Parsing vndrs ie was not taking len of tlv itself in account. Setting
mgmt ie was missing check for length indicating non configured ie and
wrongly checking available length.
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
The mode should be stored and used per virtual interface. Remove
the mode from device global structure and rework the code to use
the mode from brcmf_cfg80211_vif.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This attribute indicates successful IBSS or AP connection has been
established. However, this no longer works for virtual interfaces.
As it turns out this attribute is identical to the CONNECTED bit
in struct brcmf_cfg80211_vif::sme_state. This patch removes the
attribute and rework some functions relying on it.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Add support for 4313 iPA variant.
It is a variant of already supported 4313 ePA
and needs some PHY changes to work properly.
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Move functions in
preparation for 4313iPA changes
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Put basic information about hardware in debugfs.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Acked-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcms_b_txstatus and brcms_b_recv are off by one when
doing bounds checking on number of packets to process
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcms_c_isr returns true if interrupt was for us
and if dpc should be scheduled which is the same thing.
Simplify it.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
The .tx() callback function can drop packets when there is no
space in the DMA fifo. Propagate that information to caller
and make sure the freed sk_buff reference is not accessed.
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
There are 2 different things:
- sub-menu for "Atheros Wireless cards" family
- module ath.ko with common Atheros code
Until now, they both used to depend on the same Kconfig variable ATH_COMMON.
Thus, being "Atheros card" and "depending on ath.ko" was the same.
To allow module to belong to the
"Atheros Wireless cards" family but not use ath.ko,
2 conditions above need to be separated.
So, this patch introduce new Kconfig variable ATH_CARDS for belonging
to the "Atheros Wireless Cards" family; while ATH_COMMON becomes hidden
variable to express dependency on common Atheros code in ath.ko. Modules
that depend on this common code now express it by setting ATH_COMMON.
Right now, ath6kl do not depend on common code and thus do not set ATH_COMMON.
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
'bf_next' is cleared using ATH_TXBUF_RESET() in both the
callsites of ath_tx_get_buffer().
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
The ethtool statistics are available only when
CONFIG_ATH9K_DEBUGFS is enabled, move these functions
to debug.c
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Reported-by: Petr Stetiar <ynezz@true.cz>
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This patch adds support for advertising GreenField, 40MHz intolerance
or LDPC coding support to cfg80211.
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
The commit "ath9k: stomp audio profiles on weak signal
strength" failed to take care of new stomp type while
programming concurrent tx priority. That leads to array
index out of bounds access.
drivers/net/wireless/ath/ath9k/btcoex.c:414
ath9k_hw_btcoex_set_concur_txprio()
error: buffer overflow 'stomp_txprio' 4 <= 4
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
When a BSS struct is updated, the IEs are currently
overwritten or freed. This can lead to races if some
other CPU is accessing the BSS struct and using the
IEs concurrently.
Fix this by always allocating the IEs in a new struct
that holds the data and length and protecting access
to this new struct with RCU.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Don't return a hard coded -EFAULT, but rather the error
that occurred in the flow.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Since the op_mode is leaving, the transport should set
its pointer to it to NULL to not point to freed memory.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
The FH (DMA engine) tells the driver the index of the last
ready (closed) Rx buffer. This data is in closed_rb_num.
If we read this data several times we may get inconsistencies
between the code and the debug prints which can make it
harder to debug issues here.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Due to a bug, the fw asserts on fw log stop when dbg-pins are used.
Don't stop the fw log in this case.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
We support changing the channel BW when we started the STA role on
a 40Mhz bandwidth. Otherwise a reconnection is required.
Save the started channel width and use it when channel width updates
arrive.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Allow configuring different dwell times to the different
scan types (regular and scheduled).
Add new configuration entry (dwell_time_dfs) to
conf_scan_settings, in order to allow setting
different values for normal scan and scheduled scan.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
we have done updating the driver to the new fw
api, so make the driver operational again.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
The interface might go down before we got the SCHED_STOPPED
event, so make sure to call ieee80211_sched_scan_stopped()
if the scanned interface is removed.
