[RFC] cfg80211: add control port state to struct cfg80211_connect_resp_params

[Arend van Spriel]

When the driver supports offloading of the PTK/GTK handshakes
completion of that during connect changes the layer 2 control
port state to authorized. This patch allows the driver to pass
that state in cfg80211_connect_done() resulting in adding the
new flag NL80211_ATTR_PORT_AUTHORIZED in the NL80211_CMD_CONNECT
notification.

Signed-off-by: Arend van Spriel 
---
Hi Johannes, Jouni, et al

I have been working on 4-way handshake offloading and one of the
things discussed was the addition of PORT_AUTHORIZED flag. So
this is what I came up with, but I suppose wpa_supplicant wants
to know whether it can expect this attribute or not. One option
is to have PORT_UNAUTHORIZED flag instead. Another option would
be introducing it as nl80211 protocol feature although not sure
if it could be considered as such. What do you guys think?

Regards,
Arend
---
 include/net/cfg80211.h   | 9 +
 include/uapi/linux/nl80211.h | 3 +++
 net/wireless/nl80211.c   | 2 ++
 net/wireless/sme.c   | 1 +
 4 files changed, 15 insertions(+)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index bdc4424..f416d55 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5236,6 +5236,12 @@ static inline void cfg80211_testmode_event(struct 
sk_buff *skb, gfp_t gfp)
 #define CFG80211_TESTMODE_DUMP(cmd)
 #endif
 
+enum cfg80211_control_port_state {
+   CONTROL_PORT_STATE_UNSPECIFIED,
+   CONTROL_PORT_STATE_UNAUTHORIZED,
+   CONTROL_PORT_STATE_AUTHORIZED
+};
+
 /**
  * struct cfg80211_connect_resp_params - Connection response params
  * @status: Status code, %WLAN_STATUS_SUCCESS for successful connection, use
@@ -5271,6 +5277,8 @@ static inline void cfg80211_testmode_event(struct sk_buff 
*skb, gfp_t gfp)
  * not known. This value is used only if @status < 0 to indicate that the
  * failure is due to a timeout and not due to explicit rejection by the AP.
  * This value is ignored in other cases (@status >= 0).
+ * @port_state: Indicates whether the connection is ready to transport
+ * data packets (see  cfg80211_control_port_state).
  */
 struct cfg80211_connect_resp_params {
int status;
@@ -5288,6 +5296,7 @@ struct cfg80211_connect_resp_params {
size_t pmk_len;
const u8 *pmkid;
enum nl80211_timeout_reason timeout_reason;
+   enum cfg80211_control_port_state port_state;
 };
 
 /**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 087493d..34738df 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2106,6 +2106,8 @@ enum nl80211_commands {
  * in %NL80211_CMD_CONNECT to indicate that for 802.1X authentication it
  * wants to use the supported offload.
  * @NL80211_ATTR_PMKR0_NAME: PMK-R0 Name for offloaded FT.
+ * @NL80211_ATTR_PORT_AUTHORIZED: flag attribute used in %NL80211_CMD_CONNECT
+ * notification indicating 4-way handshake offload finished successfully.
  *
  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
  * @NL80211_ATTR_MAX: highest attribute number currently defined
@@ -2531,6 +2533,7 @@ enum nl80211_attrs {
 
NL80211_ATTR_WANT_1X_OFFLOAD,
NL80211_ATTR_PMKR0_NAME,
+   NL80211_ATTR_PORT_AUTHORIZED,
 
/* add attributes here, update the policy in nl80211.c */
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e08c0d3..7fff668 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13745,6 +13745,8 @@ void nl80211_send_connect_result(struct 
cfg80211_registered_device *rdev,
 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
  nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
  cr->timeout_reason))) ||
+   (cr->port_state != CONTROL_PORT_STATE_UNAUTHORIZED &&
+nla_put_flag(msg, NL80211_ATTR_PORT_AUTHORIZED)) ||
(cr->req_ie &&
 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
(cr->resp_ie &&
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 6459bb7..a0d4010 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -860,6 +860,7 @@ void cfg80211_connect_done(struct net_device *dev,
ev->cr.bss = params->bss;
ev->cr.status = params->status;
ev->cr.timeout_reason = params->timeout_reason;
+   ev->cr.port_state = params->port_state;
 
spin_lock_irqsave(>event_lock, flags);
list_add_tail(>list, >event_list);
-- 
1.9.1

Re: [bug report] ath9k-htc:respect usb buffer cacheline alignment in reg in path

[Dan Carpenter]

Oops.  I forgot to put commentary on this one.  See below.

On Fri, Apr 21, 2017 at 11:11:05PM +0300, Dan Carpenter wrote:
> Hello Ming Lei,
> 
> The patch e6c6d33cb7d1: "ath9k-htc:respect usb buffer cacheline
> alignment in reg in path" from Apr 13, 2010, leads to the following
> static checker warning:
> 
>   drivers/net/wireless/ath/ath9k/hif_usb.c:745 ath9k_hif_usb_reg_in_cb()
>   warn: 'skb' was already freed.
> 
> drivers/net/wireless/ath/ath9k/hif_usb.c
>712  if (likely(urb->actual_length != 0)) {
>713  skb_put(skb, urb->actual_length);
>714  
>715  /* Process the command first */
>716  ath9k_htc_rx_msg(hif_dev->htc_handle, skb,
^^^
Pretty sure "skb" gets freed here.


>717   skb->len, USB_REG_IN_PIPE);
>718  
>719  
>720  nskb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC);
>721  if (!nskb) {
>722  dev_err(_dev->udev->dev,
>723  "ath9k_htc: REG_IN memory allocation 
> failure\n");
>724  urb->context = NULL;
>725  return;
>726  }
>727  
>728  usb_fill_int_urb(urb, hif_dev->udev,
>729   usb_rcvintpipe(hif_dev->udev,
>730   USB_REG_IN_PIPE),
>731   nskb->data, MAX_REG_IN_BUF_SIZE,
>732   ath9k_hif_usb_reg_in_cb, nskb, 1);
>733  }
>734  
>735  resubmit:
>736  usb_anchor_urb(urb, _dev->reg_in_submitted);
>737  ret = usb_submit_urb(urb, GFP_ATOMIC);
>738  if (ret) {
>739  usb_unanchor_urb(urb);
>740  goto free;
  ^
Assume we hit this goto.

>741  }
>742  
>743  return;
>744  free:
>745  kfree_skb(skb);
^^^
Double free.

>746  urb->context = NULL;
>747  }
> 

regards,
dan carpenter

Re: [PATCH] iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc()

[Dan Carpenter]

Heh.  I raced this one through to see if I could beat you to the punch.

regards,
dan carpenter

[PATCH] iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc()

[Dan Carpenter]

The > should be >= or we are writing one space beyond the end of the
array.

Fixes: 310181ec34e2 ("iwlwifi: move to TVQM mode")
Signed-off-by: Dan Carpenter 

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c 
b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..295331558108 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -912,7 +912,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
rsp = (void *)hcmd.resp_pkt->data;
qid = le16_to_cpu(rsp->queue_number);
 
-   if (qid > ARRAY_SIZE(trans_pcie->txq)) {
+   if (qid >= ARRAY_SIZE(trans_pcie->txq)) {
WARN_ONCE(1, "queue index %d unsupported", qid);
ret = -EIO;
goto error;

Re: [PATCH 00/14] rtlwifi: btcoex: Second set of changes for rtl8821ae 2ant

[Larry Finger]

On 04/21/2017 01:55 AM, Kalle Valo wrote:

But what should I do with this one:

rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
https://patchwork.kernel.org/patch/9683395/


Please apply that one. It should not conflict due to dropping the others.

Thanks,

Larry

ad-hoc mode max speed on 8812au wifi card

[Belisko Marek]

Hi,

I'm doing small research on mesh with batman-adv module by using
8812au wifi adapters. I can setup 2 nodes mesh network in 2.4 or 5GHz
bands but max speed (tested with iperf) is only ~2.5MBytes. I read
something about limitation of ad-hoc that speed is restricted to
11Mbits even if it's connected in 5GHz channels. I can assume that
this limitation is due some wifi aliance restriction or is there other
reason (like avoid too many transmissions)? Would be possible to
increase ad-hoc mode speed somehow when using 8812au wifi card. Thanks
a lot for replies and hints.

