10 files changed, 157 insertions, 72 deletions

diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 6cf0c9ef47aa..d07ff7f2fd92 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -48,7 +48,7 @@
 #include <linux/usb.h>
 #ifdef CONFIG_CARL9170_LEDS
 #include <linux/leds.h>
-#endif /* CONFIG_CARL170_LEDS */
+#endif /* CONFIG_CARL9170_LEDS */
 #ifdef CONFIG_CARL9170_WPC
 #include <linux/input.h>
 #endif /* CONFIG_CARL9170_WPC */
@@ -215,7 +215,7 @@ enum carl9170_restart_reasons {
         CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS,
         CARL9170_RR_WATCHDOG,
         CARL9170_RR_STUCK_TX,
-        CARL9170_RR_SLOW_SYSTEM,
+        CARL9170_RR_UNRESPONSIVE_DEVICE,
         CARL9170_RR_COMMAND_TIMEOUT,
         CARL9170_RR_TOO_MANY_PHY_ERRORS,
         CARL9170_RR_LOST_RSP,
@@ -287,6 +287,7 @@ struct ar9170 {
 
         /* reset / stuck frames/queue detection */
         struct work_struct restart_work;
+        struct work_struct ping_work;
         unsigned int restart_counter;
         unsigned long queue_stop_timeout[__AR9170_NUM_TXQ];
         unsigned long max_queue_stop_timeout[__AR9170_NUM_TXQ];
diff --git a/drivers/net/wireless/ath/carl9170/fwcmd.h b/drivers/net/wireless/ath/carl9170/fwcmd.h
index d552166db505..3680dfc70f46 100644
--- a/drivers/net/wireless/ath/carl9170/fwcmd.h
+++ b/drivers/net/wireless/ath/carl9170/fwcmd.h
@@ -97,13 +97,13 @@ struct carl9170_set_key_cmd {
         __le16          type;
         u8              macAddr[6];
         u32             key[4];
-} __packed;
+} __packed __aligned(4);
 #define CARL9170_SET_KEY_CMD_SIZE               28
 
 struct carl9170_disable_key_cmd {
         __le16          user;
         __le16          padding;
-} __packed;
+} __packed __aligned(4);
 #define CARL9170_DISABLE_KEY_CMD_SIZE           4
 
 struct carl9170_u32_list {
@@ -206,7 +206,7 @@ struct carl9170_cmd {
                 struct carl9170_rx_filter_cmd   rx_filter;
                 u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
         } __packed;
-} __packed;
+} __packed __aligned(4);
 
 #define CARL9170_TX_STATUS_QUEUE        3
 #define CARL9170_TX_STATUS_QUEUE_S      0
@@ -216,6 +216,7 @@ struct carl9170_cmd {
 #define CARL9170_TX_STATUS_TRIES        (7 << CARL9170_TX_STATUS_TRIES_S)
 #define CARL9170_TX_STATUS_SUCCESS      0x80
 
+#ifdef __CARL9170FW__
 /*
  * NOTE:
  * Both structs [carl9170_tx_status and _carl9170_tx_status]
@@ -232,6 +233,8 @@ struct carl9170_tx_status {
         u8 tries:3;
         u8 success:1;
 } __packed;
+#endif /* __CARL9170FW__ */
+
 struct _carl9170_tx_status {
         /*
          * This version should be immune to all alignment bugs.
@@ -272,13 +275,15 @@ struct carl9170_rsp {
                 struct carl9170_rf_init_result  rf_init_res;
                 struct carl9170_u32_list        rreg_res;
                 struct carl9170_u32_list        echo;
+#ifdef __CARL9170FW__
                 struct carl9170_tx_status       tx_status[0];
+#endif /* __CARL9170FW__ */
                 struct _carl9170_tx_status      _tx_status[0];
                 struct carl9170_gpio            gpio;
                 struct carl9170_tsf_rsp         tsf;
                 struct carl9170_psm             psm;
                 u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
         } __packed;
-} __packed;
+} __packed __aligned(4);
 
