It is observed that while loading and unloading ath10k modules
in an infinite loop, before ath10k_core_start() completion HTT
rx frames are received, while processing these frames,
dereferencing the arvifs list code is getting hit before
initilizing the arvifs list, causing a kernel panic.

This patch initilizes the arvifs list before initilizing htt.

Fixes the below issue:
 [<bf88b058>] (ath10k_htt_rx_pktlog_completion_handler+0x278/0xd08 [ath10k_core])
 [<bf88b058>] (ath10k_htt_rx_pktlog_completion_handler [ath10k_core])
 [<bf88c0dc>] (ath10k_htt_txrx_compl_task+0x5f4/0xeb0 [ath10k_core])
 [<bf88c0dc>] (ath10k_htt_txrx_compl_task [ath10k_core])
 [<c0234100>] (tasklet_action+0x8c/0xec)
 [<c0234100>] (tasklet_action)
 [<c02337c0>] (__do_softirq+0xf8/0x228)
 [<c02337c0>] (__do_softirq)  [<c0233920>] (run_ksoftirqd+0x30/0x90)
 Code: e5954ad8 e2899008 e1540009 0a00000d (e5943008)
 ---[ end trace 71de5c2e011dbf56 ]---
 Kernel panic - not syncing: Fatal exception in interrupt

Fixes: 500ff9f9 ("ath10k: implement chanctx API")
Cc: <stable@vger.kernel.org>
Signed-off-by: NAnilkumar Kolli <akolli@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Spectral related structures are accessed / modified only if ath10k
debugfs is enabled, so it makes more sense to move them under
ATH10K_DEBUGFS
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

According to the spec, VHT doesn't exist in 2.4GHz.

There are vendor extensions to allow a subset of VHT to work
(notably 256-QAM), but since mac80211 doesn't support those
advertising VHT capability on 2.4GHz leads to the behaviour
of reporting VHT capabilities but not being able to use any
of them due to mac80211's code requiring 80 MHz support.

Remove the VHT capabilities from 2.4GHz for now. If mac80211
gets extended to use the (likely Broadcom) vendor IEs for it
and handles the lack of 80 MHz support, it can be added back.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

After booting the wireless subsystem and uploading the NV blob to the
WCNSS_CTRL service the remote continues to do things and will not start
servicing wlan-requests for another 2-5 seconds (measured).

The downstream code does not have any special handling for this case,
but has a timeout of 10 seconds for the communication layer. By
extending the wcn36xx timeout to match this we follows the same flow for
the boot procedure and can successfully configure WiFi as wlan0 is
registered.
Signed-off-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

In idle times 60G device can enter deep sleep and turn off
its XTAL clock.
Host access triggers the device power-up flow which will hold
the AHB during XTAL stabilization until device switches from
slow-clock to XTAL clock.
This behavior can stall the PCIe bus for some arbitrary period
of time.
In order to prevent this stall, host can vote for High Latency
Access Policy (HALP) before reading from PCIe bus.
This vote will wakeup the device from deep sleep and prevent
deep sleep until unvote is done.
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

RX_HTRSH interrupt sometimes triggered during device reset
procedure.
To prevent handling this interrupt when not required, unmask
this interrupt only if we are connected and mask it when
disconnected.
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Network stack can try to transmit data while AP / STA is
disconnected.
Change this print-out to debug level as this should not be
handled as error.
This patch also adds wil_dbg_ratelimited, used to limit the
above print-out.
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When using interrupt moderation RX_HTRSH interrupt can occur
frequently during high throughput and should not be considered
as error.
Such print-outs can degrade the performance hence should be printed
in debug print level.
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

P2P search can only run on the social channel (channel 2).
When issuing a scan request on the P2P_DEVICE interface,
driver ignored the channels argument and always performed a P2P
search.
Fix this by checking the channels argument, if it is
not specified (meaning full scan) or if a non-social channel
was specified, perform a regular scan and not a P2P search.
Signed-off-by: NLior David <qca_liord@qca.qualcomm.com>
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Add __func__ to wil_err and wil_info for easier
debugging.
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It's useful to permit the customization of the debug uart baud rate. Enable
this and send down the value to the chip if we're enabling debug.
Signed-off-by: NSteve deRosier <steve.derosier@lairdtech.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

For some reason, the 6004 HW 3.0 definition was missing the value for the
uarttx_pin (used for firmware debug). This corrects this situation.
Signed-off-by: NSteve deRosier <steve.derosier@lairdtech.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

fix a typo (spelling mistake) in 'ath10k_start'
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

QCA6174 WLAN.RM.2.0 firmware uses max_tx_power instead of using max_reg_power
to set transmission power. The tx power was about -50dbm, after applying this
change, it become -32dbm.
Signed-off-by: NAlan Liu <alanliu@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ath.git patches for 4.7. Major changes:

ath10k

* implement set_tsf() for 10.2.4 branch
* remove rare MSI range support
* remove deprecated firmware API 1 support

ath9k

* add module parameter to invert LED polarity

wcn36xx

* fixes to get the driver properly working on Dragonboard 410c

In commit 97f95c93 ("iwlwifi: remove support for fw older than
-16.ucode") we accidentally changed the fw version reading code for
DVM devices.  The code intended to remove the old fw version API,
because all MVM firmwares version 16 and above that we support don't
use it anymore.  But DVM devices still use the old FW API.

