ath10k doesn't support qca988x hw1.0 boards anymore. Unfortunately
the PCI id is the same in hw1.0 and hw2.0 so ath10k tries to use
hw1.0 boards anyway. But without hw1.0 workarounds in place
ath10k just crashes horribly.

To avoid using hw1.0 boards at all add a chip id detection
and fail the probe if hw1.0 is detected:

[ 5265.786408] ath10k: ERROR: qca988x hw1.0 is not supported
[ 5265.786497] ath10k: Unsupported chip id 0x043200ff
[ 5265.786574] ath10k: could not register driver core (-95)
[ 5265.793191] ath10k_pci: probe of 0000:02:00.0 failed with error -95

Also add a warning if there's an unknown chip id but continue
the boot process normally anyway.
Reported-by: NZaki Bakar <zaki.bm@gmail.com>
Tested-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ath10k_ce_init() and the functions it calls wakeup
the chip multiple times. Simplify that to call
ath10k_pci_wake() only once. This also makes it
easier to add error handling when wakeup fails.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

We should not try to access hw if wakeup fails so add
proper error checking for that. Also add the timeout lenght
to the warning message.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The error handling was just weird, simplify it.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This is consistent with all other functions.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Void pointers are bad, mmkay.

No functional changes.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It's easier to read t if the field names are visible.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It's much more readable if struct entries in host_ce_config_wlan
are explicitly set.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

cacheline_sz is not used anywhere and can be removed.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The new naming makes more sense.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The new naming makes more sense.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The new naming makes more sense.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Some parameters were unused and are not required.
They have no representation in firmware. Clean
them up.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It was only written to and never read back. No use
to keep it around.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Simplifies memory managament of ce_state.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ath10k_debug_read_target_stats is properly
protected by data_lock (spinlock). Remove
the unwanted mutex_unlock(&ar->conf_mutex)

[ BUG: bad unlock balance detected! ]
-------------------------------------
kworker/u4:0/12459 is trying to release lock
(&ar->conf_mutex) at:
[<c16a170d>] mutex_unlock+0xd/0x10
but there are no more locks to release!

 Call Trace:
  [<c16a170d>] ? mutex_unlock+0xd/0x10
  [<c10b697d>] __lock_release+0x4d/0xe0
  [<f88ca0fc>] ? ath10k_debug_read_target_stats+0xac/0x290

  [<c16a170d>] ? mutex_unlock+0xd/0x10
  [<c10b6a5b>] lock_release+0x4b/0x150
  [<c16a1580>] __mutex_unlock_slowpath+0x70/0x150
  [<f88ca0fc>] ? ath10k_debug_read_target_stats+0xac/0x290

  [<c10b456b>] ? trace_hardirqs_on+0xb/0x10
  [<c16a170d>] mutex_unlock+0xd/0x10
  [<f88ca107>] ath10k_debug_read_target_stats+0xb7/0x290

  [<f88d337a>] ath10k_wmi_event_process+0x3fa/0x6e0

  [<c10b456b>] ? trace_hardirqs_on+0xb/0x10
  [<f88d36e1>] ath10k_wmi_event_work+0x21/0x40
               [ath10k_core]
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

New firmware comes with new HTT protocol version.
In 3.0 the separate mgmt tx command has been
removed. All traffic is to be pushed through data
tx (tx_frm) command with a twist - FW seems to not
be able (yet?) to access tx fragment table so for
manamgement frames frame pointer is passed
directly.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The mgmt_rx event structure has been expanded.
Since the structure header is expanded the payload
(i.e. mgmt frame) is shifted by a few bytes. This
needs to be taken into account in order to support
both old and new firmware.

This introduces a fw_features to keep track of any
FW-related ABI/behaviour changes.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

WEP encoding was not working properly for AP and IBSS mode.
TX frames were encrypted with default WEP tx key index set
always to zero, what sometimes was wrong when different
key index should be used. This patch allows to update
WEP key index also for AP and IBSS mode.
Problem detected during automated WEP tests.
Signed-off-by: NMarek Puzyniak <marek.puzyniak@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

There was a possible memory leak when WMI command
queue reached it's limit. Command buffers were not
freed.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This enables driver to rx another decapped a-msdu
frames. It should possibly help with throughputs
in some cases and reduce (or eliminate) number of
messages like this:

  ath10k: error processing msdus -524
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The "disable credit flow" flag was set too late
and it never was in the HTC service request
message.

