The band field for the supported channels were left unpopulated, making
them default to 0 == IEEE80211_BAND_2GHZ, even for the 5GHz channels.

This resulted in null pointer accesses if anything tries to access
wiphy->bands[channel->band] of a 5GHz channel on 5GHz only cards, since
wiphy->bands[2GHZ] is NULL for them (e.g. cfg80211_chandef_usable does).

Example kernel OOPS:

[  665.669993] Unable to handle kernel NULL pointer dereference at virtual address 00000016
[  665.678194] pgd = c6d58000
[  665.680941] [00000016] *pgd=06f8a831, *pte=00000000, *ppte=00000000
[  665.687303] Internal error: Oops: 17 [#1]
(...)
[  666.116373] Backtrace:
[  666.118866] [<bf0368dc>] (cfg80211_chandef_usable+0x0/0x1bc [cfg80211]) from [<bf025e64>] (nl80211_leave_mesh+0x244/0x264 [cfg80211])
[  666.130919]  r7:c6d12100 r6:0000143c r5:c0611c48 r4:c0611b98
[  666.136668] [<bf025d84>] (nl80211_leave_mesh+0x164/0x264 [cfg80211]) from [<bf02634c>] (nl80211_remain_on_channel+0x2a0/0x358 [cfg80211])
[  666.149074]  r7:c6d12000 r6:c6d12000 r5:c6f4f368 r4:00000003
[  666.154814] [<bf0262ec>] (nl80211_remain_on_channel+0x240/0x358 [cfg80211]) from [<bf02ddb0>] (nl80211_set_wiphy+0x264/0x560 [cfg80211])
[  666.167150] [<bf02db4c>] (nl80211_set_wiphy+0x0/0x560 [cfg80211]) from [<c01f94e0>] (genl_rcv_msg+0x1b8/0x1f8)
[  666.177205] [<c01f9328>] (genl_rcv_msg+0x0/0x1f8) from [<c01f89a0>] (netlink_rcv_skb+0x58/0xb4)
[  666.185949] [<c01f8948>] (netlink_rcv_skb+0x0/0xb4) from [<c01f931c>] (genl_rcv+0x20/0x2c)
[  666.194251]  r6:c6f70780 r5:0000002c r4:c6f70780 r3:00000001
[  666.199973] [<c01f92fc>] (genl_rcv+0x0/0x2c) from [<c01f8418>] (netlink_unicast+0x154/0x1f4)
[  666.208449]  r4:c785ea00 r3:c01f92fc
[  666.212057] [<c01f82c4>] (netlink_unicast+0x0/0x1f4) from [<c01f8790>] (netlink_sendmsg+0x230/0x2b0)
[  666.221240] [<c01f8560>] (netlink_sendmsg+0x0/0x2b0) from [<c01cccf8>] (sock_sendmsg+0x90/0xa4)
[  666.229986] [<c01ccc68>] (sock_sendmsg+0x0/0xa4) from [<c01cdcb0>] (__sys_sendmsg+0x290/0x298)
[  666.238637]  r9:00000000 r8:c0611ec8 r6:0000002c r5:c0610000 r4:c0611f64
[  666.245411] [<c01cda20>] (__sys_sendmsg+0x0/0x298) from [<c01cf52c>] (sys_sendmsg+0x44/0x6c)
[  666.253897] [<c01cf4e8>] (sys_sendmsg+0x0/0x6c) from [<c00090a0>] (ret_fast_syscall+0x0/0x2c)
[  666.262460]  r6:00000000 r5:beeff96c r4:00000005
Signed-off-by: NJonas Gorski <jogo@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

alloc failures already get standardized OOM
messages and a dump_stack.

