drivers/net/wireless/intel/iwlwifi/mvm/scan.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2016 Intel Deutschland GmbH
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of version 2 of the GNU General Public License as
  14  * published by the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but
  17  * WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  24  * USA
  25  *
  26  * The full GNU General Public License is included in this distribution
  27  * in the file called COPYING.
  28  *
  29  * Contact Information:
  30  *  Intel Linux Wireless <linuxwifi@intel.com>
  31  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  32  *
  33  * BSD LICENSE
  34  *
  35  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  36  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  37  * Copyright(c) 2016 Intel Deutschland GmbH
  38  * All rights reserved.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  *
  44  *  * Redistributions of source code must retain the above copyright
  45  *    notice, this list of conditions and the following disclaimer.
  46  *  * Redistributions in binary form must reproduce the above copyright
  47  *    notice, this list of conditions and the following disclaimer in
  48  *    the documentation and/or other materials provided with the
  49  *    distribution.
  50  *  * Neither the name Intel Corporation nor the names of its
  51  *    contributors may be used to endorse or promote products derived
  52  *    from this software without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  55  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  56  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  57  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  58  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  59  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  60  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  61  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  62  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  63  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  64  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  65  *
  66  *****************************************************************************/
  67
  68 #include <linux/etherdevice.h>
  69 #include <net/mac80211.h>
  70
  71 #include "mvm.h"
  72 #include "fw-api-scan.h"
  73 #include "iwl-io.h"
  74
  75 #define IWL_DENSE_EBS_SCAN_RATIO 5
  76 #define IWL_SPARSE_EBS_SCAN_RATIO 1
  77
  78 enum iwl_mvm_traffic_load {
  79         IWL_MVM_TRAFFIC_LOW,
  80         IWL_MVM_TRAFFIC_MEDIUM,
  81         IWL_MVM_TRAFFIC_HIGH,
  82 };
  83
  84 struct iwl_mvm_scan_timing_params {
  85         u32 dwell_active;
  86         u32 dwell_passive;
  87         u32 dwell_fragmented;
  88         u32 dwell_extended;
  89         u32 suspend_time;
  90         u32 max_out_time;
  91 };
  92
  93 static struct iwl_mvm_scan_timing_params scan_timing[] = {
  94         [IWL_SCAN_TYPE_UNASSOC] = {
  95                 .dwell_active = 10,
  96                 .dwell_passive = 110,
  97                 .dwell_fragmented = 44,
  98                 .dwell_extended = 90,
  99                 .suspend_time = 0,
 100                 .max_out_time = 0,
 101         },
 102         [IWL_SCAN_TYPE_WILD] = {
 103                 .dwell_active = 10,
 104                 .dwell_passive = 110,
 105                 .dwell_fragmented = 44,
 106                 .dwell_extended = 90,
 107                 .suspend_time = 30,
 108                 .max_out_time = 120,
 109         },
 110         [IWL_SCAN_TYPE_MILD] = {
 111                 .dwell_active = 10,
 112                 .dwell_passive = 110,
 113                 .dwell_fragmented = 44,
 114                 .dwell_extended = 90,
 115                 .suspend_time = 120,
 116                 .max_out_time = 120,
 117         },
 118         [IWL_SCAN_TYPE_FRAGMENTED] = {
 119                 .dwell_active = 10,
 120                 .dwell_passive = 110,
 121                 .dwell_fragmented = 44,
 122                 .suspend_time = 95,
 123                 .max_out_time = 44,
 124         },
 125 };
 126
 127 struct iwl_mvm_scan_params {
 128         enum iwl_mvm_scan_type type;
 129         u32 n_channels;
 130         u16 delay;
 131         int n_ssids;
 132         struct cfg80211_ssid *ssids;
 133         struct ieee80211_channel **channels;
 134         u32 flags;
 135         u8 *mac_addr;
 136         u8 *mac_addr_mask;
 137         bool no_cck;
 138         bool pass_all;
 139         int n_match_sets;
 140         struct iwl_scan_probe_req preq;
 141         struct cfg80211_match_set *match_sets;
 142         int n_scan_plans;
 143         struct cfg80211_sched_scan_plan *scan_plans;
 144         u32 measurement_dwell;
 145 };
 146
 147 static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 148 {
 149         if (mvm->scan_rx_ant != ANT_NONE)
 150                 return mvm->scan_rx_ant;
 151         return iwl_mvm_get_valid_rx_ant(mvm);
 152 }
 153
 154 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 155 {
 156         u16 rx_chain;
 157         u8 rx_ant;
 158
 159         rx_ant = iwl_mvm_scan_rx_ant(mvm);
 160         rx_chain = rx_ant << PHY_RX_CHAIN_VALID_POS;
 161         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
 162         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_SEL_POS;
 163         rx_chain |= 0x1 << PHY_RX_CHAIN_DRIVER_FORCE_POS;
 164         return cpu_to_le16(rx_chain);
 165 }
 166
 167 static __le32 iwl_mvm_scan_rxon_flags(enum nl80211_band band)
 168 {
 169         if (band == NL80211_BAND_2GHZ)
 170                 return cpu_to_le32(PHY_BAND_24);
 171         else
 172                 return cpu_to_le32(PHY_BAND_5);
 173 }
 174
 175 static inline __le32
 176 iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum nl80211_band band,
 177                           bool no_cck)
 178 {
 179         u32 tx_ant;
 180
 181         mvm->scan_last_antenna_idx =
 182                 iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
 183                                      mvm->scan_last_antenna_idx);
 184         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 185
 186         if (band == NL80211_BAND_2GHZ && !no_cck)
 187                 return cpu_to_le32(IWL_RATE_1M_PLCP | RATE_MCS_CCK_MSK |
 188                                    tx_ant);
 189         else
 190                 return cpu_to_le32(IWL_RATE_6M_PLCP | tx_ant);
 191 }
 192
 193 static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
 194                                             struct ieee80211_vif *vif)
 195 {
 196         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 197         int *global_cnt = data;
 198
 199         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
 200             mvmvif->phy_ctxt->id < MAX_PHYS)
 201                 *global_cnt += 1;
 202 }
 203
 204 static enum iwl_mvm_traffic_load iwl_mvm_get_traffic_load(struct iwl_mvm *mvm)
 205 {
 206         return IWL_MVM_TRAFFIC_LOW;
 207 }
 208
 209 static enum
 210 iwl_mvm_scan_type iwl_mvm_get_scan_type(struct iwl_mvm *mvm, bool p2p_device)
 211 {
 212         int global_cnt = 0;
 213         enum iwl_mvm_traffic_load load;
 214         bool low_latency;
 215
 216         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
 217                                             IEEE80211_IFACE_ITER_NORMAL,
 218                                             iwl_mvm_scan_condition_iterator,
 219                                             &global_cnt);
 220         if (!global_cnt)
 221                 return IWL_SCAN_TYPE_UNASSOC;
 222
 223         load = iwl_mvm_get_traffic_load(mvm);
 224         low_latency = iwl_mvm_low_latency(mvm);
 225
 226         if ((load == IWL_MVM_TRAFFIC_HIGH || low_latency) && !p2p_device &&
 227             fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_FRAGMENTED_SCAN))
 228                 return IWL_SCAN_TYPE_FRAGMENTED;
 229
 230         if (load >= IWL_MVM_TRAFFIC_MEDIUM || low_latency)
 231                 return IWL_SCAN_TYPE_MILD;
 232
 233         return IWL_SCAN_TYPE_WILD;
 234 }
 235
 236 static int
 237 iwl_mvm_get_measurement_dwell(struct iwl_mvm *mvm,
 238                               struct cfg80211_scan_request *req,
 239                               struct iwl_mvm_scan_params *params)
 240 {
 241         if (!req->duration)
 242                 return 0;
 243
 244         if (req->duration_mandatory &&
 245             req->duration > scan_timing[params->type].max_out_time) {
 246                 IWL_DEBUG_SCAN(mvm,
 247                                "Measurement scan - too long dwell %hu (max out time %u)\n",
 248                                req->duration,
 249                                scan_timing[params->type].max_out_time);
 250                 return -EOPNOTSUPP;
 251         }
 252
 253         return min_t(u32, (u32)req->duration,
 254                      scan_timing[params->type].max_out_time);
 255 }
 256
 257 static inline bool iwl_mvm_rrm_scan_needed(struct iwl_mvm *mvm)
 258 {
 259         /* require rrm scan whenever the fw supports it */
 260         return fw_has_capa(&mvm->fw->ucode_capa,
 261                            IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT);
 262 }
 263
 264 static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm)
 265 {
 266         int max_probe_len;
 267
 268         max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
 269
 270         /* we create the 802.11 header and SSID element */
 271         max_probe_len -= 24 + 2;
 272
 273         /* DS parameter set element is added on 2.4GHZ band if required */
 274         if (iwl_mvm_rrm_scan_needed(mvm))
 275                 max_probe_len -= 3;
 276
 277         return max_probe_len;
 278 }
 279
 280 int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm)
 281 {
 282         int max_ie_len = iwl_mvm_max_scan_ie_fw_cmd_room(mvm);
 283
 284         /* TODO: [BUG] This function should return the maximum allowed size of
 285          * scan IEs, however the LMAC scan api contains both 2GHZ and 5GHZ IEs
 286          * in the same command. So the correct implementation of this function
 287          * is just iwl_mvm_max_scan_ie_fw_cmd_room() / 2. Currently the scan
 288          * command has only 512 bytes and it would leave us with about 240
 289          * bytes for scan IEs, which is clearly not enough. So meanwhile
 290          * we will report an incorrect value. This may result in a failure to
 291          * issue a scan in unified_scan_lmac and unified_sched_scan_lmac
 292          * functions with -ENOBUFS, if a large enough probe will be provided.
