wlcore: improved Tx scheduling algorithm

Prioritize EDCA by choosing the AC before anything else. Use the
fast/slow link bitmap in FW to improve the scheduling algorithm for
the multi-link scenario.

Set packet thresholds to determine if a given link is high or low
priority according to its speed. A slow link will be given high priority
if the amount of packets queued for it in the FW is lower than the
slow-threshold. Similarly, a fast link will be given high priority if
the number of its packets queued in FW is smaller than the high-threshold.

The improved algorithm:
1. Choose optimal AC according to FW utilization
2. Traversing the VIFs in a round-robin fashion, try to choose a high
   priority link. Links are traversed in a round-robin fashion inside a
   VIF.
3. If no high priority links are found, choose the first non-empty
   (low priority) link found in the round robin.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: track FW-allocated packets per link

Move FW-allocation tracking code to the fw_status function and track
allocations made by all links. These will be incorporated in the
improved Tx scheduling algorithm.

Manually zero the system link counters on op_stop, as this link is not
allocated the normal way.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: count packets held per AC in each vif

This accounting will help find a vif that has data in a specific AC.
Otherwise we have to traverse all the links, which can be lengthy for
the AP case.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: track wlvif inside per-link structure

This allows us to pass only the link as a parameter to various functions
and deduce the wlvif. Note that this member will be NULL for global
links.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: initialize per-link FW freed blocks correctly

When a link is allocated, sometimes the "freed packets" counter in FW
is non zero, but we always assumed it is. This caused us to incorrectly
account FW allocated blocks in some cases.

When operating in AP mode, this bug caused some stations to never
come back from PSM.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: restore default channel configuration

wlcore allocates two static structs wl1271_band_2ghz & wl1271_band_5ghz
which are used/modified by Reg-Domain e.g. some channel might be marked
as passive at some point. Make sure we don't keep stale settings around
if the HW is unregistered/registered during operation.

[Arik - use Tx-power constant and tweak commit message]

Signed-off-by: Victor Goldenshtein <victorg@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: consolidate free_link and always call it

Make sure free_link is always called when removing an interface. This
ensures all skbs belonging to this interface are returned to mac80211.
Otherwise these dangling skbs might crash the system on the next
call to wl1271_tx_reset_link_queues(). This happens on recovery/stop or
an unsuccessful Tx flush.

Signed-off-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: take the mutex before resetting Tx queues

Otherwise we risk contention for private members of our global structure
while op_stop_locked is running.

Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: remove unnecessary WARN_ON in wl12xx_tx_reset

Sometimes the driver can perform a recovery while Tx is
active, this will trigger unnecessary warning which might
delay the recovery for more than 100 mS.

Signed-off-by: Victor Goldenshtein <victorg@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wl18xx: declare support for greenfield ht_cap

The 18xx fw supports greenfield so add the
IEEE80211_HT_CAP_GRN_FLD flag to the supported
ht capabilities flags.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Ido Reis <idor@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: clear roc_vif on iface removal

When removing an interface currently performing a ROC operation, clear
the current ROC state. This is useful especially during recovery and
keeps mac80211 in sync to our state.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: remove WLCORE_QUIRK_NO_ELP

all the current firmwares support elp, so
we can safely remove WLCORE_QUIRK_NO_ELP.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: allow ACX_BA_SESSION_RX_SETUP to fail

Under some circumstances, that fw might be asked to
remove a rx ba sessions it doesn't know about. In
this case, instead of triggering a recovery, accept
the error code (CMD_STATUS_NO_RX_BA_SESSION) and
ignore it.

[Arik - indicate failure up when the BA session cannot be setup]

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: allow fw commands to fail

Currently, each fw command/acx that return a status code
different than CMD_STATUS_SUCCESS will trigger a recovery
in the driver.

However, it is a valid for some fw commands to fail (e.g.
due to temporary lack of resources), so add new functions
that allow passing bitmap of valid error return values.

(make the current wl1271_cmd_send/wl1271_cmd_configure
wrappers around the new functions, in order to avoid
changing the whole driver)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wl18xx: support 2nd set of mac/phy tx-power params

First set (low, medium and high TX power values) is used
for STA-HP background role. The 2nd set is used for other roles.

Update other mac/phy parameters according to new FW.