BR,

marek

-- 
as simple and primitive as possible
-
Marek Belisko - OPEN-NANDRA
Freelance Developer

Ruska Nova Ves 219 | Presov, 08005 Slovak Republic
Tel: +421 915 052 184
skype: marekwhite
twitter: #opennandra
web: http://open-nandra.com

[PATCH V3 3/9] cfg80211: add request id parameter to .sched_scan_stop() signature

[Arend van Spriel]

For multiple scheduled scan support the driver needs to know which
scheduled scan request is being stopped. Pass the request id in the
.sched_scan_stop() callback.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 drivers/net/wireless/ath/ath6kl/cfg80211.c|  2 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c   |  6 +++---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c   |  2 +-
 include/net/cfg80211.h| 15 ---
 net/mac80211/cfg.c|  3 ++-
 net/wireless/rdev-ops.h   |  6 +++---
 net/wireless/scan.c   |  2 +-
 net/wireless/trace.h  | 10 +-
 8 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c 
b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 1906412..fd53ffb 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -3352,7 +3352,7 @@ static int ath6kl_cfg80211_sscan_start(struct wiphy 
*wiphy,
 }
 
 static int ath6kl_cfg80211_sscan_stop(struct wiphy *wiphy,
- struct net_device *dev)
+ struct net_device *dev, u64 reqid)
 {
struct ath6kl_vif *vif = netdev_priv(dev);
bool stopped;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index b23c37c..3ca1132 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -3390,7 +3390,7 @@ static int brcmf_start_internal_escan(struct brcmf_if 
*ifp,
 }
 
 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
- struct net_device *ndev)
+ struct net_device *ndev, u64 reqid)
 {
struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
struct brcmf_if *ifp = netdev_priv(ndev);
@@ -3592,7 +3592,7 @@ static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
  cfg->wowl.pre_pmmode);
cfg->wowl.active = false;
if (cfg->wowl.nd_enabled) {
-   brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev);
+   brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 
0);
brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
brcmf_notify_sched_scan_results);
@@ -3676,7 +3676,7 @@ static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
 
/* Stop scheduled scan */
if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
-   brcmf_cfg80211_sched_scan_stop(wiphy, ndev);
+   brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
 
/* end any scanning */
if (test_bit(BRCMF_SCAN_STATUS_BUSY, >scan_status))
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c 
b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index ffb78f6..65783a4 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2718,7 +2718,7 @@ static int mwifiex_set_ibss_params(struct mwifiex_private 
*priv,
  * previous bgscan configuration in the firmware
  */
 static int mwifiex_cfg80211_sched_scan_stop(struct wiphy *wiphy,
-   struct net_device *dev)
+   struct net_device *dev, u64 reqid)
 {
struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 2142800..84e3baa 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2771,12 +2771,12 @@ struct cfg80211_nan_func {
  * @set_cqm_txe_config: Configure connection quality monitor TX error
  * thresholds.
  * @sched_scan_start: Tell the driver to start a scheduled scan.
- * @sched_scan_stop: Tell the driver to stop an ongoing scheduled scan. This
- * call must stop the scheduled scan and be ready for starting a new one
- * before it returns, i.e. @sched_scan_start may be called immediately
- * after that again and should not fail in that case. The driver should
- * not call cfg80211_sched_scan_stopped() for a requested stop (when this
- * method returns 0.)
+ * @sched_scan_stop: Tell the driver to stop an ongoing scheduled scan with
+ * given request id. This call must stop the scheduled scan and be ready
+ * for starting a new one before it returns, 

[PATCH V3 2/9] nl80211: add support for BSSIDs in scheduled scan matchsets

[Arend van Spriel]

This patch allows for the scheduled scan request to specify matchsets
for specific BSSIDs.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 include/net/cfg80211.h   |  6 +-
 include/uapi/linux/nl80211.h |  2 ++
 net/wireless/nl80211.c   | 41 +++--
 3 files changed, 38 insertions(+), 11 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 7721a9b..2142800 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1613,11 +1613,15 @@ static inline void get_random_mask_addr(u8 *buf, const 
u8 *addr, const u8 *mask)
 /**
  * struct cfg80211_match_set - sets of attributes to match
  *
- * @ssid: SSID to be matched; may be zero-length for no match (RSSI only)
+ * @ssid: SSID to be matched; may be zero-length in case of BSSID match
+ * or no match (RSSI only)
+ * @bssid: BSSID to be matched; may be all-zero BSSID in case of SSID match
+ * or no match (RSSI only)
  * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
  */
 struct cfg80211_match_set {
struct cfg80211_ssid ssid;
+   u8 bssid[ETH_ALEN];
s32 rssi_thold;
 };
 
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index f34127d..925eb38 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -3209,6 +3209,7 @@ enum nl80211_reg_rule_attr {
  * BSS-es in the specified band is to be adjusted before doing
  * RSSI-based BSS selection. The attribute value is a packed structure
  * value as specified by  nl80211_bss_select_rssi_adjust.
+ * @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID: BSSID to be used for matching.
  * @NL80211_SCHED_SCAN_MATCH_ATTR_MAX: highest scheduled scan filter
  * attribute number currently defined
  * @__NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST: internal use
@@ -3220,6 +3221,7 @@ enum nl80211_sched_scan_match_attr {
NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
NL80211_SCHED_SCAN_MATCH_ATTR_RELATIVE_RSSI,
NL80211_SCHED_SCAN_MATCH_ATTR_RSSI_ADJUST,
+   NL80211_SCHED_SCAN_MATCH_ATTR_BSSID,
 
/* keep last */
__NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index fe03d42..19cc70a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -497,6 +497,8 @@ enum nl80211_multicast_groups {
 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 .len = IEEE80211_MAX_SSID_LEN 
},
+   [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .type = NLA_BINARY,
+ .len = ETH_ALEN },
[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 };
 
@@ -7056,8 +7058,15 @@ static int nl80211_abort_scan(struct sk_buff *skb, 
struct genl_info *info)
   NULL);
if (err)
return ERR_PTR(err);
+
+   /* SSID and BSSID are mutually exclusive */
+   if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
+   tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
+   return ERR_PTR(-EINVAL);
+
/* add other standalone attributes here */
-   if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
+   if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
+   tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
n_match_sets++;
continue;
}
@@ -7228,7 +7237,7 @@ static int nl80211_abort_scan(struct sk_buff *skb, struct 
genl_info *info)
nla_for_each_nested(attr,
attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
tmp) {
-   struct nlattr *ssid, *rssi;
+   struct nlattr *ssid, *bssid, *rssi;
 
err = nla_parse_nested(tb,
   
NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
@@ -7237,7 +7246,8 @@ static int nl80211_abort_scan(struct sk_buff *skb, struct 
genl_info *info)
if (err)
goto out_free;
ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
-   if (ssid) {
+   bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
+   if (ssid || bssid) {
if (WARN_ON(i >= n_match_sets)) {
/* this indicates a programming error,
   

[PATCH V3 4/9] cfg80211: add request id to cfg80211_sched_scan_*() api

[Arend van Spriel]

Have proper request id filled in the SCHED_SCAN_RESULTS and
SCHED_SCAN_STOPPED notifications toward user-space by having the
driver provide it through the api.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 drivers/net/wireless/ath/ath6kl/cfg80211.c |  2 +-
 drivers/net/wireless/ath/ath6kl/wmi.c  |  2 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c |  4 +--
 drivers/net/wireless/marvell/mwifiex/cfg80211.c|  6 ++---
 drivers/net/wireless/marvell/mwifiex/main.c|  2 +-
 drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c |  2 +-
 drivers/net/wireless/marvell/mwifiex/sta_event.c   |  2 +-
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |  2 +-
 include/net/cfg80211.h | 11 +---
 net/mac80211/pm.c  |  2 +-
 net/mac80211/scan.c|  4 +--
 net/mac80211/util.c|  2 +-
 net/wireless/core.c|  1 -
 net/wireless/core.h|  1 -
 net/wireless/nl80211.c |  2 ++
 net/wireless/scan.c| 30 ++
 net/wireless/trace.h   | 26 ++-
 17 files changed, 59 insertions(+), 42 deletions(-)

diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c 
b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index fd53ffb..decb937 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -169,7 +169,7 @@ static void ath6kl_cfg80211_sscan_disable(struct ath6kl_vif 
*vif)
if (!stopped)
return;
 
-   cfg80211_sched_scan_stopped(ar->wiphy);
+   cfg80211_sched_scan_stopped(ar->wiphy, 0);
 }
 
 static int ath6kl_set_wpa_version(struct ath6kl_vif *vif,
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c 
b/drivers/net/wireless/ath/ath6kl/wmi.c
index 84a6d12..04df853 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1082,7 +1082,7 @@ void ath6kl_wmi_sscan_timer(unsigned long ptr)
 {
struct ath6kl_vif *vif = (struct ath6kl_vif *) ptr;
 
