Major changes:

ath10k:

* add QCA9377 support
* fw_stats support for 10.4 firmware

ath6kl:

* report antenna configuration to user space
* implement ethtool stats

This supports a way to get target stats through normal
ethtool stats API.

For instance:
# ethtool -S wlan1
NIC statistics:
     tx_pkts_nic: 353
     tx_bytes_nic: 25142
     rx_pkts_nic: 6
     rx_bytes_nic: 996
     d_tx_ucast_pkts: 89
     d_tx_bcast_pkts: 264
     d_tx_ucast_bytes: 3020
     d_tx_bcast_bytes: 22122
...
Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This will allow us to call it from elsewhere when implementing
ethtool stats.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Improper use of strlcpy caused garbage to be appended to the
firmware version string.  Fix this by paying attention to the
ie_lenth.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

It can take a user a while to understand why their
NIC that advertises 802.11n support cannot actually
do 802.11n.  Print out a warning in the logs to save
the next poor person to use this NIC some trouble.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This lets 'iw phy phy0 info' report antennas for
the radio device:

...
	Available Antennas: TX 0x2 RX 0x2
	Configured Antennas: TX 0x2 RX 0x2
...
Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

When configuring Tx vring for new connection,
WMI call to the firmware may fail. In this case, need to
clean up properly. In particular, need to call
cfg80211_del_sta() in case of AP like interface.

Perform full "disconnect" procedure for proper clean up
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Adjust driver behavior during FW boot. Proper sequence of
events after reset and FW download, is as following:

- FW prepares mailbox structure and reports IRQ "FW_READY"
- driver caches mailbox registers, marks mailbox readiness
- FW sends WMI_FW_READY event, ignore it
- FW sends WMI_READY event with some data
- driver stores relevant data marks FW is operational
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

When Tx ring full is encountered with TSO,
printout of "DMA error" was wrongly printed.

In addition, in case of Tx ring full return
proper error code so that NETDEV_TX_BUSY is
returned to network stack in order not to
drop the packets and retry transmission of the
packets when ring is emptied.
Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Some events are ignored for purpose; such events should not
be treated as "unhandled events". Replace info message
saying "unhandled" with debug one saying "ignore", to reduce
dmesg pollution
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Add the hardware name, revision and update the pci_id table.

Currently there're two HW ref. designs available I'm aware of,
with 1.0.2 and 1.1 chip revisions. I've access and been using
the first one so far and this patch cover only it.

QCA9377 inherits most of the stuff (e.g. fw interfaces)
from QCA61x4 design, so the integration was pretty straightforward.
Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

To reflect configured antenna settings in HT/VHT MCS map,
reload the HT/VHT capabilities upon antenna change.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Move HT and VHT capabiltity setup static functions to avoid
forward declaration.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

HT/VHT MCS rateset should be filled only for configured chainmask
rather that max supported chainmask. Fix that by checking configured
chainmask while filling HT/VHT MCS rate map.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Removing supported chainmask fields as it can be always derived
from num_rf_chains.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

For the messages from host to target, shadow copy of CE descriptors
are maintained in source ring. Before writing actual CE descriptor,
first shadow copy is filled and then it is copied to CE address space.
To optimize in download path and to reduce d-cache pressure, removing
shadow copy of CE descriptors. This will also reduce driver memory
consumption by 33KB during on device probing.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

The physical address necessary to unmap DMA ('bufferp') is stored
in ath10k_skb_cb as 'paddr'. ath10k doesn't rely on the meta/transfer_id
when handling send completion (htc ep id is stored in sk_buff control
buffer). So the unused output arguments {bufferp, nbytesp and transfer_idp}
are removed from CE send completion. This change is needed before removing
the shadow copy of copy engine (CE) descriptors in follow up patch.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

CE diag window access is serialized (it has to be by design) so
there's no way to get a different send completion. so there's no
need for post completion validation.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Currently to avoid uncached memory access while filling up copy engine
descriptors, shadow descriptors are used. This can be optimized further
by removing shadow descriptors. To achieve that first shadow ring
dependency in ce_send is removed by creating local copy of the
descriptor on stack and make a one-shot copy into the "uncached"
descriptor.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This patch adds support for getting firmware debug stats in 10.4 fw.
Signed-off-by: Manikanta Pubbisetty <c_mpubbi@qti.qualcomm.com>
Signed-off-by: Tamizh chelvam <c_traja@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Add WMI-TLV and FW API support in ath10k testmode.
Ath10k can get right wmi command format from UTF image
to communicate UTF firmware.
Signed-off-by: Alan Liu <alanliu@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

European Union has made it mandatory that all devices working in 2.4 GHz
has to adhere to the ETSI specification (ETSI EN 300 328 V1.9.1)
beginnig this year. The standard basically speaks about interferences
in 2.4Ghz band.
For example, when 802.11 device detects interference, TX must be stopped
as long as interference is present.