Signed-off-by: Yair Shapira <yair.shapira@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Conflicts:
drivers/net/wireless/ti/wl18xx/main.c

wl18xx: update default mac/phy parameters

Update mac/phy paramters according to the default HP SISO boards.

Signed-off-by: Ido Reis <idor@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore/wl12xx: make sure session id is always zero for AP

The 12xx FW doesn't support non-zero session ids for AP-mode. Introduce
an appropriate quirk to make sure the session id is always zero when
needed.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

Merge branch 'wl12xx-next' into for-linville

Conflicts:
drivers/net/wireless/ti/wlcore/main.c

wl18xx: ignore irrelevant firmware version fields

For wl18xx, only the chip ID and the minor version number are
relevant.  Ignore the other numbers which are either not used or
relate to internal projects or internal branches.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore/wl12xx/wl18xx: verify multi-role and single-role fw versions

Previously we were only checking the single-role firmware version.
Now add code to check for the firmware versions separately for each
firmware type.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wl12xx: ignore some of the firmware version fields

The firmware type and the project number fields in the firmware
version number, cannot be checked as if they increase sequentially,
because the former is the firmware type and the latter is an internal
project number.  There's no guarantee that these numbers will remain
incremental, so use WLCORE_FW_VER_IGNORE.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: change way of checking the firmware version

The firmwares version string contain 5 integers.  We used to consider
all the digits (except for the first one, which indicates the chip) as
linearly increasing version numbers.  This is not correct, because
some of the integers indicate type of firmware (eg. single-role
vs. multi-role) or the internal project it was created for.

Besides, this varies a bit from chip to chip, so we need to make the
firmware version checks more flexible (eg. allow the lower driver to
ignore some of the integers).  Additionally, we need to change the
code so that we only check for a linearly increasing number on the
fields where this actually makes sense.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore/wl12xx: remove deprecated FW version check

We don't distinguish between STA and AP firmwares anymore, so the
firmware version checking and quirks setting in wl12xx isn't needed
anymore.

Remove implementation of .identify_fw in wl12xx and deprecated
definitions.  Don't remove the op entirely from wlcore, because it may
be needed for more fine-grained checking later.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore/wl12xx: move wl12xx chip ID defines to the lower driver

Move wl12xx-specific chip ID macros to the wl12xx driver and rename
them to 127X and 128X for clarity since both the "1" (2.4GHz) and the
"3" (2.4GHz and 5GHz) variants use the same chip ID.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore/wl18xx/wl12xx: add recovery settings to conf

add support for recovery settings including bug_on_recovery and
no_recovery options.

These options can now be set using wl18xx-conf.bin file and wlconf
tool.

Signed-off-by: Yair Shapira <yair.shapira@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: gather information about firmware stability

It's sometimes useful to gather information about the firmware
stability in long test runs, especially to see if problems are
recurring frequently or not.  With this commit we count the number of
times a hardware recovery was issued and print it out during recovery
and in the driver_state in debugfs.

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Igal Chernobelsky <igalc@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: move ps change handling to .bss_info_changed()

Adapt the new mac80211 BSS_CHANGED_PS notification,
and do the ps handling in mac80211's per-vif
callback (.bss_info_changed), rather than in
the per-device (.config) callback.

Make sure to configure it only after association.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: mask out CCK rates when starting GO

mask out CCK rates from the AP's local rates
when the interace is p2p interface (GO).

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: use sta_state-based ROCs for AP mode

Try an opportunistic ROC when a STA is first added and stop the ROC when
the STA is removed or successfully authenticated. This would ensure we
don't miss auth/assoc/EAPOL packets during connection

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore/wl18xx/wl12xx: separate channel count between chips

18xx chips are capable of staying on 2 channels at the same time.
Introduce a chip-family specific parameter to set the number of channels
in the interface-combinations published by the driver.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

mwl8k: remove useless pci shutdown callback and stray debugging

This patch removes a left over debugging print present in the pci
shutdown callback, since this callback does not do anything useful, get
rid of it entirely.

Signed-off-by: Florian Fainelli <ffainelli@freebox.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2800lib: introduce RFCSR3_VCOCAL_EN

On the RF3290,RF5360,RF5370,RF5372,RF5390,RF5392
radio frontends, the VCO calibration can be
controlled via the RFCSR3 register. The current
code uses the RFCSR30_RF_CALIBRATION constant to
enable the calibration, however that belongs to
the RFCSR30 register. Although the values of the
constant is correct, but using that for another
register is confusing.

