Merge branch 'iwlwifi-fixes' into iwlwifi-next

6 files changed, 59 insertions, 26 deletions

diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 47e64e8b9517..cceb026e0793 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1114,16 +1114,17 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) |
                         BIT(IWL_DEFAULT_CMD_QUEUE_NUM));
 
-        if (vif)
-                scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
-
-        IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues);
-        if (iwlagn_txfifo_flush(priv, scd_queues)) {
-                IWL_ERR(priv, "flush request fail\n");
-                goto done;
+        if (drop) {
+                IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n",
+                                    scd_queues);
+                if (iwlagn_txfifo_flush(priv, scd_queues)) {
+                        IWL_ERR(priv, "flush request fail\n");
+                        goto done;
+                }
         }
+
         IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n");
-        iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
+        iwl_trans_wait_tx_queue_empty(priv->trans, scd_queues);
 done:
         mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index c7358a9d5b71..770b0e2a9b46 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -579,7 +579,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+        if (mvmvif->phy_ctxt &&
+            IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
                                mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index 897dd5330b0d..4f303639147b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -891,7 +891,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+        if (mvmvif->phy_ctxt &&
+            data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
         IWL_DEBUG_COEX(data->mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 6b3f4d0284a7..302c8cc50f25 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -510,7 +510,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 
-                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                if ((mvm->fw->ucode_capa.capa[0] &
+                     IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+                    (mvm->fw->ucode_capa.api[0] &
+                     IWL_UCODE_TLV_API_LQ_SS_PARAMS))
                         hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
         }
@@ -2385,7 +2388,19 @@ static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
-        iwl_mvm_cancel_scan(mvm);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a hw_scan when it's already stopped.  This can
+         * happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_scan_completed() and the userspace called
+         * cancel scan scan before ieee80211_scan_work() could run.
+         * To handle that, simply return if the scan is not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if ((mvm->scan_status == IWL_MVM_SCAN_OS) ||
+            (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+                iwl_mvm_cancel_scan(mvm);
 
         mutex_unlock(&mvm->mutex);
 }
@@ -2743,12 +2758,29 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         int ret;
 
         mutex_lock(&mvm->mutex);
+
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a sched_scan when it's already stopped.  This
+         * can happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_sched_scan_stopped() and the userspace called
+         * stop sched scan scan before ieee80211_sched_scan_stopped_work()
+         * could run.  To handle this, simply return if the scan is
+         * not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
+            !(mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
+                mutex_unlock(&mvm->mutex);
+                return 0;
+        }
+
         ret = iwl_mvm_scan_offload_stop(mvm, false);
         mutex_unlock(&mvm->mutex);
         iwl_mvm_wait_for_async_handlers(mvm);
 
         return ret;
-
 }
 
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index f0946b5dd7c8..a75bb150ea27 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -587,8 +587,10 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                 return 0;
 
-        if (iwl_mvm_is_radio_killed(mvm))
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ret = 0;
                 goto out;
+        }
 
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
                                    scan_done_notif,
@@ -600,16 +602,14 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                 IWL_DEBUG_SCAN(mvm, "Send stop %sscan failed %d\n",
                                sched ? "offloaded " : "", ret);
                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
-                return ret;
+                goto out;
         }
 
         IWL_DEBUG_SCAN(mvm, "Successfully sent stop %sscan\n",
                        sched ? "offloaded " : "");
 
         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
-        if (ret)
-                return ret;
-
+out:
         /*
          * Clear the scan status so the next scan requests will succeed. This
          * also ensures the Rx handler doesn't do anything, as the scan was
@@ -619,7 +619,6 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_OS)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 
-out:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
@@ -629,7 +628,7 @@ out:
                         ieee80211_scan_completed(mvm->hw, true);
         }
 
-        return 0;
+        return ret;
 }
 
 static void iwl_mvm_unified_scan_fill_tx_cmd(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 1dbfcc43d82c..8d179ab67cc2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -197,6 +197,8 @@ iwl_mvm_te_handle_notify_csa(struct iwl_mvm *mvm,
                              struct iwl_time_event_notif *notif)
 {
         if (!le32_to_cpu(notif->status)) {
+                if (te_data->vif->type == NL80211_IFTYPE_STATION)
+                        ieee80211_connection_loss(te_data->vif);
                 IWL_DEBUG_TE(mvm, "CSA time event failed to start\n");
                 iwl_mvm_te_clear_data(mvm, te_data);
                 return;
@@ -756,8 +758,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->time_event_list, list) {
-                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
-                    te_data->running) {
+                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                         mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
                         is_p2p = true;
                         goto remove_te;
@@ -772,10 +773,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
-                if (te_data->running) {
-                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
-                        goto remove_te;
-                }
+                mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+                goto remove_te;
         }
 
 remove_te: