When one client is associated and connected to an ar6003 hw version
2.0 with firmware 3.1.1.149, and another client tries to connect, the
first client's MAC address is lost in the station list because the
"aid" is always "1".  The structure "wmi_connect_event" has the "aid"
as the second byte in the message, but it should be the first byte.

This patch has been tested with linux-3.10.40
Signed-off-by: NBrent Taylor <motobud@gmail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Found during code review. This was pretty much
impossible to happen but better safe than sorry.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

In the midst of chanctx patch review channel
switching became broken which I failed to notice
until now.

Function ath10k_mac_vif_chan() reports current
chandef which isn't updated until after
switch_vif_chanctx() is returned from.
Consequently the driver just restarted operation
on channels it was residing already instead of
switching to the new ones.

Fixes: 500ff9f9 ("ath10k: implement chanctx API")
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

In practice there's no point in having a copy of
chanctx_conf.

Most of the time the channel pointer (and band
along with it) is accessed and this can't change
after a chanctx is created because switching is
done using explicit chanctx swapping via
switch_vif_chanctx().

The only thing that can change within a
chanctx_conf and is used by the driver is
radar_enabled and channel width. These are however
always accessed in adequate mac80211 callback
context which guarantees safe access to the
chanctx data.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Channel contexts aren't iterable until after
they've been added to the driver. The code assumed
otherwise.

This problem could result in:

 * rx_channel being NULL and forcing Rx path to go
   the slow way to get channel on QCA988X,

 * report incorrect channel when running
   multi-channel on QCA61X4 hw2.1,

 * report incorrect channel after AP channel
   switch.

Fixes: 500ff9f9 ("ath10k: implement chanctx API")
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

mete_data is extracted from ce descriptor and stored in variable 'id'.
later, id is not used anywhere in the same function.

Fixes: d84a512d ("ath10k: remove transfer_id from ath10k_hif_cb::tx_completion")
Signed-off-by: NRaja Mani <rmani@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When wmi mgmt event function fails to parse given skb,
it should be freed on failure condition to avoid memory
leaks. Found this during the code review.
Signed-off-by: NRaja Mani <rmani@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

If probing failed pci sleep timer could remain
running and trigger after ath10k structures were
freed causing invalid pointer dereference:

 BUG: unable to handle kernel paging request at ffffc90001c80004
 IP: [<ffffffff81354728>] iowrite32+0x38/0x40
 ...
 Call Trace:
  <IRQ>
  [<ffffffffa00da048>] ? __ath10k_pci_sleep+0x48/0x60 [ath10k_pci]
  [<ffffffffa00da44e>] ath10k_pci_ps_timer+0x5e/0x80 [ath10k_pci]
  [<ffffffff810b210e>] call_timer_fn+0x3e/0x120
  [<ffffffffa00da3f0>] ? ath10k_pci_wake+0x150/0x150 [ath10k_pci]
  [<ffffffff810b3d11>] run_timer_softirq+0x201/0x2e0
  [<ffffffff8105d73f>] __do_softirq+0xaf/0x290
  [<ffffffff8105da95>] irq_exit+0x95/0xa0
  [<ffffffff81950406>] smp_apic_timer_interrupt+0x46/0x60
  [<ffffffff8194e77e>] apic_timer_interrupt+0x6e/0x80

Fixes: 77258d40 ("ath10k: enable pci soc powersaving")
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Some of of qca988x solutions are having global reset issue
during target initialization. Bypassing PLL setting before
downloading firmware and letting the SoC run on REF_CLK is fixing
the problem. Corresponding firmware change is also needed to set
the clock source once the target is initialized. Since 10.2.4
firmware is having this ROM patch, applying skip_clock_init only
for 10.2.4 firmware versions.
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This could lead userspace initram images getting
built without necessary firmware files included
leading to probing failures of ath10k on boot with
QCA61X4.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

In some cases some channel survey data was
reported incorrect.

Channel info events were expected to come in pairs
without and with COMPLETE flag set respectively
for each channel visit during scan.

The known deviation from this is rule for last
scan chan info and first (next) scan chan info
both have COMPLETE flag set. This was either
programmed with the intent of providing BSS cycle
count info or this is an artefact of firmware scan
state machine. Either way this is useless due to
short wraparound time, wraparound quirks and no
overflow notification.