Fix that by bringing the code back in.
Reported-by: NPat Erley <pat-lkml@erley.org>
Tested-by: NKalle Valo <kvalo@codeaurora.org>
Fixes: 97f95c93 ("iwlwifi: remove support for fw older than-16.ucode")
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

If rt2800usb is loaded with nohwcrypt=1, mac80211 takes
care of the crypto with software encryption/decryption
and thus, MFP can be used.

Tested for secured mesh using ath9k_htc and ath9k.
Signed-off-by: NChun-Yeow Yeoh <yeohchunyeow@gmail.com>
Acked-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Smatch complains about this code:

    drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c:335 brcmf_rx_hdrpull()
    error: we previously assumed '*ifp' could be null (see line 333)

The problem is that we recently changed these from "ifp" to "*ifp" but
there was one that we didn't update.

-       if (ret || !ifp || !ifp->ndev) {
+       if (ret || !(*ifp) || !(*ifp)->ndev) {
                if (ret != -ENODATA && ifp)
                                       ^^^
-                       ifp->stats.rx_errors++;
+                       (*ifp)->stats.rx_errors++;

I have updated it to *ifp as well.  We always call this function is a
non-NULL "ifp" pointer, btw.

Fixes: c462ebcd ('brcmfmac: create common function for handling brcmf_proto_hdrpull()')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

USB8XXX_FW_MAX_RETRY is 3.  We were using a post-op loop
"while (retries--) {" but then the lines after that assume the loop
exits with retries set to zero.

I've fixed this by changing to a pre-op loop.  I started with retries
set to 4 instead of 3 so that we still go through the loop the same
number of times.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

We accidentally return success instead of -ENOMEM.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

There is nothing 8723au specific about rtl8723au_iqk_phy_iq_bb_reg so
rename the array to rtl8xxxu_iqk_phy_iq_bb_reg.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This renames rtl8723bu_simularity_compare() to
rtl8xxxu_gen2_simularity_compare() to reflect it is used for all gen2
parts.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This renames rtl8723b_channel_to_group() to
rtl8xxxu_gen2_channel_to_group() to reflect it is used by all
currently supported gen2 parts.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All currently supported gen1 parts use the same mac_init_table, so
rename it to reflect this.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All gen1 parts use the same enable_rf() function, so rename it to
reflect this.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All gen1 parts use the same interface for setting TX power, so rename
the function to reflect this.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All gen1 parts use the same init_phy_bb() function, so rename it to
reflect this.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All supported gen1 parts use the same phy_iq_calibrate() function
(unlike their gen2 counterparts). Rename the function to reflect this.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All currently supported gen1 parts use the same function for updating
the rate mask, so rename it to reflect this.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All supported gen1 parts use the same config_channel() function, so
rename it to reflect this.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

All currently supported gen1 parts use the same disable_rf() routine,
so rename the function to reflect that.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

At least for now, all gen2 parts use the same disable_rf() function
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Rename the function to indicate it is applicable to most/all gen2
parts.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Rename the function to reflect it is for all/most gen1 parts.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Make the name reflect this is for most/all gen2 parts.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Update the name of rtl8723bu_update_rate_mask() to make it reflect
it's applicable for all/most gen2 N parts.
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Transmit data path should not touch background scan. We will stop
background scan when net device is closed.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

On some arm-based platforms, we need to configure platform specific
parameters by device tree node and also define our node as a child
node of parent SDIO host controller.
This patch parses these parameters from device tree. It includes
calibration data dowoload to firmware, wakeup pin configured to firmware,
and soc specific wake up gpio, which will be set as wakeup interrupt pin.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Add device tree binding documentation for MARVELL's sd8xxx
(sd8897 and sd8997) wlan chip.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In fwsignal.c: brcmf_fws_commit_skb()
...
if (rc < 0) {
  entry->transit_count--;
    if (entry->suppressed)
      entry->suppr_transit_count--;
      (void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL);
                                                     ^^^^^^^
    goto rollback;
}
...

The call to hdrpull will trigger a null pointer exception
unless a null check is made in the method implementation.
Signed-off-by: NPer Forlin <per.forlin@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>