Add a new definition for the VCO calibration enable
bit of the RFCSR3 register and use that in the
relevant places in order to avoid confusions.

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2800lib: remove trailing semicolons from RFCSR3_* defines

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

carl9170: fix signal strength reporting issues

On A-MPDU frames, the hardware only reports valid
signal strength data for the last subframe.

This patch fixes it by flagging everything but the
last subframe in an A-MPDU to tell mac80211 to
ignore the signal strength entirely. Otherwise
the empty value (= 0 dbm) will distort the
average quite badly.

Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2800lib: fix indentation in rt2800_init_rfcsr

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2800lib: fix indentation of some rt2x00_rt calls

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

p54: potential signedness issue in p54_parse_rssical()

"entries" is unsigned here, so it is never less than zero.  In theory,
len could be less than offset so I have added a check for that.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next

Revert "Bluetooth: Fix possible deadlock in SCO code"

This reverts commit 269c4845d5b3627b95b1934107251bacbe99bb68.

The commit was causing dead locks and NULL dereferences in the sco code:

 [28084.104013] BUG: soft lockup - CPU#0 stuck for 22s! [kworker/u:0H:7]
 [28084.104021] Modules linked in: btusb bluetooth <snip [last unloaded:
bluetooth]
...
 [28084.104021]  [<c160246d>] _raw_spin_lock+0xd/0x10
 [28084.104021]  [<f920e708>] sco_conn_del+0x58/0x1b0 [bluetooth]
 [28084.104021]  [<f920f1a9>] sco_connect_cfm+0xb9/0x2b0 [bluetooth]
 [28084.104021]  [<f91ef289>]
hci_sync_conn_complete_evt.isra.94+0x1c9/0x260 [bluetooth]
 [28084.104021]  [<f91f1a8d>] hci_event_packet+0x74d/0x2b40 [bluetooth]
 [28084.104021]  [<c1501abd>] ? __kfree_skb+0x3d/0x90
 [28084.104021]  [<c1501b46>] ? kfree_skb+0x36/0x90
 [28084.104021]  [<f91fcb4e>] ? hci_send_to_monitor+0x10e/0x190 [bluetooth]
 [28084.104021]  [<f91fcb4e>] ? hci_send_to_monitor+0x10e/0x190 [bluetooth]

Cc: stable@vger.kernel.org
Reported-by: Chan-yeol Park <chanyeol.park@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: trivial: Change NO_FCS_RECV to RECV_NO_FCS

Make code more readable by changing CONF_NO_FCS_RECV which is read
as "No L2CAP FCS option received" to CONF_RECV_NO_FCS which means
"Received L2CAP option NO_FCS". This flag really means that we have
received L2CAP FRAME CHECK SEQUENCE (FCS) OPTION with value "No FCS".

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Process receiving FCS_NONE in L2CAP Conf Rsp

Process L2CAP Config rsp Pending with FCS Option 0x00 (No FCS)
which is sent by Motorola Windows 7 Bluetooth stack. The trace
is shown below (all other options are skipped).

...
< ACL data: handle 1 flags 0x00 dlen 48
    L2CAP(s): Config req: dcid 0x0043 flags 0x00 clen 36
      ...
      FCS Option 0x00 (No FCS)
> ACL data: handle 1 flags 0x02 dlen 48
    L2CAP(s): Config req: dcid 0x0041 flags 0x00 clen 36
      ...
      FCS Option 0x01 (CRC16 Check)
< ACL data: handle 1 flags 0x00 dlen 47
    L2CAP(s): Config rsp: scid 0x0043 flags 0x00 result 4 clen 33
      Pending
      ...
> ACL data: handle 1 flags 0x02 dlen 50
    L2CAP(s): Config rsp: scid 0x0041 flags 0x00 result 4 clen 36
      Pending
      ...
      FCS Option 0x00 (No FCS)
< ACL data: handle 1 flags 0x00 dlen 14
    L2CAP(s): Config rsp: scid 0x0043 flags 0x00 result 0 clen 0
      Success
> ACL data: handle 1 flags 0x02 dlen 14
    L2CAP(s): Config rsp: scid 0x0041 flags 0x00 result 0 clen 0
      Success
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Fix missing L2CAP EWS Conf parameter

