1/******************************************************************************
   2 *
   3 * This file is provided under a dual BSD/GPLv2 license.  When using or
   4 * redistributing this file, you may do so under either license.
   5 *
   6 * GPL LICENSE SUMMARY
   7 *
   8 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  11 *
  12 * This program is free software; you can redistribute it and/or modify
  13 * it under the terms of version 2 of the GNU General Public License as
  14 * published by the Free Software Foundation.
  15 *
  16 * This program is distributed in the hope that it will be useful, but
  17 * WITHOUT ANY WARRANTY; without even the implied warranty of
  18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19 * General Public License for more details.
  20 *
  21 * You should have received a copy of the GNU General Public License
  22 * along with this program; if not, write to the Free Software
  23 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  24 * USA
  25 *
  26 * The full GNU General Public License is included in this distribution
  27 * in the file called COPYING.
  28 *
  29 * Contact Information:
  30 *  Intel Linux Wireless <linuxwifi@intel.com>
  31 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  32 *
  33 * BSD LICENSE
  34 *
  35 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  36 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  37 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  38 * Copyright(c) 2018 Intel Corporation
  39 * All rights reserved.
  40 *
  41 * Redistribution and use in source and binary forms, with or without
  42 * modification, are permitted provided that the following conditions
  43 * are met:
  44 *
  45 *  * Redistributions of source code must retain the above copyright
  46 *    notice, this list of conditions and the following disclaimer.
  47 *  * Redistributions in binary form must reproduce the above copyright
  48 *    notice, this list of conditions and the following disclaimer in
  49 *    the documentation and/or other materials provided with the
  50 *    distribution.
  51 *  * Neither the name Intel Corporation nor the names of its
  52 *    contributors may be used to endorse or promote products derived
  53 *    from this software without specific prior written permission.
  54 *
  55 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  56 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  57 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  58 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  59 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  60 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  61 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  62 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  63 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  64 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  65 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  66 *
  67 *****************************************************************************/
  68
  69#include <linux/etherdevice.h>
  70#include <net/mac80211.h>
  71
  72#include "mvm.h"
  73#include "fw/api/scan.h"
  74#include "iwl-io.h"
  75
  76#define IWL_DENSE_EBS_SCAN_RATIO 5
  77#define IWL_SPARSE_EBS_SCAN_RATIO 1
  78
  79enum iwl_mvm_traffic_load {
  80	IWL_MVM_TRAFFIC_LOW,
  81	IWL_MVM_TRAFFIC_MEDIUM,
  82	IWL_MVM_TRAFFIC_HIGH,
  83};
  84
  85#define IWL_SCAN_DWELL_ACTIVE		10
  86#define IWL_SCAN_DWELL_PASSIVE		110
  87#define IWL_SCAN_DWELL_FRAGMENTED	44
  88#define IWL_SCAN_DWELL_EXTENDED		90
  89#define IWL_SCAN_NUM_OF_FRAGS		3
  90
  91
  92/* adaptive dwell max budget time [TU] for full scan */
  93#define IWL_SCAN_ADWELL_MAX_BUDGET_FULL_SCAN 300
  94/* adaptive dwell max budget time [TU] for directed scan */
  95#define IWL_SCAN_ADWELL_MAX_BUDGET_DIRECTED_SCAN 100
  96/* adaptive dwell default APs number */
  97#define IWL_SCAN_ADWELL_DEFAULT_N_APS 2
  98/* adaptive dwell default APs number in social channels (1, 6, 11) */
  99#define IWL_SCAN_ADWELL_DEFAULT_N_APS_SOCIAL 10
 100
 101struct iwl_mvm_scan_timing_params {
 
 
 
 
 102	u32 suspend_time;
 103	u32 max_out_time;
 104};
 105
 106static struct iwl_mvm_scan_timing_params scan_timing[] = {
 107	[IWL_SCAN_TYPE_UNASSOC] = {
 
 
 
 
 108		.suspend_time = 0,
 109		.max_out_time = 0,
 110	},
 111	[IWL_SCAN_TYPE_WILD] = {
 
 
 
 
 112		.suspend_time = 30,
 113		.max_out_time = 120,
 114	},
 115	[IWL_SCAN_TYPE_MILD] = {
 
 
 
 
 116		.suspend_time = 120,
 117		.max_out_time = 120,
 118	},
 119	[IWL_SCAN_TYPE_FRAGMENTED] = {
 
 
 
