When we find a timewait connection in __inet_hash_connect() and reuse
it for a new connection request, we have a race window, releasing bind
list lock and reacquiring it in __inet_twsk_kill() to remove timewait
socket from list.

Another thread might find the timewait socket we already chose, leading to
list corruption and crashes.

Fix is to remove timewait socket from bind list before releasing the bind lock.

Note: This problem happens if sysctl_tcp_tw_reuse is set.
Reported-by: kapil dakhane <kdakhane@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

First patch changes __inet_hash_nolisten() and __inet6_hash()
to get a timewait parameter to be able to unhash it from ehash
at same time the new socket is inserted in hash.

This makes sure timewait socket wont be found by a concurrent
writer in __inet_check_established()
Reported-by: kapil dakhane <kdakhane@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Here is an updated version, because ixgbe_get_ethtool_stats()
needs to call dev_get_stats() or "ethtool -S" wont give
correct tx_bytes/tx_packets values.

Several cpus can update netdev->stats.tx_bytes & netdev->stats.tx_packets
in parallel. In this case, TX stats are under estimated and false sharing
takes place.

After a pktgen session sending exactly 200000000 packets :
# ifconfig fiber0 | grep TX
          TX packets:198501982 errors:0 dropped:0 overruns:0 carrier:0

Multi queue devices should instead use txq->tx_bytes & txq->tx_packets
in their xmit() method (appropriate txq lock already held by caller, no
cache line miss), or use appropriate locking.

After patch, same pktgen session gives :

# ifconfig fiber0 | grep TX
          TX packets:200000000 errors:0 dropped:0 overruns:0 carrier:0
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

A workaround added for all ESB2 devices (adds a delay for all MDIC accesses
which resolves an issue with the MDIC ready bit being set prematurely) is
applicable only to devices in which the MAC-PHY interconnect is not
operating in a certain mode with in-band MDIO.  Check the control register
for the operating mode and enable the workaround accordingly.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The GG82563_REG() macro should not be used to determine the offset provided
to the e1000e_[read|write]_kmrn_reg() functions since the first argument to
the macro is already implied and gets masked off anyway in the functions.
The resultant register reads/writes with this patch are functionally the
same as before.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bit 7 in the CTRL_REG register is actually the Software Definable Pin 3,
not the Software Definable Pin 7.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

GCC even warns about it, as reported by Andrew Morton:

net/ipv4/tcp.c: In function 'do_tcp_getsockopt':
net/ipv4/tcp.c:2544: warning: comparison is always false due to limited range of data type
Signed-off-by: David S. Miller <davem@davemloft.net>

I messed up the merge in d7fc02c7, where
the conflict in question wasn't just about CTL_UNNUMBERED being removed,
but the 'strategy' field is too (sysctl handling is now done through the
/proc interface, with no duplicate protocols for reading the data).
Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-2.6.33' of git://git.kernel.dk/linux-2.6-block: (113 commits)
  cfq-iosched: Do not access cfqq after freeing it
  block: include linux/err.h to use ERR_PTR
  cfq-iosched: use call_rcu() instead of doing grace period stall on queue exit
  blkio: Allow CFQ group IO scheduling even when CFQ is a module
  blkio: Implement dynamic io controlling policy registration
  blkio: Export some symbols from blkio as its user CFQ can be a module
  block: Fix io_context leak after failure of clone with CLONE_IO
  block: Fix io_context leak after clone with CLONE_IO
  cfq-iosched: make nonrot check logic consistent
  io controller: quick fix for blk-cgroup and modular CFQ
  cfq-iosched: move IO controller declerations to a header file
  cfq-iosched: fix compile problem with !CONFIG_CGROUP
  blkio: Documentation
  blkio: Wait on sync-noidle queue even if rq_noidle = 1
  blkio: Implement group_isolation tunable
  blkio: Determine async workload length based on total number of queues
  blkio: Wait for cfq queue to get backlogged if group is empty
  blkio: Propagate cgroup weight updation to cfq groups
  blkio: Drop the reference to queue once the task changes cgroup
  blkio: Provide some isolation between groups
  ...

