As we're running out of hardware capability flags pretty quickly,
convert them to use the regular test_bit() style unsigned long
bitmaps.

This introduces a number of helper functions/macros to set and to
test the bits, along with new debugfs code.

The occurrences of an explicit __clear_bit() are intentional, the
drivers were never supposed to change their supported bits on the
fly. We should investigate changing this to be a per-frame flag.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

There are no drivers setting IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE
or IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE, so any code using the
two flags is dead; it's also exceedingly unlikely that any new driver
could ever need to set these flags.

The wcn36xx code is almost certainly broken, but this preserves the
previous behaviour.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

When we disconnect from the AP, drivers call cfg80211_disconnect().
This doesn't know whether the disconnection was initiated locally
or by the AP though, which can cause problems with the supplicant,
for example with WPS. This issue obviously doesn't show up with any
mac80211 based driver since mac80211 doesn't call this function.

Fix this by requiring drivers to indicate whether the disconnect is
locally generated or not. I've tried to update the drivers, but may
not have gotten the values correct, and some drivers may currently
not be able to report correct values. In case of doubt I left it at
false, which is the current behaviour.

For libertas, make adjustments as indicated by Dan Williams.
Reported-by: NMatthieu Mauger <matthieux.mauger@intel.com>
Tested-by: NMatthieu Mauger <matthieux.mauger@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

[ar5008 and ar9002]_hw_spur_mitigate have big portion of identical code.
This patch will move common part of ar5008_hw_spur_mitigate to
ar5008_hw_cmn_spur_mitigate and reuse it in ar9002_hw_spur_mitigate.

As noticed by Joe Perches I reuse ar9002_hw_spur_mitigate (const) version of
declarations for pilot_mask_reg and chan_mask_reg.

There should be no other difference with original code.
Signed-off-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In d8a2c51c ('ath9k_htc: Use atomic operations for op_flags') we
changed things like this:

-	if (priv->op_flags & OP_TSF_RESET) {
+	if (test_bit(OP_TSF_RESET, &priv->op_flags)) {

The problem is that test_bit() takes a bit number and not a mask.  It
means that when we do:

	set_bit(OP_TSF_RESET, &priv->op_flags);

Then it sets the (1 << 6) bit instead of the 6 bit so we are setting a
bit which is past the end of the unsigned long.

Fixes: d8a2c51c ('ath9k_htc: Use atomic operations for op_flags')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Return type of wait_for_completion_timeout is unsigned long not int.
An appropriately named unsigned long is added, and the assignments
as well as error checking fixed up.

API conformance testing for completions with coccinelle spatches are being
used to locate API usage inconsistencies:
./drivers/net/wireless/ath/carl9170/usb.c:675
	int return assigned to unsigned long

Patch was compile tested with x86_64_defconfig + CONFIG_ATH_CARDS=m,
CONFIG_CARL9170=m

Patch is against 4.1-rc3 (localversion-next is -next-20150512)
Signed-off-by: NNicholas Mc Guire <hofrat@osadl.org>
Acked-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Some firmware revisions pad 4th hw address in
Native Wifi Rx decap. This is the case with 10.x
and it was assumed that this is true for all
firmware images.

However QCA988X with 999.999.0.636 and QCA61X4
with WLAN.RM.2.0-00088 don't have the padding.
Hence add a feature flag indicating that the
padding isn't present so firmware images can
advertise it appropriately. This way driver will
behave as it was before with old firmware blobs
and doesn't cause any regressions from user
perspective.

Effectively this patch enables QCA988X with
999.999.0.636 and QCA61X4 with WLAN.RM.2.0-00088
to set up client bridging provided user has an
updated firmware blob.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

By using SOC_WAKE register it is possible to bring
down power consumption of QCA61X4 from 36mA to
16mA when associated and idle.

Currently the sleep threshold/grace period is at a
very conservative value of 60ms.

