Merge tag 'mac80211-next-for-john-2014-08-29' of git://git./linux/kernel/git/jberg/mac80211-next

Johannes Berg <johannes@sipsolutions.net> says:

"Not that much content this time. Some RCU cleanups, crypto
performance improvements, and various patches all over,
rather than listing them one might as well look into the
git log instead."

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Conflicts:
drivers/net/wireless/ath/wil6210/wmi.c

net: rfkill: gpio: Add more Broadcom bluetooth ACPI IDs

This adds one more ACPI ID of a Broadcom bluetooth chip.

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

mac80211: fix chantype recalc warning

When a device driver is unloaded local->interfaces
list is cleared. If there was more than 1
interface running and connected (bound to a
chanctx) then chantype recalc was called and it
ended up with compat being NULL causing a call
trace warning.

Warn if compat becomes NULL as a result of
incompatible bss_conf.chandef of interfaces bound
to a given channel context only.

The call trace looked like this:

 WARNING: CPU: 2 PID: 2594 at /devel/src/linux/net/mac80211/chan.c:557 ieee80211_recalc_chanctx_chantype+0x2cd/0x2e0()
 Modules linked in: ath10k_pci(-) ath10k_core ath
 CPU: 2 PID: 2594 Comm: rmmod Tainted: G        W     3.16.0-rc1+ #150
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  0000000000000009 ffff88001ea279c0 ffffffff818dfa93 0000000000000000
  ffff88001ea279f8 ffffffff810514a8 ffff88001ce09cd0 ffff88001e03cc58
  0000000000000000 ffff88001ce08840 ffff88001ce09cd0 ffff88001ea27a08
 Call Trace:
  [<ffffffff818dfa93>] dump_stack+0x4d/0x66
  [<ffffffff810514a8>] warn_slowpath_common+0x78/0xa0
  [<ffffffff81051585>] warn_slowpath_null+0x15/0x20
  [<ffffffff818a407d>] ieee80211_recalc_chanctx_chantype+0x2cd/0x2e0
  [<ffffffff818a3dda>] ? ieee80211_recalc_chanctx_chantype+0x2a/0x2e0
  [<ffffffff818a4919>] ieee80211_assign_vif_chanctx+0x1a9/0x770
  [<ffffffff818a6220>] __ieee80211_vif_release_channel+0x70/0x130
  [<ffffffff818a6dd3>] ieee80211_vif_release_channel+0x43/0xb0
  [<ffffffff81885f4e>] ieee80211_stop_ap+0x21e/0x5a0
  [<ffffffff8184b9b5>] __cfg80211_stop_ap+0x85/0x520
  [<ffffffff8181c188>] __cfg80211_leave+0x68/0x120
  [<ffffffff8181c268>] cfg80211_leave+0x28/0x40
  [<ffffffff8181c5f3>] cfg80211_netdev_notifier_call+0x373/0x6b0
  [<ffffffff8107f965>] notifier_call_chain+0x55/0x110
  [<ffffffff8107fa41>] raw_notifier_call_chain+0x11/0x20
  [<ffffffff816a8dc0>] call_netdevice_notifiers_info+0x30/0x60
  [<ffffffff816a8eb9>] __dev_close_many+0x59/0xf0
  [<ffffffff816a9021>] dev_close_many+0x81/0x120
  [<ffffffff816aa1c5>] rollback_registered_many+0x115/0x2a0
  [<ffffffff816aa3a6>] unregister_netdevice_many+0x16/0xa0
  [<ffffffff8187d841>] ieee80211_remove_interfaces+0x121/0x1b0
  [<ffffffff8185e0e6>] ieee80211_unregister_hw+0x56/0x110
  [<ffffffffa0011ac4>] ath10k_mac_unregister+0x14/0x60 [ath10k_core]
  [<ffffffffa0014fe7>] ath10k_core_unregister+0x27/0x40 [ath10k_core]
  [<ffffffffa003b1f4>] ath10k_pci_remove+0x44/0xa0 [ath10k_pci]
  [<ffffffff81373138>] pci_device_remove+0x28/0x60
  [<ffffffff814cb534>] __device_release_driver+0x64/0xd0
  [<ffffffff814cbcc8>] driver_detach+0xb8/0xc0
  [<ffffffff814cb23a>] bus_remove_driver+0x4a/0xb0
  [<ffffffff814cc697>] driver_unregister+0x27/0x50

