iwlegacy: don't mess up the SCD when removing a key
When we remove a key, we put a key index which was supposed
to tell the fw that we are actually removing the key. But
instead the fw took that index as a valid index and messed
up the SRAM of the device.
This memory corruption on the device mangled the data of
the SCD. The impact on the user is that SCD queue 2 got
stuck after having removed keys.
Reported-by: Paul Bolle <pebolle@tiscali.nl> Cc: stable@vger.kernel.org Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
If we only monitor while associated, the following
can happen:
- we're associated, and the queue stuck check
runs, setting the queue "touch" time to X
- we disassociate, stopping the monitoring,
which leaves the time set to X
- almost 2s later, we associate, and enqueue
a frame
- before the frame is transmitted, we monitor
for stuck queues, and find the time set to
X, although it is now later than X + 2000ms,
so we decide that the queue is stuck and
erroneously restart the device
Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
On rt2x00_dmastart() we increase index specified by Q_INDEX and on
rt2x00_dmadone() we increase index specified by Q_INDEX_DONE. So entries
between Q_INDEX_DONE and Q_INDEX are those we currently process in the
hardware. Entries between Q_INDEX and Q_INDEX_DONE are those we can
submit to the hardware.
According to that fix rt2x00usb_kick_queue(), as we need to submit RX
entries that are not processed by the hardware. It worked before only
for empty queue, otherwise was broken.
Note that for TX queues indexes ordering are ok. We need to kick entries
that have filled skb, but was not submitted to the hardware, i.e.
started from Q_INDEX_DONE and have ENTRY_DATA_PENDING bit set.
From practical standpoint this fixes RX queue stall, usually reproducible
in AP mode, like for example reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=828824
Reported-and-tested-by: Franco Miceli <fmiceli@plan.ceibal.edu.uy> Reported-and-tested-by: Tom Horsley <horsley1953@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
mac80211: destroy assoc_data correctly if assoc fails
If association failed due to internal error (e.g. no
supported rates IE), we call ieee80211_destroy_assoc_data()
with assoc=true, while we actually reject the association.
This results in the BSSID not being zeroed out.
After passing assoc=false, we no longer have to call
sta_info_destroy_addr() explicitly. While on it, move
the "associated" message after the assoc_success check.
Cc: stable@vger.kernel.org [3.4+] Signed-off-by: Eliad Peller <eliad@wizery.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Thomas Huehn [Fri, 29 Jun 2012 13:26:27 +0000 (06:26 -0700)]
mac80211: correct size the argument to kzalloc in minstrel_ht
msp has type struct minstrel_ht_sta_priv not struct minstrel_ht_sta.
(This incorporates the fixup originally posted as "mac80211: fix kzalloc
memory corruption introduced in minstrel_ht". -- JWL)
Reported-by: Fengguang Wu <wfg@linux.intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Thu, 28 Jun 2012 02:57:59 +0000 (19:57 -0700)]
mwifiex: retrieve correct max_power information in reg_notifier handler
As we don't provide custom regulatory rules to cfg80211,
"chan->max_power" remains uninitialized (0dbm) and
"chan->max_reg_power" will contain maximum power for a channel
extracted from regulatory rules provided by CRDA; hence use
"chan->max_reg_power" in reg_notifier handler instead of
"chan->max_power" to set max_power in firmware.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Thu, 28 Jun 2012 02:57:57 +0000 (19:57 -0700)]
mwifiex: use correct firmware command to get power limits
"priv->max_tx_power_level" and "priv->min_tx_power_level" variables
are initialized to maximum and minimum power levels supported by
hardware by sending correct firmware command.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Thu, 28 Jun 2012 02:57:56 +0000 (19:57 -0700)]
mwifiex: wakeup main thread to handle command queued
We miss to wakeup main thread after adding command to cmd pending
queue at follwing places. These commands are handled later when
main thread is woken up for handling an interrupt for sleep event
from firmware. This adds worst case delay of 50msec.
1) We don't wakeup main thread when asynchronous command is added
to cmd pending queue. Move queue_work() call from
mwifiex_wait_queue_complete() to mwifiex_send_cmd_async() to wakeup
main thread for sync as well as async commands.