-   cfg80211_sched_scan_results(vif->ar->wiphy);
+   cfg80211_sched_scan_results(vif->ar->wiphy, 0);
 }
 
 static int ath6kl_wmi_bssinfo_event_rx(struct wmi *wmi, u8 *datap, int len,
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 3ca1132..8da9ae0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -762,7 +762,7 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info 
*cfg,
brcmf_dbg(SCAN, "scheduled scan completed\n");
cfg->internal_escan = false;
if (!aborted)
-   cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
+   cfg80211_sched_scan_results(cfg_to_wiphy(cfg), 0);
} else if (scan_request) {
struct cfg80211_scan_info info = {
.aborted = aborted,
@@ -3357,7 +3357,7 @@ static int brcmf_start_internal_escan(struct brcmf_if 
*ifp,
goto free_req;
 
 out_err:
-   cfg80211_sched_scan_stopped(wiphy);
+   cfg80211_sched_scan_stopped(wiphy, 0);
 free_req:
kfree(request);
return err;
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c 
b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 65783a4..9b30ad4 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2053,7 +2053,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
if (!mwifiex_stop_bg_scan(priv))
-   cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
+   cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy, 0);
 
if (mwifiex_deauthenticate(priv, NULL))
return -EFAULT;
@@ -2321,7 +2321,7 @@ static int mwifiex_cfg80211_inform_ibss_bss(struct 
mwifiex_private *priv)
(int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
 
if (!mwifiex_stop_bg_scan(priv))
-   cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
+   cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy, 0);
 
ret = mwifiex_cfg80211_assoc(priv, sme->ssid_len, sme->ssid, sme->bssid,
 priv->bss_mode, sme->channel, sme, 0);
@@ -2530,7 +2530,7 @@ static int mwifiex_set_ibss_params(struct mwifiex_private 
*priv,
priv->scan_block = false;
 
if 

[PATCH V3 0/9] cfg80211: support multiple scheduled scans

[Arend van Spriel]

After the RFC rounds here is multi-scheduled scan submission. What
has been added since the RFC is support for user-space to specify a
BSSID in the matchset (PATCH 3/10). As example this could be used for
roaming algorithm done in user-space. The patches for scheduled scan
notification api have been collapsed into a single patch and rtnl
locking was needed for the cfg80211_sched_scan_results() function.

This series also adds a driver implementation for the new features.
Not surprisingly being brcmfmac.

This series applies to master branch of the mac80211-next
repository. In this version some rework was needed to stop
scheduled scans owned by a specific netlink socket which
is released.
---
 changes:
  V2:
   - patch 5/10 changed to resolve kerneldoc issue.
   - patch 8/10 and 10/10 resolving uninitialized warnings.
  V3:
   - patch 1/9 changed getting rid of rdev->sched_scan_req.
---
Arend van Spriel (9):
  nl80211: allow multiple active scheduled scan requests
  nl80211: add support for BSSIDs in scheduled scan matchsets
  cfg80211: add request id parameter to .sched_scan_stop() signature
  cfg80211: add request id to cfg80211_sched_scan_*() api
  brcmfmac: add firmware feature detection for gscan feature
  brcmfmac: move scheduled scan wiphy param setting to pno module
  brcmfmac: add support multi-scheduled scan
  brcmfmac: add mutex to protect pno requests
  brcmfmac: add scheduled scan support for specified BSSIDs

 drivers/net/wireless/ath/ath6kl/cfg80211.c |   6 +-
 drivers/net/wireless/ath/ath6kl/wmi.c  |   2 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c |  93 +++--
 .../broadcom/brcm80211/brcmfmac/cfg80211.h |   8 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c|   1 +
 .../wireless/broadcom/brcm80211/brcmfmac/debug.h   |   2 +
 .../wireless/broadcom/brcm80211/brcmfmac/feature.c |  22 +-
 .../wireless/broadcom/brcm80211/brcmfmac/feature.h |   4 +-
 .../broadcom/brcm80211/brcmfmac/fwil_types.h   |  76 
 .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 453 ++---
 .../net/wireless/broadcom/brcm80211/brcmfmac/pno.h |  55 ++-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   2 +-
 drivers/net/wireless/marvell/mwifiex/cfg80211.c|  10 +-
 drivers/net/wireless/marvell/mwifiex/main.c|   2 +-
 drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c |   2 +-
 drivers/net/wireless/marvell/mwifiex/sta_event.c   |   2 +-
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |   2 +-
 drivers/net/wireless/ti/wlcore/main.c  |   2 +-
 include/net/cfg80211.h |  39 +-
 include/uapi/linux/nl80211.h   |  14 +-
 net/mac80211/cfg.c |   3 +-
 net/mac80211/pm.c  |   2 +-
 net/mac80211/scan.c|   4 +-
 net/mac80211/util.c|   2 +-
 net/wireless/core.c|  49 ++-
 net/wireless/core.h|  16 +-
 net/wireless/nl80211.c | 120 --
 net/wireless/rdev-ops.h|   8 +-
 net/wireless/scan.c| 133 --
 net/wireless/trace.h   |  54 ++-
 30 files changed, 963 insertions(+), 225 deletions(-)

-- 
1.9.1

[PATCH V3 1/9] nl80211: allow multiple active scheduled scan requests

[Arend van Spriel]

This patch implements the idea to have multiple scheduled scan requests
running concurrently. It mainly illustrates how to deal with the incoming
request from user-space in terms of backward compatibility. In order to
use multiple scheduled scans user-space needs to provide a flag attribute
NL80211_ATTR_SCHED_SCAN_MULTI to indicate support. If not the request is
treated as a legacy scan.

Drivers currently supporting scheduled scan are now indicating they support
a single scheduled scan request. This obsoletes WIPHY_FLAG_SUPPORTS_SCHED_SCAN.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 drivers/net/wireless/ath/ath6kl/cfg80211.c |   2 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   2 +-
 drivers/net/wireless/marvell/mwifiex/cfg80211.c|   2 +-
 drivers/net/wireless/ti/wlcore/main.c  |   2 +-
 include/net/cfg80211.h |   7 +-
 include/uapi/linux/nl80211.h   |  12 ++-
 net/wireless/core.c|  48 ++---
 net/wireless/core.h|  15 ++-
 net/wireless/nl80211.c |  77 ++
 net/wireless/rdev-ops.h|   2 +-
 net/wireless/scan.c| 115 +
 net/wireless/trace.h   |  18 ++--
 13 files changed, 237 insertions(+), 67 deletions(-)

diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c 
b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 0c118b7c..1906412 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -3973,7 +3973,7 @@ int ath6kl_cfg80211_init(struct ath6kl *ar)
WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
 
if (test_bit(ATH6KL_FW_CAPABILITY_SCHED_SCAN_V2, ar->fw_capabilities))
-   ar->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+   ar->wiphy->max_sched_scan_reqs = 1;
 
if (test_bit(ATH6KL_FW_CAPABILITY_INACTIVITY_TIMEOUT,
 ar->fw_capabilities))
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 7efdcd6..b23c37c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6359,11 +6359,11 @@ static int brcmf_setup_ifmodes(struct wiphy *wiphy, 
struct brcmf_if *ifp)
 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
 {
/* scheduled scan settings */
+   wiphy->max_sched_scan_reqs = 1;
wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
wiphy->max_sched_scan_plan_interval = BRCMF_PNO_SCHED_SCAN_MAX_PERIOD;
-   wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c 
b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 841bfdff..b589c66 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -619,7 +619,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
else
hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-   hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+   hw->wiphy->max_sched_scan_reqs = 1;
hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
/* we create the 802.11 header and zero length SSID IE. */
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c 
b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 3a8a08d..ffb78f6 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -4295,7 +4295,6 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter 
*adapter)
wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
WIPHY_FLAG_AP_UAPSD |
-   WIPHY_FLAG_SUPPORTS_SCHED_SCAN |
WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
WIPHY_FLAG_HAS_CHANNEL_SWITCH |
WIPHY_FLAG_PS_ON_BY_DEFAULT;
@@ -4314,6 +4313,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter 
*adapter)
NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
 
+   wiphy->max_sched_scan_reqs = 1;
wiphy->max_sched_scan_ssids = MWIFIEX_MAX_SSID_LIST_LENGTH;

[PATCH V3 6/9] brcmfmac: move scheduled scan wiphy param setting to pno module

[Arend van Spriel]

As pno module is providing scheduled scan functionality have it taking
care of setting related wiphy parameters as well.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c| 18 +-
 .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.h|  2 ++
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 10 ++
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h |  8 
 4 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 8da9ae0..6585411 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6356,16 +6356,6 @@ static int brcmf_setup_ifmodes(struct wiphy *wiphy, 
struct brcmf_if *ifp)
return -ENOMEM;
 }
 
