ath10k: fix num_legacy_stations tracking

If a station was reassociated, i.e. due to change
of supported rates update via sta_rc_update() the
num_legacy_stations would be (incorrectly) bumped
up leading to unbalanced usage of the var. This in
turn could lock rtscts protection up as enabled.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: re-enable interrupts properly in hw recovery

Recent changes done to start/restart sequences
broke hw recovery in some hw configurations. The
pci transport was stopped twice however due to a
workaround in the pci disabling code the
disable/enable for first msi interrupt was not
balanced. This ended up with irqs not being
properly re-enabled and the following print out
during recovery:

 ath10k: failed to receive control response completion, polling..
 ath10k: Service connect timeout: -110
 ath10k: Could not init core: -110

Legacy interrupt mode was unaffected while msi
ranged mode would be partially crippled (it would
miss fw indication interrupts but otherwise it
worked fine).

This fixes completely broken fw recovery for a
single msi interrupt mode and fixes subsequent fw
crash reports for msi range interrupt mode.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

carl9170: tx: Replace rcu_assign_pointer() with RCU_INIT_POINTER()

According to RCU_INIT_POINTER()'s block comment 3.a, it can be used if
"3.   The referenced data structure has already been exposed to readers either
at compile time or via rcu_assign_pointer() -and-
 a.   You have not made -any- reader-visible changes to this structure since
then".

This case fulfills the conditions above because between the rcu_dereference()
call (cvif = rcu_dereference(ar->beacon_iter);) and the rcu_assign_pointer()
call there is no update of the "cvif" variable.
Therefore, this patch makes the replacement.

The following Coccinelle semantic patch was used:
@@
identifier v;
@@

v = rcu_dereference(...);
... when != rcu_dereference(...);
    when != v = ...;
    when != (<+...v...+>)++;
    when != \(memcpy\|memset\)(...);
(
- rcu_assign_pointer
+ RCU_INIT_POINTER
  (..., v);
|
 if(...) {
... when != v = ...;
- rcu_assign_pointer
+ RCU_INIT_POINTER
  (..., v);
... when any
 }
)

Because there are cases where between a “rcu_dereference()” call and a
“rcu_assign_pointer()” call might be updates of the value that interests us,
the Coccinelle semantic patch ignores them and replaces with
"RCU_INIT_POINTER()" only when the update is not happening.

Signed-off-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context timer

Setup the channel context correctly. Not doing this was
causing beacon loss in a P2P-GO/STA concurrent setup.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add more debug statements for channel context

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Disable fastcc for channel context mode

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: support Ralink 5362.

Signed-off-by: Canek Peláez Valdés <canek@ciencias.unam.mx>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context creation

If a new context is being added in addition to the current one,
then send the ASSIGN event to abort a running scan since
the addition of a context is usually followed by VIF
assignment and further operations.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix interface limits

There is no reason why managed/p2p interfaces have to
be limited to one. IBSS is the only type that needs
a restriction.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Print the event/state in ath_chanctx_event

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add new chanctx events

This will be useful in handling addition/change of new
channel contexts.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix ath_chanctx_get()

Move it inside a CONFIG_ATH9K_CHANNEL_CONTEXT ifdef
since it is not needed otherwise.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move ath9k_beacon_add_noa to channel.c

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Remove redundant ifdef

This was introduced in an earlier patch to handle
a compilation warning, but since the channel context
code has been mostly isolated, this is not required now.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context variables in ath_softc

chanctx_work and next_chan are required only when
CONFIG_ATH9K_CHANNEL_CONTEXT is enabled.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix 'offchannel' in ath_softc

Finally move the 'offchannel' instance in ath_softc
inside a CONFIG_ATH9K_CHANNEL_CONTEXT cage. The offchannel
usage in ath9k_calculate_iter_data() is closed off with
an ifdef for now, since the state/opmode calculation is
common for both the channel context mode and the normal mode.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix function argument type

ath9k_vif_iter() was earlier used as an iterator
routine when calling a mac80211 utility. This is no
longer the case and hence we can mention the argument
type explicitly.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Use ath_chanctx_check_active properly

ath_chanctx_check_active() is required only when channel contexts
are used. Make sure that it is not called in normal usage.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add ath9k_offchannel_init

This patch adds a routine to setup the offchannel
instance in ath_softc.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add ath9k_chanctx_wake_queues