 120		.suspend_time = 95,
 121		.max_out_time = 44,
 122	},
 123};
 124
 125struct iwl_mvm_scan_params {
 126	enum iwl_mvm_scan_type type;
 127	u32 n_channels;
 128	u16 delay;
 129	int n_ssids;
 130	struct cfg80211_ssid *ssids;
 131	struct ieee80211_channel **channels;
 132	u32 flags;
 133	u8 *mac_addr;
 134	u8 *mac_addr_mask;
 135	bool no_cck;
 136	bool pass_all;
 137	int n_match_sets;
 138	struct iwl_scan_probe_req preq;
 139	struct cfg80211_match_set *match_sets;
 140	int n_scan_plans;
 141	struct cfg80211_sched_scan_plan *scan_plans;
 142	u32 measurement_dwell;
 143};
 144
 145static inline void *iwl_mvm_get_scan_req_umac_data(struct iwl_mvm *mvm)
 146{
 147	struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
 148
 149	if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm))
 150		return (void *)&cmd->v8.data;
 151
 152	if (iwl_mvm_is_adaptive_dwell_supported(mvm))
 153		return (void *)&cmd->v7.data;
 154
 155	if (iwl_mvm_has_new_tx_api(mvm))
 156		return (void *)&cmd->v6.data;
 157
 158	return (void *)&cmd->v1.data;
 159}
 160
 161static inline struct iwl_scan_umac_chan_param *
 162iwl_mvm_get_scan_req_umac_channel(struct iwl_mvm *mvm)
 163{
 164	struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
 165
 166	if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm))
 167		return &cmd->v8.channel;
 168
 169	if (iwl_mvm_is_adaptive_dwell_supported(mvm))
 170		return &cmd->v7.channel;
 171
 172	if (iwl_mvm_has_new_tx_api(mvm))
 173		return &cmd->v6.channel;
 174
 175	return &cmd->v1.channel;
 176}
 177
 178static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 179{
 180	if (mvm->scan_rx_ant != ANT_NONE)
 181		return mvm->scan_rx_ant;
 182	return iwl_mvm_get_valid_rx_ant(mvm);
 183}
 184
 185static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 186{
 187	u16 rx_chain;
 188	u8 rx_ant;
 189
 190	rx_ant = iwl_mvm_scan_rx_ant(mvm);
 191	rx_chain = rx_ant << PHY_RX_CHAIN_VALID_POS;
 192	rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
 193	rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_SEL_POS;
 194	rx_chain |= 0x1 << PHY_RX_CHAIN_DRIVER_FORCE_POS;
 195	return cpu_to_le16(rx_chain);
 196}
 197
 198static __le32 iwl_mvm_scan_rxon_flags(enum nl80211_band band)
 199{
 200	if (band == NL80211_BAND_2GHZ)
 201		return cpu_to_le32(PHY_BAND_24);
 202	else
 203		return cpu_to_le32(PHY_BAND_5);
 204}
 205
 206static inline __le32
 207iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum nl80211_band band,
 208			  bool no_cck)
 209{
 210	u32 tx_ant;
 211
 212	mvm->scan_last_antenna_idx =
 213		iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
 214				     mvm->scan_last_antenna_idx);
 215	tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 216
 217	if (band == NL80211_BAND_2GHZ && !no_cck)
 218		return cpu_to_le32(IWL_RATE_1M_PLCP | RATE_MCS_CCK_MSK |
 219				   tx_ant);
 220	else
 221		return cpu_to_le32(IWL_RATE_6M_PLCP | tx_ant);
 222}
 223
 224static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
 225					    struct ieee80211_vif *vif)
 226{
 227	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 228	int *global_cnt = data;
 229
 230	if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
 231	    mvmvif->phy_ctxt->id < NUM_PHY_CTX)
 232		*global_cnt += 1;
 233}
 234
 235static enum iwl_mvm_traffic_load iwl_mvm_get_traffic_load(struct iwl_mvm *mvm)
 236{
 237	return IWL_MVM_TRAFFIC_LOW;
 238}
 239
 240static enum
 241iwl_mvm_scan_type iwl_mvm_get_scan_type(struct iwl_mvm *mvm, bool p2p_device)
 242{
 243	int global_cnt = 0;
 244	enum iwl_mvm_traffic_load load;
 245	bool low_latency;
 246
 247	ieee80211_iterate_active_interfaces_atomic(mvm->hw,
 248					    IEEE80211_IFACE_ITER_NORMAL,
 249					    iwl_mvm_scan_condition_iterator,
 250					    &global_cnt);
 251	if (!global_cnt)
 252		return IWL_SCAN_TYPE_UNASSOC;
 253
 254	load = iwl_mvm_get_traffic_load(mvm);
 255	low_latency = iwl_mvm_low_latency(mvm);
 256
 257	if ((load == IWL_MVM_TRAFFIC_HIGH || low_latency) && !p2p_device &&
 258	    fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_FRAGMENTED_SCAN))
 259		return IWL_SCAN_TYPE_FRAGMENTED;
 260
 261	if (load >= IWL_MVM_TRAFFIC_MEDIUM || low_latency)
 262		return IWL_SCAN_TYPE_MILD;
 263
 264	return IWL_SCAN_TYPE_WILD;
 265}
 266
 267static int
 268iwl_mvm_get_measurement_dwell(struct iwl_mvm *mvm,
 269			      struct cfg80211_scan_request *req,
 270			      struct iwl_mvm_scan_params *params)
 271{
 272	if (!req->duration)
 273		return 0;
 274
 275	if (req->duration_mandatory &&
 276	    req->duration > scan_timing[params->type].max_out_time) {
 277		IWL_DEBUG_SCAN(mvm,
 278			       "Measurement scan - too long dwell %hu (max out time %u)\n",
 279			       req->duration,
 280			       scan_timing[params->type].max_out_time);
 281		return -EOPNOTSUPP;
 282	}
 283
 284	return min_t(u32, (u32)req->duration,
 285		     scan_timing[params->type].max_out_time);
 286}
 287
 288static inline bool iwl_mvm_rrm_scan_needed(struct iwl_mvm *mvm)
 289{
 290	/* require rrm scan whenever the fw supports it */
 291	return fw_has_capa(&mvm->fw->ucode_capa,
 292			   IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT);
 293}
 294
 295static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm)
 296{
 297	int max_probe_len;
 298
 299	max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
 300
 301	/* we create the 802.11 header and SSID element */
 302	max_probe_len -= 24 + 2;
 303
 304	/* DS parameter set element is added on 2.4GHZ band if required */
 305	if (iwl_mvm_rrm_scan_needed(mvm))
 306		max_probe_len -= 3;
 307
 308	return max_probe_len;
 309}
 310
 311int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm)
 312{
 313	int max_ie_len = iwl_mvm_max_scan_ie_fw_cmd_room(mvm);
 314
 315	/* TODO: [BUG] This function should return the maximum allowed size of
 316	 * scan IEs, however the LMAC scan api contains both 2GHZ and 5GHZ IEs
 317	 * in the same command. So the correct implementation of this function
 318	 * is just iwl_mvm_max_scan_ie_fw_cmd_room() / 2. Currently the scan
 319	 * command has only 512 bytes and it would leave us with about 240
 320	 * bytes for scan IEs, which is clearly not enough. So meanwhile
 321	 * we will report an incorrect value. This may result in a failure to
 322	 * issue a scan in unified_scan_lmac and unified_sched_scan_lmac
 323	 * functions with -ENOBUFS, if a large enough probe will be provided.
 324	 */
 325	return max_ie_len;
 326}
 327
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 328void iwl_mvm_rx_lmac_scan_iter_complete_notif(struct iwl_mvm *mvm,
 329					      struct iwl_rx_cmd_buffer *rxb)
 330{
 331	struct iwl_rx_packet *pkt = rxb_addr(rxb);
 332	struct iwl_lmac_scan_complete_notif *notif = (void *)pkt->data;
 