 293          */
 294         return max_ie_len;
 295 }
 296
 297 static u8 *iwl_mvm_dump_channel_list(struct iwl_scan_results_notif *res,
 298                                      int num_res, u8 *buf, size_t buf_size)
 299 {
 300         int i;
 301         u8 *pos = buf, *end = buf + buf_size;
 302
 303         for (i = 0; pos < end && i < num_res; i++)
 304                 pos += snprintf(pos, end - pos, " %u", res[i].channel);
 305
 306         /* terminate the string in case the buffer was too short */
 307         *(buf + buf_size - 1) = '\0';
 308
 309         return buf;
 310 }
 311
 312 void iwl_mvm_rx_lmac_scan_iter_complete_notif(struct iwl_mvm *mvm,
 313                                               struct iwl_rx_cmd_buffer *rxb)
 314 {
 315         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 316         struct iwl_lmac_scan_complete_notif *notif = (void *)pkt->data;
 317         u8 buf[256];
 318
 319         IWL_DEBUG_SCAN(mvm,
 320                        "Scan offload iteration complete: status=0x%x scanned channels=%d channels list: %s\n",
 321                        notif->status, notif->scanned_channels,
 322                        iwl_mvm_dump_channel_list(notif->results,
 323                                                  notif->scanned_channels, buf,
 324                                                  sizeof(buf)));
 325
 326         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
 327                 IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
 328                 ieee80211_sched_scan_results(mvm->hw);
 329                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 330         }
 331 }
 332
 333 void iwl_mvm_rx_scan_match_found(struct iwl_mvm *mvm,
 334                                  struct iwl_rx_cmd_buffer *rxb)
 335 {
 336         IWL_DEBUG_SCAN(mvm, "Scheduled scan results\n");
 337         ieee80211_sched_scan_results(mvm->hw);
 338 }
 339
 340 static const char *iwl_mvm_ebs_status_str(enum iwl_scan_ebs_status status)
 341 {
 342         switch (status) {
 343         case IWL_SCAN_EBS_SUCCESS:
 344                 return "successful";
 345         case IWL_SCAN_EBS_INACTIVE:
 346                 return "inactive";
 347         case IWL_SCAN_EBS_FAILED:
 348         case IWL_SCAN_EBS_CHAN_NOT_FOUND:
 349         default:
 350                 return "failed";
 351         }
 352 }
 353
 354 void iwl_mvm_rx_lmac_scan_complete_notif(struct iwl_mvm *mvm,
 355                                          struct iwl_rx_cmd_buffer *rxb)
 356 {
 357         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 358         struct iwl_periodic_scan_complete *scan_notif = (void *)pkt->data;
 359         bool aborted = (scan_notif->status == IWL_SCAN_OFFLOAD_ABORTED);
 360
 361         /* If this happens, the firmware has mistakenly sent an LMAC
 362          * notification during UMAC scans -- warn and ignore it.
 363          */
 364         if (WARN_ON_ONCE(fw_has_capa(&mvm->fw->ucode_capa,
 365                                      IWL_UCODE_TLV_CAPA_UMAC_SCAN)))
 366                 return;
 367
 368         /* scan status must be locked for proper checking */
 369         lockdep_assert_held(&mvm->mutex);
 370
 371         /* We first check if we were stopping a scan, in which case we
 372          * just clear the stopping flag.  Then we check if it was a
 373          * firmware initiated stop, in which case we need to inform
 374          * mac80211.
 375          * Note that we can have a stopping and a running scan
 376          * simultaneously, but we can't have two different types of
 377          * scans stopping or running at the same time (since LMAC
 378          * doesn't support it).
 379          */
 380
 381         if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_SCHED) {
 382                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR);
 383
 384                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 385                                aborted ? "aborted" : "completed",
 386                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 387                 IWL_DEBUG_SCAN(mvm,
 388                                "Last line %d, Last iteration %d, Time after last iteration %d\n",
 389                                scan_notif->last_schedule_line,
 390                                scan_notif->last_schedule_iteration,
 391                                __le32_to_cpu(scan_notif->time_after_last_iter));
 392
 393                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_SCHED;
 394         } else if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR) {
 395                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s\n",
 396                                aborted ? "aborted" : "completed",
 397                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 398
 399                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_REGULAR;
 400         } else if (mvm->scan_status & IWL_MVM_SCAN_SCHED) {
 401                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_REGULAR);
 402
 403                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 404                                aborted ? "aborted" : "completed",
 405                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 406                 IWL_DEBUG_SCAN(mvm,
 407                                "Last line %d, Last iteration %d, Time after last iteration %d (FW)\n",
 408                                scan_notif->last_schedule_line,
 409                                scan_notif->last_schedule_iteration,
 410                                __le32_to_cpu(scan_notif->time_after_last_iter));
 411
 412                 mvm->scan_status &= ~IWL_MVM_SCAN_SCHED;
 413                 ieee80211_sched_scan_stopped(mvm->hw);
 414                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 415         } else if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
 416                 struct cfg80211_scan_info info = {
 417                         .aborted = aborted,
 418                 };
 419
 420                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s (FW)\n",
 421                                aborted ? "aborted" : "completed",
 422                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 423
 424                 mvm->scan_status &= ~IWL_MVM_SCAN_REGULAR;
 425                 ieee80211_scan_completed(mvm->hw, &info);
 426                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 427                 cancel_delayed_work(&mvm->scan_timeout_dwork);
 428         } else {
 429                 IWL_ERR(mvm,
 430                         "got scan complete notification but no scan is running\n");
 431         }
 432
 433         mvm->last_ebs_successful =
 434                         scan_notif->ebs_status == IWL_SCAN_EBS_SUCCESS ||
 435                         scan_notif->ebs_status == IWL_SCAN_EBS_INACTIVE;
 436 }
 437
 438 static int iwl_ssid_exist(u8 *ssid, u8 ssid_len, struct iwl_ssid_ie *ssid_list)
 439 {
 440         int i;
 441
 442         for (i = 0; i < PROBE_OPTION_MAX; i++) {
 443                 if (!ssid_list[i].len)
 444                         break;
 445                 if (ssid_list[i].len == ssid_len &&
 446                     !memcmp(ssid_list->ssid, ssid, ssid_len))
 447                         return i;
 448         }
 449         return -1;
 450 }
 451
 452 /* We insert the SSIDs in an inverted order, because the FW will
 453  * invert it back.