 #endif /* __CARL9170_SHARED_FWCMD_H */
diff --git a/drivers/net/wireless/ath/carl9170/hw.h b/drivers/net/wireless/ath/carl9170/hw.h
index 2f471b3f05af..e85df6edfed3 100644
--- a/drivers/net/wireless/ath/carl9170/hw.h
+++ b/drivers/net/wireless/ath/carl9170/hw.h
@@ -712,7 +712,8 @@ struct ar9170_stream {
         __le16 tag;
 
         u8 payload[0];
-};
+} __packed __aligned(4);
+#define AR9170_STREAM_LEN                               4
 
 #define AR9170_MAX_ACKTABLE_ENTRIES                     8
 #define AR9170_MAX_VIRTUAL_MAC                          7
@@ -736,4 +737,8 @@ struct ar9170_stream {
 
 #define MOD_VAL(reg, value, newvalue)                                   \
         (((value) & ~reg) | (((newvalue) << reg##_S) & reg))
+
+#define GET_VAL(reg, value)                                             \
+        (((value) & reg) >> reg##_S)
+
 #endif  /* __CARL9170_SHARED_HW_H */
diff --git a/drivers/net/wireless/ath/carl9170/mac.c b/drivers/net/wireless/ath/carl9170/mac.c
index 2305bc27151c..385cf508479b 100644
--- a/drivers/net/wireless/ath/carl9170/mac.c
+++ b/drivers/net/wireless/ath/carl9170/mac.c
@@ -205,8 +205,8 @@ int carl9170_init_mac(struct ar9170 *ar)
         carl9170_regwrite(AR9170_MAC_REG_BACKOFF_PROTECT, 0x105);
 
         /* Aggregation MAX number and timeout */
-        carl9170_regwrite(AR9170_MAC_REG_AMPDU_FACTOR, 0xa);
-        carl9170_regwrite(AR9170_MAC_REG_AMPDU_DENSITY, 0x140a00);
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_FACTOR, 0x8000a);
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_DENSITY, 0x140a07);
 
         carl9170_regwrite(AR9170_MAC_REG_FRAMETYPE_FILTER,
                           AR9170_MAC_FTF_DEFAULTS);
@@ -457,8 +457,9 @@ int carl9170_set_beacon_timers(struct ar9170 *ar)
 
 int carl9170_update_beacon(struct ar9170 *ar, const bool submit)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct carl9170_vif_info *cvif;
+        struct ieee80211_tx_info *txinfo;
         __le32 *data, *old = NULL;
         u32 word, off, addr, len;
         int i = 0, err = 0;
@@ -487,7 +488,13 @@ found:
 
         if (!skb) {
                 err = -ENOMEM;
-                goto out_unlock;
+                goto err_free;
+        }
+
+        txinfo = IEEE80211_SKB_CB(skb);
+        if (txinfo->control.rates[0].flags & IEEE80211_TX_RC_MCS) {
+                err = -EINVAL;
+                goto err_free;
         }
 
         spin_lock_bh(&ar->beacon_lock);
@@ -504,11 +511,8 @@ found:
                         wiphy_err(ar->hw->wiphy, "beacon does not "
                                   "fit into device memory!\n");
                 }
-
-                spin_unlock_bh(&ar->beacon_lock);
-                dev_kfree_skb_any(skb);
                 err = -EINVAL;
-                goto out_unlock;
+                goto err_unlock;
         }
 
         if (len > AR9170_MAC_BCN_LENGTH_MAX) {
@@ -518,22 +522,22 @@ found:
                                  AR9170_MAC_BCN_LENGTH_MAX, len);
                 }
 
-                spin_unlock_bh(&ar->beacon_lock);
-                dev_kfree_skb_any(skb);
                 err = -EMSGSIZE;
-                goto out_unlock;
+                goto err_unlock;
         }
 
-        carl9170_async_regwrite_begin(ar);
+        i = txinfo->control.rates[0].idx;
+        if (txinfo->band != IEEE80211_BAND_2GHZ)
+                i += 4;
 
