It was possible to force an out of bounds MMIO
read/write via debugfs. E.g. on QCA988X this could
be triggered with:

 echo 0x2080e0 | tee /sys/kernel/debug/ieee80211/*/ath10k/reg_addr
 cat /sys/kernel/debug/ieee80211/*/ath10k/reg_value

 BUG: unable to handle kernel paging request at ffffc90001e080e0
 IP: [<ffffffff8135c860>] ioread32+0x40/0x50
 ...
 Call Trace:
  [<ffffffffa00d0c7f>] ? ath10k_pci_read32+0x4f/0x70 [ath10k_pci]
  [<ffffffffa0080f50>] ath10k_reg_value_read+0x90/0xf0 [ath10k_core]
  [<ffffffff8115c2c1>] ? handle_mm_fault+0xa91/0x1050
  [<ffffffff81189758>] __vfs_read+0x28/0xe0
  [<ffffffff812e4694>] ? security_file_permission+0x84/0xa0
  [<ffffffff81189ce3>] ? rw_verify_area+0x53/0x100
  [<ffffffff81189e1a>] vfs_read+0x8a/0x140
  [<ffffffff8118acb9>] SyS_read+0x49/0xb0
  [<ffffffff8104e39c>] ? trace_do_page_fault+0x3c/0xc0
  [<ffffffff8196596e>] system_call_fastpath+0x12/0x71
Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Enable VHT support for IBSS, while mac80211/cfg80211 and
wpa_supplicant already support this.

In my test env, qca988x 2x2 I get:

(udp) ath10k-1 >>>> ath10k-2 (server) -  speed: 419 Mbits/sec
(tcp) ath10k-1 >>>> ath10k-2 (server) -  speed: 404 Mbits/sec

During tests I used wpa_supplicant (latest git version), which
already support IBSS VHT, and choose highest available BW. Also tested with
qca6174.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

HTT version itself isn't sufficient to know what
HTT version given firmware blob uses. Hence print
the recently introduced HTT op version code.

While at it make the info string a bit more
consistent and clear.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This should help when analysing problems from
users and spot fw api blob problems easier.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Major changes:

wil6210:

* add modparam for bcast ring size
* support hidden SSID
* add per-MCS Rx stats

On some hardware reading WCID entries table results getting 0xff
numbers, no matter of value written there before. This cause assigning
the same WCID for different stations and makes not possible to connect
to more than one station.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

When unloading the driver with a p2pdev interface it resulted in
a warning upon calling wiphy_unregister() and subsequently a crash
in the driver. This patch assures the p2pdev is unregistered calling
unregister_wdev() before doing the wiphy_unregister().
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Moving two functions in p2p.c as is so next change will be
easier to review.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Making it more clear by freeing the ifp in same place where the
vif object is freed.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The bus interface functions txctl and rxctl may be used while the device
can not be accessed, eg. upon driver .remove() callback. This patch will
immediately return -EIO when this is the case which speeds up the module
unload.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The .get_station() cfg80211 callback is used in several scenarios. In
managed mode it can obtain information about the access-point and its
BSS parameters. In managed mode it can also obtain information about
TDLS peers. In AP mode it can obtain information about connected
clients.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Switch from using semi hard coded interface combinations. This makes
it easier to announce what the firmware actually supports. This fixes
the case where brcmfmac announces p2p but the firmware doesn't
support it.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Add a feature flag to reflect the firmware's p2p capability.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

We expect EEPROM per-rate power table to be filled with
s6 values and warn user if values are invalid.  However,
there appear to be devices which don't have this section
of EEPROM initialized.  In such case we should ignore
the values and leave the driver power tables set to zero.

Note that vendor driver doesn't care about this case but
mt76x2 skips 0xff per value.  We take mt76x2's approach.
Signed-off-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

rt2x00.serialmonkey.com will be shutdown.

Since traffic on rt2x00 mailing list is very low, we can use only
linux-wireless list for any rt2x00 related topics.

Thanks for Luis Correia, Ivo van Doorn and Mark Wallis for maintaining
rt2x00 servers for years!
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

If timeshare coexistance between bluetooth and WLAN gets enabled,
firmware will give host an event to reduce Rx AMPDU BA window size.
The event is handled in this patch.
Signed-off-by: Chunfan Chen <jeffc@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Add the support of channel switching functionality, similar
to ath9k support.

