The PCI-based drivers can generate the following warning:

[ 9497.776350] ------------[ cut here ]------------
[ 9497.776366] WARNING: at kernel/softirq.c:159 local_bh_enable_ip+0x7a/0xa0()
[ 9497.776370] Hardware name: 05794NC
[ 9497.776597] Pid: 6413, comm: hostapd Not tainted 3.3.0-4.fc16.x86_64 #1
[ 9497.776601] Call Trace:
[ 9497.776612]  [<ffffffff81057b1f>] warn_slowpath_common+0x7f/0xc0
[ 9497.776633]  [<ffffffffa034a099>] ? rtl_pci_reset_trx_ring+0x199/0x230
[rtlwifi]
[ 9497.776640]  [<ffffffff81057b7a>] warn_slowpath_null+0x1a/0x20
[ 9497.776646]  [<ffffffff8105f06a>] local_bh_enable_ip+0x7a/0xa0
[ 9497.776654]  [<ffffffff815f3ef6>] _raw_spin_unlock_bh+0x16/0x20
[ 9497.776671]  [<ffffffffa03e50de>] destroy_conntrack+0x9e/0x120
[nf_conntrack]
[ 9497.776681]  [<ffffffff81511847>] nf_conntrack_destroy+0x17/0x20
[ 9497.776689]  [<ffffffff814d9c85>] skb_release_head_state+0xe5/0x120
[ 9497.776695]  [<ffffffff814d98b6>] __kfree_skb+0x16/0xa0
[ 9497.776700]  [<ffffffff814d9a35>] kfree_skb+0x45/0xc0
[ 9497.776717]  [<ffffffffa034a099>] rtl_pci_reset_trx_ring+0x199/0x230
[rtlwifi]
[ 9497.776734]  [<ffffffffa034a155>] rtl_pci_start+0x25/0x1d0 [rtlwifi]
[ 9497.776750]  [<ffffffffa03440b5>] rtl_op_start+0x55/0x90 [rtlwifi]
[ 9497.776785]  [<ffffffffa02c4956>] ieee80211_do_open+0x296/0xa10 [mac80211]
[ 9497.776794]  [<ffffffff815f7ddd>] ? notifier_call_chain+0x4d/0x70
[ 9497.776828]  [<ffffffffa02c513d>] ieee80211_open+0x6d/0x80 [mac80211]
[ 9497.776836]  [<ffffffff814e8b3f>] __dev_open+0x8f/0xe0
[ 9497.776842]  [<ffffffff814e8de1>] __dev_change_flags+0xa1/0x180
[ 9497.776847]  [<ffffffff814e8f78>] dev_change_flags+0x28/0x70
[ 9497.776856]  [<ffffffff8154e99d>] devinet_ioctl+0x61d/0x7b0
[ 9497.776863]  [<ffffffff8154ef55>] inet_ioctl+0x75/0x90
[ 9497.776870]  [<ffffffff814cdd50>] sock_do_ioctl+0x30/0x70
[ 9497.776876]  [<ffffffff814cee09>] sock_ioctl+0x79/0x2f0
[ 9497.776885]  [<ffffffff81193498>] do_vfs_ioctl+0x98/0x550
[ 9497.776891]  [<ffffffff811939e1>] sys_ioctl+0x91/0xa0
[ 9497.776897]  [<ffffffff815fc029>] system_call_fastpath+0x16/0x1b
[ 9497.776902] ---[ end trace 22886c442489082d ]---

The cause is due to calling kfree_skb() with interrupts disabled.

This bug is discussed in https://bugzilla.redhat.com/show_bug.cgi?id=797709.

Reported-and-Tested by: Ivan Ivanovich <iivanich@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ieee80211_check_concurrent_iface() need not use the
netdev. Remove the use of the netdev here to prepare
the function for P2P device addition.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Remove the unused function is_ieee80211_device().
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Support configuring an RSSI threshold in dBm (s32) when requesting
scheduled scan, below which a BSS won't be reported by the cfg80211
driver.
Signed-off-by: Thomas Pedersen <c_tpeder@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

The code is fine in both cases as-is, but we can
write it slightly differently to fix smatch/sparse
complaints:
 * compare the skb pointer (which we use as a cookie)
   by casting the skb to unsigned long rather than the
   cookie to a pointer (fixes "different address spaces")
 * when transmitting, data->channel must be assigned,
   don't check it (fixes "dereferenced before check")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