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

carl9170: tx: Replace rcu_assign_pointer() with RCU_INIT_POINTER()

According to RCU_INIT_POINTER()'s block comment 3.a, it can be used if
"3.   The referenced data structure has already been exposed to readers either
at compile time or via rcu_assign_pointer() -and-
 a.   You have not made -any- reader-visible changes to this structure since
then".

This case fulfills the conditions above because between the rcu_dereference()
call (cvif = rcu_dereference(ar->beacon_iter);) and the rcu_assign_pointer()
call there is no update of the "cvif" variable.
Therefore, this patch makes the replacement.

The following Coccinelle semantic patch was used:
@@
identifier v;
@@

v = rcu_dereference(...);
... when != rcu_dereference(...);
    when != v = ...;
    when != (<+...v...+>)++;
    when != \(memcpy\|memset\)(...);
(
- rcu_assign_pointer
+ RCU_INIT_POINTER
  (..., v);
|
 if(...) {
... when != v = ...;
- rcu_assign_pointer
+ RCU_INIT_POINTER
  (..., v);
... when any
 }
)

Because there are cases where between a “rcu_dereference()” call and a
“rcu_assign_pointer()” call might be updates of the value that interests us,
the Coccinelle semantic patch ignores them and replaces with
"RCU_INIT_POINTER()" only when the update is not happening.

Signed-off-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context timer

Setup the channel context correctly. Not doing this was
causing beacon loss in a P2P-GO/STA concurrent setup.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add more debug statements for channel context

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Disable fastcc for channel context mode

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: support Ralink 5362.

Signed-off-by: Canek Peláez Valdés <canek@ciencias.unam.mx>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context creation

If a new context is being added in addition to the current one,
then send the ASSIGN event to abort a running scan since
the addition of a context is usually followed by VIF
assignment and further operations.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix interface limits

There is no reason why managed/p2p interfaces have to
be limited to one. IBSS is the only type that needs
a restriction.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Print the event/state in ath_chanctx_event

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add new chanctx events

This will be useful in handling addition/change of new
channel contexts.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix ath_chanctx_get()

Move it inside a CONFIG_ATH9K_CHANNEL_CONTEXT ifdef
since it is not needed otherwise.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move ath9k_beacon_add_noa to channel.c

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Remove redundant ifdef

This was introduced in an earlier patch to handle
a compilation warning, but since the channel context
code has been mostly isolated, this is not required now.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context variables in ath_softc

chanctx_work and next_chan are required only when
CONFIG_ATH9K_CHANNEL_CONTEXT is enabled.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix 'offchannel' in ath_softc

Finally move the 'offchannel' instance in ath_softc
inside a CONFIG_ATH9K_CHANNEL_CONTEXT cage. The offchannel
usage in ath9k_calculate_iter_data() is closed off with
an ifdef for now, since the state/opmode calculation is
common for both the channel context mode and the normal mode.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix function argument type

ath9k_vif_iter() was earlier used as an iterator
routine when calling a mac80211 utility. This is no
longer the case and hence we can mention the argument
type explicitly.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Use ath_chanctx_check_active properly

ath_chanctx_check_active() is required only when channel contexts
are used. Make sure that it is not called in normal usage.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add ath9k_offchannel_init

This patch adds a routine to setup the offchannel
instance in ath_softc.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add ath9k_chanctx_wake_queues

Introduce a function that handles queues in channel
context mode.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add wrappers for beacon events

Using these wrappers allows us to move the 'sched'
variable in ath_softc inside CONFIG_ATH9K_CHANNEL_CONTEXT.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix function declarations

These routines are required only when
CONFIG_ATH9K_CHANNEL_CONTEXT is enabled.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix channel context events