Contrary to QCA61X4 the QCA988X firmware doesn't
have Rx/beacon filtering available for client mode
and SWBA events are used for beaconing in AP/IBSS
so the SoC needs to be woken up at least every
~100ms in most cases. This means that QCA988X
is at a disadvantage and the power consumption
won't drop as much as for QCA61X4.

Due to putting irq-safe spinlocks on every MMIO
read/write it is expected this can cause a little
performance regression on some systems. I haven't
done any thorough measurements but some of my
tests don't show any extreme degradation.

The patch removes some explicit pci_wake calls
that were added in 320e14b8db51aa ("ath10k: fix
some pci wake/sleep issues"). This is safe because
all MMIO accesses are now wrapped and the device
is woken up automatically if necessary.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

mac80211 can update vif powersave state while
disconnected. Firmware doesn't behave nicely and
consumes more power than necessary if PS is
disabled on a non-started vdev. Hence
force-enable PS for non-running vdevs.

This reduces power drain on QCA61X4 from 88mA to
36mA when interface is up and not associated.
QCA988X wasn't measured.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It is actually safe to enable ASPM after the
device is booted up.

This reduces power drain of QCA61X4 when driver is
simply loaded (no interface is up) from 31mA to
14mA. QCA988X wasn't measured but doesn't seem to
regress in any other way.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Fix format specifier used for dma_addr_t, namely use %pad
Debug print virtual address for the same buffer as well.

Fixes: dc16427b ("wil6210: Add pmc debug mechanism memory management")
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Rx clear count reported in wmi_chan_info_event is actually channel_busy_count
not rx_frame_count. Send rx_clear_count through time_busy of survey_info
and set SURVEY_INFO_TIME_BUSY in filled.

iw wlan0 survey dump

urvey data from wlan0
        frequency:                      5180 MHz [in use]
        noise:                          -103 dBm
        channel active time:            150 ms
        channel busy time:              22 ms
Survey data from wlan0
        frequency:                      5200 MHz
        noise:                          -102 dBm
        channel active time:            146 ms
        channel busy time:              0 ms
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Spectral scan supported by ath10k has capability to monitor and report
through whole bands and channels, but current buffer size is too small
to save reported spectral scan data.
This results in dropping 5G channel reports at all when dual band card
is used, so that users are not able to analyze spectral environments.
Hence increase the buffer size to fix the problem.

A spectral data size is vary based on the number of bins, so the unit
buffer size, 1140, is chose to minimize relay buffer fragmentation.

The total buffer size is also chose in tradeoff with spectral scan
support vs. kernel memory consumption.
Since theoretical maximum buffer size, 9.5MB, can be consumed with
512 bins in dual bands, we target to cover up to 128 bins for all
channels in dual bands and due to the buffer size limitation,
spectral scan with bin number bigger than 128 needs to be run on
single band each.
Signed-off-by: NPeter Oh <poh@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Normal FFT reports generate a LOT of data, to save resources
enable short repeat by default also on ath9k_htc (it's already
enabled by default on ath9k). This can always be changed from
userspace if needed.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

E/M noise is a pretty good source of entropy so we mix the FFT
measurements of the E/M spectrum to /dev/random pool. Note that
this doesn't increase the pool's entropy count but it still helps
on improving the output of /dev/(u)random.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Temp buffer is only used for fixing malformed frames, there is no
need to memset it every time.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

There is no reason to keep processing FFT reports if there is no
space left on the relayfs buffers for the results. This saves
lots of CPU cycles, especially on normal (non-short) reports.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

No need to copy the frame to the temporary buffer when its length
is ok.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since we have lots of frames on a normal FFT report don't bother
processing the malformed ones. Only try to fix malformed frames
in case of a short FFT report (only a single frame on the report).
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since we can identify the FFT frames on the report by checking the
consistency of their magnitude info, we can process all of them,
even when some of them are corrupted.

This patch introduces two functions to quickly verify the integrity
of the mag_info fields and some further tweaks to detect the frames
in the report and process them.

