New bus layers like pcie require nvram parsing routines which are
the same routines as being used by sdio. Make these routines common
in the new file nvram.c. Update sdio to use these routines and
simplify the nvram upload process. Also add memory validation check
for downloaded firmware and nvram in debug mode.
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Keeping this as 0 is ok according to spec section 9.7.11
as this means the limits are according to the Tx/Rx
supported MCS x NSS bitmap. Initially we've set these as
there were concerns of interop issues but these turned out
to be false.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If we try to write NVM that do not exist, the function will return
uninitialized value. fixed.
Signed-off-by: Eytan Lifshitz <eytan.lifshitz@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Add an inline helper function for getting an RX packet's
length or payload length and use it throughout the code
(most of which I did using an spatch.)

While at it, adjust some code, and remove a bogus comment
from the dvm calibration code.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

All beamformee supporting chips have the ability to support
VHT NDP in up to 4 STSs. So change the published beamformee
STS cap accordingly to 3 as it should be Nsts-1.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The request of SMPS issued by the Thermal Throttling code
was not reset when we disassociated - fix that.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

It's a bit strange to treat an array as a pointer, so use proper
array indexing instead.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If the length isn't set it means we want all the SRAM.
Also - this is perfectly valid to partially dump starting
at offset 0.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Discovered by klocwork

Array 'iwl_rate_mcs' of size 15 may use index value(s) -1
  * rs.c:2562: index = iwl_hwrate_to_plcp_idx(rate)
    * rs.c:2562: Result of function call 'iwl_hwrate_to_plcp_idx(rate)' is '[-1,14]'
  * rs.c:2565: Array 'iwl_rate_mcs' size is 15.
  * rs.c:2565: Possible attempt to access element -1 of array 'iwl_rate_mcs'.

While at it stop using index = -1 and always use IWL_RATE_INVALID
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Some NIC comes with more than the 4 NVM (non volative
memory) sections described in the nvm_to_read array.
These NICs usually get their NVM from an external file
fetched from userland during init.
We already parsed the file, but sent to the NIC only 4 NVM
sections whereas there could be more sections in the file.
Fix this.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Since seq_number is incremented right after using
it, so printed seq_ctrl was actually the next
one to be used.

Fix it by incrementing the seq_number only later,
before saving it.

Additionally, use the IEEE80211_SEQ_TO_SN macro
in order to print the actual sequence number.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Enabling the oscillator consumes slightly more power (100uA)
but allows to make sure that we exit from L1 on time.

Not doing so might lead to a PCIe specification violation
since we might wake up from L1 at the wrong time.
This issue has been identified on 3160 and 7260 only.
On older NICs L1 off is not enabled, on newer NICs (7265),
the issue is fixed.

When the bug occurs the user sees that the NIC has
disappeared from the PCI bridge, any access to the device
returns 0xff.

This fixes:
	https://bugzilla.kernel.org/show_bug.cgi?id=64541

and has been extensively discussed here:
	http://markmail.org/thread/mfmpzqt3r333n4bo

Cc: stable@vger.kernel.org [3.10+]
Fixes: 99cd4714 ("iwlwifi: add 7000 series device configuration")
Reported-and-tested-by: wzyboy <wzyboy@wzyboy.org>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The call to clamp_t() first truncates the variable signed 8 bit and as a
result, the actual clamp is a no-op.

Fixes: 0d78156e ('p54: improve site survey')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Delete a variable that is at most only assigned to a constant, but never
used otherwise.

A simplified version of the semantic patch that fixes this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
type T;
identifier i;
constant c;
@@

-T i;
<... when != i
-i = c;
...>
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Global Transmission Timeout interrupts are generated by
the HW when transmission of a frame fails - this is done
based on the threshold programmed in the AR_GTXTO register.

Currently, even though the interrupt is enabled for all chips,
it is not handled in the driver. This patch handles GTT events
for AR9003 and above chips, checking if the MAC/BB has hung
after successive GTT interrupts crosses a threshold (5).

This can be enabled for the older chips in the AR9002 family once
appropriate HW hang checks are implemented for them.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

There is no need to do this and we can avoid
an unused variable warning when CONFIG_ATH9K_WOW is
not selected.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This would be useful when debugging RX performance issues.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Also, rename node_stat to node_aggr.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The asyncronous firmware load uses a completion struct to hold firmware
processing until the user-space routines are up and running. There is.
however, a problem in that the waiter is nevered canceled during teardown.
As a result, unloading the driver when firmware is not available causes an oops.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The asyncronous firmware load uses a completion struct to hold firmware
processing until the user-space routines are up and running. There is.
however, a problem in that the waiter is nevered canceled during teardown.
As a result, unloading the driver when firmware is not available causes an oops.

To be able to access the completion structure at teardown, it had to be moved
into the b43_wldev structure.

This patch also fixes a typo in a comment.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported
when b43 is used with hostapd, and rfkill is used to kill the radio output.