 454  */
 455 static void iwl_scan_build_ssids(struct iwl_mvm_scan_params *params,
 456                                  struct iwl_ssid_ie *ssids,
 457                                  u32 *ssid_bitmap)
 458 {
 459         int i, j;
 460         int index;
 461
 462         /*
 463          * copy SSIDs from match list.
 464          * iwl_config_sched_scan_profiles() uses the order of these ssids to
 465          * config match list.
 466          */
 467         for (i = 0, j = params->n_match_sets - 1;
 468              j >= 0 && i < PROBE_OPTION_MAX;
 469              i++, j--) {
 470                 /* skip empty SSID matchsets */
 471                 if (!params->match_sets[j].ssid.ssid_len)
 472                         continue;
 473                 ssids[i].id = WLAN_EID_SSID;
 474                 ssids[i].len = params->match_sets[j].ssid.ssid_len;
 475                 memcpy(ssids[i].ssid, params->match_sets[j].ssid.ssid,
 476                        ssids[i].len);
 477         }
 478
 479         /* add SSIDs from scan SSID list */
 480         *ssid_bitmap = 0;
 481         for (j = params->n_ssids - 1;
 482              j >= 0 && i < PROBE_OPTION_MAX;
 483              i++, j--) {
 484                 index = iwl_ssid_exist(params->ssids[j].ssid,
 485                                        params->ssids[j].ssid_len,
 486                                        ssids);
 487                 if (index < 0) {
 488                         ssids[i].id = WLAN_EID_SSID;
 489                         ssids[i].len = params->ssids[j].ssid_len;
 490                         memcpy(ssids[i].ssid, params->ssids[j].ssid,
 491                                ssids[i].len);
 492                         *ssid_bitmap |= BIT(i);
 493                 } else {
 494                         *ssid_bitmap |= BIT(index);
 495                 }
 496         }
 497 }
 498
 499 static int
 500 iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
 501                                    struct cfg80211_sched_scan_request *req)
 502 {
 503         struct iwl_scan_offload_profile *profile;
 504         struct iwl_scan_offload_profile_cfg *profile_cfg;
 505         struct iwl_scan_offload_blacklist *blacklist;
 506         struct iwl_host_cmd cmd = {
 507                 .id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
 508                 .len[1] = sizeof(*profile_cfg),
 509                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
 510                 .dataflags[1] = IWL_HCMD_DFL_NOCOPY,
 511         };
 512         int blacklist_len;
 513         int i;
 514         int ret;
 515
 516         if (WARN_ON(req->n_match_sets > IWL_SCAN_MAX_PROFILES))
 517                 return -EIO;
 518
 519         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SHORT_BL)
 520                 blacklist_len = IWL_SCAN_SHORT_BLACKLIST_LEN;
 521         else
 522                 blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 523
 524         blacklist = kzalloc(sizeof(*blacklist) * blacklist_len, GFP_KERNEL);
 525         if (!blacklist)
 526                 return -ENOMEM;
 527
 528         profile_cfg = kzalloc(sizeof(*profile_cfg), GFP_KERNEL);
 529         if (!profile_cfg) {
 530                 ret = -ENOMEM;
 531                 goto free_blacklist;
 532         }
 533
 534         cmd.data[0] = blacklist;
 535         cmd.len[0] = sizeof(*blacklist) * blacklist_len;
 536         cmd.data[1] = profile_cfg;
 537
 538         /* No blacklist configuration */
 539
 540         profile_cfg->num_profiles = req->n_match_sets;
 541         profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
 542         profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
 543         profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
 544         if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
 545                 profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 546
 547         for (i = 0; i < req->n_match_sets; i++) {
 548                 profile = &profile_cfg->profiles[i];
 549                 profile->ssid_index = i;
 550                 /* Support any cipher and auth algorithm */
 551                 profile->unicast_cipher = 0xff;
 552                 profile->auth_alg = 0xff;
 553                 profile->network_type = IWL_NETWORK_TYPE_ANY;
 554                 profile->band_selection = IWL_SCAN_OFFLOAD_SELECT_ANY;
 555                 profile->client_bitmap = SCAN_CLIENT_SCHED_SCAN;
 556         }
 557
 558         IWL_DEBUG_SCAN(mvm, "Sending scheduled scan profile config\n");
 559
 560         ret = iwl_mvm_send_cmd(mvm, &cmd);
 561         kfree(profile_cfg);
 562 free_blacklist:
 563         kfree(blacklist);
 564
 565         return ret;
 566 }
 567
 568 static bool iwl_mvm_scan_pass_all(struct iwl_mvm *mvm,
 569                                   struct cfg80211_sched_scan_request *req)
 570 {
 571         if (req->n_match_sets && req->match_sets[0].ssid.ssid_len) {
 572                 IWL_DEBUG_SCAN(mvm,
 573                                "Sending scheduled scan with filtering, n_match_sets %d\n",
 574                                req->n_match_sets);
 575                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 576                 return false;
 577         }
 578
 579         IWL_DEBUG_SCAN(mvm, "Sending Scheduled scan without filtering\n");
 580
 581         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 582         return true;
 583 }
 584
 585 static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
 586 {
 587         int ret;
 588         struct iwl_host_cmd cmd = {
 589                 .id = SCAN_OFFLOAD_ABORT_CMD,
 590         };
 591         u32 status;
 592
 593         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
 594         if (ret)
 595                 return ret;
 596
 597         if (status != CAN_ABORT_STATUS) {
 598                 /*
 599                  * The scan abort will return 1 for success or
 600                  * 2 for "failure".  A failure condition can be
 601                  * due to simply not being in an active scan which
 602                  * can occur if we send the scan abort before the
 603                  * microcode has notified us that a scan is completed.
 604                  */
 605                 IWL_DEBUG_SCAN(mvm, "SCAN OFFLOAD ABORT ret %d.\n", status);
 606                 ret = -ENOENT;
 607         }
 608
 609         return ret;
 610 }
 611
 612 static void iwl_mvm_scan_fill_tx_cmd(struct iwl_mvm *mvm,
 613                                      struct iwl_scan_req_tx_cmd *tx_cmd,
 614                                      bool no_cck)
 615 {
 616         tx_cmd[0].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 617                                          TX_CMD_FLG_BT_DIS);
 618         tx_cmd[0].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 619                                                            NL80211_BAND_2GHZ,
 620                                                            no_cck);
 621         tx_cmd[0].sta_id = mvm->aux_sta.sta_id;
 622
 623         tx_cmd[1].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 624                                          TX_CMD_FLG_BT_DIS);
 625         tx_cmd[1].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 626                                                            NL80211_BAND_5GHZ,
 627                                                            no_cck);
 628         tx_cmd[1].sta_id = mvm->aux_sta.sta_id;
 629 }
 630
 631 static void
 632 iwl_mvm_lmac_scan_cfg_channels(struct iwl_mvm *mvm,
 633                                struct ieee80211_channel **channels,
 634                                int n_channels, u32 ssid_bitmap,
 635                                struct iwl_scan_req_lmac *cmd)
 636 {
 637         struct iwl_scan_channel_cfg_lmac *channel_cfg = (void *)&cmd->data;
 638         int i;
 639
 640         for (i = 0; i < n_channels; i++) {
 641                 channel_cfg[i].channel_num =
 642                         cpu_to_le16(channels[i]->hw_value);
 643                 channel_cfg[i].iter_count = cpu_to_le16(1);
 644                 channel_cfg[i].iter_interval = 0;
 645                 channel_cfg[i].flags =
 646                         cpu_to_le32(IWL_UNIFIED_SCAN_CHANNEL_PARTIAL |
 647                                     ssid_bitmap);
 648         }
 649 }
 650
 651 static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,
 652                                            size_t len, u8 *const pos)
 653 {
 654         static const u8 before_ds_params[] = {
 655                         WLAN_EID_SSID,
 656                         WLAN_EID_SUPP_RATES,
 657                         WLAN_EID_REQUEST,
 658                         WLAN_EID_EXT_SUPP_RATES,
 659         };
 660         size_t offs;
 661         u8 *newpos = pos;
 662
 663         if (!iwl_mvm_rrm_scan_needed(mvm)) {
 664                 memcpy(newpos, ies, len);
 665                 return newpos + len;
 666         }
 667
 668         offs = ieee80211_ie_split(ies, len,
 669                                   before_ds_params,
 670                                   ARRAY_SIZE(before_ds_params),
 671                                   0);
 672
 673         memcpy(newpos, ies, offs);
 674         newpos += offs;
 675
 676         /* Add a placeholder for DS Parameter Set element */
 677         *newpos++ = WLAN_EID_DS_PARAMS;
 678         *newpos++ = 1;
 679         *newpos++ = 0;
 680
 681         memcpy(newpos, ies + offs, len - offs);
 682         newpos += len - offs;
 683
 684         return newpos;
 685 }
 686
 687 static void
 688 iwl_mvm_build_scan_probe(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 689                          struct ieee80211_scan_ies *ies,
 690                          struct iwl_mvm_scan_params *params)
 691 {
 692         struct ieee80211_mgmt *frame = (void *)params->preq.buf;
 693         u8 *pos, *newpos;
 694         const u8 *mac_addr = params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
 695                 params->mac_addr : NULL;
 696
 697         /*
 698          * Unfortunately, right now the offload scan doesn't support randomising
 699          * within the firmware, so until the firmware API is ready we implement
 700          * it in the driver. This means that the scan iterations won't really be
 701          * random, only when it's restarted, but at least that helps a bit.
