9 files changed, 82 insertions, 75 deletions

diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
index 5a8a3cce27bc..7e5e85a017b5 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
@@ -955,9 +955,6 @@ int iwl4965_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         if (priv->cfg->scan_rx_antennas[band])
                 rx_ant = priv->cfg->scan_rx_antennas[band];
 
-        if (priv->cfg->scan_tx_antennas[band])
-                scan_tx_antennas = priv->cfg->scan_tx_antennas[band];
-
         priv->scan_tx_ant[band] = iwl4965_toggle_tx_ant(priv,
                                                 priv->scan_tx_ant[band],
                                                     scan_tx_antennas);
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index c1511b14b239..d743373a9424 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -211,10 +211,7 @@ int iwl_legacy_init_geos(struct iwl_priv *priv)
                 if (!iwl_legacy_is_channel_valid(ch))
                         continue;
 
-                if (iwl_legacy_is_channel_a_band(ch))
-                        sband =  &priv->bands[IEEE80211_BAND_5GHZ];
-                else
-                        sband =  &priv->bands[IEEE80211_BAND_2GHZ];
+                sband = &priv->bands[ch->band];
 
                 geo_ch = &sband->channels[sband->n_channels++];
 
@@ -2117,10 +2114,9 @@ int iwl_legacy_mac_config(struct ieee80211_hw *hw, u32 changed)
         IWL_DEBUG_MAC80211(priv, "enter to channel %d changed 0x%X\n",
                                         channel->hw_value, changed);
 
-        if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
-                        test_bit(STATUS_SCANNING, &priv->status))) {
+        if (unlikely(test_bit(STATUS_SCANNING, &priv->status))) {
                 scan_active = 1;
-                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
+                IWL_DEBUG_MAC80211(priv, "scan active\n");
         }
 
         if (changed & (IEEE80211_CONF_CHANGE_SMPS |
@@ -2433,11 +2429,13 @@ void iwl_legacy_mac_bss_info_changed(struct ieee80211_hw *hw,
 
         IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
 
-        if (!iwl_legacy_is_alive(priv))
-                return;
-
         mutex_lock(&priv->mutex);
 
+        if (!iwl_legacy_is_alive(priv)) {
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+
         if (changes & BSS_CHANGED_QOS) {
                 unsigned long flags;
 
@@ -2646,7 +2644,7 @@ unplugged:
 
 none:
         /* re-enable interrupts here since we don't have anything to service. */
-        /* only Re-enable if diabled by irq */
+        /* only Re-enable if disabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_legacy_enable_interrupts(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.h b/drivers/net/wireless/iwlegacy/iwl-core.h
index f03b463e4378..bc66c604106c 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.h
+++ b/drivers/net/wireless/iwlegacy/iwl-core.h
@@ -287,7 +287,6 @@ struct iwl_cfg {
         struct iwl_base_params *base_params;
         /* params likely to change within a device family */
         u8 scan_rx_antennas[IEEE80211_NUM_BANDS];
-        u8 scan_tx_antennas[IEEE80211_NUM_BANDS];
         enum iwl_led_mode led_mode;
 };
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-dev.h b/drivers/net/wireless/iwlegacy/iwl-dev.h
index 9ee849d669f3..2d87dba2cfa3 100644
--- a/drivers/net/wireless/iwlegacy/iwl-dev.h
+++ b/drivers/net/wireless/iwlegacy/iwl-dev.h
@@ -134,7 +134,7 @@ struct iwl_queue {
                                 * space more than this */
         int high_mark;         /* high watermark, stop queue if free
                                 * space less than this */
-} __packed;
+};
 
 /* One for each TFD */
 struct iwl_tx_info {
@@ -290,6 +290,7 @@ enum {
         CMD_SIZE_HUGE = (1 << 0),
         CMD_ASYNC = (1 << 1),
         CMD_WANT_SKB = (1 << 2),
+        CMD_MAPPED = (1 << 3),
 };
 
 #define DEF_CMD_PAYLOAD_SIZE 320
@@ -1076,7 +1077,6 @@ struct iwl_priv {
         spinlock_t hcmd_lock;   /* protect hcmd */
         spinlock_t reg_lock;    /* protect hw register access */
         struct mutex mutex;
-        struct mutex sync_cmd_mutex; /* enable serialization of sync commands */
 
         /* basic pci-network driver stuff */
         struct pci_dev *pci_dev;
diff --git a/drivers/net/wireless/iwlegacy/iwl-hcmd.c b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
index 9d721cbda5bb..62b4b09122cb 100644
--- a/drivers/net/wireless/iwlegacy/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
@@ -145,6 +145,8 @@ int iwl_legacy_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         int cmd_idx;
         int ret;
 