The lockdep splat (in part) is as follows:

======================================================
[ INFO: possible circular locking dependency detected ]
3.12.0 #1 Not tainted
-------------------------------------------------------
rfkill/10040 is trying to acquire lock:
 (rtnl_mutex){+.+.+.}, at: [<ffffffff8146f282>] rtnl_lock+0x12/0x20

but task is already holding lock:
 (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa04832ca>] rfkill_fop_write+0x6a/0x170 [rfkill]

--snip--

Chain exists of:
  rtnl_mutex --> misc_mtx --> rfkill_global_mutex

The fix is to move the initialization of the hardware random number generator
outside the code range covered by the rtnl_mutex.
Reported-by: yury <urykhy@gmail.com>
Tested-by: yury <urykhy@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

It is u64 data received from firmware. Little endian to cpu
conversion is required here.

Cc: <stable@vger.kernel.org> # 3.5+
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The driver ignores BSS_CHANGED_TXPOWER changes.
Fix this by calling ACX_TX_POWER when appropriate.
Signed-off-by: Alex Gal <a.gal@motsai.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Adding new device IDs and assigning generic function/variable
names instead of using device-id specific names.
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Nishant Sarmukadam <nishants@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Frank Huang <frankh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Reported-by: Jan Prinsloo <janroot@gmail.com>
Tested-by: Jan Prinsloo <janroot@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The REGULATORY_CUSTOM_REG can be used during early init with
the goal of overriding the wiphy's default regulatory settings
in case the alpha2 of the device is not known. In the case that
the alpha2 becomes known lets avoid having drivers having to
clear the REGULATORY_CUSTOM_REG flag by doing it for them
when regulatory_hint() is used.

Cc: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath wants to first apply the custom regd and only later
will it revert to not using it if an alpha2 regulatory
domain is found. Since the wireless core now enforces
usage of the REGULATORY_CUSTOM_REG strictly when
wiphy_apply_custom_regulatory() is used this makes
ath adhere to the expected behaviour but also updates
the wiphy after its done with the custom usage.

This fixes this warning:

[    5.488733] ath: phy0: ASPM enabled: 0x43
[    5.488735] ath: EEPROM regdomain: 0x0
[    5.488736] ath: EEPROM indicates default country code should be used
[    5.488736] ath: doing EEPROM country->regdmn map search
[    5.488737] ath: country maps to regdmn code: 0x3a
[    5.488737] ath: Country alpha2 being used: US
[    5.488738] ath: Regpair used: 0x3a
[    5.488738] ------------[ cut here ]------------
[    5.488745] WARNING: CPU: 0 PID: 161 at
	/home/sujith/dev/wireless-testing/net/wireless/reg.c:1361
	wiphy_apply_custom_regulatory+0x17a/0x1b0 [cfg80211]()
[    5.488746] wiphy should have REGULATORY_CUSTOM_REG

The wireless core can *later* lift this flag for us for when
using the regulatory_hint() to make this fix more generic.
Reported-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Samuel Ortiz <sameo@linux.intel.com> says:

"This is the first NFC pull request for 3.14

It includes:

* A new NFC driver for Marvell's 8897, and a few NCI fixes and
  improvements needed to support this chipset.

* An LLCP fix for how we were setting the default MIU on a p2p link. If
  there is no explicit MIU extension announced at connection time, we
  must use the default one and not the one announced at LLCP link
  establishement time.

* A pn544 EEPROM config update. Some of the currently EEPROM configured
  values are overwriting the firmware ones while other should not be set
  by the driver itself.

* Some NFC digital stack fixes and improvements. Asynchronous functions
  are better documented, RF technologies and CRC functions are set upon
  PSL_REQ reception, and a few minor bugs are fixed.

* Minor and miscelaneous pn533, mei_phy and port100 fixes."
Signed-off-by: John W. Linville <linville@tuxdriver.com>

When we disassociate in managed mode, we flush the queues
after mac80211 has already removed the station.
During that time, the pointer to ieee80211_sta to the
fw_id_to_mac_id map is -EINVAL. In that case we should not
set the station as being drained when the last Tx of this
station has exited the shared Tx queue since we are
flushing all the queues anyway.
The draining logic is meant to be used in GO / AP mode only.
In GO / AP mode, we set -EBUSY in the fw_id_to_mac_id map.

This is why testing the ieee80211_sta pointer in the
fw_id_to_mac_id map with IS_ERR isn't enough to set the
station as draining, we need to check that it is -EBUSY.

The only impact of the bug was a print:

Drained sta 1, but it is internal?
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>

If we can't switch to a column because no rates are supported
in that column this led to a state where the search cycle
got stuck and never ended. This in turn also led to aggregation
not being turned on. Fix this by marking a column as
visited if we can't switch to it.
Reported-and-tested-by: Karl Beldan <karl.beldan@gmail.com>
Signed-off-by: Eyal Shapira <eyal@wizery.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Cleanup of iwl_mvm_leds was missing in case of error,
resulting in the following warning:

WARNING: at lib/kobject.c:196 kobject_add_internal+0x1f4/0x210()
kobject_add_internal failed for phy0-led with -EEXIST, don't try to register things with the same name in the same directory.

which prevents further reloads of the driver.

Cc: stable@vger.kernel.org [3.10+]
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The power settings need to be updated after a binding flow is done
and before quota calculations. This was missing in the start_ap_ibss()
flow. Fix it.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The state variable was not set to false in case of a failure to
complete the start_ap_ibss() flow.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>