For the affected mallocs around these OOM messages:

Converted kmallocs with multiplies to kmalloc_array.
Converted a kmalloc/memcpy to kmemdup.
Removed now unused stack variables.
Removed unnecessary parentheses.
Neatened alignment.
Signed-off-by: NJoe Perches <joe@perches.com>
Acked-by: NArend van Spriel <arend@broadcom.com>
Acked-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Acked-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

alloc failures already get standardized OOM
messages and a dump_stack.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add PCI deviceIDs for single band versions of 88W8366, found e.g. in
simultaneous dual band routers based on kirkwood.
Signed-off-by: NJonas Gorski <jogo@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

While using STA mode in the AP firmware, avoid
calling some firmware commands which are not
supported by the AP firmware.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Choose interface specific function calls
based on interface type instead of
firmware types.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add and delete self entry in the firmware sta database
for AP interface only. We do not need such an entry for
STA interface.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Firmware supports hardware encryption feature
for the station interface running on AP
firmware.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Set mac type for station interface on AP firmware
as secondary. This allows the firmware to set specific
characteristics for the STA interface.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When user wants to add a station interface when
AP firmware is loaded & in-use, allow creating
it and also notify user about the same.

Allow adding max one STA interface for AP fw.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Specify the STA support in iface_limit and
in wihpy->interface_modes
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This avoids calling mwl8k_cmd_rf_antenna functions every
time mwl8k_config function is called.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Avoid calling mwl8k_cmd_set_rf_channel unconditionally
by checking IEEE80211_CONF_CHANGE_CHANNEL.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

For the commands, that might change the hw characteristics
of the PHY device, stop the running bsses and resume them
once command is complete.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If pci_iomap() fails in mwl8k_probe(), it breaks off initialization,
deallocates all resources, but returns zero.
There is a similar issue when priv->rxd_ops is NULL in mwl8k_probe_hw().

The patch adds proper error code return values.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If queues are stopped in mwl8k_stop,
these should be started in mwl8k_start
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When a station deauths, we do not delete the streams with state
AMPDU_STREAM_NEW and these remain created forever. Fix this issue by
removing such streams in the driver
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Whenever TX ring is drained, priv->tx_wait still points
to a valid completion. Making sure that it points to
NULL before returning from the  mwl8k_tx_wait_empty
check.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

New firmware is required to support
a) Add support for additional ampdu streams
b) Handle corresponding watchdog events to destroy ampdu streams

Bumping firmware API version by one.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently, command path waits till all the tx host queues
are empty. Whenever watchdog event is raised, firmware
expects driver to destroy ampdu queues immediately.

This requires corresponding commands i.e.
mwl8k_cmd_get_watchdog_bitmap and mwl8k_destroy_ba to be
sent without waiting for the tx queues to be completely
empty.

Use "watchdog_event_pending" to ensure the above mentioned
two commands are sent down immediately.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

With more ampdu streams, we need to handle watchdog
events for the new ampdu streams. Handle these
events appropriately.

Earlier mwl8k_cmd_get_watchdog_bitmap used to return
only one stream index and hence bitwise operations
on the return value were not required. Now the function
returns a bitmap with different bits are mapped with
different stream indices.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently, mwl8k_ampdu_stream is passed as one of the
argument to the function mwl8k_destroy_ba. Instead of
this pass only the stream index. This will be helpful
during watchdog event handling when bitmap of stream
indices are received.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently, we have 2 ampdu streams that can be created
simultaneously. Firmware is capable of supporting
additional streams. Add support to use these streams.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Set ACK policy to NORMAL when its not going to
be an AMPDU packet.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Ampdu stream index can be derived from stream->idx.
So we no longer need stream->txq_idx, hence removing it.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Do not dereference p->station_id after kfree(cmd) because p
points into the cmd data structure.
Signed-off-by: NNickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When TX aggregation is stopped, there are a few
different cases:
 - connection with the peer was dropped
 - session stop was requested locally
 - session stop was requested by the peer
 - connection was dropped while a session is stopping

The behaviour in these cases should be different, if
the connection is dropped then the driver should drop
all frames, otherwise the frames may continue to be
transmitted, aggregated in the case of a locally
requested session stop or unaggregated in the case of
the peer requesting session stop.

Split these different cases so that the driver can
act accordingly; however, treat local and remote stop
the same way and ask the driver to not send frames as
aggregated packets any more.

In the case of connection drop, the stop callback the
driver is otherwise supposed to call is no longer
required.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

CONFIG_HOTPLUG is going away as an option.  As result the __dev*
markings will be going away.