Tested with TP-Link TL-WN722N and TL-WN821N.
Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Some time ago the function debugfs_create_devm_seqfile() was
introduced in debugfs. The caller simply needs to provide a
device pointer and read function. The function brcmf_debugfs_add_entry()
is now simply a wrapper only doing the work for CONFIG_BRCMDBG.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The watchdog reset as done in brcmf_pcie_buscoreprep() is not
sufficient. It needs to modify PCIe core registers as well
which is properly done by brcmf_pcie_reset_device() after the
chip recognition is done. So the faulty watchdog reset can be
removed as it was causing driver reload to fail and hang the
system requiring a power-cycle. Instead the call to to the
brcmf_pcie_reset_device() function is done twice in the unload.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The information provided by chipinfo is also provided by the
revinfo debugfs entry. Removing it from debugfs.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

On device to host data using msgbuf the read pointer gets updated
once all data is processed. Updating this pointer more frequently
allows the firmware to add more data quicker. This will result in
slightly higher and more stable throughput on CPU bounded host
processors.
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

The variable "fw_version" is used in the _ResetDigitalProcedure1().
but It is not initialized. so I add init codes for "fw_version" and
"fw_subversion".
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

rtl92cu_rx_query_desc set a isampdu twice.
but second code is related to isfirst_ampdu.
so i change it.
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

In the rtlwifi/rtl8192cu, I change debug message "RTL8192CE" to
"RTL8192CU".
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

in the _rtl92c_phy_rf6052_config_parafile(), cases
RF90_PATH_A and RF90_PATH_B call the same routine.
so i remove one of these routine. also the return
routine is duplicated. so i remove it.
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

While working on getting my rtl8821au driver in pretty shape for
inclusion, it is dicosvered that the tm_trigger flag is used only for
the first device using this driver.
This flag handles the thermal power management in the hardware.

To change this add a entry in sttruct rtl_dm, so each device can handle
is separately.
Signed-off-by: Hans Ulli Kroll <ulli.kroll@googlemail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

in the rtlwifi/rtl8192cu, INTF_PCI and INTF_USB is unnecessary.
because RTL8192CU chipset is only USB interface.
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

_InitBeaconParameters() and rtl92cu_init_beacon_parameters() is
same routine. I remove both functions. then i add
_rtl92cu_init_beacon_parameters() in the hw.c.
_rtl92cu_init_beacon_parameters() is same routine with
_InitBeaconParameters().
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

in the rtlwifi/rtl8192cu, IS_HARDWARE_TYPE_8192CE and IS_HARDWARE_TYPE_8192CU
is unnecessary. because rtlwifi/rtl8192cu codes aren't shared.
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Need to reorder init sequence to run wil_platform_init
before pci_enable_device. Assumption is platform init
may be required before device may be enabled.
Another issue, platform uninit should be called after
pci_disable_device because platform uninit may render
pci device non-accessible.
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Provide platform hooks for module init/exit.
If platform require to perform some specific actions
in global context, this is where to do so.

Example may be turning on power for the PCIE based
on DT information.
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Pass hidden SSID information to FW for proper operation.
In order to be able to scan/connect to the hidden SSID, SSID
setting is added when scan is requested from FW. SSID
scanning currently supports single SSID due to FW limitation.
Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Provide detailed statistics for the Rx frames per MCS
Statistics printed in "stations" debugfs entry
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Firmware defines new memory region, mac_rgf_ext
that need to be accessed from the host for debug purposes.

Add corresponded mapping
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Control Bcast ring size in similar way as Rx and Tx ones,
through "bcast_ring_order" modparam, actual ring size is 1 << order
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

When one client is associated and connected to an ar6003 hw version
2.0 with firmware 3.1.1.149, and another client tries to connect, the
first client's MAC address is lost in the station list because the
"aid" is always "1".  The structure "wmi_connect_event" has the "aid"
as the second byte in the message, but it should be the first byte.

This patch has been tested with linux-3.10.40
Signed-off-by: Brent Taylor <motobud@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Found during code review. This was pretty much
impossible to happen but better safe than sorry.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

In the midst of chanctx patch review channel
switching became broken which I failed to notice
until now.

Function ath10k_mac_vif_chan() reports current
chandef which isn't updated until after
switch_vif_chanctx() is returned from.
Consequently the driver just restarted operation
on channels it was residing already instead of
switching to the new ones.

Fixes: 500ff9f9 ("ath10k: implement chanctx API")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

In practice there's no point in having a copy of
chanctx_conf.

Most of the time the channel pointer (and band
along with it) is accessed and this can't change
after a chanctx is created because switching is
done using explicit chanctx swapping via
switch_vif_chanctx().

The only thing that can change within a
chanctx_conf and is used by the driver is
radar_enabled and channel width. These are however
always accessed in adequate mac80211 callback
context which guarantees safe access to the
chanctx data.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Channel contexts aren't iterable until after
they've been added to the driver. The code assumed
otherwise.

This problem could result in:

 * rx_channel being NULL and forcing Rx path to go
   the slow way to get channel on QCA988X,

 * report incorrect channel when running
   multi-channel on QCA61X4 hw2.1,

 * report incorrect channel after AP channel
   switch.

Fixes: 500ff9f9 ("ath10k: implement chanctx API")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>