wifi: rtw89: fix HW scan not aborting properly

There is a length limit on the commands we send to firmware, so
dividing to two commands is sometimes required when scanning.
When aborting scan, we should not send second scan command to
firmware after the first one is finished. This could cause some
unexpected errors when we cannot receive firmware events
(e.g. in suspend).

Another case is scan happens before suspending, ieee80211_do_stop() is
called to abort scan and driver indicate scan completion by
ieee80211_scan_completed(), which queues event to scan work. But scan work
might be late to execute after ieee80211_do_stop(). To correct this, driver
indicates ieee80211_scan_completed() before returning, so that
ieee80211_do_stop() can flush scan work properly.

Fixes: bcbefbd032df ("wifi: rtw89: add wait/completion for abort scan")
Cc: stable@vger.kernel.org
Co-developed-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://msgid.link/20240517013350.11278-1-pkshih@realtek.com

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 044a5b90c7f4e04a7e5670056a1027d5c3408262..f5cd06c35982e4616b752a53a6b0de4142441db8 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -6245,7 +6245,14 @@ void rtw89_hw_scan_abort(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif)
 
        ret = rtw89_hw_scan_offload(rtwdev, vif, false);
        if (ret)
-               rtw89_hw_scan_complete(rtwdev, vif, true);
+               rtw89_warn(rtwdev, "rtw89_hw_scan_offload failed ret %d\n", ret);
+
+       /* Indicate ieee80211_scan_completed() before returning, which is safe
+        * because scan abort command always waits for completion of
+        * RTW89_SCAN_END_SCAN_NOTIFY, so that ieee80211_stop() can flush scan
+        * work properly.
+        */
+       rtw89_hw_scan_complete(rtwdev, vif, true);
 }
 
 static bool rtw89_is_any_vif_connected_or_connecting(struct rtw89_dev *rtwdev)

diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index baefc30b88c4d7c5483723c7bbb83c569a9a5603..824ece03d92d2998121c6bb7247c881aad4e7635 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -4756,6 +4756,9 @@ rtw89_mac_c2h_scanofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *skb,
                }
                return;
        case RTW89_SCAN_END_SCAN_NOTIFY:
+               if (rtwdev->scan_info.abort)
+                       return;
+
                if (rtwvif && rtwvif->scan_req &&
                    last_chan < rtwvif->scan_req->n_channels) {
                        ret = rtw89_hw_scan_offload(rtwdev, vif, true);
@@ -4764,7 +4767,7 @@ rtw89_mac_c2h_scanofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *skb,
                                rtw89_warn(rtwdev, "HW scan failed: %d\n", ret);
                        }
                } else {
-                       rtw89_hw_scan_complete(rtwdev, vif, rtwdev->scan_info.abort);
+                       rtw89_hw_scan_complete(rtwdev, vif, false);
                }
                break;
        case RTW89_SCAN_ENTER_OP_NOTIFY: