wil6210: add oob_mode module parameter

Add module parameter oob_mode. Takes effect the next time
the interface is brought up and FW is loaded. Puts the FW
in special "out of the box" (OOB) mode whic

wil6210: add oob_mode module parameter

Add module parameter oob_mode. Takes effect the next time
the interface is brought up and FW is loaded. Puts the FW
in special "out of the box" (OOB) mode which is used for
diagnostics and certification.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: fix no_fw_recovery mode with change_virtual_intf

When FW crashed with no_fw_recovery mode enabled, user space
could still call wil_cfg80211_change_iface quickly to change
interface type, an

wil6210: fix no_fw_recovery mode with change_virtual_intf

When FW crashed with no_fw_recovery mode enabled, user space
could still call wil_cfg80211_change_iface quickly to change
interface type, and this would cause recovery to proceed and
FW crash logs may be lost.
Fix this problem by not resetting the FW in case no_fw_recovery
is enabled.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: fix race conditions in p2p listen and search

Fix 2 race conditions found during test runs of P2P discovery:
1. Because wil_p2p_cancel_listen was not protected, user space
could start a new

wil6210: fix race conditions in p2p listen and search

Fix 2 race conditions found during test runs of P2P discovery:
1. Because wil_p2p_cancel_listen was not protected, user space
could start a new P2P listen/search before wmi_stop_discovery
completed. This caused a crash in the firmware.
2. In P2P listen, when listen timer expires and user space calls
cancel_remain_on_channel at the same time, code could send the
cfg80211_remain_on_channel_expired notification twice.

Added protections with wil->mutex to several places that call
wmi_stop_discovery.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: P2P_DEVICE virtual interface support

Added support for the P2P_DEVICE virtual interface. This interface
is intended for P2P management operations such as discovery and
GO negotiation. Norma

wil6210: P2P_DEVICE virtual interface support

Added support for the P2P_DEVICE virtual interface. This interface
is intended for P2P management operations such as discovery and
GO negotiation. Normally it is implemented by drivers to allow
a separate interface for P2P management with its own MAC address,
but for 11ad drivers it is needed to support P2P search, since it
cannot otherwise be separated from normal scan.

Since we only support a single interface/MAC address, we can't
easily separate between primary and P2P_DEVICE interfaces.
For example when a management packet arrives we can't tell for
which interface it is intended. To work around this, we store
a pointer to the interface where the last "radio operation" was
triggered such as scan or remain on channel, and we forward
management packets and scan results to this interface.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: p2p initial support

supporting p2p_find, p2p_listen and p2p_connect
Use updated cfg80211_get_bss API (additional argument)

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-

wil6210: p2p initial support

supporting p2p_find, p2p_listen and p2p_connect
Use updated cfg80211_get_bss API (additional argument)

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: add support for platform specific notification events

Add the ability to notify the platform driver on different
events, such as FW crash, pre reset and FW ready.

Signed-off-by: Maya Erez

wil6210: add support for platform specific notification events

Add the ability to notify the platform driver on different
events, such as FW crash, pre reset and FW ready.

Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: replay attack detection

Check PN for encrypted frames.
Maintain PN data for Rx keys, pairwise per TID and group.
Print PN's in the debugfs "stations" entry, like:

[0] 04:ce:14:0a:3c:3d con

wil6210: replay attack detection

Check PN for encrypted frames.
Maintain PN data for Rx keys, pairwise per TID and group.
Print PN's in the debugfs "stations" entry, like:

[0] 04:ce:14:0a:3c:3d connected
[ 0] ([32] 0 TU) 0x0fe [____________________________|___] total 252 drop 0 (dup 0 + old 0) last 0x000
[ 0] PN [0+]000000000000 [1-]000000000000 [2-]000000000000 [3-]000000000000
[GR] PN [0-]000000000000 [1+]000000000000 [2+]000000000000 [3-]000000000000
Rx invalid frame: non-data 0, short 0, large 0, replay 0
Rx/MCS: 0 110 65 65 65 0 12 0 0 0 0 0 0
[1] 00:00:00:00:00:00 unused
[2] 00:00:00:00:00:00 unused
[3] 00:00:00:00:00:00 unused
[4] 00:00:00:00:00:00 unused
[5] 00:00:00:00:00:00 unused
[6] 00:00:00:00:00:00 unused
[7] 00:00:00:00:00:00 unused