2) Scan operation is triggered due to following reasons
a) request from user (ex. "iw scan" command)
b) Scan performed by driver internally.
In first case main thread is woken up when first scan command is
queued in cmd pending queue (we don't need to wakeup main thread for
subsequent scan commands, because they are queued in scan command
response handler), but it is not done for second case. queue_work()
is moved inside mwifiex_scan_networks() to handle both the cases.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Felix Fietkau [Thu, 28 Jun 2012 00:33:41 +0000 (02:33 +0200)]
ath9k: de-duplicate initvals
The initvals tool from https://github.com/mcgrof/qca-swiss-army-knife has
been modified to detect identical initval tables and replace them with
macros. This patch contains the generated changes.
On MIPS this reduces the binary size by 24 KB with no runtime changes.
Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Felix Fietkau [Wed, 27 Jun 2012 12:58:19 +0000 (14:58 +0200)]
ath9k: fix ANI operation in AP mode
ath9k_ani_reset (which is called at reset time) uses a state variable
ani->update_ani to prevent the ANI noise immunity state on the operating
channel from being overwritten by background scans. Unfortunately this
is also being set for AP mode, since it's mixed with code that is only
supposed to change the default settings after a reset.
In AP mode this has the side effect of having ANI run, but being unable to
change its runtime noise immunity level, making it effectively useless.
Fix this by getting rid of ani->update_ani and passing a parameter to
ath9k_hw_set_ofdm_nil and ath9k_hw_set_cck_nil instead.
Signed-off-by: Felix Fietkau <nbd@openwrt.org> Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Paul Bolle [Wed, 27 Jun 2012 08:36:27 +0000 (10:36 +0200)]
iwlegacy: print how long queue was actually stuck
Every now and then, after resuming from suspend, the iwlegacy driver
prints
iwl4965 0000:03:00.0: Queue 2 stuck for 2000 ms.
iwl4965 0000:03:00.0: On demand firmware reload
I have no idea what causes these errors. But the code currently uses
wd_timeout in the first error. wd_timeout will generally be set at
IL_DEF_WD_TIMEOUT (ie, 2000). Perhaps printing for how long the queue
was actually stuck can clarify the cause of these errors.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Arend van Spriel [Tue, 26 Jun 2012 19:26:40 +0000 (21:26 +0200)]
brcmfmac: fix sparse warning introduced with checkdied patch
The commit "brcmfmac: introduce checkdied debugfs functionality"
also introduced a sparse warning:
..../brcmfmac/dhd_sdio.c:3147:45: sparse: cast to restricted __le32
This patch fixes this sparse warning.
Reported-by: Fengguang Wu <wfg@linux.intel.com> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Franky Lin [Tue, 26 Jun 2012 19:26:39 +0000 (21:26 +0200)]
brcmfmac: add BCM4334 support
BCM4334 is a dualband a/b/g/n WiFi chip support 20MHz/40MHz
channels. This patch adds support for its SDIO interface.
Reviewed-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: Franky Lin <frankyl@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Arend van Spriel [Tue, 26 Jun 2012 19:26:38 +0000 (21:26 +0200)]
brcmfmac: reduce allocations needed during nvram data download
The nvram data is preprocessed before being sent to the device
and just before sending an additional allocation was done that
assured word alignment of the data. This has moved to the
preprocessing step to reduce allocations and subsequent copying
of the nvram data.
Reviewed-by: Franky Lin <frankyl@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Franky Lin [Tue, 26 Jun 2012 19:26:37 +0000 (21:26 +0200)]
brcmfmac: use firmware data buffer directly for nvram
The nvram file could be parsed directly in the data buffer in the
firmware structure passed by request_firmware function. This patch
gets rid of the redundant memcpy.
Reviewed-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: Franky Lin <frankyl@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Franky Lin [Tue, 26 Jun 2012 19:26:36 +0000 (21:26 +0200)]
brcmfmac: move glom alignment setting to SDIO bus layer
txglomming alignment is a SDIO bus specific feature. It is more
appropriate to place it in SDIO bus layer instead of common layer.