Replace sched_scanning with sched_vif in order to save
the scanned interface.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
In 18xx the calibration process of the PHY Cortex domain
requires to perform an active calibration of the channel
before it can be used for transmission. To fulfill world
wide regulatory restrictions, fw should be always
synchronized/updated with current CRDA configuration.
Add a new "CMD_DFS_CHANNEL_CONFIG" command to update the
fw with current reg-domain, this command passes a bit map
of channels that are allowed to be used for transmission.
The driver shall update the fw during initialization and
after each change in the current reg-domain
configuration. The driver will save the channel number of
incoming beacons during the scan process, as they might
be a result of the passive scan on
"IEEE80211_CHAN_PASSIVE_SCAN" channel and will update the
fw accordingly once the scan is finished, the purpose of
this is to be ready in case of the authentication request
on one of these disabled (uncalibrated) channels.
The new command requires to wait for the fw completion
event "DFS_CHANNELS_CONFIG_COMPLETE_EVENT".
No scan commands (including the sched scan) can be
executed concurrently with the "CMD_DFS_CHANNEL_CONFIG",
wl->mutex ensures that.
[Arik - move reset of reg_ch_conf_last to safe place inside
op_stop_locked]
[Eliad - adjust to new event waiting api]
Signed-off-by: Victor Goldenshtein <victorg@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Rename ath6kl_cleanup_vif function as 'ath6kl_cfg80211_vif_stop'
which is the more appropriate name considering the functionality
of the module and vif specific cleanup is actually done by
ath6kl_cfg80211_vif_cleanup. Also move it to cfg80211.c.
Also make ath6kl_cfg80211_sta_bmiss_enhance as static function.
This addresses a FIXME/TODO.
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Parse beacon interval from userspace to
firmware. Incase the firmware does not
supports it, just print a warning message
and continue with AP settings.
Cc: Sumathi Mandipati <sumathi@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
a minor cleanup in assigning the driver specific network type
based on interface type.
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
On continuous loading and unloading of AR6004 ath6kl USB
driver it triggers a panic due to NULL pointer dereference of
'target' pointer.
while true; do sudo modprobe -v ath6kl_core;
sudo modprobe -v ath6kl_usb; sudo modprobe -r usb;
sudo modprobe -r ath6kl_core; done
ar->htc_target can be NULL due to a race condition that can occur
during driver initialization(we do 'ath6kl_hif_power_on' before
initializing 'ar->htc_target' via 'ath6kl_htc_create').
'ath6kl_hif_power_on' assigns 'ath6kl_recv_complete' as
usb_complete_t/callback function for 'usb_fill_bulk_urb'.
Thus the possibility of ar->htc_target being NULL
via ath6kl_recv_complete -> ath6kl_usb_io_comp_work
before even 'ath6kl_htc_create' is finished to initialize
ar->htc_create.
Worth noting is the obvious solution of doing 'ath6kl_hif_power_on'
later(i.e after we are done with 'ath6kl_htc_create', causes a
h/w bring up failure in AR6003 SDIO, as 'ath6kl_hif_power_on' is a
pre-requisite to get the target version 'ath6kl_bmi_get_target_info'.
So simply check for NULL pointer for 'ar->htc_target' and bail out.