If L2CAP_FEAT_FCS is not supported we sould miss EWS option
configuration because of break. Make code more readable by
combining FCS configuration in the single block.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: AMP: Check that AMP is present and active

Before starting quering remote AMP controllers make sure
that there is local active AMP controller.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: AMP: Mark controller radio powered down after HCIDEVDOWN

After getting HCIDEVDOWN controller did not mark itself as 0x00 which
means: "The Controller radio is available but is currently physically
powered down". The result was even if the hdev was down we return
in controller list value 0x01 "status 0x01 (Bluetooth only)".

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Refactor l2cap_send_disconn_req

l2cap_send_disconn_req takes 3 parameters of which conn might be
derived from chan. Make this conversion inside l2cap_send_disconn_req.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Move double negation to macros

Some comparisons needs to double negation(!!) in order to make the value
of the field boolean. Add it to the macro makes the code more readable.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Implement deferred sco socket setup

In order to authenticate and configure an incoming SCO connection, the
BT_DEFER_SETUP option was added. This option is intended to defer reply
to Connect Request on SCO sockets.
When a connection is requested, the listening socket is unblocked but
the effective connection setup happens only on first recv. Any send
between accept and recv fails with -ENOTCONN.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Add BT_DEFER_SETUP option to sco socket

This option will set the BT_SK_DEFER_SETUP bit in socket flags.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: cancel power_on work when unregistering the device

We need to cancel the hci_power_on work in order to avoid it run when we
try to free the hdev.

[ 1434.201149] ------------[ cut here ]------------
[ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
[ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci
_power_on+0x0/0x90
[ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G        W    3.7.0-rc5-next-
20121112-sasha-00018-g2f4ce0e #127
[ 1434.210760] Call Trace:
[ 1434.210760]  [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
[ 1434.210760]  [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
[ 1434.210760]  [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
[ 1434.210760]  [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
[ 1434.210760]  [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
[ 1434.210760]  [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
[ 1434.210760]  [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
[ 1434.210760]  [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
[ 1434.210760]  [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
[ 1434.210760]  [<ffffffff8125eee7>] kfree+0x227/0x330
[ 1434.210760]  [<ffffffff83785db0>] bt_host_release+0x10/0x20
[ 1434.210760]  [<ffffffff81e539e5>] device_release+0x65/0xc0
[ 1434.210760]  [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
[ 1434.210760]  [<ffffffff819d39cd>] kobject_release+0xd/0x10
[ 1434.210760]  [<ffffffff819d33cc>] kobject_put+0x4c/0x60
[ 1434.210760]  [<ffffffff81e548b2>] put_device+0x12/0x20
[ 1434.210760]  [<ffffffff8376a334>] hci_free_dev+0x24/0x30
[ 1434.210760]  [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
[ 1434.210760]  [<ffffffff8127be12>] __fput+0x122/0x250
[ 1434.210760]  [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
[ 1434.210760]  [<ffffffff8127bf49>] ____fput+0x9/0x10
[ 1434.210760]  [<ffffffff81133402>] task_work_run+0xb2/0xf0
[ 1434.210760]  [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
[ 1434.210760]  [<ffffffff83bfb0ea>] int_signal+0x12/0x17
[ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---

Cc: stable@vger.kernel.org
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Add missing lock nesting notation

This patch fixes the following report, it happens when accepting rfcomm
connections:

[  228.165378] =============================================
[  228.165378] [ INFO: possible recursive locking detected ]
[  228.165378] 3.7.0-rc1-00536-gc1d5dc4 #120 Tainted: G        W
[  228.165378] ---------------------------------------------
[  228.165378] bluetoothd/1341 is trying to acquire lock:
[  228.165378]  (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
[<ffffffffa0000aa0>] bt_accept_dequeue+0xa0/0x180 [bluetooth]
[  228.165378]
[  228.165378] but task is already holding lock:
[  228.165378]  (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
[<ffffffffa0205118>] rfcomm_sock_accept+0x58/0x2d0 [rfcomm]
[  228.165378]
[  228.165378] other info that might help us debug this:
[  228.165378]  Possible unsafe locking scenario:
[  228.165378]
[  228.165378]        CPU0
[  228.165378]        ----
[  228.165378]   lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
[  228.165378]   lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
[  228.165378]
[  228.165378]  *** DEADLOCK ***
[  228.165378]
[  228.165378]  May be due to missing lock nesting notation