It can be very useful to have all debug messages
available when debugging, but hard to correlate
between different sources, so add a trace event
for all mac80211 debug messages.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

This file will contain more soon, so
rename it to just trace.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

There are a few things that make the logging and
debugging in mac80211 less useful than it should
be right now:
 * a lot of messages should be pr_info, not pr_debug
 * wholesale use of pr_debug makes it require *both*
   Kconfig and dynamic configuration
 * there are still a lot of ifdefs
 * the style is very inconsistent, sometimes the
   sdata->name is printed in front

Clean up everything, introducing new macros and
separating out the station MLME debugging into
a new Kconfig symbol.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

When running in AP mode, the driver reports all deletions from CAM in
a cryptic manner that makes users think it is an error. change so that
the condition is only reported at higher-levels of debugging.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/ath/ath9k/ar9003_phy.c:211
ar9003_hw_spur_mitigate_mrc_cck() error: potential NULL dereference
'spur_fbin_ptr'.
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Rename mrcCCKOff for better code readability and also fixes
the smatch warning.

drivers/net/wireless/ath/ath9k/ar9003_phy.c:982
	ar9003_hw_ani_control() Error invalid range 1 to 0.
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In the function brcms_c_regd_init() the channels are validated
against the device capabilities. This is done for both 2.4G and
5G band, but there are devices that are 2.4G only, ie. BCM4313.
For that device this leads to a NULL dereference. This patch adds
a check in brcms_c_regd_init() to fix this.

Issue introduced in wireless-next tree by following commit:
cf03c5da brcm80211: smac: inform mac80211 of the X2 regulatory domain

Cc: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This patch fixes problem detected in linux-next build for powerpc
allyesconfig. The error message below is no longer observed:

  CC      drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.o
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c: In function 'brcmf_sdio_dump_console':
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c:3085: error: implicit declaration of function 'vzalloc'
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c:3085: warning: assignment makes pointer from integer without a cast
drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c:3113: error: implicit declaration of function 'vfree'
make[2]: *** [drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.o] Error 1
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

FW will not explicitly notify about host sleep activation to the
host for USB and PCIe chipsets. Hence host should generate Host
Sleep Activated event as soon as Host Sleep parameters are
configured to FW successfully.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This is a flaw in recently implemented logic to handle Tx traffic
and scan operation simultaneously. We missed to wakeup main thread
to handle Tx traffic if scan is delayed/aborted.

For some cards (SD8797, for example), firmware will send SLEEP event
if there is no activity for 50msec. While handling the SLEEP event,
main thread will be woken up and Tx packet gets sent hence. In worst
case Tx traffic will be delayed for 50msec.

For other cards, such as USB8797, firmware won't send SLEEP event.
So, Tx traffic gets stuck if no other event triggers the wakeup of
main thread.

This patch fixes above issues.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Add support for parsing WPA IE from beacon parameter of
cfg80211_ap_settings and set it to FW.

WPA/WPA2 mixed mode is supported with this patch.
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Kiran Divekar <dkiran@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

For better debugging, we would like to have
the sdata pointer available later, so pass
it into these functions.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Two instances of CONFIG_MAC80211_VERBOSE_DEBUG
should be different, fix them.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

The TKIP code hasn't been changed in a very long
time, so it seems unlikely that anyone really has
a need for the TKIP debug code. Remove it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

WMM and WPS
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Get current rssi (in dBm) from the driver/FW.

Instead of reporting the signal received in the last
rx packet, which might be inaccurate if rx traffic is
low and beacon filtering is enabled, get the signal
from the driver/FW.
Signed-off-by: Victor Goldenshtein <victorg@ti.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Conflicts:
	drivers/net/wireless/ti/wl18xx/main.c

After 934b9d1e (wl18xx: avoid some -Wformat warnings) there was still
a warning with (at least) ARM gcc version 4.4.1:

drivers/net/wireless/ti/wl18xx/main.c: In function 'wl18xx_conf_init':
drivers/net/wireless/ti/wl18xx/main.c:1026: warning: format '%ld' expects type 'long int', but argument 2 has type 'unsigned int'

Fix this by using %zu for the both formats, since the fw->size and the
macro (derived from sizeof()) are size_t.
Signed-off-by: Luciano Coelho <coelho@ti.com>

Remove the cap IEEE80211_HT_CAP_DSSSCCK40 from the 5Ghz variant of
the siso40 HT capabilities. It is meaningless in 5Ghz.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

Introduce a default set of HT capabilities that are set according to the
number of antennas on the board. Move the HT setting code down to allow
the number of antennas to be set (and optionally overridden) before it.

