If recovery failed ath10k returned 0 (success) and
mac80211 continued to call other driver callbacks.
This caused null dereference.

This is how the failure looked like:

ath10k: ctl_resp never came in (-110)
ath10k: failed to connect to HTC: -110
ath10k: could not init core (-110)
BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffffa0b355c1>] ath10k_ce_send+0x1d/0x15d [ath10k_pci]
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: ath10k_pci ath10k_core ath5k ath9k ath9k_common ath9k_hw ath mac80211 cfg80211 nf_nat_ipv4 ]
CPU: 1 PID: 36 Comm: kworker/1:1 Tainted: G        WC   3.13.0-rc8-wl-ath+ #8
Hardware name: To be filled by O.E.M. To be filled by O.E.M./HURONRIVER, BIOS 4.6.5 05/02/2012
Workqueue: events ieee80211_restart_work [mac80211]
task: ffff880215b521c0 ti: ffff880215e18000 task.ti: ffff880215e18000
RIP: 0010:[<ffffffffa0b355c1>]  [<ffffffffa0b355c1>] ath10k_ce_send+0x1d/0x15d [ath10k_pci]
RSP: 0018:ffff880215e19af8  EFLAGS: 00010292
RAX: ffff880215e19b10 RBX: 0000000000000000 RCX: 0000000000000018
RDX: 00000000d9ccf800 RSI: ffff8800c965ad00 RDI: 0000000000000000
RBP: ffff880215e19b58 R08: 0000000000000002 R09: 0000000000000000
R10: ffffffff812e1a23 R11: 0000000000000292 R12: 0000000000000018
R13: 0000000000000000 R14: 0000000000000002 R15: ffff88021562d700
FS:  0000000000000000(0000) GS:ffff88021fa80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000001a0d000 CR4: 00000000000407e0
Stack:
 d9ccf8000d47df40 ffffffffa0b367a0 ffff880215e19b10 0000000000000010
 ffff880215e19b68 ffff880215e19b28 0000000000000018 ffff8800c965ad00
 0000000000000018 0000000000000000 0000000000000002 ffff88021562d700
Call Trace:
 [<ffffffffa0b3251d>] ath10k_pci_hif_send_head+0xa7/0xcb [ath10k_pci]
 [<ffffffffa0b16cbe>] ath10k_htc_send+0x23d/0x2d0 [ath10k_core]
 [<ffffffffa0b1a169>] ath10k_wmi_cmd_send_nowait+0x5d/0x85 [ath10k_core]
 [<ffffffffa0b1aaef>] ath10k_wmi_cmd_send+0x62/0x115 [ath10k_core]
 [<ffffffff814e8abd>] ? __netdev_alloc_skb+0x4b/0x9b
 [<ffffffffa0b1c438>] ath10k_wmi_vdev_set_param+0x91/0xa3 [ath10k_core]
 [<ffffffffa0b0e0d5>] ath10k_mac_set_rts+0x3e/0x40 [ath10k_core]
 [<ffffffffa0b0e1d0>] ath10k_set_frag_threshold+0x5e/0x9c [ath10k_core]
 [<ffffffffa09d60eb>] ieee80211_reconfig+0x12a/0x7b3 [mac80211]
 [<ffffffff815a8069>] ? mutex_unlock+0x9/0xb
 [<ffffffffa09b3a40>] ieee80211_restart_work+0x5e/0x68 [mac80211]
 [<ffffffff810c01d0>] process_one_work+0x1d7/0x2fc
 [<ffffffff810c0166>] ? process_one_work+0x16d/0x2fc
 [<ffffffff810c06c8>] worker_thread+0x12e/0x1fb
 [<ffffffff810c059a>] ? rescuer_thread+0x27b/0x27b
 [<ffffffff810c5aee>] kthread+0xb5/0xbd
 [<ffffffff815a9220>] ? _raw_spin_unlock_irq+0x28/0x42
 [<ffffffff810c5a39>] ? __kthread_parkme+0x5c/0x5c
 [<ffffffff815ae04c>] ret_from_fork+0x7c/0xb0
 [<ffffffff810c5a39>] ? __kthread_parkme+0x5c/0x5c
Code: df ff d0 48 83 c4 18 5b 41 5c 41 5d 5d c3 55 48 89 e5 41 57 41 56 45 89 c6 41 55 41 54 41 89 cc 53 48 89
RIP  [<ffffffffa0b355c1>] ath10k_ce_send+0x1d/0x15d [ath10k_pci]
 RSP <ffff880215e19af8>
CR2: 0000000000000000
Reported-By: NBen Greear <greearb@candelatech.com>
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Until now ath10k used a copy-by-value beacon
submission.

