The SSID length as received from firmware should not exceed
IEEE80211_MAX_SSID_LEN as that would result in heap overflow.
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

If a macro is in CamelCase, it it converted to upper case. Variables
and routine names are converted to lower case.

The following checkpatch exceptions are also fixed:

WARNING: line over 80 characters
#316: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c:1751:
+       SET_8821AE_H2CCMD_AOAC_RSVDPAGE_LOC_GTK_EXT_MEM(u1rsvdpageloc2, GTKEXT_PG);

CHECK: spaces preferred around that '+' (ctx:VxV)
#357: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c:2591:
+                (eeaddr+1), hwinfo[eeaddr+1]);
                        ^

CHECK: spaces preferred around that '+' (ctx:VxV)
#357: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c:2591:
+                (eeaddr+1), hwinfo[eeaddr+1]);
                                          ^

CHECK: spaces preferred around that '+' (ctx:VxV)
#358: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c:2592:
+       if (0xFF == hwinfo[eeaddr+1])  /*YJ,add,120316*/
                                 ^

WARNING: Comparisons should place the constant on the right side of the test
#358: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c:2592:
+       if (0xFF == hwinfo[eeaddr+1])  /*YJ,add,120316*/

CHECK: spaces preferred around that '&' (ctx:VxV)
#501: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c:2666:
+                               pwrinfo24g->bw40_diff[rfpath][txcount] = (hwinfo[eeaddr]&0xf0) >> 4;
                                                                                        ^
Note that not all checkpatch exceptions are addressed. Those will be
handled in later patches.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

If a macro is in CamelCase, it it converted to upper case. Variables
and routine names are converted to lower case.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

If a macro is in CamelCase, it it converted to upper case. Variables
and routine names are converted to lower case.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

If a macro is in CamelCase, it it converted to upper case. Variables
and routine names are converted to lower case.

The following checkpatch exceptions are also fixed:

CHECK: No space is necessary after a cast
#211: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c:109:
+                                             (u8 *) (&rfstate));

CHECK: No space is necessary after a cast
#241: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c:277:
+                               ptmp_byte = (u8 *) (&regtoset) + index;

Note that not all checkpatch exceptions are addressed. Those will be
handled in later patches.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

This patch affects modules rtl8192ce, rtl8192cu, and rtl8192com.

The following checkpatch exceptions are also fixed:

CHECK: No space is necessary after a cast
#237: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192ce/hw.c:90:
+                                                     (u8 *) (&rfstate));

CHECK: No space is necessary after a cast
#744: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rf.c:329:
+                       pwr_val[i] = (u8) ((writeval & (0x7f <<

CHECK: No space is necessary after a cast
#784: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rf.c:365:
+                                              (u8) writeval);

CHECK: spaces preferred around that '/' (ctx:VxV)
#963: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c:513:
+               txqpageunit = txqpagenum/outepnum;
                                        ^

CHECK: Unnecessary parentheses around 'outepnum > 1'
#975: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c:521:
+               if ((outepnum > 1) && (txqremaininpage))

CHECK: Alignment should match open parenthesis
#1059: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c:617:
+static void _rtl92cu_init_chipn_two_out_ep_priority(struct ieee80211_hw *hw,
                                                                bool wmm_enable,

ERROR: "foo * bar" should be "foo *bar"
#1940: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:591:
+void rtl92cu_fill_fake_txdesc(struct ieee80211_hw *hw, u8 *pdesc,

Note that not all checkpatch exceptions are addressed. Those will be
handled in later patches.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

This driver contains one instance of a CamelCase variable, namely
IS_81xxC_VENDOR_UMC_A_CUT. This macro is never used, thus it is deleted.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

File halbt_precomp.h contains the only CamelCase value, namely
GetDefaultAdapter, but that macro is never used, thus it is deleted.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

There are a number of CamelCase variables remaining in the source
files of modules rtl_pci, rtl_usb, and rtlwifi.