Check if channel context usage is enabled before
calling ath_chanctx_event() from various parts of the
driver. Also, make sure that ath_chanctx_event() is
compiled only when CONFIG_ATH9K_CHANNEL_CONTEXT is
enabled.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_switch static

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_get_oper_chan static

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_offchan_switch static

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Conditionally compile more functions

Use CONFIG_ATH9K_CHANNEL_CONTEXT to exclude:

ath_scan_complete()
ath_roc_complete()
ath_offchannel_next()
ath_scan_next_channel()
ath_scan_channel_duration()

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Exclude more functions

Use CONFIG_ATH9K_CHANNEL_CONTEXT to exclude more functions:

ath_offchannel_channel_change()
ath_scan_channel_start()
ath_scan_send_probe()

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Conditionally compile a few functions

Exclude these functions when CONFIG_ATH9K_CHANNEL_CONTEXT is not
enabled:

ath_chanctx_send_vif_ps_frame()
ath_chanctx_send_ps_frame()
ath_chanctx_defer_switch()
ath_chanctx_set_next()

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Cleanup mgd_prepare_tx callback

Rename the callback from ath9k_chanctx_force_active()
to ath9k_mgd_prepare_tx(). Also, move it to main.c and
group it with the other callbacks.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make ath_chanctx_work static

Also compile it conditionally based on
CONFIG_ATH9K_CHANNEL_CONTEXT.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a routine to tear down channel contexts

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a routine for initializing channel contexts

Setup the offchannel/sched timers and the chanctx work
inside the new function.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

carl9170: Remove redundant protection check

The carl9170_op_ampdu_action() function is used only by the mac80211
framework.
Since the mac80211 already takes care of checks and properly serializing
calls to the driver's function there is no need for the driver to do the same
thing.

Signed-off-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Isolate ath9k_use_chanctx module parameter

This patch ensures that the module parameter "use_chanctx" is
visible only when CONFIG_ATH9K_CHANNEL_CONTEXT is selected.
Also register the channel context callbacks with mac80211 only
when it is explicitly enabled and compile them out of the driver
when CONFIG_ATH9K_CHANNEL_CONTEXT is not selected.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Isolate P2P powersave routines

Use CONFIG_ATH9K_CHANNEL_CONTEXT to conditionally
compile P2P-PS code.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move P2P functions to channel.c

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a config option for channel context

Channel contexts are supported only for P2P right now,
so make sure that the 'normal' path remains unaffected
by using a config option. This will also reduce the size
of the driver.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add debug information

Add a few statements to debug channel context operation.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move channel operations to channel.c

This reduces clutter in main.c

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Handle failure to allocate HW timer

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add a debug level for channel context

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: remove redundant null check before kfree()

kfree() null-checks its argument.
Found by smatch.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: ensure led name is null terminated

Add the missing null termination after strncpy().

This isn't actually a buffer overflow in this case since we use
snprintf() appropriately to fill the buffer passed by the caller,
but in the interest of not turning this into a bug down the road,
go ahead and force termination here.

Found by Coverity.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: drop useless comparison

rxs->rate_idx is unsigned, so it will always be >= 0.
Found by Coverity.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ray_cs: Add include guards

The files ray_cs.h and rayctl.h both contain two thirds of what
appears to be an include guard using the macro name RAYLINK_H (both
lack the #define). Since RAYLINK_H is not defined anywhere, the
#ifndefs are confusing no-ops. Add proper include guards using
different macro names.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

bcma: only map wrapper if its address is available

The Chipcommon B core does not have a wrap address and it would fail here.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: use firmware API revision from GET_HW_SPEC response

Newer firmware returns API revision in GET_HW_SPEC command
response. We will make use of it instead of parsing this
information from FW release number.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: rename macro and variables related to API revision

We will remove 'fw' prefix from these variable and macro
names and make them generic.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: fix left_len calculation issue

While updating 'left_len' in each iteration, we should subtract
last TLV length not the accumulated length of TLVs parsed till
now.
This bug in parsing logic is exposed by newer firmware which adds
two TLVs in GET_HW_SPEC command response. Earlier firmwares used to
add only one TLV.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: advertise support for TDLS

Based on a quick test with AR9271, TDLS seems to be working fine.