+        lockdep_assert_held(&priv->mutex);
+
         BUG_ON(cmd->flags & CMD_ASYNC);
 
          /* A synchronous command can not have a callback set. */
@@ -152,7 +154,6 @@ int iwl_legacy_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 
         IWL_DEBUG_INFO(priv, "Attempting to send sync command %s\n",
                         iwl_legacy_get_cmd_string(cmd->id));
-        mutex_lock(&priv->sync_cmd_mutex);
 
         set_bit(STATUS_HCMD_ACTIVE, &priv->status);
         IWL_DEBUG_INFO(priv, "Setting HCMD_ACTIVE for command %s\n",
@@ -224,7 +225,6 @@ fail:
                 cmd->reply_page = 0;
         }
 out:
-        mutex_unlock(&priv->sync_cmd_mutex);
         return ret;
 }
 EXPORT_SYMBOL(iwl_legacy_send_cmd_sync);
diff --git a/drivers/net/wireless/iwlegacy/iwl-helpers.h b/drivers/net/wireless/iwlegacy/iwl-helpers.h
index 02132e755831..a6effdae63f9 100644
--- a/drivers/net/wireless/iwlegacy/iwl-helpers.h
+++ b/drivers/net/wireless/iwlegacy/iwl-helpers.h
@@ -149,6 +149,12 @@ static inline void iwl_legacy_disable_interrupts(struct iwl_priv *priv)
         IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
 }
 
+static inline void iwl_legacy_enable_rfkill_int(struct iwl_priv *priv)
+{
+        IWL_DEBUG_ISR(priv, "Enabling rfkill interrupt\n");
+        iwl_write32(priv, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
+}
+
 static inline void iwl_legacy_enable_interrupts(struct iwl_priv *priv)
 {
         IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
diff --git a/drivers/net/wireless/iwlegacy/iwl-tx.c b/drivers/net/wireless/iwlegacy/iwl-tx.c
index a227773cb384..4fff995c6f3e 100644
--- a/drivers/net/wireless/iwlegacy/iwl-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-tx.c
@@ -146,33 +146,32 @@ void iwl_legacy_cmd_queue_unmap(struct iwl_priv *priv)
 {
         struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
         struct iwl_queue *q = &txq->q;
-        bool huge = false;
         int i;
 
         if (q->n_bd == 0)
                 return;
 
         while (q->read_ptr != q->write_ptr) {
-                /* we have no way to tell if it is a huge cmd ATM */
                 i = iwl_legacy_get_cmd_index(q, q->read_ptr, 0);
 
-                if (txq->meta[i].flags & CMD_SIZE_HUGE)
-                        huge = true;
-                else
+                if (txq->meta[i].flags & CMD_MAPPED) {
                         pci_unmap_single(priv->pci_dev,
                                          dma_unmap_addr(&txq->meta[i], mapping),
                                          dma_unmap_len(&txq->meta[i], len),
                                          PCI_DMA_BIDIRECTIONAL);
+                        txq->meta[i].flags = 0;
+                }
 
                 q->read_ptr = iwl_legacy_queue_inc_wrap(q->read_ptr, q->n_bd);
         }
 
-        if (huge) {
-                i = q->n_window;
+        i = q->n_window;
+        if (txq->meta[i].flags & CMD_MAPPED) {
                 pci_unmap_single(priv->pci_dev,
                                  dma_unmap_addr(&txq->meta[i], mapping),
                                  dma_unmap_len(&txq->meta[i], len),
                                  PCI_DMA_BIDIRECTIONAL);
+                txq->meta[i].flags = 0;
         }
 }
 EXPORT_SYMBOL(iwl_legacy_cmd_queue_unmap);
@@ -467,29 +466,27 @@ int iwl_legacy_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                 return -EIO;
         }
 
+        spin_lock_irqsave(&priv->hcmd_lock, flags);
+
         if (iwl_legacy_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
-                IWL_ERR(priv, "No space in command queue\n");
-                IWL_ERR(priv, "Restarting adapter due to queue full\n");
+                spin_unlock_irqrestore(&priv->hcmd_lock, flags);
+
+                IWL_ERR(priv, "Restarting adapter due to command queue full\n");
                 queue_work(priv->workqueue, &priv->restart);
                 return -ENOSPC;
         }
 