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: Set permanent MAC address to wiphy

MAC address of wil6210 was not set in wiphy

Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm

wil6210: Set permanent MAC address to wiphy

MAC address of wil6210 was not set in wiphy

Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: remove BACK RX and TX workers

WMI synchronous handling has changed and WMI calls that provide
a buffer for the reply are completed in the WMI interrupt context.
This allows sending the RX a

wil6210: remove BACK RX and TX workers

WMI synchronous handling has changed and WMI calls that provide
a buffer for the reply are completed in the WMI interrupt context.
This allows sending the RX and TX BACK commands from the WMI event
handler without the need for the worker thread.
This is a better approach as it can decrease the handshake time
in the connect flow and prevent race conditions in case of fast
disconnects. An example for such a race is handling of wil_back_rx_handle
during a disconnect event, as wil_back_rx_handle is not protected by
the wil mutex and a disconnect can be handled after sta->status is
verified as connected.

Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: wait for disconnect completion

cfg80211_ops.disconnect() should wait for disconnect flow to
complete. If it does not, internal state becomes out of sync with
one in cfg80211. If one does st

wil6210: wait for disconnect completion

cfg80211_ops.disconnect() should wait for disconnect flow to
complete. If it does not, internal state becomes out of sync with
one in cfg80211. If one does stress test connect/disconnect
sequence, cfg80211 will issue next connect before disconnect
completed internally.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: prevent access to vring_tx_data lock during its init

wil_tx_vring locks the vring_tx_data lock before accessing the TX
vring to check if it is enabled and valid for use.
In case of quick di

wil6210: prevent access to vring_tx_data lock during its init

wil_tx_vring locks the vring_tx_data lock before accessing the TX
vring to check if it is enabled and valid for use.
In case of quick disconnect / connect events for the same station,
spin_lock(&txdata->lock) can be called during the lock initialization
in the vring init function.
To prevent such a race, the TX vrings spin lock should be initialized
once during wil6210 driver initialization.

Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: handle multiple connect/disconnect events

In the current solution wil6210 configures the vring in a worker
and holds only one pending CID. This implementation may lead to
race conditions be

wil6210: handle multiple connect/disconnect events

In the current solution wil6210 configures the vring in a worker
and holds only one pending CID. This implementation may lead to
race conditions between connect and disconnect events of multiple
stations or fast connect/disconnect events of the same station.

In order to allow the removal of the connect worker and handling of
WMI_VRING_CFG_DONE_EVENTID in the connect event, the WMI replies
that provide the reply in a given buffer needs to be handled
immediately in the WMI event interrupt thread.
To prevent deadlocks, WMI replies that requires additional
handling are still handled via the events list.

Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: fix a warning message condition

"iter" is -1 at the end of the loop and not zero. It means we don't
print a warning message.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed

wil6210: fix a warning message condition

"iter" is -1 at the end of the loop and not zero. It means we don't
print a warning message.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: prevent external wmi commands during suspend flow

In __wmi_send we check if fw is ready at the beginning of the function.
While we wait for the completion of the previous command, system su

wil6210: prevent external wmi commands during suspend flow

In __wmi_send we check if fw is ready at the beginning of the function.
While we wait for the completion of the previous command, system suspend
can be invoked and reset the HW, causing __wmi_send to read from HW
registers while it is not ready.
Taking the wmi_mutex in the reset flow when setting the FW ready bit
to zero will prevent the above race condition.

Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: hold wil->mutex while managing vrings

To prevent race when connect flow may run in parallel with
the disconnect event.

Scenario leading to the bug is: while running connect flow on the AP,

wil6210: hold wil->mutex while managing vrings

To prevent race when connect flow may run in parallel with
the disconnect event.

Scenario leading to the bug is: while running connect flow on the AP,
STA sends disconnect. log follows.

