After unregister_netdevice() call the request is queued and
reg_state is changed to NETREG_UNREGISTERING.
As we check for NETREG_UNREGISTERED state, free_netdev() never
gets executed causing memory leak.

Initialize "dev->destructor" to free_netdev() to free device
data after unregistration.

Cc: <stable@vger.kernel.org>
Reported-by: NDaniel Drake <dsd@laptop.org>
Tested-by: NDaniel Drake <dsd@laptop.org>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When the XO-4 with 8787 wireless is woken up due to wake-on-WLAN
mwifiex is often flooded with "not allowed while suspended" messages
and the interface is unusable.

[  202.171609] int: sdio_ireg = 0x1
[  202.180700] info: mwifiex_process_hs_config: auto cancelling host
               sleep since there is interrupt from the firmware
[  202.201880] event: wakeup device...
[  202.211452] event: hs_deactivated
[  202.514638] info: --- Rx: Data packet ---
[  202.514753] data: 4294957544 BSS(0-0): Data <= kernel
[  202.514825] PREP_CMD: device in suspended state
[  202.514839] data: dequeuing the packet ec7248c0 ec4869c0
[  202.514886] mwifiex_write_data_sync: not allowed while suspended
[  202.514886] host_to_card, write iomem (1) failed: -1
[  202.514917] mwifiex_write_data_sync: not allowed while suspended
[  202.514936] host_to_card, write iomem (2) failed: -1
[  202.514949] mwifiex_write_data_sync: not allowed while suspended
[  202.514965] host_to_card, write iomem (3) failed: -1
[  202.514976] mwifiex_write_data_async failed: 0xFFFFFFFF

This can be readily reproduced when putting the XO-4 in a loop where
it goes to sleep due to inactivity, but then wakes up due to an
incoming ping. The error is hit within an hour or two.

This issue happens when an interrupt comes in early while host sleep
is still activated. Driver handles this case by auto cancelling host
sleep. However is_suspended flag is still set which prevents any cmd
or data from being sent to firmware. Fix it by clearing is_suspended
flag in this path.

Cc: <stable@vger.kernel.org>
Reported-by: NDaniel Drake <dsd@laptop.org>
Tested-by: NDaniel Drake <dsd@laptop.org>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

* Register Modification for xLNA board.
* TX gain table modification for zero calibration.
* AUX chain (LNA2) sensitivity enhancement
* Modify diversity bias default setting in INI.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When a reset or a channel-change happens, for managed mode,
the HW beacon timers have to be programmed after the TSF has
been synchronized. This is handled via the sync flags.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Jake reported that since commit 1672c0e3
"mac80211: start auth/assoc timeout on frame status", he is unable to
connect to his AP, which is configured to use passive channel.

After switch to passive channel 4965 firmware drops any TX packet until
it receives beacon. Before commit 1672c0e3 we waited on channel and
retransmit packet after 200ms, that makes we receive beacon on the
meantime and association process succeed. New mac80211 behaviour cause
that any ASSOC frame fail immediately on iwl4965 and we can not
associate.

This patch restore old mac80211 behaviour for iwl4965, by removing
IEEE80211_HW_REPORTS_TX_ACK_STATUS feature. This feature will be
added again to iwl4965 driver, when different, more complex
workaround for this firmware issue, will be added to the driver.

Cc: stable@vger.kernel.org # 3.9
Bisected-by: NJake Edge <jake@lwn.net>
Reported-and-tested-by: NJake Edge <jake@lwn.net>
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add handling of rx descriptor underflow. This fixes a fault that could
happen on slow machines, where data is received faster than the CPU can
handle. In such a case the device will use up all rx descriptors and
refuse to send any more data before confirming that it is ok. This
patch enables necessary interrupt to discover such a situation and will
handle them by dropping everything in the ring buffer.
Reviewed-by: NMichael Buesch <m@bues.ch>
Signed-off-by: NThommy Jakobsson <thommyj@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch claim to fix "WARNING: at net/mac80211/util.c:599
ieee80211_can_queue_work.isra.7+0x30/0x40", which was reported at:

https://bugzilla.redhat.com/show_bug.cgi?id=922295

We use ATH_STAT_STARTED flag to disallow to perform
ath5k_tx_complete_poll_work() code, hence reschedule
ah->tx_complete_work, when we stop device. This flag was defined in
ath5k code, but it was not used.

