For some reason firmware is sending invalid rates when we try to
query current bitrate from ath6kl_get_station() and a warning is issued:

[ 3810.415720] ath6kl: invalid rate: 1935633515
[ 3811.105493] ath6kl: invalid rate: 1935633515
[ 3811.556063] ath6kl: invalid rate: 1935633515

As the warning happens way too often, convert the warning to a debug
message once we have a proper fix. But to make it easy to follow
how often the problem appears, add a debugfs to print
various statistics about workarounds and make this issue the first WAR.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

In some firmware versions their patch address has changed. If the firmware
provides one, use it to override the default address.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Commit 94e532d1 ("ath6kl: Fix system freeze under heavy data load")
aligns the skb data without checking if the skb is cloned. Because of
this ath6kl can corrupt the local TCP stack information that can result
in TCP retransmission failing and TCP connections stalling.

To avoid the corruption we need to copy the skb. Now the alignment
in ath6kl_htc_tx_buf_align() doesn't corrupt TCP packets anymore (and is
not even used for the cloned skb's that got copied since the alignment
of the data is handled at the copy time).
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It is unnecessary to take the first list entry from queue again for
transmission. Sometimes it may look racy when the head of the list
changes between subsequent retrival, but should not happen in
practical.
Reported-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

drivers/net/wireless/ath/ath6kl/htc_hif.o:
In function `ath6kl_debug_fwlog_event':
drivers/net/wireless/ath/ath6kl/debug.h:109:
multiple definition of `ath6kl_debug_fwlog_event'
drivers/net/wireless/ath/ath6kl/debug.o:
drivers/net/wireless/ath/ath6kl/debug.h:109: first defined here
drivers/net/wireless/ath/ath6kl/htc_hif.o:
In function `ath6kl_debug_cleanup':
drivers/net/wireless/ath/ath6kl/debug.h:118:
multiple definition of `ath6kl_debug_cleanup'
drivers/net/wireless/ath/ath6kl/debug.o:
drivers/net/wireless/ath/ath6kl/debug.h:118: first defined here
Signed-off-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Driver does not report disconnect event properly when in connecting state,
this leads to issues failures in starting reconnection. Send a disconnect
command to target when a disconnect event is received with reason code
other than 3 (DISCONNECT_CMD - disconnect request from host) to make the
frimware stop trying to connect even after giving disconnect event. There
will be one more disconnect event for this disconnect command with reason
code DISCONNECT_CMD which will be notified to cfg80211.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When pinging form ar6003 to the AP RTT was high even when power save was
disabled:

100 packets transmitted, 97 received, 3% packet loss, time 99125ms
rtt min/avg/max/mdev = 1.875/46.733/795.506/139.181 ms

After some investigation one reason for this was that received
multicast traffic confused the aggrecation logic and caused 400 ms
timeouts when receiving multicast frames from AP.

A simple way to fix is to pass only unicast frames for aggregation. This
improves RTT:

100 packets transmitted, 99 received, 1% packet loss, time 99144ms
rtt min/avg/max/mdev = 2.083/13.084/403.390/56.794 ms
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This allows RSN pre-authentication to be used when roaming decisions are
done in the target.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When the rssi of the current AP drops, both wpa_supplicant and the
firmware may do a background scan to find a better AP and try to
associate. This might lead to a race condition where both may try
to connect to some AP based on their scan results.

Since the firmware is capable of handling roaming, let
wpa_supplicant know about this capability so that it will back off
from bgscan based roaming.
Signed-off-by: NVivek Natarajan <nataraja@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Now that we allow the first Beacon frame after each connection to
be processed at the host, we can figure out the DTIM period and
expose it with Beacon interval through STA info BSS parameters
to user space.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Since we may end up using a dummy BSS entry when roaming, allow one Beacon
frame -based bssinfo from the current BSS to be processed prior to starting
to filter all bssinfo events. This allows cfg80211 BSS table to be filled
with proper data in the roaming case where the full Beacon data may not
have been present at the time of roamed event.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

There is no point in unconditionally converting the bssinfo header
to the old version since only the new header is being used and the
driver can as well read the values from it when needed. Leaving out
the conversion saves some extra memory copying.