-        spin_lock_irqsave(&priv->hcmd_lock, flags);
-
-        /* If this is a huge cmd, mark the huge flag also on the meta.flags
-         * of the _original_ cmd. This is used for DMA mapping clean up.
-         */
-        if (cmd->flags & CMD_SIZE_HUGE) {
-                idx = iwl_legacy_get_cmd_index(q, q->write_ptr, 0);
-                txq->meta[idx].flags = CMD_SIZE_HUGE;
-        }
-
         idx = iwl_legacy_get_cmd_index(q, q->write_ptr, cmd->flags & CMD_SIZE_HUGE);
         out_cmd = txq->cmd[idx];
         out_meta = &txq->meta[idx];
 
+        if (WARN_ON(out_meta->flags & CMD_MAPPED)) {
+                spin_unlock_irqrestore(&priv->hcmd_lock, flags);
+                return -ENOSPC;
+        }
+
         memset(out_meta, 0, sizeof(*out_meta)); /* re-initialize to NULL */
-        out_meta->flags = cmd->flags;
+        out_meta->flags = cmd->flags | CMD_MAPPED;
         if (cmd->flags & CMD_WANT_SKB)
                 out_meta->source = cmd;
         if (cmd->flags & CMD_ASYNC)
@@ -610,6 +607,7 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         struct iwl_device_cmd *cmd;
         struct iwl_cmd_meta *meta;
         struct iwl_tx_queue *txq = &priv->txq[priv->cmd_queue];
+        unsigned long flags;
 
         /* If a Tx command is being handled and it isn't in the actual
          * command queue then there a command routing bug has been introduced
@@ -623,14 +621,6 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                 return;
         }
 
-        /* If this is a huge cmd, clear the huge flag on the meta.flags
-         * of the _original_ cmd. So that iwl_legacy_cmd_queue_free won't unmap
-         * the DMA buffer for the scan (huge) command.
-         */
-        if (huge) {
-                cmd_index = iwl_legacy_get_cmd_index(&txq->q, index, 0);
-                txq->meta[cmd_index].flags = 0;
-        }
         cmd_index = iwl_legacy_get_cmd_index(&txq->q, index, huge);
         cmd = txq->cmd[cmd_index];
         meta = &txq->meta[cmd_index];
@@ -647,6 +637,8 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         } else if (meta->callback)
                 meta->callback(priv, cmd, pkt);
 
+        spin_lock_irqsave(&priv->hcmd_lock, flags);
+
         iwl_legacy_hcmd_queue_reclaim(priv, txq_id, index, cmd_index);
 
         if (!(meta->flags & CMD_ASYNC)) {
@@ -655,6 +647,10 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                                iwl_legacy_get_cmd_string(cmd->hdr.cmd));
                 wake_up_interruptible(&priv->wait_command_queue);
         }
+
+        /* Mark as unmapped */
         meta->flags = 0;
+
+        spin_unlock_irqrestore(&priv->hcmd_lock, flags);
 }
 EXPORT_SYMBOL(iwl_legacy_tx_cmd_complete);
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index cc7ebcee60e5..0ee6be6a9c5d 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -2748,11 +2748,12 @@ static void iwl3945_bg_init_alive_start(struct work_struct *data)
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, init_alive_start.work);
 
+        mutex_lock(&priv->mutex);
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+                goto out;
 
-        mutex_lock(&priv->mutex);
         iwl3945_init_alive_start(priv);
+out:
         mutex_unlock(&priv->mutex);
 }
 
@@ -2761,11 +2762,12 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, alive_start.work);
 
+        mutex_lock(&priv->mutex);
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+                goto out;
 
-        mutex_lock(&priv->mutex);
         iwl3945_alive_start(priv);
+out:
         mutex_unlock(&priv->mutex);
 }
 
@@ -2995,10 +2997,12 @@ static void iwl3945_bg_restart(struct work_struct *data)
         } else {
                 iwl3945_down(priv);
 
-                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                mutex_lock(&priv->mutex);
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
+                        mutex_unlock(&priv->mutex);
                         return;
+                }
 
-                mutex_lock(&priv->mutex);
                 __iwl3945_up(priv);
                 mutex_unlock(&priv->mutex);
         }
@@ -3009,11 +3013,12 @@ static void iwl3945_bg_rx_replenish(struct work_struct *data)
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, rx_replenish);
 
+        mutex_lock(&priv->mutex);
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+                goto out;
 
-        mutex_lock(&priv->mutex);
         iwl3945_rx_replenish(priv);
+out:
         mutex_unlock(&priv->mutex);
 }
 
