12 files changed, 134 insertions, 63 deletions
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 822f1a00efbb..319387263e12 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1068,7 +1068,10 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                return;
-        if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+        if (!test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+                return;
+        if (ctx->vif)
                ieee80211_chswitch_done(ctx->vif, is_success);
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 3952ddf2ddb2..1531a4fc0960 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -758,7 +758,7 @@ int iwl_alive_start(struct iwl_priv *priv)
                                         BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                if (ret)
                        return ret;
-        } else {
+        } else if (priv->lib->bt_params) {
                /*
                 * default is 2-wire BT coexexistence support
                 */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 7e5e5c2f9f87..83da884cf303 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -134,7 +134,7 @@ struct wowlan_key_data {
        struct iwl_wowlan_rsc_tsc_params_cmd *rsc_tsc;
        struct iwl_wowlan_tkip_params_cmd *tkip;
        bool error, use_rsc_tsc, use_tkip;
-        int gtk_key_idx;
+        int wep_key_idx;
 };
 static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
@@ -188,8 +188,8 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                        wkc.wep_key.key_offset = 0;
                } else {
                        /* others start at 1 */
-                        data->gtk_key_idx++;
+                        data->wep_key_idx++;
-                        wkc.wep_key.key_offset = data->gtk_key_idx;
+                        wkc.wep_key.key_offset = data->wep_key_idx;
                }
                ret = iwl_mvm_send_cmd_pdu(mvm, WEP_KEY, CMD_SYNC,
@@ -316,8 +316,13 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                mvm->ptk_ivlen = key->iv_len;
                mvm->ptk_icvlen = key->icv_len;
        } else {
-                data->gtk_key_idx++;
+                /*
-                key->hw_key_idx = data->gtk_key_idx;
+                 * firmware only supports TSC/RSC for a single key,
+                 * so if there are multiple keep overwriting them
+                 * with new ones -- this relies on mac80211 doing
+                 * list_add_tail().
+                 */
+                key->hw_key_idx = 1;
                mvm->gtk_ivlen = key->iv_len;
                mvm->gtk_icvlen = key->icv_len;
        }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index e56ed2a84888..c24a744910ac 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -988,7 +988,11 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
        char buf[100];
-        if (!dbgfs_dir)
+        /*
+         * Check if debugfs directory already exist before creating it.
+         * This may happen when, for example, resetting hw or suspend-resume
+         */
+        if (!dbgfs_dir || mvmvif->dbgfs_dir)
                return;
        mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index b60d14151721..365095a0c3b3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -69,7 +69,6 @@
 /* Scan Commands, Responses, Notifications */
 /* Masks for iwl_scan_channel.type flags */
-#define SCAN_CHANNEL_TYPE_PASSIVE       0
 #define SCAN_CHANNEL_TYPE_ACTIVE        BIT(0)
 #define SCAN_CHANNEL_NARROW_BAND        BIT(22)
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e08683b20531..f19baf0dea6b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -257,7 +257,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
        if (ret)
                return ret;
-        return ieee80211_register_hw(mvm->hw);
+        ret = ieee80211_register_hw(mvm->hw);
+        if (ret)
+                iwl_mvm_leds_exit(mvm);
+        return ret;
 }
 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
@@ -385,6 +389,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
        ieee80211_wake_queues(mvm->hw);
        mvm->vif_count = 0;
+        mvm->rx_ba_sessions = 0;
 }
 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
@@ -507,6 +512,27 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                goto out_unlock;
        /*
+         * TODO: remove this temporary code.
+         * Currently MVM FW supports power management only on single MAC.
+         * If new interface added, disable PM on existing interface.
+         * P2P device is a special case, since it is handled by FW similary to
+         * scan. If P2P deviced is added, PM remains enabled on existing
+         * interface.
+         * Note: the method below does not count the new interface being added
+         * at this moment.
+         */
+        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
+                mvm->vif_count++;
+        if (mvm->vif_count > 1) {
+                IWL_DEBUG_MAC80211(mvm,
+                                   "Disable power on existing interfaces\n");
+                ieee80211_iterate_active_interfaces_atomic(
+                                            mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_pm_disable_iterator, mvm);
+        }
+        /*
         * The AP binding flow can be done only after the beacon
         * template is configured (which happens only in the mac80211
         * start_ap() flow), and adding the broadcast station can happen
@@ -529,27 +555,6 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                goto out_unlock;
        }
-        /*
-         * TODO: remove this temporary code.
-         * Currently MVM FW supports power management only on single MAC.
-         * If new interface added, disable PM on existing interface.
-         * P2P device is a special case, since it is handled by FW similary to
-         * scan. If P2P deviced is added, PM remains enabled on existing
-         * interface.
-         * Note: the method below does not count the new interface being added
-         * at this moment.