-static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
-{
-   /* scheduled scan settings */
-   wiphy->max_sched_scan_reqs = 1;
-   wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
-   wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
-   wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
-   wiphy->max_sched_scan_plan_interval = BRCMF_PNO_SCHED_SCAN_MAX_PERIOD;
-}
-
 #ifdef CONFIG_PM
 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
@@ -6412,6 +6402,7 @@ static int brcmf_setup_wiphy(struct wiphy *wiphy, struct 
brcmf_if *ifp)
const struct ieee80211_iface_combination *combo;
struct ieee80211_supported_band *band;
u16 max_interfaces = 0;
+   bool gscan;
__le32 bandlist[3];
u32 n_bands;
int err, i;
@@ -6461,9 +6452,10 @@ static int brcmf_setup_wiphy(struct wiphy *wiphy, struct 
brcmf_if *ifp)
wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
wiphy->mgmt_stypes = brcmf_txrx_stypes;
wiphy->max_remain_on_channel_duration = 5000;
-   if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
-   brcmf_wiphy_pno_params(wiphy);
-
+   if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
+   gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
+   brcmf_pno_wiphy_params(wiphy, gscan);
+   }
/* vendor commands/events support */
wiphy->vendor_commands = brcmf_vendor_cmds;
wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
index 8f19d95..a1c2e0a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -24,6 +24,8 @@
 #include "fwil_types.h"
 #include "p2p.h"
 
+#define BRCMF_SCAN_IE_LEN_MAX  2048
+
 #define WL_NUM_SCAN_MAX10
 #define WL_TLV_INFO_MAX1024
 #define WL_BSS_INFO_MAX2048
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
index 6c3bde8..a473445 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
@@ -239,3 +239,13 @@ int brcmf_pno_start_sched_scan(struct brcmf_if *ifp,
return ret;
 }
 
+void brcmf_pno_wiphy_params(struct wiphy *wiphy, bool gscan)
+{
+   /* scheduled scan settings */
+   wiphy->max_sched_scan_reqs = gscan ? 2 : 1;
+   wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
+   wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
+   wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
+   wiphy->max_sched_scan_plan_interval = BRCMF_PNO_SCHED_SCAN_MAX_PERIOD;
+}
+
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
index bae55b2..07ec51f 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
@@ -37,4 +37,12 @@
 int brcmf_pno_start_sched_scan(struct brcmf_if *ifp,
   struct cfg80211_sched_scan_request *req);
 
+/**
+ * brcmf_pno_wiphy_params - fill scheduled scan parameters in wiphy instance.
+ *
+ * @wiphy: wiphy instance to be used.
+ * @gscan: indicates whether the device has support for g-scan feature.
+ */
+void brcmf_pno_wiphy_params(struct wiphy *wiphy, bool gscan);
+
 #endif /* _BRCMF_PNO_H */
-- 
1.9.1

[PATCH V3 9/9] brcmfmac: add scheduled scan support for specified BSSIDs

[Arend van Spriel]

Add support to handle scheduled scan request containing BSSID in
the matchsets. The firmware can send event upon finding BSSIDs and
SSIDs. To get these in one event the bit REPORT_SEPARATELY needed
to be removed from the flags in brcmf_pno_config().

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 .../broadcom/brcm80211/brcmfmac/fwil_types.h   | 11 
 .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 58 --
 2 files changed, 53 insertions(+), 16 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 45aaae8..b857d53 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -806,6 +806,17 @@ struct brcmf_pno_macaddr_le {
 };
 
 /**
+ * struct brcmf_pno_bssid_le - bssid configuration for PNO scan.
+ *
+ * @bssid: BSS network identifier.
+ * @flags: flags for this BSSID.
+ */
+struct brcmf_pno_bssid_le {
+   u8 bssid[ETH_ALEN];
+   __le16 flags;
+};
+
+/**
  * struct brcmf_pktcnt_le - packet counters.
  *
  * @rx_good_pkt: packets (MSDUs & MMPDUs) received from this station
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
index 81e8549..9623157 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
@@ -120,7 +120,6 @@ static int brcmf_pno_config(struct brcmf_if *ifp, u32 
scan_freq,
 
/* set extra pno params */
flags = BIT(BRCMF_PNO_IMMEDIATE_SCAN_BIT) |
-   BIT(BRCMF_PNO_REPORT_SEPARATELY_BIT) |
BIT(BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
pfn_param.repeat = BRCMF_PNO_REPEAT;
pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
@@ -205,6 +204,7 @@ static int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct 
cfg80211_ssid *ssid,
  bool active)
 {
struct brcmf_pno_net_param_le pfn;
+   int err;
 
pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
@@ -215,7 +215,28 @@ static int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct 
cfg80211_ssid *ssid,
pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
pfn.ssid.SSID_len = cpu_to_le32(ssid->ssid_len);
memcpy(pfn.ssid.SSID, ssid->ssid, ssid->ssid_len);
-   return brcmf_fil_iovar_data_set(ifp, "pfn_add", , sizeof(pfn));
+
+   brcmf_dbg(SCAN, "adding ssid=%.32s (active=%d)\n", ssid->ssid, active);
+   err = brcmf_fil_iovar_data_set(ifp, "pfn_add", , sizeof(pfn));
+   if (err < 0)
+   brcmf_err("adding failed: err=%d\n", err);
+   return err;
+}
+
+static int brcmf_pno_add_bssid(struct brcmf_if *ifp, const u8 *bssid)
+{
+   struct brcmf_pno_bssid_le bssid_cfg;
+   int err;
+
+   memcpy(bssid_cfg.bssid, bssid, ETH_ALEN);
+   bssid_cfg.flags = 0;
+
+   brcmf_dbg(SCAN, "adding bssid=%pM\n", bssid);
+   err = brcmf_fil_iovar_data_set(ifp, "pfn_add_bssid", _cfg,
+  sizeof(bssid_cfg));
+   if (err < 0)
+   brcmf_err("adding failed: err=%d\n", err);
+   return err;
 }
 
 static bool brcmf_is_ssid_active(struct cfg80211_ssid *ssid,
@@ -342,29 +363,29 @@ static int brcmf_pno_prep_fwconfig(struct brcmf_pno_info 
*pi,
return err;
 }
 
-static int brcmf_pno_config_ssids(struct brcmf_if *ifp,
- struct brcmf_pno_info *pi)
+static int brcmf_pno_config_networks(struct brcmf_if *ifp,
+struct brcmf_pno_info *pi)
 {
struct cfg80211_sched_scan_request *r;
struct cfg80211_match_set *ms;
bool active;
-   int i, j, err;
+   int i, j, err = 0;
 
for (i = 0; i < pi->n_reqs; i++) {
r = pi->reqs[i];
 
for (j = 0; j < r->n_match_sets; j++) {
ms = >match_sets[j];
-   if (!ms->ssid.ssid_len)
-   continue;
-   active = brcmf_is_ssid_active(>ssid, r);
-   brcmf_dbg(SCAN, "adding %.32s (active=%d)\n",
- ms->ssid.ssid, active);
-   err = brcmf_pno_add_ssid(ifp, >ssid, active);
-   if (err < 0) {
-   brcmf_err("adding failed: err=%d\n", err);
-   return err;
+   if (ms->ssid.ssid_len) {
+   active = brcmf_is_ssid_active(>ssid, r);
+   err = brcmf_pno_add_ssid(ifp, >ssid,
+ 

[PATCH V3 5/9] brcmfmac: add firmware feature detection for gscan feature

[Arend van Spriel]

From: Arend van Spriel 

Detect gscan support in firmware by doing pfn_gscan_cfg iovar with
invalid version.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 22 +++-
 .../wireless/broadcom/brcm80211/brcmfmac/feature.h |  4 +-
 .../broadcom/brcm80211/brcmfmac/fwil_types.h   | 59 ++
 3 files changed, 83 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index 62985f2..8c7ef59 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -27,6 +27,7 @@
 #include "feature.h"
 #include "common.h"
 
+#define BRCMF_FW_UNSUPPORTED   23
 
 /*
  * expand feature list to array of feature strings.
@@ -113,6 +114,22 @@ static void brcmf_feat_iovar_int_get(struct brcmf_if *ifp,
}
 }
 
+static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
+ enum brcmf_feat_id id, char *name,
+ const void *data, size_t len)
+{
+   int err;
+
+   err = brcmf_fil_iovar_data_set(ifp, name, data, len);
+   if (err != -BRCMF_FW_UNSUPPORTED) {
+   brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
+   ifp->drvr->feat_flags |= BIT(id);
+   } else {
+   brcmf_dbg(TRACE, "%s feature check failed: %d\n",
+ brcmf_feat_names[id], err);
+   }
+}
+
 static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
 {
char caps[256];
@@ -136,11 +153,14 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
 {
struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
struct brcmf_pno_macaddr_le pfn_mac;
+   struct brcmf_gscan_config gscan_cfg;
u32 wowl_cap;
s32 err;
 
brcmf_feat_firmware_capabilities(ifp);
-
+   memset(_cfg, 0, sizeof(gscan_cfg));
+   brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN, "pfn_gscan_cfg",
+ _cfg, sizeof(gscan_cfg));
brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
if (drvr->bus_if->wowl_supported)
brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
index db4733a..c1dbd17 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
@@ -31,6 +31,7 @@
  * WOWL_GTK: (WOWL) GTK rekeying offload
  * WOWL_ARP_ND: ARP and Neighbor Discovery offload support during WOWL.
  * MFP: 802.11w Management Frame Protection.
+ * GSCAN: enhanced scan offload feature.
  */
 #define BRCMF_FEAT_LIST \
BRCMF_FEAT_DEF(MBSS) \
@@ -44,7 +45,8 @@
BRCMF_FEAT_DEF(WOWL_ND) \
BRCMF_FEAT_DEF(WOWL_GTK) \
BRCMF_FEAT_DEF(WOWL_ARP_ND) \
-   BRCMF_FEAT_DEF(MFP)
+   BRCMF_FEAT_DEF(MFP) \
+   BRCMF_FEAT_DEF(GSCAN)
 