-        /* XXX: use skb->cb info */
-        if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
-                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
-                                ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400);
-        } else {
-                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
-                                ((skb->len + FCS_LEN) << 16) + 0x001b);
-        }
+        word = __carl9170_ratetable[i].hw_value & 0xf;
+        if (i < 4)
+                word |= ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400;
+        else
+                word |= ((skb->len + FCS_LEN) << 16) + 0x0010;
+
+        carl9170_async_regwrite_begin(ar);
+        carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP, word);
 
         for (i = 0; i < DIV_ROUND_UP(skb->len, 4); i++) {
                 /*
@@ -557,7 +561,7 @@ found:
                 cvif->beacon = skb;
         spin_unlock_bh(&ar->beacon_lock);
         if (err)
-                goto out_unlock;
+                goto err_free;
 
         if (submit) {
                 err = carl9170_bcn_ctrl(ar, cvif->id,
@@ -565,10 +569,18 @@ found:
                                         addr, skb->len + FCS_LEN);
 
                 if (err)
-                        goto out_unlock;
+                        goto err_free;
         }
 out_unlock:
         rcu_read_unlock();
+        return 0;
+
+err_unlock:
+        spin_unlock_bh(&ar->beacon_lock);
+
+err_free:
+        rcu_read_unlock();
+        dev_kfree_skb_any(skb);
         return err;
 }
 
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 980ae70ea424..4ae6a5849076 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -428,6 +428,7 @@ static void carl9170_cancel_worker(struct ar9170 *ar)
         cancel_delayed_work_sync(&ar->led_work);
 #endif /* CONFIG_CARL9170_LEDS */
         cancel_work_sync(&ar->ps_work);
+        cancel_work_sync(&ar->ping_work);
         cancel_work_sync(&ar->ampdu_work);
 }
 
@@ -533,6 +534,21 @@ void carl9170_restart(struct ar9170 *ar, const enum carl9170_restart_reasons r)
          */
 }
 
+static void carl9170_ping_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170, ping_work);
+        int err;
+
+        if (!IS_STARTED(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_echo_test(ar, 0xdeadbeef);
+        if (err)
+                carl9170_restart(ar, CARL9170_RR_UNRESPONSIVE_DEVICE);
+        mutex_unlock(&ar->mutex);
+}
+
 static int carl9170_init_interface(struct ar9170 *ar,
                                    struct ieee80211_vif *vif)
 {
@@ -1614,6 +1630,7 @@ void *carl9170_alloc(size_t priv_size)
                 skb_queue_head_init(&ar->tx_pending[i]);
         }
         INIT_WORK(&ar->ps_work, carl9170_ps_work);
+        INIT_WORK(&ar->ping_work, carl9170_ping_work);
         INIT_WORK(&ar->restart_work, carl9170_restart_work);
         INIT_WORK(&ar->ampdu_work, carl9170_ampdu_work);
         INIT_DELAYED_WORK(&ar->tx_janitor, carl9170_tx_janitor);
@@ -1828,7 +1845,7 @@ int carl9170_register(struct ar9170 *ar)
         err = carl9170_led_register(ar);
         if (err)
                 goto err_unreg;
-#endif /* CONFIG_CAR9L170_LEDS */
+#endif /* CONFIG_CARL9170_LEDS */
 
 #ifdef CONFIG_CARL9170_WPC
         err = carl9170_register_wps_button(ar);
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
index 89deca37a988..82bc81c4c930 100644
--- a/drivers/net/wireless/ath/carl9170/phy.c
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -1554,15 +1554,6 @@ static int carl9170_set_power_cal(struct ar9170 *ar, u32 freq,
         return carl9170_regwrite_result();
 }
 
