kernel panic occurs when we create an IBSS mode and leave it for
sometime without any joiner and this is introduced by the
commit ec2b774e where we don't
put proper braces for 'list_for_each_entry_safe' and we pass an
invalid 'sta' pointer to __sta_info_destroy

EIP is at __list_add+0xe/0xa0
EAX: f3b63db4 EBX: 00000000 ECX: eab88c1c EDX: 00000000
ESI: 00000000 EDI: 00000246 EBP: f3b63d80 ESP: f3b63d58
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process kworker/u:2 (pid: 198, ti=f3b62000 task=f3afbea0
task.ti=f3b62000)
Stack:
00000000 00000000 f9ef9821 00000000 00000000 eab88c30
f3b63d80 c017f623
eab88bf0 eab88bf0 f3b63dd0 c066f925 00000000 00000002
00000000 f9ef9821
f3b63da0 c0180a2b eab88c1c eab88c30 00000002 f3afbea0
eab88bf4 f3b63db4
 Call Trace:
[<f9ef9821>] ? __ieee80211_stop_tx_ba_session+0x31/0x60
[mac80211]
[<c017f623>] ? debug_mutex_add_waiter+0x23/0x60
[<c066f925>] __mutex_lock_common+0xd5/0x390
[<f9ef9821>] ? __ieee80211_stop_tx_ba_session+0x31/0x60
[mac80211]
[<c0180a2b>] ? trace_hardirqs_off+0xb/0x10
[<c066fd37>] mutex_lock_nested+0x47/0x60
[<f9ef9821>] ? __ieee80211_stop_tx_ba_session+0x31/0x60
[mac80211]
[<f9ef9821>] __ieee80211_stop_tx_ba_session+0x31/0x60
[mac80211]
[<f9ef8989>] ieee80211_sta_tear_down_BA_sessions+0x39/0x60 [mac80211]
[<f9ef1a67>] __sta_info_destroy+0x57/0x780 [mac80211]
[<f9ef2223>] ieee80211_sta_expire+0x93/0xb0 [mac80211]
[<f9efc8f6>] ieee80211_ibss_work+0x2d6/0x530 [mac80211]

Cc: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

when we run high bandwidth UDP traffic and we trigger a scan, the scan
state machine seems to be looping in SUSPEND->RESUME->DECISION->SUSPEND
and SET_CHANNEL seems to be never called as 'tx_empty' is never true
while running UDP traffic. fix this by settting SET_CHANNEL state when
we get into RESUME state.

Cc: Leela Kella <leela@qca.qualcomm.com>
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Error handling code following a kmalloc should free the allocated data.
The label fail_alloc already does this for rfkill.

A simplified version of the semantic match that finds the problem is as
follows: (http://coccinelle.lip6.fr)

// <smpl>
@r exists@
local idexpression x;
statement S;
identifier f1;
position p1,p2;
expression *ptr != NULL;
@@

x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
     when != if (...) { <+...x...+> }
x->f1
...>
(
 return \(0\|<+...x...+>\|ptr\);
|
 return@p2 ...;
)

@script:python@
p1 << r.p1;
p2 << r.p2;
@@

print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

AR9003 chips read tx status from ring buffer whose max number of
status descriptor is mininal compared to max number of tx buffers.
On a stress condition, it can be easily overflown which might cause
false tx hung detection. Though increasing number of max status
descriptors consumes more memory, it helps to avoid false positive
chip resets.

Cc: Paul Stewart <pstew@google.com>
Signed-off-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Patch fix firmware error on "iw dev wlan0 scan passive" for
hardware scanning (with disable_hw_scan=0 module parameter).

 iwl3945 0000:03:00.0: Microcode SW error detected. Restarting 0x82000008.
 iwl3945 0000:03:00.0: Loaded firmware version: 15.32.2.9
 iwl3945 0000:03:00.0: Start IWL Error Log Dump:
 iwl3945 0000:03:00.0: Status: 0x0002A2E4, count: 1
 iwl3945 0000:03:00.0: Desc       Time       asrtPC blink2 ilink1  nmiPC   Line
 iwl3945 0000:03:00.0: SYSASSERT     (0x5) 0041263900 0x13756 0x0031C 0x00000 764
 iwl3945 0000:03:00.0: Error Reply type 0x000002FC cmd C_SCAN (0x80) seq 0x443E ser 0x00340000
 iwl3945 0000:03:00.0: Command C_SCAN failed: FW Error
 iwl3945 0000:03:00.0: Can't stop Rx DMA.