In addition, use the calculated "rssi" value snr - 95 dBm to get the
proper value in cfg80211 BSS table (i.e., something that more or less
matches with the value used in STA info).
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Now that the scan results are reported directly to the cfg80211 BSS
table there is no need for maintaining this internal node table
implementation for scan results. Remove the definitions and node
table functions.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The internal node table in ath6kl was not really used for any useful
purpose. It was just used to collect scan results during a scan and then
provide them in a burst to cfg80211 at the completion of the scan. There
is no point in doing this since cfg80211 is perfectly capable of
maintaining the BSS table and the BSS inform messages are sent in
separate function calls anyway.

This provides more complete information in the cfg80211 BSS table since
this allows Beacon and Probe Response frames to be distinguished and IEs
from them reported separately.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Since ath6kl does not actually update cfg80211 BSS table when this
event occurs, there is not much need for removing the entries from
the internal table that is not really used or exposed.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ath6kl does not actually update cfg80211 BSS table when this update
occurs, so there is not much need in updating the internal table
that is not used or exposed.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This event has been deprecated and there is no need for ath6kl to
include code for processing it.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This fixes the BSS "update" just before the connected or roamed event.
The previous implementation was completely broken: it forced a hardcoded
signal strength and IEs from Association _Request_ frame instead of any
Beacon information. This broke various things, including PMKSA caching.

The current workaround for creating a dummy BSS entry before the roamed
event is not exactly ideal, but that is quite a bit better than the
previous state. As a future improvement, cfg80211 could potentially be
extended to allow this type of use or ath6kl could delay sending the
roamed event before receiving a BSS info event.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

We dereference "rate" on the lines before so the checks here are too
late to help.  This function is only called from
mwifiex_dump_station_info() and "rate" is always a non-NULL pointer
so the check can be removed.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We're not likely to hit this small memory leak, but lets fix it
anyway to keep the static checkers happy.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

iwl_trans_rx_alloc is only called from iwl_rx_init, so no need
to init the lists twice.
Signed-off-by: NAmit Beka <amit.beka@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

During my works on the transport layer I removed code that updated
a local variable (is_agg) that is needed to keep the pending_frames
count up to date. Fix this.

Also, there should be no way to have a packet with TX_CTL_AMPDU set
while the internal aggregation state machine is not in AGG_ON state.
Add a WARN_ON to ensure that.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This has been removed but the declaration hasn't.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This simplifies both the transport layer and the upper layer.

Kill the union in the device command, which avoids the funny syntax
we had: cmd->cmd.payload.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Before this patch, the upper layer could register a callback for each
host command. This mechanism allowed the upper layer to have
different callbacks for the same command ID. In fact, it wasn't used
and the rx_handlers is enough: same callback for all the command with
a specific command ID.

The iwl_send_add_station needs the access the command that was sent
while handling the response (regardless if the command was sent in
SYNC or ASYNC mode). So now, all the handlers receive the host
command that was sent. This implies a change in the handler signature.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If we're associated and want to do P2P at the same
time, the scan for remain-on-channel is currently
limited to 80ms because of the way the device will
behave in that case. Instead of doing that, split
up the dwell times into little pieces. It will not
actually be a single big dwell time then, but will
be close enough. This improves robustness of P2P
in such scenarios.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since the driver split there's no more need for
shared/non-shared private station data so remove
struct iwl_station_priv_common entirely.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since the driver split there's no longer a need
to have the scan code scattered across multiple
files, so move it all back to iwl-scan.c
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NWey-Yi Guy <wey-yi.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Three drivers, rtl8192ce, rtl8192cu and rtl8192de, use the same macro
to check if a particular rate is in the CCK set. This common code is
relocated to a common header file. A distinct macro used by rtl8192se
with the same name is renamed.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The various modparam messages are difficult to understand.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The various modparam messages are difficult to understand.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The various modparam messages are difficult to understand.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

CCK/OFDM noise immunilty values are always reset to defaults
during bgscan. This could affect the link quality and
performance when the STA is associated in a noisy channel.
So do not override the learned values across the scanning.
Signed-off-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

They have been taken from brcmsmac, add Broadcom's copyright.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

re-apply the unsigned shorts bug fixed by Dan Carpenter but get lost
after the file move.
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>