Fix format specifier used for dma_addr_t, namely use %pad
Debug print virtual address for the same buffer as well.

Fixes: dc16427b ("wil6210: Add pmc debug mechanism memory management")
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

WSC connection is secure (privacy bit set in various frames)
but authentication suite, keys etc. are absent.

Support this mode in the connect WMI command. Detect WSC by
having 'sme->privacy' and no RSN IE. Inform firmware about WSC
session by setting dot11_auth_mode to WMI_AUTH11_WSC.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Introduce 2 types of GTK, Tx (for this STA) and Rx (for each peer).
Now, AP has only Tx GTK, STA - only Rx one. PBSS not supported yet;
for it, continue using pseudo-DMS.
Handle per-vring .1x state, update it from WMI_VRING_EN_EVENTID
event. This allows unification for unicast and broadcast vrings.
This mechanism replaces former per-CID "data_port_open"
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Pmc is a hardware debug mechanism which allows capturing phy data,
packets, and internally generated events and messages synchronized
and time stamped by the hardware. It requires memory buffers
allocated by the driver in order to be used by hardware dma to
upstream real time debug data to host memory.
Driver will handle memory allocation and release, and fetching
the data from the memory to application layer via debug file
system. The configuration of pmc is handled entirely by the
application layer.
Signed-off-by: NVladimir Shulman <qca_shulmanv@qca.qualcomm.com>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Parameters for the start_ap and change_bcon contains
probe response template and probe response IE's.

supplicant puts in the proberesp_ies only WPS related IE's,
while firmware need all IE's, most notable is RSN that is not
included in the proberesp_ies.

Always use IE's provided by the bcon->probe_resp
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Boot loader "ready" indication has changed from "bit0 set"
to "only bit0 set". This is to address hardware glitches.
Due to glitches, sometimes right after reset register reads
0xffffffff, or (rarely) other garbage.

Reflect this in the driver
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Rx descriptor fields accordingly to the updated
hardware documentation
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Sometimes it takes for the firmware more than 20ms to
react on "echo" command after reset. Increase timeout
from 20 to 50ms
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Firmware "board" file name has changed from wil6210.board
to wil6210.brd by the FW generation tools.

Reflect this in the driver.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

cfg80211_ops.stop_ap supposed to have interface carried turned off as
post condition. Fulfill this requirement.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Trace where wil6210_disconnect() is called from.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Provide info for [add|del]_key.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

refactor module parameter debug_fw to act as "fw debug mode",
where driver do nothing but allow card memory access.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Multicast is not yet properly supported for all connection types;
actually, only non-secure AP is supported. For all other cases,
fall back to old "pseudo-DMS" approach. Namely, for:
- PBSS
- secure connection

When re-routing MCAST Rx->Tx on the AP, do not Tx back to the origin
of the frame
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use dedicated vring for multicast frames; this vring allocated for
AP and PBSS (both P2P GO and client) configurations

For short frames, use MCS0; for long - MCS1
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Sync with the wmi definitions from the firmware team
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Fix checkpatch warning:
WARNING: Prefer ether_addr_copy() over memcpy() if the
Ethernet addresses are __aligned(2)
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

For the networking code and for hardware network accelerators,
it is better to have IP header 4*n aligned. On the other side,
DMA on Rx path require buffer to be aligned on 4*n as well.
Having 14 bytes of Ethernet header, these 2 alignment
requests are in contradiction.

To solve this, order hardware offload block to not remove
SNAP header. This adds extra 6 bytes between addresses and
ethertype, making it 20 bytes total. This way, both buffer and
IP header are 4*n aligned. Remaining is only to remove SNAP
by shifting addresses 6 bytes. This involves data copying, so
this feature should be disabled unless required by the platform.

Module parameter "rx_align_2" (bool, default - false)
introduced to control this feature. Feature is completely disabled
when parameter is false.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

"echo" used to be called when no firmware loaded to the NIC,
this causes error output.

Probe firmware with "echo" only after it returned "ready" event.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use temporal variable for often used vring->swhead;
and use proper index in debug printing - vring->swhead
used before was modified in wil_vring_advance_head
and then increased value was used in debug print
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

For the AP, configuration may say not to bridge traffic between
wireless clients. This is conveyed from user space (ex: hostapd has
ap_isolate parameter) with NL80211_CMD_SET_BSS, to the driver's
cfg80211 ops method change_bss

Add support for this setting.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This is for AP only. If Rx data frame targeted to one of associated clients,
transmit it back to the wireless media and don't deliver to the host.
For the multicast frames, deliver to both host and wireless media.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

It is expected that driver completes NAPI when less than
full budget is consumed.

Fulfill this requirement.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

802.11ad adds new a network type (PBSS) and changes the capability
field interpretation for the DMG (60G) band.
The same 2 bits that were interpreted as "ESS" and "IBSS" before are
re-used as a 2-bit field with 3 valid values (and 1 reserved). Valid
values are: "IBSS", "PBSS" (new) and "AP".