Adaptive CCA is a feature, when enabled the device learns from the
environment and configures CCA levels adaptively. This will improve
detecting interferences and the device can stop trasmissions till the
interference is present eventually leading to good performances in
varying interference conditions.

The patch includes code for enabling adaptive CCA for 10.2.4 firmware on
QCA988X.
Signed-off-by: Maharaja <c_mkenna@qti.qualcomm.com>
Signed-off-by: Manikanta Pubbisetty <c_mpubbi@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This allows saving a little of space when not using ssb on Broadcom SoC.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

This cleans main.c a bit and will allow us to compile SoC related code
conditionally in the future.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

ssb bus can be found on various "host" devices like PCI/PCMCIA/SDIO.
Every ssb bus contains cores AKA devices.
The main idea is to have ssb driver scan/initialize bus and register
ready-to-use cores. This way ssb drivers can operate on a single core
mostly ignoring underlaying details.

For some reason PCMCIA support was split between ssb and b43. We got
PCMCIA host device probing in b43, then bus scanning in ssb and then
wireless core probing back in b43. The truth is it's very unlikely we
will ever see PCMCIA ssb device with no 802.11 core but I still don't
see any advantage of the current architecture.

With proposed change we get the same functionality with a simpler
architecture, less Kconfig symbols, one killed EXPORT and hopefully
cleaner b43. Since b43 supports both: ssb & bcma I prefer to keep ssb
specific code in ssb driver.

This mostly moves code from b43's pcmcia.c to bridge_pcmcia_80211.c. We
already use similar solution with b43_pci_bridge.c. I didn't use "b43"
in name of this new file as in theory any driver can operate on wireless
core.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

In uap mode the carrier is not enabled until after the first STA joins.
The carrier triggers the bridge to start its state machine, and if STP
is enabled, it takes 4 seconds as it transitions from disabled to
forwarding. During this time the bridge drops all traffic, and the EAPOL
handshake times out after 3 seconds, preventing stations from joining.

Follow the logic used in mac80211 and start the carrier in start_ap
and disable it in stop_ap. This has a nice benefit of allowing the
first station connection time to be reduced by up to 75% when STP is
in use.
Signed-off-by: Martin Faltesek <mfaltesek@google.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

arm64 has requirement that all the dma operations have actual device.
Otherwise, following warnning message shown and dma allocation fails:

WARNING: CPU: 0 PID: 954 at arch/arm64/mm/dma-mapping.c:106 __dma_alloc+0x24c/0x258()
Use an actual device structure for DMA allocation
Modules linked in: wcn36xx wcn36xx_platform
CPU: 0 PID: 954 Comm: ifconfig Not tainted 4.0.0+ #14
Hardware name: Qualcomm Technologies, Inc. MSM 8916 MTP (DT)
Call trace:
[<ffffffc000089904>] dump_backtrace+0x0/0x124
[<ffffffc000089a38>] show_stack+0x10/0x1c
[<ffffffc000627114>] dump_stack+0x80/0xc4
[<ffffffc0000b2e64>] warn_slowpath_common+0x98/0xd0
[<ffffffc0000b2ee8>] warn_slowpath_fmt+0x4c/0x58
[<ffffffc00009487c>] __dma_alloc+0x248/0x258
[<ffffffbffc009270>] wcn36xx_dxe_allocate_mem_pools+0xc4/0x108 [wcn36xx]
[<ffffffbffc0079c4>] wcn36xx_start+0x38/0x240 [wcn36xx]
[<ffffffc0005f161c>] ieee80211_do_open+0x1b0/0x9a4
[<ffffffc0005f1e68>] ieee80211_open+0x58/0x68
[<ffffffc00051693c>] __dev_open+0xb0/0x120
[<ffffffc000516c10>] __dev_change_flags+0x88/0x150
[<ffffffc000516cf4>] dev_change_flags+0x1c/0x5c
[<ffffffc000570950>] devinet_ioctl+0x644/0x6f0
Signed-off-by: Yin, Fengwei <fengwei.yin@linaro.org>
Acked-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

wcn36xx implements a ring buffer for transmitted frames for each
(high and low priority) DMA channel.  The ring buffers are lockless:
new frames are inserted at the head of the queue, while finished
packets are reaped from the tail.