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

brcmsmac: Fix possible NULL pointer dereference in _dma_ctrlflags()

There's a debug message to warn if this function is passed a NULL
pointer, but in order to print the message we have to dereference the
pointer. Obviously this isn't a good idea, so remove the message.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wireless: mwifiex: Fix typo in wireless/mwifiex driver

Correct spelling typo in wireless/mwifiex driver.

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtlwifi: use SIMPLE_DEV_PM_OPS

rtlwifi only provides pm callbacks for functions covered by pm sleep
and they are also just called if CONFIG_PM_SLEEP is set.

Only add functions rtl_pci_suspend and rtl_pci_resume if
CONFIG_PM_SLEEP is set and use SIMPLE_DEV_PM_OPS instead of
manually filling struct dev_pm_ops.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

p54pci: use SIMPLE_DEV_PM_OPS

p54pci does not provide any runtime pm callbacks, so support for
PM_RUNTIME is not needed and we could go to PM_SLEEP.
This also makes it possible to use SIMPLE_DEV_PM_OPS instead of
manually filling struct dev_pm_ops.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: use SIMPLE_DEV_PM_OPS

ath9k does not provide any runtime pm callbacks, so support for
PM_RUNTIME is not needed and we could go to PM_SLEEP.
This also makes it possible to use SIMPLE_DEV_PM_OPS instead of
manually filling struct dev_pm_ops.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtlwifi: rtl8192se: Fixed coding style issues in the driver

This patch fixes almost all coding issues in the rtl8192se driver. Only
exception is putting trailing */ on separate lines.

Signed-off-by: Daniel Stamer <daniel@stamer.info>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: fix struct member mismatch

Using bss->information_elements and treating
bss->len_beacon_ies as its size is wrong, the
real size is len_information_elements.

Found while I was reviewing the use of this
cfg80211 API (as it is actually potentially
broken due to races.)

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: change debug output for received event.

see header.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: fix bug in setting mgmt ie and parsing vndrs ie.

Parsing vndrs ie was not taking len of tlv itself in account. Setting
mgmt ie was missing check for length indicating non configured ie and
wrongly checking available length.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: remove mode from struct brcmf_cfg80211_conf

The mode should be stored and used per virtual interface. Remove
the mode from device global structure and rework the code to use
the mode from brcmf_cfg80211_vif.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: get rid of struct brcmf_cfg80211_info::link_up attribute

This attribute indicates successful IBSS or AP connection has been
established. However, this no longer works for virtual interfaces.
As it turns out this attribute is identical to the CONNECTED bit
in struct brcmf_cfg80211_vif::sme_state. This patch removes the
attribute and rework some functions relying on it.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmsmac: support 4313iPA

Add support for 4313 iPA variant.
It is a variant of already supported 4313 ePA
and needs some PHY changes to work properly.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmsmac: move PHY functions

Move functions in
preparation for 4313iPA changes

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmsmac: hardware info in debugfs

Put basic information about hardware in debugfs.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Acked-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmsmac: fix bounds checking in tx/rx

brcms_b_txstatus and brcms_b_recv are off by one when
doing bounds checking on number of packets to process

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmsmac: cleanup in isr code

brcms_c_isr returns true if interrupt was for us
and if dpc should be scheduled which is the same thing.
Simplify it.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmsmac: handle packet drop during transmit correctly

The .tx() callback function can drop packets when there is no
space in the DMA fifo. Propagate that information to caller
and make sure the freed sk_buff reference is not accessed.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcm80211: update the MAINTAINERS file

Organizational changes need to be reflected in the MAINTAINERS file.
The contact info on wireless.kernel.org has also been updated.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wireless: allow Atheros card to not depend on ath.ko

There are 2 different things:
- sub-menu for "Atheros Wireless cards" family
- module ath.ko with common Atheros code

Until now, they both used to depend on the same Kconfig variable ATH_COMMON.
Thus, being "Atheros card" and "depending on ath.ko" was the same.