-/* TODO: replace this with sign_extend32(noise, 8) */
-static int carl9170_calc_noise_dbm(u32 raw_noise)
-{
-        if (raw_noise & 0x100)
-                return ~0x1ff | raw_noise;
-        else
-                return raw_noise;
-}
-
 int carl9170_get_noisefloor(struct ar9170 *ar)
 {
         static const u32 phy_regs[] = {
@@ -1578,11 +1569,11 @@ int carl9170_get_noisefloor(struct ar9170 *ar)
                 return err;
 
         for (i = 0; i < 2; i++) {
-                ar->noise[i] = carl9170_calc_noise_dbm(
-                        (phy_res[i] >> 19) & 0x1ff);
+                ar->noise[i] = sign_extend32(GET_VAL(
+                        AR9170_PHY_CCA_MIN_PWR, phy_res[i]), 8);
 
-                ar->noise[i + 2] = carl9170_calc_noise_dbm(
-                        (phy_res[i + 2] >> 23) & 0x1ff);
+                ar->noise[i + 2] = sign_extend32(GET_VAL(
+                        AR9170_PHY_EXT_CCA_MIN_PWR, phy_res[i + 2]), 8);
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/carl9170/phy.h b/drivers/net/wireless/ath/carl9170/phy.h
index 02c34eb4ebde..024fb42bc787 100644
--- a/drivers/net/wireless/ath/carl9170/phy.h
+++ b/drivers/net/wireless/ath/carl9170/phy.h
@@ -139,8 +139,8 @@
 #define         AR9170_PHY_AGC_CONTROL_NO_UPDATE_NF     0x00020000
 
 #define AR9170_PHY_REG_CCA                      (AR9170_PHY_REG_BASE + 0x0064)
-#define         AR9170_PHY_CCA_MINCCA_PWR               0x0ff80000
-#define         AR9170_PHY_CCA_MINCCA_PWR_S             19
+#define         AR9170_PHY_CCA_MIN_PWR                  0x0ff80000
+#define         AR9170_PHY_CCA_MIN_PWR_S                19
 #define         AR9170_PHY_CCA_THRESH62                 0x0007f000
 #define         AR9170_PHY_CCA_THRESH62_S               12
 
@@ -338,8 +338,8 @@
 #define         AR9170_PHY_EXT_CCA_CYCPWR_THR1_S        9
 #define         AR9170_PHY_EXT_CCA_THRESH62             0x007f0000
 #define         AR9170_PHY_EXT_CCA_THRESH62_S           16
-#define         AR9170_PHY_EXT_MINCCA_PWR               0xff800000
-#define         AR9170_PHY_EXT_MINCCA_PWR_S             23
+#define         AR9170_PHY_EXT_CCA_MIN_PWR              0xff800000
+#define         AR9170_PHY_EXT_CCA_MIN_PWR_S            23
 
 #define AR9170_PHY_REG_SFCORR_EXT               (AR9170_PHY_REG_BASE + 0x01c0)
 #define         AR9170_PHY_SFCORR_EXT_M1_THRESH         0x0000007f
@@ -546,19 +546,19 @@
 #define         AR9170_PHY_FORCE_XPA_CFG_S              0
 
 #define AR9170_PHY_REG_CH1_CCA                  (AR9170_PHY_REG_BASE + 0x1064)
-#define         AR9170_PHY_CH1_MINCCA_PWR               0x0ff80000
-#define         AR9170_PHY_CH1_MINCCA_PWR_S             19
+#define         AR9170_PHY_CH1_CCA_MIN_PWR              0x0ff80000
+#define         AR9170_PHY_CH1_CCA_MIN_PWR_S            19
 
 #define AR9170_PHY_REG_CH2_CCA                  (AR9170_PHY_REG_BASE + 0x2064)
-#define         AR9170_PHY_CH2_MINCCA_PWR               0x0ff80000
-#define         AR9170_PHY_CH2_MINCCA_PWR_S             19
+#define         AR9170_PHY_CH2_CCA_MIN_PWR              0x0ff80000
+#define         AR9170_PHY_CH2_CCA_MIN_PWR_S            19
 
 #define AR9170_PHY_REG_CH1_EXT_CCA              (AR9170_PHY_REG_BASE + 0x11bc)
-#define         AR9170_PHY_CH1_EXT_MINCCA_PWR           0xff800000
-#define         AR9170_PHY_CH1_EXT_MINCCA_PWR_S         23
+#define         AR9170_PHY_CH1_EXT_CCA_MIN_PWR          0xff800000
+#define         AR9170_PHY_CH1_EXT_CCA_MIN_PWR_S        23
 