@@ -3810,7 +3815,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         INIT_LIST_HEAD(&priv->free_frames);
 
         mutex_init(&priv->mutex);
-        mutex_init(&priv->sync_cmd_mutex);
 
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index f8870543d68f..f781b7e225b4 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -1069,9 +1069,12 @@ static void iwl4965_irq_tasklet(struct iwl_priv *priv)
         }
 
         /* Re-enable all interrupts */
-        /* only Re-enable if diabled by irq */
+        /* only Re-enable if disabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_legacy_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_legacy_enable_rfkill_int(priv);
 
 #ifdef CONFIG_IWLWIFI_LEGACY_DEBUG
         if (iwl_legacy_get_debug_level(priv) & (IWL_DL_ISR)) {
@@ -2139,7 +2142,7 @@ static void iwl4965_cancel_deferred_work(struct iwl_priv *priv);
 static void __iwl4965_down(struct iwl_priv *priv)
 {
         unsigned long flags;
-        int exit_pending = test_bit(STATUS_EXIT_PENDING, &priv->status);
+        int exit_pending;
 
         IWL_DEBUG_INFO(priv, DRV_NAME " is going down\n");
 
@@ -2401,11 +2404,12 @@ static void iwl4965_bg_init_alive_start(struct work_struct *data)
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, init_alive_start.work);
 
+        mutex_lock(&priv->mutex);
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+                goto out;
 
-        mutex_lock(&priv->mutex);
         priv->cfg->ops->lib->init_alive_start(priv);
+out:
         mutex_unlock(&priv->mutex);
 }
 
@@ -2414,11 +2418,12 @@ static void iwl4965_bg_alive_start(struct work_struct *data)
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, alive_start.work);
 
+        mutex_lock(&priv->mutex);
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+                goto out;
 
-        mutex_lock(&priv->mutex);
         iwl4965_alive_start(priv);
+out:
         mutex_unlock(&priv->mutex);
 }
 
@@ -2468,10 +2473,12 @@ static void iwl4965_bg_restart(struct work_struct *data)
         } else {
                 iwl4965_down(priv);
 
-                if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                mutex_lock(&priv->mutex);
+                if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
+                        mutex_unlock(&priv->mutex);
                         return;
+                }
 
-                mutex_lock(&priv->mutex);
                 __iwl4965_up(priv);
                 mutex_unlock(&priv->mutex);
         }
@@ -2624,9 +2631,10 @@ void iwl4965_mac_stop(struct ieee80211_hw *hw)
 
         flush_workqueue(priv->workqueue);
 
-        /* enable interrupts again in order to receive rfkill changes */
+        /* User space software may expect getting rfkill changes
+         * even if interface is down */
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
-        iwl_legacy_enable_interrupts(priv);
+        iwl_legacy_enable_rfkill_int(priv);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
@@ -2847,21 +2855,22 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
+        mutex_lock(&priv->mutex);
+
         if (iwl_legacy_is_rfkill(priv))
-                goto out_exit;
+                goto out;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
             test_bit(STATUS_SCANNING, &priv->status))
-                goto out_exit;
+                goto out;
 
         if (!iwl_legacy_is_associated_ctx(ctx))
-                goto out_exit;
+                goto out;
 
         /* channel switch in progress */
         if (priv->switch_rxon.switch_in_progress == true)
-                goto out_exit;
+                goto out;
 
-        mutex_lock(&priv->mutex);
         if (priv->cfg->ops->lib->set_channel_switch) {
 
                 ch = channel->hw_value;
@@ -2917,7 +2926,6 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
         }
 out:
         mutex_unlock(&priv->mutex);
-out_exit:
         if (!priv->switch_rxon.switch_in_progress)
                 ieee80211_chswitch_done(ctx->vif, false);
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -3116,7 +3124,6 @@ static int iwl4965_init_drv(struct iwl_priv *priv)
         INIT_LIST_HEAD(&priv->free_frames);
 
         mutex_init(&priv->mutex);
-        mutex_init(&priv->sync_cmd_mutex);
 
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
@@ -3406,14 +3413,14 @@ iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * 8. Enable interrupts and read RFKILL state
          *********************************************/
 
-        /* enable interrupts if needed: hw bug w/a */
+        /* enable rfkill interrupt: hw bug w/a */
         pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
         if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
                 pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
                 pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
         }
 
-        iwl_legacy_enable_interrupts(priv);
+        iwl_legacy_enable_rfkill_int(priv);
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         if (iwl_read32(priv, CSR_GP_CNTRL) &