Unfortunately, the list manipulations are missing any kind of barriers
so are susceptible to various races: for example, a TX completion
handler might read an updated desc->ctrl before the head has actually
advanced, and then null out the ctl->skb pointer while it is still
being used in the TX path.

Simplify things here by adding a spin lock when traversing the ring.
This change increased stability for me without adding any noticeable
overhead on my platform (xperia z).
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Some of the ath9k_phyerr enums were wrong from the
beginning (and even before). Most of the time the
codes were used for counters to be displayed over
debugfs, which made this a non-functional issue.

Some (e.g. ATH9K_PHYERR_FALSE_RADAR_EXT) are used
for radar detection and require the correct code
to work as intended.

This patch includes:
a) fixes
  ATH9K_PHYERR_FALSE_RADAR_EXT:    24 => 36
  ATH9K_PHYERR_CCK_LENGTH_ILLEGAL: 32 => 28
  ATH9K_PHYERR_CCK_POWER_DROP:     33 => 29
  ATH9K_PHYERR_HT_CRC_ERROR:       34 => 32
  ATH9K_PHYERR_HT_LENGTH_ILLEGAL:  35 => 33
  ATH9K_PHYERR_HT_RATE_ILLEGAL:    36 => 34

b) extensions
  ATH9K_PHYERR_CCK_BLOCKER = 24
  ATH9K_PHYERR_HT_ZLF      = 35
  ATH9K_PHYERR_GREEN_FIELD = 37

Aside from the correction and completion made in
the enum, the patch also extends the display of
the related counters in the debugfs.
Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The current code exits after alloc_orinocodev, but fails to change the
return value to something that indicates the failure.  This patch
changes the return value to -ENOMEM.

https://bugzilla.kernel.org/show_bug.cgi?id=106181Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

SIOCSIWAP (airo_set_wap) affects scan: only the AP specified by
SIOCSIWAP is present in scan results.

This makes NetworkManager work for the first time but then unable to
find any other APs.

Clear APList before starting scan and set it back after scan completes
to work-around the problem.

To avoid losing packets during scan, modify disable_MAC() to omit
netif_carrier_off() call when lock == 2.
Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Instead of dynamically allocating APList, make it a member of struct
airo_info to always track state of APList_rid.
This simplifies suspend/resume and allows removal of readAPListRid.
Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Merge tag 'iwlwifi-next-for-kalle-2015-10-25' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next

* bug fix for TDLS
* fixes and cleanups in scan
* support of several scan plans
* improvements in FTM
* fixes in FW API
* improvements in the failure paths when the bus is dead
* other various small things here and there

updates the bindings documents and dtsi file according to the review
comments[https://lkml.org/lkml/2015/9/21/670] from Rob Herring <robh@kernel.org>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: yankejian <yankejian@huawei.com>
Signed-off-by: huangdaode <huangdaode@hisilicon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

delete action of ETHTOOL_ID_ON/ETHTOOL_ID_OFF in XGE ethtool -p,
so Hardware control the LED state instead of software.
Signed-off-by: Li Peng <lipeng321@huawei.com>
Signed-off-by: Yisen Zhuang <yisen.zhuang@huawei.com>
Signed-off-by: yankejian <yankejian@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Increased TX_TIMEOUT to 5HZ to accommodate worst case situation
for traffic and CPU intensive use cases
Signed-off-by: Priyanka Jain <Priyanka.Jain@freescale.com>
Signed-off-by: Abhimanyu <abhimanyu@freescale.com>
Acked-by: Claudiu Manoil <claudiu.manoil@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge tag 'wireless-drivers-next-for-davem-2015-10-27' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
here's a bigger pull request for 4.4. The diffstat looks scary as we
created a new directory realtek for all realtek drivers. In the future
I'm planning to create similar directories for all vendors, currently we
just have ath, mediatek and realtek. This change has been in linux-next
for a couple of weeks so it should be safe, but of course you never
know.