Reviewed-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: Franky Lin <frankyl@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Franky Lin [Tue, 26 Jun 2012 19:26:35 +0000 (21:26 +0200)]
brcmfmac: restrict dongle txglom disable to old SDIO core
txglomming is a firmware feature for sdio bus interface. For SDIO
device cores newer than revision 11, the default setting of
firmware should be used instead of disabling it from the host side.
Reviewed-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: Franky Lin <frankyl@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Franky Lin [Tue, 26 Jun 2012 19:26:34 +0000 (21:26 +0200)]
brcmfmac: add support for bus specific data command
brcmfmac need to support data command setting for dongle's bus
core. A list must be placed at brcmf_bus structure before calling
brcmf_bus_start in order to be sent by brcmf_c_preinit_dcmds.
Reviewed-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: Franky Lin <frankyl@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Tom Hughes [Wed, 27 Jun 2012 17:21:15 +0000 (18:21 +0100)]
ath9k: fix panic caused by returning a descriptor we have queued for reuse
Commit 3a2923e83c introduced a bug when a corrupt descriptor
is encountered - although the following descriptor is discarded
and returned to the queue for reuse the associated frame is
also returned for processing. This leads to a panic:
Johannes Berg [Wed, 27 Jun 2012 13:38:56 +0000 (15:38 +0200)]
mac80211: correct behaviour on unrecognised action frames
When receiving an "individually addressed" action frame, the
receiver is required to return it to the sender. mac80211
gets this wrong as it also returns group addressed (mcast)
frames to the sender. Fix this and update the reference to
the new 802.11 standards version since things were shuffled
around significantly.
Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sven Eckelmann [Mon, 25 Jun 2012 05:15:22 +0000 (07:15 +0200)]
ath9k: raise aggregation limit to 64k for HT IBSS
mac80211 adds stations in HT IBSS as soon as a frame comes by,
even if the HT capabilities are not known yet (they are often
received later, e.g. in beacons). So far, ampdu factor/density
are only calculated when the station is initially added.
This patch changes this to update ampdu factor/density settings
when starting a blockack session.
Using this patch, we had performance boosts from 60 to 150 MBit/s
between two 2x2 Atheros devices in 5 GHz HT IBSS mode.
Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
The cause is due to calling kfree_skb() with interrupts disabled.
This bug is discussed in https://bugzilla.redhat.com/show_bug.cgi?id=797709.
Reported-and-Tested by: Ivan Ivanovich <iivanich@gmail.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Eyal Shapira [Tue, 26 Jun 2012 07:41:17 +0000 (10:41 +0300)]
wlcore: print stack trace in every recovery
As recovery queuing can now occur from multiple code paths
it's convenient to know what triggered it in all cases
other than an intended recovery which is part of the
switch between single role to multi role.
Eyal Shapira [Tue, 26 Jun 2012 07:41:16 +0000 (10:41 +0300)]
wlcore: queue recovery in case of bus errors during cmd_remove_peer
Following the addition of propagating errors from the bus ops
there's a need to distinguish between bus errors (including timeout)
and a legitimate timeout occuring in cmd_wait_for_event_or_timeout.
In case of real bus errors we need to queue recovery even in cases
where a timeout on a response from the FW to a command is acceptable.
Eyal Shapira [Tue, 26 Jun 2012 07:41:15 +0000 (10:41 +0300)]
wlcore: fix broken TX due to wrong queuing of recovery
commit 14bba17b "wl12xx: Propagate errors from wl1271_raw_write32"
breaks down TX in certain scenarios. wl1271_irq_locked() propagates
errors from wl1271_tx_work_locked however it may return -EBUSY
when the FW queues are full which is a legitimate case and not a
a real error. In this case a recovery is triggered by wl1271_irq
and this keeps repeating itself so TX is completely broken.
Fix it by avoiding propagating return values as errors even if they
aren't. Only bus (SDIO or SPI) ops failures would be progagated
as only these should trigger recovery.