Tests were done with 2 Atheros AR9271 based devices with firmware
1.3 (sha1 8d49f928aa40ac53c729189bff1333cd373a7fb5), associated
with a WAP54G access point. TDLS worked fine both in WPA2 mode and
without encryption. Stations maintained ping flood traffic between
each other and towards the AP without significant losses.

Not tested with AR7010.

TDLS was enabled in earlier patches the same way for other
Atheros drivers:
ath9k (fd6562344dea2b8b2a5d644cf971f4e56004500a),
and carl9170 (d1f3de71a584a82ee4e84505fce9acccf40215ff).

Signed-off-by: Csaba Kiraly <csaba.kiraly@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

MAINTAINTERS: The NFC list is subscribers-only

It's not moderated, it's subscribers-only.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-linville' of git://github.com/kvalo/ath

ath10k: make target endianess more explicit

Some copy engine structures are target specific
and are uploaded to the device during
init/configuration.

This also cleans up a bit diag_mem_read/write
implicit byteswap mess leaving only
diag_access_read/write with an implicit endianess
byteswap.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: dont duplicate service-pipe mapping

The mapping is already defined in a structure. It
makes little sense to duplicate information stored
in it within a function.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: move pci init structures

It doesn't make much sense to have copy engine
configuration structures spread across the whole
source file.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

mac80211: Replace rcu_dereference() with rcu_access_pointer()

The "rcu_dereference()" calls are used directly in conditions.
Since their return values are never dereferenced it is recommended to
use "rcu_access_pointer()" instead of "rcu_dereference()".
Therefore, this patch makes the replacements.

The following Coccinelle semantic patch was used:
@@
@@

(
 if(
 (<+...
- rcu_dereference
+ rcu_access_pointer
  (...)
  ...+>)) {...}
|
 while(
 (<+...
- rcu_dereference
+ rcu_access_pointer
  (...)
  ...+>)) {...}
)

Signed-off-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

ath10k: fix fw crash dumping

Recent crash dump patches introduced a regression.
If debugfs was disabled upon crash user could only
see the following:

 [  793.880000] ath10k: firmware crashed! (uuid n/a)
 [  793.890000] ath10k: qca988x hw2.0 (0x4100016c, 0x043202ff) fw 10.1.467.2-1 api 2 htt 2.1
 [  793.890000] ath10k: debug 0 debugfs 0 tracing 0 dfs 1

The report was missing register dump. Fix it by
printing registers regardless if crash_data is
present or not.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath10k: improve logging to include dev id

This makes it a lot easier to log and debug
messages if there's more than 1 ath10k device on a
system.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

mac80211: scan: Replace rcu_assign_pointer() with RCU_INIT_POINTER()

The use of "rcu_assign_pointer()" is NULLing out the pointer.
According to RCU_INIT_POINTER()'s block comment:
"1.   This use of RCU_INIT_POINTER() is NULLing out the pointer"
it is better to use it instead of rcu_assign_pointer() because it has a
smaller overhead.

The following Coccinelle semantic patch was used:
@@
@@

- rcu_assign_pointer
+ RCU_INIT_POINTER
  (..., NULL)

Signed-off-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

cfg80211: allow passing frame type to cfg80211_inform_bss()

When using the cfg80211_inform_bss[_width]() functions drivers
cannot currently indicate whether the data was received in a
beacon or probe response. Fix that by passing a new enum that
indicates such (or unknown).

For good measure, use it in ath6kl.