There's also a new driver rtl8xxxu for few realtek USB devices. This
just made it to the last linux-next build.

Otherwise there's nothing really special, more info below. If time
permits, and it's ok for you, I'm hoping to send you a one more pull
request this week.

brcmfmac

* using netdev carrier state
* add and rework some cfg80211 callbacks mainly for AP mode
* use devcoredump when triggered by firmware event

realtek

* create new directory drivers/net/wireless/realtek/ for all realtek
  drivers, not visible to users (no kconfig changes etc)
* add rtl8xxxu, a new mac80211 driver for RTL8723AU, RTL8188CU,
  RTL8188RU, RTL8191CU, RTL8192CU and hopefully more in the future

ath10k

* add board 2 API support for automatically choosing correct board file
* data path optimisations
* disable PCI power save for qca988x and QCA99x0 due to interop reasons

wil6210

* BlockAckReq support
* firmware crashdump using devcoredump
* capture all frames with sniffer
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch adds support for dumping a process' (classic BPF) seccomp
filters via ptrace.

PTRACE_SECCOMP_GET_FILTER allows the tracer to dump the user's classic BPF
seccomp filters. addr should be an integer which represents the ith seccomp
filter (0 is the most recently installed filter). data should be a struct
sock_filter * with enough room for the ith filter, or NULL, in which case
the filter is not saved. The return value for this command is the number of
BPF instructions the program represents, or negative in the case of errors.
Command specific errors are ENOENT: which indicates that there is no ith
filter in this seccomp tree, and EMEDIUMTYPE, which indicates that the ith
filter was not installed as a classic BPF filter.

A caveat with this approach is that there is no way to get explicitly at
the heirarchy of seccomp filters, and users need to memcmp() filters to
decide which are inherited. This means that a task which installs two of
the same filter can potentially confuse users of this interface.

v2: * make save_orig const
    * check that the orig_prog exists (not necessary right now, but when
       grows eBPF support it will be)
    * s/n/filter_off and make it an unsigned long to match ptrace
    * count "down" the tree instead of "up" when passing a filter offset

v3: * don't take the current task's lock for inspecting its seccomp mode
    * use a 0x42** constant for the ptrace command value

v4: * don't copy to userspace while holding spinlocks

v5: * add another condition to WARN_ON

v6: * rebase on net-next
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
CC: Will Drewry <wad@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Pavel Emelyanov <xemul@parallels.com>
CC: Serge E. Hallyn <serge.hallyn@ubuntu.com>
CC: Alexei Starovoitov <ast@kernel.org>
CC: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Robert Shearman says:

====================
mpls: mulipath improvements

Two improvements to the recently added mpls multipath support. The
first is a fix for missing initialisation the nexthop address length
for the v4 and v6 explicit null label routes, and the second is to
reduce the amount of memory used by mpls routes by changing the way
the via addresses are stored.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Nexthops for MPLS routes have a via address field sized for the
largest via address that is expected, which is 32 bytes. This means
that in the most common case of having ipv4 via addresses, 28 bytes of
memory more than required are used per nexthop. In the other common
case of an ipv6 nexthop then 16 bytes more than required are
used. With large numbers of MPLS routes this extra memory usage could
start to become significant.

To avoid allocating memory for a maximum length via address when not
all of it is required and to allow for ease of iterating over
nexthops, then the via addresses are changed to be stored in the same
memory block as the route and nexthops, but in an array after the end
of the array of nexthops. New accessors are provided to retrieve a
pointer to the via address.

To allow for O(1) access without having to store a pointer or offset
per nh, the via address for each nexthop is sized according to the
maximum via address for any nexthop in the route, which is stored in a
new route field, rt_max_alen, but this is in an existing hole in
struct mpls_route so it doesn't increase the size of the
structure. Each via address is ensured to be aligned to VIA_ALEN_ALIGN
to account for architectures that don't allow unaligned accesses.
Signed-off-by: Robert Shearman <rshearma@brocade.com>
Signed-off-by: David S. Miller <davem@davemloft.net>