 333
 334	IWL_DEBUG_SCAN(mvm,
 335		       "Scan offload iteration complete: status=0x%x scanned channels=%d\n",
 336		       notif->status, notif->scanned_channels);
 
 
 
 337
 338	if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
 339		IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
 340		ieee80211_sched_scan_results(mvm->hw);
 341		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 342	}
 343}
 344
 345void iwl_mvm_rx_scan_match_found(struct iwl_mvm *mvm,
 346				 struct iwl_rx_cmd_buffer *rxb)
 347{
 348	IWL_DEBUG_SCAN(mvm, "Scheduled scan results\n");
 349	ieee80211_sched_scan_results(mvm->hw);
 350}
 351
 352static const char *iwl_mvm_ebs_status_str(enum iwl_scan_ebs_status status)
 353{
 354	switch (status) {
 355	case IWL_SCAN_EBS_SUCCESS:
 356		return "successful";
 357	case IWL_SCAN_EBS_INACTIVE:
 358		return "inactive";
 359	case IWL_SCAN_EBS_FAILED:
 360	case IWL_SCAN_EBS_CHAN_NOT_FOUND:
 361	default:
 362		return "failed";
 363	}
 364}
 365
 366void iwl_mvm_rx_lmac_scan_complete_notif(struct iwl_mvm *mvm,
 367					 struct iwl_rx_cmd_buffer *rxb)
 368{
 369	struct iwl_rx_packet *pkt = rxb_addr(rxb);
 370	struct iwl_periodic_scan_complete *scan_notif = (void *)pkt->data;
 371	bool aborted = (scan_notif->status == IWL_SCAN_OFFLOAD_ABORTED);
 372
 373	/* If this happens, the firmware has mistakenly sent an LMAC
 374	 * notification during UMAC scans -- warn and ignore it.
 375	 */
 376	if (WARN_ON_ONCE(fw_has_capa(&mvm->fw->ucode_capa,
 377				     IWL_UCODE_TLV_CAPA_UMAC_SCAN)))
 378		return;
 379
 380	/* scan status must be locked for proper checking */
 381	lockdep_assert_held(&mvm->mutex);
 382
 383	/* We first check if we were stopping a scan, in which case we
 384	 * just clear the stopping flag.  Then we check if it was a
 385	 * firmware initiated stop, in which case we need to inform
 386	 * mac80211.
 387	 * Note that we can have a stopping and a running scan
 388	 * simultaneously, but we can't have two different types of
 389	 * scans stopping or running at the same time (since LMAC
 390	 * doesn't support it).
 391	 */
 392
 393	if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_SCHED) {
 394		WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR);
 395
 396		IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 397			       aborted ? "aborted" : "completed",
 398			       iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 399		IWL_DEBUG_SCAN(mvm,
 400			       "Last line %d, Last iteration %d, Time after last iteration %d\n",
 401			       scan_notif->last_schedule_line,
 402			       scan_notif->last_schedule_iteration,
 403			       __le32_to_cpu(scan_notif->time_after_last_iter));
 404
 405		mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_SCHED;
 406	} else if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR) {
 407		IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s\n",
 408			       aborted ? "aborted" : "completed",
 409			       iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 410
 411		mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_REGULAR;
 412	} else if (mvm->scan_status & IWL_MVM_SCAN_SCHED) {
 413		WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_REGULAR);
 414
 415		IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 416			       aborted ? "aborted" : "completed",
 417			       iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 418		IWL_DEBUG_SCAN(mvm,
 419			       "Last line %d, Last iteration %d, Time after last iteration %d (FW)\n",
 420			       scan_notif->last_schedule_line,
 421			       scan_notif->last_schedule_iteration,
 422			       __le32_to_cpu(scan_notif->time_after_last_iter));
 423
 424		mvm->scan_status &= ~IWL_MVM_SCAN_SCHED;
 425		ieee80211_sched_scan_stopped(mvm->hw);
 426		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 427	} else if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
 428		struct cfg80211_scan_info info = {
 429			.aborted = aborted,
 430		};
 431
 432		IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s (FW)\n",
 433			       aborted ? "aborted" : "completed",
 434			       iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 435
 436		mvm->scan_status &= ~IWL_MVM_SCAN_REGULAR;
 437		ieee80211_scan_completed(mvm->hw, &info);
 
 438		iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 439		cancel_delayed_work(&mvm->scan_timeout_dwork);
 440	} else {
 441		IWL_ERR(mvm,
 442			"got scan complete notification but no scan is running\n");
 443	}
 444
 445	mvm->last_ebs_successful =
 446			scan_notif->ebs_status == IWL_SCAN_EBS_SUCCESS ||
 447			scan_notif->ebs_status == IWL_SCAN_EBS_INACTIVE;
 448}
 449
 450static int iwl_ssid_exist(u8 *ssid, u8 ssid_len, struct iwl_ssid_ie *ssid_list)
 451{
 452	int i;
 453
 454	for (i = 0; i < PROBE_OPTION_MAX; i++) {
 455		if (!ssid_list[i].len)
 456			break;
 457		if (ssid_list[i].len == ssid_len &&
 458		    !memcmp(ssid_list->ssid, ssid, ssid_len))
 459			return i;
 460	}
 461	return -1;
 462}
 463
 464/* We insert the SSIDs in an inverted order, because the FW will
 465 * invert it back.
 466 */
 467static void iwl_scan_build_ssids(struct iwl_mvm_scan_params *params,
 468				 struct iwl_ssid_ie *ssids,
 469				 u32 *ssid_bitmap)
 470{
 471	int i, j;
 472	int index;
 473
 474	/*
 475	 * copy SSIDs from match list.
 476	 * iwl_config_sched_scan_profiles() uses the order of these ssids to
 477	 * config match list.
 478	 */
 479	for (i = 0, j = params->n_match_sets - 1;
 480	     j >= 0 && i < PROBE_OPTION_MAX;
 481	     i++, j--) {
 482		/* skip empty SSID matchsets */
 483		if (!params->match_sets[j].ssid.ssid_len)
 484			continue;
 485		ssids[i].id = WLAN_EID_SSID;
 486		ssids[i].len = params->match_sets[j].ssid.ssid_len;
 487		memcpy(ssids[i].ssid, params->match_sets[j].ssid.ssid,
 488		       ssids[i].len);
 489	}
 490
 491	/* add SSIDs from scan SSID list */
 492	*ssid_bitmap = 0;
 493	for (j = params->n_ssids - 1;
 494	     j >= 0 && i < PROBE_OPTION_MAX;
 495	     i++, j--) {
 496		index = iwl_ssid_exist(params->ssids[j].ssid,
 497				       params->ssids[j].ssid_len,
 498				       ssids);
 499		if (index < 0) {
 500			ssids[i].id = WLAN_EID_SSID;
 501			ssids[i].len = params->ssids[j].ssid_len;
 502			memcpy(ssids[i].ssid, params->ssids[j].ssid,
 503			       ssids[i].len);
 504			*ssid_bitmap |= BIT(i);
 505		} else {
 506			*ssid_bitmap |= BIT(index);
 507		}
 508	}
 509}
 510
 511static int
 512iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
 513				   struct cfg80211_sched_scan_request *req)
 514{
 515	struct iwl_scan_offload_profile *profile;
 516	struct iwl_scan_offload_profile_cfg *profile_cfg;
 517	struct iwl_scan_offload_blacklist *blacklist;
 518	struct iwl_host_cmd cmd = {
 519		.id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
 520		.len[1] = sizeof(*profile_cfg),
 521		.dataflags[0] = IWL_HCMD_DFL_NOCOPY,
 522		.dataflags[1] = IWL_HCMD_DFL_NOCOPY,
 523	};
 524	int blacklist_len;
 525	int i;
 526	int ret;
 527
 528	if (WARN_ON(req->n_match_sets > IWL_SCAN_MAX_PROFILES))
 529		return -EIO;
 530
 531	if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SHORT_BL)
 532		blacklist_len = IWL_SCAN_SHORT_BLACKLIST_LEN;
 533	else
 534		blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 535
 536	blacklist = kzalloc(sizeof(*blacklist) * blacklist_len, GFP_KERNEL);
 537	if (!blacklist)
 538		return -ENOMEM;
 539
 540	profile_cfg = kzalloc(sizeof(*profile_cfg), GFP_KERNEL);
 541	if (!profile_cfg) {
 542		ret = -ENOMEM;
 543		goto free_blacklist;
 544	}
 545
 546	cmd.data[0] = blacklist;
 547	cmd.len[0] = sizeof(*blacklist) * blacklist_len;
 548	cmd.data[1] = profile_cfg;
 549
 550	/* No blacklist configuration */
 551
 552	profile_cfg->num_profiles = req->n_match_sets;
