drivers/net/wireless/intel/iwlwifi/mvm/scan.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of version 2 of the GNU General Public License as
  14  * published by the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but
  17  * WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  24  * USA
  25  *
  26  * The full GNU General Public License is included in this distribution
  27  * in the file called COPYING.
  28  *
  29  * Contact Information:
  30  *  Intel Linux Wireless <linuxwifi@intel.com>
  31  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  32  *
  33  * BSD LICENSE
  34  *
  35  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  36  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  37  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  38  * All rights reserved.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  *
  44  *  * Redistributions of source code must retain the above copyright
  45  *    notice, this list of conditions and the following disclaimer.
  46  *  * Redistributions in binary form must reproduce the above copyright
  47  *    notice, this list of conditions and the following disclaimer in
  48  *    the documentation and/or other materials provided with the
  49  *    distribution.
  50  *  * Neither the name Intel Corporation nor the names of its
  51  *    contributors may be used to endorse or promote products derived
  52  *    from this software without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  55  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  56  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  57  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  58  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  59  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  60  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  61  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  62  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  63  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  64  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  65  *
  66  *****************************************************************************/
  67
  68 #include <linux/etherdevice.h>
  69 #include <net/mac80211.h>
  70
  71 #include "mvm.h"
  72 #include "fw/api/scan.h"
  73 #include "iwl-io.h"
  74
  75 #define IWL_DENSE_EBS_SCAN_RATIO 5
  76 #define IWL_SPARSE_EBS_SCAN_RATIO 1
  77
  78 enum iwl_mvm_traffic_load {
  79         IWL_MVM_TRAFFIC_LOW,
  80         IWL_MVM_TRAFFIC_MEDIUM,
  81         IWL_MVM_TRAFFIC_HIGH,
  82 };
  83
  84 #define IWL_SCAN_DWELL_ACTIVE           10
  85 #define IWL_SCAN_DWELL_PASSIVE          110
  86 #define IWL_SCAN_DWELL_FRAGMENTED       44
  87 #define IWL_SCAN_DWELL_EXTENDED         90
  88
  89 struct iwl_mvm_scan_timing_params {
  90         u32 suspend_time;
  91         u32 max_out_time;
  92 };
  93
  94 static struct iwl_mvm_scan_timing_params scan_timing[] = {
  95         [IWL_SCAN_TYPE_UNASSOC] = {
  96                 .suspend_time = 0,
  97                 .max_out_time = 0,
  98         },
  99         [IWL_SCAN_TYPE_WILD] = {
 100                 .suspend_time = 30,
 101                 .max_out_time = 120,
 102         },
 103         [IWL_SCAN_TYPE_MILD] = {
 104                 .suspend_time = 120,
 105                 .max_out_time = 120,
 106         },
 107         [IWL_SCAN_TYPE_FRAGMENTED] = {
 108                 .suspend_time = 95,
 109                 .max_out_time = 44,
 110         },
 111 };
 112
 113 struct iwl_mvm_scan_params {
 114         enum iwl_mvm_scan_type type;
 115         u32 n_channels;
 116         u16 delay;
 117         int n_ssids;
 118         struct cfg80211_ssid *ssids;
 119         struct ieee80211_channel **channels;
 120         u32 flags;
 121         u8 *mac_addr;
 122         u8 *mac_addr_mask;
 123         bool no_cck;
 124         bool pass_all;
 125         int n_match_sets;
 126         struct iwl_scan_probe_req preq;
 127         struct cfg80211_match_set *match_sets;
 128         int n_scan_plans;
 129         struct cfg80211_sched_scan_plan *scan_plans;
 130         u32 measurement_dwell;
 131 };
 132
 133 static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 134 {
 135         if (mvm->scan_rx_ant != ANT_NONE)
 136                 return mvm->scan_rx_ant;
 137         return iwl_mvm_get_valid_rx_ant(mvm);
 138 }
 139
 140 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 141 {
 142         u16 rx_chain;
 143         u8 rx_ant;
 144
 145         rx_ant = iwl_mvm_scan_rx_ant(mvm);
 146         rx_chain = rx_ant << PHY_RX_CHAIN_VALID_POS;
 147         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
 148         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_SEL_POS;
 149         rx_chain |= 0x1 << PHY_RX_CHAIN_DRIVER_FORCE_POS;
 150         return cpu_to_le16(rx_chain);
 151 }
 152
 153 static __le32 iwl_mvm_scan_rxon_flags(enum nl80211_band band)
 154 {
 155         if (band == NL80211_BAND_2GHZ)
 156                 return cpu_to_le32(PHY_BAND_24);
 157         else
 158                 return cpu_to_le32(PHY_BAND_5);
 159 }
 160
 161 static inline __le32
 162 iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum nl80211_band band,
 163                           bool no_cck)
 164 {
 165         u32 tx_ant;
 166
 167         mvm->scan_last_antenna_idx =
 168                 iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
 169                                      mvm->scan_last_antenna_idx);
 170         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 171
 172         if (band == NL80211_BAND_2GHZ && !no_cck)
 173                 return cpu_to_le32(IWL_RATE_1M_PLCP | RATE_MCS_CCK_MSK |
 174                                    tx_ant);
 175         else
 176                 return cpu_to_le32(IWL_RATE_6M_PLCP | tx_ant);
 177 }
 178
 179 static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
 180                                             struct ieee80211_vif *vif)
 181 {
 182         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 183         int *global_cnt = data;
 184
 185         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
 186             mvmvif->phy_ctxt->id < NUM_PHY_CTX)
 187                 *global_cnt += 1;
 188 }
 189
 190 static enum iwl_mvm_traffic_load iwl_mvm_get_traffic_load(struct iwl_mvm *mvm)
 191 {
 192         return IWL_MVM_TRAFFIC_LOW;
 193 }
 194
 195 static enum
 196 iwl_mvm_scan_type iwl_mvm_get_scan_type(struct iwl_mvm *mvm, bool p2p_device)
 197 {
 198         int global_cnt = 0;
 199         enum iwl_mvm_traffic_load load;
 200         bool low_latency;
 201
 202         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
 203                                             IEEE80211_IFACE_ITER_NORMAL,
 204                                             iwl_mvm_scan_condition_iterator,
 205                                             &global_cnt);
 206         if (!global_cnt)
 207                 return IWL_SCAN_TYPE_UNASSOC;
 208
 209         load = iwl_mvm_get_traffic_load(mvm);
 210         low_latency = iwl_mvm_low_latency(mvm);
 211
 212         if ((load == IWL_MVM_TRAFFIC_HIGH || low_latency) && !p2p_device &&
 213             fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_FRAGMENTED_SCAN))
 214                 return IWL_SCAN_TYPE_FRAGMENTED;
 215
 216         if (load >= IWL_MVM_TRAFFIC_MEDIUM || low_latency)
 217                 return IWL_SCAN_TYPE_MILD;
 218
 219         return IWL_SCAN_TYPE_WILD;
 220 }
 221
 222 static int
 223 iwl_mvm_get_measurement_dwell(struct iwl_mvm *mvm,
 224                               struct cfg80211_scan_request *req,
 225                               struct iwl_mvm_scan_params *params)
 226 {
 227         if (!req->duration)
 228                 return 0;
 229
 230         if (req->duration_mandatory &&
 231             req->duration > scan_timing[params->type].max_out_time) {
 232                 IWL_DEBUG_SCAN(mvm,
 233                                "Measurement scan - too long dwell %hu (max out time %u)\n",
 234                                req->duration,
 235                                scan_timing[params->type].max_out_time);
 236                 return -EOPNOTSUPP;
 237         }
 238
 239         return min_t(u32, (u32)req->duration,
 240                      scan_timing[params->type].max_out_time);
 241 }
 242
 243 static inline bool iwl_mvm_rrm_scan_needed(struct iwl_mvm *mvm)
 244 {
 245         /* require rrm scan whenever the fw supports it */
 246         return fw_has_capa(&mvm->fw->ucode_capa,
 247                            IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT);
 248 }
 249
 250 static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm)
 251 {
 252         int max_probe_len;
 253
 254         max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
 255
 256         /* we create the 802.11 header and SSID element */
 257         max_probe_len -= 24 + 2;
 258
 259         /* DS parameter set element is added on 2.4GHZ band if required */
 260         if (iwl_mvm_rrm_scan_needed(mvm))
 261                 max_probe_len -= 3;
 262
 263         return max_probe_len;
 264 }
 265
 266 int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm)
 267 {
 268         int max_ie_len = iwl_mvm_max_scan_ie_fw_cmd_room(mvm);
 269
 270         /* TODO: [BUG] This function should return the maximum allowed size of
 271          * scan IEs, however the LMAC scan api contains both 2GHZ and 5GHZ IEs
 272          * in the same command. So the correct implementation of this function
 273          * is just iwl_mvm_max_scan_ie_fw_cmd_room() / 2. Currently the scan
 274          * command has only 512 bytes and it would leave us with about 240
 275          * bytes for scan IEs, which is clearly not enough. So meanwhile
 276          * we will report an incorrect value. This may result in a failure to
 277          * issue a scan in unified_scan_lmac and unified_sched_scan_lmac
 278          * functions with -ENOBUFS, if a large enough probe will be provided.