 /*
  * Quirks:
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 9a1eb5a..8c18fad 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -835,4 +835,63 @@ struct brcmf_gtk_keyinfo_le {
u8 replay_counter[BRCMF_RSN_REPLAY_LEN];
 };
 
+/**
+ * struct brcmf_gscan_bucket_config - configuration data for channel bucket.
+ *
+ * @bucket_end_index: !unknown!
+ * @bucket_freq_multiple: !unknown!
+ * @flag: !unknown!
+ * @reserved: !unknown!
+ * @repeat: !unknown!
+ * @max_freq_multiple: !unknown!
+ */
+struct brcmf_gscan_bucket_config {
+   u8 bucket_end_index;
+   u8 bucket_freq_multiple;
+   u8 flag;
+   u8 reserved;
+   __le16 repeat;
+   __le16 max_freq_multiple;
+};
+
+/* version supported which must match firmware */
+#define BRCMF_GSCAN_CFG_VERSION 1
+
+/**
+ * enum brcmf_gscan_cfg_flags - bit values for gscan flags.
+ *
+ * @BRCMF_GSCAN_CFG_FLAGS_ALL_RESULTS: send probe responses/beacons to host.
+ * @BRCMF_GSCAN_CFG_FLAGS_CHANGE_ONLY: indicated only flags member is changed.
+ */
+enum brcmf_gscan_cfg_flags {
+   BRCMF_GSCAN_CFG_FLAGS_ALL_RESULTS = BIT(0),
+   BRCMF_GSCAN_CFG_FLAGS_CHANGE_ONLY = BIT(7),
+};
+
+/**
+ * struct brcmf_gscan_config - configuration data for gscan.
+ *
+ * @version: version of the api to match firmware.
+ * @flags: flags according %enum brcmf_gscan_cfg_flags.
+ * @buffer_threshold: percentage threshold of buffer to generate an event.
+ * @swc_nbssid_threshold: 

[PATCH V3 7/9] brcmfmac: add support multi-scheduled scan

[Arend van Spriel]

This change adds support for multi-scheduled scan in the driver. It
currently relies on g-scan support in firmware and will set struct
wiphy::max_sched_scan_reqs accordingly. This is limited to 16 concurrent
requests.

The firmware currently has a limit of 64 channels that can be configured
for all requests in total regardless whether there are duplicates. So if
a request uses 35 channels there are 29 channels left for another request.
When user-space does not specify any channels cfg80211 will add all
channels defined by the wiphy instance to the request, which makes
reaching the limit rather easy for dual-band devices.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c |  67 +++-
 .../broadcom/brcm80211/brcmfmac/cfg80211.h |   6 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c|   1 +
 .../wireless/broadcom/brcm80211/brcmfmac/debug.h   |   2 +
 .../broadcom/brcm80211/brcmfmac/fwil_types.h   |  32 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 398 ++---
 .../net/wireless/broadcom/brcm80211/brcmfmac/pno.h |  47 ++-
 7 files changed, 464 insertions(+), 89 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 6585411..151bba1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -719,6 +719,8 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info 
*cfg,
 {
struct brcmf_scan_params_le params_le;
struct cfg80211_scan_request *scan_request;
+   u64 reqid;
+   u32 bucket;
s32 err = 0;
 
brcmf_dbg(SCAN, "Enter\n");
@@ -749,7 +751,7 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info 
*cfg,
err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 _le, sizeof(params_le));
if (err)
-   brcmf_err("Scan abort  failed\n");
+   brcmf_err("Scan abort failed\n");
}
 
brcmf_scan_config_mpc(ifp, 1);
@@ -758,11 +760,21 @@ s32 brcmf_notify_escan_complete(struct 
brcmf_cfg80211_info *cfg,
 * e-scan can be initiated internally
 * which takes precedence.
 */
-   if (cfg->internal_escan) {
-   brcmf_dbg(SCAN, "scheduled scan completed\n");
-   cfg->internal_escan = false;
-   if (!aborted)
-   cfg80211_sched_scan_results(cfg_to_wiphy(cfg), 0);
+   if (cfg->int_escan_map) {
+   brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
+ cfg->int_escan_map);
+   while (cfg->int_escan_map) {
+   bucket = __ffs(cfg->int_escan_map);
+   cfg->int_escan_map &= ~BIT(bucket);
+   reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
+  bucket);
+   if (!aborted) {
+   brcmf_dbg(SCAN, "report results: reqid=%llu\n",
+ reqid);
+   cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
+   reqid);
+   }
+   }
} else if (scan_request) {
struct cfg80211_scan_info info = {
.aborted = aborted,
@@ -1011,7 +1023,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info 
*cfg,
if (!ssid_le.SSID_len)
brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
else
-   brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
+   brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
  i, ssid_le.SSID, ssid_le.SSID_len);
memcpy(ptr, _le, sizeof(ssid_le));
ptr += sizeof(ssid_le);
@@ -3011,7 +3023,7 @@ void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
struct escan_info *escan = >escan_info;
 
set_bit(BRCMF_SCAN_STATUS_ABORT, >scan_status);
-   if (cfg->internal_escan || cfg->scan_request) {
+   if (cfg->int_escan_map || cfg->scan_request) {
escan->escan_state = WL_ESCAN_STATE_IDLE;
brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
}
@@ -3034,7 +3046,7 @@ static void brcmf_escan_timeout(unsigned long data)
struct brcmf_cfg80211_info *cfg =
(struct brcmf_cfg80211_info *)data;
 
-   if (cfg->internal_escan || 

[PATCH V3 8/9] brcmfmac: add mutex to protect pno requests

[Arend van Spriel]

The request references kept in pno are accessed in user-space context
and in firmware event handler context. As such we need to protect it
with a lock. As both context allow sleep a mutex seems appropriate.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
---
 .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 33 --
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
index 5ae0680..81e8549 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
@@ -43,6 +43,7 @@
 struct brcmf_pno_info {
int n_reqs;
struct cfg80211_sched_scan_request *reqs[BRCMF_PNO_MAX_BUCKETS];
+   struct mutex req_lock;
 };
 
 #define ifp_to_pno(_ifp)   ((_ifp)->drvr->config->pno)
@@ -55,13 +56,17 @@ static int brcmf_pno_store_request(struct brcmf_pno_info 
*pi,
return -ENOSPC;
}
brcmf_dbg(SCAN, "reqid=%llu\n", req->reqid);
+   mutex_lock(>req_lock);
pi->reqs[pi->n_reqs++] = req;
+   mutex_unlock(>req_lock);
return 0;
 }
 
 static int brcmf_pno_remove_request(struct brcmf_pno_info *pi, u64 reqid)
 {
-   int i;
+   int i, err = 0;
+
+   mutex_lock(>req_lock);
 
/* find request */
for (i = 0; i < pi->n_reqs; i++) {
@@ -71,7 +76,8 @@ static int brcmf_pno_remove_request(struct brcmf_pno_info 
*pi, u64 reqid)
/* request not found */
if (WARN_ON(i == pi->n_reqs)) {
brcmf_err("reqid not found\n");
-   return -ENOENT;
+   err = -ENOENT;
+   goto done;
}
 
brcmf_dbg(SCAN, "reqid=%llu\n", reqid);
@@ -79,14 +85,17 @@ static int brcmf_pno_remove_request(struct brcmf_pno_info 
*pi, u64 reqid)
 
/* if last we are done */
if (!pi->n_reqs || i == pi->n_reqs)
-   return 0;
+   goto done;
 
/* fill the gap with remaining requests */
while (i <= pi->n_reqs - 1) {
pi->reqs[i] = pi->reqs[i + 1];
i++;
}
-   return 0;
+
+done:
+   mutex_unlock(>req_lock);
+   return err;
 }
 
 static int brcmf_pno_channel_config(struct brcmf_if *ifp,
@@ -489,6 +498,7 @@ int brcmf_pno_attach(struct brcmf_cfg80211_info *cfg)
return -ENOMEM;
 
cfg->pno = pi;
+   mutex_init(>req_lock);
return 0;
 }
 
@@ -501,6 +511,7 @@ void brcmf_pno_detach(struct brcmf_cfg80211_info *cfg)
cfg->pno = NULL;
 