We have disable ability to change passive scanning to active on
particular channel when traffic is detected on that channel. Otherwise
firmware will report error, when we try to do passive scan on radar
channels.
Reported-and-debugged-by: NPedro Francisco <pedrogfrancisco@gmail.com>
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We have two such functions.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove these helpers, some are not unused at all, one can be
unrolled in place of use.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Get rid of two inline functions related and simplify a bit
rts_retry_limit calculations.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Make function static and change antenna number inline.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This save us about 20k of text size, and should have no impact on
performance as hot paths do not use much I/O.

Before:
   text	   data	    bss	    dec	    hex	filename
 108512	   1784	    168	 110464	  1af80	drivers/net/wireless/iwlegacy/iwl3945.ko
 165730	   2164	    156	 168050	  29072	drivers/net/wireless/iwlegacy/iwl4965.ko
  91942	    328	     48	  92318	  1689e	drivers/net/wireless/iwlegacy/iwlegacy.ko

After:
   text	   data	    bss	    dec	    hex	filename
  95556	   1784	    168	  97508	  17ce4	drivers/net/wireless/iwlegacy/iwl3945.ko
 154853	   2164	    156	 157173	  265f5	drivers/net/wireless/iwlegacy/iwl4965.ko
  91634	    328	     48	  92010	  1676a	drivers/net/wireless/iwlegacy/iwlegacy.ko
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We use "rate_index" like this:
	rate = iwl3945_rates[rate_index].plcp;
The iwl3945_rates[] array has IWL_RATE_COUNT_3945 elements so the
limit here is off by one.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

I forgot to remove this file before.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If the vif is stopped while it is offchannel (e.g. right
after p2p negotiation) the SDATA_STATE_OFFCHANNEL flag
is never get cleared, resulting in various bad effects
(e.g. GO can't start beaconing).

Fix it by clearing the SDATA_STATE_OFFCHANNEL flag
even if the vif is stopped.
Signed-off-by: NEliad Peller <eliad@wizery.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Wireless will select a different hardware queue based on the
top 3 bits of the diffserv field, for ipv4. Extend that queue
selection mechanism to ipv6, and make the calls orthogonal.
Signed-off-by: NDave Täht <dave.taht@bufferbloat.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The nfcid1 is the NFC-A identifier.
It is exported as an attribute of the target info
(returned as a response to NFC_CMD_GET_TARGET).
Signed-off-by: NIlan Elias <ilane@ti.com>
Acked-by: NSamuel Ortiz <sameo@linux.intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This is just a cosmetical fix since we only return survey data for the
active channel but it allows iw to show that the survey data is
for the currently used channel.
Signed-off-by: NHelmut Schaa <helmut.schaa@googlemail.com>
Acked-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch addresses a bug in the dma worker code that keeps draining
packets even when the hardware queues are full. In such cases packets
can not be passed down to the device and are erroneusly dropped by the
code. It is based on commit bad69194,
which fixes the same problem in b43.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Specs were updated, now we match wl according to MMIO dumps.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes this sparse warning:

  CHECK   drivers/net/wireless/ath/ath9k/mci.c
drivers/net/wireless/ath/ath9k/mci.c:23:4: warning: symbol 'ath_mci_duty_cycle' was not declared. Should it be static?
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Replace dma_alloc_coherent()+memset() with the new dma_zalloc_coherent()
Signed-off-by: NDjalal Harouni <tixxdz@opendz.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Following the tradition we have had with ath5k, ath9k, CRDA,
wireless-regdb I'd like to license this code under the permissive ISC
license for the code sharing purposes with other OSes, it'd sure be nice
to help the landscape in this area. Although I am %82.89 owner of the
regulatory code I have asked every contributor to the regulatory code
and have receieved positive Acked-bys from everyone except two deceased
entities:

 o Frans Pop RIP 2010 [0]
	- Frans Pop <elendil@planet.nl>
	- Frans Pop <fjp@debian.org>
 o Nokia     RIP February, 11, 2011 [1], [2]
	- ext-yuri.ershov@nokia.com
	- kalle.valo@nokia.com

Frans Pop's contribution was a simple patch 55f98938, titled,
"wireless: remove trailing space in messages" which just add a \n
to some printk lines. I'm going to treat these additions as
uncopyrightable.

