Currently mac80211 does not support WDS and DFS with channel context
drivers. So advertise these features only when the driver is not
supporting channel context and modparam "use_chanctx" is introduced
for preparing channel context support in ath9k.
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In case of receiving frame with sequence number far greater than current,
wil_release_reorder_frames() will iterate many times over empty buffer.

Optimize this case by checking buffer emptiness and simply update
head_seq_num without iterating.
Suggested-by: NVladimir Shulman <Vladimir.Shulman@Wilocity.com>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

use proper format %pad for the dma_addr_t arguments;
prefix %p with 0x, as %p don't print is by itself
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If scan has not finished in some reasonable time (10sec), interpret it as
if firmware error occurs but was not reported. Firmware should report
scan completion for every scan request, so it is error condition indeed.
Perform firmware recovery procedure.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Provide clear definition of the watermarks for the vring descriptor space.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In case there is something fundamentally wrong with the firmware
(example: RF cable disconnected), FW will always crash immediately
after reset. This leads to infinite fw error recovery loop.

Count consecutive unsuccessful error recovery attempts in a short period
of time, and stop doing recovery after some reasonable count.
It is still possible to manually reset fw doing
interface down/up sequence.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Obey 802.11 spec that defines max. data size 7920 bytes
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

pm_lock is taken twice while syncing HW TSF of p2p vif.
Fix this by taking the lock at caller side.

Cc: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This issue was reported by coccicheck using the semantic patch
at scripts/coccinelle/api/memdup.cocci
Signed-off-by: NBenoit Taine <benoit.taine@lip6.fr>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The commit "ath9k: fix possible hang on flush" changed the receive code
to always link rx descriptors of processed frames, even when flushing.
In some cases, this leads to flushed rx buffers being passed to the
hardware while rx is already stopped.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Make DFS pulse interval calculation independent
from CONFIG_ATH9K_DEBUGFS.
Signed-off-by: NZefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This prevents leaving incomplete scatter-gather
transfer on CE rings which can lead firmware to
crash.
Reported-By: NAvery Pennarun <apenwarr@gmail.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It was possible to read invalid state of CE ring
buffer indexes. This could lead to scatter-gather
transfer failure in mid-way and crash firmware
later by leaving garbage data on the ring.
Reported-By: NAvery Pennarun <apenwarr@gmail.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It seems ath10k firmware gives us no way to know
the rssi for rx-fragments.
Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

FW creates self-peer for AP internally.

This prevents ath10k from trying to create
explicit self-peer during hw recovery and thus
prevents a timeout and a warning during teardown:

  ath10k: removing stale peer $AP_BSSID from vdev_id 0
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

All configuration sequences should be protected
with conf_mutex to avoid concurrent/conflicting
requests.

This should make sure that wep tx key setup is not
performed while hw is restarted (at least).
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This makes sure no further tx requests are
submitted to HTT before driver teardown.

This should prevent invalid pointer/NULL
dereference on htt tx pool in ath10k_htt_tx() in
some cases of heavy traffic.

kvalo: remove the WARN_ON() if conf_mutex is held
Reported-By: NBen Greear <greearb@candelatech.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This reduces risk of races and prepares for more
hw restart fixes.

It also makes sense to perform teardown after
mac80211 starts its restart routine as it
guarantees it has stopped itself by then
(including tx queues).
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This fixes failpath when override AC pdev param
setup fails and makes other pdev params setting
fail as well.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

If ath10k was built into the kernel it could stall
booting for 120 seconds by default (60 seconds for
each firmware API variant) waiting for firmware
files before userspace was ready or filesystems
mounted.

Fix this by making the core registering
asynchronous.

This also shoves off about 1 second from boot time
on most systems since the driver is now mostly
initialized in a worker and modprobe takes very
little time to complete.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The tasklet is already guaranteed to be killed on
the teardown path.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This will avoid unnecessary forward declaration of
any kind in the future.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This prevents protected flag being stripped from
undecrypted raw sniffed frames when monitor
interface is active.
Reported-by: NChun-Yeow Yeoh <yeohchunyeow@gmail.com>
Tested-by: NChun-Yeow Yeoh <yeohchunyeow@gmail.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The channel_switch_beacon callback is optional, so it doesn't have to
be defined if it's not going to do anything useful with it.  Both
ath9k and ath10k define the callback and just returns.  This commit
removes them.