 #define AR9170_PHY_REG_CH2_EXT_CCA              (AR9170_PHY_REG_BASE + 0x21bc)
-#define         AR9170_PHY_CH2_EXT_MINCCA_PWR           0xff800000
-#define         AR9170_PHY_CH2_EXT_MINCCA_PWR_S         23
+#define         AR9170_PHY_CH2_EXT_CCA_MIN_PWR          0xff800000
+#define         AR9170_PHY_CH2_EXT_CCA_MIN_PWR_S        23
 
 #endif  /* __CARL9170_SHARED_PHY_H */
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index b575c865142d..688eede48516 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -242,9 +242,11 @@ static void carl9170_tx_release(struct kref *ref)
                         ar->tx_ampdu_schedule = true;
 
                 if (txinfo->flags & IEEE80211_TX_STAT_AMPDU) {
-                        txinfo->status.ampdu_len = txinfo->pad[0];
-                        txinfo->status.ampdu_ack_len = txinfo->pad[1];
-                        txinfo->pad[0] = txinfo->pad[1] = 0;
+                        struct _carl9170_tx_superframe *super;
+
+                        super = (void *)skb->data;
+                        txinfo->status.ampdu_len = super->s.rix;
+                        txinfo->status.ampdu_ack_len = super->s.cnt;
                 } else if (txinfo->flags & IEEE80211_TX_STAT_ACK) {
                         /*
                          * drop redundant tx_status reports:
@@ -337,7 +339,8 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
         u8 tid;
 
         if (!(txinfo->flags & IEEE80211_TX_CTL_AMPDU) ||
-            txinfo->flags & IEEE80211_TX_CTL_INJECTED)
+            txinfo->flags & IEEE80211_TX_CTL_INJECTED ||
+           (!(super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_AGGR))))
                 return;
 
         tx_info = IEEE80211_SKB_CB(skb);
@@ -389,8 +392,8 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
                 sta_info->stats[tid].ampdu_ack_len++;
 
         if (super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_IMM_BA)) {
-                txinfo->pad[0] = sta_info->stats[tid].ampdu_len;
-                txinfo->pad[1] = sta_info->stats[tid].ampdu_ack_len;
+                super->s.rix = sta_info->stats[tid].ampdu_len;
+                super->s.cnt = sta_info->stats[tid].ampdu_ack_len;
                 txinfo->flags |= IEEE80211_TX_STAT_AMPDU;
                 sta_info->stats[tid].clear = true;
         }
@@ -524,6 +527,59 @@ next:
         }
 }
 
+static void carl9170_tx_ampdu_timeout(struct ar9170 *ar)
+{
+        struct carl9170_sta_tid *iter;
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *txinfo;
+        struct carl9170_tx_info *arinfo;
+        struct _carl9170_tx_superframe *super;
+        struct ieee80211_sta *sta;
+        struct ieee80211_vif *vif;
+        struct ieee80211_hdr *hdr;
+        unsigned int vif_id;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(iter, &ar->tx_ampdu_list, list) {
+                if (iter->state < CARL9170_TID_STATE_IDLE)
+                        continue;
+
+                spin_lock_bh(&iter->lock);
+                skb = skb_peek(&iter->queue);
+                if (!skb)
+                        goto unlock;
+
+                txinfo = IEEE80211_SKB_CB(skb);
+                arinfo = (void *)txinfo->rate_driver_data;
+                if (time_is_after_jiffies(arinfo->timeout +
+                    msecs_to_jiffies(CARL9170_QUEUE_TIMEOUT)))
+                        goto unlock;
+
+                super = (void *) skb->data;
+                hdr = (void *) super->frame_data;
+
+                vif_id = (super->s.misc & CARL9170_TX_SUPER_MISC_VIF_ID) >>
+                         CARL9170_TX_SUPER_MISC_VIF_ID_S;
+
+                if (WARN_ON(vif_id >= AR9170_MAX_VIRTUAL_MAC))
+                        goto unlock;
+
+                vif = rcu_dereference(ar->vif_priv[vif_id].vif);
+                if (WARN_ON(!vif))
+                        goto unlock;
+
+                sta = ieee80211_find_sta(vif, hdr->addr1);
+                if (WARN_ON(!sta))
+                        goto unlock;
+
+                ieee80211_stop_tx_ba_session(sta, iter->tid);
+unlock:
+                spin_unlock_bh(&iter->lock);
+
+        }
+        rcu_read_unlock();
+}
+
 void carl9170_tx_janitor(struct work_struct *work)
 {
         struct ar9170 *ar = container_of(work, struct ar9170,
@@ -534,6 +590,7 @@ void carl9170_tx_janitor(struct work_struct *work)
         ar->tx_janitor_last_run = jiffies;
 