 553	profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
 554	profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
 555	profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
 556	if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
 557		profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 558
 559	for (i = 0; i < req->n_match_sets; i++) {
 560		profile = &profile_cfg->profiles[i];
 561		profile->ssid_index = i;
 562		/* Support any cipher and auth algorithm */
 563		profile->unicast_cipher = 0xff;
 564		profile->auth_alg = 0xff;
 565		profile->network_type = IWL_NETWORK_TYPE_ANY;
 566		profile->band_selection = IWL_SCAN_OFFLOAD_SELECT_ANY;
 567		profile->client_bitmap = SCAN_CLIENT_SCHED_SCAN;
 568	}
 569
 570	IWL_DEBUG_SCAN(mvm, "Sending scheduled scan profile config\n");
 571
 572	ret = iwl_mvm_send_cmd(mvm, &cmd);
 573	kfree(profile_cfg);
 574free_blacklist:
 575	kfree(blacklist);
 576
 577	return ret;
 578}
 579
 580static bool iwl_mvm_scan_pass_all(struct iwl_mvm *mvm,
 581				  struct cfg80211_sched_scan_request *req)
 582{
 583	if (req->n_match_sets && req->match_sets[0].ssid.ssid_len) {
 584		IWL_DEBUG_SCAN(mvm,
 585			       "Sending scheduled scan with filtering, n_match_sets %d\n",
 586			       req->n_match_sets);
 587		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 588		return false;
 589	}
 590
 591	IWL_DEBUG_SCAN(mvm, "Sending Scheduled scan without filtering\n");
 592
 593	mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 594	return true;
 595}
 596
 597static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
 598{
 599	int ret;
 600	struct iwl_host_cmd cmd = {
 601		.id = SCAN_OFFLOAD_ABORT_CMD,
 602	};
 603	u32 status = CAN_ABORT_STATUS;
 604
 605	ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
 606	if (ret)
 607		return ret;
 608
 609	if (status != CAN_ABORT_STATUS) {
 610		/*
 611		 * The scan abort will return 1 for success or
 612		 * 2 for "failure".  A failure condition can be
 613		 * due to simply not being in an active scan which
 614		 * can occur if we send the scan abort before the
 615		 * microcode has notified us that a scan is completed.
 616		 */
 617		IWL_DEBUG_SCAN(mvm, "SCAN OFFLOAD ABORT ret %d.\n", status);
 618		ret = -ENOENT;
 619	}
 620
 621	return ret;
 622}
 623
 624static void iwl_mvm_scan_fill_tx_cmd(struct iwl_mvm *mvm,
 625				     struct iwl_scan_req_tx_cmd *tx_cmd,
 626				     bool no_cck)
 627{
 628	tx_cmd[0].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 629					 TX_CMD_FLG_BT_DIS);
 630	tx_cmd[0].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 631							   NL80211_BAND_2GHZ,
 632							   no_cck);
 633	tx_cmd[0].sta_id = mvm->aux_sta.sta_id;
 634
 635	tx_cmd[1].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 636					 TX_CMD_FLG_BT_DIS);
 637	tx_cmd[1].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 638							   NL80211_BAND_5GHZ,
 639							   no_cck);
 640	tx_cmd[1].sta_id = mvm->aux_sta.sta_id;
 641}
 642
 643static void
 644iwl_mvm_lmac_scan_cfg_channels(struct iwl_mvm *mvm,
 645			       struct ieee80211_channel **channels,
 646			       int n_channels, u32 ssid_bitmap,
 647			       struct iwl_scan_req_lmac *cmd)
 648{
 649	struct iwl_scan_channel_cfg_lmac *channel_cfg = (void *)&cmd->data;
 650	int i;
 651
 652	for (i = 0; i < n_channels; i++) {
 653		channel_cfg[i].channel_num =
 654			cpu_to_le16(channels[i]->hw_value);
 655		channel_cfg[i].iter_count = cpu_to_le16(1);
 656		channel_cfg[i].iter_interval = 0;