 702          */
 703         if (mac_addr)
 704                 get_random_mask_addr(frame->sa, mac_addr,
 705                                      params->mac_addr_mask);
 706         else
 707                 memcpy(frame->sa, vif->addr, ETH_ALEN);
 708
 709         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 710         eth_broadcast_addr(frame->da);
 711         eth_broadcast_addr(frame->bssid);
 712         frame->seq_ctrl = 0;
 713
 714         pos = frame->u.probe_req.variable;
 715         *pos++ = WLAN_EID_SSID;
 716         *pos++ = 0;
 717
 718         params->preq.mac_header.offset = 0;
 719         params->preq.mac_header.len = cpu_to_le16(24 + 2);
 720
 721         /* Insert ds parameter set element on 2.4 GHz band */
 722         newpos = iwl_mvm_copy_and_insert_ds_elem(mvm,
 723                                                  ies->ies[NL80211_BAND_2GHZ],
 724                                                  ies->len[NL80211_BAND_2GHZ],
 725                                                  pos);
 726         params->preq.band_data[0].offset = cpu_to_le16(pos - params->preq.buf);
 727         params->preq.band_data[0].len = cpu_to_le16(newpos - pos);
 728         pos = newpos;
 729
 730         memcpy(pos, ies->ies[NL80211_BAND_5GHZ],
 731                ies->len[NL80211_BAND_5GHZ]);
 732         params->preq.band_data[1].offset = cpu_to_le16(pos - params->preq.buf);
 733         params->preq.band_data[1].len =
 734                 cpu_to_le16(ies->len[NL80211_BAND_5GHZ]);
 735         pos += ies->len[NL80211_BAND_5GHZ];
 736
 737         memcpy(pos, ies->common_ies, ies->common_ie_len);
 738         params->preq.common_data.offset = cpu_to_le16(pos - params->preq.buf);
 739         params->preq.common_data.len = cpu_to_le16(ies->common_ie_len);
 740 }
 741
 742 static void iwl_mvm_scan_lmac_dwell(struct iwl_mvm *mvm,
 743                                     struct iwl_scan_req_lmac *cmd,
 744                                     struct iwl_mvm_scan_params *params)
 745 {
 746         cmd->active_dwell = scan_timing[params->type].dwell_active;
 747         cmd->passive_dwell = scan_timing[params->type].dwell_passive;
 748         cmd->fragmented_dwell = scan_timing[params->type].dwell_fragmented;
 749         cmd->extended_dwell = scan_timing[params->type].dwell_extended;
 750         cmd->max_out_time = cpu_to_le32(scan_timing[params->type].max_out_time);
 751         cmd->suspend_time = cpu_to_le32(scan_timing[params->type].suspend_time);
 752         cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
 753 }
 754
 755 static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,
 756                                      struct ieee80211_scan_ies *ies,
 757                                      int n_channels)
 758 {
 759         return ((n_ssids <= PROBE_OPTION_MAX) &&
 760                 (n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
 761                 (ies->common_ie_len +
 762                  ies->len[NL80211_BAND_2GHZ] +
 763                  ies->len[NL80211_BAND_5GHZ] <=
 764                  iwl_mvm_max_scan_ie_fw_cmd_room(mvm)));
 765 }
 766
 767 static inline bool iwl_mvm_scan_use_ebs(struct iwl_mvm *mvm,
 768                                         struct ieee80211_vif *vif)
 769 {
 770         const struct iwl_ucode_capabilities *capa = &mvm->fw->ucode_capa;
 771
 772         /* We can only use EBS if:
 773          *      1. the feature is supported;
 774          *      2. the last EBS was successful;
 775          *      3. if only single scan, the single scan EBS API is supported;
 776          *      4. it's not a p2p find operation.
 777          */
 778         return ((capa->flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT) &&
 779                 mvm->last_ebs_successful &&
 780                 vif->type != NL80211_IFTYPE_P2P_DEVICE);
 781 }
 782
 783 static inline bool iwl_mvm_is_regular_scan(struct iwl_mvm_scan_params *params)
 784 {
 785         return params->n_scan_plans == 1 &&
 786                 params->scan_plans[0].iterations == 1;
 787 }
 788
 789 static int iwl_mvm_scan_lmac_flags(struct iwl_mvm *mvm,
 790                                    struct iwl_mvm_scan_params *params,
 791                                    struct ieee80211_vif *vif)
 792 {
 793         int flags = 0;
 794
 795         if (params->n_ssids == 0)
 796                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 797
 798         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
 799                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
 800
 801         if (params->type == IWL_SCAN_TYPE_FRAGMENTED)
 802                 flags |= IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED;
 803
 804         if (iwl_mvm_rrm_scan_needed(mvm))
 805                 flags |= IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED;
 806
 807         if (params->pass_all)
 808                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
 809         else
 810                 flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
 811
 812 #ifdef CONFIG_IWLWIFI_DEBUGFS
 813         if (mvm->scan_iter_notif_enabled)
 814                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 815 #endif
 816
 817         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
 818                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 819
 820         if (iwl_mvm_is_regular_scan(params) &&
 821             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
 822             params->type != IWL_SCAN_TYPE_FRAGMENTED)
 823                 flags |= IWL_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL;
 824
 825         return flags;
 826 }
 827
 828 static int iwl_mvm_scan_lmac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 829                              struct iwl_mvm_scan_params *params)
 830 {
 831         struct iwl_scan_req_lmac *cmd = mvm->scan_cmd;
 832         struct iwl_scan_probe_req *preq =
 833                 (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
 834                          mvm->fw->ucode_capa.n_scan_channels);
 835         u32 ssid_bitmap = 0;
 836         int i;
 837
 838         lockdep_assert_held(&mvm->mutex);
 839
 840         memset(cmd, 0, ksize(cmd));
 841
 842         if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
 843                 return -EINVAL;
 844
 845         iwl_mvm_scan_lmac_dwell(mvm, cmd, params);
 846
 847         cmd->rx_chain_select = iwl_mvm_scan_rx_chain(mvm);
 848         cmd->iter_num = cpu_to_le32(1);
 849         cmd->n_channels = (u8)params->n_channels;
 850
 851         cmd->delay = cpu_to_le32(params->delay);
 852
 853         cmd->scan_flags = cpu_to_le32(iwl_mvm_scan_lmac_flags(mvm, params,
 854                                                               vif));
 855
 856         cmd->flags = iwl_mvm_scan_rxon_flags(params->channels[0]->band);
 857         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
 858                                         MAC_FILTER_IN_BEACON);
 859         iwl_mvm_scan_fill_tx_cmd(mvm, cmd->tx_cmd, params->no_cck);
 860         iwl_scan_build_ssids(params, cmd->direct_scan, &ssid_bitmap);
 861
 862         /* this API uses bits 1-20 instead of 0-19 */
 863         ssid_bitmap <<= 1;
 864
 865         for (i = 0; i < params->n_scan_plans; i++) {
 866                 struct cfg80211_sched_scan_plan *scan_plan =
 867                         &params->scan_plans[i];
 868
 869                 cmd->schedule[i].delay =
 870                         cpu_to_le16(scan_plan->interval);
 871                 cmd->schedule[i].iterations = scan_plan->iterations;
 872                 cmd->schedule[i].full_scan_mul = 1;
 873         }
 874
 875         /*
 876          * If the number of iterations of the last scan plan is set to
 877          * zero, it should run infinitely. However, this is not always the case.
 878          * For example, when regular scan is requested the driver sets one scan
 879          * plan with one iteration.
 880          */
 881         if (!cmd->schedule[i - 1].iterations)
 882                 cmd->schedule[i - 1].iterations = 0xff;
 883
 884         if (iwl_mvm_scan_use_ebs(mvm, vif)) {
 885                 cmd->channel_opt[0].flags =
 886                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 887                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 888                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 889                 cmd->channel_opt[0].non_ebs_ratio =
 890                         cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
 891                 cmd->channel_opt[1].flags =
 892                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 893                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 894                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 895                 cmd->channel_opt[1].non_ebs_ratio =
 896                         cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
 897         }
 898
 899         iwl_mvm_lmac_scan_cfg_channels(mvm, params->channels,
 900                                        params->n_channels, ssid_bitmap, cmd);
 901
 902         *preq = params->preq;
 903
 904         return 0;
 905 }
 906
 907 static int rate_to_scan_rate_flag(unsigned int rate)
 908 {
 909         static const int rate_to_scan_rate[IWL_RATE_COUNT] = {
 910                 [IWL_RATE_1M_INDEX]     = SCAN_CONFIG_RATE_1M,
 911                 [IWL_RATE_2M_INDEX]     = SCAN_CONFIG_RATE_2M,
 912                 [IWL_RATE_5M_INDEX]     = SCAN_CONFIG_RATE_5M,
 913                 [IWL_RATE_11M_INDEX]    = SCAN_CONFIG_RATE_11M,
 914                 [IWL_RATE_6M_INDEX]     = SCAN_CONFIG_RATE_6M,
 915                 [IWL_RATE_9M_INDEX]     = SCAN_CONFIG_RATE_9M,
 916                 [IWL_RATE_12M_INDEX]    = SCAN_CONFIG_RATE_12M,
 917                 [IWL_RATE_18M_INDEX]    = SCAN_CONFIG_RATE_18M,
 918                 [IWL_RATE_24M_INDEX]    = SCAN_CONFIG_RATE_24M,
 919                 [IWL_RATE_36M_INDEX]    = SCAN_CONFIG_RATE_36M,
 920                 [IWL_RATE_48M_INDEX]    = SCAN_CONFIG_RATE_48M,
 921                 [IWL_RATE_54M_INDEX]    = SCAN_CONFIG_RATE_54M,
 922         };
 923
 924         return rate_to_scan_rate[rate];
 925 }
 926
 927 static __le32 iwl_mvm_scan_config_rates(struct iwl_mvm *mvm)
 928 {
 929         struct ieee80211_supported_band *band;
 930         unsigned int rates = 0;
 931         int i;
 932
 933         band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 934         for (i = 0; i < band->n_bitrates; i++)
 935                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 936         band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 937         for (i = 0; i < band->n_bitrates; i++)
 938                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 939
 940         /* Set both basic rates and supported rates */
 941         rates |= SCAN_CONFIG_SUPPORTED_RATE(rates);
 942
 943         return cpu_to_le32(rates);
 944 }
 945
 946 int iwl_mvm_config_scan(struct iwl_mvm *mvm)
 947 {
 948         struct iwl_scan_config *scan_config;
 949         struct ieee80211_supported_band *band;
 950         int num_channels =
 951                 mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels +
 952                 mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels;
 953         int ret, i, j = 0, cmd_size;
 954         struct iwl_host_cmd cmd = {
 955                 .id = iwl_cmd_id(SCAN_CFG_CMD, IWL_ALWAYS_LONG_GROUP, 0),
 956         };
 957         enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, false);
 958
 959         if (WARN_ON(num_channels > mvm->fw->ucode_capa.n_scan_channels))
 960                 return -ENOBUFS;
 961
 962         if (type == mvm->scan_type) {
 963                 IWL_DEBUG_SCAN(mvm,
 964                                "Ignoring UMAC scan config of the same type\n");
 965                 return 0;
 966         }
 967
 968         cmd_size = sizeof(*scan_config) + mvm->fw->ucode_capa.n_scan_channels;
 969
 970         scan_config = kzalloc(cmd_size, GFP_KERNEL);
 971         if (!scan_config)
 972                 return -ENOMEM;
 973
 974         scan_config->flags = cpu_to_le32(SCAN_CONFIG_FLAG_ACTIVATE |
 975                                          SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS |
 976                                          SCAN_CONFIG_FLAG_SET_TX_CHAINS |
 977                                          SCAN_CONFIG_FLAG_SET_RX_CHAINS |
 978                                          SCAN_CONFIG_FLAG_SET_AUX_STA_ID |
 979                                          SCAN_CONFIG_FLAG_SET_ALL_TIMES |
 980                                          SCAN_CONFIG_FLAG_SET_LEGACY_RATES |
 981                                          SCAN_CONFIG_FLAG_SET_MAC_ADDR |
 982                                          SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS|
 983                                          SCAN_CONFIG_N_CHANNELS(num_channels) |
 984                                          (type == IWL_SCAN_TYPE_FRAGMENTED ?
 985                                           SCAN_CONFIG_FLAG_SET_FRAGMENTED :
 986                                           SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED));
 987         scan_config->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
 988         scan_config->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
 989         scan_config->legacy_rates = iwl_mvm_scan_config_rates(mvm);
 990         scan_config->out_of_channel_time =
 991                 cpu_to_le32(scan_timing[type].max_out_time);
 992         scan_config->suspend_time = cpu_to_le32(scan_timing[type].suspend_time);
 993         scan_config->dwell_active = scan_timing[type].dwell_active;
 994         scan_config->dwell_passive = scan_timing[type].dwell_passive;
 995         scan_config->dwell_fragmented = scan_timing[type].dwell_fragmented;
 996         scan_config->dwell_extended = scan_timing[type].dwell_extended;
 997
 998         memcpy(&scan_config->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
 999
1000         scan_config->bcast_sta_id = mvm->aux_sta.sta_id;
1001         scan_config->channel_flags = IWL_CHANNEL_FLAG_EBS |
1002                                      IWL_CHANNEL_FLAG_ACCURATE_EBS |
1003                                      IWL_CHANNEL_FLAG_EBS_ADD |
1004                                      IWL_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE;
1005
1006         band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
1007         for (i = 0; i < band->n_channels; i++, j++)
1008                 scan_config->channel_array[j] = band->channels[i].hw_value;
1009         band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
1010         for (i = 0; i < band->n_channels; i++, j++)
1011                 scan_config->channel_array[j] = band->channels[i].hw_value;
1012
1013         cmd.data[0] = scan_config;
1014         cmd.len[0] = cmd_size;
1015         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
1016
1017         IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
1018
1019         ret = iwl_mvm_send_cmd(mvm, &cmd);
1020         if (!ret)
1021                 mvm->scan_type = type;
1022
1023         kfree(scan_config);
1024         return ret;
1025 }
1026
1027 static int iwl_mvm_scan_uid_by_status(struct iwl_mvm *mvm, int status)
1028 {
1029         int i;
1030
1031         for (i = 0; i < mvm->max_scans; i++)
1032                 if (mvm->scan_uid_status[i] == status)
1033                         return i;
1034
1035         return -ENOENT;
1036 }
1037
1038 static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
1039                                     struct iwl_scan_req_umac *cmd,
1040                                     struct iwl_mvm_scan_params *params)
1041 {
1042         if (params->measurement_dwell) {
1043                 cmd->active_dwell = params->measurement_dwell;
1044                 cmd->passive_dwell = params->measurement_dwell;
1045                 cmd->extended_dwell = params->measurement_dwell;
1046         } else {
1047                 cmd->active_dwell = scan_timing[params->type].dwell_active;
1048                 cmd->passive_dwell = scan_timing[params->type].dwell_passive;
1049                 cmd->extended_dwell = scan_timing[params->type].dwell_extended;
1050         }
1051         cmd->fragmented_dwell = scan_timing[params->type].dwell_fragmented;
1052         cmd->max_out_time = cpu_to_le32(scan_timing[params->type].max_out_time);
1053         cmd->suspend_time = cpu_to_le32(scan_timing[params->type].suspend_time);
1054         cmd->scan_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1055
1056         if (iwl_mvm_is_regular_scan(params))
1057                 cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1058         else
1059                 cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_2);
1060 }
1061
1062 static void
1063 iwl_mvm_umac_scan_cfg_channels(struct iwl_mvm *mvm,
1064                                struct ieee80211_channel **channels,
1065                                int n_channels, u32 ssid_bitmap,
1066                                struct iwl_scan_req_umac *cmd)
1067 {
1068         struct iwl_scan_channel_cfg_umac *channel_cfg = (void *)&cmd->data;
1069         int i;
1070
1071         for (i = 0; i < n_channels; i++) {
1072                 channel_cfg[i].flags = cpu_to_le32(ssid_bitmap);
1073                 channel_cfg[i].channel_num = channels[i]->hw_value;
1074                 channel_cfg[i].iter_count = 1;
1075                 channel_cfg[i].iter_interval = 0;
1076         }
1077 }
1078
1079 static u16 iwl_mvm_scan_umac_flags(struct iwl_mvm *mvm,
1080                                    struct iwl_mvm_scan_params *params,
1081                                    struct ieee80211_vif *vif)
1082 {
1083         u16 flags = 0;
1084
1085         if (params->n_ssids == 0)
1086                 flags = IWL_UMAC_SCAN_GEN_FLAGS_PASSIVE;
1087
1088         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
1089                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT;
1090
1091         if (params->type == IWL_SCAN_TYPE_FRAGMENTED)
1092                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED;
1093
1094         if (iwl_mvm_rrm_scan_needed(mvm))
1095                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED;
1096
1097         if (params->pass_all)
1098                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
1099         else
1100                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_MATCH;
1101
1102         if (!iwl_mvm_is_regular_scan(params))
1103                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PERIODIC;
1104
1105         if (params->measurement_dwell)
1106                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1107
1108 #ifdef CONFIG_IWLWIFI_DEBUGFS
1109         if (mvm->scan_iter_notif_enabled)
1110                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1111 #endif
1112
1113         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
1114                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1115
1116         if (iwl_mvm_is_regular_scan(params) &&
1117             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
1118             params->type != IWL_SCAN_TYPE_FRAGMENTED)
1119                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL;
1120
1121         return flags;
1122 }
1123
1124 static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1125                              struct iwl_mvm_scan_params *params,
1126                              int type)
1127 {
1128         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
1129         struct iwl_scan_req_umac_tail *sec_part = (void *)&cmd->data +
1130                 sizeof(struct iwl_scan_channel_cfg_umac) *
1131                         mvm->fw->ucode_capa.n_scan_channels;
1132         int uid, i;
1133         u32 ssid_bitmap = 0;
1134         struct iwl_mvm_vif *scan_vif = iwl_mvm_vif_from_mac80211(vif);
1135
1136         lockdep_assert_held(&mvm->mutex);
1137
1138         if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
1139                 return -EINVAL;
1140
1141         uid = iwl_mvm_scan_uid_by_status(mvm, 0);
1142         if (uid < 0)
1143                 return uid;
1144
1145         memset(cmd, 0, ksize(cmd));
1146
1147         iwl_mvm_scan_umac_dwell(mvm, cmd, params);
1148
1149         mvm->scan_uid_status[uid] = type;
1150
1151         cmd->uid = cpu_to_le32(uid);
1152         cmd->general_flags = cpu_to_le16(iwl_mvm_scan_umac_flags(mvm, params,
1153                                                                  vif));
1154         cmd->scan_start_mac_id = scan_vif->id;
1155
1156         if (type == IWL_MVM_SCAN_SCHED || type == IWL_MVM_SCAN_NETDETECT)
1157                 cmd->flags = cpu_to_le32(IWL_UMAC_SCAN_FLAG_PREEMPTIVE);
1158
1159         if (iwl_mvm_scan_use_ebs(mvm, vif))
1160                 cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
1161                                      IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1162                                      IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
1163
1164         cmd->n_channels = params->n_channels;
1165
1166         iwl_scan_build_ssids(params, sec_part->direct_scan, &ssid_bitmap);
1167
1168         iwl_mvm_umac_scan_cfg_channels(mvm, params->channels,
1169                                        params->n_channels, ssid_bitmap, cmd);
1170
1171         for (i = 0; i < params->n_scan_plans; i++) {
1172                 struct cfg80211_sched_scan_plan *scan_plan =
1173                         &params->scan_plans[i];
1174
1175                 sec_part->schedule[i].iter_count = scan_plan->iterations;
1176                 sec_part->schedule[i].interval =
1177                         cpu_to_le16(scan_plan->interval);
1178         }
1179
1180         /*
1181          * If the number of iterations of the last scan plan is set to
1182          * zero, it should run infinitely. However, this is not always the case.
1183          * For example, when regular scan is requested the driver sets one scan
1184          * plan with one iteration.
1185          */
1186         if (!sec_part->schedule[i - 1].iter_count)
1187                 sec_part->schedule[i - 1].iter_count = 0xff;
1188
1189         sec_part->delay = cpu_to_le16(params->delay);
1190         sec_part->preq = params->preq;
1191
1192         return 0;
1193 }
1194
1195 static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
1196 {
1197         return hweight32(mvm->scan_status & IWL_MVM_SCAN_MASK);
1198 }
1199
1200 static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
1201 {
1202         bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
1203                                          IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
1204
1205         /* This looks a bit arbitrary, but the idea is that if we run
1206          * out of possible simultaneous scans and the userspace is
1207          * trying to run a scan type that is already running, we
1208          * return -EBUSY.  But if the userspace wants to start a
1209          * different type of scan, we stop the opposite type to make
1210          * space for the new request.  The reason is backwards
1211          * compatibility with old wpa_supplicant that wouldn't stop a
1212          * scheduled scan before starting a normal scan.
1213          */
1214
1215         if (iwl_mvm_num_scans(mvm) < mvm->max_scans)
1216                 return 0;
1217
1218         /* Use a switch, even though this is a bitmask, so that more
1219          * than one bits set will fall in default and we will warn.
1220          */
1221         switch (type) {
1222         case IWL_MVM_SCAN_REGULAR:
1223                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1224                         return -EBUSY;
1225                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
1226         case IWL_MVM_SCAN_SCHED:
1227                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1228                         return -EBUSY;
1229                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
1230         case IWL_MVM_SCAN_NETDETECT:
1231                 /* For non-unified images, there's no need to stop
1232                  * anything for net-detect since the firmware is
1233                  * restarted anyway.  This way, any sched scans that
1234                  * were running will be restarted when we resume.
1235                  */
1236                 if (!unified_image)
1237                         return 0;
1238
1239                 /* If this is a unified image and we ran out of scans,
1240                  * we need to stop something.  Prefer stopping regular
1241                  * scans, because the results are useless at this
1242                  * point, and we should be able to keep running
1243                  * another scheduled scan while suspended.
1244                  */
1245                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1246                         return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR,
1247                                                  true);
1248                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1249                         return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
1250                                                  true);
1251
1252                 /* fall through, something is wrong if no scan was
1253                  * running but we ran out of scans.
