Fix the issues which checkpatch found and were easy to fix. Especially
callers of ath6kl_bmi_write() are tricky and that needs to be fixed
separately.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Below two scenarios are taken care in this patch which helped
to fix the firmware crash during wow suspend/resume.

* TX operation (ctrl tx and data tx) has to be controlled based
  on suspend state. i.e, with respect to WOW mode, control packets
  are allowed to send from the host until the suspend state goes
  ATH6KL_STATE_WOW and the data packets are allowed until WOW
  suspend operation starts.

* Similarly, wow resume is NOT allowed if WOW suspend is in progress.
Signed-off-by: NRaja Mani <rmani@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When the wmi event is vif specific, the validation of vif index
is taken care in ath6kl_wmi_proc_events_iface(). This also avoids
the need for a netdev to be registered while receiving initial events
like "target_ready" and "regulatory domain".
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Tx packets will begin to drop when there are multiple traffic priorities
and the current traffic is not the highest priority and the remaining
cookies drop below a certain number, which is fixed for all AC. It is
possilbe that lower priority AC have more traffic which will consume
more cookies and lock out higher priority AC from having any. Assign
each endpoint (AC) with a different Tx-packet-drop threshold so lower
priority AC is more likely to drop packets and the cookies become more
available to higher priority AC.
Signed-off-by: NChilam Ng <chilamng@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

PS buffering of unicast Action frames that are sent in a context
of a BSS. In AP mode when the recepient station goes to powersave
and PS_POLL flag is not set, we would buffer the frames. Send out
unicast mgmt bufferred frame when PS_POLL is received.

This fixes a bug in P2P GO behavior when sending a GO Discoverability
Request to a client that is in sleep mode.

kvalo: indentation fixes
Signed-off-by: NThirumalai Pachamuthu <tpachamu@qca.qualcomm.com>
Signed-off-by: NNaveen Gangadharan <ngangadh@qca.qualcomm.com>
Signed-off-by: NAarthi Thiruvengadam <athiruve@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Update license header with the copyright to Qualcomm Atheros, Inc.
for the year 2011-2012.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

"ath6kl: Define a structure for connection specific aggregation information"
introduces this. In aggr_conn_init(), vif->aggr_cntxt is assigned to
aggr_conn->aggr_info, but vif->aggr_cntxt is not initialized at this
point, this would end up accessing an invalid pointer in aggregation
receive path. Fix this by passing the correct aggr_info to aggr_conn_init().
The panic trace would look like.

[<ffffffff8159e02e>] panic+0xa1/0x1c6
[<ffffffff8103773d>] ? kmsg_dump+0xfd/0x160
[<ffffffff815a2f6a>] oops_end+0xea/0xf0
[<ffffffff8102b95d>] no_context+0x11d/0x2d0
[<ffffffff8102bc5d>] __bad_area_nosemaphore+0x14d/0x230
[<ffffffff815a5c4d>] ? do_page_fault+0x30d/0x520
[<ffffffff8102bd53>] bad_area_nosemaphore+0x13/0x20
[<ffffffff815a5cfd>] do_page_fault+0x3bd/0x520
[<ffffffff8108bd60>] ? __lock_acquire+0x320/0x1680
[<ffffffff812e3a9d>] ? trace_hardirqs_off_thunk+0x3a/0x3c
[<ffffffff815a2385>] page_fault+0x25/0x30
[<ffffffffa0487a5f>] ? aggr_slice_amsdu+0xdf/0x170 [ath6kl_core]
[<ffffffffa0487bac>] aggr_deque_frms+0xbc/0x190 [ath6kl_core]
[<ffffffffa0488404>] ath6kl_rx+0x3e4/0xae0 [ath6kl_core]
[<ffffffffa047ae77>] ath6kl_htc_rxmsg_pending_handler+0x8b7/0xf10 [ath6kl_core]
[<ffffffffa00c82f0>] ? mmc_do_release_host+0x70/0x90 [mmc_core]
[<ffffffffa00c833a>] ? mmc_release_host+0x2a/0x50 [mmc_core]
[<ffffffffa04865c0>] ? ath6kl_alloc_amsdu_rxbuf+0x140/0x140 [ath6kl_core]
[<ffffffffa0477772>] ath6kl_hif_intr_bh_handler+0x362/0x510 [ath6kl_core]
[<ffffffffa01f1000>] ath6kl_sdio_irq_handler+0x60/0xb0 [ath6kl_sdio]
[<ffffffffa00d30bc>] sdio_irq_thread+0xec/0x320 [mmc_core]
[<ffffffffa00d2fd0>] ? sdio_claim_irq+0x220/0x220 [mmc_core]
[<ffffffffa00d2fd0>] ? sdio_claim_irq+0x220/0x220 [mmc_core]
[<ffffffff8105b21e>] kthread+0xbe/0xd0
[<ffffffff815ab574>] kernel_thread_helper+0x4/0x10
[<ffffffff815a2174>] ? retint_restore_args+0x13/0x13
[<ffffffff8105b160>] ? __init_kthread_worker+0x70/0x70
[<ffffffff815ab570>] ? gs_change+0x13/0x13
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Currently rx aggregation related states are maintained per
vif, but this will not properly work when operating in AP mode.
Aggregation is completely broken when more than one
11n stations are connected to AP mode vif. Fix this issue
by keeping station specific aggregation state in sta_list.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The tid which is given in addba/delba req event is not
just tid but also muxed with the assoc id (MSB 4 bits)
which can be used to determine the corresponding connected
station in softap mode. The actual tid is LSB 4 bits. Using
the tid as it is with rx_tid[] would result in OOB or invalid
memory access in AP mode.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This patch just groups connection specific aggregation information
from struct aggr_info into a new structure (struct aggr_info_conn)
so that, in softAP mode, this can be used when each connected station
is made to have it's own aggregation state.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The timer which is used to flush rx aggregation frames needs to
be disabled when resetting the aggregation state. This is found
in code review.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Before I commited patch c1762a3f ("ath6kl: Add support for uAPSD") I
did a minor change how up variable is initialised in
ath6kl_process_uapsdq(). But I was sloppy and caused this compiler
warning:

txrx.c:88:5: warning: 'up' may be used uninitialized in this function

Revert my change to fix the warning.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

* A new APSD power save queue is added in the station structure.
* When a station has APSD capability and goes to power save, the frame
  designated to the station will be buffered in APSD queue.
* When the host receives a frame which the firmware marked as trigger,
  host delivers the buffered frame from the APSD power save queue.
  Number of frames to deliver is decided by MAX SP length.
* When a station moves from sleep to awake state, all frames buffered
  in APSD power save queue are sent to the firmware.
* When a station is disconnected, all frames bufferes in APSD power save
  queue are dropped.
* When the host queues the first frame to the APSD queue or removes the
  last frame from the APSD queue, it is indicated to the firmware using
  WMI_AP_APSD_BUFFERED_TRAFFIC_CMD.

kvalo: fix buggy handling of sks queues, made it more obvious
the user priority when wmm is disabled, remove unneed else block and
combined some variable declarations
Signed-off-by: NThirumalai Pachamuthu <tpachamu@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The change enables offloading TCP checksum calculation to firmware.
There are still some issues with the checksum offload so better to
disable it by default until the issues are resolved.

To enable TCP checksum offload for tx and rx paths, use
the ethtool as follows:
ethtool -K <interface> tx on
ethtool -K <interface> rx on

To disable TCP checksum offload, for tx and rx paths, use
the ethtool as follows:
ethtool -K <interface> tx off
ethtool -K <interface> rx off

kvalo: indentation changes
Signed-off-by: NRishi Panjwani <rpanjwan@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Needed when detecting how many vifs firmware supports.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

"ath6kl: Maintain virtual interface in a list" mistakenly stops the
netq only when the mode is ibss. This causes packet drops in sta mode
when the available cookies (buffer abstraction in ath6kl and also used
for tx throttling) runs out for the highest priority traffic. This patch
just fixes this regression though the original code may still need fixes
which can be addressed in separate patches.
Reported-by: NKalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When buffer alignmnet is applied, the data pointer of skb taken from
cookie will no longer point to the first byte of the actual data.
But the skb->data pointer is used in ath6kl_tx_complete() to get
the index of the virtual interface which will not give the correct
interface index and sometimes may give the following WARN_ON() message.
Use packet->buf instead of skb->data to fix this.