The new method passes a DMA address via WMI
command only. This command contains additional
metadata that fixes AP behaviour with regard
to powersave buffering.

This also fixes strange bug when multicast traffic
would freeze TX indefinitely.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NMarek Puzyniak <marek.puzyniak@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Most channel switching logic has been implemented
already so this patch is pretty small. The patch
makes use of mac80211's vif->csa_active for AP CSA
handling.
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Until now channel change wasn't propagating to FW
directly because operational channel is abstracted
by VDEVs and it wasn't really necessary since
ath10k implements hwscan and hwroc.

This effectively fixes STA CSA and allows for
future AP-like CSA as well.

kvalo: change error handling in ath10k_bss_info_changed()
Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

10.x FW has no structure member sw_version_1. Thus,
both fw_version_release and fw_version_build are not
available. The provided fw_version_major is also wrong.
Fix this by using the fw_version from struct wiphy.
Signed-off-by: NChun-Yeow Yeoh <yeohchunyeow@gmail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

ath10k handles UAPSD completly in the firmware.
When works in AP mode we have to configure
UAPSD params for each station. Without this
patch we configure UAPSD params before we
send peer assoc command to the FW, which was
wrong. Next FW didn't know what should be trigger
frame, couse UAPSD didn't work correctly in AP mode.
To configure UAPSD params correctly we have to
send them after peer assoc command.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Firmware has a feature to track if the associated STA is not acking the frames.
When that happens, the firmware sends WMI_PEER_STA_KICKOUT_EVENTID event to the
host. Enable that to faster detect when a STA has left BSS without sending a
deauth frame.

Also set huge keepalive timeouts to avoid using the keepalive functionality in
the firmware.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Enable ap_ps_peer_param_cmdid for 10.x FW.
This is used mainly for AP UAPSD.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Reduce the Rx count threshold to make sure we read
the available credits for Tx.
Signed-off-by: NJulien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

With the previous value (1700), some urb are dropped
with a babble error (urb status equal -EOVERFLOW).

These error seems to only happen when urb length is a
multiple of packet size (512).
Signed-off-by: NJulien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Global Transmission Timeout interrupts are generated by
the HW when transmission of a frame fails - this is done
based on the threshold programmed in the AR_GTXTO register.

Currently, even though the interrupt is enabled for all chips,
it is not handled in the driver. This patch handles GTT events
for AR9003 and above chips, checking if the MAC/BB has hung
after successive GTT interrupts crosses a threshold (5).

This can be enabled for the older chips in the AR9002 family once
appropriate HW hang checks are implemented for them.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There is no need to do this and we can avoid
an unused variable warning when CONFIG_ATH9K_WOW is
not selected.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This would be useful when debugging RX performance issues.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Also, rename node_stat to node_aggr.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The REGULATORY_CUSTOM_REG can be used during early init with
the goal of overriding the wiphy's default regulatory settings
in case the alpha2 of the device is not known. In the case that
the alpha2 becomes known lets avoid having drivers having to
clear the REGULATORY_CUSTOM_REG flag by doing it for them
when regulatory_hint() is used.

Cc: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NLuis R. Rodriguez <mcgrof@do-not-panic.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

ath wants to first apply the custom regd and only later
will it revert to not using it if an alpha2 regulatory
domain is found. Since the wireless core now enforces
usage of the REGULATORY_CUSTOM_REG strictly when
wiphy_apply_custom_regulatory() is used this makes
ath adhere to the expected behaviour but also updates
the wiphy after its done with the custom usage.

This fixes this warning:

[    5.488733] ath: phy0: ASPM enabled: 0x43
[    5.488735] ath: EEPROM regdomain: 0x0
[    5.488736] ath: EEPROM indicates default country code should be used
[    5.488736] ath: doing EEPROM country->regdmn map search
[    5.488737] ath: country maps to regdmn code: 0x3a
[    5.488737] ath: Country alpha2 being used: US
[    5.488738] ath: Regpair used: 0x3a
[    5.488738] ------------[ cut here ]------------
[    5.488745] WARNING: CPU: 0 PID: 161 at
	/home/sujith/dev/wireless-testing/net/wireless/reg.c:1361
	wiphy_apply_custom_regulatory+0x17a/0x1b0 [cfg80211]()
[    5.488746] wiphy should have REGULATORY_CUSTOM_REG

The wireless core can *later* lift this flag for us for when
using the regulatory_hint() to make this fix more generic.
Reported-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NLuis R. Rodriguez <mcgrof@do-not-panic.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add set_bitrate_mask callback. Currently
ath10k HW is limited to handle only single
fixed rate setting or limit number of used
spatial streams.

