It's been observed that driver's power state goes out
of sync with firmware in some corner cases. When this
happens, driver tries to download the data to firmware
assuming it's awake which causes Tx data timeout.

Main thread will process interrupt as soon as interrupt
handler fills 'int_status' variable.

This patch fixes the race issue by updating 'int_status'
at the end of mwifiex_interrupt_status().
Signed-off-by: NShengzhen Li <szli@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Newer pcie chipsets (8997 onwards) support MSIx. This
patch enables it.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

wlcore_read/wlcore_write can return negative values so it should
be assigned to signed variable.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2120705

Fixes: 3719c17e ("wlcore/wl18xx: fw logger over sdio")
Signed-off-by: NAndrzej Hajda <a.hajda@samsung.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch add 'verext' debugfs item, which can be used to
get detailed chip specific information from our firmware.

Examples:
echo "1" > /sys/kernel/debug/mwifiex/mlan0/verext
cat /sys/kernel/debug/mwifiex/mlan0/verext
Signed-off-by: NShengzhen Li <szli@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The port_open flag is not applicable for IBSS mode. IBSS data
path was broken when port_open flag was introduced.
This patch fixes the problem by correcting the checks.

Fixes: 5c894633 ("mwifiex: enable traffic only when port is open")
Signed-off-by: Nchunfan chen <jeffc@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Same chip is being used by WLAN as well as bluetooth
drivers. Each driver needs to check during initialisation
if firmware is already active or it needs to be freshly
downloaded. If one driver has started downloading the
firmware, other finds the winner flag as false.

mwifiex_check_fw_status() checks firmware status and also
check if WLAN is the winner for firmware downloading.

Once we detect that other interface is downloading
the firmware, we call this routine again with max
poll count to wait until firmware is ready.

This patch splits the routine to avoid checking
winner status unnecessarily multiple times and ensures
that correct messages are displayed to user.

Firmware status poll count is also increased to 150.
Signed-off-by: NChunfan Chen <jeffc@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Add DT support for the wl1271 SPI WiFi.

Add documentation file for the wl1271 SPI WiFi.
Signed-off-by: NUri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: NRob Herring <robh@kernel.org>
Tested-By: NSebastian Reichel <sre@kernel.org>
Reviewed-by: NGrygorii Strashko <grygorii.strashko@ti.com>
Acked-by: NIgor Grinberg <grinberg@compulab.co.il>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The power function uses a consumer regulator access to update the WiFi
enable GPIO value.
Signed-off-by: NUri Mashiach <uri.mashiach@compulab.co.il>
Tested-By: NSebastian Reichel <sre@kernel.org>
Reviewed-by: NGrygorii Strashko <grygorii.strashko@ti.com>
Acked-by: NIgor Grinberg <grinberg@compulab.co.il>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Sometimes on module reload and reconnect to ibss a deauth from
other station can be received. This is treated as a link down but
for ibss this is wrong. It will close the interface and no data
is possible. Ignore the firmware generated link down events in
ibss mode, as ibss is always teared down by cfg80211.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The btcoex uses a timeout which was in milliseconds and got
converted to jiffies upon using timer api. Instead, convert
it to jiffies and treat it as such further.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Instead to having macro definition for millisecond timeout have
the definition directly in jiffies. This makes the unit of the
value immediately clear and may result in code that is bit more
compact.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The function brcmf_sdio_wd_timer() has wdtick parameter. However, it
is only called with two values and as such the parameter is replaced
with boolean value indicating the timer should be active or not.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Function prototype forward declarations are to be avoided. This
patch shuffles some of the functions so the forward declarations
can be removed.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With wowl net detect it becomes possible to scan for specific ssids
and wakeup once found.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

8000 device family has a new debug engine that needs to be
configured differently than 7000's.
The debug engine's DMA works in chunks of memory and the
size of the buffer really means the start of the last
chunk. Since one chunk is 256-byte long, we should
configure the device to write to buffer_size - 256.
This fixes a situation were the device would write to
memory it is not allowed to access.