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: (54 commits)
  Revert "pata_sis: Implement MWDMA for the UDMA 133 capable chips"
  libata: Clarify ata_set_lba_range_entries function
  libata: Report zeroed read after TRIM and max discard size
  pata_hpt3x2n: fix overclocked MWDMA0 timing
  pata_it8213: MWDMA0 is unsupported
  [libata] MWDMA0 is unsupported on PIIX-like PATA controllers
  pata_via: clear UDMA transfer mode bit for PIO and MWDMA
  pata_sis: Power Management fix
  pata_rz1000: Power Management fix
  pata_radisys: fix UDMA handling
  pata_ns87415: Power Management fix
  pata_marvell: fix marvell_pre_reset() documentation
  pata_legacy: add pointers to QDI65x0 documentation
  pata_legacy: fix access to control register for QDI6580
  pata_legacy: fix QDI6580DP support
  pata_it8213: fix it8213_pre_reset() documentation
  pata_it8213: fix wrong MWDMA timings being programmed
  pata_it8213: fix PIO2 underclocking
  pata_it8213: fix wrong PIO timings being programmed
  pata_it8213: fix UDMA handling
  ...

Merge branch 'omap-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

* 'omap-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6: (149 commits)
  arm: omap: Add omap3_defconfig
  AM35xx: Defconfig for AM3517 EVM board
  AM35xx: Add support for AM3517 EVM board
  omap: 3630sdp: defconfig creation
  omap: 3630sdp: introduce 3630 sdp board support
  omap3: Add defconfig for IGEP v2 board
  omap3: Add minimal IGEP v2 support
  omap3: Add CompuLab CM-T35 defconfig
  omap3: Add CompuLab CM-T35 board support
  omap3: rx51: Add wl1251 wlan driver support
  omap3: rx51: Add SDRAM init
  omap1: Add default kernel configuration for Herald
  omap1: Add board support and LCD for HTC Herald
  omap: zoom2: update defconfig for LL_DEBUG_NONE
  omap: zoom3: defconfig creation
  omap3: zoom: Introduce zoom3 board support
  omap3: zoom: Drop i2c-1 speed to 2400
  omap3: zoom: rename zoom2 name to generic zoom
  omap3: zoom: split board file for software reuse
  omap3evm: MIgrate to smsc911x ethernet driver
  ...

Fix trivial conflict (two unrelated config options added next to each
other) in arch/arm/mach-omap2/Makefile

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k: parport_mfc3 - Not makes it a bool before the comparison.
  m68k: don't export static inline functions
  fbdev: atafb - add palette register check
  m68k: Remove the BKL from sys_execve
  m68k: Cleanup linker scripts using new linker script macros.
  m68k: Make thread_info.h usable from assembly.
  m68knommu: define arch_has_single_step() and friends
  m68k: ptrace fixes
  m68k: use generic code for ptrace requests
  rtc: Add an RTC driver for the Ricoh RP5C01
  rtc: Add an RTC driver for the Oki MSM6242

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  ieee1394: Use hweight32
  firewire: cdev: reduce stack usage by ioctl_dispatch
  firewire: ohci: 0 may be a valid DMA address
  firewire: core: WARN on wrong usage of core transaction functions
  firewire: core: optimize Topology Map creation
  firewire: core: clarify generate_config_rom usage
  firewire: optimize config ROM creation
  firewire: cdev: normalize variable names
  firewire: normalize style of queue_work wrappers
  firewire: cdev: fix memory leak in an error path

