Rate control algorithms are supposed to stop processing when they
encounter a rate with the index -1.  Checking for rate->count not being
zero is not enough.

Allowing a rate with negative index leads to memory corruption in
ath_debug_stat_rc().

One consequence of the bug is discussed at
https://bugzilla.redhat.com/show_bug.cgi?id=768639Signed-off-by: NPavel Roskin <proski@gnu.org>
Cc: stable@vger.kernel.org
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Booleans should not be compared to true or false
but be directly tested or tested with !.

Done via cocci script:

@@
bool t;
@@
- t == true
+ t
@@
bool t;
@@
- t != true
+ !t
@@
bool t;
@@
- t == false
+ !t
@@
bool t;
@@
- t != false
+ t
Signed-off-by: NJoe Perches <joe@perches.com>
Reviewed-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If the firmware was over 2G, it would cause memory corruption and the
system would die here.  Obviously we all know the firmware isn't going
to be that large but static checkers get upset.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

commit adb5066a "ath9k_hw: do not apply the 2.4 ghz ack timeout
workaround to cts" reduced the hardware CTS timeout to the normal
values specified by the standard, but it turns out while it doesn't
need the same extra time that it needs for the ACK timeout, it
does need more than the value specified in the standard, but only
for 2.4 GHz.

This patch brings the CTS timeout value in sync with the initialization
values, while still allowing adjustment for bigger distances.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Reported-by: NSeth Forshee <seth.forshee@canonical.com>
Reported-by: NMarek Lindner <lindner_marek@yahoo.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

commit b4a82a0 "ath9k_hw: fix interpretation of the rx KeyMiss flag"
fixed the interpretation of the KeyMiss flag for keycache based lookups,
however WEP encryption uses a static index, so KeyMiss is always asserted
for it, even though frames are decrypted properly.
Fix this by clearing the ATH9K_RXERR_KEYMISS flag if no keycache based
lookup was performed.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Reported-by: NLaurent Bonnans <bonnans.l@gmail.com>
Reported-by: NJurica Vukadin <u.ra604@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

all works need to be initialized before ieee80211_register_hw
to prevent mac80211 call backs such as drv_start, drv_config
getting started. otherwise we would queue/cancel works before
initializing them and it leads to kernel panic.
this issue can be recreated with the following script
in Chrome laptops with AR928X cards, with background scan
running (or) Network manager is running

while true
do
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3
done

	 EIP: [<81040a47>] __cancel_work_timer+0xb8/0xe1 SS:ESP 0068:f6be9d70
	 ---[ end trace 4f86d6139a9900ef ]---
	 Registered led device: ath9k-phy0
	 ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xf88a0000,
	 irq=16
	 Kernel panic - not syncing: Fatal exception
	 Pid: 456, comm: wpa_supplicant Tainted: G      D
	 3.0.13 #1
	Call Trace:
	 [<81379e21>] panic+0x53/0x14a
	 [<81004a30>] oops_end+0x73/0x81
	 [<81004b53>] die+0x4c/0x55
	 [<81002710>] do_trap+0x7c/0x83
	 [<81002855>] ? do_bounds+0x58/0x58
	 [<810028cc>] do_invalid_op+0x77/0x81
	 [<81040a47>] ? __cancel_work_timer+0xb8/0xe1
	 [<810489ec>] ? sched_clock_cpu+0x81/0x11f
	 [<8103f809>] ? wait_on_work+0xe2/0xf7
	 [<8137f807>] error_code+0x67/0x6c
	 [<810300d8>] ? wait_consider_task+0x4ba/0x84c
	 [<81040a47>] ? __cancel_work_timer+0xb8/0xe1
	 [<810380c9>] ? try_to_del_timer_sync+0x5f/0x67
	 [<81040a91>] cancel_work_sync+0xf/0x11
	 [<f88d7b7c>] ath_set_channel+0x62/0x25c [ath9k]
	 [<f88d67d1>] ? ath9k_tx_last_beacon+0x26a/0x85c [ath9k]
	 [<f88d8899>] ath_radio_disable+0x3f1/0x68e [ath9k]
	 [<f90d0edb>] ieee80211_hw_config+0x111/0x116 [mac80211]
	 [<f90dd95c>] __ieee80211_recalc_idle+0x919/0xa37 [mac80211]
	 [<f90dda76>] __ieee80211_recalc_idle+0xa33/0xa37 [mac80211]
	 [<812dbed8>] __dev_open+0x82/0xab