 279          */
 280         return max_ie_len;
 281 }
 282
 283 void iwl_mvm_rx_lmac_scan_iter_complete_notif(struct iwl_mvm *mvm,
 284                                               struct iwl_rx_cmd_buffer *rxb)
 285 {
 286         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 287         struct iwl_lmac_scan_complete_notif *notif = (void *)pkt->data;
 288
 289         IWL_DEBUG_SCAN(mvm,
 290                        "Scan offload iteration complete: status=0x%x scanned channels=%d\n",
 291                        notif->status, notif->scanned_channels);
 292
 293         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
 294                 IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
 295                 ieee80211_sched_scan_results(mvm->hw);
 296                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 297         }
 298 }
 299
 300 void iwl_mvm_rx_scan_match_found(struct iwl_mvm *mvm,
 301                                  struct iwl_rx_cmd_buffer *rxb)
 302 {
 303         IWL_DEBUG_SCAN(mvm, "Scheduled scan results\n");
 304         ieee80211_sched_scan_results(mvm->hw);
 305 }
 306
 307 static const char *iwl_mvm_ebs_status_str(enum iwl_scan_ebs_status status)
 308 {
 309         switch (status) {
 310         case IWL_SCAN_EBS_SUCCESS:
 311                 return "successful";
 312         case IWL_SCAN_EBS_INACTIVE:
 313                 return "inactive";
 314         case IWL_SCAN_EBS_FAILED:
 315         case IWL_SCAN_EBS_CHAN_NOT_FOUND:
 316         default:
 317                 return "failed";
 318         }
 319 }
 320
 321 void iwl_mvm_rx_lmac_scan_complete_notif(struct iwl_mvm *mvm,
 322                                          struct iwl_rx_cmd_buffer *rxb)
 323 {
 324         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 325         struct iwl_periodic_scan_complete *scan_notif = (void *)pkt->data;
 326         bool aborted = (scan_notif->status == IWL_SCAN_OFFLOAD_ABORTED);
 327
 328         /* If this happens, the firmware has mistakenly sent an LMAC
 329          * notification during UMAC scans -- warn and ignore it.
 330          */
 331         if (WARN_ON_ONCE(fw_has_capa(&mvm->fw->ucode_capa,
 332                                      IWL_UCODE_TLV_CAPA_UMAC_SCAN)))
 333                 return;
 334
 335         /* scan status must be locked for proper checking */
 336         lockdep_assert_held(&mvm->mutex);
 337
 338         /* We first check if we were stopping a scan, in which case we
 339          * just clear the stopping flag.  Then we check if it was a
 340          * firmware initiated stop, in which case we need to inform
 341          * mac80211.
 342          * Note that we can have a stopping and a running scan
 343          * simultaneously, but we can't have two different types of
 344          * scans stopping or running at the same time (since LMAC
 345          * doesn't support it).
 346          */
 347
 348         if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_SCHED) {
 349                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR);
 350
 351                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 352                                aborted ? "aborted" : "completed",
 353                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 354                 IWL_DEBUG_SCAN(mvm,
 355                                "Last line %d, Last iteration %d, Time after last iteration %d\n",
 356                                scan_notif->last_schedule_line,
 357                                scan_notif->last_schedule_iteration,
 358                                __le32_to_cpu(scan_notif->time_after_last_iter));
 359
 360                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_SCHED;
 361         } else if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR) {
 362                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s\n",
 363                                aborted ? "aborted" : "completed",
 364                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 365
 366                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_REGULAR;
 367         } else if (mvm->scan_status & IWL_MVM_SCAN_SCHED) {
 368                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_REGULAR);
 369
 370                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 371                                aborted ? "aborted" : "completed",
 372                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 373                 IWL_DEBUG_SCAN(mvm,
 374                                "Last line %d, Last iteration %d, Time after last iteration %d (FW)\n",
 375                                scan_notif->last_schedule_line,
 376                                scan_notif->last_schedule_iteration,
 377                                __le32_to_cpu(scan_notif->time_after_last_iter));
 378
 379                 mvm->scan_status &= ~IWL_MVM_SCAN_SCHED;
 380                 ieee80211_sched_scan_stopped(mvm->hw);
 381                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 382         } else if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
 383                 struct cfg80211_scan_info info = {
 384                         .aborted = aborted,
 385                 };
 386
 387                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s (FW)\n",
 388                                aborted ? "aborted" : "completed",
 389                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 390
 391                 mvm->scan_status &= ~IWL_MVM_SCAN_REGULAR;
 392                 ieee80211_scan_completed(mvm->hw, &info);
 393                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 394                 cancel_delayed_work(&mvm->scan_timeout_dwork);
 395         } else {
 396                 IWL_ERR(mvm,
 397                         "got scan complete notification but no scan is running\n");
 398         }
 399
 400         mvm->last_ebs_successful =
 401                         scan_notif->ebs_status == IWL_SCAN_EBS_SUCCESS ||
 402                         scan_notif->ebs_status == IWL_SCAN_EBS_INACTIVE;
 403 }
 404
 405 static int iwl_ssid_exist(u8 *ssid, u8 ssid_len, struct iwl_ssid_ie *ssid_list)
 406 {
 407         int i;
 408
 409         for (i = 0; i < PROBE_OPTION_MAX; i++) {
 410                 if (!ssid_list[i].len)
 411                         break;
 412                 if (ssid_list[i].len == ssid_len &&
 413                     !memcmp(ssid_list->ssid, ssid, ssid_len))
 414                         return i;
 415         }
 416         return -1;
 417 }
 418
 419 /* We insert the SSIDs in an inverted order, because the FW will
 420  * invert it back.
 421  */
 422 static void iwl_scan_build_ssids(struct iwl_mvm_scan_params *params,
 423                                  struct iwl_ssid_ie *ssids,
 424                                  u32 *ssid_bitmap)
 425 {
 426         int i, j;
 427         int index;
 428
 429         /*
 430          * copy SSIDs from match list.
 431          * iwl_config_sched_scan_profiles() uses the order of these ssids to
 432          * config match list.