WARN_ON(pi->n_reqs);
+   mutex_destroy(>req_lock);
kfree(pi);
 }
 
@@ -516,11 +527,15 @@ void brcmf_pno_wiphy_params(struct wiphy *wiphy, bool 
gscan)
 
 u64 brcmf_pno_find_reqid_by_bucket(struct brcmf_pno_info *pi, u32 bucket)
 {
-   /* bucket appears to be gone */
-   if (bucket >= pi->n_reqs)
-   return 0;
+   u64 reqid = 0;
+
+   mutex_lock(>req_lock);
+
+   if (bucket < pi->n_reqs)
+   reqid = pi->reqs[bucket]->reqid;
 
-   return pi->reqs[bucket]->reqid;
+   mutex_unlock(>req_lock);
+   return reqid;
 }
 
 u32 brcmf_pno_get_bucket_map(struct brcmf_pno_info *pi,
@@ -531,6 +546,7 @@ u32 brcmf_pno_get_bucket_map(struct brcmf_pno_info *pi,
u32 bucket_map = 0;
int i, j;
 
+   mutex_lock(>req_lock);
for (i = 0; i < pi->n_reqs; i++) {
req = pi->reqs[i];
 
@@ -545,5 +561,6 @@ u32 brcmf_pno_get_bucket_map(struct brcmf_pno_info *pi,
}
}
}
+   mutex_unlock(>req_lock);
return bucket_map;
 }
-- 
1.9.1

Re: [v2,1/3] ath9k: Support channels in licensed bands

[Simon Wunderlich]

Hi,

On Tuesday, April 18, 2017 10:09:59 AM CEST Ben Greear wrote:
> [...]
> > In my personal view, we have quite a few obstacles which I consider
> > "enough", but would be interesting to hear others opinions ...
> > 
> > I'll throw in my 2-cents. This patch is treading on very dangerous ground.
> > I can't speak to other regulatory environments, but at least the FCC is
> > cracking down on even the possibility that anyone can operate a WiFi
> > device outside the regulatory bounds.
> These patches make it slightly easier to use the licensed bands, but no one
> can accidentally use them due to the regdb and other constaints in these
> patches.
> 
> So, I don't think these patches offer any fundamental new vulnerability
> that should concern the FCC.
> 
> After all, someone who really wants to do evil can find and apply the
> patches without undue effort, and it could easily be that those applying
> the patches would then make it even easier to abuse the new channels due to
> laziness or poor coding choices.

I'm with Ben on this one. I also have followed the FCC actions in the past few 
years, and I've also been involved into that [1,2,3]. There are mailing lists 
on the topic if you want to get involved. I agree that the topic is important, 
but I would prefer to not have this patch serving as battleground. :)

The patches proposed here, as Ben says, at least put proper warnings and 
obstacles which users have to knowingly overcome (or read). It's probably 
safer than keeping the driver as is and having people apply random patches 
from the internet which they don't understand or hack the code themselves. 
Frankly, it's not that hard to enable those channels.

As we have seen by the number of questions and people trying to bring this 
patch in (Ben and Julian), there is quite some interest for supporting those 
bands. I've also got a few requests from companies to have it supported 
(Fraunhofer is one of those).

Cheers,
  Simon


[1] https://www.reddit.com/r/wireless/comments/3irr5b/
openwrt_vs_fcc_forced_firmware_lockdown/
[2] http://hackaday.com/2016/02/26/fcc-locks-down-router-firmware/
[3] https://libreplanet.org/wiki/Save_WiFi

signature.asc
Description: This is a digitally signed message part.

Re: [PATCH] iwlwifi: pcie: missing unlock on error path

[Kalle Valo]

Dan Carpenter  writes:

> We should unlock before returning.
>
> Fixes: eda50cde58de ("iwlwifi: pcie: add context information support")
> Signed-off-by: Dan Carpenter 
>
> diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c 
> b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
> index 302310dfef9e..4e84955d55c8 100644
> --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
> +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
> @@ -212,8 +212,10 @@ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
>   goto out;
>   }
>  
> - if (iwl_pcie_ctxt_info_init(trans, fw))
> - return -ENOMEM;
> + if (iwl_pcie_ctxt_info_init(trans, fw)) {
> + ret = -ENOMEM;
> + goto out;
> + }

This was recently fixed:

https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git/commit/?id=97b00d877bb8c2e499b9d0c07b65bd92b4e91ddd

-- 
Kalle Valo

Re: [PATCH] iwlwifi: pcie: missing unlock on error path

[Coelho, Luciano]

Hi Dan

On Fri, 2017-04-21 at 13:39 +0300, Dan Carpenter wrote:
> We should unlock before returning.
> 
> Fixes: eda50cde58de ("iwlwifi: pcie: add context information support")
> Signed-off-by: Dan Carpenter 
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c 
> b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
> index 302310dfef9e..4e84955d55c8 100644
> --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
> +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
> @@ -212,8 +212,10 @@ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
>   goto out;
>   }
>  
> - if (iwl_pcie_ctxt_info_init(trans, fw))
> - return -ENOMEM;
> + if (iwl_pcie_ctxt_info_init(trans, fw)) {
> + ret = -ENOMEM;
> + goto out;
> + }
>  
>   /* re-check RF-Kill state since we may have missed the interrupt */
>   hw_rfkill = iwl_trans_check_hw_rf_kill(trans);

Thanks for your patch! But this has already been fixed by Johannes in
the patch I sent out yesterday[1].

[1] https://www.spinics.net/lists/linux-wireless/msg161582.html

--
Cheers,
Luca.

[PATCH] iwlwifi: pcie: missing unlock on error path

[Dan Carpenter]

We should unlock before returning.

Fixes: eda50cde58de ("iwlwifi: pcie: add context information support")
Signed-off-by: Dan Carpenter 

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c 
b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index 302310dfef9e..4e84955d55c8 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -212,8 +212,10 @@ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
goto out;
}
 
-   if (iwl_pcie_ctxt_info_init(trans, fw))
-   return -ENOMEM;
+   if (iwl_pcie_ctxt_info_init(trans, fw)) {
+   ret = -ENOMEM;
+   goto out;
+   }
 
/* re-check RF-Kill state since we may have missed the interrupt */
hw_rfkill = iwl_trans_check_hw_rf_kill(trans);

Re: [PATCH] brcm80211: brcmfmac: Ensure that incoming skb's are writable

[James Hughes]

On 20 April 2017 at 20:48, Arend van Spriel
 wrote:
> + linux-wireless
>
> On 4/20/2017 1:16 PM, James Hughes wrote:
>>
>> The driver was adding header information to incoming skb
>> without ensuring the head was uncloned and hence writable.
>>
>> skb_cow_head has been used to ensure they are writable, however,
>> this required some changes to error handling to ensure that
>> if skb_cow_head failed it was not ignored.
>>
>> This really needs to be reviewed by someone who is more familiar
>> with this code base to ensure any deallocation of skb's is
>> still correct.
>>
>> Signed-off-by: James Hughes 
>> ---
>>   .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c| 15 --
>>   .../wireless/broadcom/brcm80211/brcmfmac/core.c| 23 +---
>>   .../broadcom/brcm80211/brcmfmac/fwsignal.c | 32
>> +-
>>   .../wireless/broadcom/brcm80211/brcmfmac/sdio.c|  7 -
>>   4 files changed, 51 insertions(+), 26 deletions(-)
>>
>
> [...]
>
>> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>> index 5eaac13..08272e8 100644
>> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
>> @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct
>> sk_buff *skb,
>> int ret;
>> struct brcmf_if *ifp = netdev_priv(ndev);
>> struct brcmf_pub *drvr = ifp->drvr;
>> -   struct ethhdr *eh = (struct ethhdr *)(skb->data);
>> +   struct ethhdr *eh;
>> brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
>>   @@ -212,23 +212,14 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct
>> sk_buff *skb,
>> }
>> /* Make sure there's enough room for any header */
>> -   if (skb_headroom(skb) < drvr->hdrlen) {
>> -   struct sk_buff *skb2;
>> -
>> -   brcmf_dbg(INFO, "%s: insufficient headroom\n",
>> - brcmf_ifname(ifp));
>> -   drvr->bus_if->tx_realloc++;
>> -   skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
>> -   dev_kfree_skb(skb);
>> -   skb = skb2;
>> -   if (skb == NULL) {
>> -   brcmf_err("%s: skb_realloc_headroom failed\n",
>> - brcmf_ifname(ifp));
>> -   ret = -ENOMEM;
>> -   goto done;
>> -   }
>
>
> What you are throwing away here is code that assures there is sufficient
> headroom for protocol and bus layer in the tx path, because that is
> determined by drvr->hdrlen. This is where the skb is handed to the driver so
> if you could leave the functionality above *and* assure it is writeable that
> would be the best solution as there is no need for all the other changes
> down the tx path.