The following checkpatch excettions are also fixed:

for_kalle1/0001-rtlwifi-Remove-CamelCase-variables-from-base-code.patch
-----------------------------------------------------------------------
CHECK: Unnecessary parentheses around 'rtlefuse->efuse_map[EFUSE_INIT_MAP][base + i] !=
                             rtlefuse->efuse_map[EFUSE_MODIFY_MAP][base + i]'
#68: FILE: drivers/net/wireless/realtek/rtlwifi/efuse.c:377:
+                       if ((rtlefuse->efuse_map[EFUSE_INIT_MAP][base + i] !=
+                            rtlefuse->efuse_map[EFUSE_MODIFY_MAP][base + i]) ||
+                           (rtlefuse->efuse_map[EFUSE_INIT_MAP][base + i + 1] !=
+                            rtlefuse->efuse_map[EFUSE_MODIFY_MAP][base + i +
                                                                   1])) {

CHECK: Unnecessary parentheses around 'rtlefuse->efuse_map[EFUSE_INIT_MAP][base + i + 1] !=
                             rtlefuse->efuse_map[EFUSE_MODIFY_MAP][base + i +
                                                                   1]'
#68: FILE: drivers/net/wireless/realtek/rtlwifi/efuse.c:377:
+                       if ((rtlefuse->efuse_map[EFUSE_INIT_MAP][base + i] !=
+                            rtlefuse->efuse_map[EFUSE_MODIFY_MAP][base + i]) ||
+                           (rtlefuse->efuse_map[EFUSE_INIT_MAP][base + i + 1] !=
+                            rtlefuse->efuse_map[EFUSE_MODIFY_MAP][base + i +
                                                                   1])) {

WARNING: line over 80 characters
#70: FILE: drivers/net/wireless/realtek/rtlwifi/efuse.c:379:
+                           (rtlefuse->efuse_map[EFUSE_INIT_MAP][base + i + 1] !=

CHECK: No space is necessary after a cast
#186: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.c:396:
+       status->rx_is40mhzpacket = (bool) GET_RX_DESC_BW(pdesc);

CHECK: No space is necessary after a cast
#208: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192ce/trx.c:335:
+       stats->rx_is40mhzpacket = (bool) GET_RX_DESC_BW(pdesc);

CHECK: No space is necessary after a cast
#243: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:301:
+       stats->rx_is40mhzpacket = (bool) GET_RX_DESC_BW(pdesc);

CHECK: No space is necessary after a cast
#252: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:368:
+       stats.rx_is40mhzpacket = (bool) GET_RX_DESC_BW(rxdesc);

CHECK: No space is necessary after a cast
#265: FILE: drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c:475:
+       stats->rx_is40mhzpacket = (bool) GET_RX_DESC_BW(pdesc);

WARNING: Unnecessary space before function pointer arguments
#455: FILE: drivers/net/wireless/realtek/rtlwifi/wifi.h:1462:
+       void (*writen_sync) (struct rtl_priv *rtlpriv, u32 addr, void *buf,

WARNING: Unnecessary space before function pointer arguments
#483: FILE: drivers/net/wireless/realtek/rtlwifi/wifi.h:2257:
+       void (*fill_fake_txdesc) (struct ieee80211_hw *hw, u8 *pdesc,

Note that not all checkpatch exceptions are addressed. Those will be
handled in later patches.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The old-style license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The traditional license information is replaced by the SPDX form. There
are no code changes.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

mt76 patches for 5.1

* beacon support for USB devices (mesh+ad-hoc only)
* mt76x0 tx power fixes
* fixes for encryption, calibration and ED/CCA
* more code unification
* USB fixes
* fix for using the correct hweight8 function

There is no need to use a for loop here, supported chips can only support
up to 2 chains.
Signed-off-by: Felix Fietkau <nbd@nbd.name>

It needs to be unset instead of set

Fixes: 23405236 ("mt76: fix transmission of encrypted management frames")
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Since ccmp_pn is u8 *, the second half needs to start at array index 4
instead of 0. Fixes a connection stall after a certain amount of traffic

Fixes: 23405236 ("mt76: fix transmission of encrypted management frames")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Remove bogus check for MT_PACKET_ID_NO_ACK in mt76_tx_status_skb_get, which
is already handled in callers and turns timeout calls into no-ops
Do not clean up pending status items on reordering of tx status information
if the timeout is not reached yet
Signed-off-by: Felix Fietkau <nbd@nbd.name>

mt76_init_stream_cap() and mt76_get_txpower() call __sw_hweight8()
directly, but that's only defined if CONFIG_GENERIC_HWEIGHT is
enabled.  The function that works on all architectures is hweight8().

