Merge tag 'nfc-next-3.10-2' of git://git./linux/kernel/git/sameo/nfc-next

Samuel Ortiz <sameo@linux.intel.com> says:

"This is the 2nd NFC pull request for 3.10.

With this one we have:

- A major pn533 update. The pn533 framing support has been changed in order to
  easily support all pn533 derivatives. For example we now support the ACR122
  USB dongle.

- An NFC MEI physical layer code factorization through the mei_phy NFC API.
  Both the microread and the pn544 drivers now use it.

- LLCP aggregation support. This allows NFC p2p devices to send aggregated
  frames containing all sort of LLCP frames except SYMM and aggregation
  frames.

- More LLCP socket options for getting the remote device link parameters.

- Fixes for the LLCP socket option code added with the first pull request for
  3.10.

- Some support for LLCP corner cases like 0 length SDUs and general DISC
  (tagged with a 0,0 dsap ssap couple) handling.

- RFKILL support for NFC."

Signed-off-by: John W. Linville <linville@tuxdriver.com>

NFC: pn544: Add MEI physical layer

With the new mei_phy NFC driver API, the pn544 MEI physical layer is
minimal and similar to the microread one.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: mei: Add a common mei bus API for NFC drivers

This isolates the common code that is required to use an mei bus nfc
device from an NFC HCI drivers. This prepares for future drivers for
NFC chips connected behind an Intel Management Engine controller.
The microread_mei HCI driver is also modified to use that common code.

Signed-off-by: Eric Lapuyade <eric.lapuyade@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

b43: use bcma_pmu_spuravoid_pllupdate()

Do not implement this in b43, but use bcma_pmu_spuravoid_pllupdate().

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: use more idiomatic tracing include style

Pretty much everywhere that uses a trace definition
header that's not in include/trace/events/ uses the
make system for the include path rather than putting
it into the sources, so do that in ath5k as well.

This came up during backporting work (where this is
required), but since all other drivers do it this
way upstream it seemed applicable.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcm80211: simplify makefiles

This came up during my backporting work but it seems
perfectly appropriate for the kernel as well.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: remove ifidx variable from brcmf_fws_process_skb()

The value can be obtained from the struct brcmf_if object pointer
and it is used only twice.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: rename brcmf_fws_mac_desc_ready()

Replace the function by brcmf_fws_mac_desc_closed(). The new function
is used in the transmit path and in the dequeue worker.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: pass ifp pointer in brcmf_fws_find_mac_desc()

Instead of passing the ifidx and lookup the ifp inside the
function brcmf_fws_find_mac_desc() simply pass the ifp as
parameter.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: obtain iftype for firmware-signal descriptor lookup

The function brcmf_fws_find_mac_desc() determines the descriptor
associated with a sk_buff for firmware-signalling. It needs the
interface type to do that. For this a helper function is added in
wl_cfg80211.c.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: define and use platform specific data for SDIO.

This patch adds support for platform specific data for SDIO
fullmac devices. Currently OOB interrupts are configured by Kconfig
BRCMFMAC_SDIO_OOB but that is now determined dynamically by checking
availibility of platform data.

Cc: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: Add drive strength programming for SDIO 43143.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: Add 43143 SDIO support.

Added sdio device id to list of supported devices. 43143 is a new
802.11n single stream device.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: add BCM4335 sdio interface support

BCM4335 is an a/b/g/n/ac WiFi chip that supports up to 80MHz channel. This patch
adds support for this chip through SDIO interface.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: setup SDIO reset behavior

Set device in a manner that SDIO I/O card reset
will lead to WLAN backplane and PMU state reset.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: add support for dongle ARM CR4 core

Newer WiFi chip use ARM CR4 core to achieve higher performance. Add necessary
code for host driver in order to support CR4 core.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: adopt new d11 interface

Adopting the new d11 interface for 11ac fullmac chip support.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmutil: add new d11 interface support