 433          */
 434         for (i = 0, j = params->n_match_sets - 1;
 435              j >= 0 && i < PROBE_OPTION_MAX;
 436              i++, j--) {
 437                 /* skip empty SSID matchsets */
 438                 if (!params->match_sets[j].ssid.ssid_len)
 439                         continue;
 440                 ssids[i].id = WLAN_EID_SSID;
 441                 ssids[i].len = params->match_sets[j].ssid.ssid_len;
 442                 memcpy(ssids[i].ssid, params->match_sets[j].ssid.ssid,
 443                        ssids[i].len);
 444         }
 445
 446         /* add SSIDs from scan SSID list */
 447         *ssid_bitmap = 0;
 448         for (j = params->n_ssids - 1;
 449              j >= 0 && i < PROBE_OPTION_MAX;
 450              i++, j--) {
 451                 index = iwl_ssid_exist(params->ssids[j].ssid,
 452                                        params->ssids[j].ssid_len,
 453                                        ssids);
 454                 if (index < 0) {
 455                         ssids[i].id = WLAN_EID_SSID;
 456                         ssids[i].len = params->ssids[j].ssid_len;
 457                         memcpy(ssids[i].ssid, params->ssids[j].ssid,
 458                                ssids[i].len);
 459                         *ssid_bitmap |= BIT(i);
 460                 } else {
 461                         *ssid_bitmap |= BIT(index);
 462                 }
 463         }
 464 }
 465
 466 static int
 467 iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
 468                                    struct cfg80211_sched_scan_request *req)
 469 {
 470         struct iwl_scan_offload_profile *profile;
 471         struct iwl_scan_offload_profile_cfg *profile_cfg;
 472         struct iwl_scan_offload_blacklist *blacklist;
 473         struct iwl_host_cmd cmd = {
 474                 .id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
 475                 .len[1] = sizeof(*profile_cfg),
 476                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
 477                 .dataflags[1] = IWL_HCMD_DFL_NOCOPY,
 478         };
 479         int blacklist_len;
 480         int i;
 481         int ret;
 482
 483         if (WARN_ON(req->n_match_sets > IWL_SCAN_MAX_PROFILES))
 484                 return -EIO;
 485
 486         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SHORT_BL)
 487                 blacklist_len = IWL_SCAN_SHORT_BLACKLIST_LEN;
 488         else
 489                 blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 490
 491         blacklist = kzalloc(sizeof(*blacklist) * blacklist_len, GFP_KERNEL);
 492         if (!blacklist)
 493                 return -ENOMEM;
 494
 495         profile_cfg = kzalloc(sizeof(*profile_cfg), GFP_KERNEL);
 496         if (!profile_cfg) {
 497                 ret = -ENOMEM;
 498                 goto free_blacklist;
 499         }
 500
 501         cmd.data[0] = blacklist;
 502         cmd.len[0] = sizeof(*blacklist) * blacklist_len;
 503         cmd.data[1] = profile_cfg;
 504
 505         /* No blacklist configuration */
 506
 507         profile_cfg->num_profiles = req->n_match_sets;
 508         profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
 509         profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
 510         profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
 511         if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
 512                 profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 513
 514         for (i = 0; i < req->n_match_sets; i++) {
 515                 profile = &profile_cfg->profiles[i];
 516                 profile->ssid_index = i;
 517                 /* Support any cipher and auth algorithm */
 518                 profile->unicast_cipher = 0xff;
 519                 profile->auth_alg = 0xff;
 520                 profile->network_type = IWL_NETWORK_TYPE_ANY;
 521                 profile->band_selection = IWL_SCAN_OFFLOAD_SELECT_ANY;
 522                 profile->client_bitmap = SCAN_CLIENT_SCHED_SCAN;
 523         }
 524
 525         IWL_DEBUG_SCAN(mvm, "Sending scheduled scan profile config\n");
 526
 527         ret = iwl_mvm_send_cmd(mvm, &cmd);
 528         kfree(profile_cfg);
 529 free_blacklist:
 530         kfree(blacklist);
 531
 532         return ret;
 533 }
 534
 535 static bool iwl_mvm_scan_pass_all(struct iwl_mvm *mvm,
 536                                   struct cfg80211_sched_scan_request *req)
 537 {
 538         if (req->n_match_sets && req->match_sets[0].ssid.ssid_len) {
 539                 IWL_DEBUG_SCAN(mvm,
 540                                "Sending scheduled scan with filtering, n_match_sets %d\n",
 541                                req->n_match_sets);
 542                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 543                 return false;
 544         }
 545
 546         IWL_DEBUG_SCAN(mvm, "Sending Scheduled scan without filtering\n");
 547
 548         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 549         return true;
 550 }
 551
 552 static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
 553 {
 554         int ret;
 555         struct iwl_host_cmd cmd = {
 556                 .id = SCAN_OFFLOAD_ABORT_CMD,
 557         };
 558         u32 status = CAN_ABORT_STATUS;
 559
 560         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
 561         if (ret)
 562                 return ret;
 563
 564         if (status != CAN_ABORT_STATUS) {
 565                 /*
 566                  * The scan abort will return 1 for success or
 567                  * 2 for "failure".  A failure condition can be
 568                  * due to simply not being in an active scan which
 569                  * can occur if we send the scan abort before the
 570                  * microcode has notified us that a scan is completed.
 571                  */
 572                 IWL_DEBUG_SCAN(mvm, "SCAN OFFLOAD ABORT ret %d.\n", status);
 573                 ret = -ENOENT;
 574         }
 575
 576         return ret;
 577 }
 578
 579 static void iwl_mvm_scan_fill_tx_cmd(struct iwl_mvm *mvm,
 580                                      struct iwl_scan_req_tx_cmd *tx_cmd,
 581                                      bool no_cck)
 582 {
 583         tx_cmd[0].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 584                                          TX_CMD_FLG_BT_DIS);
 585         tx_cmd[0].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 586                                                            NL80211_BAND_2GHZ,
 587                                                            no_cck);
 588         tx_cmd[0].sta_id = mvm->aux_sta.sta_id;
 589
 590         tx_cmd[1].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 591                                          TX_CMD_FLG_BT_DIS);
 592         tx_cmd[1].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 593                                                            NL80211_BAND_5GHZ,
 594                                                            no_cck);
 595         tx_cmd[1].sta_id = mvm->aux_sta.sta_id;
 596 }
 597
 598 static void
 599 iwl_mvm_lmac_scan_cfg_channels(struct iwl_mvm *mvm,
 600                                struct ieee80211_channel **channels,
 601                                int n_channels, u32 ssid_bitmap,
 602                                struct iwl_scan_req_lmac *cmd)
 603 {
 604         struct iwl_scan_channel_cfg_lmac *channel_cfg = (void *)&cmd->data;
 605         int i;
 606
 607         for (i = 0; i < n_channels; i++) {
 608                 channel_cfg[i].channel_num =
 609                         cpu_to_le16(channels[i]->hw_value);
 610                 channel_cfg[i].iter_count = cpu_to_le16(1);
 611                 channel_cfg[i].iter_interval = 0;
 612                 channel_cfg[i].flags =
 613                         cpu_to_le32(IWL_UNIFIED_SCAN_CHANNEL_PARTIAL |
 614                                     ssid_bitmap);
 615         }
 616 }
 617
 618 static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,
 619                                            size_t len, u8 *const pos)
 620 {
 621         static const u8 before_ds_params[] = {
 622                         WLAN_EID_SSID,
 623                         WLAN_EID_SUPP_RATES,
 624                         WLAN_EID_REQUEST,
 625                         WLAN_EID_EXT_SUPP_RATES,
 626         };
 627         size_t offs;
 628         u8 *newpos = pos;
 629
 630         if (!iwl_mvm_rrm_scan_needed(mvm)) {
 631                 memcpy(newpos, ies, len);
 632                 return newpos + len;
 633         }
 634
 635         offs = ieee80211_ie_split(ies, len,
 636                                   before_ds_params,
 637                                   ARRAY_SIZE(before_ds_params),
 638                                   0);
 639
 640         memcpy(newpos, ies, offs);
 641         newpos += offs;
 642
 643         /* Add a placeholder for DS Parameter Set element */
 644         *newpos++ = WLAN_EID_DS_PARAMS;
 645         *newpos++ = 1;
 646         *newpos++ = 0;
 647
 648         memcpy(newpos, ies + offs, len - offs);
 649         newpos += len - offs;
 650
 651         return newpos;
 652 }
 653
 654 static void
 655 iwl_mvm_build_scan_probe(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 656                          struct ieee80211_scan_ies *ies,
 657                          struct iwl_mvm_scan_params *params)
 658 {
 659         struct ieee80211_mgmt *frame = (void *)params->preq.buf;
 660         u8 *pos, *newpos;
 661         const u8 *mac_addr = params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
 662                 params->mac_addr : NULL;
 663
 664         /*
 665          * Unfortunately, right now the offload scan doesn't support randomising
 666          * within the firmware, so until the firmware API is ready we implement
 667          * it in the driver. This means that the scan iterations won't really be
 668          * random, only when it's restarted, but at least that helps a bit.