Fixes: 551e1ef4 ("mt76: add mt76_init_stream_cap routine")
Fixes: 9313faac ("mt76: move mt76x02_get_txpower to mt76 core")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

In mt76x02u_skb_dma_info() pad is always non-zero. Patch removes
bogus check and add comments to the function.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

During device removal the driver can report multiple error messages.
Use dev_err_ratelimited instead of dev_err to display urb errors
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Add disable_usb_sg module parameter to disable scatter-gather on demand
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Use linear fragment and not a single usb scatter-gather buffer in mt76u
{tx,rx} datapath if the usb controller has sg data length constraints
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Do not use scatter-gather buffers for mcu commands.
Introduce mt76u_buf_alloc and mt76u_buf_alloc_sg routines.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Move mt76u_check_sg routine in usb.c and introduce sg_en variable
in mt76_usb in order to check if scatter-gather is supported by
mt76u layer
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Do not call mt76u_queues_deinit routine in mt76u_alloc_queues error path
since it will be run in mt76x0u_register_device or
mt76x2u_register_device error path. Current implementation triggers the
following kernel warning:

[   67.005516] WARNING: CPU: 2 PID: 761 at lib/refcount.c:187 refcount_sub_and_test_checked+0xa4/0xb8
[   67.019513] refcount_t: underflow; use-after-free.
[   67.099872] Hardware name: BCM2835
[   67.106268] Backtrace:
[   67.111584] [<8010c91c>] (dump_backtrace) from [<8010cc00>] (show_stack+0x20/0x24)
[   67.124974]  r6:60000013 r5:ffffffff r4:00000000 r3:a50bade6
[   67.132226] [<8010cbe0>] (show_stack) from [<807ca5f4>] (dump_stack+0xc8/0x114)
[   67.141225] [<807ca52c>] (dump_stack) from [<8011e65c>] (__warn+0xf4/0x120)
[   67.149849]  r9:000000bb r8:804d0138 r7:00000009 r6:8099dc84 r5:00000000 r4:b66c7b58
[   67.160767] [<8011e568>] (__warn) from [<8011e6d0>] (warn_slowpath_fmt+0x48/0x50)
[   67.171436]  r9:7f65e128 r8:80d1419c r7:80c0bac4 r6:b97b3044 r5:b7368e00 r4:00000000
[   67.182433] [<8011e68c>] (warn_slowpath_fmt) from [<804d0138>] (refcount_sub_and_test_checked+0xa4/0xb8)
[   67.195221]  r3:80c91c25 r2:8099dc94
[   67.200370]  r4:00000000
[   67.204397] [<804d0094>] (refcount_sub_and_test_checked) from [<804d0164>] (refcount_dec_and_test_checked+0x18/0x1c)
[   67.218046]  r4:b7368e00 r3:00000001
[   67.223125] [<804d014c>] (refcount_dec_and_test_checked) from [<805db49c>] (usb_free_urb+0x20/0x4c)
[   67.235358] [<805db47c>] (usb_free_urb) from [<7f639804>] (mt76u_buf_free+0x98/0xac [mt76_usb])
[   67.247302]  r4:00000001 r3:00000001
[   67.252468] [<7f63976c>] (mt76u_buf_free [mt76_usb]) from [<7f639ef8>] (mt76u_queues_deinit+0x44/0x100 [mt76_usb])
[   67.266102]  r8:b8fe8600 r7:b5dac480 r6:b5dace20 r5:00000001 r4:00000000 r3:00000080
[   67.277132] [<7f639eb4>] (mt76u_queues_deinit [mt76_usb]) from [<7f65c040>] (mt76x0u_cleanup+0x40/0x4c [mt76x0u])
[   67.290737]  r7:b5dac480 r6:b8fe8600 r5:ffffffea r4:b5dace20
[   67.298069] [<7f65c000>] (mt76x0u_cleanup [mt76x0u]) from [<7f65c564>] (mt76x0u_probe+0x1f0/0x354 [mt76x0u])
[   67.311174]  r4:b5dace20 r3:00000000