802.11 core interface is upgraded with 11ac support. Add channel spec support
code to brcmutil.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: move chip download state code to sdio_chip.c

enter/exit download state routine is going to diverge with new ARM core
introduced. Move corresponding code to sdio_chip.c for new ARM core support.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: aggregate dongle ram access interface

For fullmac chips host driver can access to dongle RAM through SDIO function 1.
Introduce brcmf_sdio_ramrw and place it at bcmsdh.c with other interface
functions.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: support save&restore firmware feature

Save & restore is an advanced power saving feature,
supported only on selected devices.
SR operation is almost completely transparent to the driver.
Support for it is hardware and firmware dependent.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

NFC: RFKILL support

All NFC devices will now get proper RFKILL support as long as they provide
some dev_up and dev_down hooks. Rfkilling an NFC device will bring it down
while it is left to userspace to bring it back up when being rfkill unblocked.
This is very similar to what Bluetooth does.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

rfkill: Add NFC to the list of supported radios

And return the proper string for it.

Acked-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Turn radio on and off when bringing the device up and down

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: Prevent polling when device is down

Some devices turn radio on whenever they're asked to start a poll.
To prevent that from happening, we just don't call into the driver
start_poll hook when the NFC device is down.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Add missing usb_put_dev

Add missing usb_put_dev on failure path in pn533_probe().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Marina Makienko <makienko@ispras.ru>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Terminate connection when receiving a DISC on (0,0)

According to the LLCP specs, we must terminate the LLCP link when receiving
a DISC with both ssap and dsap set to 0.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Remove local_cleanup last argument

local_cleanup is always called with device set to false as it means the
local LLCP is going away. So no need to pass this switch as an argument.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Only keep raw sockets alive when the LLCP local leaves

When the MAC goes down, connected and connection less sockets should be
notified, but raw sockets should be kept alive.
They will get notified only when the physical devices goes away.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Increase version number

Major features added in 0.2 version:

* frame ops added to support wider set of devices
* support of ACS ACR122U

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Remove unused pn533_cmd_complete_t

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Add pn533_abort_cmd procedure

pn533_abort_cmd() aborts last command sent to the controller
and cancels already requested urb.

As ACR122U does not support any mechanism (as ACK for standard
PN533) which aborts last command this cannot be issued for this
device. Otherwise, acr122u will behave in an unstable way.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Add support for ACS ACR122U reader

ACS ACR122U is an USB NFC reader, PC/SC and CCID compilant, based
on NXP PN532 chip.

Internally, it's build of MCU, PN532 and an antenna. MCU makes the
device CCID and PC/SC compilant and provide USB connection.

In this achitecture, a host cannot talk directly to PN532 and must
rely on MCU. Luckily, MCU exposes pseud-APDU through PC/SC Escape
mechanism which let the host to transmit standard PN532 commands
directly to PN532 chip with some limitations.

The frame roughly looks like:

    CCID header    |          APDU header           |    PN532 header
(pc_to_rdr_escape) |  (pseudo apdu Direct Tramsmit) | (len, TFI, cmd, params)

Accordign to limitations, ACR122U does't provide any mechanism to
abort last issued command.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Add protocol type for frame ops

As not all devices require ACK confirmation of every request sent to the
controller, differentiate two protocol types.

First one, request-ack-response and the second one request-response type.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Move wq_in_error to cmd context

Rename 'wq_in_error' field to more relevant 'status'
and move it to cmd context struct.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Re-group fields in struct pn533

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Avoid function declarations

Reorder code to avoid functions declaration.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Simplify __pn533_send_frame_async

In all cases (send_cmd_async, send_data_async and send_sync)
pn533_send_async_complete() handles all responses internally,
so there is no need to pass this as a callback.

Cmd context is passed to __pn533_send_frame_async in all the
cases as well. It's already kept in struct pn533 which is
available all the time the device is attached. So we can make
use of it instead.