Survey dumps now include only data gathered during
scan channel visits that can be computed
correctly.

This should improve hostapd ACS a little bit.
Reported-by: NSrinivasa Duvvuri <sduvvuri@chromium.org>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When QCA988X cycle counter HW register wraps
around it resets to 0x7fffffff instead of 0. All
other cycle counter related registers are divided
by 2 so they never wraparound themselves. QCA61X4
has a uniform CC and it wraparounds in a regular
fashion though.

Worst case wraparound time is approx 24 seconds
(2**31 / 88MHz). Since scan channel visit times
are max 5 seconds (offchannel case) it is
guaranteed there's been at most 1 wraparound and
it is possible to compute survey active time
value. It is, however, impossible to determine the
point at which Rx Clear Count has been divided by
two so it is not reported upon wraparound.

This fixes some occasional incorrect survey data
on QCA988X as some channels (depending on how/when
scan/offchannel requests were requested) would
have approx 24 sec active time which wasn't
actually the case.

This should improve hostapd ACS a little bit.
Reported-by: NSrinivasa Duvvuri <sduvvuri@chromium.org>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The macro isn't WMI specific. Instead it is
related to hardware chip so move the macro
accordingly. While at it document the magic value.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Some firmware revisions pad 4th hw address in
Native Wifi Rx decap. This is the case with 10.x
and it was assumed that this is true for all
firmware images.

However QCA988X with 999.999.0.636 and QCA61X4
with WLAN.RM.2.0-00088 don't have the padding.
Hence add a feature flag indicating that the
padding isn't present so firmware images can
advertise it appropriately. This way driver will
behave as it was before with old firmware blobs
and doesn't cause any regressions from user
perspective.

Effectively this patch enables QCA988X with
999.999.0.636 and QCA61X4 with WLAN.RM.2.0-00088
to set up client bridging provided user has an
updated firmware blob.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

By using SOC_WAKE register it is possible to bring
down power consumption of QCA61X4 from 36mA to
16mA when associated and idle.

Currently the sleep threshold/grace period is at a
very conservative value of 60ms.

Contrary to QCA61X4 the QCA988X firmware doesn't
have Rx/beacon filtering available for client mode
and SWBA events are used for beaconing in AP/IBSS
so the SoC needs to be woken up at least every
~100ms in most cases. This means that QCA988X
is at a disadvantage and the power consumption
won't drop as much as for QCA61X4.

Due to putting irq-safe spinlocks on every MMIO
read/write it is expected this can cause a little
performance regression on some systems. I haven't
done any thorough measurements but some of my
tests don't show any extreme degradation.

The patch removes some explicit pci_wake calls
that were added in 320e14b8db51aa ("ath10k: fix
some pci wake/sleep issues"). This is safe because
all MMIO accesses are now wrapped and the device
is woken up automatically if necessary.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

mac80211 can update vif powersave state while
disconnected. Firmware doesn't behave nicely and
consumes more power than necessary if PS is
disabled on a non-started vdev. Hence
force-enable PS for non-running vdevs.

This reduces power drain on QCA61X4 from 88mA to
36mA when interface is up and not associated.
QCA988X wasn't measured.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It is actually safe to enable ASPM after the
device is booted up.

This reduces power drain of QCA61X4 when driver is
simply loaded (no interface is up) from 31mA to
14mA. QCA988X wasn't measured but doesn't seem to
regress in any other way.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Fix format specifier used for dma_addr_t, namely use %pad
Debug print virtual address for the same buffer as well.

Fixes: dc16427b ("wil6210: Add pmc debug mechanism memory management")
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Rx clear count reported in wmi_chan_info_event is actually channel_busy_count
not rx_frame_count. Send rx_clear_count through time_busy of survey_info
and set SURVEY_INFO_TIME_BUSY in filled.

iw wlan0 survey dump

urvey data from wlan0
        frequency:                      5180 MHz [in use]
        noise:                          -103 dBm
        channel active time:            150 ms
        channel busy time:              22 ms
Survey data from wlan0
        frequency:                      5200 MHz
        noise:                          -102 dBm
        channel active time:            146 ms
        channel busy time:              0 ms
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Spectral scan supported by ath10k has capability to monitor and report
through whole bands and channels, but current buffer size is too small
to save reported spectral scan data.
This results in dropping 5G channel reports at all when dual band card
is used, so that users are not able to analyze spectral environments.
Hence increase the buffer size to fix the problem.