<7>[ 668.736269] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Configure for connection CID 1
<7>[ 668.736269] wil6210 0000:01:00.0: wlan0: DBG[MISC]wil_vring_init_tx() max_mpdu_size 2048
<7>[ 668.736301] wil6210 0000:01:00.0: wlan0: DBG[MISC]wil_vring_alloc()
<7>[ 668.736363] wil6210 0000:01:00.0: wlan0: DBG[MISC]vring[1024] 0xffbe8000:d962ce08 0xdb244000
<7>[ 668.736394] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Head 0x00880300 -> 0x00880308
<7>[ 668.736394] wil6210 0000:01:00.0: wlan0: DBG[ WMI]WMI command 0x0821 [28]
<7>[ 668.736426] DBG[ WMI]Cmd 00000000: 20 00 24 00 00 00 00 00 00 00 21 08 00 00 00 00 .$.......!.....
<7>[ 668.736426] DBG[ WMI]cmd 00000000: 00 00 00 00 00 00 5f 5c 00 00 00 00 00 04 00 08 ......_\........
<7>[ 668.736457] DBG[ WMI]cmd 00000010: 01 01 00 00 00 00 00 00 00 00 ff 0f ............
<7>[ 668.736488] wil6210 0000:01:00.0: wlan0: DBG[ IRQ]Pseudo IRQ 0x00000004
<7>[ 668.736519] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Handle WMI 0x1824 (reply_id 0x1821)
<7>[ 668.736519] wil6210 0000:01:00.0: wlan0: DBG[ IRQ]wil6210_mask_irq_pseudo()
<7>[ 668.736519] wil6210 0000:01:00.0: wlan0: DBG[ IRQ]ISR MISC 0x20000000
<7>[ 668.736551] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Handle WMI 0x1003 (reply_id 0x1821)
<7>[ 668.736551] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Disconnect 04:ce:14:00:07:70 reason [proto 3 wmi 4]
<7>[ 668.736582] wil6210 0000:01:00.0: wlan0: DBG[MISC]wil6210_disconnect()
<7>[ 668.736613] wil6210 0000:01:00.0: wlan0: DBG[ IRQ]Thread IRQ
<7>[ 668.736613] wil6210 0000:01:00.0: wlan0: DBG[ IRQ]Thread ISR MISC 0x20000000
<7>[ 668.736644] wil6210 0000:01:00.0: wlan0: DBG[ IRQ]MBOX event
<7>[ 668.736644] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Mbox head 00880330 tail 00880328
<7>[ 668.736676] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Mbox evt 001a 0010 0000 00
<7>[ 668.736676] wil6210 0000:01:00.0: wlan0: DBG[ WMI]WMI event 0x1821 MID 0 @3255145 msec
<7>[ 668.736707] DBG[ WMI]evt 00000000: 1a 00 10 00 00 00 00 10 00 00 21 18 69 ab 31 00 ..........!.i.1.
<7>[ 668.736707] DBG[ WMI]evt 00000010: 01 01 00 00 00 00 00 00 ........
<7>[ 668.736738] wil6210 0000:01:00.0: wlan0: DBG[ WMI]queue_work -> 0
<7>[ 668.736738] wil6210 0000:01:00.0: wlan0: DBG[ WMI]wmi_recv_cmd -> 1 events queued
<7>[ 668.736769] wil6210 0000:01:00.0: wlan0: DBG[ IRQ]wil6210_unmask_irq_pseudo()
<7>[ 668.736832] wil6210 0000:01:00.0: wlan0: DBG[MISC]Disconnect 04:ce:14:00:07:70, CID=1, reason=3
<7>[ 668.736832] wil6210 0000:01:00.0: wlan0: DBG[MISC]wil_disconnect_cid(CID 1, status 1)
<7>[ 668.736894] wil6210 0000:01:00.0: wlan0: DBG[MISC]wil_vring_fini_tx() id=1
<7>[ 668.736894] wil6210 0000:01:00.0: wlan0: DBG[MISC]free Tx vring 1 [1024] 0xffbe8000:d962ce08 0xdb244000
<7>[ 668.736957] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Handle WMI 0x1821 (reply_id 0x1821)
<7>[ 668.736988] wil6210 0000:01:00.0: wlan0: DBG[ WMI]Complete WMI 0x1821
<7>[ 668.737019] wil6210 0000:01:00.0: wlan0: DBG[ WMI]wmi_call(0x0821->0x1821) completed in 0 msec
<3>[ 668.737019] wil6210 0000:01:00.0: wlan0: Tx config failed, status 0x01
<7>[ 668.739518] wil6210 0000:01:00.0: wlan0: DBG[MISC]wil_cfg80211_del_station(04:ce:14:00:07:70, reason=2)
<7>[ 668.739550] wil6210 0000:01:00.0: wlan0: DBG[MISC]wil6210_disconnect()
<7>[ 668.739550] wil6210 0000:01:00.0: wlan0: DBG[MISC]_wil6210_disconnect(bssid=04:ce:14:00:07:70, reason=2, ev-)
<7>[ 668.739581] wil6210 0000:01:00.0: wlan0: DBG[MISC]Disconnect 04:ce:14:00:07:70, CID=-2, reason=2
<7>[ 668.742705] wil6210 0000:01:00.0: wlan0: DBG[MISC]free Tx vring 1 [1024] 0x (null):d962ce08 0x (null)
<3>[ 668.742736] __dma_free_remap: trying to free invalid coherent area: (null)

