This adds adhoc mode support to brcmsmac.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This activates the AP mode support.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It is possible to configure the ucode to automatically send the probe
responses to the clients after they send a probe request. At least for
WPS the userspace needs to answer the probe requests and we do not know
a way to say to the ucode to just handle the normal probe requests, so
for now no probe requests should be handled by the ucode.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The ucode is able to answer probe response by itself. This writes such
a template into the specific memory. Currently the probe requests are
also send to mac80211 so there are more answers send to a requesting
client. We have to make the ucode stop sending probe requests to the
driver.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

To send the correct probe response the hardware needs to know the SSID
when it changed.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This makes it possible that a beacon template provided by mac80211 is
written to the hardware for constant beaconing.

This is based on an old version of brcmsmac, on b43 and the spec b43 is
based on.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Make brcms_c_set_beacon_period() write the beacon period to the
hardware if a new one is set.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This was a write only member
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

use brcms_pub->cur_etheraddr instead
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This was a read only member, replace it with pub->up.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This was a read only member.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Replaced the usage with pub->associated.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This was a read only member. The checks using BSS are replaced by
better fitting checks of the new type member.

The change in brcms_c_tbtt() was based on code from b43, in
brcms_c_ps_allowed() the same happens with BSS being true or false,
beaconing and probe responses are just needed in ap mode.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This makes it possible to easily check in which mode the device is
currently running. This also adds a function to start station mode.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

setting the tsf is needed to start a timer to make beaconing in AP mode
work.

This is based on older versions of brcmsmac and b43.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This exports the firmware version in use to userspace through ethtool.

root@OpenWrt:/# ethtool -i wlan0
firmware-version: 610.812
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove the casts of the first argument of memset.

Neaten the style by using the sizeof the actual variable
being memset not the sizeof the type of variable.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

These messages don't seem to be errors but notifications
that some attribute isn't quite right.

Don't mark them as errors.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Dynamically allocate the probe response template which
avoids potential stack corruption. Observed with smatch:

drivers/net/wireless/brcm80211/brcmsmac/main.c:7412 brcms_c_bss_update_probe_resp()
 warn: 'prb_resp' puts 512 bytes on stack

Cc: Brett Rudley <brudley@broadcom.com>
Cc: Arend van Spriel <arend@broadcom.com>
Cc: "Franky (Zhenhui) Lin" <frankyl@broadcom.com>
Cc: Hante Meuleman <meuleman@broadcom.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Cc: Hauke Mehrtens <hauke@hauke-m.de>
Cc: linux-wireless@vger.kernel.org
Cc: brcm80211-dev-list@broadcom.com
Cc: netdev@vger.kernel.org
Signed-off-by: NTim Gardner <tim.gardner@canonical.com>
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

DOT11_MIN_BEACON_PERIOD and DOT11_MAX_BEACON_PERIOD are
superfluous. The only invalid beacon period is 0. Comparing
a 16 bit quantity to 0xffff also causes a compile warning:

drivers/net/wireless/brcm80211/brcmsmac/main.c:5560 brcms_c_set_beacon_period()
 warn: impossible condition '(period > 65535) => (0-65535 > 65535)'

Observed from smatch analysis.

Cc: Brett Rudley <brudley@broadcom.com>
Cc: Arend van Spriel <arend@broadcom.com>
Cc: "Franky (Zhenhui) Lin" <frankyl@broadcom.com>
Cc: Hante Meuleman <meuleman@broadcom.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Hauke Mehrtens <hauke@hauke-m.de>
Cc: linux-wireless@vger.kernel.org
Cc: brcm80211-dev-list@broadcom.com
Cc: netdev@vger.kernel.org
Signed-off-by: NTim Gardner <tim.gardner@canonical.com>
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch addresses a long standing issue of the driver with the
mac80211 .flush() callback. Since implementing the .flush() callback
a number of issues have been fixed, but a WARN_ON_ONCE() was still
triggered because the timeout on the flush could still occur.

This patch changes the awkward design using msleep() into one using
a waitqueue. The waiting flush() context will kick the transmit dma
when it is idle and the timeout used waiting for the event is set
to 500 ms. Worst case there can be 64 frames outstanding for transmit
in the driver. At a rate of 1Mbps that would take 1.5 seconds assuming
MTU is 1500 bytes and ignoring retries. The WARN_ON_ONCE() is also
removed as this was put in to indicate the flush timeout as a reason
for the driver to stall. That was not happening since fixing endless
AMPDU retries with following upstream commit:

commit 85091fc0
Author: Arend van Spriel <arend@broadcom.com>
Date:   Thu Feb 23 18:38:22 2012 +0100

    brcm80211: smac: fix endless retry of A-MPDU transmissions

bugzilla: 42840 <https://bugzilla.kernel.org/show_bug.cgi?id=42840>
bugzilla@redhat: <https://bugzilla.redhat.com/show_bug.cgi?id=799168>
bugzilla@redhat: <https://bugzilla.redhat.com/show_bug.cgi?id=787649>