 657		channel_cfg[i].flags =
 658			cpu_to_le32(IWL_UNIFIED_SCAN_CHANNEL_PARTIAL |
 659				    ssid_bitmap);
 660	}
 661}
 662
 663static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,
 664					   size_t len, u8 *const pos)
 665{
 666	static const u8 before_ds_params[] = {
 667			WLAN_EID_SSID,
 668			WLAN_EID_SUPP_RATES,
 669			WLAN_EID_REQUEST,
 670			WLAN_EID_EXT_SUPP_RATES,
 671	};
 672	size_t offs;
 673	u8 *newpos = pos;
 674
 675	if (!iwl_mvm_rrm_scan_needed(mvm)) {
 676		memcpy(newpos, ies, len);
 677		return newpos + len;
 678	}
 679
 680	offs = ieee80211_ie_split(ies, len,
 681				  before_ds_params,
 682				  ARRAY_SIZE(before_ds_params),
 683				  0);
 684
 685	memcpy(newpos, ies, offs);
 686	newpos += offs;
 687
 688	/* Add a placeholder for DS Parameter Set element */
 689	*newpos++ = WLAN_EID_DS_PARAMS;
 690	*newpos++ = 1;
 691	*newpos++ = 0;
 692
 693	memcpy(newpos, ies + offs, len - offs);
 694	newpos += len - offs;
 695
 696	return newpos;
 697}
 698
 699#define WFA_TPC_IE_LEN	9
 700
 701static void iwl_mvm_add_tpc_report_ie(u8 *pos)
 702{
 703	pos[0] = WLAN_EID_VENDOR_SPECIFIC;
 704	pos[1] = WFA_TPC_IE_LEN - 2;
 705	pos[2] = (WLAN_OUI_MICROSOFT >> 16) & 0xff;
 706	pos[3] = (WLAN_OUI_MICROSOFT >> 8) & 0xff;
 707	pos[4] = WLAN_OUI_MICROSOFT & 0xff;
 708	pos[5] = WLAN_OUI_TYPE_MICROSOFT_TPC;
 709	pos[6] = 0;
 710	/* pos[7] - tx power will be inserted by the FW */
 711	pos[7] = 0;
 712	pos[8] = 0;
 713}
 714
 715static void
 716iwl_mvm_build_scan_probe(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 717			 struct ieee80211_scan_ies *ies,
 718			 struct iwl_mvm_scan_params *params)
 719{
 720	struct ieee80211_mgmt *frame = (void *)params->preq.buf;
 721	u8 *pos, *newpos;
 722	const u8 *mac_addr = params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
 723		params->mac_addr : NULL;
 724
 725	/*
 726	 * Unfortunately, right now the offload scan doesn't support randomising
 727	 * within the firmware, so until the firmware API is ready we implement
 728	 * it in the driver. This means that the scan iterations won't really be
 729	 * random, only when it's restarted, but at least that helps a bit.
 730	 */
 731	if (mac_addr)
 732		get_random_mask_addr(frame->sa, mac_addr,
 733				     params->mac_addr_mask);
 734	else
 735		memcpy(frame->sa, vif->addr, ETH_ALEN);
 736
 737	frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 738	eth_broadcast_addr(frame->da);
 739	eth_broadcast_addr(frame->bssid);
 740	frame->seq_ctrl = 0;
 741
 742	pos = frame->u.probe_req.variable;
 743	*pos++ = WLAN_EID_SSID;
 744	*pos++ = 0;
 745
 746	params->preq.mac_header.offset = 0;
 747	params->preq.mac_header.len = cpu_to_le16(24 + 2);
 748
 749	/* Insert ds parameter set element on 2.4 GHz band */
 750	newpos = iwl_mvm_copy_and_insert_ds_elem(mvm,
 751						 ies->ies[NL80211_BAND_2GHZ],
 752						 ies->len[NL80211_BAND_2GHZ],
 753						 pos);
 754	params->preq.band_data[0].offset = cpu_to_le16(pos - params->preq.buf);
 755	params->preq.band_data[0].len = cpu_to_le16(newpos - pos);
 756	pos = newpos;
 757
 758	memcpy(pos, ies->ies[NL80211_BAND_5GHZ],
 759	       ies->len[NL80211_BAND_5GHZ]);
 760	params->preq.band_data[1].offset = cpu_to_le16(pos - params->preq.buf);
 761	params->preq.band_data[1].len =
 762		cpu_to_le16(ies->len[NL80211_BAND_5GHZ]);
 763	pos += ies->len[NL80211_BAND_5GHZ];
 764
 765	memcpy(pos, ies->common_ies, ies->common_ie_len);
 766	params->preq.common_data.offset = cpu_to_le16(pos - params->preq.buf);
 