Cc: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

tmp may be used uninitialized if ath10k_bmi_read_memory() returns
an error.
Signed-off-by: NFrederic Danis <frederic.danis@linux.intel.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Recently there was a bug discovered that involved
hif_stop() being called twice that ended up with a
double free_irq() call but it only manifested with
multiple MSI interrupts mapping.

Catch this kind of a problem early in driver
regardless of interrupt mapping.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It was possible to call hif_stop() 2 times through
ath10k_htc_connect_init() timeout failpath which
could lead to double free_irq() kernel splat for
multiple MSI interrupt case.

Re-order init sequence to avoid this problem. The
HTC stop shouldn't stop HIF implicitly since it
doesn't implicitly start it. Since the re-ordering
required some functions to be split/removed/renamed
rename a few functions to make more sense while at
it.
Reported-By: NBen Greear <greearb@candelatech.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

On idle state, sleep timer is scheduled to put the chip into fullsleep.
But during suspend, this timer is scheduled after the chip is moved to
fullsleep forcibily. This is causing below unnecessary error messages
in kernel log during suspend.

ath: phy2: timeout (100000 us) on reg 0x806c: 0xdeadbeef & 0x01f00000
!= 0x00000000
ath: phy2: RX failed to go idle in 10 ms RXSM=0xdeadbeef
ath: phy2: DMA failed to stop in 10 ms AR_CR=0xdeadbeef AR_DIAG_SW=0xdeadbeef
DMADBG_7=0xdeadbeef
Reported-by: NArkh4mKn1ght <arkh4mkn1ght@gmail.com>
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The keycache index is used to abort transmission for given station
when it goes to sleep state. But the commit "ath9k_hw: Abort transmission
for sleeping station" is not handling multi-key station. Fix that.

Cc: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

DFS pulse interval printing is only available
when CONFIG_ATH9K_DEBUGFS is set.
Signed-off-by: NZefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

carl9170_usb_probe() does not handle request_firmware_nowait() failure
that leads to several leaks in this case.
The patch adds all required deallocations.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Verified that target's tx/rx chain register is set appropriately,
and that the tx rate goes down as number of chains
decrease, but I did not actually try to verify antenna
ceased to transmit when disabled.

kvalo: move ar->supp_*_chainmask initialisation to ath10k_mac_register()
Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NAvery Pennarun <apenwarr@gmail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Apparently Oleksij's compile testing was no better than mine initially
was... :-(

Cc: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

  CC [M]  drivers/net/wireless/ath/ath9k/htc_drv_txrx.o
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c: In function ‘ath9k_rx_prepare’:
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1006:2: warning: passing argument 2 of ‘ath9k_htc_err_stat_rx’ from incompatible pointer type [enabled by default]
  ath9k_htc_err_stat_rx(priv, &rx_stats);
  ^
In file included from drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:17:0:
drivers/net/wireless/ath/ath9k/htc.h:380:20: note: expected ‘struct ath_htc_rx_status *’ but argument is of type ‘struct ath_rx_status *’
 static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
Signed-off-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The data transmission to the power save station should be aborted
immediately, whenever the station informs sleep state. Right now
the frames queued into into hardware are being transmitted until
the hardware detects the power save station based excessive retries
of the data frames due to unacknowlegdement. Then remaining frames
are returned with filetered status and might be retried later by
driver or mac80211.

Per WFA certification testing, AP should not send out more than two
frames after processing nullfunc with PM bit set from associated
station. To speed up tx filtering, the pending frames in hardware
queues for given station will be aborted immediately via tx filter
registers. This transmit filters can be ignored if the descriptor
is having invalid destination index or clear destination mask set.
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This also propagates through the drivers.

The orinoco driver uses the cfg80211 API structs for internal
bookkeeping, and so needs a (void *) cast that removes the
const - but that's OK because it allocates those pointers.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This propagates through all the drivers and mac80211.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Add initial values for JP DFS pattern detector.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add initial values for DFS FCC pattern detector.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Tested-by: NBartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fix sending and receiveing protected managment frames.
Lack of protected flag for received protected action frames
causes report these frames as unprotected robust action frames.
If the driver in AP mode sent frame with protected flag and
CCMP header using IEEE80211_KEY_FLAG_SW_MGMT_TX flag,
the FW encrypted frames once again. From user side all
received SA Query Requests and Responses were skipped and
all protected action frames were sent as malformed packets.
Signed-off-by: NMarek Kwaczynski <marek.kwaczynski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>