* 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm: (272 commits)
  Fix soc_common PCMCIA configuration
  ARM: 5827/1: SA1100: h3100/h3600: emit messages on failed gpio_request
  ARM: 5826/1: SA1100: h3100/h3600: always build htc-egpio driver
  ARM: 5825/1: SA1100: h3600: update defconfig
  ARM: 5824/1: SA1100: reuse h3600 PCMCIA driver on h3100
  ARM: 5823/1: SA1100: h3100/h3600: add support for gpio-keys
  ARM: 5822/1: SA1100: h3100/h3600: clean up #includes
  ARM: 5821/1: SA1100: h3100/h3600: revise copyright boilerplates
  ARM: 5820/1: SA1100: h3100/h3600: split h3600.c
  ARM: 5819/1: SA1100: h3100/h3600: merge h3600.h and h3600_gpio.h into h3xxx.h
  ARM: 5818/1: SA1100: h3100/h3600: drop old GPIO definitions
  ARM: 5817/1: SA1100: h3100/h3600: configure all unused gpios as inputs
  ARM: 5816/1: SA1100: h3600: remove IRQ_GPIO_* definitions
  ARM: 5815/1: SA1100: h3100/h3600: remove now unused assign_h3600_egpio handlers
  ARM: 5814/1: SA1100: h3100/h3600: convert all users of assign_h3600_egpio to gpiolib
  ARM: 5813/1: SA1100: h3100/h3600: add htc-egpio driver
  ARM: 5812/1: SA1100: h3100/h3600: separate machine-specific LCD helpers
  ARM: 5811/2: pcmcia: convert sa1100_h3600 driver to gpiolib
  ARM: 5799/1: SA1100: h3600: stop setting direction for LCD pins
  ARM: 5798/1: SA1100: h3600: remove unused cruft from h3600.h
  ...

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  i2c-stub: Documentation update
  i2c-stub: Allow user to disable some commands
  i2c-stub: Implement I2C block support
  i2c: Refactor for_each callbacks
  i2c-i801: Retry on lost arbitration
  i2c: Remove big kernel lock from i2cdev_open
  ics932s401: Clean up detect function
  i2c: Simplify i2c_detect_address
  i2c: Drop probe, ignore and force module parameters
  i2c: Add missing __devinit markers to old i2c adapter drivers
  i2c: Bus drivers don't have to support I2C_M_REV_DIR_ADDR
  i2c: Prevent priority inversion on top of bus lock
  i2c-voodoo3: Delete
  i2c-powermac: Drop temporary name buffer
  i2c-powermac: Include the i2c_adapter in struct pmac_i2c_bus
  i2c-powermac: Log errors
  i2c-powermac: Refactor i2c_powermac_smbus_xfer
  i2c-powermac: Reject unsupported I2C transactions
  i2c/chips: Move ds1682 to drivers/misc

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6:
  PM: Add flag for devices capable of generating run-time wake-up events
  PM / Runtime: Remove unnecessary braces in __pm_runtime_set_status()
  PM / Runtime: Make documentation of runtime_idle() agree with the code
  PM / Runtime: Ensure timer_expires is nonzero in pm_schedule_suspend()
  PM / Runtime: Use deferred_resume flag in pm_request_resume
  PM / Runtime: Export the PM runtime workqueue
  PM / Runtime: Fix lockdep warning in __pm_runtime_set_status()
  PM / Hibernate: Swap, use KERN_CONT
  PM / Hibernate: Shift remaining code from swsusp.c to hibernate.c
  PM / Hibernate: Move swap functions to kernel/power/swap.c.
  PM / freezer: Don't get over-anxious while waiting