Cc: <stable@vger.kernel.org>
Cc: Gary Morain <gmorain@google.com>
Cc: Paul Stewart <pstew@google.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Tested-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The device seems to survive the issue, so no need to flood the logs
about it...
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

ath6kl: initialize the 'nominal_phy' field in the 'wmi_create_pstream_cmd' struct for create_qos command

The nominal_phy field is uninitialized. Initialize it to min_phy_rate for
create_qos.

kvalo: simplified the equation as checkpatch complained for a too long line
Signed-off-by: NChilam Ng <chilamng@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Both Luis and John reported that they see a compiler warning:

drivers/net/wireless/ath/ath6kl/init.c: In function 'ath6kl_init_hw_params':
drivers/net/wireless/ath/ath6kl/init.c:1377:26: warning: ‘hw’
may be used uninitialized in this function

Oddly enough I have never seen it. But AFAICT the code is correct and
hw is not used uninitalized so add uninitialized_var() to inform that to
the compiler.
Reported-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Reported-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Correct spelling "spported" to "supported" in
drivers/net/wireless/ath/ath6kl/cfg80211.c
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

alloc failures use dump_stack so emitting an additional
out-of-memory message is an unnecessary duplication.

Remove the allocation failure messages.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Set the host pm flag MMC_PM_WAKE_SDIO_IRQ to allow host
to disable the sdc2_clk and sdc2_h_clk,so that the MSM device
enter into TCXO shutdown.
Signed-off-by: NSantosh Sajjan <ssajjan@codeaurora.org>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

channelFlags doesn't contain the operating HT mode.
Use IS_CHAN_HT40 to determine if the current channel is
in HT40 mode.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch modifies ath9k_htc to load the needed
firmware in an asynchronous manner, fixing timeouts
that were introduced with the new udev changes.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Error code ENOTCONN is more suitable than EINVAL to report
when the driver is not in connected state in ath6kl_wow_suspend().

I found this during code review.
Signed-off-by: NRaja Mani <rmani@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

For every WMI_SET_HOST_SLEEP_MODE_CMDID command (send from the host),
the firmware sends WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENTID as
an acknowledgement to the host.

In order to being sync with the firmware, the host has to wait for
WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENT event before going to
the suspend state. This patch ensures ath6kl_wow_suspend() waits
until it gets this event after sending set host sleep mode command.

This patch adds,
 * New command WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENTID in
   WMI event table.
 * New WMI function ath6kl_wmi_host_sleep_mode_cmd_prcd_evt_rx()
   to process the event.
 * New flag HOST_SLEEP_MODE_CMD_PROCESSED in VIF flags to record
   the arrival of the event.
Signed-off-by: NRaja Mani <rmani@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

First preference is given to the user configured WOW patterns.
If the user doesn't configure any patterns (for ex, via iw command),
the default patterns will be configured based on the current mode
(vif->nw_type) while going to WOW suspend.

Summary of changes:

  * ath6kl_wow_ap() is added to configure the below default
    patterns when the system enters into WOW suspend in AP mode.
      + Unicast IP, EAPOL-like and ARP packet pattern
      + ARP packet pattern
      + mDNS/SSDP/LLMNR pattern
      + DHCP broadcast pattern

 * ath6kl_wow_sta() is added to configure the below default
   patterns when the system enters into WOW suspend in STA mode.
      + Unicast packet pattern
      + mDNS/SSDP/LLMNR pattern

  * Move the user provided WOW patterns configuration code
    from ath6kl_wow_suspend() to a separate function called
    ath6kl_wow_usr().

  * Two argument variable's ('filter' and 'mask) data type in
    ath6kl_wmi_add_wow_pattern_cmd() are changed from 'u8 *' to
    'const u8 *'. This is needed to make all pattern and mask
    arrays to be 'static const u8' in the caller function.