Note that in case of missing bytes we don't duplicate them, instead
we leave them as zeroes. This way we get less noise on the FFT plot.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

a) Check that the maximum magnitude is at the specified index

b) Check if the maximum magnitude index is at dc_pos and if so
calculate a new one (value at dc_pos is invalid)

c) Check if the specified maximum magnitude is indeed the maximum
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Since more checks and fixes will be added later and ath_cmn_process_fft is
already big enough.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Maximum magnitude index is a 5bit signed integer,
convert to an 8bit signed integer and then "shift" it so that it can be used
as an array index. Note that the current implementation adds +1 to the index
value (so it can't be used as an array index) and it's only valid for HT20
channels.

Note that the maximum magnitude index is not being used by
the userspace tools that parse FFT samples (they just use
maximum magnitude) so this doesn't break userspace compatibility.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

FFT spectral scan is a functionality that makes sense to have its own
debug flag.
Signed-off-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Extend the function to read the TKIP IV32/IV16 to read the IV/PN for
all ciphers in order to allow drivers with full hardware crypto to
properly support this.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This is just a code cleanup, make the LED trigger names const
as they're not expected to be modified by drivers.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

WSC connection is secure (privacy bit set in various frames)
but authentication suite, keys etc. are absent.

Support this mode in the connect WMI command. Detect WSC by
having 'sme->privacy' and no RSN IE. Inform firmware about WSC
session by setting dot11_auth_mode to WMI_AUTH11_WSC.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Introduce 2 types of GTK, Tx (for this STA) and Rx (for each peer).
Now, AP has only Tx GTK, STA - only Rx one. PBSS not supported yet;
for it, continue using pseudo-DMS.
Handle per-vring .1x state, update it from WMI_VRING_EN_EVENTID
event. This allows unification for unicast and broadcast vrings.
This mechanism replaces former per-CID "data_port_open"
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Pmc is a hardware debug mechanism which allows capturing phy data,
packets, and internally generated events and messages synchronized
and time stamped by the hardware. It requires memory buffers
allocated by the driver in order to be used by hardware dma to
upstream real time debug data to host memory.
Driver will handle memory allocation and release, and fetching
the data from the memory to application layer via debug file
system. The configuration of pmc is handled entirely by the
application layer.
Signed-off-by: NVladimir Shulman <qca_shulmanv@qca.qualcomm.com>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Parameters for the start_ap and change_bcon contains
probe response template and probe response IE's.

supplicant puts in the proberesp_ies only WPS related IE's,
while firmware need all IE's, most notable is RSN that is not
included in the proberesp_ies.

Always use IE's provided by the bcon->probe_resp
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Boot loader "ready" indication has changed from "bit0 set"
to "only bit0 set". This is to address hardware glitches.
Due to glitches, sometimes right after reset register reads
0xffffffff, or (rarely) other garbage.

Reflect this in the driver
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Rx descriptor fields accordingly to the updated
hardware documentation
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Sometimes it takes for the firmware more than 20ms to
react on "echo" command after reset. Increase timeout
from 20 to 50ms
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

qca6174 otp binary seems to always return an error to the host, even if the
calibration succeeded. Add a firmware feature flag to detect if the firmware
image which have this problem and workaround the issue in ath10k by ignoring
the error code.

I was also considering making this hw specific flag but as this is strictly a
firmware issue it's best to handle this via a firmware feature flag so that it
will be easy to disable the workaround.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Do not use ieee80211_vif pointer in ath_get_rate_txpower() since it has been
overwritten by setup_frame_info() and it will result in a corrupted tx power
configuration. Set per-packet tx power in setup_frame_info() according to
current vif tx power.
Signed-off-by: NLorenzo Bianconi <lorenzo.bianconi83@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Firmware "board" file name has changed from wil6210.board
to wil6210.brd by the FW generation tools.

Reflect this in the driver.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

cfg80211_ops.stop_ap supposed to have interface carried turned off as
post condition. Fulfill this requirement.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Trace where wil6210_disconnect() is called from.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Provide info for [add|del]_key.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

refactor module parameter debug_fw to act as "fw debug mode",
where driver do nothing but allow card memory access.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>