It was found during testing the nss calculation does not
cover all corner cases. Station could request eq. only MCS8
and MCS9 (nss=2 specific). Next num_rates=2 so the driver
sets nss=(max((2+7)/8, 1))=1. Which is wrong. The in-driver
calculation was introduced prior (commit ddcc347b
mac80211: fix rx_nss calculation for drivers with hw rc).
Since it's fixed, use mac80211 provided value from now.
End user will experience lower throuhputs than expected
if the nss is wrongly calculated.
Signed-off-by: NMarek Kwaczynski <marek.kwaczynski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

This throw a lot of pointless warnings in case of DFS (radar
detection) and PHYERR events from firmware, when firmware may
actually insert more data, than we assume.

Besides of being noisy this debug does not protect or check
anything usefull currently. It was introduced long time ago
while debugging aggregations. So just removing it.
Signed-off-by: NBartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Make it easier to grep for htt rx errors.
Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Show message length and expected length.  Helps debug
firmware mismatch issues.
Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Aids in understanding excactly what a firmware is
offering.
Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ARP frames exchange does not work properly for UAPSD enabled AP.
ARP requests which arrives with access category 0 are processed
by network stack and send back with access category 0. FW changes
access category to 6. This is causing problems when UAPSD associated
STA is sleeping after has sent ARP request. Configure ARP access
category in FW to best effort (0) solves this problem. ARP frames
will be send with access category 0.

Simplify arp ac override functionality by removing redundant entry in
pdev param maping table. There should be only one entry in pdev param
map but enum has different name for different FW.

kvalo: change the warning message
Signed-off-by: NMarek Puzyniak <marek.puzyniak@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

If recovery failed ath10k returned 0 (success) and
mac80211 continued to call other driver callbacks.
This caused null dereference.

This is how the failure looked like:

ath10k: ctl_resp never came in (-110)
ath10k: failed to connect to HTC: -110
ath10k: could not init core (-110)
BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffffa0b355c1>] ath10k_ce_send+0x1d/0x15d [ath10k_pci]
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: ath10k_pci ath10k_core ath5k ath9k ath9k_common ath9k_hw ath mac80211 cfg80211 nf_nat_ipv4 ]
CPU: 1 PID: 36 Comm: kworker/1:1 Tainted: G        WC   3.13.0-rc8-wl-ath+ #8
Hardware name: To be filled by O.E.M. To be filled by O.E.M./HURONRIVER, BIOS 4.6.5 05/02/2012
Workqueue: events ieee80211_restart_work [mac80211]
task: ffff880215b521c0 ti: ffff880215e18000 task.ti: ffff880215e18000
RIP: 0010:[<ffffffffa0b355c1>]  [<ffffffffa0b355c1>] ath10k_ce_send+0x1d/0x15d [ath10k_pci]
RSP: 0018:ffff880215e19af8  EFLAGS: 00010292
RAX: ffff880215e19b10 RBX: 0000000000000000 RCX: 0000000000000018
RDX: 00000000d9ccf800 RSI: ffff8800c965ad00 RDI: 0000000000000000
RBP: ffff880215e19b58 R08: 0000000000000002 R09: 0000000000000000
R10: ffffffff812e1a23 R11: 0000000000000292 R12: 0000000000000018
R13: 0000000000000000 R14: 0000000000000002 R15: ffff88021562d700
FS:  0000000000000000(0000) GS:ffff88021fa80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000001a0d000 CR4: 00000000000407e0
Stack:
 d9ccf8000d47df40 ffffffffa0b367a0 ffff880215e19b10 0000000000000010
 ffff880215e19b68 ffff880215e19b28 0000000000000018 ffff8800c965ad00
 0000000000000018 0000000000000000 0000000000000002 ffff88021562d700
Call Trace:
 [<ffffffffa0b3251d>] ath10k_pci_hif_send_head+0xa7/0xcb [ath10k_pci]
 [<ffffffffa0b16cbe>] ath10k_htc_send+0x23d/0x2d0 [ath10k_core]
 [<ffffffffa0b1a169>] ath10k_wmi_cmd_send_nowait+0x5d/0x85 [ath10k_core]
 [<ffffffffa0b1aaef>] ath10k_wmi_cmd_send+0x62/0x115 [ath10k_core]
 [<ffffffff814e8abd>] ? __netdev_alloc_skb+0x4b/0x9b
 [<ffffffffa0b1c438>] ath10k_wmi_vdev_set_param+0x91/0xa3 [ath10k_core]
 [<ffffffffa0b0e0d5>] ath10k_mac_set_rts+0x3e/0x40 [ath10k_core]
 [<ffffffffa0b0e1d0>] ath10k_set_frag_threshold+0x5e/0x9c [ath10k_core]
 [<ffffffffa09d60eb>] ieee80211_reconfig+0x12a/0x7b3 [mac80211]
 [<ffffffff815a8069>] ? mutex_unlock+0x9/0xb
 [<ffffffffa09b3a40>] ieee80211_restart_work+0x5e/0x68 [mac80211]
 [<ffffffff810c01d0>] process_one_work+0x1d7/0x2fc
 [<ffffffff810c0166>] ? process_one_work+0x16d/0x2fc
 [<ffffffff810c06c8>] worker_thread+0x12e/0x1fb
 [<ffffffff810c059a>] ? rescuer_thread+0x27b/0x27b
 [<ffffffff810c5aee>] kthread+0xb5/0xbd
 [<ffffffff815a9220>] ? _raw_spin_unlock_irq+0x28/0x42
 [<ffffffff810c5a39>] ? __kthread_parkme+0x5c/0x5c
 [<ffffffff815ae04c>] ret_from_fork+0x7c/0xb0
 [<ffffffff810c5a39>] ? __kthread_parkme+0x5c/0x5c
Code: df ff d0 48 83 c4 18 5b 41 5c 41 5d 5d c3 55 48 89 e5 41 57 41 56 45 89 c6 41 55 41 54 41 89 cc 53 48 89
RIP  [<ffffffffa0b355c1>] ath10k_ce_send+0x1d/0x15d [ath10k_pci]
 RSP <ffff880215e19af8>
CR2: 0000000000000000
Reported-By: NBen Greear <greearb@candelatech.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The kernel already has this information, and individual drivers
shouldn't duplicate that.  This also eliminates the use of __DATE__ and
__TIME__, which make the build non-deterministic.
Signed-off-by: NJosh Triplett <josh@joshtriplett.org>
Signed-off-by: NMichal Marek <mmarek@suse.cz>