* 'kvm-updates/2.6.33' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (84 commits)
  KVM: VMX: Fix comparison of guest efer with stale host value
  KVM: s390: Fix prefix register checking in arch/s390/kvm/sigp.c
  KVM: Drop user return notifier when disabling virtualization on a cpu
  KVM: VMX: Disable unrestricted guest when EPT disabled
  KVM: x86 emulator: limit instructions to 15 bytes
  KVM: s390: Make psw available on all exits, not just a subset
  KVM: x86: Add KVM_GET/SET_VCPU_EVENTS
  KVM: VMX: Report unexpected simultaneous exceptions as internal errors
  KVM: Allow internal errors reported to userspace to carry extra data
  KVM: Reorder IOCTLs in main kvm.h
  KVM: x86: Polish exception injection via KVM_SET_GUEST_DEBUG
  KVM: only clear irq_source_id if irqchip is present
  KVM: x86: disallow KVM_{SET,GET}_LAPIC without allocated in-kernel lapic
  KVM: x86: disallow multiple KVM_CREATE_IRQCHIP
  KVM: VMX: Remove vmx->msr_offset_efer
  KVM: MMU: update invlpg handler comment
  KVM: VMX: move CR3/PDPTR update to vmx_set_cr3
  KVM: remove duplicated task_switch check
  KVM: powerpc: Fix BUILD_BUG_ON condition
  KVM: VMX: Use shared msr infrastructure
  ...

Trivial conflicts due to new Kconfig options in arch/Kconfig and kernel/Makefile

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1815 commits)
  mac80211: fix reorder buffer release
  iwmc3200wifi: Enable wimax core through module parameter
  iwmc3200wifi: Add wifi-wimax coexistence mode as a module parameter
  iwmc3200wifi: Coex table command does not expect a response
  iwmc3200wifi: Update wiwi priority table
  iwlwifi: driver version track kernel version
  iwlwifi: indicate uCode type when fail dump error/event log
  iwl3945: remove duplicated event logging code
  b43: fix two warnings
  ipw2100: fix rebooting hang with driver loaded
  cfg80211: indent regulatory messages with spaces
  iwmc3200wifi: fix NULL pointer dereference in pmkid update
  mac80211: Fix TX status reporting for injected data frames
  ath9k: enable 2GHz band only if the device supports it
  airo: Fix integer overflow warning
  rt2x00: Fix padding bug on L2PAD devices.
  WE: Fix set events not propagated
  b43legacy: avoid PPC fault during resume
  b43: avoid PPC fault during resume
  tcp: fix a timewait refcnt race
  ...

Fix up conflicts due to sysctl cleanups (dead sysctl_check code and
CTL_UNNUMBERED removed) in
	kernel/sysctl_check.c
	net/ipv4/sysctl_net_ipv4.c
	net/ipv6/addrconf.c
	net/sctp/sysctl.c

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next-2.6:
  sparc: Set UTS_MACHINE correctly.
  sparc,leon: init_leon srmmu cleanup
  sparc32: Remove early interrupt enable.
  sparc, leon: Added Aeroflex Gaisler entry in manufacturer_info structure
  sparc64: Faster early-boot framebuffer console.
  Revert "sparc: Make atomic locks raw"
  sparc: remove unused nfsd #includes
  sparc: Fixup last users of irq_chip->typename
  Added sparc_leon3_snooping_enabled() and converted extern inline to static inline
  No auxio on LEON
  apbuart: Use of_find_node_by_path to find root node.
  sparc: Replace old style lock initializer
  sparc: Make atomic locks raw
  apbuart: Fix build and missing driver unregister.
  apbuart: Kill dependency on deprecated Sparc-only PROM interfaces.
  apbuart: Fix build warning.
  sparc: Support for GRLIB APBUART serial port
  watchdog: Remove BKL from rio watchdog driver
  sparc: Remove BKL from apc
  sparc,leon: Sparc-Leon SMP support

