -> 0x993d
phy_read(0x0119) -> 0x012f
phy_read(0x01ee) -> 0x992f
phy_read(0x011a) -> 0x0139
phy_read(0x0969) -> 0x9939
It matches the code of wlc_phy_txpower_est_power_nphy (from brcm80211),
so we know the registers meaning.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

After b43_phy_ht_tx_power_ctl_setup there are some extra radio ops:
 radio_read(0x08bf) -> 0x0001
radio_write(0x08bf) <- 0x0001
radio_write(0x0159) <- 0x0011
On N-PHY we write 0x11 to TSSI regs, so it's probably sth similar.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Now when we know many radio regs at 0x000 are core-generic, I've noticed
we duplicate some values in the tables.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

After comparing writes to registers at 0x000, 0x400 and 0x800 it seems
there are many very similar writes. So 0x000 offset is not for accessing
something totally different, but probably just the first out of three
cores.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Do not implement this in b43, but use bcma_pmu_spuravoid_pllupdate().
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

And make use of it in b43. This fixes a regression introduced with
49d55cef
b43: N-PHY: implement spurious tone avoidance
This commit made BCM4322 use only MCS 0 on channel 13, which of course
resulted in performance drop (down to 0.7Mb/s).
Reported-by: NStefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes some sparse warnings.

b43_nphy_set_rxantenna() was not used anywhere.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Instead of defining the magic values in the code use constants.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When calculating "offset" for final RSSI calibration we're using numbers
bigger than s8 can hold. We have for example:
offset[j] = 232 - poll_results[j];
formula. If poll_results[j] is small enough (it usually is) we treat
number's bit as a sign bit. For example 232 - 1 becomes:
0xE8 - 0x1 = 0xE7, which is not 231 but -25.

This code was introduced in e0c9a021
and caused stability regression on some cards, for ex. BCM4322.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Intermittently, b43 will report "Out of order TX status report on DMA ring".
When this happens, the driver must be reset before communication can resume.
The cause of the problem is believed to be an error in the closed-source
firmware; however, all versions of the firmware are affected.

This change uses the observation that the expected status is always 2 less
than the observed value, and supplies a fake status report to skip one
header/data pair.

Not all devices suffer from this problem, but it can occur several times
per second under heavy load. As each occurence kills the unmodified driver,
this patch makes if possible for the affected devices to function. The patch
logs only the first instance of the reset operation to prevent spamming
the logs.
Tested-by: NChris Vine <chris@cvine.freeserve.co.uk>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>