Acked-by: Kalle Valo <kvalo@qca.qualcomm.com> [ath6kl]
Acked-by: Arend van Spriel <arend@broadcom.com> [brcmfmac]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

cfg80211: clarify BSS probe response vs. beacon data

There are a few possible cases of where BSS data came from:
 1) only a beacon has been received
 2) only a probe response has been received
 3) the driver didn't report what it received (this happens when
    using cfg80211_inform_bss[_width]())
 4) both probe response and beacon data has been received

Unfortunately, in the userspace API, a few things weren't there:
 a) there was no way to differentiate cases 1) and 4) above
    without comparing the data of the IEs
 b) the TSF was always from the last frame, instead of being
    exposed for beacon/probe response separately like IEs

Fix this by
   i) exporting a new flag attribute that indicates whether or
      not probe response data has been received - this addresses (a)
  ii) exporting a BEACON_TSF attribute that holds the beacon's TSF
      if a beacon has been received
 iii) not exporting the beacon attributes in case (3) above as that
      would just lead userspace into thinking the data actually came
      from a beacon when that isn't clear

To implement this, track inside the IEs struct whether or not it
(definitely) came from a beacon.

Reported-by: William Seto
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

cfg80211: re-enable CSA for drivers that support it

This reverts commit dda444d52496aa8ddc501561bca580f1374a96a9.

Channel switching code has been reworked and
improved significantly since the time original
locking issues were found.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

mac80211: don't resize skbs needlessly

Header-less cloned skbs with sufficient headroom need not be cloned
unless the tailroom is going to be modified.

Fix ieee80211_skb_resize so it would only resize cloned skbs if either
the header isn't released or the tailroom is going to be modified.

Some drivers might have assumed that skbs are never cloned, so add a HW
flag that explicitly permits cloned TX skbs. Drivers which do not modify
TX skbs should set this flag to avoid copying skbs.

Signed-off-by: Ido Yariv <idox.yariv@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

mac80211: Fix accounting of the tailroom-needed counter

When hw acceleration is enabled, the GENERATE_IV or PUT_IV_SPACE flags
will only require headroom space. Consequently, the tailroom-needed
counter can safely be decremented.

Signed-off-by: Ido Yariv <idox.yariv@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

ieee80211: Support parsing TPC report element in action frames

TPC report element is contained in spectrum management's tpc report
action frames and in radio measurement's link measurement report
action frames. Add a function which checks whether an action frame
contains this element. This may be needed by the drivers in order
to set the correct tx power value in these frames.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

cfg80211: remove @gfp parameter from cfg80211_rx_mgmt()

In the cfg80211_rx_mgmt(), parameter @gfp was used for the memory allocation.
But, memory get allocated under spin_lock_bh(), this implies atomic context.
So, one can't use GFP_KERNEL, only variants with no __GFP_WAIT. Actually, in all
occurrences GFP_ATOMIC is used (wil6210 use GFP_KERNEL by mistake),
and it should be this way or warning triggered in the memory allocation code.

Remove @gfp parameter as no actual choice exist, and use hard coded
GFP_ATOMIC for memory allocation.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

mac80211: make ieee80211_vif_use_reserved_switch static

Reorder some code to make ieee80211_vif_use_reserved_switch()
static, no other changes.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

mac80211: mesh_plink: use get_unaligned_le16 instead of memcpy

Use get_unaligned_le16 to access llid/plid.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

orinoco_usb: use USB API functions rather than constants

This patch introduces the use of the functions
usb_endpoint_is_bulk_in(epd) and usb_endpoint_is_bulk_out(epd).

The semantic patch that makes these changes is as follows:

@@ struct usb_endpoint_descriptor *epd; @@

- ((epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) ==
- \(USB_ENDPOINT_XFER_BULK\|2\))
+ usb_endpoint_xfer_bulk(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- ((epd->bEndpointAddress & \(USB_ENDPOINT_DIR_MASK\|0x80\)) ==
-  \(USB_DIR_IN\|0x80\))
+ usb_endpoint_dir_in(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- ((epd->bEndpointAddress & \(USB_ENDPOINT_DIR_MASK\|0x80\)) ==
-  \(USB_DIR_OUT\|0\))
+ usb_endpoint_dir_out(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- (usb_endpoint_xfer_bulk(epd) && usb_endpoint_dir_in(epd))
+ usb_endpoint_is_bulk_in(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- (usb_endpoint_xfer_bulk(epd) && usb_endpoint_dir_out(epd))
+ usb_endpoint_is_bulk_out(epd)

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

atmel_cs: Remove typedef local_info_t

The Linux kernel coding style guidelines suggest not using typedefs
for structure types. This patch gets rid of the typedef for
local_info_t. Also, the name of the struct is changed to drop the _t,
to make the name look less typedef-like.

