iwlwifi: mvm: fix txq aggregation bug

commit 2c4a247e42526d9aae8f5ce1f190b893532f2806 upstream.

Fix an issue where nullfunc frames and block ack requests
had the same tid as aggregation frames and were queued on
a non aggregation queue. The pending frames counter included
those frames but the check whether to decrement the pending
frames counter relied on the tid status and not on the txq id.
The result was an inconsistent state of the pending frames
counter followed by a failure to remove the station.
This failure triggered SYSASSERT 0x3421.

In addition, fix a situation in DQA mode where the number
of pending frames turned negative. This was due to the TX queue
being on the IWL_EMPTYING_HW_QUEUE_DELBA state and its frames
were still decremented.

Even though the SYSASSERT issue is fixed when DQA is disabled,
the issue is not completely solved when DQA is enabled and
should still be fixed.

Signed-off-by: Oren Givon <oren.givon@intel.com>
Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 2e8cb8ce29b84840844dc4fb887f7d7f9f00ebbb..6b8d9a5ab8557aa939cd7f7fd2b43cd746fc167b 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1303,7 +1303,15 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                        bool send_eosp_ndp = false;
 
                        spin_lock_bh(&mvmsta->lock);
-                       txq_agg = (mvmsta->tid_data[tid].state == IWL_AGG_ON);
+                       if (iwl_mvm_is_dqa_supported(mvm)) {
+                               enum iwl_mvm_agg_state state;
+
+                               state = mvmsta->tid_data[tid].state;
+                               txq_agg = (state == IWL_AGG_ON ||
+                                       state == IWL_EMPTYING_HW_QUEUE_DELBA);
+                       } else {
+                               txq_agg = txq_id >= mvm->first_agg_queue;
+                       }
 
                        if (!is_ndp) {
                                tid_data->next_reclaimed = next_reclaimed;