-         */
-        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
-                mvm->vif_count++;
-        if (mvm->vif_count > 1) {
-                IWL_DEBUG_MAC80211(mvm,
-                                   "Disable power on existing interfaces\n");
-                ieee80211_iterate_active_interfaces_atomic(
-                                            mvm->hw,
-                                            IEEE80211_IFACE_ITER_NORMAL,
-                                            iwl_mvm_pm_disable_iterator, mvm);
-        }
        ret = iwl_mvm_mac_ctxt_add(mvm, vif);
        if (ret)
                goto out_release;
@@ -1006,6 +1011,21 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
        mutex_lock(&mvm->mutex);
        if (old_state == IEEE80211_STA_NOTEXIST &&
            new_state == IEEE80211_STA_NONE) {
+                /*
+                 * Firmware bug - it'll crash if the beacon interval is less
+                 * than 16. We can't avoid connecting at all, so refuse the
+                 * station state change, this will cause mac80211 to abandon
+                 * attempts to connect to this AP, and eventually wpa_s will
+                 * blacklist the AP...
+                 */
+                if (vif->type == NL80211_IFTYPE_STATION &&
+                    vif->bss_conf.beacon_int < 16) {
+                        IWL_ERR(mvm,
+                                "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
+                                sta->addr, vif->bss_conf.beacon_int);
+                        ret = -EINVAL;
+                        goto out_unlock;
+                }
                ret = iwl_mvm_add_sta(mvm, vif, sta);
        } else if (old_state == IEEE80211_STA_NONE &&
                   new_state == IEEE80211_STA_AUTH) {
@@ -1038,6 +1058,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
        } else {
                ret = -EIO;
        }
+ out_unlock:
        mutex_unlock(&mvm->mutex);
        return ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d40d7db185d6..420e82d379d9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -419,6 +419,7 @@ struct iwl_mvm {
        struct work_struct sta_drained_wk;
        unsigned long sta_drained[BITS_TO_LONGS(IWL_MVM_STATION_COUNT)];
        atomic_t pending_frames[IWL_MVM_STATION_COUNT];
+        u8 rx_ba_sessions;
        /* configured by mac80211 */
        u32 rts_threshold;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 2157b0f8ced5..acdff6b67e04 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -137,8 +137,8 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
 {
        int fw_idx, req_idx;
-        fw_idx = 0;
+        for (req_idx = req->n_ssids - 1, fw_idx = 0; req_idx > 0;
-        for (req_idx = req->n_ssids - 1; req_idx > 0; req_idx--) {
+             req_idx--, fw_idx++) {
                cmd->direct_scan[fw_idx].id = WLAN_EID_SSID;
                cmd->direct_scan[fw_idx].len = req->ssids[req_idx].ssid_len;
                memcpy(cmd->direct_scan[fw_idx].ssid,
@@ -153,7 +153,9 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
 * just to notify that this scan is active and not passive.
 * In order to notify the FW of the number of SSIDs we wish to scan (including
 * the zero-length one), we need to set the corresponding bits in chan->type,
- * one for each SSID, and set the active bit (first).
+ * one for each SSID, and set the active bit (first). The first SSID is already
+ * included in the probe template, so we need to set only req->n_ssids - 1 bits
+ * in addition to the first bit.
 */
 static u16 iwl_mvm_get_active_dwell(enum ieee80211_band band, int n_ssids)
 {
@@ -176,19 +178,12 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
        struct iwl_scan_channel *chan = (struct iwl_scan_channel *)
                (cmd->data + le16_to_cpu(cmd->tx_cmd.len));
        int i;
-        __le32 chan_type_value;
-        if (req->n_ssids > 0)
-                chan_type_value = cpu_to_le32(BIT(req->n_ssids + 1) - 1);
-        else
-                chan_type_value = SCAN_CHANNEL_TYPE_PASSIVE;
        for (i = 0; i < cmd->channel_count; i++) {
                chan->channel = cpu_to_le16(req->channels[i]->hw_value);
+                chan->type = cpu_to_le32(BIT(req->n_ssids) - 1);
                if (req->channels[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        chan->type = SCAN_CHANNEL_TYPE_PASSIVE;
+                        chan->type &= cpu_to_le32(~SCAN_CHANNEL_TYPE_ACTIVE);
-                else
-                        chan->type = chan_type_value;
                chan->active_dwell = cpu_to_le16(active_dwell);
                chan->passive_dwell = cpu_to_le16(passive_dwell);
                chan->iteration_count = cpu_to_le16(1);
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 62fe5209093b..563f559b902d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -608,6 +608,8 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *bsta)
        return ret;
 }
+#define IWL_MAX_RX_BA_SESSIONS 16
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                       int tid, u16 ssn, bool start)
 {
@@ -618,11 +620,20 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
        lockdep_assert_held(&mvm->mutex);
+        if (start && mvm->rx_ba_sessions >= IWL_MAX_RX_BA_SESSIONS) {
+                IWL_WARN(mvm, "Not enough RX BA SESSIONS\n");
+                return -ENOSPC;
+        }
        cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
        cmd.sta_id = mvm_sta->sta_id;
        cmd.add_modify = STA_MODE_MODIFY;
-        cmd.add_immediate_ba_tid = (u8) tid;
+        if (start) {
-        cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+                cmd.add_immediate_ba_tid = (u8) tid;
+                cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        } else {
+                cmd.remove_immediate_ba_tid = (u8) tid;
+        }
        cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