CC: <stable@vger.kernel.org> [4.1+]
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When iwl_mvm_fw_error_dump fails, it needs to clear the
state in mvm, which includes:
	* clear IWL_MVM_STATUS_DUMPING_FW_LOG
	* set mvm->fw_dump_trig to NULL
	* free the description

While at it, remove a NULL check in
iwl_mvm_free_fw_dump_desc since kfree is NULL safe.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The debug functions of fw-dbg.c don't really need to modify
the trigger and the description they receive as a parameter.
Constify the pointers.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This notification will be extended with extra data, so just
check that it has a minimum length, not the exact length;
we might later add handling for the extra fields added and
have more code to handle both versions.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

gtkdata->mvm wasn't set in iwl_mvm_d0i3_update_keys,
resulting in kernel panic in some flows (when mvm
is actually used...)

Fixes: a3f7ba5c ("iwlwifi: update key params on d0i3 entrance/exit")
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

As we're working on multi-queue RX, we want to parallelise checking
the PN in order to avoid having to serialise the RX processing.

It may seem that doing parallel PN checking is insecure, but it turns
out to be OK because queue assignment is done based on the data in the
frame (IP/TCP) and thus cannot be manipulated by an attacker, since
the data is encrypted and must first have been decrypted successfully.

There are some corner cases, in particular when the peer starts using
fragmentation which redirects the packet to the default queue. However
this redirection is remembered (for the STA, per TID) and thus cannot
be exploited by an attacker either.

Leave checking on the default queue (queue 0) to mac80211, since we
get fragmented packets there and those are subject to stricter checks
during reassembly.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The commit below called iwl_mvm_mac_ctxt_changed() to handle
a case that the vif is a P2P GO.
However iwl_mvm_mac_ctxt_cmd_go() ignores the number of
associated stations and asks the FW to pass beacons anyways.

Fix this by checking ap_assoc_sta_count parameter, in iwl_mvm_mac_ctxt_cmd_go()
as well, and ask the FW to pass beacons only when there's
at least one associated station.
Signed-off-by: NAyala Beker <ayala.beker@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

As the device (and parts of the driver) cannot deal with having the
same MAC address for two stations (on two virtual interfaces), add
some explicit code to prevent this case.

Note that in practice this cannot happen since the device doesn't
support operating with two AP/GO interfaces at the same time either,
and other scenarios for this are, while not impossible, not going to
happen in practice.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

We advertise one STATION vif only, so this just can't
happen. Remove this useless WARN_ON.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Since A-MPDU deaggregation is done in hardware, and A-MSDU deaggregation
is done in software, there's no reason not to support A-MSDU in A-MPDU;
set the flag to support it.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Allow the user to configure a non-trigger session - a window
between triggers in which the driver won't collect fw debug data.
This can be useful when the frequent collection of fw data
has an impact on the performance, such as debugging
tx flows.
Signed-off-by: NGolan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Dumping the content of the radio registers greatly helps
to debug PHY issues, which can lead to TFD queue hang.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

FW adds 10 msec for every dwell time in low band, so we need
to set 10 msec less.
Don't use extended dwell time when fragmented scan is needed
because FW adds 3 msec per probe and it can easily exceed
max out of channel time.

Fixes: c3e230b1 ("iwlwifi: mvm: add extended dwell time")
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Fix loading the default NVM file, in the case where the
requested NVM file isn't found in the file system.
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

7265D and up are now able to handle -20.ucode.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Just like 7260, 7265 will not have firmware releases newer
than iwlwifi-7265-17.ucode. 7265D is still supported in
latest firmware releases.

