Some parts of the sprom struct are bigger than needed.
The leddc and maxpwr values are just 8 bit long and not 16.
rxpo2g and rxpo5g are signed

I got these information for the open source part of the Broadcom SDK
covering sprom version 1 to 9. rxpo2g contained a negative number on my
bcm5354 based device, this cased an error and Broadcom SDK says this is
signed.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Not doing so could cause the tx status queue to overflow during longer
periods of time without non-beacon tx. These events are also required
for proper drv_tx_last_beacon handling.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since AR9003 uses a global tx status queue, processing tx status outside of
the regular tx tasklet is dangerous and messes up hardware/software
synchronization of tx status events.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The approach of this change is flawed, as it triggers tx status processing
from more callsites, yet the chips only have one global tx status queue.
Subsequent patches will properly fix the issue that this one tried to address.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When authentication type is configured to NL80211_AUTHTYPE_AUTOMATIC,
driver tries to connect using open mode. The association is failed
if AP is configured in shared mode.

This patch adds code to try association using shared mode as well if
open mode association fails.

Now since we returned exact error code in association response handler
(instead of -1), corresponding changes are done in
mwifiex_process_cmdresp().
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

That commit intended for 3.4 renamed IEEE80211_TX_CTL_POLL_RESPONSE as
IEEE80211_TX_CTL_NO_PS_BUFFER.  Meanwhile, "carl9170: fix frame delivery
if sta is in powersave mode" added a reference to
IEEE80211_TX_CTL_POLL_RESPONSE in the fixes stream for 3.3.  This simple
patch fixes that merge boo-boo.
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Previous RX error checking was done exclusive-or for different error
types and caused DFS pulse events to be dropped when other error
flags (e.g. CRC) were set simultaneously.

This patch decouples PHY error processing from other types and ensures
that all pulses detected by HW are accounted by the pattern detector.
Signed-off-by: NZefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove the enum il4965_calib_enabled_state because it is not used.
Signed-off-by: NGreg Dietsche <Gregory.Dietsche@cuw.edu>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove the enum il_calib. It defined one identifier: IL_CALIB_MAX.
Remove the function il4965_calib_free_results. It was doing nothing
because IL_CALIB_MAX is zero. Next, remove calib_results from the
il_priv structure and also remove the associated return
type/struct il_calib_result.
Signed-off-by: NGreg Dietsche <Gregory.Dietsche@cuw.edu>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since the menuconfig system doesn't indent the debug options
for the 3945 /4965, add some text to make it clear which
debug options are being configured.
Signed-off-by: NGreg Dietsche <Gregory.Dietsche@cuw.edu>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Move the debug options so they appear below the 3945 / 4965 options.
Signed-off-by: NGreg Dietsche <Gregory.Dietsche@cuw.edu>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This renames the IEEE80211_TX_CTL_POLL_RESPONSE
TX flag to IEEE80211_TX_CTL_NO_PS_BUFFER and also
uses it for non-bufferable MMPDUs (all MMPDUs but
deauth, disassoc and action frames.)

Previously, mac80211 would let the MMPDU through
but not set the flag so drivers supporting some
hardware aids for avoiding the PS races would
then reject the frame.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Instead of defining an 'enum', we can simply use 'u8' flag for WEP
status. Rename 'wep_status' to 'wep_enabled' to match with
'wpa_enabled' and 'wpa2_enabled'.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It should have been removed by commit "mwifiex: use cfg80211 dynamic
scan..." (7c6fa2a8..) after adding code to avoid an extra scan
during association because scan entries are valid for 15 seconds in
cfg80211 stack.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The association sequence looks (roughly) like
this now:
 * set BSSID
 * set station to EXIST state
 * send auth
 * set station to AUTH state
 * send assoc
 * set station to ASSOC state
 * set BSS info to associated

In contrast, the deauth/disassoc sequence is
the other way around:
 * clear BSSID/BSS info state
 * remove station
 * send deauth/disassoc
(in some cases the last two steps are reversed.)