The following Coccinelle semantic patch detects the case:

@tn@
identifier i;
type td;
@@

-typedef
 struct i { ... }
-td
 ;

@@
type tn.td;
identifier tn.i;
@@

-td
+ struct i

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wireless: core: Reorder wiphy_register() notifications relevantly

Currently it can send regulatory domain change notification before any
NEW_WIPHY notification. Moreover, if rfill_register() fails, calling
wiphy_unregister() will send a DEL_WIPHY though no NEW_WIPHY had been
sent previously.

Thus reordering so it properly notifies NEW_WIPHY before any other.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

net: wireless: ipw2x00: ipw2200.c: Cleaning up missing null-terminate in conjunction with strncpy

Replacing strncpy with strlcpy to avoid strings that lacks null terminate.

Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wireless: wlcore: Use devm_kzalloc

This patch introduces the use of devm_kzalloc and does away with the
kfrees in the probe and remove functions. Also, a couple of labels and
the initial assignment of the ret variable in the probe function are
removed.

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix access after free in wil_pcie_remove()

'wil'  released in wil_if_free(); save iomapped address aside to
properly unmap it.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: cfg80211_rx_mgmt to use GFP_ATOMIC

Internally, cfg80211_rx_mgmt() takes lock:
spin_lock_bh(&wdev->mgmt_registrations_lock);

and therefore one can't use it with GFP_KERNEL allocation flags.
When called with GFP_KERNEL, "sleep while atomic" warning triggered:

<3>[242645.446224] BUG: sleeping function called from invalid context at kernel/mm/slub.c:926
<3>[242645.455516] in_atomic(): 1, irqs_disabled(): 0, pid: 18881, name: kworker/u16:0
<6>[242645.462868] CPU: 0 PID: 18881 Comm: kworker/u16:0 Tainted: G           O 3.10.40-g619a884-00001-g357fa9c #2
<6>[242645.463044] Workqueue: wil6210_wmi wmi_event_worker [wil6210]
<6>[242645.463087] Call trace:
<6>[242645.463157] [<ffffffc000087390>] dump_backtrace+0x0/0x144
<6>[242645.463205] [<ffffffc0000874e4>] show_stack+0x10/0x1c
<6>[242645.463259] [<ffffffc0009abc04>] dump_stack+0x1c/0x28
<6>[242645.463313] [<ffffffc0000c10c0>] __might_sleep+0xe0/0xf0
<6>[242645.463365] [<ffffffc00015a514>] kmem_cache_alloc+0x48/0x1e4
<6>[242645.463414] [<ffffffc00080d468>] __alloc_skb+0x48/0x164
<6>[242645.463466] [<ffffffc00097f2c4>] nl80211_send_mgmt+0x4c/0x1dc
<6>[242645.463511] [<ffffffc000980268>] cfg80211_rx_mgmt+0x1bc/0x25c
<6>[242645.463647] [<ffffffbffc005d64>] wmi_evt_rx_mgmt+0x21c/0x23c [wil6210]
<6>[242645.463783] [<ffffffbffc0073b8>] wmi_event_worker+0x230/0x2f8 [wil6210]
<6>[242645.463838] [<ffffffc0000afffc>] process_one_work+0x258/0x3d0
<6>[242645.463887] [<ffffffc0000b0fe0>] worker_thread+0x1f0/0x310
<6>[242645.463946] [<ffffffc0000b642c>] kthread+0xac/0xb8

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix free'd memory access in wil_if_free()

In the wil_priv_deinit(), wdev->netdev is accessed, so free_netdev()
should not be called before mentioned call.