Fixes: 628a2918 ("iwlwifi: separate firmware version for 7260 devices")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If we don't reset the scan type when the firmware is
started, we will think the firmware is still configured
after the interface has been brought down. When we will
bring it up again, we will not configure the scan type
in firmware and it will crash with the following assert:

0x0000100A | ADVANCED_SYSASSERT

Fixes: 355346ba ("iwlwifi: mvm: configure scheduled scan according to traffic conditions")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

New functionality for testing that is not relevant for
this driver has been added. This required an API change.

Add new cmd & response versions for the MCC update cmd & response.
Add new TLV indicating that the FW is using the new API.
Signed-off-by: NMatti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware knows better what antenna to choose.
Old firmware still need the setting, so use a flag to know
if the driver should choose the antenna or if the firmware
can do it iself.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Update and fix some 7265 PCI IDs entries.

CC: <stable@vger.kernel.org> [3.13+]
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

My commit below introduced a mutex in the transport to
prevent concurrent operations. To do so, it added a flag
(is_down) to make sure the transport is in the right state.
This uncoverred an bug that didn't cause any harm until
now: iwldvm calls stop_device and then starts the firmware
without calling start_hw in between. While this flow is
fine from the device configuration point of view (register,
etc...), it is now forbidden by the new is_down flag.
This led to this error to appear:
iwlwifi 0000:05:00.0: Can't start_fw since the HW hasn't been started
and the suspend would fail.

This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=109591

CC: <stable@vger.kernel.org> [4.3+]
Reported-by: NBogdan Bogush <bogdan.s.bogush@gmail.com>
Fixes=fa9f3281 ("iwlwifi: pcie: lock start_hw / start_fw / stop_device")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Per comments from Bjorn Andersson <bjorn.andersson@sonymobile.com>,
split DMA mask register writing as seperate patch in case we need
bi-sect in the furture.
Signed-off-by: NFengwei Yin <fengwei.yin@linaro.org>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Lawrence reported that git clone could make system crash on a
Qualcomm ARM soc based device (DragonBoard, 1G memory without
swap) running 64bit Debian.

It's turned out the crash is related with rx skb allocation
failure. git could consume more than 600MB anonymous memory.
And system is in extremely memory shortage case.

But driver didn't handle the rx allocation failure case. This patch
doesn't submit skb to upper layer if rx skb allocation fails.
Instead, it reuse the old skb for rx DMA again. It's more like
drop the packets if system is in memory shortage case.

With this change, git clone is OOMed instead of system crash.
Reported-by: NKing, Lawrence <lking@qti.qualcomm.com>
Signed-off-by: NFengwei Yin <fengwei.yin@linaro.org>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

There is a type bug so it always returns success.

Fixes: 6fa658fd ('ath9k: Simplify and fix eeprom endianness swapping')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Ath9k driver does not modify tx skbs, so SUPPORTS_CLONED_SKBS
flag can be set. Enabling this flag significant reduce number
of copy operation during TCP Tx. This is especially noticeable
on platforms with slower CPU (lower CPU usage brings
profits in better TCP Tx troughput results).

Tested on MIPS with 560 MHz clock
Without CLONED_SKBS flag:
TCP Tx 145 Mb/s (iperf result)
__copy_user_common consumes 12.9% of CPU (result from perf tool)
0% CPU Idle

With CLONED_SKBS flag:
TCP Tx 170 Mb/s (iperf result)
__copy_user_common consumes 1.8% of CPU (result from perf tool)
12% CPU Idle
Signed-off-by: NPawel Kulakowski <pawel.kulakowski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Added a simple interface for platform to perform crash
recovery.
When firmware crashes, wil driver can notify the platform
which can trigger a crash recovery process. During
the process the platform can request a ram dump
from the wil driver as well as control when firmware
recovery will start. This interface allows the platform
to implement a more advanced crash recovery, for
example to reset dependent subsystems in proper order, or
to provide its own notifications during the recovery process.
Signed-off-by: NLior David <qca_liord@qca.qualcomm.com>
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>