Remove use of __devinit, __devexit_p, __devinitdata, __devinitconst,
and __devexit.
Signed-off-by: NBill Pemberton <wfp5p@virginia.edu>
Cc: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch removes a left over debugging print present in the pci
shutdown callback, since this callback does not do anything useful, get
rid of it entirely.
Signed-off-by: NFlorian Fainelli <ffainelli@freebox.fr>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The firmware supports 8 macid's corresponding to 8 BSS that can be
created in an MBSS environment. Currently, BASTREAM commands were always
sent with macid 0. This macid is used to configure the hardware ampdu
registers with appropriate BSS address in an MBSS environment.
This mac address is used by the hardware for various ampdu related requirements
e.g. source address in BAR generation, BA interpretation e.t.c.
Using invalid macid results in this mac address not getting appropriately
configured in the hardware which results in issues during ampdu traffic.

Fix this by sending the BASTREAM commands with appropriate macid.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Set tx packet timestamp to 0 in following scenarios:-
- All packets in STA mode
- Mgmt packets in AP mode
- Eapol packets in AP mode

In STA mode, this field is unused in the firmware. In AP
mode, we should not be expiring mgmt and eapol frames.
Setting timestamp to 0 will ensure that.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This can cause issues when clients try to connect when the
traffic is heavy
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We should unmap the DMA address in the error path, else it
causes resource leaks. Fix this.
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We have 6.5 Mbps is minimum rate of the link
as the criterion for creation of BA.

Although we check this before creating the BA
stream, by the time amdpu_action is called from
the workqueue, the link can get affected in the
meantime.
Hence, add an additional check in amdpu_action.
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NNishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

AP mode support upto 8 interfaces.
Defining it using iface_combinations
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove the control.sta pointer from ieee80211_tx_info to free up
sufficient space in the TX skb control buffer for the upcoming
Transmit Power Control (TPC).
Instead, the pointer is now on the stack in a new control struct
that is passed as a function parameter to the drivers' tx method.
Signed-off-by: NThomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: NAlina Friedrichsen <x-alina@gmx.net>
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
[reworded commit message]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

info->control.sta may only be dereferenced during the drv_tx call otherwise
could lead to use-after-free bugs
Reported-by: NFelix Fietkau <nbd@nbd.name>
Signed-off-by: NThomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use the new bool function ether_addr_equal to add
some clarity and reduce the likelihood for misuse
of compare_ether_addr for sorting.

Done via cocci script:

$ cat compare_ether_addr.cocci
@@
expression a,b;
@@
-	!compare_ether_addr(a, b)
+	ether_addr_equal(a, b)

@@
expression a,b;
@@
-	compare_ether_addr(a, b)
+	!ether_addr_equal(a, b)

@@
expression a,b;
@@
-	!ether_addr_equal(a, b) == 0
+	ether_addr_equal(a, b)

@@
expression a,b;
@@
-	!ether_addr_equal(a, b) != 0
+	!ether_addr_equal(a, b)

@@
expression a,b;
@@
-	ether_addr_equal(a, b) == 0
+	!ether_addr_equal(a, b)

@@
expression a,b;
@@
-	ether_addr_equal(a, b) != 0
+	ether_addr_equal(a, b)

@@
expression a,b;
@@
-	!!ether_addr_equal(a, b)
+	ether_addr_equal(a, b)
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch converts the drivers in drivers/net/wireless/* to use
module_pci_driver() macro which makes the code smaller and a bit simpler.
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: Jiri Slaby <jirislaby@gmail.com>
Cc: Nick Kossifidis <mickflemm@gmail.com>
Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com>
Cc: Simon Kelley <simon@thekelleys.org.uk>
Cc: Jouni Malinen <j@w1.fi>
Cc: Lennert Buytenhek <buytenh@wantstofly.org>
Cc: Christian Lamparter <chunkeey@googlemail.com>
Cc: Ivo van Doorn <IvDoorn@gmail.com>
Cc: Larry Finger <Larry.Finger@lwfinger.net>
Cc: linux-wireless@vger.kernel.org
Acked-by: NLennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Booleans should not be compared to true or false
but be directly tested or tested with !.

Done via cocci script:

@@
bool t;
@@
- t == true
+ t
@@
bool t;
@@
- t != true
+ !t
@@
bool t;
@@
- t == false
+ !t
@@
bool t;
@@
- t != false
+ t
Signed-off-by: NJoe Perches <joe@perches.com>
Reviewed-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>