To allow module to belong to the
"Atheros Wireless cards" family but not use ath.ko,
2 conditions above need to be separated.

So, this patch introduce new Kconfig variable ATH_CARDS for belonging
to the "Atheros Wireless Cards" family; while ATH_COMMON becomes hidden
variable to express dependency on common Atheros code in ath.ko. Modules
that depend on this common code now express it by setting ATH_COMMON.

Right now, ath6kl do not depend on common code and thus do not set ATH_COMMON.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Remove redundant NULL assignment

'bf_next' is cleared using ATH_TXBUF_RESET() in both the
callsites of ath_tx_get_buffer().

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Implement sta_add_debugfs/sta_remove_debugfs

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Replace WME_NUM_TID with IEEE80211_NUM_TIDS

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move ethtool functions to debug.c

The ethtool statistics are available only when
CONFIG_ATH9K_DEBUGFS is enabled, move these functions
to debug.c

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Use addr_mask to disallow invalid MAC addresses in mutli-bssid mode

Reported-by: Petr Stetiar <ynezz@true.cz>
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: advertise GreenField, 40MHz intolerance support to cfg80211

This patch adds support for advertising GreenField, 40MHz intolerance
or LDPC coding support to cfg80211.

Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix buffer overflow error

The commit "ath9k: stomp audio profiles on weak signal
strength" failed to take care of new stomp type while
programming concurrent tx priority. That leads to array
index out of bounds access.

drivers/net/wireless/ath/ath9k/btcoex.c:414
        ath9k_hw_btcoex_set_concur_txprio()
               error: buffer overflow 'stomp_txprio' 4 <= 4

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ssb: extif: fix compile errors

If CONFIG_SSB_EMBEDDED or CONFIG_SSB_DRIVER_MIPS is set and
CONFIG_SSB_DRIVER_EXTIF is not set, it will cause compile problems
because of missing functions. This patch fixes these problems.

The mips driver now also uses ssb_chipco_available() instead of
checking bus->chipco.dev manually.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

bcma: handle return value of pci_assign_resource

This fixes the following warning:

  CC      drivers/bcma/driver_pci_host.o
drivers/bcma/driver_pci_host.c: In function 'bcma_core_pci_fixup_addresses':
drivers/bcma/driver_pci_host.c:555:23: error: ignoring return value of
'pci_assign_resource', declared with attribute warn_unused_result
[-Werror=unused-result]

Reported-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wlcore: don't stop fwlog if dbgpins are used

Due to a bug, the fw asserts on fw log stop when dbg-pins are used.
Don't stop the fw log in this case.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: use new set bandwidth command to adjusting channel BW

We support changing the channel BW when we started the STA role on
a 40Mhz bandwidth. Otherwise a reconnection is required.
Save the started channel width and use it when channel width updates
arrive.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: configure dwell times according to scan type

Allow configuring different dwell times to the different
scan types (regular and scheduled).

Add new configuration entry (dwell_time_dfs) to
conf_scan_settings, in order to allow setting
different values for normal scan and scheduled scan.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wl18xx: make driver operational again

we have done updating the driver to the new fw
api, so make the driver operational again.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: call ieee80211_sched_scan_stopped on interface removal

The interface might go down before we got the SCHED_STOPPED
event, so make sure to call ieee80211_sched_scan_stopped()
if the scanned interface is removed.

Replace sched_scanning with sched_vif in order to save
the scanned interface.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: add new reg-domain configuration command

In 18xx the calibration process of the PHY Cortex domain
requires to perform an active calibration of the channel
before it can be used for transmission. To fulfill world
wide regulatory restrictions, fw should be always
synchronized/updated with current CRDA configuration.
Add a new "CMD_DFS_CHANNEL_CONFIG" command to update the
fw with current reg-domain, this command passes a bit map
of channels that are allowed to be used for transmission.

The driver shall update the fw during initialization and
after each change in the current reg-domain
configuration. The driver will save the channel number of
incoming beacons during the scan process, as they might
be a result of the passive scan on
"IEEE80211_CHAN_PASSIVE_SCAN" channel and will update the
fw accordingly once the scan is finished, the purpose of
this is to be ready in case of the authentication request
on one of these disabled (uncalibrated) channels.