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: (294 commits)
  S3C64XX: Staticise platform data for PCM devices
  ASoC: Rename controls with a / in wm_hubs
  snd-fm801: autodetect SF64-PCR (tuner-only) card
  ALSA: tea575x-tuner: fix mute
  ASoC: au1x: dbdma2: plug memleak in pcm device creation error path
  ASoC: au1x: dbdma2: fix oops on soc device removal.
  ALSA: hda - Fix memory leaks in the previous patch
  ALSA: hda - Add ALC661/259, ALC892/888VD support
  ALSA: opti9xx: remove snd_opti9xx fields
  ALSA: aaci - Clean up duplicate code
  ALSA: usb - Fix mixer map for Hercules Gamesurround Muse Pocket LT
  ALSA: hda - Add position_fix quirk for HP dv3
  ALSA: hda - Add a pin-fix for FSC Amilo Pi1505
  ALSA: hda - Fix Cxt5047 test mode
  ASoC: pxa/raumfeld: adopt new snd_soc_dai_set_pll() API
  ASoC: sh: fsi: Add runtime PM support
  sh: ms7724se: Add runtime PM support for FSI
  ALSA: hda - Add a position_fix quirk for MSI Wind U115
  ALSA: opti-miro: add PnP detection
  ALSA: opti-miro: separate comon probing code
  ...

* 'next-devicetree' of git://git.secretlab.ca/git/linux-2.6:
  of: merge of_find_all_nodes() implementations
  of: merge other miscellaneous prototypes
  of: merge of_*_flat_dt*() functions
  of: merge of_node_get(), of_node_put() and of_find_all_nodes()
  of: merge of_read_number() an of_read_ulong()
  of: merge of_node_*_flag() and set_node_proc_entry()
  of: merge struct boot_param_header from Microblaze and PowerPC
  of: add common header for flattened device tree representation
  of: Move OF_IS_DYNAMIC and OF_MARK_DYNAMIC macros to of.h
  of: merge struct device_node
  of: merge phandle, ihandle and struct property
  of: Rework linux/of.h and asm/prom.h include ordering

* git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/sysctl-2.6: (43 commits)
  security/tomoyo: Remove now unnecessary handling of security_sysctl.
  security/tomoyo: Add a special case to handle accesses through the internal proc mount.
  sysctl: Drop & in front of every proc_handler.
  sysctl: Remove CTL_NONE and CTL_UNNUMBERED
  sysctl: kill dead ctl_handler definitions.
  sysctl: Remove the last of the generic binary sysctl support
  sysctl net: Remove unused binary sysctl code
  sysctl security/tomoyo: Don't look at ctl_name
  sysctl arm: Remove binary sysctl support
  sysctl x86: Remove dead binary sysctl support
  sysctl sh: Remove dead binary sysctl support
  sysctl powerpc: Remove dead binary sysctl support
  sysctl ia64: Remove dead binary sysctl support
  sysctl s390: Remove dead sysctl binary support
  sysctl frv: Remove dead binary sysctl support
  sysctl mips/lasat: Remove dead binary sysctl support
  sysctl drivers: Remove dead binary sysctl support
  sysctl crypto: Remove dead binary sysctl support
  sysctl security/keys: Remove dead binary sysctl support
  sysctl kernel: Remove binary sysctl logic
  ...

Adds support for the WiFi activity LED on the Dell Vostro A860 laptop.
Signed-off-by: Shahar Or <shahar@shahar-or.co.il>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

A KERN_DEBUG didn't get removed when transitioning from printk to
pr_debug
Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

There are different bits used to convey the setting of the rfkill
switch to the driver. The current driver only supports one of these
possibilities. These changes were derived from the latest version
of the vendor driver.

This patch fixes the regression noted in kernel Bugzilla #14743.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-and-tested-by: Antti Kaijanmäki <antti@kaijanmaki.net>
Tested-by: Hin-Tak Leung <hintak.leung@gmail.com>
Cc: Stable <stable@kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This patch fixes a bug in ath9k's tx status check, which
caused mac80211 to consider regularly transmitted unicast frames
as un-acked.
When checking the ts_status field for errors, it needs to be masked
with ATH9K_TXERR_FILT, because this field also contains other fields
like ATH9K_TX_ACKED.
Without this patch, AP mode is pretty much unusable, as hostapd
checks the ACK status for the frames that it injects.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

On a 32-bit machine, BIT() macro does not give the required
bit value if the bit is mroe than 31. In ieee802_11_parse_elems_crc(),
BIT() is suppossed to get the bit value more than 31 (42 (id of ERP_INFO_IE),
37 (CHANNEL_SWITCH_IE), (42), 32 (POWER_CONSTRAINT_IE), 45 (HT_CAP_IE),
61 (HT_INFO_IE)). As we do not get the required bit value for the above
IEs, crc over these IEs are never calculated, so any dynamic change in these
IEs after the association is not really handled on 32-bit platforms.
This patch fixes this issue.