I didn't get feedback if the fix works, so patch is compile only tested.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If no keycache slots are available, ath_key_config can return -ENOSPC.
If the key index is not checked for errors, it can lead to logspam that
looks like this: "ath: wiphy0: keyreset: keycache entry 228 out of range"
This can cause follow-up errors if the invalid keycache index gets
used for tx.

Cc: stable@vger.kernel.org
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

A major change in the rtlwifi family recently added code to detect when
there is loss of AP signals. One critical statement needed for the USB
driver was missed.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Commit 7088f4835aa353f7226e57e73fd9e6564a4dfb75
"Merge branch 'master' of
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless"
ramoved call to brcms_led_unregister in mac80211_if.c
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NPiotr Haber <phaber@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Acked-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There exist mismatch between the size used for pci_map and
pci_unmap on command skb. Correcting it.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All the command buffers are freed in mwifiex_free_cmd_buffer()
and hence there is no need to kfree the current command buffer
again. This might ends up freeing memory allocated by some other
kernel code.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

"drivers should call pci_release_region() AFTER
calling pci_disable_device()"

Please refer section 3.2 Request MMIO/IOP resources
in Documentation/PCI/pci.txt

Cc: <stable@vger.kernel.org> # 3.2+
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

PCI regions are associated with the device using
pci_request_region() call. Hence use pci_release_region()
instead of pci_release_regions().

Cc: <stable@vger.kernel.org> # 3.2+
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

FW does the synchronization of the different modules during init.
It will report different modules, that it is ready at different times.
The fw download 'winner' will be reported fw ready first. Without this
patch, btmrvl was already continuing before the FW told it too. Probably
on behalf of the 'winner' which then never sees FW ready and times out.
Signed-off-by: NAndreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>

If not winner, driver must release the sdio host lock, so the fw
download can progress. While holding the lock fw download is stalled
and the following error is produced:

[  235.746015] Bluetooth: FW failed to be active in time!
[  235.752799] Bluetooth: Downloading firmware failed!
Signed-off-by: NAndreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>

Clean up the code by using native debugfs helpers, instead of implementing
them ourselves:

	debugfs_create_u8()
	debugfs_create_x16()
	debugfs_create_file()
	debugfs_remove_recursive()
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>

This patch adds support for Intel Bluetooth device by adding
btusb_setup_intel() routine that update the device with ROM patch.

T:  Bus=02 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  4 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=8087 ProdID=07dc Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
Signed-off-by: NTedd Ho-Jeong An <tedd.an@intel.com>
Acked-by: NMarcel Holtmann <marcel@holtmann.org>
Acked-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>

Rotate bss prio list, so the bss next to the one served, will come first
in the list of bss' with equal priority. This way we pick bss nodes in a
round robin fashion. Using list rotation instead of a cur ptr simplifies
iteration to calling list_for_each_entry. List rotation is done via
list_move, where the head itself is temporarily removed and then
re-inserted after the bss just served.
Signed-off-by: NAndreas Fenkart <andreas.fenkart@streamunlimited.com>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

After a packet is successfully transmitted, ra list is rotated, so the ra
next to the one transmitted, will be the first in the list. This way we
pick the ra' in a round robin fashion. This significantly simplifies
iteration in  mwifiex_wmm_get_highest_priolist_ptr to a call to
list_for_each_entry.
List rotation is done via list_move, where the head itself is temporarily
removed and then re-inserted after the item just transferred.
Signed-off-by: NAndreas Fenkart <andreas.fenkart@streamunlimited.com>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The firmware provides credits to the driver per WMM-AC. When
only AC_BE are to be transmitted to the firmware the driver
may use credits from other priorities to send AC_BE packets
towards the firmware.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In brcmf_fws_init() the error flows were not properly handled
and the caller ignored the return value. The only action that
is allowed to fail in brcmf_fws_init() is setting the tlv in
firmware as the feature is not supported on all devices.

Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When firmware signals the driver to remove a destination entry
it may have sk_buff packets queued for it. These should be freed.
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Adds support for the critical protocol API provided by nl80211
which gives Wifi traffic priority over a Bluetooth (e)SCO connection
and disables scanning during DCHP negotiation.
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NPiotr Haber <phaber@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

During the DHCP protocol exchange it is benificial to suppress
scan requests which may decrease time to complete DHCP protocol.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

After the commit "ath9k: improve dma map failure handling", the
wrong buffer was DMA-unmapped, introducing warnings like the one below.
This patch fixes the issue.