This patch encodes the entire sequence in the
ieee80211_set_disassoc() function and changes
it to be like this, for good measure with an
explicit flush:
 * send deauth/disassoc
 * flush
 * remove station
 * clear BSSID/BSS info state

At least iwlwifi gets confused with the other
sequence in P2P mode and complains that it
wasn't able to flush the queues.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When ieee80211_set_disassoc() is called with the
tx argument set to true, it will send DelBA out
to the peer. This isn't useful or necessary in a
few cases where we do it today, those being when
we lost the connection or when the supplicant
explicitly asked us to not tell the AP.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Instead of calling cfg80211 in ieee80211_send_deauth_disassoc()
pass out the frame and call it from the caller. That saves the
SKB allocation if we don't actually want to send the frame and
enables us to make the ordering smarter in the future.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In "cfg80211: no cookies in cfg80211_send_XXX()"
Holger Schurig removed the cookies in the calls
from mac80211 to cfg80211, but the ones in the
other direction were left in. Remove them now.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It's just a duplicate of ipw2100_bg_rates[].
Signed-off-by: NStanislav Yakovlev <stas.yakovlev@gmail.com>
Reviewed-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

I am running Debian testing kernel 3.1.0-1-amd64, using a 079b:0062 Sagem
XG-76NA 802.11bg stick.

Upon zd1211rw interface
bringup (ifconfig wlan0 up) I get the following timeout:

[  950.330573] zd1211rw 1-3:1.0: phy2
[  955.108510] zd1211rw 1-3:1.0: firmware version 4725
[  955.148532] zd1211rw 1-3:1.0: zd1211b chip 079b:0062 v4810 high 00-19-70
AL2230_RF pa0 g--NS
[snip]
[  955.204072] zd1211rw 1-3:1.0: error ioread32(CR_REG1): -110

A second ifconfig wlan0 up brings the interface up without problems.

After a bit more debugging, the call trace is the following:

[10241.028130] zd1211rw 1-3:1.0: zd_chip_lock_phy_regs: error
ioread32(CR_REG1): -110
[10241.028140] zd1211rw 1-3:1.0: zd_switch_radio_on: failed to lock PHY regs
[10241.028148] zd1211rw 1-3:1.0: zd_op_start: failed to set radio on

Adding a 10 milliseconds delay between the call to set_mc_hash() and
zd_chip_switch_radio_on() allows successful interface bringups in all
cases and matches what the vendor driver did.
Acked-by: NJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: NFlorian Fainelli <florian@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Recent commit
"mwifiex: clear previous security setting during association"
fixes association failure problems observed in some corner cases
by clearing previous security setting before each association.

We should reset encryption mode flag as well. This patch takes care
of it.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Nicolas Cavallari discovered that carl9170 has some
serious problems delivering data to sleeping stations.

It turns out that the driver was not honoring two
important flags (IEEE80211_TX_CTL_POLL_RESPONSE and
IEEE80211_TX_CTL_CLEAR_PS_FILT) which are set on
frames that should be sent although the receiving
station is still in powersave mode.

Cc: stable <stable@vger.kernel.org>
Reported-by: NNicolas Cavallari <Nicolas.Cavallari@lri.fr>
Signed-off-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On Access Point mode, when transmitting a packet, if the destination
station is in powersave mode, we abort transmitting the packet to the
device queue, but we do not reclaim the allocated memory.  Given enough
packets, we can go in a state where there is no packet on the device
queue, but we think the device has no memory left, so no packet gets
transmitted, connections breaks and the AP stops working.

This undo the allocation done in the TX path when the station is in
power-save mode.
Signed-off-by: NNicolas Cavallari <cavallar@lri.fr>
Acked-by: NChristian Lamparter <chunkeey@googlemail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This is a fixup for my:
iwlwifi: kill iwl_bus.h

Please fold them into one patch for upstream
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

Update the pci subsystem id and product name for 6005 series devices
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

Add new sku to 6x35 series
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

We can use forward declaration for the relevant struct since they
aren't dereferenced in the header file.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

Also add a might_sleep to enforce the context requirements.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

It is op_mode related
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

It is op_mode related
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

No one needs it any more
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

This is temporary, but at least we can now throw the bus away
and move the iwl_pci_{probe,remove} functions.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

They don't need to be in iwl-dev.h
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

The transport should not dereference the iwl_priv pointer. Remove a
few of those.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

Export it as "nic_error" notification, the error handling will be in
the op_mode.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

Export it as "hw_rf_kill" notification.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

Export them as "queue_full" and "queue_not_full" notification.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>

This is the op_mode's Rx handler.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>