cfg80211 could pass a NULL net_device to the driver via the
set_channel() callback, when it receives a request to set the
device's channel. Not handling this case properly results in this panic:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000cb0
IP: [<ffffffffa0374e49>] ath6kl_cfg80211_ready+0x9/0x70 [ath6kl_sdio]

Call Trace:
[<ffffffffa0374ed7>] ath6kl_set_channel+0x27/0x90 [ath6kl_sdio]
[<ffffffffa04dfd5f>] cfg80211_set_freq+0xff/0x1d0 [cfg80211]
[<ffffffffa04d3275>] ? nl80211_set_wiphy+0x85/0x660 [cfg80211]
[<ffffffffa04d3198>] __nl80211_set_channel.isra.39+0x118/0x140 [cfg80211]
[<ffffffffa04d34f3>] nl80211_set_wiphy+0x303/0x660 [cfg80211]
[<ffffffff813678d7>] ? rtnl_lock+0x17/0x20
[<ffffffffa04ca165>] ? nl80211_pre_doit+0xb5/0x150 [cfg80211]
[<ffffffff81382a45>] genl_rcv_msg+0x1d5/0x250
[<ffffffff81382870>] ? genl_rcv+0x40/0x40
[<ffffffff81381be9>] netlink_rcv_skb+0xa9/0xd0
[<ffffffff81382855>] genl_rcv+0x25/0x40
[<ffffffff811354f0>] ? might_fault+0x40/0x90
[<ffffffff81381519>] netlink_unicast+0x2d9/0x320
[<ffffffff813818e6>] netlink_sendmsg+0x2c6/0x320
[<ffffffff81343800>] ? sock_update_classid+0xb0/0x110
[<ffffffff8133f52e>] sock_sendmsg+0x10e/0x130
[<ffffffff81169933>] ? mem_cgroup_update_page_stat+0x193/0x250
[<ffffffff811354f0>] ? might_fault+0x40/0x90
[<ffffffff811354f0>] ? might_fault+0x40/0x90
[<ffffffff81135539>] ? might_fault+0x89/0x90
[<ffffffff811354f0>] ? might_fault+0x40/0x90
[<ffffffff8134d126>] ? verify_iovec+0x56/0xd0
[<ffffffff8133f9e6>] __sys_sendmsg+0x396/0x3b0
[<ffffffff8108e823>] ? up_read+0x23/0x40
[<ffffffff81040e68>] ? do_page_fault+0x208/0x4e0
[<ffffffff81193151>] ? vfsmount_lock_local_unlock+0x21/0x60
[<ffffffff811947d0>] ? mntput_no_expire+0x30/0xe0
[<ffffffff8119489f>] ? mntput+0x1f/0x30
[<ffffffff81342149>] sys_sendmsg+0x49/0x90
[<ffffffff81425482>] system_call_fastpath+0x16/0x1b
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

As firmware starting from 3.2.0.12 has some API changes and doesn't work
with older versions of ath6kl we need to bump up the API version. This
way we don't break anything.

Also store which version of API is used and print that during boot:

ath6kl: ar6003 hw 2.1.1 sdio fw 3.2.0.13 api 3
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Currently ath6kl has just hardcoded paths to each firmware file. Change
this more dynamic by separating the the directory and file name from each
other. That way it's easier to dynamically create full paths to firmware and
code looks better. And now it's possible to remove a function needed by
devicetree code.

While at it add a structure inside struct ath6kl_hw to contain all
firmware names. I deliberately omitted board file support as
those will be handled later.

This is needed for firmware API 3.
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Firmware ARP module requires own IP addr in order to respond
to the outside world when the target is in WOW suspend state.

At present, firmware ARP module has capability to hold 2 IP addr.
So, WOW mode will be disabled if the total IP addr configured in
net_dev for our device is greater than firmware limit (MAX_IP_ADDRS)
which is 2 at this moment.
Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
Signed-off-by: Thirumalai Pachamuthu <tpachamu@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

In this way, caller is free to pass only the value of IP addr
to configure.