 669          */
 670         if (mac_addr)
 671                 get_random_mask_addr(frame->sa, mac_addr,
 672                                      params->mac_addr_mask);
 673         else
 674                 memcpy(frame->sa, vif->addr, ETH_ALEN);
 675
 676         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 677         eth_broadcast_addr(frame->da);
 678         eth_broadcast_addr(frame->bssid);
 679         frame->seq_ctrl = 0;
 680
 681         pos = frame->u.probe_req.variable;
 682         *pos++ = WLAN_EID_SSID;
 683         *pos++ = 0;
 684
 685         params->preq.mac_header.offset = 0;
 686         params->preq.mac_header.len = cpu_to_le16(24 + 2);
 687
 688         /* Insert ds parameter set element on 2.4 GHz band */
 689         newpos = iwl_mvm_copy_and_insert_ds_elem(mvm,
 690                                                  ies->ies[NL80211_BAND_2GHZ],
 691                                                  ies->len[NL80211_BAND_2GHZ],
 692                                                  pos);
 693         params->preq.band_data[0].offset = cpu_to_le16(pos - params->preq.buf);
 694         params->preq.band_data[0].len = cpu_to_le16(newpos - pos);
 695         pos = newpos;
 696
 697         memcpy(pos, ies->ies[NL80211_BAND_5GHZ],
 698                ies->len[NL80211_BAND_5GHZ]);
 699         params->preq.band_data[1].offset = cpu_to_le16(pos - params->preq.buf);
 700         params->preq.band_data[1].len =
 701                 cpu_to_le16(ies->len[NL80211_BAND_5GHZ]);
 702         pos += ies->len[NL80211_BAND_5GHZ];
 703
 704         memcpy(pos, ies->common_ies, ies->common_ie_len);
 705         params->preq.common_data.offset = cpu_to_le16(pos - params->preq.buf);
 706         params->preq.common_data.len = cpu_to_le16(ies->common_ie_len);
 707 }
 708
 709 static void iwl_mvm_scan_lmac_dwell(struct iwl_mvm *mvm,
 710                                     struct iwl_scan_req_lmac *cmd,
 711                                     struct iwl_mvm_scan_params *params)
 712 {
 713         cmd->active_dwell = IWL_SCAN_DWELL_ACTIVE;
 714         cmd->passive_dwell = IWL_SCAN_DWELL_PASSIVE;
 715         cmd->fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
 716         cmd->extended_dwell = IWL_SCAN_DWELL_EXTENDED;
 717         cmd->max_out_time = cpu_to_le32(scan_timing[params->type].max_out_time);
 718         cmd->suspend_time = cpu_to_le32(scan_timing[params->type].suspend_time);
 719         cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
 720 }
 721
 722 static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,
 723                                      struct ieee80211_scan_ies *ies,
 724                                      int n_channels)
 725 {
 726         return ((n_ssids <= PROBE_OPTION_MAX) &&
 727                 (n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
 728                 (ies->common_ie_len +
 729                  ies->len[NL80211_BAND_2GHZ] +
 730                  ies->len[NL80211_BAND_5GHZ] <=
 731                  iwl_mvm_max_scan_ie_fw_cmd_room(mvm)));
 732 }
 733
 734 static inline bool iwl_mvm_scan_use_ebs(struct iwl_mvm *mvm,
 735                                         struct ieee80211_vif *vif)
 736 {
 737         const struct iwl_ucode_capabilities *capa = &mvm->fw->ucode_capa;
 738
 739         /* We can only use EBS if:
 740          *      1. the feature is supported;
 741          *      2. the last EBS was successful;
 742          *      3. if only single scan, the single scan EBS API is supported;
 743          *      4. it's not a p2p find operation.
 744          */
 745         return ((capa->flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT) &&
 746                 mvm->last_ebs_successful && IWL_MVM_ENABLE_EBS &&
 747                 vif->type != NL80211_IFTYPE_P2P_DEVICE);
 748 }
 749
 750 static inline bool iwl_mvm_is_regular_scan(struct iwl_mvm_scan_params *params)
 751 {
 752         return params->n_scan_plans == 1 &&
 753                 params->scan_plans[0].iterations == 1;
 754 }
 755
 756 static int iwl_mvm_scan_lmac_flags(struct iwl_mvm *mvm,
 757                                    struct iwl_mvm_scan_params *params,
 758                                    struct ieee80211_vif *vif)
 759 {
 760         int flags = 0;
 761
 762         if (params->n_ssids == 0)
 763                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 764
 765         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
 766                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
 767
 768         if (params->type == IWL_SCAN_TYPE_FRAGMENTED)
 769                 flags |= IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED;
 770
 771         if (iwl_mvm_rrm_scan_needed(mvm))
 772                 flags |= IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED;
 773
 774         if (params->pass_all)
 775                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
 776         else
 777                 flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
 778
 779 #ifdef CONFIG_IWLWIFI_DEBUGFS
 780         if (mvm->scan_iter_notif_enabled)
 781                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 782 #endif
 783
 784         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
 785                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 786
 787         if (iwl_mvm_is_regular_scan(params) &&
 788             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
 789             params->type != IWL_SCAN_TYPE_FRAGMENTED)
 790                 flags |= IWL_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL;
 791
 792         return flags;
 793 }
 794
 795 static int iwl_mvm_scan_lmac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 796                              struct iwl_mvm_scan_params *params)
 797 {
 798         struct iwl_scan_req_lmac *cmd = mvm->scan_cmd;
 799         struct iwl_scan_probe_req *preq =
 800                 (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
 801                          mvm->fw->ucode_capa.n_scan_channels);
 802         u32 ssid_bitmap = 0;
 803         int i;
 804
 805         lockdep_assert_held(&mvm->mutex);
 806
 807         memset(cmd, 0, ksize(cmd));
 808
 809         if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
 810                 return -EINVAL;
 811
 812         iwl_mvm_scan_lmac_dwell(mvm, cmd, params);
 813
 814         cmd->rx_chain_select = iwl_mvm_scan_rx_chain(mvm);
 815         cmd->iter_num = cpu_to_le32(1);
 816         cmd->n_channels = (u8)params->n_channels;
 817
 818         cmd->delay = cpu_to_le32(params->delay);
 819
 820         cmd->scan_flags = cpu_to_le32(iwl_mvm_scan_lmac_flags(mvm, params,
 821                                                               vif));
 822
 823         cmd->flags = iwl_mvm_scan_rxon_flags(params->channels[0]->band);
 824         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
 825                                         MAC_FILTER_IN_BEACON);
 826         iwl_mvm_scan_fill_tx_cmd(mvm, cmd->tx_cmd, params->no_cck);
 827         iwl_scan_build_ssids(params, cmd->direct_scan, &ssid_bitmap);
 828
 829         /* this API uses bits 1-20 instead of 0-19 */
 830         ssid_bitmap <<= 1;
 831
 832         for (i = 0; i < params->n_scan_plans; i++) {
 833                 struct cfg80211_sched_scan_plan *scan_plan =
 834                         &params->scan_plans[i];
 835
 836                 cmd->schedule[i].delay =
 837                         cpu_to_le16(scan_plan->interval);
 838                 cmd->schedule[i].iterations = scan_plan->iterations;
 839                 cmd->schedule[i].full_scan_mul = 1;
 840         }
 841
 842         /*
 843          * If the number of iterations of the last scan plan is set to
 844          * zero, it should run infinitely. However, this is not always the case.
 845          * For example, when regular scan is requested the driver sets one scan
 846          * plan with one iteration.