Luciano Coelho [Mon, 25 Jun 2012 11:41:20 +0000 (14:41 +0300)]
wlcore: fix some failure cases in wlcore_probe()
We need to release the IRQ if hw_info() or identify_chip() fails. And
we need unregister the HW with mac80211 if there are any failures
after it's registered.
Luciano Coelho [Mon, 25 Jun 2012 11:15:55 +0000 (14:15 +0300)]
wl18xx: deprecate PG1 support
The new PG2 version of the chip has a few differences in terms of FW
API if compared to PG1. PG1 is just a sample that shouldn't be used
in real life, so to avoid having to handle both separately, mark the
PG1 version as deprecated and bail out during probe.
Johannes Berg [Mon, 25 Jun 2012 07:36:41 +0000 (09:36 +0200)]
iwlwifi: fix activating inactive stations
When authentication/association timed out, the driver would
complain bitterly, printing the message
ACTIVATE a non DRIVER active station id ... addr ...
The cause turns out to be that when the AP station is added
but we don't associate, the IWL_STA_UCODE_INPROGRESS is set
but never cleared. This then causes iwl_restore_stations()
to attempt to resend it because it uses the flag internally
and uploads even if it didn't set it itself.
To fix this issue and not upload the station again when it
has already been removed by mac80211, clear the flag after
adding it in case we add it only for association.
Cc: stable@vger.kernel.org Reviewed-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Randy Dunlap [Mon, 25 Jun 2012 02:17:00 +0000 (19:17 -0700)]
wlcore: drop INET dependency
Mainline build reports:
warning: (WL12XX) selects WLCORE which has unmet direct dependencies (NETDEVICES && WLAN && WL_TI && GENERIC_HARDIRQS && MAC80211 && INET)
The INET dependency was added in commit 3c6af5b54fe74b6e56efadc22927e4055d00e9fc:
wl1271_main.c:(.text+0x271052): undefined reference to `unregister_inetaddr_
notifier'
wl1271_main.c:(.text+0x2714d7): undefined reference to `register_inetaddr_no
tifier'
Driver is doing some filtering based on IP addresses...
but this driver no longer has that code and it builds fine even when
CONFIG_INET is not enabled, so drop that dependency and eliminate the
kconfig warning message.
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Cc: Luciano Coelho <luciano.coelho@nokia.com> Cc: John W. Linville <linville@tuxdriver.com> Acked-by: Luciano Coelho <coelho@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit used the rx key miss indication to detect packets that were
passed from the hardware without being decrypted, however it seems that
this bit is not only undefined in the static WEP case, but also for
dynamically allocated WEP keys. This caused a regression when using
WEP-LEAP.
This patch fixes the regression by keeping track of which key indexes
refer to CCMP keys and only using the key miss indication for those.
Reported-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@openwrt.org> Cc: stable@vger.kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
Dan Rosenberg [Mon, 25 Jun 2012 14:05:27 +0000 (16:05 +0200)]
NFC: Prevent multiple buffer overflows in NCI
Fix multiple remotely-exploitable stack-based buffer overflows due to
the NCI code pulling length fields directly from incoming frames and
copying too much data into statically-sized arrays.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Cc: stable@kernel.org Cc: security@kernel.org Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org> Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org> Cc: Samuel Ortiz <sameo@linux.intel.com> Cc: David S. Miller <davem@davemloft.net> Acked-by: Ilan Elias <ilane@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Johannes Berg [Mon, 25 Jun 2012 12:46:44 +0000 (14:46 +0200)]
mac80211_hwsim: fix smatch/sparse complaints
The code is fine in both cases as-is, but we can
write it slightly differently to fix smatch/sparse
complaints:
* compare the skb pointer (which we use as a cookie)
by casting the skb to unsigned long rather than the
cookie to a pointer (fixes "different address spaces")
* when transmitting, data->channel must be assigned,
don't check it (fixes "dereferenced before check")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Fri, 22 Jun 2012 11:36:25 +0000 (13:36 +0200)]
mac80211: trace debug messages
It can be very useful to have all debug messages
available when debugging, but hard to correlate
between different sources, so add a trace event
for all mac80211 debug messages.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Fri, 22 Jun 2012 09:29:50 +0000 (11:29 +0200)]
mac80211: clean up debugging
There are a few things that make the logging and
debugging in mac80211 less useful than it should
be right now:
* a lot of messages should be pr_info, not pr_debug
* wholesale use of pr_debug makes it require *both*
Kconfig and dynamic configuration
* there are still a lot of ifdefs
* the style is very inconsistent, sometimes the
sdata->name is printed in front
Clean up everything, introducing new macros and
separating out the station MLME debugging into
a new Kconfig symbol.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Thu, 21 Jun 2012 15:10:52 +0000 (18:10 +0300)]
wlcore: prevent recovery in the middle of resume
Take the mutex early in the resume handler and use the locked version of
the IRQ routine. This ensures any recoveries queued will only take place
after resume has fully completed.