[   67.316312] [<7f65c374>] (mt76x0u_probe [mt76x0u]) from [<805e0b6c>] (usb_probe_interface+0x104/0x240)
[   67.328915]  r7:00000000 r6:7f65e034 r5:b6634800 r4:b8fe8620
[   67.336276] [<805e0a68>] (usb_probe_interface) from [<8056a8bc>] (really_probe+0x224/0x2f8)
[   67.347965]  r10:b65f0a00 r9:00000019 r8:7f65e034 r7:80d3e124 r6:00000000 r5:80d3e120
[   67.359175]  r4:b8fe8620 r3:805e0a68
[   67.364384] [<8056a698>] (really_probe) from [<8056ab60>] (driver_probe_device+0x6c/0x180)
[   67.375974]  r10:b65f0a00 r9:7f65e2c0 r8:b8fe8620 r7:00000000 r6:7f65e034 r5:7f65e034
[   67.387170]  r4:b8fe8620 r3:00000000
[   67.392378] [<8056aaf4>] (driver_probe_device) from [<8056ad54>] (__driver_attach+0xe0/0xe4)
[   67.404097]  r9:7f65e2c0 r8:7f65d22c r7:00000000 r6:b8fe8654 r5:7f65e034 r4:b8fe8620
[   67.415122] [<8056ac74>] (__driver_attach) from [<8056880c>] (bus_for_each_dev+0x68/0xa0)
[   67.426628]  r6:8056ac74 r5:7f65e034 r4:00000000 r3:00000027
[   67.434017] [<805687a4>] (bus_for_each_dev) from [<8056a1cc>] (driver_attach+0x28/0x30)
[   67.445394]  r6:80c6ddc8 r5:b7368f80 r4:7f65e034
[   67.451703] [<8056a1a4>] (driver_attach) from [<80569c24>] (bus_add_driver+0x194/0x21c)
[   67.463081] [<80569a90>] (bus_add_driver) from [<8056b504>] (driver_register+0x8c/0x124)
[   67.474560]  r7:80c6ddc8 r6:7f65e034 r5:00000000 r4:7f65e034
[   67.481964] [<8056b478>] (driver_register) from [<805df510>] (usb_register_driver+0x74/0x140)
[   67.493901]  r5:00000000 r4:7f65e000
[   67.499131] [<805df49c>] (usb_register_driver) from [<7f661024>] (mt76x0_driver_init+0x24/0x1000 [mt76x0u])
[   67.512258]  r9:00000001 r8:7f65e308 r7:00000000 r6:80c08d48 r5:7f661000 r4:7f65e2c0
[   67.523404] [<7f661000>] (mt76x0_driver_init [mt76x0u]) from [<80102f6c>] (do_one_initcall+0x4c/0x210)
[   67.536142] [<80102f20>] (do_one_initcall) from [<801ae63c>] (do_init_module+0x6c/0x21c)
[   67.547639]  r8:7f65e308 r7:80c08d48 r6:b65f0ac0 r5:7f65e2c0 r4:7f65e2c0
[   67.556129] [<801ae5d0>] (do_init_module) from [<801ad68c>] (load_module+0x1d10/0x2304)

Fixes: b40b15e1 ("mt76: add usb support to mt76 layer")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Move q->ndesc initialization before the for loop in mt76u_alloc_rx
since otherwise allocated urbs will not be freed in mt76u_buf_free
Double-check scatterlist pointer in mt76u_buf_free

Fixes: b40b15e1 ("mt76: add usb support to mt76 layer")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Fix possible NULL pointer dereference in mt76u_mcu_deinit routine that
can occur if initialization path fails before calling mt76u_mcu_init_rx

Fixes: ee676cd5 ("mt76: add driver code for MT76x2u based devices")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

We don't need to send firmware data asynchronously, much simpler is just
use synchronous usb_bulk_msg().
Tested-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Add mt76x0_init_txpower in order to initialize max_power per channel
at device bootstrap. Modify mt76x0_get_tx_power_per_rate and
mt76x0_get_power_info signature in order to compute tx power for
non-operating channels
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Initialize target_power variable in mt76x0_phy_set_txpower in order to
report target_power in debugfs
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>