 847          */
 848         if (!cmd->schedule[i - 1].iterations)
 849                 cmd->schedule[i - 1].iterations = 0xff;
 850
 851         if (iwl_mvm_scan_use_ebs(mvm, vif)) {
 852                 cmd->channel_opt[0].flags =
 853                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 854                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 855                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 856                 cmd->channel_opt[0].non_ebs_ratio =
 857                         cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
 858                 cmd->channel_opt[1].flags =
 859                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 860                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 861                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 862                 cmd->channel_opt[1].non_ebs_ratio =
 863                         cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
 864         }
 865
 866         iwl_mvm_lmac_scan_cfg_channels(mvm, params->channels,
 867                                        params->n_channels, ssid_bitmap, cmd);
 868
 869         *preq = params->preq;
 870
 871         return 0;
 872 }
 873
 874 static int rate_to_scan_rate_flag(unsigned int rate)
 875 {
 876         static const int rate_to_scan_rate[IWL_RATE_COUNT] = {
 877                 [IWL_RATE_1M_INDEX]     = SCAN_CONFIG_RATE_1M,
 878                 [IWL_RATE_2M_INDEX]     = SCAN_CONFIG_RATE_2M,
 879                 [IWL_RATE_5M_INDEX]     = SCAN_CONFIG_RATE_5M,
 880                 [IWL_RATE_11M_INDEX]    = SCAN_CONFIG_RATE_11M,
 881                 [IWL_RATE_6M_INDEX]     = SCAN_CONFIG_RATE_6M,
 882                 [IWL_RATE_9M_INDEX]     = SCAN_CONFIG_RATE_9M,
 883                 [IWL_RATE_12M_INDEX]    = SCAN_CONFIG_RATE_12M,
 884                 [IWL_RATE_18M_INDEX]    = SCAN_CONFIG_RATE_18M,
 885                 [IWL_RATE_24M_INDEX]    = SCAN_CONFIG_RATE_24M,
 886                 [IWL_RATE_36M_INDEX]    = SCAN_CONFIG_RATE_36M,
 887                 [IWL_RATE_48M_INDEX]    = SCAN_CONFIG_RATE_48M,
 888                 [IWL_RATE_54M_INDEX]    = SCAN_CONFIG_RATE_54M,
 889         };
 890
 891         return rate_to_scan_rate[rate];
 892 }
 893
 894 static __le32 iwl_mvm_scan_config_rates(struct iwl_mvm *mvm)
 895 {
 896         struct ieee80211_supported_band *band;
 897         unsigned int rates = 0;
 898         int i;
 899
 900         band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 901         for (i = 0; i < band->n_bitrates; i++)
 902                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 903         band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 904         for (i = 0; i < band->n_bitrates; i++)
 905                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 906
 907         /* Set both basic rates and supported rates */
 908         rates |= SCAN_CONFIG_SUPPORTED_RATE(rates);
 909
 910         return cpu_to_le32(rates);
 911 }
 912
 913 static void iwl_mvm_fill_scan_dwell(struct iwl_mvm *mvm,
 914                                     struct iwl_scan_dwell *dwell)
 915 {
 916         dwell->active = IWL_SCAN_DWELL_ACTIVE;
 917         dwell->passive = IWL_SCAN_DWELL_PASSIVE;
 918         dwell->fragmented = IWL_SCAN_DWELL_FRAGMENTED;
 919         dwell->extended = IWL_SCAN_DWELL_EXTENDED;
 920 }
 921
 922 static void iwl_mvm_fill_channels(struct iwl_mvm *mvm, u8 *channels)
 923 {
 924         struct ieee80211_supported_band *band;
 925         int i, j = 0;
 926
 927         band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 928         for (i = 0; i < band->n_channels; i++, j++)
 929                 channels[j] = band->channels[i].hw_value;
 930         band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 931         for (i = 0; i < band->n_channels; i++, j++)
 932                 channels[j] = band->channels[i].hw_value;
 933 }
 934
 935 static void iwl_mvm_fill_scan_config_v1(struct iwl_mvm *mvm, void *config,
 936                                         u32 flags, u8 channel_flags)
 937 {
 938         enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, false);
 939         struct iwl_scan_config_v1 *cfg = config;
 940
 941         cfg->flags = cpu_to_le32(flags);
 942         cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
 943         cfg->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
 944         cfg->legacy_rates = iwl_mvm_scan_config_rates(mvm);
 945         cfg->out_of_channel_time = cpu_to_le32(scan_timing[type].max_out_time);
 946         cfg->suspend_time = cpu_to_le32(scan_timing[type].suspend_time);
 947
 948         iwl_mvm_fill_scan_dwell(mvm, &cfg->dwell);
 949
 950         memcpy(&cfg->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
 951
 952         cfg->bcast_sta_id = mvm->aux_sta.sta_id;
 953         cfg->channel_flags = channel_flags;
 954
 955         iwl_mvm_fill_channels(mvm, cfg->channel_array);
 956 }
 957
 958 static void iwl_mvm_fill_scan_config(struct iwl_mvm *mvm, void *config,
 959                                      u32 flags, u8 channel_flags)
 960 {
 961         enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, false);
 962         struct iwl_scan_config *cfg = config;
 963
 964         cfg->flags = cpu_to_le32(flags);
 965         cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
 966         cfg->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
 967         cfg->legacy_rates = iwl_mvm_scan_config_rates(mvm);
 968         cfg->out_of_channel_time[0] =
 969                 cpu_to_le32(scan_timing[type].max_out_time);
 970         cfg->suspend_time[0] = cpu_to_le32(scan_timing[type].suspend_time);
 971
 972         if (iwl_mvm_is_cdb_supported(mvm)) {
 973                 cfg->suspend_time[1] =
 974                         cpu_to_le32(scan_timing[type].suspend_time);
 975                 cfg->out_of_channel_time[1] =
 976                         cpu_to_le32(scan_timing[type].max_out_time);
 977         }
 978
 979         iwl_mvm_fill_scan_dwell(mvm, &cfg->dwell);
 980
 981         memcpy(&cfg->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
 982
 983         cfg->bcast_sta_id = mvm->aux_sta.sta_id;
 984         cfg->channel_flags = channel_flags;
 985
 986         iwl_mvm_fill_channels(mvm, cfg->channel_array);
 987 }
 988
 989 int iwl_mvm_config_scan(struct iwl_mvm *mvm)
 990 {
 991         void *cfg;
 992         int ret, cmd_size;
 993         struct iwl_host_cmd cmd = {
 994                 .id = iwl_cmd_id(SCAN_CFG_CMD, IWL_ALWAYS_LONG_GROUP, 0),
 995         };
 996         enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, false);
 997         int num_channels =
 998                 mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels +
 999                 mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels;
1000         u32 flags;
1001         u8 channel_flags;
1002
1003         if (WARN_ON(num_channels > mvm->fw->ucode_capa.n_scan_channels))
1004                 return -ENOBUFS;
1005
1006         if (type == mvm->scan_type)
1007                 return 0;
1008
1009         if (iwl_mvm_has_new_tx_api(mvm))
1010                 cmd_size = sizeof(struct iwl_scan_config);
1011         else
1012                 cmd_size = sizeof(struct iwl_scan_config_v1);
1013         cmd_size += mvm->fw->ucode_capa.n_scan_channels;
1014
1015         cfg = kzalloc(cmd_size, GFP_KERNEL);
1016         if (!cfg)
1017                 return -ENOMEM;
1018
1019         flags = SCAN_CONFIG_FLAG_ACTIVATE |
1020                  SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS |
1021                  SCAN_CONFIG_FLAG_SET_TX_CHAINS |
1022                  SCAN_CONFIG_FLAG_SET_RX_CHAINS |
1023                  SCAN_CONFIG_FLAG_SET_AUX_STA_ID |
1024                  SCAN_CONFIG_FLAG_SET_ALL_TIMES |
1025                  SCAN_CONFIG_FLAG_SET_LEGACY_RATES |
1026                  SCAN_CONFIG_FLAG_SET_MAC_ADDR |
1027                  SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS |
1028                  SCAN_CONFIG_N_CHANNELS(num_channels) |
1029                  (type == IWL_SCAN_TYPE_FRAGMENTED ?
1030                   SCAN_CONFIG_FLAG_SET_FRAGMENTED :
1031                   SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED);
1032
1033         channel_flags = IWL_CHANNEL_FLAG_EBS |
1034                         IWL_CHANNEL_FLAG_ACCURATE_EBS |
1035                         IWL_CHANNEL_FLAG_EBS_ADD |
1036                         IWL_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE;
1037
1038         if (iwl_mvm_has_new_tx_api(mvm)) {
1039                 flags |= (type == IWL_SCAN_TYPE_FRAGMENTED) ?