Arik Nemtsov [Thu, 21 Jun 2012 15:10:51 +0000 (18:10 +0300)]
wlcore: refactor threaded IRQ routine
Separate the threaded IRQ handling routine into two functions.
The outer function takes the mutex and calls recovery on errors. It also
performs a Tx-path optimization to avoid redundant works.
The inner function is simplified - all calls to recovery are removed and
it assumes the lock is taken. The locked variant will be reused elsewhere.
Arik Nemtsov [Thu, 21 Jun 2012 15:10:49 +0000 (18:10 +0300)]
wlcore: force recovery on resume if suspended without recovering
If an error is detected after mac80211 is already suspended, the recovery
work will not be queued. This will leave the driver in a bad state on
resume.
Detect this in the resume op and re-queue a recovery.
Arik Nemtsov [Thu, 21 Jun 2012 15:10:48 +0000 (18:10 +0300)]
wlcore: don't allow SDIO read/writes after failure
Set a flag and after the first read/write failure is encountered.
This flag will disallow further SDIO read/writes until op_stop() is
executed, which will clear all flags.
This prevents further errors from occurring, since one error usually
indicates that IO operations won't work anymore until the chip is
rebooted. By blocking more calls, we avoid extra timeouts and having
to wait for them to occur.
[Added second paragraph explaining why the change is needed. -- Luca]
Arkady Miasnikov [Mon, 18 Jun 2012 13:21:12 +0000 (16:21 +0300)]
wlcore: access the firmware memory via debugfs
Applications running in the user space needs access to the
memory of the chip. Examples of such access
- read/write global variables
- access to firmware log
- dump memory after firmware panic event
Arbitrary 4-bytes aligned location can be accessed by
read/write file wlcore/mem
[Check return value of wlcore_raw_read/write and wlcore_set_partition
calls as required by the recent IO changes. -- Luca]
Larry Finger [Thu, 21 Jun 2012 18:08:04 +0000 (13:08 -0500)]
rtlwifi: Change debug level for deletion of an entry in CAM
When running in AP mode, the driver reports all deletions from CAM in
a cryptic manner that makes users think it is an error. change so that
the condition is only reported at higher-levels of debugging.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Arend van Spriel [Thu, 21 Jun 2012 13:49:13 +0000 (15:49 +0200)]
brcmsmac: fix NULL pointer crash in brcms_c_regd_init()
In the function brcms_c_regd_init() the channels are validated
against the device capabilities. This is done for both 2.4G and
5G band, but there are devices that are 2.4G only, ie. BCM4313.
For that device this leads to a NULL dereference. This patch adds
a check in brcms_c_regd_init() to fix this.