WARNING: at /home/sujith/dev/wireless-testing/lib/dma-debug.c:986 check_sync+0x4bc/0x580()
Hardware name: LIFEBOOK AH531
ath9k 0000:02:00.0: DMA-API: device driver tries to sync DMA memory it has not allocated [device address=0x00000000d9012800] [size=48 bytes]
Pid: 86, comm: kworker/u:5 Tainted: G        W  O 3.9.0-rc8-wl-debug #106
Call Trace:
 [<ffffffff810410c0>] warn_slowpath_common+0x70/0xa0
 [<ffffffff8104113c>] warn_slowpath_fmt+0x4c/0x50
 [<ffffffff8125432c>] check_sync+0x4bc/0x580
 [<ffffffff8109e5f7>] ? trace_hardirqs_on_caller+0xa7/0x190
 [<ffffffff8109e6ed>] ? trace_hardirqs_on+0xd/0x10
 [<ffffffff81254488>] debug_dma_sync_single_for_device+0x48/0x50
 [<ffffffffa0a53825>] ? ath9k_iowrite32+0x35/0x90 [ath9k]
 [<ffffffff812512f0>] ? swiotlb_tbl_sync_single+0x50/0x90
 [<ffffffff81251350>] ? swiotlb_sync_single+0x20/0x30
 [<ffffffff8125137f>] ? swiotlb_sync_single_for_device+0xf/0x20
 [<ffffffffa0a58baf>] ath_rx_edma_buf_link+0xef/0x140 [ath9k]
 [<ffffffffa0a58c4e>] ath_rx_addbuffer_edma+0x4e/0x90 [ath9k]
 [<ffffffffa0a59c51>] ath_startrecv+0xf1/0x120 [ath9k]
 [<ffffffffa0a550e0>] ath_complete_reset+0x20/0x130 [ath9k]
 [<ffffffffa0a5790d>] ath_reset_internal+0x10d/0x210 [ath9k]
 [<ffffffffa0a5878c>] ath9k_config+0x47c/0x7b0 [ath9k]
 [<ffffffffa06d4978>] ieee80211_hw_config+0x88/0x3f0 [mac80211]
 [<ffffffffa06d4a3f>] ? ieee80211_hw_config+0x14f/0x3f0 [mac80211]
 [<ffffffffa06dbed1>] __ieee80211_scan_completed+0xc1/0x440 [mac80211]
 [<ffffffffa06dd002>] ieee80211_scan_work+0x82/0x440 [mac80211]
 [<ffffffff810606a3>] process_one_work+0x1e3/0x530
 [<ffffffff81060641>] ? process_one_work+0x181/0x530
 [<ffffffff8106163f>] worker_thread+0x10f/0x3c0
 [<ffffffff81061530>] ? manage_workers+0x330/0x330
 [<ffffffff810665da>] kthread+0xea/0xf0
 [<ffffffff810664f0>] ? kthread_create_on_node+0x140/0x140
 [<ffffffff8146085c>] ret_from_fork+0x7c/0xb0
 [<ffffffff810664f0>] ? kthread_create_on_node+0x140/0x140

Cc: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The RX fifo can be accessed from the common tasklet or it can
be reaped/cleaned when RX is stopped, which is done when doing
a reset or channel change - this happens in process context.

Since it is ensured that there are no pending tasklets when
stopping RX and cleaning the FIFO, there is no need to use
SKB queue functions which take internal locks.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The EDMA case is handled first, so the else condition
can be removed.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The split makes no sense and merging the functions makes further changes
easier to implement
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

GCC 4.8 is spitting out uninitialized-variable warnings against
"drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c".  This patch adds
initialization to the variable and properly sets its value.

Signed-off-by: Han Shen  (shenhan@google.com)
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

According to 802.11-2007 17.3.8.6 (slot time), the slot time should
be increased by 3 us * coverage class. The code only increased the
ack timeout, which is fixed by this patch.

We have noticed in our long shot scenario that we see less collisions
with this patch.
Signed-off-by: NMathias Kretschmer <mathias.kretschmer@fokus.fraunhofer.de>
[add standard reference and commit message]
Signed-off-by: NSimon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All radio ops are 16b (there is only 1 exception for reg 0x1), so we
deprecated b43_radio_read16 and b43_radio_write16 long time ago.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Sort defines, use one macro for all revs, support for 5GHz when
uploading antenna table.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Also make a function name shorter so we can easily fit 80 chars.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>