WARNING: at drivers/net/wireless/ath/ath6kl/wmi.c:88 ath6kl_get_vif_by_index+0x5b/0x60 [ath6kl]()
Hardware name: 2842K3U
Modules linked in: ath6kl mmc_block cfg80211 binfmt_misc ppdev nfs nfsd lockd nfs_acl auth_rpcgss sunrpc exportfs snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel
+snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy thinkpad_acpi snd_seq_oss snd_seq_midi snd_rawmidi joydev fbcon tileblit font bitblit softcursor
+snd_seq_midi_event snd_seq snd_timer snd_seq_device i915 uvcvideo drm_kms_helper drm psmouse serio_raw snd i2c_algo_bit sdhci_pci videodev intel_agp soundcore intel_gtt jmb38x_ms
+memstick sdhci snd_page_alloc nvram lp parport agpgart video ahci r8169 mii libahci [last unloaded: ath6kl]
Pid: 15482, comm: kworker/u:1 Tainted: G        W   3.1.0-rc10-wl+ #2
Call Trace:
 [<c0144d72>] warn_slowpath_common+0x72/0xa0
 [<fb7c94fb>] ? ath6kl_get_vif_by_index+0x5b/0x60 [ath6kl]
 [<fb7c94fb>] ? ath6kl_get_vif_by_index+0x5b/0x60 [ath6kl]
 [<c0144dc2>] warn_slowpath_null+0x22/0x30
 [<fb7c94fb>] ath6kl_get_vif_by_index+0x5b/0x60 [ath6kl]
 [<fb7c7028>] ath6kl_tx_complete+0x128/0x4d0 [ath6kl]
 [<c04df920>] ? mmc_request_done+0x80/0x80
 [<fb7b9e2e>] htc_tx_complete+0x5e/0x70 [ath6kl]
 [<c05e4cf6>] ? _raw_spin_unlock_bh+0x16/0x20
 [<fb7ce588>] ? ath6kl_sdio_scatter_req_add+0x48/0x60 [ath6kl]
 [<fb7b9f42>] htc_async_tx_scat_complete+0xb2/0x120 [ath6kl]
 [<fb7ce9e7>] ath6kl_sdio_scat_rw+0x87/0x370 [ath6kl]
 [<c0101e12>] ? __switch_to+0xd2/0x190
 [<c01397b5>] ? finish_task_switch+0x45/0xd0
 [<c05e272e>] ? __schedule+0x3ae/0x8b0
 [<fb7cf00a>] ath6kl_sdio_write_async_work+0x4a/0xf0 [ath6kl]
 [<c015d266>] process_one_work+0x116/0x3c0
 [<fb7cefc0>] ? ath6kl_sdio_read_write_sync+0xb0/0xb0 [ath6kl]
 [<c015f5b0>] worker_thread+0x140/0x3b0
 [<c015f470>] ? manage_workers+0x1f0/0x1f0
 [<c0163424>] kthread+0x74/0x80
 [<c01633b0>] ? kthread_worker_fn+0x160/0x160
 [<c05ebdc6>] kernel_thread_helper+0x6/0x10
Reported-by: NAarthi Thiruvengadam <athiruve@qca.qualcomm.com>
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

skb is dropped in ath6kl_data_tx() when the headroom in skb
is insufficient. We hit this condition for every skb in AP mode
which is used with bridge, so all tx packets are getting dropped
when tried to send traffic to wireless client from bridge. Fix
this by reallocating the headroom instead of dropping the skb
when it has lesser headroom than needed.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The target triggers sdio data line to wake up the host when
WOW pattern matches. This causes sdio irq handler is being
executed in the host side which internally hits ath6kl's RX path.

WOW resume should happen before start processing any data from
the target. So it's required to perform WOW resume in RX path.

This area needs bit rework to avoid WOW resume in RX path,
As of now it's fine to have this model, rework will be done later.
Signed-off-by: NRaja Mani <rmani@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The following is the lockdep warning which detects possible
deadlock condition with the way ar->lock and ar->list_lock
are being used.

  (&(&ar->lock)->rlock){+.-...}, at: [<ffffffffa0492d13>] ath6kl_indicate_tx_activity+0x83/0x110 [ath6kl]
 but this lock took another, SOFTIRQ-unsafe lock in the past:
  (&(&ar->list_lock)->rlock){+.+...}

 and interrupts could create inverse lock ordering between them.

 other info that might help us debug this:
  Possible interrupt unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&(&ar->list_lock)->rlock);
                                local_irq_disable();
                                lock(&(&ar->lock)->rlock);
                                lock(&(&ar->list_lock)->rlock);
   <Interrupt>
     lock(&(&ar->lock)->rlock);

  *** DEADLOCK ***

softirqs have to be disabled when acquiring ar->list_lock to avoid
the above deadlock condition. When the above warning printed the
interface is still up and running without issue.
Reported-by: NKalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ath6kl_tx_complete() was printing an error when packet was canceled.
That causes unnecessary errors when hardware is powered off.