In addition to this,
  * 'ips' variable data type in struct wmi_set_ip_cmd is changed
     from __le32 to __be32 in order to match network byte order.
  *  ipv4_is_multicast() is used to validate multicast ip addr.
  *  New argument if_idx is added to supply correct vif index
     to ath6kl_wmi_cmd_send().

This will be used in the next patch.
Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
Signed-off-by: Thirumalai Pachamuthu <tpachamu@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Empty IE buffer means that the new association is not supposed to
include extra IEs. Make sure any previously configured (Re)Association
Request frame IEs get cleared in such a case. This is based on a patch
from Shuibing.

Cc: Dai Shuibing <shuibing@qca.qualcomm.com>
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This is to avoid the scenario where the bss entry of the AP got
expired when reporting roaming event to current AP. As the bss
entry for the current bss is available in driver, pass this bss
to cfg80211. This fixes WARNING: at net/wireless/sme.c:586.

This patch depends on the following patch in cfg80211
"cfg80211: Fix race in bss timeout".
Reported-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Conflicts:
	drivers/net/wireless/ath/ath6kl/init.c

Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com>
Acked-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

When we restore regulatory settings the world regulatory domain
is properly reset on cfg80211 (or user prefered regulatory domain)
but we were never setting back channel values for drivers that use
WIPHY_FLAG_CUSTOM_REGULATORY. Set these values up again by using
the orig_ channel parameters.

This fixes restoring custom regulatory settings upon disconnect
events.

Cc: compat@orbit-lab.org
Cc: Paul Stewart <pstew@google.com>
Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Cc: Senthilkumar Balasubramanian <senthilb@qca.qualcomm.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

By definition WIPHY_FLAG_STRICT_REGULATORY was intended to allow the
wiphy to adjust itself to the country IE power information if the
card had no regulatory data but we had no way to tell cfg80211 that if
the card also had its own custom regulatory domain (these are typically
custom world regulatory domains) that we want to follow the country IE's
noted values for power for each channel. We add support for this and
document it.

This is not a critical fix but a performance optimization for cards
with custom regulatory domains that associate to an AP with sends
out country IEs with a higher EIRP than the one on the custom
regulatory domain. In practice the only driver affected right now
are the Atheros drivers as they are the only drivers using both
WIPHY_FLAG_STRICT_REGULATORY and WIPHY_FLAG_CUSTOM_REGULATORY --
used on cards that have an Atheros world regulatory domain. Cards
that have been programmed to follow a country specifically will not
follow the country IE power. So although not a stable fix distributions
should consider cherry picking this.

Cc: compat@orbit-lab.org
Cc: Paul Stewart <pstew@google.com>
Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Cc: Senthilkumar Balasubramanian <senthilb@qca.qualcomm.com>
Reported-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Fix a few minor issues with wmediumd_pid:
a) make static
b) use u32 to match the snd_pid type
c) use ACCESS_ONCE since we don't lock it
d) don't explicitly initialize to 0
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

its not used anywhere in the current code
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

before concluding that the recieved beacon is for us, let us make sure
that the BSSID is non-zero. when I configured ad-hoc mode as creator and
left it for some time without joining I found we recieved few frames whose
BSSID is zero, which we concluded wrongly as 'my_beacons'
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Reported-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Negate has higher precendence than compare and since neither zero nor
one are equal to four or eight the original condition is always false.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This initial DFS module provides basic functionality to deal
with radar pulses reported by the Atheros DFS HW pulse detector.

The reported data is evaluated and basic plausibility checks
are performed to filter false pulses. Passing radar pulses are
forwarded to pattern detectors which are not yet implemented.

(Some modifications to actually use ATH9K_DFS_DEBUGFS based on comments
from Julian Calaby <julian.calaby@gmail.com>. -- JWL)
Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In order to enable DFS upstream we want to be sure
DFS has been tested for each chipset. Push for public
documentation of the requirements we want in place and
allow for enabling each chipset through a single upstream
commit.
Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This can later be used by other drivers that implement
DFS support.
Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In ai_attach(), space is allocated for an si_info struct. Immediately
after the allocation, routine ai_doattach() is called and that allocated
space is set to zero. As no other routine calls ai_doattach(), kzalloc()
can be utilized.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

A debug level was added to the ath module for printing
MCI messages but no documentation was provided. Clarify that
MCI is the Message Coexistence Interface, a private protocol
used exclusively for WLAN-BT coexistence starting from
AR9462.