Example:
iw wlanX set bitrates legacy-5 ht-mcs-5 vht-mcs-5 2:9
will setup VHT, nss=2, mcs=9

iw wlanX set bitrates legacy-5 18 ht-mcs-5 vht-mcs-5
will setup legacy, 18Mbps

iw wlanX set bitrates legacy-5 ht-mcs-5 3 vht-mcs-5
will setup HT, nss=1, mcs=3

iw wlanX set bitrate legacy-5 ht-mcs-5 vht-mcs-5 1:0-9
will setup nss=1

iw wlanX set bitrate legacy-5 ht-mcs-5 vht-mcs-5 1:0-9 2:0-9
will setup nss=2
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Firmware dbglogs can be now enabled through fw_dbglog file. To enable all
possible log messages run:

echo 0xffffffff > /sys/kernel/debug/ieee80211/phy0/ath10k/fw_dbglog

And to put back firmare defaults use 0x0:

echo 0x0 > /sys/kernel/debug/ieee80211/phy0/ath10k/fw_dbglog
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Send firmware WMI debug logs to user space for further processing.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Firmware can send simple ascii strings as debug messages using
WMI_DEBUG_PRINT_EVENTID, print those with ATH10K_DBG_WMI log level.
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

To not exceed number of allowed clients (AP mode), make sure to
check how many of them are already on the peers list.

10.X firmware support up to 127 peers, non-AP centric firmwares 16.
Signed-off-by: NBartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Currently ath10k is not using STA KICKOUT firmware functionality.
In order to avoid unwanted WMI_PEER_STA_KICKOUT_EVENT event this functionality
should be disabled when not used.
Signed-off-by: NMarek Puzyniak <marek.puzyniak@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Add Kconfig option that allow DFS functionality.
Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Fast Channel Change across bands was enabled for
AR9462 recently, but this is causing baseband issues.
Disable it until this feature is tested well. Also,
remove the feature bit for AR9565 since it is
a single-band card and doesn't support this feature.

Cc: stable@vger.kernel.org
Reported-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Accessing the current channel definition in mac80211
when processing RX packets is problematic because it
could have been updated when a scan is issued. Since a
channel change involves flushing the existing packets
in the RX queue before a chip-reset is done, they would
be processed using the wrong band/channel information.

To avoid this, use the current channel information
maintained in the driver.

Cc: stable@vger.kernel.org
Reported-by: NOleksij Rempel <linux@rempel-privat.de>
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

* Add new AR9565 1.0/1.0.1/1.1 IDs
* Change Dell/Lenovo/Samsung cards to 2-Antenna with diversity.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

As soon as skb is ready to be reaped, prefetch 1-st cache line.
This accelerates data access that is performed later, during the
packet classification by the driver and IP stack.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Bit DMA_CFG_DESC_TX_OFFLOAD_CFG_L3T_IPV4_POS should be set for IPv4
only. Don't set it for IPv6
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use hardware capabilities to limit IRQ generation to about 15 per msec
It corresponds to about 7 packets/IRQ when running iperf with default
parameters at 1.3Gbps

Do not enable this feature in the sniffer (monitor)  mode, because
interrupt moderation cause timestamp accuracy deterioration.
For the sniffer flow, it is important to get precise timestamp.
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This value is no longer used by mac80211, and practically no
driver ever set it to a correct value anyway, so remove it.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

None of these files are actually using any __init type directives
and hence don't need to include <linux/init.h>.  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.
Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
Acked-by: NChristian Lamparter <chunkeey@googlemail.com>
Acked-by: NGertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The maximum permissible values for noise floor in ETSI
and Japan domains have been updated with new EU
regulations for CCA detection. Adjust the values in the
driver accordingly.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

AR955x has problems with RX sensitivity in 2G. This patch
adds a routine to select range_osdac dynamically on a
per-chain basis to address this issue.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>