As for the contributions made by employees on behalf of Nokia
my contact point was Petri Karhula <petri.karhula@nokia.com> but
after one month he noted he had not been able to get traction from the
legal department on this request, as such it I proceeded by replacing
their contributions in previous patches.

The end goal is to help a clean rewrite that starts in userspace
that is shared under ISC license which currently is taking place with
the regulatory simulator [3].

[0] http://lists.debian.org/debian-devel/2011/12/msg00263.html
[1] http://press.nokia.com/2011/02/11/nokia-outlines-new-strategy-introduces-new-leadership-operational-structure/
[2] http://NokiaPlanB.com
[3] git://github.com/mcgrof/regsim.gitAcked-by: NThadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Acked-by: NDan Carpenter <error27@gmail.com>
Acked-by: NMihai Moldovan <ionic@ionic.de>
Acked-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: NSven Neumann <s.neumann@raumfeld.com>
Acked-by: NJohannes Berg <johannes@sipsolutions.net>
Acked-by: NTomas Winkler <tomas.winkler@intel.com>
Acked-by: NTony Vroon <tony@linx.net>
Acked-by: NPavel Roskin <proski@gnu.org>
Acked-by: NBob Copeland <me@bobcopeland.com>
Acked-by: NLucas De Marchi <lucas.demarchi@profusion.mobi>
Acked-by: NPat Erley <pat-lkml@erley.org>
Acked-by: NTejun Heo <tj@kernel.org>
Acked-by: NJohn W. Linville <linville@tuxdriver.com>
Acked-by: NChris Wright <chrisw@sous-sol.org>
Acked-by: NJoe Perches <joe@perches.com>
Acked-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Acked-by: NJohn Gordon <john@devicescape.com>
Acked-by: NSimon Barber <protocolmagic@gmail.com>
Acked-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Acked-by: NJiri Benc <jbenc@upir.cz>
Acked-by: NBruno Randolf <br1@einfach.org>
Acked-by: NScott James Remnant <keybuk@google.com>
Acked-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Nokia hasn't gotten back to me in over 1 month for a relicense
change request. There are only a few changes that they contributed,
so just reverting their changes but replacing with another set.
This change replaces this commit:

commit 269ac5fd
Author: Kalle Valo <kalle.valo@nokia.com>
Date:   Tue Dec 1 10:47:15 2009 +0200

    cfg80211: indent regulatory messages with spaces

    The regulatory messages in syslog look weird:

    kernel: cfg80211: Regulatory domain: US
    kernel: ^I(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
    kernel: ^I(2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
    kernel: ^I(5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
    kernel: ^I(5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
    kernel: ^I(5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
    kernel: ^I(5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
    kernel: ^I(5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)

    Indent them with four spaces instead of the tab character to get prettier
    output.
Signed-off-by: NKalle Valo <kalle.valo@nokia.com>
    Acked: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Cc: Petri Karhula <petri.karhula@nokia.com>
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Nokia hasn't gotten back to me in over 1 month for a relicense
change request. There are only a few changes that they contributed,
so just reverting their changes but replacing with another set.
This change replaces this commit:

commit c4c32294
Author: Yuri Ershov <ext-yuri.ershov@nokia.com>
Date:   Tue Jun 29 15:08:08 2010 +0400

    cfg80211: Update of regulatory request initiator handling

    In some cases there could be possible dereferencing freed pointer. The
    update is intended to avoid this issue.
Signed-off-by: NYuri Ershov <ext-yuri.ershov@nokia.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Cc: Petri Karhula <petri.karhula@nokia.com>
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes this sparse complaint:

make C=2 CF="-D__CHECK_ENDIAN__" M=drivers/net/wireless/ath/

  CHECK   drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3544:21: warning: incorrect type in assignment (different base types)
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3544:21:    expected restricted __le32 [usertype] val
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3544:21:    got restricted __le16 [usertype] switchcomspdt
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3546:21: warning: incorrect type in assignment (different base types)
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3546:21:    expected restricted __le32 [usertype] val
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3546:21:    got restricted __le16 [usertype] switchcomspdt

The eep->modalHeader5G.switchcomspdt is a le16 and we return u16,
so just return le16_to_cpu().