1254                  */
1255         default:
1256                 WARN_ON(1);
1257                 break;
1258         }
1259
1260         return -EIO;
1261 }
1262
1263 #define SCAN_TIMEOUT 20000
1264
1265 void iwl_mvm_scan_timeout_wk(struct work_struct *work)
1266 {
1267         struct delayed_work *delayed_work = to_delayed_work(work);
1268         struct iwl_mvm *mvm = container_of(delayed_work, struct iwl_mvm,
1269                                            scan_timeout_dwork);
1270
1271         IWL_ERR(mvm, "regular scan timed out\n");
1272
1273         iwl_force_nmi(mvm->trans);
1274 }
1275
1276 int iwl_mvm_reg_scan_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1277                            struct cfg80211_scan_request *req,
1278                            struct ieee80211_scan_ies *ies)
1279 {
1280         struct iwl_host_cmd hcmd = {
1281                 .len = { iwl_mvm_scan_size(mvm), },
1282                 .data = { mvm->scan_cmd, },
1283                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1284         };
1285         struct iwl_mvm_scan_params params = {};
1286         int ret;
1287         struct cfg80211_sched_scan_plan scan_plan = { .iterations = 1 };
1288
1289         lockdep_assert_held(&mvm->mutex);
1290
1291         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1292                 IWL_ERR(mvm, "scan while LAR regdomain is not set\n");
1293                 return -EBUSY;
1294         }
1295
1296         ret = iwl_mvm_check_running_scans(mvm, IWL_MVM_SCAN_REGULAR);
1297         if (ret)
1298                 return ret;
1299
1300         /* we should have failed registration if scan_cmd was NULL */
1301         if (WARN_ON(!mvm->scan_cmd))
1302                 return -ENOMEM;
1303
1304         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1305                 return -ENOBUFS;
1306
1307         params.n_ssids = req->n_ssids;
1308         params.flags = req->flags;
1309         params.n_channels = req->n_channels;
1310         params.delay = 0;
1311         params.ssids = req->ssids;
1312         params.channels = req->channels;
1313         params.mac_addr = req->mac_addr;
1314         params.mac_addr_mask = req->mac_addr_mask;
1315         params.no_cck = req->no_cck;
1316         params.pass_all = true;
1317         params.n_match_sets = 0;
1318         params.match_sets = NULL;
1319
1320         params.scan_plans = &scan_plan;
1321         params.n_scan_plans = 1;
1322
1323         params.type =
1324                 iwl_mvm_get_scan_type(mvm,
1325                                       vif->type == NL80211_IFTYPE_P2P_DEVICE);
1326
1327         ret = iwl_mvm_get_measurement_dwell(mvm, req, &params);
1328         if (ret < 0)
1329                 return ret;
1330
1331         params.measurement_dwell = ret;
1332
1333         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1334
1335         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1336                 hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1337                 ret = iwl_mvm_scan_umac(mvm, vif, &params,
1338                                         IWL_MVM_SCAN_REGULAR);
1339         } else {
1340                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1341                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1342         }
1343
1344         if (ret)
1345                 return ret;
1346
1347         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1348         if (ret) {
1349                 /* If the scan failed, it usually means that the FW was unable
1350                  * to allocate the time events. Warn on it, but maybe we
1351                  * should try to send the command again with different params.
1352                  */
1353                 IWL_ERR(mvm, "Scan failed! ret %d\n", ret);
1354                 return ret;
1355         }
1356
1357         IWL_DEBUG_SCAN(mvm, "Scan request was sent successfully\n");
1358         mvm->scan_status |= IWL_MVM_SCAN_REGULAR;
1359         mvm->scan_vif = iwl_mvm_vif_from_mac80211(vif);
1360         iwl_mvm_ref(mvm, IWL_MVM_REF_SCAN);
1361
1362         queue_delayed_work(system_wq, &mvm->scan_timeout_dwork,
1363                            msecs_to_jiffies(SCAN_TIMEOUT));
1364
1365         return 0;
1366 }
1367
1368 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
1369                              struct ieee80211_vif *vif,
1370                              struct cfg80211_sched_scan_request *req,
1371                              struct ieee80211_scan_ies *ies,
1372                              int type)
1373 {
1374         struct iwl_host_cmd hcmd = {
1375                 .len = { iwl_mvm_scan_size(mvm), },
1376                 .data = { mvm->scan_cmd, },
1377                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1378         };
1379         struct iwl_mvm_scan_params params = {};
1380         int ret;
1381
1382         lockdep_assert_held(&mvm->mutex);
1383
1384         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1385                 IWL_ERR(mvm, "sched-scan while LAR regdomain is not set\n");
1386                 return -EBUSY;
1387         }
1388
1389         ret = iwl_mvm_check_running_scans(mvm, type);
1390         if (ret)
1391                 return ret;
1392
1393         /* we should have failed registration if scan_cmd was NULL */
1394         if (WARN_ON(!mvm->scan_cmd))
1395                 return -ENOMEM;
1396
1397         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1398                 return -ENOBUFS;
1399
1400         params.n_ssids = req->n_ssids;
1401         params.flags = req->flags;
1402         params.n_channels = req->n_channels;
1403         params.ssids = req->ssids;
1404         params.channels = req->channels;
1405         params.mac_addr = req->mac_addr;
1406         params.mac_addr_mask = req->mac_addr_mask;
1407         params.no_cck = false;
1408         params.pass_all =  iwl_mvm_scan_pass_all(mvm, req);
1409         params.n_match_sets = req->n_match_sets;
1410         params.match_sets = req->match_sets;
1411         if (!req->n_scan_plans)
1412                 return -EINVAL;
1413
1414         params.n_scan_plans = req->n_scan_plans;
1415         params.scan_plans = req->scan_plans;
1416
1417         params.type =
1418                 iwl_mvm_get_scan_type(mvm,
1419                                       vif->type == NL80211_IFTYPE_P2P_DEVICE);
1420
1421         /* In theory, LMAC scans can handle a 32-bit delay, but since
1422          * waiting for over 18 hours to start the scan is a bit silly
1423          * and to keep it aligned with UMAC scans (which only support
1424          * 16-bit delays), trim it down to 16-bits.
1425          */
1426         if (req->delay > U16_MAX) {
1427                 IWL_DEBUG_SCAN(mvm,
1428                                "delay value is > 16-bits, set to max possible\n");
1429                 params.delay = U16_MAX;
1430         } else {
1431                 params.delay = req->delay;
1432         }
1433
1434         ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
1435         if (ret)
1436                 return ret;
1437
1438         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1439
1440         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1441                 hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1442                 ret = iwl_mvm_scan_umac(mvm, vif, &params, type);
1443         } else {
1444                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1445                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1446         }
1447
1448         if (ret)
1449                 return ret;
1450
1451         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1452         if (!ret) {
1453                 IWL_DEBUG_SCAN(mvm,
1454                                "Sched scan request was sent successfully\n");
1455                 mvm->scan_status |= type;
1456         } else {
1457                 /* If the scan failed, it usually means that the FW was unable
1458                  * to allocate the time events. Warn on it, but maybe we
1459                  * should try to send the command again with different params.