1040                          SCAN_CONFIG_FLAG_SET_LMAC2_FRAGMENTED :
1041                          SCAN_CONFIG_FLAG_CLEAR_LMAC2_FRAGMENTED;
1042                 iwl_mvm_fill_scan_config(mvm, cfg, flags, channel_flags);
1043         } else {
1044                 iwl_mvm_fill_scan_config_v1(mvm, cfg, flags, channel_flags);
1045         }
1046
1047         cmd.data[0] = cfg;
1048         cmd.len[0] = cmd_size;
1049         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
1050
1051         IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
1052
1053         ret = iwl_mvm_send_cmd(mvm, &cmd);
1054         if (!ret)
1055                 mvm->scan_type = type;
1056
1057         kfree(cfg);
1058         return ret;
1059 }
1060
1061 static int iwl_mvm_scan_uid_by_status(struct iwl_mvm *mvm, int status)
1062 {
1063         int i;
1064
1065         for (i = 0; i < mvm->max_scans; i++)
1066                 if (mvm->scan_uid_status[i] == status)
1067                         return i;
1068
1069         return -ENOENT;
1070 }
1071
1072 static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
1073                                     struct iwl_scan_req_umac *cmd,
1074                                     struct iwl_mvm_scan_params *params)
1075 {
1076         struct iwl_mvm_scan_timing_params *timing = &scan_timing[params->type];
1077
1078         if (params->measurement_dwell) {
1079                 cmd->active_dwell = params->measurement_dwell;
1080                 cmd->passive_dwell = params->measurement_dwell;
1081                 cmd->extended_dwell = params->measurement_dwell;
1082         } else {
1083                 cmd->active_dwell = IWL_SCAN_DWELL_ACTIVE;
1084                 cmd->passive_dwell = IWL_SCAN_DWELL_PASSIVE;
1085                 cmd->extended_dwell = IWL_SCAN_DWELL_EXTENDED;
1086         }
1087         cmd->fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
1088
1089         if (iwl_mvm_has_new_tx_api(mvm)) {
1090                 cmd->v6.scan_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1091                 cmd->v6.max_out_time[0] = cpu_to_le32(timing->max_out_time);
1092                 cmd->v6.suspend_time[0] = cpu_to_le32(timing->suspend_time);
1093                 if (iwl_mvm_is_cdb_supported(mvm)) {
1094                         cmd->v6.max_out_time[1] =
1095                                 cpu_to_le32(timing->max_out_time);
1096                         cmd->v6.suspend_time[1] =
1097                                 cpu_to_le32(timing->suspend_time);
1098                 }
1099         } else {
1100                 cmd->v1.max_out_time = cpu_to_le32(timing->max_out_time);
1101                 cmd->v1.suspend_time = cpu_to_le32(timing->suspend_time);
1102                 cmd->v1.scan_priority =
1103                         cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1104         }
1105
1106         if (iwl_mvm_is_regular_scan(params))
1107                 cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1108         else
1109                 cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_2);
1110 }
1111
1112 static void
1113 iwl_mvm_umac_scan_cfg_channels(struct iwl_mvm *mvm,
1114                                struct ieee80211_channel **channels,
1115                                int n_channels, u32 ssid_bitmap,
1116                                struct iwl_scan_channel_cfg_umac *channel_cfg)
1117 {
1118         int i;
1119
1120         for (i = 0; i < n_channels; i++) {
1121                 channel_cfg[i].flags = cpu_to_le32(ssid_bitmap);
1122                 channel_cfg[i].channel_num = channels[i]->hw_value;
1123                 channel_cfg[i].iter_count = 1;
1124                 channel_cfg[i].iter_interval = 0;
1125         }
1126 }
1127
1128 static u16 iwl_mvm_scan_umac_flags(struct iwl_mvm *mvm,
1129                                    struct iwl_mvm_scan_params *params,
1130                                    struct ieee80211_vif *vif)
1131 {
1132         u16 flags = 0;
1133
1134         if (params->n_ssids == 0)
1135                 flags = IWL_UMAC_SCAN_GEN_FLAGS_PASSIVE;
1136
1137         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
1138                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT;
1139
1140         if (params->type == IWL_SCAN_TYPE_FRAGMENTED) {
1141                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED;
1142                 if (iwl_mvm_is_cdb_supported(mvm))
1143                         flags |= IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED;
1144         }
1145
1146         if (iwl_mvm_rrm_scan_needed(mvm))
1147                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED;
1148
1149         if (params->pass_all)
1150                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
1151         else
1152                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_MATCH;
1153
1154         if (!iwl_mvm_is_regular_scan(params))
1155                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PERIODIC;
1156
1157         if (params->measurement_dwell)
1158                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1159
1160 #ifdef CONFIG_IWLWIFI_DEBUGFS
1161         if (mvm->scan_iter_notif_enabled)
1162                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1163 #endif
1164
1165         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
1166                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1167
1168         if (iwl_mvm_is_regular_scan(params) &&
1169             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
1170             params->type != IWL_SCAN_TYPE_FRAGMENTED)
1171                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL;
1172
1173         return flags;
1174 }
1175
1176 static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1177                              struct iwl_mvm_scan_params *params,
1178                              int type)
1179 {
1180         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
1181         void *cmd_data = iwl_mvm_has_new_tx_api(mvm) ?
1182                          (void *)&cmd->v6.data : (void *)&cmd->v1.data;
1183         struct iwl_scan_req_umac_tail *sec_part = cmd_data +
1184                 sizeof(struct iwl_scan_channel_cfg_umac) *
1185                         mvm->fw->ucode_capa.n_scan_channels;
1186         int uid, i;
1187         u32 ssid_bitmap = 0;
1188         u8 channel_flags = 0;
1189         struct iwl_mvm_vif *scan_vif = iwl_mvm_vif_from_mac80211(vif);
1190
1191         lockdep_assert_held(&mvm->mutex);
1192
1193         if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
1194                 return -EINVAL;
1195
1196         uid = iwl_mvm_scan_uid_by_status(mvm, 0);
1197         if (uid < 0)
1198                 return uid;
1199
1200         memset(cmd, 0, ksize(cmd));
1201
1202         iwl_mvm_scan_umac_dwell(mvm, cmd, params);
1203
1204         mvm->scan_uid_status[uid] = type;
1205
1206         cmd->uid = cpu_to_le32(uid);
1207         cmd->general_flags = cpu_to_le16(iwl_mvm_scan_umac_flags(mvm, params,
1208                                                                  vif));
1209         cmd->scan_start_mac_id = scan_vif->id;
1210
1211         if (type == IWL_MVM_SCAN_SCHED || type == IWL_MVM_SCAN_NETDETECT)
1212                 cmd->flags = cpu_to_le32(IWL_UMAC_SCAN_FLAG_PREEMPTIVE);
1213
1214         if (iwl_mvm_scan_use_ebs(mvm, vif))
1215                 channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
1216                                 IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1217                                 IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
1218
1219         if (iwl_mvm_has_new_tx_api(mvm)) {
1220                 cmd->v6.channel_flags = channel_flags;
1221                 cmd->v6.n_channels = params->n_channels;
1222         } else {
1223                 cmd->v1.channel_flags = channel_flags;
1224                 cmd->v1.n_channels = params->n_channels;
1225         }
1226
1227         iwl_scan_build_ssids(params, sec_part->direct_scan, &ssid_bitmap);
1228
1229         iwl_mvm_umac_scan_cfg_channels(mvm, params->channels,
1230                                        params->n_channels, ssid_bitmap,
1231                                        cmd_data);
1232
1233         for (i = 0; i < params->n_scan_plans; i++) {
1234                 struct cfg80211_sched_scan_plan *scan_plan =
1235                         &params->scan_plans[i];
1236
1237                 sec_part->schedule[i].iter_count = scan_plan->iterations;
1238                 sec_part->schedule[i].interval =
1239                         cpu_to_le16(scan_plan->interval);
1240         }
1241
1242         /*
1243          * If the number of iterations of the last scan plan is set to
1244          * zero, it should run infinitely. However, this is not always the case.
1245          * For example, when regular scan is requested the driver sets one scan
1246          * plan with one iteration.
1247          */
1248         if (!sec_part->schedule[i - 1].iter_count)
1249                 sec_part->schedule[i - 1].iter_count = 0xff;
1250
1251         sec_part->delay = cpu_to_le16(params->delay);
1252         sec_part->preq = params->preq;
1253
1254         return 0;
1255 }
1256
1257 static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
1258 {
1259         return hweight32(mvm->scan_status & IWL_MVM_SCAN_MASK);
1260 }
1261
1262 static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
1263 {
1264         bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
1265                                          IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
1266
1267         /* This looks a bit arbitrary, but the idea is that if we run
1268          * out of possible simultaneous scans and the userspace is
1269          * trying to run a scan type that is already running, we
1270          * return -EBUSY.  But if the userspace wants to start a
1271          * different type of scan, we stop the opposite type to make
1272          * space for the new request.  The reason is backwards
1273          * compatibility with old wpa_supplicant that wouldn't stop a
1274          * scheduled scan before starting a normal scan.
1275          */
1276
1277         if (iwl_mvm_num_scans(mvm) < mvm->max_scans)
1278                 return 0;
1279
1280         /* Use a switch, even though this is a bitmask, so that more
1281          * than one bits set will fall in default and we will warn.
1282          */
1283         switch (type) {
1284         case IWL_MVM_SCAN_REGULAR:
1285                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1286                         return -EBUSY;
1287                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
1288         case IWL_MVM_SCAN_SCHED:
1289                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1290                         return -EBUSY;
1291                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
1292         case IWL_MVM_SCAN_NETDETECT:
1293                 /* For non-unified images, there's no need to stop
1294                  * anything for net-detect since the firmware is
1295                  * restarted anyway.  This way, any sched scans that
1296                  * were running will be restarted when we resume.
1297                  */
1298                 if (!unified_image)
1299                         return 0;
1300
1301                 /* If this is a unified image and we ran out of scans,
1302                  * we need to stop something.  Prefer stopping regular
1303                  * scans, because the results are useless at this
1304                  * point, and we should be able to keep running
1305                  * another scheduled scan while suspended.