Introduce a function that handles queues in channel
context mode.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add wrappers for beacon events

Using these wrappers allows us to move the 'sched'
variable in ath_softc inside CONFIG_ATH9K_CHANNEL_CONTEXT.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix function declarations

These routines are required only when
CONFIG_ATH9K_CHANNEL_CONTEXT is enabled.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context events

Check if channel context usage is enabled before
calling ath_chanctx_event() from various parts of the
driver. Also, make sure that ath_chanctx_event() is
compiled only when CONFIG_ATH9K_CHANNEL_CONTEXT is
enabled.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_switch static

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_get_oper_chan static

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_offchan_switch static

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Conditionally compile more functions

Use CONFIG_ATH9K_CHANNEL_CONTEXT to exclude:

ath_scan_complete()
ath_roc_complete()
ath_offchannel_next()
ath_scan_next_channel()
ath_scan_channel_duration()

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Exclude more functions

Use CONFIG_ATH9K_CHANNEL_CONTEXT to exclude more functions:

ath_offchannel_channel_change()
ath_scan_channel_start()
ath_scan_send_probe()

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Conditionally compile a few functions

Exclude these functions when CONFIG_ATH9K_CHANNEL_CONTEXT is not
enabled:

ath_chanctx_send_vif_ps_frame()
ath_chanctx_send_ps_frame()
ath_chanctx_defer_switch()
ath_chanctx_set_next()

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Cleanup mgd_prepare_tx callback

Rename the callback from ath9k_chanctx_force_active()
to ath9k_mgd_prepare_tx(). Also, move it to main.c and
group it with the other callbacks.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_work static

Also compile it conditionally based on
CONFIG_ATH9K_CHANNEL_CONTEXT.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a routine to tear down channel contexts

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a routine for initializing channel contexts

Setup the offchannel/sched timers and the chanctx work
inside the new function.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

carl9170: Remove redundant protection check

The carl9170_op_ampdu_action() function is used only by the mac80211
framework.
Since the mac80211 already takes care of checks and properly serializing
calls to the driver's function there is no need for the driver to do the same
thing.

Signed-off-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Isolate ath9k_use_chanctx module parameter

This patch ensures that the module parameter "use_chanctx" is
visible only when CONFIG_ATH9K_CHANNEL_CONTEXT is selected.
Also register the channel context callbacks with mac80211 only
when it is explicitly enabled and compile them out of the driver
when CONFIG_ATH9K_CHANNEL_CONTEXT is not selected.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Isolate P2P powersave routines

Use CONFIG_ATH9K_CHANNEL_CONTEXT to conditionally
compile P2P-PS code.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move P2P functions to channel.c

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a config option for channel context

Channel contexts are supported only for P2P right now,
so make sure that the 'normal' path remains unaffected
by using a config option. This will also reduce the size
of the driver.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add debug information

Add a few statements to debug channel context operation.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move channel operations to channel.c

This reduces clutter in main.c

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Handle failure to allocate HW timer

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a debug level for channel context

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: remove redundant null check before kfree()

kfree() null-checks its argument.
Found by smatch.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: ensure led name is null terminated

Add the missing null termination after strncpy().

This isn't actually a buffer overflow in this case since we use
snprintf() appropriately to fill the buffer passed by the caller,
but in the interest of not turning this into a bug down the road,
go ahead and force termination here.

Found by Coverity.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: drop useless comparison

rxs->rate_idx is unsigned, so it will always be >= 0.
Found by Coverity.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ray_cs: Add include guards

The files ray_cs.h and rayctl.h both contain two thirds of what
appears to be an include guard using the macro name RAYLINK_H (both
lack the #define). Since RAYLINK_H is not defined anywhere, the
#ifndefs are confusing no-ops. Add proper include guards using
different macro names.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

bcma: only map wrapper if its address is available

The Chipcommon B core does not have a wrap address and it would fail here.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: use firmware API revision from GET_HW_SPEC response

Newer firmware returns API revision in GET_HW_SPEC command
response. We will make use of it instead of parsing this
information from FW release number.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: rename macro and variables related to API revision

We will remove 'fw' prefix from these variable and macro
names and make them generic.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: fix left_len calculation issue

While updating 'left_len' in each iteration, we should subtract
last TLV length not the accumulated length of TLVs parsed till
now.
This bug in parsing logic is exposed by newer firmware which adds
two TLVs in GET_HW_SPEC command response. Earlier firmwares used to
add only one TLV.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: advertise support for TDLS

Based on a quick test with AR9271, TDLS seems to be working fine.