  * New conditional check is added to make sure user
    configured pattern count is within the limit (WOW_MAX_FILTERS_PER_LIST).
Signed-off-by: NRaja Mani <rmani@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Using this patch, the user can bypass existing auto
suspend mode selection logic and force ath6kl to enter
into the suspend mode what he/she wants.

If the user doesn't choose any suspend mode while doing
insmod of the driver, auto suspend mode selection logic
will kick in and choose suspend mode based on the host
SDIO controller capability.

Generic module parameter is required to specify suspend
mode including Deep Sleep and WOW while doing insmod.
Renaming existing mod param variable suspend_cutpower
would be sufficient to meet this requirement.

New module parameter suspend_mode can take any one of
the below suspend state,
   1. cut power
   2. deep sleep
   3. wow
Signed-off-by: NRaja Mani <rmani@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

"ath6kl: Define a structure for connection specific aggregation information"
introduces this. In aggr_conn_init(), vif->aggr_cntxt is assigned to
aggr_conn->aggr_info, but vif->aggr_cntxt is not initialized at this
point, this would end up accessing an invalid pointer in aggregation
receive path. Fix this by passing the correct aggr_info to aggr_conn_init().
The panic trace would look like.

[<ffffffff8159e02e>] panic+0xa1/0x1c6
[<ffffffff8103773d>] ? kmsg_dump+0xfd/0x160
[<ffffffff815a2f6a>] oops_end+0xea/0xf0
[<ffffffff8102b95d>] no_context+0x11d/0x2d0
[<ffffffff8102bc5d>] __bad_area_nosemaphore+0x14d/0x230
[<ffffffff815a5c4d>] ? do_page_fault+0x30d/0x520
[<ffffffff8102bd53>] bad_area_nosemaphore+0x13/0x20
[<ffffffff815a5cfd>] do_page_fault+0x3bd/0x520
[<ffffffff8108bd60>] ? __lock_acquire+0x320/0x1680
[<ffffffff812e3a9d>] ? trace_hardirqs_off_thunk+0x3a/0x3c
[<ffffffff815a2385>] page_fault+0x25/0x30
[<ffffffffa0487a5f>] ? aggr_slice_amsdu+0xdf/0x170 [ath6kl_core]
[<ffffffffa0487bac>] aggr_deque_frms+0xbc/0x190 [ath6kl_core]
[<ffffffffa0488404>] ath6kl_rx+0x3e4/0xae0 [ath6kl_core]
[<ffffffffa047ae77>] ath6kl_htc_rxmsg_pending_handler+0x8b7/0xf10 [ath6kl_core]
[<ffffffffa00c82f0>] ? mmc_do_release_host+0x70/0x90 [mmc_core]
[<ffffffffa00c833a>] ? mmc_release_host+0x2a/0x50 [mmc_core]
[<ffffffffa04865c0>] ? ath6kl_alloc_amsdu_rxbuf+0x140/0x140 [ath6kl_core]
[<ffffffffa0477772>] ath6kl_hif_intr_bh_handler+0x362/0x510 [ath6kl_core]
[<ffffffffa01f1000>] ath6kl_sdio_irq_handler+0x60/0xb0 [ath6kl_sdio]
[<ffffffffa00d30bc>] sdio_irq_thread+0xec/0x320 [mmc_core]
[<ffffffffa00d2fd0>] ? sdio_claim_irq+0x220/0x220 [mmc_core]
[<ffffffffa00d2fd0>] ? sdio_claim_irq+0x220/0x220 [mmc_core]
[<ffffffff8105b21e>] kthread+0xbe/0xd0
[<ffffffff815ab574>] kernel_thread_helper+0x4/0x10
[<ffffffff815a2174>] ? retint_restore_args+0x13/0x13
[<ffffffff8105b160>] ? __init_kthread_worker+0x70/0x70
[<ffffffff815ab570>] ? gs_change+0x13/0x13
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Testmode (TCMD and ART) was not enabled when fw-2.bin or fw-3.bin files
were available, fix that by fetching testmode file just after the
board file but before rest of the firmware files are fetched.