Until now ath10k used a copy-by-value beacon
submission.

The new method passes a DMA address via WMI
command only. This command contains additional
metadata that fixes AP behaviour with regard
to powersave buffering.

This also fixes strange bug when multicast traffic
would freeze TX indefinitely.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NMarek Puzyniak <marek.puzyniak@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Most channel switching logic has been implemented
already so this patch is pretty small. The patch
makes use of mac80211's vif->csa_active for AP CSA
handling.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Until now channel change wasn't propagating to FW
directly because operational channel is abstracted
by VDEVs and it wasn't really necessary since
ath10k implements hwscan and hwroc.

This effectively fixes STA CSA and allows for
future AP-like CSA as well.

kvalo: change error handling in ath10k_bss_info_changed()
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The threshold values for RX interrupt mitigation
are different for AR9003 and AR9002 families.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRoman Dubtsov <dubtsov@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The commit "ath9k: Process GTT interrupts" accidentally
had a line that was commented out.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use the right function to update frequency value.

If rx skb is probe response or beacon, the wrong frequency value can
cause problem that bss info can't be updated when it should be.

Cc: <stable@vger.kernel.org>
Fixes: 8318d78a ("cfg80211 API for channels/bitrates, mac80211
and driver conversion")
Signed-off-by: NZHAO Gang <gamerh2o@gmail.com>
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

 8 bytes preamble
14 bytes src/dst/eth_type
 6 bytes 0xff:0xff..

http://en.wikipedia.org/wiki/Wake-on-LAN#Magic_packet
http://en.wikipedia.org/wiki/EtherType

This will fail if we VLAN or the magic packet is encapsulated
as a UDP packet...
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

10.x FW has no structure member sw_version_1. Thus,
both fw_version_release and fw_version_build are not
available. The provided fw_version_major is also wrong.
Fix this by using the fw_version from struct wiphy.
Signed-off-by: NChun-Yeow Yeoh <yeohchunyeow@gmail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ath10k handles UAPSD completly in the firmware.
When works in AP mode we have to configure
UAPSD params for each station. Without this
patch we configure UAPSD params before we
send peer assoc command to the FW, which was
wrong. Next FW didn't know what should be trigger
frame, couse UAPSD didn't work correctly in AP mode.
To configure UAPSD params correctly we have to
send them after peer assoc command.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Firmware has a feature to track if the associated STA is not acking the frames.
When that happens, the firmware sends WMI_PEER_STA_KICKOUT_EVENTID event to the
host. Enable that to faster detect when a STA has left BSS without sending a
deauth frame.