The skb_cow_head function takes the required headroom as a parameter
and will ensure that there is enough space, so I don't think this code
segment is
required or have I misunderstood what you mean here?

Is it safe to rely on the _cow_ being done here and not further down
in the stack?
Or at least checked further down in the stack. Previous comments from
another patch
requested that the _cow_ be done close to the actual addition of the
header. I presume
it is unlikely/impossible that the functions that add header
information  down the stack
will be called without the above being done first?

>
>> +   ret = skb_cow_head(skb, drvr->hdrlen);
>> +   if (ret) {
>
>
> So move the realloc code above here instead of simply freeing the skb.
>
>> +   dev_kfree_skb_any(skb);
>> +   goto done;
>> }
>>   + eh = (struct ethhdr *)(skb->data);
>
>
> Now this is actually a separate fix so I would like a separate patch for it.
>

No problem, but see final paragraph below.


> I have a RPi3 sitting on my desk so how can I replicate the issue. It was
> something about broadcast/multicast traffic when using AP mode and a bridge,
> right?
>
> Regards,
> Arend

See this issue for details on replication.
https://github.com/raspberrypi/firmware/issues/673

The bridge I use is setup using a similar procedure to that described
here.  
https://www.raspberrypi.org/documentation/configuration/wireless/access-point.md

I'm happy to pass over this work to you guys if you think it is
appropriate, you are the
experts on the codebase.

pull-request: wireless-drivers-next 2017-04-21

[Kalle Valo]

Hi Dave,

here's most likely the last pull request to net-next for 4.12, unless
Linus delayes the start of merge window. More info in the signed tag
below and please let me know if there are any problems.

Kalle

The following changes since commit d92be7a41ef15463eb816a4a2d42bf094b56dfce:

  net: make struct net_device::min_header_len 8-bit (2017-04-12 13:59:21 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git 
tags/wireless-drivers-next-for-davem-2017-04-21

for you to fetch changes up to a0597834dc0e1af68f48f92b31617b360a14dfc8:

  rt2800: fix mt7620 E2 channel registers (2017-04-20 14:00:54 +0300)


wireless-drivers-next patches for 4.12

Quite a lot of patches for rtlwifi and iwlwifi this time, but changes
also for other active wireless drivers.

Major changes:

ath9k

* add support for Dell Wireless 1601 PCI device

* add debugfs file to manually override noise floor

ath10k

* bump up FW API to 6 for a new QCA6174 firmware branch

wil6210

* support 8 kB RX buffers

iwlwifi

* work to support A000 devices continues

* add support for FW API 30

* add Geographical and Dynamic Specific Absorption Rate (SAR) support

* support a few new PCI device IDs

rtlwifi

* work on adding Bluetooth coexistance support, not finished yet


Arend Van Spriel (7):
  brcmfmac: rename brcmf_fws_{de,}init to brcmf_fws{at,de}tach
  brcmfmac: ignore interfaces when fwsignal is disabled
  brcmfmac: remove reference to fwsignal data from struct brcmf_pub
  brcmfmac: add length checks in scheduled scan result handler
  brcmfmac: remove bogus check in scheduled scan result handler
  brcmfmac: only add channels and ssids once in scan request
  brcmfmac: only build fwsignal module for CONFIG_BRCMFMAC_PROTO_BCDC

Brian Norris (6):
  mwifiex: MAC randomization should not be persistent
  mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
  mwifiex: reset timeout flag when resetting device
  mwifiex: pcie: clear outstanding work when resetting
  mwifiex: don't leak 'chan_stats' on reset
  MAINTAINERS: update Amitkumar's email address

Damien Thébault (1):
  ath9k: Add Dell Wireless 1601 with wowlan capability

Dan Carpenter (1):
  ath9k: off by one in ath9k_hw_nvram_read_array()

Daniel Golle (3):
  rt2x00: reverse external PA capability flag logic
  rt2800: fix LNA gain assignment for MT7620
  rt2800: do VCO calibration after programming ALC

David Spinadel (1):
  iwlwifi: mvm: change TX_CMD_SEC_KEY_FROM_TABLE value

Dedy Lansky (3):
  wil6210: align to latest auto generated wmi.h
  wil6210: fix memory access violation in wil_memcpy_from/toio_32
  wil6210: fix array out of bounds access in pmc

Emmanuel Grumbach (5):
  iwlwifi: mvm: add DQA_ENABLE_CMD to the command list
  iwlwifi: pcie: print less data upon firmware crash
  iwlwifi: mvm: tell the firmware about the U-APSD parameters
  iwlwifi: mvm: provide the actual number of frames for the SP len
  iwlwifi: split the handler and the wake parts of the notification infra

Ganapathi Bhat (1):
  mwifiex: Fix invalid port issue

Golan Ben-Ami (1):
  iwlwifi: mvm: support MFUART dump in case of MFUART assert

Goodstein, Mordechay (1):
  iwlwifi: mvm: move new API code to the end

Haim Dreyfuss (2):
  iwlwifi: mvm: refactor SAR init to prepare for dynamic SAR
  iwlwifi: mvm: add GEO_TX_POWER_LIMIT cmd for geographic tx power table

Hamad Kadmany (3):
  wil6210: fix sequence for scan-abort during reset
  wil6210: fix protection against connections during reset
  wil6210: fix check for sparrow D0 FW file

Heiner Kallweit (1):
  brcmfmac: properly align buffers on certain platforms with 64 bit DMA

Joe Perches (1):
  ath6kl: add __printf verification to ath6kl_dbg

Johan Hovold (1):
  ath9k_htc: fix NULL-deref at probe

Johannes Berg (5):
  iwlwifi: mvm: fix RX SKB header size and align it properly
  iwlwifi: use upper_32_bits/lower_32_bits where appropriate
  iwlwifi: pcie: use iwl_get_dma_hi_addr()
  iwlwifi: pcie: fix mutex leak in gen2 start
  iwlwifi: pcie: free context info in case of failures

Kalle Valo (3):
  Merge tag 'iwlwifi-next-for-kalle-2017-04-13' of 
git://git.kernel.org/.../iwlwifi/iwlwifi-next
  Merge tag 'iwlwifi-next-for-kalle-2017-04-19-2' of 
git://git.kernel.org/.../iwlwifi/iwlwifi-next
  Merge ath-next from git://git.kernel.org/.../kvalo/ath.git

Lazar Alexei (1):
  wil6210: restore power save state after internal FW reset

Liad Kaufman (3):
  iwlwifi: add support for 9000 HW B-step NICs
  iwlwifi: mvm: remove unneeded reg write in iwl_mvm_up()
  iwlwifi: a000: fix memory offsets and lengths

Lior David (1):
  wil6210: support 8KB RX buffers

Luca Coelho 

pull-request mwifiex-firmware 2017-04-21

[Ganapathi Bhat]

The following changes since commit 5e523f5cd672d8fae7cdbb147d0b1fb31119414d:

  linux-firmware: update Marvell SD8887 firmware image (2017-04-19 20:20:13 
-0700)

are available in the git repository at:

  git://git.marvell.com/mwifiex-firmware.git

for you to fetch changes up to c2ff512b4939b2140ed62cc3f60b1a93110764bc:

  linux-firmware: update Marvell SD8897-B0 firmware image (2017-04-21 13:04:39 
+0530)


Ganapathi Bhat (1):
  linux-firmware: update Marvell SD8897-B0 firmware image

 WHENCE |   2 +-
 mrvl/sd8897_uapsta.bin | Bin 800344 -> 814048 bytes
 2 files changed, 1 insertion(+), 1 deletion(-)

Re: [PATCH 00/14] rtlwifi: btcoex: Second set of changes for rtl8821ae 2ant

[Kalle Valo]

Larry Finger  writes:

> On 04/19/2017 11:59 PM, Kalle Valo wrote:
>> Larry Finger  writes:
>>
>>> These patches are the second set of patches for file
>>> btcoexist/halbtc8821a2ant.c.
>>>
>>> Signed-off-by: Yan-Hsuan Chuang 
>>> Signed-off-by: Larry Finger 
>>> Cc: Pkshih 
>>> Cc: Birming Chiu 
>>> Cc: Shaofu 
>>> Cc: Steven Ting 
>>
>> BTW, please try to limit the amount of patches you send. I haven't
>> counted how many rtlwifi patches there are from the last week but it's
>> just too much, even if they are in smaller sets like this one. Reviewing
>> them is just too tedious when you see that you have something like 50
>> more still to go.
>>
>> If you send two sets with reasonable size[1] per week I don't have any
>> problems. But if you send five such sets per week I will get annoyed :)
>> So try to strect the submission a bit to stay below ~30 patches per week
>> limit, please.
>>
>> So I'm not sure if I'm able to apply all of pending rtlwifi patches
>> before the merge window opens, but I'll try.
>>
>> [1] a reasonable size is around a dozen patches per set
>
> Kalle,
>
> Sorry about the heavy load. I received the patches from Realtek late
> in the 4.12 cycle, and I was trying to make the deadline.