I also added testmode field to struct ath6kl and moved the module parameter
to core.c. Now all module parameters are grouped in one place.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The device seems to survive the issue, so no need to flood the logs
about it...
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch implements a simple way of reducing the
output power of the device by a configurable upper
limit.
Requested-by: NHarshal Chhaya <harshal@gmail.com>
Signed-off-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Avoids this:

  CC [M]  drivers/net/wireless/ath/ath5k/base.o
drivers/net/wireless/ath/ath5k/base.c: In function ‘__check_no_hw_rfkill_switch’:
drivers/net/wireless/ath/ath5k/base.c:85:1: warning: return from incompatible pointer type
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Skip group keys configuration in hardware in order to make IBSS RSN work.
Keys will be managed using software.
Signed-off-by: NAntonio Quartulli <ordex@autistici.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Disable group keys programming when using IBSS RSN. Keys will be managed using
software. In this way IBSS RSN can correctly work.
Signed-off-by: NAntonio Quartulli <ordex@autistici.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In the early days, this was a quite useful software
feature for testing different regdomains and chain
configurations without adding debugfs cruft into
the driver. Nowadays, the driver's phy code seems
to be stable and there's no need for it anymore.
Therefore I decided to removed altogether.
Signed-off-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On carl9170, HW encryption is disabled on IBSS; the mac80211
software-based encryption is used instead. As mac80211 supports IBSS
RSN (per-STA GTK), claim its support in the carl9170 PHY.
Signed-off-by: NNicolas Cavallari <cavallar@lri.fr>
Acked-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently rx aggregation related states are maintained per
vif, but this will not properly work when operating in AP mode.
Aggregation is completely broken when more than one
11n stations are connected to AP mode vif. Fix this issue
by keeping station specific aggregation state in sta_list.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The tid which is given in addba/delba req event is not
just tid but also muxed with the assoc id (MSB 4 bits)
which can be used to determine the corresponding connected
station in softap mode. The actual tid is LSB 4 bits. Using
the tid as it is with rx_tid[] would result in OOB or invalid
memory access in AP mode.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This will be used when initializing station specific aggregation
information.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This patch just groups connection specific aggregation information
from struct aggr_info into a new structure (struct aggr_info_conn)
so that, in softAP mode, this can be used when each connected station
is made to have it's own aggregation state.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The patch "ath6kl: create core.c" removes wiphy_free() from
ath6kl_cfg80211_cleanup() and misses to free wiphy in
ath6kl_sdio_remove(). This patch fixes this regression.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The timer which is used to flush rx aggregation frames needs to
be disabled when resetting the aggregation state. This is found
in code review.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

John Linville had to revert the part of USB support which was already
in ath6kl due to build problems in commit cb00ec38 ("ath6kl: revert
USB support"). Now that I fixed the build problems properly by adding
ath6kl_core.ko kernel module it's possible to add back the
(incomplete) USB support. This patch is a revert of John's patch and
adds back the USB code which as already in ath6kl, only difference
being minor changes in Makefile and adapting usb.c to new core
function names.

Note that USB support in ath6kl is not complete yet. This code only
makes it possible to boot firmware but as HTC layer does not yet
support USB it's not possible to send any WMI commands nor data
packets to the firmware. That will be added soon.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Now ath6kl is ready for splitting core code to ath6kl_core.ko module.
This also makes it possible to link both sdio and usb code to kernel
at the same time, which earlier failed miserably.
Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

That way it's possible to not export debug_mask outside the upcoming
ath6kl_core.ko and that makes it easier to ath6kl_core.ko in the
following patch.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

We don't need it as debug calls already have a log level and compiler
should be smart enough to optimise away the code when ath6kl debug code
is not enabled. Also it makes it easier to abstract core code to
ath6kl_core.ko.

In ath6kl_dump_registers() I had to change the debug level from ANY to IRQ
as I removed the AR_DBG_LVL_CHECK() check before calling the function.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Currently core functions are spread between various files, group all
the functions into file and rename the functions to follow the style
used elsewhere in the driver. This will make it easier to a separate core
module.

Also fix a bug where wiphy is freed too early.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Add ATH6KL_CONF_UART_DEBUG which is set whenever uart_debug module
parameter is enabled. This way we can keep the uart_debug parameter
static when core.c file is introduced.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Group them together and change the naming to follow the common style in
ath6kl. No functional changes.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>