Cc: Jonathan Nieder <jrnieder@gmail.com>
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: Camaleón <noelamac@gmail.com>
Cc: Milan Bouchet-Valat <nalimilan@club-internet.fr>
Cc: Seth Forshee <seth.forshee@canonical.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPiotr Haber <phaber@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Acked-by: NSeth Forshee <seth.forshee@canonical.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This issue was reported on the wireless list (see [1]) in which
brcmsmac ran into a fatal error:

[  588.284074] brcmsmac bcma0:0: frameid != txh->TxFrameID
[  588.284098] brcmsmac bcma0:0: MI_TFS: fatal
[  588.284103] brcmsmac bcma0:0: wl0: fatal error, reinitializing
[  588.286208] ieee80211 phy0: Hardware restart was requested

The tx status feedback is processed in a loop limiting the number of
frames processed in one run. The code terminate processing when the
limit is reached regardless the txstatus value read from the device
register. When that status is is flagged as being valid it must be
processed as the hardware will clear it after is has been read.

Bisecting was done by Seth Forshee and showed following commit as the
culprit:

commit 57fe5048
Author: Piotr Haber <phaber@broadcom.com>
Date:   Wed Nov 28 21:44:07 2012 +0100

    brcmsmac: fix bounds checking in tx/rx

[1] http://www.spinics.net/lists/linux-wireless/msg101293.htmlReported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Tested-by: NSeth Forshee <seth.forshee@canonical.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The interface address of the wireless device is determined by
the permanent address stored in the device. This patch allows
it to be overridden from user-space.
Reported-by: NMaximilian Engelhardt <maxi@daemonizer.de>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NPiotr Haber <phaber@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

drivers/net/wireless/brcm80211/brcmsmac/main.c: In function ‘brcms_b_recv’:
drivers/net/wireless/brcm80211/brcmsmac/main.c:7636: warning: ‘morepending’ may be used uninitialized in this function
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This device can be found on some embedded devices connected to a
Broadcom SoC like the BCM4718.
I tested this with my Netgear WNDR3400 v1.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

As described in the documentation of bcma_wflush16 in drivers/net
/wireless/brcm80211/brcmsmac/types.h some PCIe controllers of Broadcom
SoCs are broken. The PCIe controller on these SoCs are mostly used to
connect some additional wifi device to the SoC and some of these wifi
devices are supported by brcmsmac.
For my BCM43224 connected to the broken PCIe controller of the BCM4718 I
need an extra read after write in brcms_b_write_objmem() to prevent a
Data bus error. This fixes the problem reading tsf_random later.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This adds support for bcma wifi core revision 17 which is found on
BCM4716/4717/4718 SoCs. The firmware version 610.812 for brcmsmac found
in linux-firmware does not support these cores, but a firmware
generated with b43-fwcutter from the proprietary broadcom wireless
driver works with these chips. This wifi core contains a revision 5
N-PHY and a revision 7 radio of type 0x2056.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

brcms_b_txstatus and brcms_b_recv are off by one when
doing bounds checking on number of packets to process
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NPiotr Haber <phaber@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

brcms_c_isr returns true if interrupt was for us
and if dpc should be scheduled which is the same thing.
Simplify it.
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NPiotr Haber <phaber@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The .tx() callback function can drop packets when there is no
space in the DMA fifo. Propagate that information to caller
and make sure the freed sk_buff reference is not accessed.
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NPiotr Haber <phaber@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fixes sparse warning:
drivers/net/wireless/brcm80211/brcmsmac/main.c:308:10: sparse: symbol 'wlc_prio2prec_map' was not declared. Should it be static?
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

These messages clutter up the trace buffer without adding any useful
information.
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add the brcmsmac_tx trace system for tx debugging. Existing code to dump
tx status and descriptors are converted to using tracepoints, allowing
for more efficient collection and post-processing of this data. These
tracepoints are placed to collect data for all tx frames instead of only
on errors. Logging of tx errors is also improved.
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Also convert relevant messages to use this macro.
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Also convert relevant message to use this macro.
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Also convert relevant messages over to use thses macros.
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This macro is used for messages related to the 802.11 MAC layer.
Relevant messages are also converted to use this macro.
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Convert most uses of wiphy_* and pr_* for general error and debug
messages to use the internal debug macros instead. Most code used only
for initialization still use wiphy_err(), as well as some locations
which are executed too early to use the debug macros. Some debug
messages which are redundant or not useful are removed.
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The debug level can be set by passing debug=... to brcmsmac whenever
CONFIG_BRCMDBG is enabled.
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Tested-by: NDaniel Wagner <wagi@monom.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>