The new command requires to wait for the fw completion
event "DFS_CHANNELS_CONFIG_COMPLETE_EVENT".

No scan commands (including the sched scan) can be
executed concurrently with the "CMD_DFS_CHANNEL_CONFIG",
wl->mutex ensures that.

[Arik - move reset of reg_ch_conf_last to safe place inside
op_stop_locked]
[Eliad - adjust to new event waiting api]

Signed-off-by: Victor Goldenshtein <victorg@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: save session_id per-link

A new session_id is generated on link allocation.
it is saved in a global array and used later, on tx.

The new fw api adds new bcast/global_session_id
fields to start_role(ap) command, and a new session_id
field to add_peer command. align the driver with it.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: pass wmm configuration to the fw

New fields were added to start_role(ap) and
set_peer_state commands, so the fw will be
able to know whether the sta/ap supports
wmm (the fw uses it in order to choose the
AC for some of its internally-generated frames)

For sta, take this value right from bss_conf->qos.

For ap, check for wmm support by looking for the
WMM IE in the configured beacon.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: update events enum/struct to new fw api

The event mailbox in wl18xx has a different
(non-compatible) structure.

Create common functions in wlcore to handle the
events, and call them from the chip-specific
event mailbox parsers.

This way, each driver (wl12xx/wl18xx) extracts
the event mailbox by itself according to its
own structure, and then calls the common
wlcore functions to handle it.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: update channel_switch/stop_channel_switch commands

Some fields were added to the channel_switch and
stop_channel_switch commands. Unfortunately,
the new 18xx channel_switch struct is not backward
compatible with the 12xx channel switch struct.

Add a new channel_switch op to wlcore, and update
the driver accordingly.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: update acx enum

update the acx enum to the new fw api.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wl18xx: increase MAX_CHANNELS_5GHZ

Some regdomains have more than 23 valid 5ghz channels,
so 18xx's MAX_CHANNELS_5GHZ was increased to 32.

Since now we have different max 5ghz channels values
for wl12xx and wl18xx, add a new wl->max_channels_5ghz
field, and use it for scan channels configuration.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: split 18xx and 12xx scan mechanism

The scan APIs of 12xx and 18xx are totally different.
Use some common functions as much as possible (e.g.
for setting scan channels), but split scan.c into
chip-specific scan.c files, each implementing its
own scan mechanism.

(in other words - move most of the current wlcore's
scan.c into wl12xx, and implement a similar mechanism
in 18xx, according to the new api)

New wlcore ops are introduced in order to call the
chip-specific scan functions.

The template indices used for each scan (regular/scheduled)
are also different between the chips, so set the correct
indices used for each scan type after identifying the chip.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: update commands enum to new fw api

Align the commands enum with the new fw api (8.4.0.0.19)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wl18xx: change fw name and temporarily fail loading

The new fw (8.5.0.0.28) is not backward compatible
with older drivers.

Use a new fw name (along with bumping the min
fw version), and add some code to fail
any boot attempt during the fw api alignment
patches (as the driver is not functional in
these transitional patches).

This code will be removed after the api alignment
will be done.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: make scan scan configuration functions more generic

18xx and 12xx have different scan APIs. In 18xx,
the scan and the sched scan use the same struct.

Prepare the scan configuration functions to it, by taking
more generic params (e.g. ieee80211_channel) instead of
specific structs/requests.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: don't call ieee80211_sched_scan_stopped directly

When we stop sched scan during connection, we shouldn't
call ieee80211_sched_scan_stopped directly, but do it
in the normal flow, as part of the SCHED_SCAN_COMPLETED
event handling.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: remove a bunch of unnecessary parentheses

Some if statements had unnecessary parentheses.  Remove them for
consistency.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: avoid using goto in normal code flow

Remove goto and label in the code where a simple if can be used.  If
nothing else, this is at least confusing git diff, which shows the
label name as the name of the function.

Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: don't leak wl->mbox

free it on wlcore_free_hw()

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: print role_id on bss_info_changed

In multi-vif setup it's useful to know the role_id
being configured.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

wlcore: configure the remote rates with our own rates

With the new connection flow, start_sta is called before
the remote rates where updated. Use our own supported rates
instead to make sure we don't disable any potential rate
(the rate policies will be updated later, but there is
currently no way to update the remote rates)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Reviewed-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>