1306                  */
1307                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1308                         return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR,
1309                                                  true);
1310                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1311                         return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
1312                                                  true);
1313
1314                 /* fall through, something is wrong if no scan was
1315                  * running but we ran out of scans.
1316                  */
1317         default:
1318                 WARN_ON(1);
1319                 break;
1320         }
1321
1322         return -EIO;
1323 }
1324
1325 #define SCAN_TIMEOUT 20000
1326
1327 void iwl_mvm_scan_timeout_wk(struct work_struct *work)
1328 {
1329         struct delayed_work *delayed_work = to_delayed_work(work);
1330         struct iwl_mvm *mvm = container_of(delayed_work, struct iwl_mvm,
1331                                            scan_timeout_dwork);
1332
1333         IWL_ERR(mvm, "regular scan timed out\n");
1334
1335         iwl_force_nmi(mvm->trans);
1336 }
1337
1338 int iwl_mvm_reg_scan_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1339                            struct cfg80211_scan_request *req,
1340                            struct ieee80211_scan_ies *ies)
1341 {
1342         struct iwl_host_cmd hcmd = {
1343                 .len = { iwl_mvm_scan_size(mvm), },
1344                 .data = { mvm->scan_cmd, },
1345                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1346         };
1347         struct iwl_mvm_scan_params params = {};
1348         int ret;
1349         struct cfg80211_sched_scan_plan scan_plan = { .iterations = 1 };
1350
1351         lockdep_assert_held(&mvm->mutex);
1352
1353         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1354                 IWL_ERR(mvm, "scan while LAR regdomain is not set\n");
1355                 return -EBUSY;
1356         }
1357
1358         ret = iwl_mvm_check_running_scans(mvm, IWL_MVM_SCAN_REGULAR);
1359         if (ret)
1360                 return ret;
1361
1362         /* we should have failed registration if scan_cmd was NULL */
1363         if (WARN_ON(!mvm->scan_cmd))
1364                 return -ENOMEM;
1365
1366         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1367                 return -ENOBUFS;
1368
1369         params.n_ssids = req->n_ssids;
1370         params.flags = req->flags;
1371         params.n_channels = req->n_channels;
1372         params.delay = 0;
1373         params.ssids = req->ssids;
1374         params.channels = req->channels;
1375         params.mac_addr = req->mac_addr;
1376         params.mac_addr_mask = req->mac_addr_mask;
1377         params.no_cck = req->no_cck;
1378         params.pass_all = true;
1379         params.n_match_sets = 0;
1380         params.match_sets = NULL;
1381
1382         params.scan_plans = &scan_plan;
1383         params.n_scan_plans = 1;
1384
1385         params.type =
1386                 iwl_mvm_get_scan_type(mvm,
1387                                       vif->type == NL80211_IFTYPE_P2P_DEVICE);
1388
1389         ret = iwl_mvm_get_measurement_dwell(mvm, req, &params);
1390         if (ret < 0)
1391                 return ret;
1392
1393         params.measurement_dwell = ret;
1394
1395         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1396
1397         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1398                 hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1399                 ret = iwl_mvm_scan_umac(mvm, vif, &params,
1400                                         IWL_MVM_SCAN_REGULAR);
1401         } else {
1402                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1403                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1404         }
1405
1406         if (ret)
1407                 return ret;
1408
1409         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1410         if (ret) {
1411                 /* If the scan failed, it usually means that the FW was unable
1412                  * to allocate the time events. Warn on it, but maybe we
1413                  * should try to send the command again with different params.
1414                  */
1415                 IWL_ERR(mvm, "Scan failed! ret %d\n", ret);
1416                 return ret;
1417         }
1418
1419         IWL_DEBUG_SCAN(mvm, "Scan request was sent successfully\n");
1420         mvm->scan_status |= IWL_MVM_SCAN_REGULAR;
1421         mvm->scan_vif = iwl_mvm_vif_from_mac80211(vif);
1422         iwl_mvm_ref(mvm, IWL_MVM_REF_SCAN);
1423
1424         schedule_delayed_work(&mvm->scan_timeout_dwork,
1425                               msecs_to_jiffies(SCAN_TIMEOUT));
1426
1427         return 0;
1428 }
1429
1430 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
1431                              struct ieee80211_vif *vif,
1432                              struct cfg80211_sched_scan_request *req,
1433                              struct ieee80211_scan_ies *ies,
1434                              int type)
1435 {
1436         struct iwl_host_cmd hcmd = {
1437                 .len = { iwl_mvm_scan_size(mvm), },
1438                 .data = { mvm->scan_cmd, },
1439                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1440         };
1441         struct iwl_mvm_scan_params params = {};
1442         int ret;
1443
1444         lockdep_assert_held(&mvm->mutex);
1445
1446         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1447                 IWL_ERR(mvm, "sched-scan while LAR regdomain is not set\n");
1448                 return -EBUSY;
1449         }
1450
1451         ret = iwl_mvm_check_running_scans(mvm, type);
1452         if (ret)
1453                 return ret;
1454
1455         /* we should have failed registration if scan_cmd was NULL */
1456         if (WARN_ON(!mvm->scan_cmd))
1457                 return -ENOMEM;
1458
1459         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1460                 return -ENOBUFS;
1461
1462         params.n_ssids = req->n_ssids;
1463         params.flags = req->flags;
1464         params.n_channels = req->n_channels;
1465         params.ssids = req->ssids;
1466         params.channels = req->channels;
1467         params.mac_addr = req->mac_addr;
1468         params.mac_addr_mask = req->mac_addr_mask;
1469         params.no_cck = false;
1470         params.pass_all =  iwl_mvm_scan_pass_all(mvm, req);
1471         params.n_match_sets = req->n_match_sets;
1472         params.match_sets = req->match_sets;
1473         if (!req->n_scan_plans)
1474                 return -EINVAL;
1475
1476         params.n_scan_plans = req->n_scan_plans;
1477         params.scan_plans = req->scan_plans;
1478
1479         params.type =
1480                 iwl_mvm_get_scan_type(mvm,
1481                                       vif->type == NL80211_IFTYPE_P2P_DEVICE);
1482
1483         /* In theory, LMAC scans can handle a 32-bit delay, but since
1484          * waiting for over 18 hours to start the scan is a bit silly
1485          * and to keep it aligned with UMAC scans (which only support
1486          * 16-bit delays), trim it down to 16-bits.
1487          */
1488         if (req->delay > U16_MAX) {
1489                 IWL_DEBUG_SCAN(mvm,
1490                                "delay value is > 16-bits, set to max possible\n");
1491                 params.delay = U16_MAX;
1492         } else {
1493                 params.delay = req->delay;
1494         }
1495
1496         ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
1497         if (ret)
1498                 return ret;
1499
1500         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1501
1502         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1503                 hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1504                 ret = iwl_mvm_scan_umac(mvm, vif, &params, type);
1505         } else {
1506                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1507                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1508         }
1509
1510         if (ret)
1511                 return ret;
1512
1513         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1514         if (!ret) {
1515                 IWL_DEBUG_SCAN(mvm,
1516                                "Sched scan request was sent successfully\n");
1517                 mvm->scan_status |= type;
1518         } else {
1519                 /* If the scan failed, it usually means that the FW was unable
1520                  * to allocate the time events. Warn on it, but maybe we
1521                  * should try to send the command again with different params.