Issue introduced in wireless-next tree by following commit: cf03c5d brcm80211: smac: inform mac80211 of the X2 regulatory domain
Cc: Seth Forshee <seth.forshee@canonical.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Arend van Spriel [Thu, 21 Jun 2012 09:33:32 +0000 (11:33 +0200)]
brcmfmac: make inclusion of vmalloc.h explicit fixing linux-next build
This patch fixes problem detected in linux-next build for powerpc
allyesconfig. The error message below is no longer observed:
CC drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.o
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c: In function 'brcmf_sdio_dump_console':
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c:3085: error: implicit declaration of function 'vzalloc'
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c:3085: warning: assignment makes pointer from integer without a cast
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c:3113: error: implicit declaration of function 'vfree'
make[2]: *** [drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.o] Error 1
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Thu, 21 Jun 2012 02:58:37 +0000 (19:58 -0700)]
mwifiex: enhance power save for USB and PCIe chipsets
FW will not explicitly notify about host sleep activation to the
host for USB and PCIe chipsets. Hence host should generate Host
Sleep Activated event as soon as Host Sleep parameters are
configured to FW successfully.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Thu, 21 Jun 2012 02:58:36 +0000 (19:58 -0700)]
mwifiex: wake up main thread to handle Tx traffic if scan is delayed/aborted
This is a flaw in recently implemented logic to handle Tx traffic
and scan operation simultaneously. We missed to wakeup main thread
to handle Tx traffic if scan is delayed/aborted.
For some cards (SD8797, for example), firmware will send SLEEP event
if there is no activity for 50msec. While handling the SLEEP event,
main thread will be woken up and Tx packet gets sent hence. In worst
case Tx traffic will be delayed for 50msec.
For other cards, such as USB8797, firmware won't send SLEEP event.
So, Tx traffic gets stuck if no other event triggers the wakeup of
main thread.
This patch fixes above issues.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Thu, 21 Jun 2012 03:21:13 +0000 (20:21 -0700)]
mwifiex: improve error path handling in usb.c
skb allocated during initialisation is reused for receiving
commands/events by USB interface. We miss to reset skb->data in
failure cases. This patch takes care of it.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kiran Divekar <dkiran@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Amitkumar Karwar [Thu, 21 Jun 2012 03:21:12 +0000 (20:21 -0700)]
mwifiex: fix bugs in event handling code
This patch ensures uniformity in event skb sent by interface code
(USB/PCIe/SDIO) which automatically fixes following bugs.
1) For USB interface, same buffer is reused for receiving cmd and
events from firmware. While handling events, we perform
skb_pull(skb, 4) to remove event header. Corresponding skb_push()
call is missing while submitting the buffer.
2) For PCIe interface, event skb is passed with event header.
Recently added uAP events EVENT_UAP_STA_ASSOC, EVENT_UAP_STA_DEAUTH
will not work for PCIe, as they assume event skb points to event body.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kiran Divekar <dkiran@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Stone Piao [Thu, 21 Jun 2012 03:21:11 +0000 (20:21 -0700)]
mwifiex: fix WPS eapol handshake failure
After association, STA will go through eapol handshake with WPS
enabled AP. It's observed that WPS handshake fails with some 11n
AP. The reason for the failure is that the eapol packet is sent
via 11n frame aggregation.
The eapol packet should be sent directly without 11n aggregation.
This patch fixes the problem by adding WPS session control while
dequeuing Tx packets for transmission.
Cc: "3.4.y" <stable@vger.kernel.org> Signed-off-by: Stone Piao <piaoyun@marvell.com> Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Stone Piao [Thu, 21 Jun 2012 03:21:10 +0000 (20:21 -0700)]
mwifiex: fix 11n rx packet drop issue
Currently we check the sequence number of last packet received
against start_win. If a sequence hole is detected, start_win is
updated to next sequence number.
Since the rx sequence number is initialized to 0, a corner case
exists when BA setup happens immediately after association. As
0 is a valid sequence number, start_win gets increased to 1
incorrectly. This causes the first packet with sequence number 0
being dropped.
Initialize rx sequence number as 0xffff and skip adjusting
start_win if the sequence number remains 0xffff. The sequence
number will be updated once the first packet is received.
Cc: "3.0.y, 3.1.y, 3.2.y, 3.3.y, 3.4.y" <stable@vger.kernel.org> Signed-off-by: Stone Piao <piaoyun@marvell.com> Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: Kiran Divekar <dkiran@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Ido Yariv [Tue, 19 Jun 2012 21:03:46 +0000 (00:03 +0300)]
wlcore: Force checking of io functions' return values
All io functions' return values should be propagated and handled. Add a
__must_check annotation to verify that the return values are checked and
to avoid future mistakes.