Cc: stable@kernel.org
Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

net/rfkill/core.c: In function 'rfkill_type_show':
net/rfkill/core.c:610: warning: control may reach end of non-void function 'rfkill_get_type_str' being inlined

A gcc bug, but simple enough to squish.

Cc: John W. Linville <linville@tuxdriver.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The FINALIZE_JOIN firmware command only looks at the first couple of
fields in the beacon, and therefore it's not necessary to complain if
the beacon is longer than 128 bytes.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

When disassociating, mac80211 zeroes vif->bss_info.bssid before
calling our ->bss_info_changed(), but we need the BSSID to remove the
hardware station database entry for our AP, so we can't clear our
local copy of the BSSID until after we've done that.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Don't forget to call pci_disable_device() if pci_request_regions()
fails during probe.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The time between loading the helper image and starting to upload the
main firmware image should be at least 5 ms or so.  We were doing an
msleep(1) before, and 1 ms appears to not be enough in almost all
cases, but building with HZ=100 has always masked this so far.  Bumping
the msleep argument to 5 fixes firmware loading e.g. when HZ=1000.

Some firmware images need more than 200ms to initialize.  Bump the
ready code timeout to 500ms to accommodate for this.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Before issuing any firmware commands, we wait for the transmit rings
to drain, to prevent control versus data path synchronization issues.
In some cases, this can end up taking longer than the current hardcoded
limit of 5 seconds, for example if the transmit rings are filled with
packets for a host that has dropped off the air and we end up
retransmitting every pending packet at the lowest rate a couple of
times.

This patch changes mwl8k_tx_wait_empty() to only bail out on timeout
expiry if there was no change in the number of packets pending in the
transmit rings during the waiting period.  If at least one transmit
ring entry was reclaimed while we were waiting, we are apparently still
making progress, and we'll allow waiting for another timeout period.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Some firmware commands can under some circumstances take more than 2
seconds to complete.  This patch bumps the timeout up to 10 seconds,
and prints a message whenever a command takes more than 2 seconds.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

On 8366, bit 6 in the rx descriptor rate field indicates whether the
packet was received on a 20MHz or 40MHz channel, and is not part of
the MCS index.  Handle this properly, which then prevents hitting the
WARN_ON and being dropped in ieee80211_rx().
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

When inserting a DMA header into a packet for transmission,
mwl8k_add_dma_header() would blindly zero the addr4 field, which
is not a good idea if the packet being transmitted is actually a
4-address packet.

Also, if the transmitted packet was a 4-address with QoS packet,
the memmove() to do the needed header reshuffling would inadvertently
overwrite the first two bytes of the packet payload with the QoS field.

This fixes both of these issues.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Packets exchanged between the mwl8k driver and the firmware always
have a 4-address header without QoS field.  For QoS packets, the QoS
field is passed to/from the firmware via the tx/rx descriptors.

We were handling this correctly on transmit, but not on receive -- if
a QoS packet was received, we would leave garbage in the QoS field in
the packet passed up to the stack, which is Bad(tm).

Also, if the packet received on the air was a 4-address without QoS
packet, we would forget to skb_pull the 2-byte DMA length prefix off.

This patch adds an argument to the ->rxd_process() receive descriptor
operation to retrieve the QoS field from the receive descriptor, and
extends mwl8k_remove_dma_header() to insert this field back into the
packet if the packet received is a QoS packet.  It also fixes
mwl8k_remove_dma_header() to strip off the length prefix in all cases.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>