Also change the error to a warning and cleanup the message.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This patch removes all references to ar->vif and takes
vif from a list.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Use this spinlock to protect the vif's data instead of
one from ath6kl.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Interface index is passed in wmi data header as well, use it
to get the corresponding vif structure.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Use one which is available in vif structure instead.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Interface index is passed in wmi command header from target.
Use this index to get the appropriate vif.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Pass this index to target in wmi commands to specify the interface
for which the command needs to be handled.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Currently ar->flag maintains interface stats. Move interface
specific states from ar->flag to vif->flags.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

smatch found that skb might be null in some cases in ath6kl_rx():

ath6kl/txrx.c +1252 ath6kl_rx(222) error: potential null derefence 'skb'.

This will happen when ath6kl is in AP mode and two clients send traffic
to each other.
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Makes it easier to recognise longs dumps.

Obligatory screenshot using "rx" prefix:

ath6kl: ath6kl_rx
rx 00000000: 10 10 00 00 00 00 08 30 00 00 00 00 00 00 f9 0b  .......0........
rx 00000010: 2c 44 08 30 00 00 f9 0b 0c a4 02 00 00 00 73 d2  ,D.0..........s.
rx 00000020: 94 00 f9 0b 04 8c 01 00 02 00 07 02 02 00 f9 0b  ................
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Commit 94e532d1 ("ath6kl: Fix system freeze under heavy data load")
aligns the skb data without checking if the skb is cloned. Because of
this ath6kl can corrupt the local TCP stack information that can result
in TCP retransmission failing and TCP connections stalling.

To avoid the corruption we need to copy the skb. Now the alignment
in ath6kl_htc_tx_buf_align() doesn't corrupt TCP packets anymore (and is
not even used for the cloned skb's that got copied since the alignment
of the data is handled at the copy time).
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When pinging form ar6003 to the AP RTT was high even when power save was
disabled:

100 packets transmitted, 97 received, 3% packet loss, time 99125ms
rtt min/avg/max/mdev = 1.875/46.733/795.506/139.181 ms

After some investigation one reason for this was that received
multicast traffic confused the aggrecation logic and caused 400 ms
timeouts when receiving multicast frames from AP.

A simple way to fix is to pass only unicast frames for aggregation. This
improves RTT:

100 packets transmitted, 99 received, 1% packet loss, time 99144ms
rtt min/avg/max/mdev = 2.083/13.084/403.390/56.794 ms
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Patch "ath6kl: Fix buffer alignment for scatter-gather write" does
memmove for a length (scat_req->scat_list[i].len) which is not the
actual length of data that is suppossed to be moved. The right
lengh is packet->act_len + HTC_HDR_LENGTH. Using wrong length
for data move during buffer alignment causes system freeze after
the following WARN_ON and sometimes target assert.

WARNING: at drivers/net/wireless/ath/ath6kl/main.c:771 ath6k_credit_distribute+0x196/0x1a0
 [<ffffffffa051cf5f>] ath6kl_htc_rxmsg_pending_handler+0x83f/0xe00 [ath6kl]
 [<ffffffff8104a743>] ? __wake_up+0x53/0x70
 [<ffffffffa0518b18>] ath6kldev_intr_bh_handler+0x188/0x650 [ath6kl]
 [<ffffffffa052d316>] ath6kl_sdio_irq_handler+0x36/0x80 [ath6kl]
 [<ffffffff81492b3c>] sdio_irq_thread+0xfc/0x360
 [<ffffffff81051c52>] ? default_wake_function+0x12/0x20
 [<ffffffff81492a40>] ? sdio_claim_irq+0x220/0x220
 [<ffffffff81080c36>] kthread+0x96/0xa0
 [<ffffffff815b9fb4>] kernel_thread_helper+0x4/0x10
 [<ffffffff81080ba0>] ? kthread_worker_fn+0x190/0x190
 [<ffffffff815b9fb0>] ? gs_change+0x13/0x13
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

For non-scatter buffers, there is already a bounce buffer which
takes care of alignment. This patch is influenced by a rough patch of
Kalle.
Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>