8 files changed, 83 insertions, 54 deletions

diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 76cde6ce6551..18a895a949d4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -872,8 +872,11 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         lockdep_assert_held(&mvm->mutex);
 
-        /* Rssi update while not associated ?! */
-        if (WARN_ON_ONCE(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT))
+        /*
+         * Rssi update while not associated - can happen since the statistics
+         * are handled asynchronously
+         */
+        if (mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)
                 return;
 
         /* No BT - reports should be disabled */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 73cbba7424f2..9426905de6b2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -504,6 +504,7 @@ struct iwl_scan_offload_profile {
  * @match_notify:       clients waiting for match found notification
  * @pass_match:         clients waiting for the results
  * @active_clients:     active clients bitmap - enum scan_framework_client
+ * @any_beacon_notify:  clients waiting for match notification without match
  */
 struct iwl_scan_offload_profile_cfg {
         struct iwl_scan_offload_profile profiles[IWL_SCAN_MAX_PROFILES];
@@ -512,7 +513,8 @@ struct iwl_scan_offload_profile_cfg {
         u8 match_notify;
         u8 pass_match;
         u8 active_clients;
-        u8 reserved[3];
+        u8 any_beacon_notify;
+        u8 reserved[2];
 } __packed;
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c49b5073c251..c35b8661b395 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -246,7 +246,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         else
                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
+        if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
                 hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
                 hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
@@ -328,6 +328,24 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
         ieee80211_free_txskb(hw, skb);
 }
 
+static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                return false;
+        return true;
+}
+
+static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                return false;
+        if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
+                return true;
+
+        /* enabled by default */
+        return true;
+}
+
 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     enum ieee80211_ampdu_mlme_action action,
@@ -347,7 +365,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) {
+                if (!iwl_enable_rx_ampdu(mvm->cfg)) {
                         ret = -EINVAL;
                         break;
                 }
@@ -357,7 +375,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false);
                 break;
         case IEEE80211_AMPDU_TX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) {
+                if (!iwl_enable_tx_ampdu(mvm->cfg)) {
                         ret = -EINVAL;
                         break;
                 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index e4ead86f06d6..2b0ba1fc3c82 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -152,7 +152,7 @@ enum iwl_power_scheme {
         IWL_POWER_SCHEME_LP
 };
 
-#define IWL_CONN_MAX_LISTEN_INTERVAL    70
+#define IWL_CONN_MAX_LISTEN_INTERVAL    10
 #define IWL_UAPSD_AC_INFO               (IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 0e0007960612..742afc429c94 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -344,7 +344,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
 
         iwl_mvm_scan_fill_ssids(cmd, req, basic_ssid ? 1 : 0);
 
-        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL);
+        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
+                                           TX_CMD_FLG_BT_DIS);
         cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
         cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
         cmd->tx_cmd.rate_n_flags =
@@ -807,6 +808,8 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
         profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
         profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
         profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
+        if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
+                profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 
         for (i = 0; i < req->n_match_sets; i++) {
                 profile = &profile_cfg->profiles[i];
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index ec1812133235..3397f59cd4e4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -652,7 +652,7 @@ int iwl_mvm_send_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         static const u8 _baddr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
-        static const u8 *baddr = _baddr;
+        const u8 *baddr = _baddr;
 
         lockdep_assert_held(&mvm->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 90378c217bc7..76ee486039d7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -659,8 +659,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         rcu_read_lock();
 
         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+        /*
+         * sta can't be NULL otherwise it'd mean that the sta has been freed in
+         * the firmware while we still have packets for it in the Tx queues.
+         */
+        if (WARN_ON_ONCE(!sta))
+                goto out;
 
-        if (!IS_ERR_OR_NULL(sta)) {
+        if (!IS_ERR(sta)) {
                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
                 if (tid != IWL_TID_NON_QOS) {
@@ -675,7 +681,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         spin_unlock_bh(&mvmsta->lock);
                 }
         } else {
-                sta = NULL;
                 mvmsta = NULL;
         }
 