Ido Yariv [Mon, 18 Jun 2012 15:15:50 +0000 (18:15 +0300)]
wlcore: Propagate errors from wl1271_read_hwaddr
Propagate errors from wl1271_read_hwaddr. This function is only used
when reading the FW log (following a recovery), so don't read the FW log
in case of a bus error.
Also rename prefixes of wlcore functions which their prototypes had to
be changed.
Ido Yariv [Tue, 19 Jun 2012 21:48:23 +0000 (00:48 +0300)]
wlcore: Propagate errors from wl1271_raw_write32
Propagate errors from wl1271_raw_write32 and request for recovery when
appropriate.
Also rename prefixes of wlcore functions which their prototypes had to
be changed.
Ido Yariv [Mon, 18 Jun 2012 12:50:21 +0000 (15:50 +0300)]
wlcore: Propagate errors from wl1271_raw_read32
Propagate errors from wl1271_raw_read32. Since the read functions had no
way of returning errors in-band, change their prototypes.
Also rename prefixes of wlcore functions which their prototypes had to
be changed.
Ido Yariv [Mon, 18 Jun 2012 10:21:55 +0000 (13:21 +0300)]
wlcore: Propagate errors from wl1271_write
Propagate errors from wl1271_write and request for recovery when
appropriate.
Also rename prefixes of wlcore functions which their prototypes had to
be changed.
Ido Yariv [Mon, 18 Jun 2012 09:31:16 +0000 (12:31 +0300)]
wlcore: Propagate errors from wl1271_read
Propagate errors from wl1271_read and request for recovery when
appropriate.
Also rename prefixes of wlcore functions which their prototypes had to
be changed.
Ido Yariv [Sun, 17 Jun 2012 18:59:42 +0000 (21:59 +0300)]
wlcore: Propagate errors from wlcore_raw_*_data functions
wlcore_raw_read_data is called when the FW status is read which happens
while handling interrupts and when the FW log is read following a
recovery. Request a recovery in the former case, and don't read the FW
log in case the FW status read failed.
Ido Yariv [Sun, 17 Jun 2012 18:29:51 +0000 (21:29 +0300)]
wlcore: Change raw io functions to return errors
Make wl1271_raw_write and wl1271_raw_read return errors so the driver
could handle these appropriately.
Since the prototype has changed, also rename the prefix of these
functions to wlcore.
Ido Yariv [Sun, 17 Jun 2012 17:30:05 +0000 (20:30 +0300)]
wlcore: Change read/write ops to return errors
While bus operations may fail, either due to HW or FW issues, these are
never propagated to higher layers. As a result, the core driver has no
way of knowing that the operations failed, and will only recover if high
level logic requires it (e.g. no command completion).
Change read/write bus operations to return errors to let higher layer
functionality handle these.
Ido Yariv [Sun, 20 May 2012 07:38:16 +0000 (10:38 +0300)]
wlcore: Fix sdio out-of-sync power state
wl12xx_sdio_power_off() manually powers down the card regardless of the
runtime pm state. If wl12xx_sdio_power_on() is called before the card
was suspended by runtime PM, it will not power up the card.
As part of the HW detection, the chip's power is toggled. Since this
happens in the context of probing sdio, the power reference counter will
be higher than zero. As a result, when wl12xx_sdio_power_off() is
called, the chip will be powered down while still having a positive
power reference counter. If the interface is quickly activated, the
driver might try to transfer data to a powered off chip.
Fix this by ensuring that wl12xx_sdio_power_on() explicitly powers on
the chip in case runtime pm claims the chip is already powered on. To
avoid cases in which it is not possible to determine if the chip was
really powered on (card's power reference counter is positive), operate
on the mmc_card instead of the function.
Also verify that the chip is indeed powered on before powering off, to
avoid wrong reference counter values in error cases.
Instead of reporting the signal received in the last
rx packet, which might be inaccurate if rx traffic is
low and beacon filtering is enabled, get the signal
from the driver/FW.
Signed-off-by: Victor Goldenshtein <victorg@ti.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
projects / mirror_ubuntu-hirsute-kernel.git / log