Tests were done with 2 Atheros AR9271 based devices with firmware
1.3 (sha1 8d49f928aa40ac53c729189bff1333cd373a7fb5), associated
with a WAP54G access point. TDLS worked fine both in WPA2 mode and
without encryption. Stations maintained ping flood traffic between
each other and towards the AP without significant losses.

Not tested with AR7010.

TDLS was enabled in earlier patches the same way for other
Atheros drivers:
ath9k (fd6562344dea2b8b2a5d644cf971f4e56004500a),
and carl9170 (d1f3de71a584a82ee4e84505fce9acccf40215ff).

Signed-off-by: Csaba Kiraly <csaba.kiraly@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

MAINTAINTERS: The NFC list is subscribers-only

It's not moderated, it's subscribers-only.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-linville' of git://github.com/kvalo/ath

ath10k: make target endianess more explicit

Some copy engine structures are target specific
and are uploaded to the device during
init/configuration.

This also cleans up a bit diag_mem_read/write
implicit byteswap mess leaving only
diag_access_read/write with an implicit endianess
byteswap.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: dont duplicate service-pipe mapping

The mapping is already defined in a structure. It
makes little sense to duplicate information stored
in it within a function.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: move pci init structures

It doesn't make much sense to have copy engine
configuration structures spread across the whole
source file.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: fix fw crash dumping

Recent crash dump patches introduced a regression.
If debugfs was disabled upon crash user could only
see the following:

 [  793.880000] ath10k: firmware crashed! (uuid n/a)
 [  793.890000] ath10k: qca988x hw2.0 (0x4100016c, 0x043202ff) fw 10.1.467.2-1 api 2 htt 2.1
 [  793.890000] ath10k: debug 0 debugfs 0 tracing 0 dfs 1

The report was missing register dump. Fix it by
printing registers regardless if crash_data is
present or not.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: improve logging to include dev id

This makes it a lot easier to log and debug
messages if there's more than 1 ath10k device on a
system.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

orinoco_usb: use USB API functions rather than constants

This patch introduces the use of the functions
usb_endpoint_is_bulk_in(epd) and usb_endpoint_is_bulk_out(epd).

The semantic patch that makes these changes is as follows:

@@ struct usb_endpoint_descriptor *epd; @@

- ((epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) ==
- \(USB_ENDPOINT_XFER_BULK\|2\))
+ usb_endpoint_xfer_bulk(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- ((epd->bEndpointAddress & \(USB_ENDPOINT_DIR_MASK\|0x80\)) ==
-  \(USB_DIR_IN\|0x80\))
+ usb_endpoint_dir_in(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- ((epd->bEndpointAddress & \(USB_ENDPOINT_DIR_MASK\|0x80\)) ==
-  \(USB_DIR_OUT\|0\))
+ usb_endpoint_dir_out(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- (usb_endpoint_xfer_bulk(epd) && usb_endpoint_dir_in(epd))
+ usb_endpoint_is_bulk_in(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- (usb_endpoint_xfer_bulk(epd) && usb_endpoint_dir_out(epd))
+ usb_endpoint_is_bulk_out(epd)

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

atmel_cs: Remove typedef local_info_t

The Linux kernel coding style guidelines suggest not using typedefs
for structure types. This patch gets rid of the typedef for
local_info_t. Also, the name of the struct is changed to drop the _t,
to make the name look less typedef-like.

The following Coccinelle semantic patch detects the case:

@tn@
identifier i;
type td;
@@

-typedef
 struct i { ... }
-td
 ;

@@
type tn.td;
identifier tn.i;
@@

-td
+ struct i

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wireless: core: Reorder wiphy_register() notifications relevantly

Currently it can send regulatory domain change notification before any
NEW_WIPHY notification. Moreover, if rfill_register() fails, calling
wiphy_unregister() will send a DEL_WIPHY though no NEW_WIPHY had been
sent previously.

Thus reordering so it properly notifies NEW_WIPHY before any other.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

net: wireless: ipw2x00: ipw2200.c: Cleaning up missing null-terminate in conjunction with strncpy

Replacing strncpy with strlcpy to avoid strings that lacks null terminate.

Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wireless: wlcore: Use devm_kzalloc

This patch introduces the use of devm_kzalloc and does away with the
kfrees in the probe and remove functions. Also, a couple of labels and
the initial assignment of the ret variable in the probe function are
removed.