A spectral data size is vary based on the number of bins, so the unit
buffer size, 1140, is chose to minimize relay buffer fragmentation.

The total buffer size is also chose in tradeoff with spectral scan
support vs. kernel memory consumption.
Since theoretical maximum buffer size, 9.5MB, can be consumed with
512 bins in dual bands, we target to cover up to 128 bins for all
channels in dual bands and due to the buffer size limitation,
spectral scan with bin number bigger than 128 needs to be run on
single band each.
Signed-off-by: NPeter Oh <poh@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This prevents silence failures with driver waiting (infinitely) for a
callback.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

"flowrings" and "*flowrings" are both pointers so this always returns
sizeof(void *) and the current code works fine.  But "*flowrings" is
intended here and static checkers complain, so lets change it.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

If the wl18xx-conf.bin file is missing or invalid (e.g. due
to recent driver change), fallback to default configuration
instead of failing driver load.
Reported-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NEliad Peller <eliad@wizery.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

cfg80211 would complain about invalid AID in during TDLS setup.
This was happening because we use same AID value as provide by AP
while forming setup messages.
Parse AID from Association response and filter BIT14 and BIT15
of AID to get valid AID.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

wait_event_interruptible_timeout() returns 0 upon timeout. We should
convert it to a negative error code (such as -ETIMEDOUT) instead of
returning it directly, as return code of 0 indicates that command was
executed.
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Normal FFT reports generate a LOT of data, to save resources
enable short repeat by default also on ath9k_htc (it's already
enabled by default on ath9k). This can always be changed from
userspace if needed.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

E/M noise is a pretty good source of entropy so we mix the FFT
measurements of the E/M spectrum to /dev/random pool. Note that
this doesn't increase the pool's entropy count but it still helps
on improving the output of /dev/(u)random.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Temp buffer is only used for fixing malformed frames, there is no
need to memset it every time.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

There is no reason to keep processing FFT reports if there is no
space left on the relayfs buffers for the results. This saves
lots of CPU cycles, especially on normal (non-short) reports.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

No need to copy the frame to the temporary buffer when its length
is ok.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since we have lots of frames on a normal FFT report don't bother
processing the malformed ones. Only try to fix malformed frames
in case of a short FFT report (only a single frame on the report).
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since we can identify the FFT frames on the report by checking the
consistency of their magnitude info, we can process all of them,
even when some of them are corrupted.

This patch introduces two functions to quickly verify the integrity
of the mag_info fields and some further tweaks to detect the frames
in the report and process them.

Note that in case of missing bytes we don't duplicate them, instead
we leave them as zeroes. This way we get less noise on the FFT plot.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

a) Check that the maximum magnitude is at the specified index

b) Check if the maximum magnitude index is at dc_pos and if so
calculate a new one (value at dc_pos is invalid)

c) Check if the specified maximum magnitude is indeed the maximum
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since more checks and fixes will be added later and ath_cmn_process_fft is
already big enough.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Maximum magnitude index is a 5bit signed integer,
convert to an 8bit signed integer and then "shift" it so that it can be used
as an array index. Note that the current implementation adds +1 to the index
value (so it can't be used as an array index) and it's only valid for HT20
channels.

Note that the maximum magnitude index is not being used by
the userspace tools that parse FFT samples (they just use
maximum magnitude) so this doesn't break userspace compatibility.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

FFT spectral scan is a functionality that makes sense to have its own
debug flag.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

* Interrupt request need to happen when the wilink chip is powered on and
  driving the wlan_irq line. This avoids spurious interrupt issues that
  are a result of different external pulls configuration on different
  platforms
* Allow working with wl18xx level-low and falling edge irqs by configuring
  wl18xx to invert the device interrupt
Signed-off-by: NEyal Reizer <eyalr@ti.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch fix some spelling typo in drivers/net/wirless
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

We will reset more_task_flag at the end of main process
routine. This optimization will help to remove spinlock
operations at couple of places in the code.
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With PCIE it is possible to support multiple devices with the
same device type. They all load the same nvram file. In order to
support this the nvram can specify which part of the nvram is
for which pcie device. This patch adds support for these new
types of nvram files.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>