iwlwifi: Fix TKIP update key and get_free_ucode_key

This patch fixes a bug in update_tkip_key: only one key needs to be
allocated in uCode, every time it is updated, the old one will be
overwritten

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/iwlwifi/iwl-sta.c

@@ -43,7 +43,7 @@ int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 	int i;
 
 	for (i = 0; i < STA_KEY_MAX_NUM; i++)
-		if (test_and_set_bit(i, &priv->ucode_key_table))
+		if (!test_and_set_bit(i, &priv->ucode_key_table))
 			return i;
 
 	return -1;
@@ -243,6 +243,8 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 	priv->stations[sta_id].keyinfo.alg = keyconf->alg;
 	priv->stations[sta_id].keyinfo.conf = keyconf;
 	priv->stations[sta_id].keyinfo.keylen = 16;
+	priv->stations[sta_id].sta.key.key_offset =
+				 iwl_get_free_ucode_key_index(priv);
 
 	/* This copy is acutally not needed: we get the key with each TX */
 	memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);

drivers/net/wireless/iwlwifi/iwl4965-base.c

@@ -6810,8 +6810,6 @@ static void iwl4965_mac_update_tkip_key(struct ieee80211_hw *hw,
 
 	spin_lock_irqsave(&priv->sta_lock, flags);
 
-	priv->stations[sta_id].sta.key.key_offset =
-				iwl_get_free_ucode_key_index(priv);
 	priv->stations[sta_id].sta.key.key_flags = key_flags;
 	priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;