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix access after free in wil_pcie_remove()

'wil'  released in wil_if_free(); save iomapped address aside to
properly unmap it.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: cfg80211_rx_mgmt to use GFP_ATOMIC

Internally, cfg80211_rx_mgmt() takes lock:
spin_lock_bh(&wdev->mgmt_registrations_lock);

and therefore one can't use it with GFP_KERNEL allocation flags.
When called with GFP_KERNEL, "sleep while atomic" warning triggered:

<3>[242645.446224] BUG: sleeping function called from invalid context at kernel/mm/slub.c:926
<3>[242645.455516] in_atomic(): 1, irqs_disabled(): 0, pid: 18881, name: kworker/u16:0
<6>[242645.462868] CPU: 0 PID: 18881 Comm: kworker/u16:0 Tainted: G           O 3.10.40-g619a884-00001-g357fa9c #2
<6>[242645.463044] Workqueue: wil6210_wmi wmi_event_worker [wil6210]
<6>[242645.463087] Call trace:
<6>[242645.463157] [<ffffffc000087390>] dump_backtrace+0x0/0x144
<6>[242645.463205] [<ffffffc0000874e4>] show_stack+0x10/0x1c
<6>[242645.463259] [<ffffffc0009abc04>] dump_stack+0x1c/0x28
<6>[242645.463313] [<ffffffc0000c10c0>] __might_sleep+0xe0/0xf0
<6>[242645.463365] [<ffffffc00015a514>] kmem_cache_alloc+0x48/0x1e4
<6>[242645.463414] [<ffffffc00080d468>] __alloc_skb+0x48/0x164
<6>[242645.463466] [<ffffffc00097f2c4>] nl80211_send_mgmt+0x4c/0x1dc
<6>[242645.463511] [<ffffffc000980268>] cfg80211_rx_mgmt+0x1bc/0x25c
<6>[242645.463647] [<ffffffbffc005d64>] wmi_evt_rx_mgmt+0x21c/0x23c [wil6210]
<6>[242645.463783] [<ffffffbffc0073b8>] wmi_event_worker+0x230/0x2f8 [wil6210]
<6>[242645.463838] [<ffffffc0000afffc>] process_one_work+0x258/0x3d0
<6>[242645.463887] [<ffffffc0000b0fe0>] worker_thread+0x1f0/0x310
<6>[242645.463946] [<ffffffc0000b642c>] kthread+0xac/0xb8

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix free'd memory access in wil_if_free()

In the wil_priv_deinit(), wdev->netdev is accessed, so free_netdev()
should not be called before mentioned call.

Set wdev->netdev to NULL Make sure no more attempts to use it.
It is used for debug printk if not NULL.

This fix kernel panic on module unload and in case error on probe;
if memory allocation debugging enabled.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: Limit max number of associated stations

Add a module parameter to support setting the maximum
number of stations that can be associated to an AP.

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix false "scan timeout"

When sending scan request, if hardware is not ready, scan timer was started
and scan timeout mis-reported.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix beamforming data reporting

When reading 'bf' file on debugfs, query beam forming status from firmware.
Ignore CID's that return error or return all zeros.

Remove obsolete code that used to maintain statistics on per-device basis,
as now it is reported be per-CID and current.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: convert debugfs to the table mode

Define tables for similar file entries, i.e.
- table for debugfs_create_file
- table for static parameters
- table for parameters that are members of "wil" structure
- table for blobs
- table for interrupt controllers

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: Workaround for Sparrow with bad device id

If firmware broken on the boot time, Sparrow card enumerates as
device 0x302 instead of 0x310. Allow using this ID

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: wait longer for hardware reset completion

Typical time for hardware reset, as measured, is about 200..250 msec.
Adjust sleeping to use more relaxed msleep, increase sleep interval
and increase total sleep time to be about 1sec

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: check error in wil_target_reset()

When resetting target in wil_target_reset(), error may occur.
Indicate error via error code. In case of error, don't attempt to further
interact with card, specifically don't attempt firmware download or
interrupts enabling.