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: handle failure in Tx vring config

When configuring Tx vring for new connection,
WMI call to the firmware may fail. In this case, need to
clean up properly. In particular, need to call
cfg80

wil6210: handle failure in Tx vring config

When configuring Tx vring for new connection,
WMI call to the firmware may fail. In this case, need to
clean up properly. In particular, need to call
cfg80211_del_sta() in case of AP like interface.

Perform full "disconnect" procedure for proper clean up

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: Do no schedule firmware recovery during reset flow

During reset flow, ignore firmware errors detected prior
to the actual hardware reset as the recovery flow would
make additional unnecessa

wil6210: Do no schedule firmware recovery during reset flow

During reset flow, ignore firmware errors detected prior
to the actual hardware reset as the recovery flow would
make additional unnecessary reset.

Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: treat broadcast bssid as "disconnect all"

Hostapd request disconnect for broadcast bssid when it
wants to disconnect all stations from the AP.

Detect this and really disconnect all connect

wil6210: treat broadcast bssid as "disconnect all"

Hostapd request disconnect for broadcast bssid when it
wants to disconnect all stations from the AP.

Detect this and really disconnect all connected stations.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: support future boot loaders

Boot loader versions as backward compatible,
starting from v1

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kval

wil6210: support future boot loaders

Boot loader versions as backward compatible,
starting from v1

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: report boot loader error

Boot loader reports error starting from the struct v2.

Print error info before reset (power up state) in debug mode,
and print same info as error if target reset t

wil6210: report boot loader error

Boot loader reports error starting from the struct v2.

Print error info before reset (power up state) in debug mode,
and print same info as error if target reset timed out.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: use inline functions for register access

Replace macros like "R", "W", "S", "C", defined multiple times,
with inline functions "wil_[rwsc]".

Use "readl" and "writel" instead of "ioread32"

wil6210: use inline functions for register access

Replace macros like "R", "W", "S", "C", defined multiple times,
with inline functions "wil_[rwsc]".

Use "readl" and "writel" instead of "ioread32" and "iowrite32"
since it is granted that memory transactions are used,
not port ones like IN/OUT

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: skip HW version check for chip debugging

When loading with debug_fw flag, do not bail out on
unknown chipId

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by

wil6210: skip HW version check for chip debugging

When loading with debug_fw flag, do not bail out on
unknown chipId

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: use wil_fw_error_recovery()

Use function wil_fw_error_recovery() instead of inline equivalent code

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle V

wil6210: use wil_fw_error_recovery()

Use function wil_fw_error_recovery() instead of inline equivalent code

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: support boot loader struct v0 & v1

There are 2 versions of boot loader struct: v0 and v1.
In the v1, boot loader build version added; as well as
RF status.

Support both versions.

Boot loa

wil6210: support boot loader struct v0 & v1

There are 2 versions of boot loader struct: v0 and v1.
In the v1, boot loader build version added; as well as
RF status.

Support both versions.

Boot loader structure v1 has RF status; ignore RF error if firmware
not going to be loaded; driver can still be used to interact with the HW

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

wil6210: modparam for bcast ring size

Control Bcast ring size in similar way as Rx and Tx ones,
through "bcast_ring_order" modparam, actual ring size is 1 << order

Signed-off-by: Vladimir Kondratie

wil6210: modparam for bcast ring size

Control Bcast ring size in similar way as Rx and Tx ones,
through "bcast_ring_order" modparam, actual ring size is 1 << order

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...