Also set huge keepalive timeouts to avoid using the keepalive functionality in
the firmware.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

None of the devices supported by iwldvm have support for
shadow registers. This means that we wake the NIC
when we increment the write pointer on Tx ring.
This happened even before my bad commit mentionned below.
Since my commit below, we wake up the NIC when we put a
host command on the ring regardless of shadow register
support. This means that in iwldvm (when the NIC doesn't
support shadow register), we wake up the NIC twice:

pcie_enqueue_hcmd:
	wake up the NIC
	iwl_pcie_txq_inc_wr_ptr:
		wake up the NIC - no shadow reg support

Since waking up the NIC means that we need to acquire a
spinlock, this obviously leads to a recursive spinlock
and hence a freeze.

Fixes: b9439491 ("iwlwifi: pcie: keep the NIC awake when commands are in flight")
Reported-by: NJanusz Dziedzic <janusz.dziedzic@gmail.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Enable ap_ps_peer_param_cmdid for 10.x FW.
This is used mainly for AP UAPSD.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Reduce the Rx count threshold to make sure we read
the available credits for Tx.
Signed-off-by: NJulien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

With the previous value (1700), some urb are dropped
with a babble error (urb status equal -EOVERFLOW).

These error seems to only happen when urb length is a
multiple of packet size (512).
Signed-off-by: NJulien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Signed-off-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch will also change behavior of rx_beacons statistic.
Instead of collecting all received beacons, it will collect only
ours. This, IMO make more sense, since for troubleshooting we will
need to know count of our beacons, or both.
Signed-off-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

this function is used by most ath driver, so it can be moved here.
Signed-off-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

While registering the driver with cfg80211, update the threshold
value and retry limit to cfg80211.
Signed-off-by: NUjjal Roy <royujjal@gmail.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

bit 14 is actually reserved and bit 12 & 13 should be used for
11ac capability in fw_cap_info.

Cc: <stable@vger.kernel.org> # 3.9+
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes bug found by the kbuild test robot:

tree:   git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next.git master
head:   1e2f9295
commit: 1cbbcb08 [135/140] wil6210: prefetch head of packet
config: make ARCH=microblaze allyesconfig

All error/warnings:

   drivers/net/wireless/ath/wil6210/txrx.c: In function 'wil_vring_reap_rx':
>> drivers/net/wireless/ath/wil6210/txrx.c:381:2: error: implicit declaration of function 'prefetch' [-Werror=implicit-function-declaration]
     prefetch(skb->data);
     ^
   cc1: some warnings being treated as errors

vim +/prefetch +381 drivers/net/wireless/ath/wil6210/txrx.c

   375                  wil_err(wil, "Rx size too large: %d bytes!\n", dmalen);
   376                  kfree_skb(skb);
   377                  return NULL;
   378          }
   379          skb_trim(skb, dmalen);
   380
 > 381          prefetch(skb->data);
   382
   383          wil_hex_dump_txrx("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
   384                            skb->data, skb_headlen(skb), false);
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Prevent a possible overflow condition which results in occasional
bad IQ coefficients and EVM numbers.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch fixes a bug in the TX IQ calibration post
processing routine because of which the driver disables
TX IQ correction even though the calibration results
are valid. This fix is applicable for all chips in the
AR9003 family.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

debug_sta.c: ath_debug_rate_stats() error: buffer overflow 'rstats->ht_stats' 24 <= 24

Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When removing the card the driver still tries to access registers
in the device. This patch adds another state for the bus that
indicates the device is no longer reachable. This avoids errors
accessing it while cleaning up the driver.
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

For scheduled scan results the driver does a escan to obtain BSS
details from the firmware. However, the escan uses a dynamically
determined function. This needs to be set appropriately when handling
scheduled scan results to avoid NULL pointer access.
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Rework function to allow only bcm4329 in case of chip backplane
type being sonics sillicon backplane.
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The firmware download code has been restructured so the reset vector
does not need to be stored in a structure, but keep it on the stack
to be passed to exit download function.
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>