Cc: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Just skip the sparse checks on tracing.

  CHECK   drivers/net/wireless/ath/ath5k/base.c
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:19:1: error: incompatible types for operation (<)
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:19:1:    left side has type struct ath5k_hw *<noident>
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:19:1:    right side has type int
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:37:1: error: incompatible types for operation (<)
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:37:1:    left side has type struct ath5k_hw *<noident>
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:37:1:    right side has type int
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:63:1: error: incompatible types for operation (<)
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:63:1:    left side has type struct ath5k_hw *<noident>
include/trace/../../drivers/net/wireless/ath/ath5k/trace.h:63:1:    right side has type int
/home/mcgrof/wireless-testing/arch/x86/include/asm/jump_label.h:16:9: error: bad asm output
/home/mcgrof/wireless-testing/arch/x86/include/asm/jump_label.h:16:9: error: bad asm output
/home/mcgrof/wireless-testing/arch/x86/include/asm/jump_label.h:16:9: error: bad asm output
/home/mcgrof/wireless-testing/arch/x86/include/asm/jump_label.h:16:9: error: bad asm output
  CC [M]  drivers/net/wireless/ath/ath5k/base.o
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes this rant from sparse:

  CHECK   drivers/net/wireless/ath/ath9k/xmit.c
drivers/net/wireless/ath/ath9k/xmit.c:107:13: warning: context imbalance in 'ath_txq_lock' - wrong count at exit
drivers/net/wireless/ath/ath9k/xmit.c:112:13: warning: context imbalance in 'ath_txq_unlock' - unexpected unlock
drivers/net/wireless/ath/ath9k/xmit.c:123:30: warning: context imbalance in 'ath_txq_unlock_complete' - unexpected unlock
  CC [M]  drivers/net/wireless/ath/ath9k/xmit.
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes these sparse warnings:

  CHECK   drivers/net/wireless/ath/ath9k/ar9003_rtt.c
drivers/net/wireless/ath/ath9k/ar9003_rtt.c:36:6: warning: symbol 'ar9003_hw_rtt_enable' was not declared. Should it be static?
drivers/net/wireless/ath/ath9k/ar9003_rtt.c:41:6: warning: symbol 'ar9003_hw_rtt_disable' was not declared. Should it be static?
drivers/net/wireless/ath/ath9k/ar9003_rtt.c:46:6: warning: symbol 'ar9003_hw_rtt_set_mask' was not declared. Should it be static?
drivers/net/wireless/ath/ath9k/ar9003_rtt.c:52:6: warning: symbol 'ar9003_hw_rtt_force_restore' was not declared. Should it be static?
drivers/net/wireless/ath/ath9k/ar9003_rtt.c:102:6: warning: symbol 'ar9003_hw_rtt_load_hist' was not declared. Should it be static?
drivers/net/wireless/ath/ath9k/ar9003_rtt.c:135:6: warning: symbol 'ar9003_hw_rtt_fill_hist' was not declared. Should it be static?
drivers/net/wireless/ath/ath9k/ar9003_rtt.c:143:6: warning: symbol 'ar9003_hw_rtt_clear_hist' was not declared. Should it be stati
Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add support for NCI Interface Error Notification.
When this notification is received and we're during a
data exchange transaction, indicate an error to the NFC
core layer via the data exchange callback.
Signed-off-by: NIlan Elias <ilane@ti.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Addition, deletion, and modification of NCI constants.
Changes in NCI commands, responses, and notifications structures.
Signed-off-by: NIlan Elias <ilane@ti.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NDmitry Shmidt <dimitrysh@google.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This seems to not serve any purpose anymore, at least all frame
processing afterwards seems to be able to deal with QoS frames. So,
let's save the expensive memmove and just leave the QoS header in the
802.11 frame for further processing.
Signed-off-by: NHelmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>