[23614.518282] BUG: unable to handle kernel NULL pointer dereference at
00000904
[23614.518463] IP: [<c012e7a6>] __ticket_spin_trylock+0x6/0x30
[23614.518570] *pde = 00000000
[23614.518664] Oops: 0000 [#1] SMP
[23614.518795] Modules linked in: ath6kl_usb(O+) ath6kl_core(O)
[23614.520012] EIP: 0060:[<c012e7a6>] EFLAGS: 00010286 CPU: 0
[23614.520012] EIP is at __ticket_spin_trylock+0x6/0x30
Call Trace:
[<c03f2a44>] do_raw_spin_trylock+0x14/0x40
[<c06daa12>] _raw_spin_lock_bh+0x52/0x80
[<f85464b4>] ? ath6kl_htc_pipe_rx_complete+0x3b4/0x4c0 [ath6kl_core]
[<f85464b4>] ath6kl_htc_pipe_rx_complete+0x3b4/0x4c0 [ath6kl_core]
[<c05bc272>] ? skb_dequeue+0x22/0x70
[<c05bc272>] ? skb_dequeue+0x22/0x70
[<f855bb32>] ath6kl_core_rx_complete+0x12/0x20 [ath6kl_core]
[<f848771a>] ath6kl_usb_io_comp_work+0xaa/0xb0 [ath6kl_usb]
[<c015b863>] process_one_work+0x1a3/0x5e0
[<c015b7e7>] ? process_one_work+0x127/0x5e0
[<f8487670>] ? ath6kl_usb_reset_resume+0x30/0x30 [ath6kl_usb]
[<c015bfde>] worker_thread+0x11e/0x3f0
Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
dev_kfree_skb kernel API itself takes for checking for NULL
skb, so an explicit check is not required.
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Assign 'true' to the bool variable instead of needless typecasting.
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
WLAN_ENABLED is vif specific, not part of
the driver's struct ath6kl. Proper clearing
of this flag is already taken care in
ath6kl_cleanup_vif.
Cc: wei-jen jlin <jenlin@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
A new session_id is generated on link allocation.
it is saved in a global array and used later, on tx.
The new fw api adds new bcast/global_session_id
fields to start_role(ap) command, and a new session_id
field to add_peer command. align the driver with it.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
New fields were added to start_role(ap) and
set_peer_state commands, so the fw will be
able to know whether the sta/ap supports
wmm (the fw uses it in order to choose the
AC for some of its internally-generated frames)
For sta, take this value right from bss_conf->qos.
For ap, check for wmm support by looking for the
WMM IE in the configured beacon.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
The event mailbox in wl18xx has a different
(non-compatible) structure.
Create common functions in wlcore to handle the
events, and call them from the chip-specific
event mailbox parsers.
This way, each driver (wl12xx/wl18xx) extracts
the event mailbox by itself according to its
own structure, and then calls the common
wlcore functions to handle it.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Some fields were added to the channel_switch and
stop_channel_switch commands. Unfortunately,
the new 18xx channel_switch struct is not backward
compatible with the 12xx channel switch struct.
Add a new channel_switch op to wlcore, and update
the driver accordingly.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Some regdomains have more than 23 valid 5ghz channels,
so 18xx's MAX_CHANNELS_5GHZ was increased to 32.
Since now we have different max 5ghz channels values
for wl12xx and wl18xx, add a new wl->max_channels_5ghz
field, and use it for scan channels configuration.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
The scan APIs of 12xx and 18xx are totally different.
Use some common functions as much as possible (e.g.
for setting scan channels), but split scan.c into
chip-specific scan.c files, each implementing its
own scan mechanism.
(in other words - move most of the current wlcore's
scan.c into wl12xx, and implement a similar mechanism
in 18xx, according to the new api)
New wlcore ops are introduced in order to call the
chip-specific scan functions.
The template indices used for each scan (regular/scheduled)
are also different between the chips, so set the correct
indices used for each scan type after identifying the chip.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
The new fw (8.5.0.0.28) is not backward compatible
with older drivers.
Use a new fw name (along with bumping the min
fw version), and add some code to fail
any boot attempt during the fw api alignment
patches (as the driver is not functional in
these transitional patches).
This code will be removed after the api alignment
will be done.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
18xx and 12xx have different scan APIs. In 18xx,
the scan and the sched scan use the same struct.
Prepare the scan configuration functions to it, by taking
more generic params (e.g. ieee80211_channel) instead of
specific structs/requests.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
When we stop sched scan during connection, we shouldn't
call ieee80211_sched_scan_stopped directly, but do it
in the normal flow, as part of the SCHED_SCAN_COMPLETED
event handling.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Remove goto and label in the code where a simple if can be used. If
nothing else, this is at least confusing git diff, which shows the
label name as the name of the function.
Signed-off-by: Luciano Coelho <coelho@ti.com>