Remove the "mimo" HT option, since the default mode now enables MIMO is
possible.

Use this opportunity to add a helper function for setting HT
capabilities and reduce the volume of the code a bit.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

The 18xx chip does not support MIMO in 5Ghz. Use the siso20 HT cap as
fallback in 5Ghz when "mimo" is requested.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

FW uses a few memory blocks as a buffer to accumulate FW logs before
transmitting them to the host over SDIO. When FW WatchDog recovery
occurs, the last FW traces are still pending in the buffer. Driver is
to read these FW traces whether log mode is continuous or on demand.

FW memory blocks allocated for the log buffer are handled as a link list:
the first 4 bytes in each memory block contain FW address to the next block.
The end of list condition depends on FW log mode:
- on demand: the list is cyclic, the next address is equal to the first address
- continuous: the address is  equal to 0x2000000

Log data resides inside FW memory block with offset depending on
logger mode:
- on demand:  4 bytes (address of the next memory block)
- continuous: 4 bytes and Rx Descriptor structure size

Described FW logger API is backward compatible with previous FW versions.
Signed-off-by: Igal Chernobelsky <igalc@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

The get survey op expects the low level driver to report
the noise level for a a given channel.

The noise calculated in wlcore is (rssi-snr/2), but since
the snr reported by the FW is a derivative from the rssi
this calculation is useless, and should not be reported
to the user space.

Reporting incorrect noise, results in the wpa_supplicant
miscalculating the roaming candidate priority, thus causing
a situation where an AP with a lower rssi level would be
chosen over a better AP.
Signed-off-by: Yoni Divinsky <yoni.divinsky@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

Before patch b5d6d9b (wlcore/wl12xx/wl18xx: don't use TX align quirk
for wl127x), this was automatically set for all platforms. As this
should now be set explicitly, set it for PG2 as well.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

New PG2 firmwares have additional Rx descriptors.

Add a module parameter to manually set the number of Rx descriptors for
older versions (PG1). We cannot discriminate based on chip-id, since
this value must be set on probe.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

The sleep_auth value of the last interface to be set up prevailed when
an interface was removed. Take care of this by correctly configuring the
value according to the remaining STA/AP interfaces.

Take this opportunity to refactor the sleep_auth setting code for better
readability.

[Small style fix. -- Luca]
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

Hold a value for sta_sleep_auth that is amenable to change by debugfs.
When detecting a legal value in this variable on interface init, use it
as an override value for sleep_auth.

This makes debugging more intuitive using the debugfs value.

Increment the conf version since we added an element to the conf
structure.

Note: An AP going up will always set sleep_auth to PSM_CAM.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

For FW debugging purposes, we may need to change the sleep mode
(aka. sleep_auth) by hand, and set it to the mode we want.  To allow
this, a debugfs entry is added.

Now we store the sleep_auth value that has been set and use that
instead of the quirk to decide whether we should enter ELP or not.
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>

The ampdu_action() function is called on the reconfig() path to remove
existing Rx BA sessions. Since these don't exist for the low level
driver, we output an error message. Turn the message into a debug
message for now, until the mac80211 reconfig flow is changed.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

Currently when mac80211 asks to change the interface
type, we will accept it for both the BSS and PAN
contexts. This is not terribly complicated today,
but with the addition of the P2P Device abstraction
the PAN context handling will get more complex, so
restrict mac_change_interface to the BSS context.

Also fix a small locking issue and use is_active
instead of the vif pointer to check if the other
context is activated, guarding exclusive interface
types on the BSS context (IBSS) against the PAN
context being used for something else.
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

When the first interface is active, then scanning
on it or the second interface can take a little
longer than 7s (I observed around 8s.) Bump the
timeout to 15s to avoid aborting a scan that is
still running, just taking more time.
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>