1460                  */
1461                 IWL_ERR(mvm, "Sched scan failed! ret %d\n", ret);
1462         }
1463
1464         return ret;
1465 }
1466
1467 void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
1468                                          struct iwl_rx_cmd_buffer *rxb)
1469 {
1470         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1471         struct iwl_umac_scan_complete *notif = (void *)pkt->data;
1472         u32 uid = __le32_to_cpu(notif->uid);
1473         bool aborted = (notif->status == IWL_SCAN_OFFLOAD_ABORTED);
1474
1475         if (WARN_ON(!(mvm->scan_uid_status[uid] & mvm->scan_status)))
1476                 return;
1477
1478         /* if the scan is already stopping, we don't need to notify mac80211 */
1479         if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_REGULAR) {
1480                 struct cfg80211_scan_info info = {
1481                         .aborted = aborted,
1482                         .scan_start_tsf = mvm->scan_start,
1483                 };
1484
1485                 memcpy(info.tsf_bssid, mvm->scan_vif->bssid, ETH_ALEN);
1486                 ieee80211_scan_completed(mvm->hw, &info);
1487                 mvm->scan_vif = NULL;
1488                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1489                 cancel_delayed_work(&mvm->scan_timeout_dwork);
1490         } else if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_SCHED) {
1491                 ieee80211_sched_scan_stopped(mvm->hw);
1492                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1493         }
1494
1495         mvm->scan_status &= ~mvm->scan_uid_status[uid];
1496         IWL_DEBUG_SCAN(mvm,
1497                        "Scan completed, uid %u type %u, status %s, EBS status %s\n",
1498                        uid, mvm->scan_uid_status[uid],
1499                        notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
1500                                 "completed" : "aborted",
1501                        iwl_mvm_ebs_status_str(notif->ebs_status));
1502         IWL_DEBUG_SCAN(mvm,
1503                        "Last line %d, Last iteration %d, Time from last iteration %d\n",
1504                        notif->last_schedule, notif->last_iter,
1505                        __le32_to_cpu(notif->time_from_last_iter));
1506
1507         if (notif->ebs_status != IWL_SCAN_EBS_SUCCESS &&
1508             notif->ebs_status != IWL_SCAN_EBS_INACTIVE)
1509                 mvm->last_ebs_successful = false;
1510
1511         mvm->scan_uid_status[uid] = 0;
1512 }
1513
1514 void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
1515                                               struct iwl_rx_cmd_buffer *rxb)
1516 {
1517         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1518         struct iwl_umac_scan_iter_complete_notif *notif = (void *)pkt->data;
1519         u8 buf[256];
1520
1521         mvm->scan_start = le64_to_cpu(notif->start_tsf);
1522
1523         IWL_DEBUG_SCAN(mvm,
1524                        "UMAC Scan iteration complete: status=0x%x scanned_channels=%d channels list: %s\n",
1525                        notif->status, notif->scanned_channels,
1526                        iwl_mvm_dump_channel_list(notif->results,
1527                                                  notif->scanned_channels, buf,
1528                                                  sizeof(buf)));
1529
1530         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
1531                 IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
1532                 ieee80211_sched_scan_results(mvm->hw);
1533                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
1534         }
1535
1536         IWL_DEBUG_SCAN(mvm,
1537                        "UMAC Scan iteration complete: scan started at %llu (TSF)\n",
1538                        mvm->scan_start);
1539 }
1540
1541 static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type)
1542 {
1543         struct iwl_umac_scan_abort cmd = {};
1544         int uid, ret;
1545
1546         lockdep_assert_held(&mvm->mutex);
1547
1548         /* We should always get a valid index here, because we already
1549          * checked that this type of scan was running in the generic
1550          * code.
1551          */
1552         uid = iwl_mvm_scan_uid_by_status(mvm, type);
1553         if (WARN_ON_ONCE(uid < 0))
1554                 return uid;
1555
1556         cmd.uid = cpu_to_le32(uid);
1557
1558         IWL_DEBUG_SCAN(mvm, "Sending scan abort, uid %u\n", uid);
1559
1560         ret = iwl_mvm_send_cmd_pdu(mvm,
1561                                    iwl_cmd_id(SCAN_ABORT_UMAC,
1562                                               IWL_ALWAYS_LONG_GROUP, 0),
1563                                    0, sizeof(cmd), &cmd);
1564         if (!ret)
1565                 mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT;
1566
1567         return ret;
1568 }
1569
1570 static int iwl_mvm_scan_stop_wait(struct iwl_mvm *mvm, int type)
1571 {
1572         struct iwl_notification_wait wait_scan_done;
1573         static const u16 scan_done_notif[] = { SCAN_COMPLETE_UMAC,
1574                                               SCAN_OFFLOAD_COMPLETE, };
1575         int ret;
1576
1577         lockdep_assert_held(&mvm->mutex);
1578
1579         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
1580                                    scan_done_notif,
1581                                    ARRAY_SIZE(scan_done_notif),
1582                                    NULL, NULL);
1583
1584         IWL_DEBUG_SCAN(mvm, "Preparing to stop scan, type %x\n", type);
1585
1586         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1587                 ret = iwl_mvm_umac_scan_abort(mvm, type);
1588         else
1589                 ret = iwl_mvm_lmac_scan_abort(mvm);
1590
1591         if (ret) {
1592                 IWL_DEBUG_SCAN(mvm, "couldn't stop scan type %d\n", type);
1593                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
1594                 return ret;
1595         }
1596
1597         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
1598
1599         return ret;
1600 }
1601
1602 int iwl_mvm_scan_size(struct iwl_mvm *mvm)
1603 {
1604         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1605                 return sizeof(struct iwl_scan_req_umac) +
1606                         sizeof(struct iwl_scan_channel_cfg_umac) *
1607                                 mvm->fw->ucode_capa.n_scan_channels +
1608                         sizeof(struct iwl_scan_req_umac_tail);
1609
1610         return sizeof(struct iwl_scan_req_lmac) +
1611                 sizeof(struct iwl_scan_channel_cfg_lmac) *
1612                 mvm->fw->ucode_capa.n_scan_channels +
1613                 sizeof(struct iwl_scan_probe_req);
1614 }
1615
1616 /*
1617  * This function is used in nic restart flow, to inform mac80211 about scans
1618  * that was aborted by restart flow or by an assert.
1619  */
1620 void iwl_mvm_report_scan_aborted(struct iwl_mvm *mvm)
1621 {
1622         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1623                 int uid, i;
1624
1625                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_REGULAR);
1626                 if (uid >= 0) {
1627                         struct cfg80211_scan_info info = {
1628                                 .aborted = true,
1629                         };
1630
1631                         ieee80211_scan_completed(mvm->hw, &info);
1632                         mvm->scan_uid_status[uid] = 0;
1633                 }
1634                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_SCHED);
1635                 if (uid >= 0 && !mvm->restart_fw) {
1636                         ieee80211_sched_scan_stopped(mvm->hw);
1637                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1638                         mvm->scan_uid_status[uid] = 0;
1639                 }
1640
1641                 /* We shouldn't have any UIDs still set.  Loop over all the
1642                  * UIDs to make sure there's nothing left there and warn if
1643                  * any is found.
1644                  */
1645                 for (i = 0; i < mvm->max_scans; i++) {
1646                         if (WARN_ONCE(mvm->scan_uid_status[i],
1647                                       "UMAC scan UID %d status was not cleaned\n",
1648                                       i))
1649                                 mvm->scan_uid_status[i] = 0;
1650                 }
1651         } else {
1652                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
1653                         struct cfg80211_scan_info info = {
1654                                 .aborted = true,
1655                         };
1656
1657                         ieee80211_scan_completed(mvm->hw, &info);
1658                 }
1659
1660                 /* Sched scan will be restarted by mac80211 in
1661                  * restart_hw, so do not report if FW is about to be
1662                  * restarted.
1663                  */
1664                 if ((mvm->scan_status & IWL_MVM_SCAN_SCHED) &&
1665                     !mvm->restart_fw) {
1666                         ieee80211_sched_scan_stopped(mvm->hw);
1667                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1668                 }
1669         }
1670 }
1671
1672 int iwl_mvm_scan_stop(struct iwl_mvm *mvm, int type, bool notify)
1673 {
1674         int ret;
1675
1676         if (!(mvm->scan_status & type))
1677                 return 0;
1678
1679         if (iwl_mvm_is_radio_killed(mvm)) {
1680                 ret = 0;
1681                 goto out;
1682         }
1683
1684         ret = iwl_mvm_scan_stop_wait(mvm, type);
1685         if (!ret)
1686                 mvm->scan_status |= type << IWL_MVM_SCAN_STOPPING_SHIFT;
1687 out:
1688         /* Clear the scan status so the next scan requests will
1689          * succeed and mark the scan as stopping, so that the Rx
1690          * handler doesn't do anything, as the scan was stopped from
1691          * above.
1692          */
1693         mvm->scan_status &= ~type;
1694
1695         if (type == IWL_MVM_SCAN_REGULAR) {
1696                 /* Since the rx handler won't do anything now, we have
1697                  * to release the scan reference here.
1698                  */
1699                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1700                 cancel_delayed_work(&mvm->scan_timeout_dwork);
1701                 if (notify) {
1702                         struct cfg80211_scan_info info = {
1703                                 .aborted = true,
1704                         };
1705
1706                         ieee80211_scan_completed(mvm->hw, &info);
1707                 }
1708         } else if (notify) {
1709                 ieee80211_sched_scan_stopped(mvm->hw);
1710                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1711         }
1712
1713         return ret;
1714 }