Move wil_rx_fini() to be always executed to prevent memory leak.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: update copyright year 2014

Fix Copyright headers in all files changed in 2014, to mention 2014

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix race in reset

It is important to halt USER CPU first, then MAC CPU
Otherwise, race happens in the firmware

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: map MAC timer for packet lifetime into debugfs

expose reading RGF_MAC_MTRL_COUNTER_0 in debugfs

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: fix decimal printf format specifiers prefixed with 0x

The prefix suggests the number should be printed in hex, so use
the %x specifier to do that.

Found by using regex suggested by Joe Perches.

Signed-off-by: Hans Wennborg <hans@hanshq.net>
Acked-by: Avinash Patil <patila@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

cw1200: Introduce the use of devm_kzalloc

This patch introduces the use of devm_kzalloc and does away with the
kfrees in the probe and remove functions.

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

net: wireless: wl1251: Remove unnecessary free_irq

This patch does away with free_irq in the remove function as the irq is
allocated with a devm_request_irq.

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: support setting custom TX power

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: implement PPR (Power Per Rate) management/API

Broadcom hardware supports auto-adjustment of TX power depending on the
currently used rate. So far all calculations were handled without any
helpers (API) using big arrays and magic offsets.
It seems Broadcom recently decided to clean this up by developing PPR.
Their wlc_ppr.h can be found in open parts of the SDK.
As we plan to implement support for rate-based TX power it makes sense
to also implement our version of PPR as well.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: add RF power tables for radio 0x2057 revs 9 & 14

Don't write them as we don't have gains configured correctly yet.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: update rev3+ gain control workarounds

This fixes workarounds on rev 6+ and cleans code slightly.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: flush some writes on Broadcom MIPS SoCs

Access to PHY and radio registers is indirect on Broadcom hardware and
it seems that addressing on some MIPS SoCs may require flushing. So far
this problem was noticed on 0x4716 SoC only (marketing names: BCM4717,
BCM4718).

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: don't duplicate common PHY read/write ops

Most of the PHYs use the same way of accessing registers, so move that
code to the shared place. An exception is G-PHY which sometimes access
A-PHY regs and requires special handling.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: update flushing many writes performed in a row

Flush radio writes as well and add some tiny optimizations (e.g.
masksetting PHY reg involves reading it, so reset the counter).

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next

ath10k: flush hif buffers before recovery

Transport buffers weren't flushed and processed
before queueing hw recovery request to mac80211.

This could in theory result in an unwanted htt/wmi
rx events being processed while mac80211 recovers
the device and possibly interfere or even crash
the system.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: remove ar_pci->started

There are basically no more uses for
ar_pci->started. It is also perfectly safe to call
hif_stop without hif_start now.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: ignore ar_pci->started in pipe cleanup

Structures used by these functions are now
guaranteed to remain accessible until driver is
unregistered.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: update comment regarding warm reset

The old comment was a little out of date. HTT Rx
ring is a more relevant problem when stopping
transport layer.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: rework posting pci rx buffers

It was possible on a host system running low on
memory to end up with no rx buffers on pci pipes.

This makes the driver more robust as it won't fail
to start if it can't allocate all rx buffers right
away. If it is fatal then upper layers will notice
trouble anyway.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: remove early irq handling

It's not really necessary to have a dedicated irq
handler just for the sake of catching early fw
crashes anymore. It is now safe to use one handler
even during early stages of device boot up.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: make sure to really disable irqs

This fixes two corner cases.

One is a race between disabling copy engine
interrupts and unhandled pending interrupts on the
host. This could end up with a runaway tasklet and
consequently memory leak of a few copy engine
rx buffers.

The other one is an unexpected (and non-maskable
via device CSR) MSI fw indication interrupt during
teardown. This could trigger the same problem as
the first corner case.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: split ce irq/handler setup

It doesn't make much sense to overwrite send_cb
and recv_cb callbacks over and over again whenever
transport starts. Just make sure to unmask copy
engine interrupts when starting.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: setup irq method in probe

It doesn't make sense to re-init irqs completely
whenever transport is started/stopped. Do it just
once upon probing/removing.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: fix legacy irq workaround

Wrong register was being set up. This could
prevent firmware from booting in some rare cases
when using legacy interrupts.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: move fw init print

Firmware probing is done only once when driver is
registered and firmware version is guaranteed to
remain the same until driver is unregistered.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: print more driver info when firmware crashes

Sometimes users forget to include important info like firmware version,
so better to print all the info.

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: rename ath10k_pci_hif_dump_area() to ath10k_pci_fw_crashed_dump()

Better to have a clear name for the function. While at it, clear up the title
for the register dump.

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>