Therefore, cmd_complete and cmd_complete_arg are no needed any more.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Fix incorrect kfree of complete args

We must free 'cmd_complete_mi_arg' and not 'cmd_complete_arg'
when getting send error handling fragmented response.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Remove redundant cmd_ prefix in the struct

'cmd->code' looks better then 'cmd->cmd_code'

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Keep cmd context in pn533 struct

Keep cmd context in pn533 struct instead of only cmd code.
The context already includes cmd_code.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Optimise issued cmd context tracking

Use struct pn533_cmd instead of pn533_send_async_complete_arg
to track the context of the issued cmd.

This way pn533_send_async_complete_arg struct is no needed
anymore. Just move issuer complete callback to pn533_cmd struct.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Fix memleak while scheduling next cmd

In case of error from __pn533_send_frame_async() while sending
next cmd from the queue (cmd_wq), cmd->req, cmd->resp and
cmd->arg pointers won't be freed.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Rename pn533_fw_reset appropriately

Define explicitely it is Pasori specific reset command.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Update copyrights note

Remove duplicated authors info from the header as well.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Fix div by zero while stopping polling

Depends on timing division by zero can happen when user stops
polling.

pn533_stop_poll() resets modulation counter on stop_poll, but
meanwhile we get response for last poll request and try, despite
of stop poll request, to schedule next modulation for polling.

Log message:
[345.922515] pn533 1-1.3:1.0: pn533_stop_poll
[345.928314] pn533 1-1.3:1.0: pn533_send_ack
[345.932769] pn533 1-1.3:1.0: Received a frame.
[345.937438] PN533 RX: 00 00 ff 03 fd d5 4b 00 e0 00
[345.942840] pn533 1-1.3:1.0: pn533_poll_complete
[345.947753] pn533 1-1.3:1.0: pn533_start_poll_complete
[345.953186] Division by zero in kernel.
[345.957244] [<c001b38c>] (unwind_backtrace+0x0/0xf0)
[345.965698] [<c0260e78>] (Ldiv0+0x8/0x10)
[345.974060] [<c0260e60>] (__aeabi_idivmod+0x8/0x18)
[345.983978] [<c02e0064>] (pn533_poll_complete+0x3c0/0x500)
[345.994903] [<c02df690>] (pn533_send_async_complete+0x7c/0xc0)
[346.005828] [<c02e028c>] (pn533_wq_cmd_complete+0x1c/0x34)
[346.016113] [<c005d134>] (process_one_work+0x1ac/0x57c)
[346.025848] [<c005d85c>] (worker_thread+0x168/0x42c)
[346.034576] [<c00620c0>] (kthread+0xa4/0xb0)

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Print out response status bits in hex

For better debugging as the codes are defined in hex in the spec.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Reword all std frame logic funct

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Add support in getsockopt for RW, LTO, and MIU remote parameters

Useful for LLCP validation tests.

Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Reset RW, LTO, and MIU remote parameters when link goes down

This resets remote parameters in both local and socket llcp structures when the
link goes down. That way, nfc_llcp_getsockopt won't return values corresponding
to the previous link parameters.

Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Use localy stored remote_miu value if not set at socket level

If remote_miu value is not set in the socket (i.e. connection-less socket) the
value stored in the local is used.

Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Aggregated frames support

This adds support for AGF PDUs. For each PDU contained in the AGF, a new sk_buff
is allocated and dispatched to its corresponding handler.

Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Fix zero octets length SDU handling

LLCP Validation test #2 (Connection-less information transfer) send a
service data unit of zero octets length. This is now handled correctly.