                                  STA_MODIFY_REMOVE_BA_TID;
@@ -648,6 +659,14 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                break;
        }
+        if (!ret) {
+                if (start)
+                        mvm->rx_ba_sessions++;
+                else if (mvm->rx_ba_sessions > 0)
+                        /* check that restart flow didn't zero the counter */
+                        mvm->rx_ba_sessions--;
+        }
        return ret;
 }
@@ -896,6 +915,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
        struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
        u16 txq_id;
+        enum iwl_mvm_agg_state old_state;
        /*
         * First set the agg state to OFF to avoid calling
@@ -905,13 +925,17 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        txq_id = tid_data->txq_id;
        IWL_DEBUG_TX_QUEUES(mvm, "Flush AGG: sta %d tid %d q %d state %d\n",
                            mvmsta->sta_id, tid, txq_id, tid_data->state);
+        old_state = tid_data->state;
        tid_data->state = IWL_AGG_OFF;
        spin_unlock_bh(&mvmsta->lock);
-        if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
+        if (old_state >= IWL_AGG_ON) {
-                IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
+                if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
+                        IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
+                iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
+        }
-        iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
        mvm->queue_to_mac80211[tid_data->txq_id] =
                                IWL_INVALID_MAC80211_QUEUE;
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index ad9bbca99213..7fd6fbfbc1b3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -138,6 +138,20 @@ static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
        schedule_work(&mvm->roc_done_wk);
 }
+static bool iwl_mvm_te_check_disconnect(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif,
+                                        const char *errmsg)
+{
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return false;
+        if (vif->bss_conf.assoc && vif->bss_conf.dtim_period)
+                return false;
+        if (errmsg)
+                IWL_ERR(mvm, "%s\n", errmsg);
+        ieee80211_connection_loss(vif);
+        return true;
+}
 /*
 * Handles a FW notification for an event that is known to the driver.
 *
@@ -163,8 +177,13 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
         * P2P Device discoveribility, while there are other higher priority
         * events in the system).
         */
-        WARN_ONCE(!le32_to_cpu(notif->status),
+        if (WARN_ONCE(!le32_to_cpu(notif->status),
-                  "Failed to schedule time event\n");
+                      "Failed to schedule time event\n")) {
+                if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, NULL)) {
+                        iwl_mvm_te_clear_data(mvm, te_data);
+                        return;
+                }
+        }
        if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_END) {
                IWL_DEBUG_TE(mvm,
@@ -180,14 +199,8 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 * By now, we should have finished association
                 * and know the dtim period.
                 */
-                if (te_data->vif->type == NL80211_IFTYPE_STATION &&
+                iwl_mvm_te_check_disconnect(mvm, te_data->vif,
-                    (!te_data->vif->bss_conf.assoc ||
+                        "No assocation and the time event is over already...");
-                     !te_data->vif->bss_conf.dtim_period)) {
-                        IWL_ERR(mvm,
-                                "No assocation and the time event is over already...\n");
-                        ieee80211_connection_loss(te_data->vif);
-                }
                iwl_mvm_te_clear_data(mvm, te_data);
        } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
                te_data->running = true;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 81f3ea5b09a4..ff13458efc27 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -130,6 +130,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */
        {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */
        {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1326, iwl5150_abg_cfg)}, /* Half Mini Card */
        {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */
        {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 826c15602c46..390e2f058aff 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -670,6 +670,11 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
                return err;
        }
+        /* Reset the entire device */
+        iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+        usleep_range(10, 15);
        iwl_pcie_apm_init(trans);
        /* From now on, the op_mode will be kept updated about RF kill state */
@@ -1497,16 +1502,16 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        spin_lock_init(&trans_pcie->reg_lock);
        init_waitqueue_head(&trans_pcie->ucode_write_waitq);
-        /* W/A - seems to solve weird behavior. We need to remove this if we
-         * don't want to stay in L1 all the time. This wastes a lot of power */
-        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
-                               PCIE_LINK_STATE_CLKPM);
        if (pci_enable_device(pdev)) {
                err = -ENODEV;
                goto out_no_pci;
        }
+        /* W/A - seems to solve weird behavior. We need to remove this if we
+         * don't want to stay in L1 all the time. This wastes a lot of power */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                               PCIE_LINK_STATE_CLKPM);
        pci_set_master(pdev);
        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));