This patch prevents firmware from reporting
(useless) HTC credits for HTT service. HTT service
doesn't use nor need credits.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This makes it possible to see the reason why the
setup fails. It also adheres to code style of
error checking in ath drivers.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Improve code readability by using enum and a
switch-case.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This fixes checkpatch warning from the latest
3.11-rc kernel tree.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Remove useless code that was causing WARN_ON when
a 80MHz+ vif entered promiscuous mode or monitor
interface was started.

The channel mode is already computed by
chan_to_phymode().
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Handle pci_alloc_consistent(), kmalloc()
errors in copy engine module.
Found during code review.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The latest supported and available FW build is 1.0.0.636.
Reflect this in ath10k code.
Signed-off-by: NBartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Since the firmware support is no longer available for hw1.0,
drop all code (especially workarounds) for those units.
Signed-off-by: NBartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Setup UAPSD peer/peer rate flags correctly.
WMI_RC_UAPSD_FLAG is a peer rate capabilities flag
and should not be set as a peer flag.
Found during code review, doesn't fix a known
issues.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

In our Fuz testing, reference client corrupts the dest mac to "00:00:00:00:00:00"
in the WPA2 handshake no 2. During driver init the sta_list entries mac
addresses are by default "00:00:00:00:00:00". Driver returns an invalid
pointer (conn) and the drver shall crash, if rxtids (aggr_conn)
skb queues are accessed, since they would not be initialized.
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Make sure to cancel heart beat timer before
freeing wmi to avoid potential NULL pointer
dereference.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Unify the PCI options location.

By default the SoC PS option is disabled to boost the
performance and due to poor stability on early HW revisions.
In future we can remove the module parameter and turn on/off
the PS for given hardware.

This change also makes the pci module parameter for SoC PS static.
Signed-off-by: NBartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This fixes interrupt-related issue when no
interfaces were running thus the device was
considered powered down.

The power_down() function isn't really powering
down the device. It simply assumed it won't
interrupt. This wasn't true in some cases and
could lead to paging failures upon FW indication
interrupt (i.e. FW crash) because some structures
aren't allocated in that device state.

One reason for that was that ar_pci->started
wasn't reset. The other is interrupts should've
been masked when teardown starts.

The patch reorganized interrupt setup and makes
sure ar_pci->started is reset accordingly.
Reported-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

pci_disable_msi() must be called if the initial
request_irq() fails.

Also add a warning message so it's possible to
distinguish request_irq() failure and
pci_enable_msi() failure.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The private memory area in vif provided by
mac80211 isn't guaranteed to be zeroed.

This patch should fix issues when switching
between STA and AP interface types.

The tim_bitmap could become polluted by STA bssid
field (since it's a union), wep_keys array
could also become polluted with invalid pointers
and probably much more.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Apparently the available firmware has a limit of
handling 7 APs, 3 GOs or 8 STAs. This is based on
empirical tests and it is still possible some
combinations may crash the firmware.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Normally user specifies broadcast ssid for
scanning. If the user wants to do a passive scan
it does not pass any ssids.

The patch makes sure we ath10k tells firmware to
not send anything at all in case it decides no
ssids equals broadcast ssid.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

If the device is removed and hotplug fails
ioread32() will return 0xFFFFFFFF. In that case
reading ringbuffer during device bringup led to
out-of-bounds addressing of a ringbuffer array
that in turn led to a paging failure.

This could be reproduced by the following:
 * boot without acpi/prevent hotplug from working
 * insert and manually detect (pci rescan) the device
 * remove the device physically
 * load ath10k driver
 * kernel crashed

Ringbuffer index reading is now protected by using
an appropriate mask to prevent addressing an
invalid array index.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This implements a limited subset of what can be
reported in the survey dump.

This can be used for assessing approximate channel
load, e.g. for automatic channel selection.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>