Signed-off-by: Olivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Fall back to local values when getting socket options

If a socket option has not been set by the user, fall back to the LLCP
local ones.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: llcp: Socket miux is a big endian field

The MIUX must be transmitted in big endian and as such we have to convert
it properly.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

NFC: pn533: Use dynamic debug for pn533 hex dumps

Those can be very verbose and we only want them when debugging pn533.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

ipw2x00: move to kstrto* functions

There is better to use kstrto* instead of simple_strtoul. In this case it
applies a bit stricter rules for input as well.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtlwifi: rtl8188ee: Fix loop that ends early

In routine _rtl8188e_read_power_value_fromprom(), there are loops initializing
index_cck_base and index_bw40_base from the PROM. As the result of a typo, the
second loop is ended one element too soon.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: implement buffer holding handling for EDMA FIFO

Inside one FIFO slot queue, EDMA chipsets have the same link pointer
re-read race condition as older chipsets, so the same buffer holding
logic needs to be used in order to avoid use-after-free bugs.
Unlike on older chips, it can be skipped for the end of the queue.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: detect more kinds of invalid descriptors

If AR_CRCErr, AR_PHYErr, AR_DecryptCRCErr or AR_MichaelErr is indicated
in the rx status word, but AR_RxFrameOK is also set, the descriptor
contents are typically invalid. This can show up as a warning about
invalid MCS rates in a frame. Even with those checks in place, a
descriptor with invalid MCS rates can still sometimes make it through to
the driver (mostly on older hardware like AR91xx).

Detect such errors in the last descriptor of a frame and discard the
whole frame if present.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: fix handling of broken descriptors

As the comment in ath_get_next_rx_buf indicates, if a descriptor with
the done bit set follows one with the done bit cleared, both descriptors
should be discarded, however the driver is not doing that yet.

To fix this, use the rs->rs_more flag as an indicator that the following
frame should be discarded. This also helps with the split buffer case:
if the first part of the frame is discarded, the following parts need to
be discarded as well, since they contain no valid header or usable data.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: improve dma map failure handling

Instead of leaving the buffer without skb and breaking out of the loop
(which could leak the rx buffer), use the common error path.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_common: remove ath9k_cmn_padpos

It is equivalent to ieee80211_hdrlen

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: make various ar5416/ar91xx rf banks const

Banks 0-3,7 are neither modified at run time, nor SREV dependent.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: clean up RF Bank6 handling on AR5416/AR91xx

There are two sets of initvals for this RF bank, one with TPC support and
one without.
The TPC one always gets used, so remove the other one to avoid confusion.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2x00mmio: remove unused rt2x00pci_* defines

All users are converted to use the rt2x00mmio_*
functions so remove the now unused defines.

The patch contain no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2800pci: use the rt2x00mmio_* routines

Use the recently introduced rt2x00mmio_* routines
instead of the rt2x00pci_* variants.

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt61pci: use the rt2x00mmio_* routines

Use the recently introduced rt2x00mmio_* routines
instead of the rt2x00pci_* variants.

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2500pci: use the rt2x00mmio_* routines

Use the recently introduced rt2x00mmio_* routines
instead of the rt2x00pci_* variants.

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2400pci: use the rt2x00mmio_* routines

Use the recently introduced rt2x00mmio_* routines
instead of the rt2x00pci_* variants.

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2x00mmio: use rt2x00mmio prefix in function names

The functions in the rt2x00mmio module has been
moved from the rt2x00pci module. Each function
uses the rt2x00pci prefix which is a bit confusing.
Use the r2x000mmio prefix for each function to make
it consistent with the module name.

The renamed functions are used by several modules,
and updating the names in all of them would result
in a big patch. In order to keep the patch simple,
add compatibility defines for the old function
names. This allows to update the names in each
module separately. After each module is updated,
the defines can be removed.