@@ -683,42 +688,38 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
          * If the txq is not an AMPDU queue, there is no chance we freed
          * several skbs. Check that out...
          */
-        if (txq_id < mvm->first_agg_queue && !WARN_ON(skb_freed > 1) &&
-            atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id])) {
-                if (mvmsta) {
-                        /*
-                         * If there are no pending frames for this STA, notify
-                         * mac80211 that this station can go to sleep in its
-                         * STA table.
-                         */
-                        if (mvmsta->vif->type == NL80211_IFTYPE_AP)
-                                ieee80211_sta_block_awake(mvm->hw, sta, false);
-                        /*
-                         * We might very well have taken mvmsta pointer while
-                         * the station was being removed. The remove flow might
-                         * have seen a pending_frame (because we didn't take
-                         * the lock) even if now the queues are drained. So make
-                         * really sure now that this the station is not being
-                         * removed. If it is, run the drain worker to remove it.
-                         */
-                        spin_lock_bh(&mvmsta->lock);
-                        sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
-                        if (!sta || PTR_ERR(sta) == -EBUSY) {
-                                /*
-                                 * Station disappeared in the meantime:
-                                 * so we are draining.
-                                 */
-                                set_bit(sta_id, mvm->sta_drained);
-                                schedule_work(&mvm->sta_drained_wk);
-                        }
-                        spin_unlock_bh(&mvmsta->lock);
-                } else if (!mvmsta && PTR_ERR(sta) == -EBUSY) {
-                        /* Tx response without STA, so we are draining */
-                        set_bit(sta_id, mvm->sta_drained);
-                        schedule_work(&mvm->sta_drained_wk);
-                }
+        if (txq_id >= mvm->first_agg_queue)
+                goto out;
+
+        /* We can't free more than one frame at once on a shared queue */
+        WARN_ON(skb_freed > 1);
+
+        /* If we have still frames from this STA nothing to do here */
+        if (!atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id]))
+                goto out;
+
+        if (mvmsta && mvmsta->vif->type == NL80211_IFTYPE_AP) {
+                /*
+                 * If there are no pending frames for this STA, notify
+                 * mac80211 that this station can go to sleep in its
+                 * STA table.
+                 * If mvmsta is not NULL, sta is valid.
+                 */
+                ieee80211_sta_block_awake(mvm->hw, sta, false);
         }
 
+        if (PTR_ERR(sta) == -EBUSY || PTR_ERR(sta) == -ENOENT) {
+                /*
+                 * We are draining and this was the last packet - pre_rcu_remove
+                 * has been called already. We might be after the
+                 * synchronize_net already.
+                 * Don't rely on iwl_mvm_rm_sta to see the empty Tx queues.
+                 */
+                set_bit(sta_id, mvm->sta_drained);
+                schedule_work(&mvm->sta_drained_wk);
+        }
+
+out:
         rcu_read_unlock();
 }
 
@@ -821,16 +822,12 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         struct iwl_mvm_ba_notif *ba_notif = (void *)pkt->data;
         struct sk_buff_head reclaimed_skbs;
         struct iwl_mvm_tid_data *tid_data;
-        struct ieee80211_tx_info *info;
         struct ieee80211_sta *sta;
         struct iwl_mvm_sta *mvmsta;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb;
         int sta_id, tid, freed;
-
         /* "flow" corresponds to Tx queue */
         u16 scd_flow = le16_to_cpu(ba_notif->scd_flow);
-
         /* "ssn" is start of block-ack Tx window, corresponds to index
          * (in Tx queue's circular buffer) of first TFD/frame in window */
         u16 ba_resp_scd_ssn = le16_to_cpu(ba_notif->scd_ssn);
@@ -887,22 +884,26 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         freed = 0;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (ieee80211_is_data_qos(hdr->frame_control))
                         freed++;
                 else
                         WARN_ON_ONCE(1);
 
-                info = IEEE80211_SKB_CB(skb);
                 iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
 
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
                         /* put the rate scaling data there */
-                        info = IEEE80211_SKB_CB(skb);
-                        memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                         info->flags |= IEEE80211_TX_STAT_AMPDU;
                         info->status.ampdu_ack_len = ba_notif->txed_2_done;
                         info->status.ampdu_len = ba_notif->txed;
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index a4a5e25623c3..86989df69356 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -411,6 +411,8 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                         mvm->status, table.valid);
         }
 
+        IWL_ERR(mvm, "Loaded firmware version: %s\n", mvm->fw->fw_version);
+
         trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low,
                                       table.data1, table.data2, table.data3,
                                       table.blink1, table.blink2, table.ilink1,