Yeah, I guessed it was something like that.

> Please drop the following sets of patches:
>
> [PATCH 00/10] rtlwifi: btcoex: Third set of changes for rtl8821ae 2ant
> [PATCH 00/13] rtlwifi: btcoex: Second set of 21a 1ant changes
> [PATCH 00/27] rtlwifi: btcoex: Changes for 23b 1ant
> [PATCH 0/2] rtlwifi: btcoex: Two more patches

Ok, I dropped these now from patchwork.

But what should I do with this one:

rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
https://patchwork.kernel.org/patch/9683395/

> I believe that is all of the sets that have not yet been merged.

Correct, they were in deferred state as I didn't have time to review
them earlier this week.

> We will fix the issue of the conditionals that you asked about in a
> second E-mail. That is the one that my Chinese Colleagues ask about in
> Chinese.
>
> These will be resubmitted for the 4.13 cycle in smaller sets and no
> more than two sets per week.

That sounds good, thanks! And if we get lucky and Linus doesn't open the
merge window on Sunday we will have one more week to get the patches
applied to 4.12.

-- 
Kalle Valo

Re: [01/27] rtlwifi: btcoex: Restore 23b 1ant routine for tdma adjustment

[Kalle Valo]

Larry Finger  wrote:
> Routine btc8723b1ant_tdma_dur_adj_for_acl() was removed in a set of
> Sparse fixes; however, this routine will be needed later.
> 
> Signed-off-by: Larry Finger 
> Cc: Yan-Hsuan Chuang 
> Cc: Pkshih 
> Cc: Birming Chiu 
> Cc: Shaofu 
> Cc: Steven Ting 

Requested by Larry

27 patches set to Changes Requested.

9683321 [01/27] rtlwifi: btcoex: Restore 23b 1ant routine for tdma adjustment
9683323 [02/27] rtlwifi: btcoex: 23b 1ant: rename and coding style modification.
9683325 [03/27] rtlwifi: btcoex: 23b 1ant: TDMA duration for ACL busy
968 [04/27] rtlwifi: btcoex: 23b 1ant: monitor wifi and BT counter
9683329 [05/27] rtlwifi: btcoex: 23b 1ant: check if BT high priority packet 
exist
9683327 [06/27] rtlwifi: btcoex: 23b 1ant: monitor bt is enabled or disabled
9683331 [07/27] rtlwifi: btcoex: 23b 1ant: check PS state before setting tdma 
duration
9683373 [08/27] rtlwifi: btcoex: 23b 1ant: Switch antenna to wifi or BT.
9683371 [09/27] rtlwifi: btcoex: 23b 1ant: need these information when scan
9683345 [10/27] rtlwifi: btcoex: 23b 1ant: adjust wifi duration for bt a2dp
9683361 [11/27] rtlwifi: btcoex: 23b 1ant: add wifi_only argument to 
init_hwconfig
9683343 [12/27] rtlwifi: btcoex: 23b 1ant: Add power_on_setting
9683335 [13/27] rtlwifi: btcoex: 23b 1ant: parse more BT information from C2H
9683337 [14/27] rtlwifi: btcoex: 23b 1ant: Setup register for BT WHCK test
9683341 [15/27] rtlwifi: btcoex: 23b 1ant: Add rf status notification
9683339 [16/27] rtlwifi: btcoex: 23b 1ant: fine tune connect notify
9683369 [17/27] rtlwifi: btcoex: 23b 1ant: Revise media status notify to fix no 
scan result issue
9683347 [18/27] rtlwifi: btcoex: 23b 1ant: Special packets statistic in 
notification
9683349 [19/27] rtlwifi: btcoex: 23b 1ant: define wifi in high priority task.
9683351 [20/27] rtlwifi: btcoex: 23b 1ant: check more cases when bt is queing
9683367 [21/27] rtlwifi: btcoex: 23b 1ant: remove verbose log from periodic 
function
9683353 [22/27] rtlwifi: btcoex: 23b 1ant: Add coex_table_type to log
9683365 [23/27] rtlwifi: btcoex: 23b 1ant: coex table fine tune
9683355 [24/27] rtlwifi: btcoex: 23b 1ant: fine tune for wifi connected
9683357 [25/27] rtlwifi: btcoex: 23b 1ant: fine tune for wifi not connected
9683359 [26/27] rtlwifi: btcoex: 23b 1ant: fine tune for bt_sco_hid busy
9683363 [27/27] rtlwifi: btcoex: 23b 1ant: turn off ps and tdma mechanism when 
concurrent mode

-- 
https://patchwork.kernel.org/patch/9683321/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [01/13] rtlwifi: btcoex: 21a 1ant: set tdma and coex table when wifi is idle

[Kalle Valo]

Larry Finger  wrote:
> From: Yan-Hsuan Chuang 
> 
> When wifi is idle, bt could have more resources to transmit, so set the
> tdma and coex table to achieve this.
> 
> Signed-off-by: Yan-Hsuan Chuang 
> Signed-off-by: Larry Finger 
> Cc: Pkshih 
> Cc: Birming Chiu 
> Cc: Shaofu 
> Cc: Steven Ting 

Requested by Larry

13 patches set to Changes Requested.

9683295 [01/13] rtlwifi: btcoex: 21a 1ant: set tdma and coex table when wifi is 
idle
9683307 [02/13] rtlwifi: btcoex: 21a 1ant: more bt profiling when wifi receives 
special packet
9683297 [03/13] rtlwifi: btcoex: 21a 1ant: shorten wifi slot when connected scan
9683299 [04/13] rtlwifi: btcoex: 21a 1ant: react to special packet when wifi is 
not scanning
9683301 [05/13] rtlwifi: btcoex: 21a 1ant: coex table and tdma settings for 
softap mode
9683319 [06/13] rtlwifi: btcoex: 21a 1ant: wifi slot time adjustment
9683303 [07/13] rtlwifi: btcoex: 21a 1ant: normal mode for retry limit when 
connected
9683305 [08/13] rtlwifi: btcoex: 21a 1ant: mark packet high priority when 
scanning
9683315 [09/13] rtlwifi: btcoex: 21a 1ant: use default value when initiating 
coex
9683317 [10/13] rtlwifi: btcoex: 21a 1ant: re-init coex after wifi leaves IPS
9683311 [11/13] rtlwifi: btcoex: 21a 1ant: treat ARP as special packet
9683309 [12/13] rtlwifi: btcoex: 21a 1ant: fix some coding style issues
9683313 [13/13] rtlwifi: btcoex: 21a 1ant: add bt_tx_rx_mask into bt info

-- 
https://patchwork.kernel.org/patch/9683295/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [01/10] rtlwifi: btcoex: 21a 2ant: set tdma with rssi states

[Kalle Valo]

Larry Finger  wrote:
> From: Yan-Hsuan Chuang 
> 
> if bt rssi is high, adjust the duration of wifi to a longer period to
> let the wifi transmit under this bt profiling.
> 
> Signed-off-by: Yan-Hsuan Chuang 
> Signed-off-by: Larry Finger 
> Cc: Pkshih 
> Cc: Birming Chiu 
> Cc: Shaofu 
> Cc: Steven Ting 

Requested by Larry

10 patches set to Changes Requested.

9683075 [01/10] rtlwifi: btcoex: 21a 2ant: set tdma with rssi states
9683077 [02/10] rtlwifi: btcoex: 21a 2ant: refine btc8821a2ant_action_hid_a2dp
9683079 [03/10] rtlwifi: btcoex: 21a 2ant: set wifi standby when halting of 
entering ips
9683081 [04/10] rtlwifi: btcoex: 21a 2ant: settings before wifi firmware is 
ready
9683083 [05/10] rtlwifi: btcoex: 21a 2ant: add pnp notidy to avoid LPS/IPS 
mismatch
9683087 [06/10] rtlwifi: btcoex: 21a 2ant: run mechanism if status changes or 
auto adjust is set
9683085 [07/10] rtlwifi: btcoex: 21a 2ant: init wlan when leave ips
9683089 [08/10] rtlwifi: btcoex: 21a 2ant: refine bt info notify to have more 
profilings
9683093 [09/10] rtlwifi: btcoex: 21a 2ant: fix PTA unstable problem when hw init
9683091 [10/10] rtlwifi: btcoex: 21a 2ant: remove unused antenna detection 
variables

-- 
https://patchwork.kernel.org/patch/9683075/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches