While testing other things I've found that CE
items aren't cleared properly. This could lead to
null dereferences in BMI.

To prevent that make sure CE revoking clears the
nbytes value (which is used as a buffer completion
indication) and memset the entire CE ring data
shared between host and target when
(re)initializing.

Also make sure to check BMI xfer pointer and print
a splat instead of crashing the kernel.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Currently hif_power_up performs effectively a
reset and hif_stop resets the chip as well so
there's no point in resetting here.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

The power up procedure was overly complex due to
warm/cold reset workarounds and issues.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

One of the problems with warm reset I've found is
that it must be guaranteed that copy engine
registers are not being accessed while being
reset. Otherwise in worst case scenario the host
may lock up.

Instead of using sleeps and hoping the device is
operational in some arbitrary timeframes use
firmware indication register.

As a side effect this makes driver
boot/stop/recovery faster.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Make ath10k_pci_init_pipes() effectively only
alter shared target-host data.

The per_transfer_context is a host-only thing.
It is necessary to preserve it's contents for a
more robust ring cleanup.

This is required for future warm reset fixes.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This should prevent deadlock predicted by the
following splat:

 ======================================================
 [ INFO: possible circular locking dependency detected ]
 3.17.0-wl-ath+ #67 Not tainted
 -------------------------------------------------------
 kworker/u32:1/7230 is trying to acquire lock:
  (&ar->conf_mutex){+.+.+.}, at: [<ffffffffa040a57d>] ath10k_scan_timeout_work+0x2d/0x50 [ath10k_core]

 but task is already holding lock:
  ((&(&ar->scan.timeout)->work)){+.+...}, at: [<ffffffff8106dae1>] process_one_work+0x151/0x470

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 ((&(&ar->scan.timeout)->work)){+.+...}:
        [<ffffffff810a12e5>] lock_acquire+0x85/0x100
        [<ffffffff8106cb4d>] flush_work+0x3d/0x270
        [<ffffffff8106e49d>] __cancel_work_timer+0x7d/0x110
        [<ffffffff8106e543>] cancel_delayed_work_sync+0x13/0x20
        [<ffffffffa0409f16>] ath10k_cancel_remain_on_channel+0x36/0x60 [ath10k_core]
        [<ffffffffa028c75c>] ieee80211_cancel_roc+0x1cc/0x2f0 [mac80211]
        [<ffffffffa028c8a2>] ieee80211_mgmt_tx_cancel_wait+0x22/0x30 [mac80211]
        [<ffffffffa0132288>] nl80211_tx_mgmt_cancel_wait+0xa8/0x130 [cfg80211]
        [<ffffffff816654a5>] genl_family_rcv_msg+0x1a5/0x3c0
        [<ffffffff81665749>] genl_rcv_msg+0x89/0xc0
        [<ffffffff81664e91>] netlink_rcv_skb+0xb1/0xc0
        [<ffffffff816650bc>] genl_rcv+0x2c/0x40
        [<ffffffff8166474d>] netlink_unicast+0x18d/0x200
        [<ffffffff81664add>] netlink_sendmsg+0x31d/0x430
        [<ffffffff8161a9ac>] sock_sendmsg+0x9c/0xd0
        [<ffffffff8161b469>] ___sys_sendmsg+0x389/0x3a0
        [<ffffffff8161bed9>] __sys_sendmsg+0x49/0x90
        [<ffffffff8161bf32>] SyS_sendmsg+0x12/0x20
        [<ffffffff8174c456>] system_call_fastpath+0x1a/0x1f

 -> #0 (&ar->conf_mutex){+.+.+.}:
        [<ffffffff810a0bde>] __lock_acquire+0x1b6e/0x1ce0
        [<ffffffff810a12e5>] lock_acquire+0x85/0x100
        [<ffffffff817491eb>] mutex_lock_nested+0x4b/0x370
        [<ffffffffa040a57d>] ath10k_scan_timeout_work+0x2d/0x50 [ath10k_core]
        [<ffffffff8106db41>] process_one_work+0x1b1/0x470
        [<ffffffff8106df63>] worker_thread+0x123/0x460
        [<ffffffff81073f34>] kthread+0xe4/0x100
        [<ffffffff8174c3ac>] ret_from_fork+0x7c/0xb0

 other info that might help us debug this:

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock((&(&ar->scan.timeout)->work));
                                lock(&ar->conf_mutex);
                                lock((&(&ar->scan.timeout)->work));
   lock(&ar->conf_mutex);

  *** DEADLOCK ***
Reported-by: Marek Puzyniak <marek.puzyniak@tieto.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Rts threshold was being configured instead of
fragmentation threshold.

Keep in mind available firmware binaries don't
seem to support fragmentation anyway so this
doesn't fix fragmentation threshold per se.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

When user space requests survey info, it is useful to know which of the survey
data refers to the channel that is currently actively being used.  One of the
use cases is getting the current channel noise for status output.  Without this
flag you would have to look up the channel separately and then compare it
against the frequency in the survey output in user space.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Instead of defining a completely new tracepoint
use an existing tracepoint class.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Fundamentally this was wrong. Tsf is only valid
in last MPDU of a PPDU. This means tsf value was
wrong most of the time during heavy traffic.

Also I don't see much point in exposing a
redundant (and broken) tsf value. Userspace can
already read it from the dumped rx descriptor
buffer.

Cc: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Once driver entered the rx_confused state it would
refuse to rx even after firmware is restarted.
Make sure to clear it so that rx works after, e.g.
hw restart or after all interfaces are stopped.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

In theory it was possible to drain entire HTT Rx
ring via fragmented Rx leading to Rx lockup.

In practice non-data traffic would always trigger
replenishment via the regular Rx handler.

For correctness sake make sure to replenish the
ring on fragmented Rx.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

The netbuf pop can return NULL. Make sure to check
for that. It shouldn't happen but better safe than
sorry.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

There's little point in dropping, e.g. frames with
FCS error early in ath10k.

This simplifies amsdu_allowed() and gets rid of
htt_rx_mpdu_status usage finally.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Treat non-chained and chained popping the same
way. Also this makes netbuf pop fully symmetrical
to (re)filling.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Tracing function was called before buffers were
unmapped from DMA.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Use the globally defined ieee80211 values instead
of re-defining them in the driver again.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

The rx descriptor variable was no longer used in
the rx handler.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

HTT_RX_IND_MPDU_STATUS_MGMT_CTRL was pretty greedy
and because of that ath10k ended up dropping
Control Frames as well as Null Func frames.
Reported-by: Okhwan Lee <ohlee@mwnl.snu.ac.kr>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Calling init to reinit ce pipe state would also
re-set all static structure links and setting
(which don't change over driver lifecycle).

Make it so alloc links structures and initializes
static data and init part to setup state
variables and clear stuff.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This was the final missing bit to making sure the
device doesn't assert interrupts to host.

This should fix possible race when target crashes
during driver teardown.

This also removes an early warm reset workaround
during pci probing.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

If MSI isn't configured device ROM program expects
legacy interrupts to be enabled before it can
fully boot. Don't forget to disable legacy
interrupts after that.

While at it re-use the legacy irq enabling helper
instead of calling ath10k_pci_write32().
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This simply changes the source for txpower setup.
It does not make ath10k use different txpower
values for different vifs.

This will make it easier to implement chanctx in
ath10k in the future.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Using global channel won't work with chanctx. Try
to determine the channel from the information
provided in the wmi event itself alone. This
should be sufficient.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

The code can be symmetrical so make it so. This
makes it easier to understand and work with.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

It doesn't make much sense to reconfigure peer
completely upon reassociation. This will make it
easier to have a more uniform association code
across different modes.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

There's no need to pass bss_conf explicitly as it
is accessible via vif pointer. This requires
slight changes in function prototypes. While at it
clean up listen interval workaround/command.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

A frequent request have been to be able to provide calibration data from a
file as some of the AP devices store the calibration data on an MTD partition.
This patchset adds support for that and also makes it easier to add Device Tree
support later on.

The calibration data is found by using the id string provided by dev_name()
using this format:

cal-<bus>-<id>.bin

With PCI the id string contains bus, slot and func values. For example for a
PCI device in bus 2 slot 0, ath10k will try to retrieve a calibration data from
a file:

/lib/firmware/ath10k/cal-pci-0000:02:00.0.bin

The calibration data sequence is:

1. Check with request_firmware() if there's a calibration file
   ("cal-<bus>-<id>.bin") on the filesystem for this device. If yes, use that. If
   not, goto 2

2. Check if otp.bin is able to successfully load the calibration data
   from OTP. If yes, use that. If not, goto 3.

4. Print an error message that no calibration data found and stop driver
   initialization for this device.
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This is preparation for being able to download calibration data from a file.
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Commit 3a0861ff ("ath10k: remove ath10k_bus") removed enum ath10k_bus
because it was not used for anything at the time. But now it's needed for for
retrieving the right calibration data file so add it back. Only new addition is
ath10k_bus_str().
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Based on GFP flag given to DMA coherent allocation, the behaviour of
dma_free_coherent is changed. This behavioural diffrence is noticeable
in ARM platform. If DMA memory is allocated with GFP_KERNEL, free
coherent can not be called inside spin lock. This is causing kernel
crash in ARM platforms. Fix this by changing GFP flag to atomic.

This is most likely a regression from commit 64badcb6 ("ath10k: workaround
fw beaconing bug").

Cc: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Add tracing support to forward management and data frames to
user space for packet inspection.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Fix WMI scan command length we setup when scan request.

This fix issue with 636 firmware when scan always failed
with message:

ath10k_pci 0000:02:00.0: wmi start scan
ath10k_pci 0000:02:00.0: wmi stop scan reqid 1 req_type 0 vdev/scan_id 0
ath10k_pci 0000:02:00.0: failed to stop wmi scan: -11
ath10k_pci 0000:02:00.0: failed to stop scan: -11
ath10k_pci 0000:02:00.0: failed to start hw scan: -110
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This is required if we take into account possibility to load the driver
from initrd (RAM disk), so in other words: very early in the boot process,
before the file system is visible.

In such case we need to have the firmware files accessible from ram disk too,
and this patch guarantee this.
Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

It's not really necessary to create bssid peer for
bssid. Self-address peer is sufficient.

This prevents some firmware revisions from crashing.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

It makes a lot more sense to print these kinds of
problems as a warning instead of a debug.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

The tx info such as msdu_id, frame len, vdev id and tid are reported
to user space by tracepoint. This is useful for collecting tx
statistics.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Upon the reception of frame, the descriptor status are reported
to user space by tracepoint. This is useful for collecting rx
statistics.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

This is useful for collecting pktlog statistics of tx, rx
and rate information, so add tracing for the API call.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

Add support to configure packet log filters (tx, rx, rate control)
via debugfs. To disable htt pktlog events set the filters to 0.

ex:

To enable pktlog for all filters

   echo 0x1f > /sys/kernel/debug/ieee80211/phy*/ath10k/pktlog_filter

To disable pktlog

   echo 0 > /sys/kernel/debug/ieee80211/phy*/ath10k/pktlog_filter
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>