 
 767
 768	if (iwl_mvm_rrm_scan_needed(mvm) &&
 769	    !fw_has_capa(&mvm->fw->ucode_capa,
 770			 IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT)) {
 771		iwl_mvm_add_tpc_report_ie(pos + ies->common_ie_len);
 772		params->preq.common_data.len = cpu_to_le16(ies->common_ie_len +
 773							   WFA_TPC_IE_LEN);
 774	} else {
 775		params->preq.common_data.len = cpu_to_le16(ies->common_ie_len);
 776	}
 
 
 
 
 
 777}
 778
 779static void iwl_mvm_scan_lmac_dwell(struct iwl_mvm *mvm,
 780				    struct iwl_scan_req_lmac *cmd,
 781				    struct iwl_mvm_scan_params *params)
 782{
 783	cmd->active_dwell = IWL_SCAN_DWELL_ACTIVE;
 784	cmd->passive_dwell = IWL_SCAN_DWELL_PASSIVE;
 785	cmd->fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
 786	cmd->extended_dwell = IWL_SCAN_DWELL_EXTENDED;
 787	cmd->max_out_time = cpu_to_le32(scan_timing[params->type].max_out_time);
 788	cmd->suspend_time = cpu_to_le32(scan_timing[params->type].suspend_time);
 789	cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
 790}
 791
 792static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,
 793				     struct ieee80211_scan_ies *ies,
 794				     int n_channels)
 795{
 796	return ((n_ssids <= PROBE_OPTION_MAX) &&
 797		(n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
 798		(ies->common_ie_len +
 799		 ies->len[NL80211_BAND_2GHZ] +
 800		 ies->len[NL80211_BAND_5GHZ] <=
 801		 iwl_mvm_max_scan_ie_fw_cmd_room(mvm)));
 802}
 803
 804static inline bool iwl_mvm_scan_use_ebs(struct iwl_mvm *mvm,
 805					struct ieee80211_vif *vif)
 806{
 807	const struct iwl_ucode_capabilities *capa = &mvm->fw->ucode_capa;
 808
 809	/* We can only use EBS if:
 810	 *	1. the feature is supported;
 811	 *	2. the last EBS was successful;
 812	 *	3. if only single scan, the single scan EBS API is supported;
 813	 *	4. it's not a p2p find operation.
 814	 */
 815	return ((capa->flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT) &&
 816		mvm->last_ebs_successful && IWL_MVM_ENABLE_EBS &&
 817		vif->type != NL80211_IFTYPE_P2P_DEVICE);
 818}
 819
 820static inline bool iwl_mvm_is_regular_scan(struct iwl_mvm_scan_params *params)
 821{
 822	return params->n_scan_plans == 1 &&
 823		params->scan_plans[0].iterations == 1;
 824}
 825
 826static int iwl_mvm_scan_lmac_flags(struct iwl_mvm *mvm,
 827				   struct iwl_mvm_scan_params *params,
 828				   struct ieee80211_vif *vif)
 829{
 830	int flags = 0;
 831
 832	if (params->n_ssids == 0)
 833		flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 834
 835	if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
 836		flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
 837
 838	if (params->type == IWL_SCAN_TYPE_FRAGMENTED)
 839		flags |= IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED;
 840
 841	if (iwl_mvm_rrm_scan_needed(mvm) &&
 842	    fw_has_capa(&mvm->fw->ucode_capa,
 843			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
 844		flags |= IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED;
 845
 846	if (params->pass_all)
 847		flags |= IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
 848	else
 849		flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
 850
 851#ifdef CONFIG_IWLWIFI_DEBUGFS
 852	if (mvm->scan_iter_notif_enabled)
 853		flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 854#endif
 855
 856	if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
 857		flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 858
 859	if (iwl_mvm_is_regular_scan(params) &&
 860	    vif->type != NL80211_IFTYPE_P2P_DEVICE &&
 861	    params->type != IWL_SCAN_TYPE_FRAGMENTED)
 862		flags |= IWL_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL;
 863
 864	return flags;
 865}
 866
 867static int iwl_mvm_scan_lmac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 868			     struct iwl_mvm_scan_params *params)
 869{
 870	struct iwl_scan_req_lmac *cmd = mvm->scan_cmd;
 871	struct iwl_scan_probe_req *preq =
 872		(void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
 873			 mvm->fw->ucode_capa.n_scan_channels);