Set wdev->netdev to NULL Make sure no more attempts to use it.
It is used for debug printk if not NULL.

This fix kernel panic on module unload and in case error on probe;
if memory allocation debugging enabled.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: Limit max number of associated stations

Add a module parameter to support setting the maximum
number of stations that can be associated to an AP.

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix false "scan timeout"

When sending scan request, if hardware is not ready, scan timer was started
and scan timeout mis-reported.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix beamforming data reporting

When reading 'bf' file on debugfs, query beam forming status from firmware.
Ignore CID's that return error or return all zeros.

Remove obsolete code that used to maintain statistics on per-device basis,
as now it is reported be per-CID and current.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: convert debugfs to the table mode

Define tables for similar file entries, i.e.
- table for debugfs_create_file
- table for static parameters
- table for parameters that are members of "wil" structure
- table for blobs
- table for interrupt controllers

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: Workaround for Sparrow with bad device id

If firmware broken on the boot time, Sparrow card enumerates as
device 0x302 instead of 0x310. Allow using this ID

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: wait longer for hardware reset completion

Typical time for hardware reset, as measured, is about 200..250 msec.
Adjust sleeping to use more relaxed msleep, increase sleep interval
and increase total sleep time to be about 1sec

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: check error in wil_target_reset()

When resetting target in wil_target_reset(), error may occur.
Indicate error via error code. In case of error, don't attempt to further
interact with card, specifically don't attempt firmware download or
interrupts enabling.

Move wil_rx_fini() to be always executed to prevent memory leak.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: update copyright year 2014

Fix Copyright headers in all files changed in 2014, to mention 2014

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: fix race in reset

It is important to halt USER CPU first, then MAC CPU
Otherwise, race happens in the firmware

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: map MAC timer for packet lifetime into debugfs

expose reading RGF_MAC_MTRL_COUNTER_0 in debugfs

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: fix decimal printf format specifiers prefixed with 0x

The prefix suggests the number should be printed in hex, so use
the %x specifier to do that.

Found by using regex suggested by Joe Perches.

Signed-off-by: Hans Wennborg <hans@hanshq.net>
Acked-by: Avinash Patil <patila@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

cw1200: Introduce the use of devm_kzalloc

This patch introduces the use of devm_kzalloc and does away with the
kfrees in the probe and remove functions.

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

net: wireless: wl1251: Remove unnecessary free_irq

This patch does away with free_irq in the remove function as the irq is
allocated with a devm_request_irq.

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: support setting custom TX power

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: implement PPR (Power Per Rate) management/API

Broadcom hardware supports auto-adjustment of TX power depending on the
currently used rate. So far all calculations were handled without any
helpers (API) using big arrays and magic offsets.
It seems Broadcom recently decided to clean this up by developing PPR.
Their wlc_ppr.h can be found in open parts of the SDK.
As we plan to implement support for rate-based TX power it makes sense
to also implement our version of PPR as well.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: add RF power tables for radio 0x2057 revs 9 & 14

Don't write them as we don't have gains configured correctly yet.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: update rev3+ gain control workarounds

This fixes workarounds on rev 6+ and cleans code slightly.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: flush some writes on Broadcom MIPS SoCs

Access to PHY and radio registers is indirect on Broadcom hardware and
it seems that addressing on some MIPS SoCs may require flushing. So far
this problem was noticed on 0x4716 SoC only (marketing names: BCM4717,
BCM4718).

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: don't duplicate common PHY read/write ops

Most of the PHYs use the same way of accessing registers, so move that
code to the shared place. An exception is G-PHY which sometimes access
A-PHY regs and requires special handling.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: update flushing many writes performed in a row

Flush radio writes as well and add some tiny optimizations (e.g.
masksetting PHY reg involves reading it, so reset the counter).

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next

ath10k: flush hif buffers before recovery

Transport buffers weren't flushed and processed
before queueing hw recovery request to mac80211.

This could in theory result in an unwanted htt/wmi
rx events being processed while mac80211 recovers
the device and possibly interfere or even crash
the system.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>