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-john' of git://git./linux/kernel/git/iwlwifi/iwlwifi-next

Merge branch 'for-john' of git://git./linux/kernel/git/jberg/mac80211-next

Conflicts:
drivers/net/wireless/ath/carl9170/debug.c
drivers/net/wireless/ath/carl9170/main.c
net/mac80211/ieee80211_i.h

Merge branch 'master' of git://git./linux/kernel/git/linville/wireless

Conflicts:
drivers/net/wireless/rt2x00/rt2x00pci.c

brcmfmac: only use ifidx from BDC header in brcmf_rx_frames()

In brcmf_rx_frames() the call to brcmf_fweh_process_skb() could
change the ifidx using information in the event data. This is
only different to the BDC ifidx for IF ADD event. However, the
creation of the new interface is deferred to event worker so
it does not exist. After brcmf_fweh_process_skb() it is only
used to set statistics.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: obtain wdev using vif object in action frame rx

The function brcmf_p2p_notify_action_frame_rx() the wireless_dev
is needed to pass the action frame to cfg80211. The wireless_dev
is held in brcmf_cfg80211_vif object. Use that instead of the
ieee80211_ptr in net_device as P2P_DEVICE interface does not have
a net_device associated with it.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: fix reception of P2P probe requests on P2P_DEVICE interface

The probe requests received on P2P_DEVICE interface were not sent
to wpa_supplicant, which makes the device not discoverable by peers.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: wait for firmware event when creating P2P_DEVICE interface

The firmware sends a IF event to notify the host driver that the
P2P_DEVICE interface has been created. Wait for the event before
returning the related wireless_dev.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: support creation of P2P_DEVICE through user-space

The current driver code creates a P2P_DEVICE through a module
parameter. This device has a dummy netdevice which is not how this
interface type is intended. This patch add proper support for the
P2P_DEVICE interface type. This requires a wpa_supplicant with such
support as well.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: use struct brcmf_if instance iso netdevice in escan functions

escan functionality is also required for P2P device operations so it
is better not to rely on struct netdevice instances.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: use struct brcmf_if instance as parameter in brcmf_set_mpc()

Remove use of struct netdevice as parameter to brcmf_set_mpc() as it
will not always be available, ie. there will be non-netdevice interfaces.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: remove use of unconditional access of struct wireless_dev::netdev

With the introduction of the P2P_DEVICE interface type an instance of
struct wireless_dev does not always have a netdev assigned to it. Better
use container_of() construct to obtain internal structure and go from
there.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: remove condition for calling event handler

In fweh module the event handler was only called if the
struct brcmf_if instance had a non-null netdev associated.
This restriction is no longer valid for P2P_DEVICE type
of interface. This patch removes that restriction.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: add role attribute to struct brcmf_if_event definition

According specification the IF event has an additional field indicating
the role or type of the interface for which this event is sent.

Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: add hexadecimal trace of message payload

Adds a trace function used in brcmf_dbg_hex_dump() which adds the
raw binary data to the trace. It requires trace-cmd plugin to see
this data.

Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: firmware shared data version fix

Firware shared data structure is backward compatible for fields
we are interested in.
Allow reading of shared data in case of version mismatch.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: read firmware console without trap indication

Firmware console output can be read also when there was
no trap indication.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: handle firmware signals requesting for packets

The firmware can request the host driver for packets, by sending
either the MAC_REQUEST_CREDIT or the MAC_REQUEST_PACKET primitive.
This patch adds handling of these primitives.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: handle firmware signalling destination entry state

Firmware can signal whether the host driver may sent packets for
a specific destination or interface. This can happen when a
destination is sleeping or when going off-channel.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: fix unaligned access in TXSTATUS signal handling

reported by Hante. Needs to be squashed in commit 187fbcec.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: hold proper locks when accessing ra_list / bss_prio lists

Not locking ra_list when dequeuing packets creates race conditions.
When adding a packet 'tx_pkts_queued' is modified before setting
highest_priority_queue. If in-between the main loop starts, it will
see a packet queued (tx_pkts_queued > 0) but will not find it, since
max prio is not set yet. Depending on the scheduling, the thread
trying to add the packet could complete and restore the situation.
But this is not something to rely on.