1522                  */
1523                 IWL_ERR(mvm, "Sched scan failed! ret %d\n", ret);
1524         }
1525
1526         return ret;
1527 }
1528
1529 void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
1530                                          struct iwl_rx_cmd_buffer *rxb)
1531 {
1532         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1533         struct iwl_umac_scan_complete *notif = (void *)pkt->data;
1534         u32 uid = __le32_to_cpu(notif->uid);
1535         bool aborted = (notif->status == IWL_SCAN_OFFLOAD_ABORTED);
1536
1537         if (WARN_ON(!(mvm->scan_uid_status[uid] & mvm->scan_status)))
1538                 return;
1539
1540         /* if the scan is already stopping, we don't need to notify mac80211 */
1541         if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_REGULAR) {
1542                 struct cfg80211_scan_info info = {
1543                         .aborted = aborted,
1544                         .scan_start_tsf = mvm->scan_start,
1545                 };
1546
1547                 memcpy(info.tsf_bssid, mvm->scan_vif->bssid, ETH_ALEN);
1548                 ieee80211_scan_completed(mvm->hw, &info);
1549                 mvm->scan_vif = NULL;
1550                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1551                 cancel_delayed_work(&mvm->scan_timeout_dwork);
1552         } else if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_SCHED) {
1553                 ieee80211_sched_scan_stopped(mvm->hw);
1554                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1555         }
1556
1557         mvm->scan_status &= ~mvm->scan_uid_status[uid];
1558         IWL_DEBUG_SCAN(mvm,
1559                        "Scan completed, uid %u type %u, status %s, EBS status %s\n",
1560                        uid, mvm->scan_uid_status[uid],
1561                        notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
1562                                 "completed" : "aborted",
1563                        iwl_mvm_ebs_status_str(notif->ebs_status));
1564         IWL_DEBUG_SCAN(mvm,
1565                        "Last line %d, Last iteration %d, Time from last iteration %d\n",
1566                        notif->last_schedule, notif->last_iter,
1567                        __le32_to_cpu(notif->time_from_last_iter));
1568
1569         if (notif->ebs_status != IWL_SCAN_EBS_SUCCESS &&
1570             notif->ebs_status != IWL_SCAN_EBS_INACTIVE)
1571                 mvm->last_ebs_successful = false;
1572
1573         mvm->scan_uid_status[uid] = 0;
1574 }
1575
1576 void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
1577                                               struct iwl_rx_cmd_buffer *rxb)
1578 {
1579         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1580         struct iwl_umac_scan_iter_complete_notif *notif = (void *)pkt->data;
1581
1582         mvm->scan_start = le64_to_cpu(notif->start_tsf);
1583
1584         IWL_DEBUG_SCAN(mvm,
1585                        "UMAC Scan iteration complete: status=0x%x scanned_channels=%d\n",
1586                        notif->status, notif->scanned_channels);
1587
1588         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
1589                 IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
1590                 ieee80211_sched_scan_results(mvm->hw);
1591                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
1592         }
1593
1594         IWL_DEBUG_SCAN(mvm,
1595                        "UMAC Scan iteration complete: scan started at %llu (TSF)\n",
1596                        mvm->scan_start);
1597 }
1598
1599 static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type)
1600 {
1601         struct iwl_umac_scan_abort cmd = {};
1602         int uid, ret;
1603
1604         lockdep_assert_held(&mvm->mutex);
1605
1606         /* We should always get a valid index here, because we already
1607          * checked that this type of scan was running in the generic
1608          * code.
1609          */
1610         uid = iwl_mvm_scan_uid_by_status(mvm, type);
1611         if (WARN_ON_ONCE(uid < 0))
1612                 return uid;
1613
1614         cmd.uid = cpu_to_le32(uid);
1615
1616         IWL_DEBUG_SCAN(mvm, "Sending scan abort, uid %u\n", uid);
1617
1618         ret = iwl_mvm_send_cmd_pdu(mvm,
1619                                    iwl_cmd_id(SCAN_ABORT_UMAC,
1620                                               IWL_ALWAYS_LONG_GROUP, 0),
1621                                    0, sizeof(cmd), &cmd);
1622         if (!ret)
1623                 mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT;
1624
1625         return ret;
1626 }
1627
1628 static int iwl_mvm_scan_stop_wait(struct iwl_mvm *mvm, int type)
1629 {
1630         struct iwl_notification_wait wait_scan_done;
1631         static const u16 scan_done_notif[] = { SCAN_COMPLETE_UMAC,
1632                                               SCAN_OFFLOAD_COMPLETE, };
1633         int ret;
1634
1635         lockdep_assert_held(&mvm->mutex);
1636
1637         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
1638                                    scan_done_notif,
1639                                    ARRAY_SIZE(scan_done_notif),
1640                                    NULL, NULL);
1641
1642         IWL_DEBUG_SCAN(mvm, "Preparing to stop scan, type %x\n", type);
1643
1644         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1645                 ret = iwl_mvm_umac_scan_abort(mvm, type);
1646         else
1647                 ret = iwl_mvm_lmac_scan_abort(mvm);
1648
1649         if (ret) {
1650                 IWL_DEBUG_SCAN(mvm, "couldn't stop scan type %d\n", type);
1651                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
1652                 return ret;
1653         }
1654
1655         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
1656
1657         return ret;
1658 }
1659
1660 int iwl_mvm_scan_size(struct iwl_mvm *mvm)
1661 {
1662         int base_size = IWL_SCAN_REQ_UMAC_SIZE_V1;
1663
1664         if (iwl_mvm_has_new_tx_api(mvm))
1665                 base_size = IWL_SCAN_REQ_UMAC_SIZE;
1666
1667         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1668                 return base_size +
1669                         sizeof(struct iwl_scan_channel_cfg_umac) *
1670                                 mvm->fw->ucode_capa.n_scan_channels +
1671                         sizeof(struct iwl_scan_req_umac_tail);
1672
1673         return sizeof(struct iwl_scan_req_lmac) +
1674                 sizeof(struct iwl_scan_channel_cfg_lmac) *
1675                 mvm->fw->ucode_capa.n_scan_channels +
1676                 sizeof(struct iwl_scan_probe_req);
1677 }
1678
1679 /*
1680  * This function is used in nic restart flow, to inform mac80211 about scans
1681  * that was aborted by restart flow or by an assert.
1682  */
1683 void iwl_mvm_report_scan_aborted(struct iwl_mvm *mvm)
1684 {
1685         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1686                 int uid, i;
1687
1688                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_REGULAR);
1689                 if (uid >= 0) {
1690                         struct cfg80211_scan_info info = {
1691                                 .aborted = true,
1692                         };
1693
1694                         ieee80211_scan_completed(mvm->hw, &info);
1695                         mvm->scan_uid_status[uid] = 0;
1696                 }
1697                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_SCHED);
1698                 if (uid >= 0 && !mvm->fw_restart) {
1699                         ieee80211_sched_scan_stopped(mvm->hw);
1700                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1701                         mvm->scan_uid_status[uid] = 0;
1702                 }
1703
1704                 /* We shouldn't have any UIDs still set.  Loop over all the
1705                  * UIDs to make sure there's nothing left there and warn if
1706                  * any is found.
1707                  */
1708                 for (i = 0; i < mvm->max_scans; i++) {
1709                         if (WARN_ONCE(mvm->scan_uid_status[i],
1710                                       "UMAC scan UID %d status was not cleaned\n",
1711                                       i))
1712                                 mvm->scan_uid_status[i] = 0;
1713                 }
1714         } else {
1715                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
1716                         struct cfg80211_scan_info info = {
1717                                 .aborted = true,
1718                         };
1719
1720                         ieee80211_scan_completed(mvm->hw, &info);
1721                 }
1722
1723                 /* Sched scan will be restarted by mac80211 in
1724                  * restart_hw, so do not report if FW is about to be
1725                  * restarted.
1726                  */
1727                 if ((mvm->scan_status & IWL_MVM_SCAN_SCHED) &&
1728                     !mvm->fw_restart) {
1729                         ieee80211_sched_scan_stopped(mvm->hw);
1730                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1731                 }
1732         }
1733 }
1734
1735 int iwl_mvm_scan_stop(struct iwl_mvm *mvm, int type, bool notify)
1736 {
1737         int ret;
1738
1739         if (!(mvm->scan_status & type))
1740                 return 0;
1741
1742         if (iwl_mvm_is_radio_killed(mvm)) {
1743                 ret = 0;
1744                 goto out;
1745         }
1746
1747         ret = iwl_mvm_scan_stop_wait(mvm, type);
1748         if (!ret)
1749                 mvm->scan_status |= type << IWL_MVM_SCAN_STOPPING_SHIFT;
1750 out:
1751         /* Clear the scan status so the next scan requests will
1752          * succeed and mark the scan as stopping, so that the Rx
1753          * handler doesn't do anything, as the scan was stopped from
1754          * above.
1755          */
1756         mvm->scan_status &= ~type;
1757
1758         if (type == IWL_MVM_SCAN_REGULAR) {
1759                 /* Since the rx handler won't do anything now, we have
1760                  * to release the scan reference here.
1761                  */
1762                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1763                 cancel_delayed_work(&mvm->scan_timeout_dwork);
1764                 if (notify) {
1765                         struct cfg80211_scan_info info = {
1766                                 .aborted = true,
1767                         };
1768
1769                         ieee80211_scan_completed(mvm->hw, &info);
1770                 }
1771         } else if (notify) {
1772                 ieee80211_sched_scan_stopped(mvm->hw);
1773                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1774         }
1775
1776         return ret;
1777 }