         carl9170_check_queue_stop_timeout(ar);
+        carl9170_tx_ampdu_timeout(ar);
 
         if (!atomic_read(&ar->tx_total_queued))
                 return;
@@ -842,10 +899,8 @@ static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
                 if (unlikely(!sta || !cvif))
                         goto err_out;
 
-                factor = min_t(unsigned int, 1u,
-                         info->control.sta->ht_cap.ampdu_factor);
-
-                density = info->control.sta->ht_cap.ampdu_density;
+                factor = min_t(unsigned int, 1u, sta->ht_cap.ampdu_factor);
+                density = sta->ht_cap.ampdu_density;
 
                 if (density) {
                         /*
@@ -1206,6 +1261,7 @@ static void carl9170_tx(struct ar9170 *ar)
 static bool carl9170_tx_ampdu_queue(struct ar9170 *ar,
         struct ieee80211_sta *sta, struct sk_buff *skb)
 {
+        struct _carl9170_tx_superframe *super = (void *) super;
         struct carl9170_sta_info *sta_info;
         struct carl9170_sta_tid *agg;
         struct sk_buff *iter;
@@ -1274,6 +1330,7 @@ err_unlock:
 
 err_unlock_rcu:
         rcu_read_unlock();
+        super->f.mac_control &= ~cpu_to_le16(AR9170_TX_MAC_AGGR);
         carl9170_tx_status(ar, skb, false);
         ar->tx_dropped++;
         return false;
@@ -1302,9 +1359,6 @@ int carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          */
 
         if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                if (WARN_ON_ONCE(!sta))
-                        goto err_free;
-
                 run = carl9170_tx_ampdu_queue(ar, sta, skb);
                 if (run)
                         carl9170_tx_ampdu(ar);
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 3317039cd28f..82c5f1c50650 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -433,7 +433,7 @@ static void carl9170_usb_rx_complete(struct urb *urb)
                          * device.
                          */
 
-                        carl9170_restart(ar, CARL9170_RR_SLOW_SYSTEM);
+                        ieee80211_queue_work(ar->hw, &ar->ping_work);
                 }
         } else {
                 /*
diff --git a/drivers/net/wireless/ath/carl9170/version.h b/drivers/net/wireless/ath/carl9170/version.h
index ff53f078a0b5..ee0f84f2a2f6 100644
--- a/drivers/net/wireless/ath/carl9170/version.h
+++ b/drivers/net/wireless/ath/carl9170/version.h
@@ -1,7 +1,7 @@
 #ifndef __CARL9170_SHARED_VERSION_H
 #define __CARL9170_SHARED_VERSION_H
 #define CARL9170FW_VERSION_YEAR 10
-#define CARL9170FW_VERSION_MONTH 9
-#define CARL9170FW_VERSION_DAY 28
-#define CARL9170FW_VERSION_GIT "1.8.8.3"
+#define CARL9170FW_VERSION_MONTH 10
+#define CARL9170FW_VERSION_DAY 29
+#define CARL9170FW_VERSION_GIT "1.9.0"
 #endif /* __CARL9170_SHARED_VERSION_H */