Another race condition exists, if a new packet, exceeding current
max prio is added. If concurrently a packet is dequeued, the newly
set max prio will be overwritten with the value of the dequeued
packet. This can occur, because selecting a packet and modifying
the max prio is not atomic. The result in an infinite loop unless,
a new packet is added that has at least the priority of the hidden
packet.

Same applies to bss_prio_tbl. Forward iteration is no proper
lock-free technique and provides no protection from calls to
list_del. Although BSS are currently not added/removed dynamically,
this must not be the case in the future. Hence always hold proper
locks when accessing those lists.

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: fix infinite loop by removing NO_PKT_PRIO_TID

Using NO_PKT_PRIO_TID and tx_pkts_queued to check for an empty
state, can lead to a contradictory state, resulting in an
infinite loop. Currently queueing and dequeuing of packets is
not synchronized, and can happen concurrently. While tx_pkts_queued
is incremented when adding a packet, max prio is set to NO_PKT when
the WMM list is empty. If a packet is added right after the check
for empty, but before setting max prio to NO_PKT, that packet is
trapped and creates an infinite loop.

Because of the new packet, tx_pkts_queued is at least 1, indicating
wmm lists are not empty. Opposing that max prio is NO_PKT, which
means "skip this wmm queue, it has no packets". The infinite loop
results, because the main loop checks the wmm lists for not empty
via tx_pkts_queued, but for dequeing it uses max_prio to see if it
can skip current list. This will never end, unless a new packet is
added which will restore max prio to the level of the trapped packet.

The solution here is to rely on tx_pkts_queued solely for checking
wmm queue to be empty, and drop the NO_PKT define. It does not
address the locking issue.

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: remove unused tid_tbl_lock from mwifiex_tid_tbl

ra_list_spinlock is used to protect struct mwifiex_wmm_desc and
embedded structures such as ra_list. tid_tbl_lock while more fine
grained, is not used but in one function. That function is not
called reentrantly. To protect ra_list from concurrent modification
ra_list_spinlock must be held.

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: correct wrong list in list_empty check

adapter->bss_prio_tbl list has already been checked in outer loop.
The inner loop works with priv_tmp->wmm.tid_tbl_ptr list. Also the
lock taken, gives hint that this is likely a copy-paste error.

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtlwifi: rtl8188ee: Fix allyesconfig build failures

An allyesconfig build of rtl8188ee yields the following duplicate entry points:

drivers/net/wireless/rtlwifi/rtl8188ee/built-in.o: In function `.rtl92c_phy_ap_calibrate':
(.text+0x21d14): multiple definition of `.rtl92c_phy_ap_calibrate'
drivers/net/wireless/rtlwifi/rtl8192c/built-in.o:(.text+0xb1e8): first defined here
drivers/net/wireless/rtlwifi/rtl8188ee/built-in.o: In function `rtl_hal_pwrseqcmdparsing':
(.opd+0xed0): multiple definition of `rtl_hal_pwrseqcmdparsing'

One of the routines is not used and can be deleted, the other is renamed.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtlwifi: rtl8188ee: Fix linker warnings

Building rtl8188ee yields warnings such as the following:

x86_64-linux-gcc: warning: drivers/net/wireless/rtlwifi: linker input file unused because linking not done

The only potential cause is an extraneous space in the make file.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Tested-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: add support for DFS master mode

These are the remaining knobs in ath9k to support DFS:
* mark AR9280 and AR9580 as DFS tested
* synchronize DFS regulatory domain to reg notifyer
* set required RX filter flags for radar detection
* process radar PHY errors at DFS detector
* notify DFS master on radar detection

DFS support requires CONFIG_ATH9K_DFS_CERTIFIED to be set.

Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: add debugfs based DFS radar simulation

This helps testing DFS without radar generating
equipment and is required for certification.

Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: add interface combinations for DFS master

Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath: Let user know which keycache method is complaining.

Should make the warning messages more useful.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>