In order to get the BSS struct for the new PBSS networks, change the
cfg80211_get_bss() function to take a new enum ieee80211_bss_type
argument with the valid network types, as "capa_mask" and "capa_val"
no longer work correctly (the search must be band-aware now.)

The remaining bits in "capa_mask" and "capa_val" are used only for
privacy matching so replace those two with a privacy enum as well.
Signed-off-by: NDedy Lansky <dlansky@codeaurora.org>
[rewrite commit log, tiny fixes]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

cppcheck detected a buffer overflow:

[drivers/net/wireless/ath/wil6210/debugfs.c:634]: (error) Width 8
  given in format string (no. 1) is larger than destination buffer
  'cmd[8]', use %7s to prevent overflowing it.

For the current %8s sscanf we require cmd to be 9 chars long
so increase it by 1 byte to prevent the sscan overflow (rather
than reduce the %8s specifier to %7s as cppcheck recommends).
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Acked-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

For the STA interface, track 'privacy'.
Refactor safety checks to:
- always print connection params
- always check IE size validity
- require RSN IE for secure connection
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Make this field to track privacy attribute for all interface types
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

On some platforms get_cycles() implemented to allways return 0.
On such platforms "Division by zero" bug was triggered.
Signed-off-by: NBoris Sorochkin <boriss@codeaurora.org>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Change threshold to be variable debugfs entry from hard-coded 0.
Default threshold value is 16 descriptors because HW is capable
of fetching up to 16 descriptors at once.
Signed-off-by: NVladimir Shulman <qca_shulmanv@qca.qualcomm.com>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Mark expected branches using likely()/unlikely().
Do it on high performance route - data path and interrupts
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In the old hardware, bug existed that caused DA and SA for every
Rx packet to be swapped in the AP mode.
New hardware has fix for this bug. Enable this fix in the
hardware.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Hardware older than Sparrow B0 obsolete.
There is no WiFi product that uses this hardware.
Recent firmware does not support it either.

Remove driver support.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Introduce boot loader. Instead of the operational firmware,
very small boot loader is burned to the on-board flash. Boot loader
initializes hardware upon reset, and prepares for low power mode.
Boot loader reports MAC address and detects radio chip connected.

Driver loads firmware only when bringing up interface. All information
required to set up network interface, most important is MAC address,
reported by the boot loader

The firmware composed of 2 files:
- wil6210.fw - firmware itself (compiled code + data)
- wil6210.board - board file (various board and radio dependent
  calibrations and parameters)
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Current implementation depends on msm-bus driver which
is not merged into mainline kernel therefore
this code is removed
Signed-off-by: NHamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Print (at debug level) all cipher and AKM suites
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Print Tx descriptors
Print ring index for all Tx related messages
Sort prefixes: Tx for transmit, TxC for completion, added "D"
for descriptor related prints
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use spinlock, this should not impact Tx as lock is always free
except for de-allocation.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Non-cacheable Tx descriptor for the last fragment of
multi-fragment frame used to be written back twice.

Refactor code to always write non-cacheable descriptor
only once
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In the Tx, work around used to force destination index 0
to be used. This is no more necessary, as firmware supports
multiple destinations
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This fixes issue reported by Dan Carpenter:
The patch 3277213f: "wil6210: ADDBA/DELBA flows" from Dec 23,
2014, leads to the following static checker warning:

        drivers/net/wireless/ath/wil6210/rx_reorder.c:205 wil_tid_ampdu_rx_alloc()
        error: scheduling with locks held: 'spin_lock:tid_rx_lock'

drivers/net/wireless/ath/wil6210/rx_reorder.c
   202  struct wil_tid_ampdu_rx *wil_tid_ampdu_rx_alloc(struct wil6210_priv *wil,
   203                                                  int size, u16 ssn)
   204  {
   205          struct wil_tid_ampdu_rx *r = kzalloc(sizeof(*r), GFP_KERNEL);
                                                                 ^^^^^^^^^^
   206
   207          if (!r)
   208                  return NULL;
   209
   210          r->reorder_buf =
   211                  kcalloc(size, sizeof(struct sk_buff *), GFP_KERNEL);
                                                                ^^^^^^^^^^^
   212          r->reorder_time =
   213                  kcalloc(size, sizeof(unsigned long), GFP_KERNEL);
                                                             ^^^^^^^^^^^
   214          if (!r->reorder_buf || !r->reorder_time) {
   215                  kfree(r->reorder_buf);
   216                  kfree(r->reorder_time);
   217                  kfree(r);
   218                  return NULL;
   219          }
   220

[ snip ]

   331          spin_lock_bh(&sta->tid_rx_lock);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
spin lock held.

   332
   333          wil_tid_ampdu_rx_free(wil, sta->tid_rx[tid]);
   334          sta->tid_rx[tid] = wil_tid_ampdu_rx_alloc(wil, agg_wsize, ssn);
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
function called with the lock held.

   335
   336          spin_unlock_bh(&sta->tid_rx_lock);
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>