Cc: wtsao@qca.qualcomm.com
Cc: rmanohar@qca.qualcomm.com
Cc: mohammed@qca.qualcomm.com
Cc: senthilb@qca.qualcomm.com
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The receiver will discard them anyway.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Instead of releasing and taking back the lock over and over again in the
tx path, hold the lock a bit longer, requiring much fewer lock/unlock pairs.
This makes locking much easier to review and should not have any noticeable
performance/latency impact.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

tid->seq_next is initialized on A-MPDU start anyway, and the comment next
to this chunk of code seems to be bogus as well.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

When processing A-MPDU tx status, only send a BAR for the failed packet
with the highest sequence number.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Instead of limiting a subframe to 10 A-MPDU software transmission attempts,
count hardware retransmissions as well and raise the limit a bit. That way
there will be fewer software retransmission attempts when traffic suffers
from lots of hardware retransmissions.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

we found that power save is not getting enabled when we do
change interface in this order STA->IBSS->STA. this is
because ieee80211_setup_sdata clears type-dependent union
Reported-by: Leela Kella <leela@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Currently BAR, ADDBA and DELBA frames are always sent using AC_VO. If
the TID for which a BA session is established is assigned to a different
queue BAR, ADDBA and DELBA frames can "overtake" frames of the according
BA session.

Hence, always put BA session related frames into the same queue as the
BA sessions data frames.
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Now that IBSS no longer needs to insert stations
from atomic context, we can get rid of all the
special cases for that, and even get rid of the
sta_lock (though it needs to stay as tim_lock.)

This makes the station management code much more
straight-forward.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In order to notify drivers and simplify the station
management code, defer IBSS station insertion to a
work item and don't do it directly while receiving
a frame.

This increases the complexity in IBSS a little bit,
but it's pretty straight forward and it allows us
to reduce the station management complexity (next
patch) considerably.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

No real changes, just note that they are const.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Currently, each AP interface will send multicast
traffic if any interface has a station entry even
if that station entry is allocated only. With the
new station state management we can easily fix it
by adding a counter that counts each authorized
station only and send multicast traffic only when
the correct interface has at least one authorized
station.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Station entries can have various states, the most
important ones being auth, assoc and authorized.
This patch prepares us for telling the driver about
these states, we don't want to confuse drivers with
strange transitions, so with this we enforce that
they move in the right order between them (back and
forth); some transitions might happen before the
driver even knows about the station, but at least
runtime transitions will be ordered correctly.

As a consequence, IBSS and MESH stations will now
have the ASSOC flag set (so they can transition to
AUTHORIZED), and we can get rid of a special case
in TX processing.

When freeing a station, unwind the state so that
other parts of the code (or drivers later) can rely
on the transitions.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

There's no need to use RCU here, we can just lock
the station mutex instead. This allows the code
to sleep, which is necessary for later patches.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This is already checked in cfg80211, so no need
to repeat the checks here.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The nl80211 station handling code is a bit messy
and doesn't do a lot of validation. It seems like
this could be an issue for drivers that don't use
mac80211 to validate everything.

As cfg80211 doesn't keep station state, move the
validation of allowing supported_rates to change
for TDLS only in station mode to mac80211.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This was evidently missed in the TDLS patch (07ba55d7).

Cc: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

When compiling wl12xx for x86, there was a warning complaining about
the size of the buffer we were allocating in the stack:

drivers/net/wireless/wl12xx/debugfs.c: In function 'driver_state_read':
drivers/net/wireless/wl12xx/debugfs.c:380:1: warning: the frame size of 1040 bytes is larger than 1024 bytes

To prevent this, allocate the buffer in the heap instead.
Signed-off-by: Luciano Coelho <coelho@ti.com>