 874	u32 ssid_bitmap = 0;
 875	int i;
 876
 877	lockdep_assert_held(&mvm->mutex);
 878
 879	memset(cmd, 0, ksize(cmd));
 880
 881	if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
 882		return -EINVAL;
 883
 884	iwl_mvm_scan_lmac_dwell(mvm, cmd, params);
 885
 886	cmd->rx_chain_select = iwl_mvm_scan_rx_chain(mvm);
 887	cmd->iter_num = cpu_to_le32(1);
 888	cmd->n_channels = (u8)params->n_channels;
 889
 890	cmd->delay = cpu_to_le32(params->delay);
 891
 892	cmd->scan_flags = cpu_to_le32(iwl_mvm_scan_lmac_flags(mvm, params,
 893							      vif));
 894
 895	cmd->flags = iwl_mvm_scan_rxon_flags(params->channels[0]->band);
 896	cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
 897					MAC_FILTER_IN_BEACON);
 898	iwl_mvm_scan_fill_tx_cmd(mvm, cmd->tx_cmd, params->no_cck);
 899	iwl_scan_build_ssids(params, cmd->direct_scan, &ssid_bitmap);
 900
 901	/* this API uses bits 1-20 instead of 0-19 */
 902	ssid_bitmap <<= 1;
 903
 904	for (i = 0; i < params->n_scan_plans; i++) {
 905		struct cfg80211_sched_scan_plan *scan_plan =
 906			&params->scan_plans[i];
 907
 908		cmd->schedule[i].delay =
 909			cpu_to_le16(scan_plan->interval);
 910		cmd->schedule[i].iterations = scan_plan->iterations;
 911		cmd->schedule[i].full_scan_mul = 1;
 912	}
 913
 914	/*
 915	 * If the number of iterations of the last scan plan is set to
 916	 * zero, it should run infinitely. However, this is not always the case.
 917	 * For example, when regular scan is requested the driver sets one scan
 918	 * plan with one iteration.
 919	 */
 920	if (!cmd->schedule[i - 1].iterations)
 921		cmd->schedule[i - 1].iterations = 0xff;
 922
 923	if (iwl_mvm_scan_use_ebs(mvm, vif)) {
 924		cmd->channel_opt[0].flags =
 925			cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 926				    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 927				    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 928		cmd->channel_opt[0].non_ebs_ratio =
 929			cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
 930		cmd->channel_opt[1].flags =
 931			cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 932				    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 933				    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 934		cmd->channel_opt[1].non_ebs_ratio =
 935			cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
 936	}
 937
 938	iwl_mvm_lmac_scan_cfg_channels(mvm, params->channels,
 939				       params->n_channels, ssid_bitmap, cmd);
 940
 941	*preq = params->preq;
 942
 943	return 0;
 944}
 945
 946static int rate_to_scan_rate_flag(unsigned int rate)
 947{
 948	static const int rate_to_scan_rate[IWL_RATE_COUNT] = {
 949		[IWL_RATE_1M_INDEX]	= SCAN_CONFIG_RATE_1M,
 950		[IWL_RATE_2M_INDEX]	= SCAN_CONFIG_RATE_2M,
 951		[IWL_RATE_5M_INDEX]	= SCAN_CONFIG_RATE_5M,
 952		[IWL_RATE_11M_INDEX]	= SCAN_CONFIG_RATE_11M,
 953		[IWL_RATE_6M_INDEX]	= SCAN_CONFIG_RATE_6M,
 954		[IWL_RATE_9M_INDEX]	= SCAN_CONFIG_RATE_9M,
 955		[IWL_RATE_12M_INDEX]	= SCAN_CONFIG_RATE_12M,
 956		[IWL_RATE_18M_INDEX]	= SCAN_CONFIG_RATE_18M,
 957		[IWL_RATE_24M_INDEX]	= SCAN_CONFIG_RATE_24M,
 958		[IWL_RATE_36M_INDEX]	= SCAN_CONFIG_RATE_36M,
 959		[IWL_RATE_48M_INDEX]	= SCAN_CONFIG_RATE_48M,
 960		[IWL_RATE_54M_INDEX]	= SCAN_CONFIG_RATE_54M,
 961	};
 962
 963	return rate_to_scan_rate[rate];
 964}
 965
 966static __le32 iwl_mvm_scan_config_rates(struct iwl_mvm *mvm)
 967{
 968	struct ieee80211_supported_band *band;
 969	unsigned int rates = 0;
 970	int i;
 971
 972	band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 973	for (i = 0; i < band->n_bitrates; i++)
 974		rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 975	band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 976	for (i = 0; i < band->n_bitrates; i++)
 977		rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 978
 979	/* Set both basic rates and supported rates */
 980	rates |= SCAN_CONFIG_SUPPORTED_RATE(rates);
 981
 982	return cpu_to_le32(rates);
 983}
 984
 985static void iwl_mvm_fill_scan_dwell(struct iwl_mvm *mvm,
 986				    struct iwl_scan_dwell *dwell)
 987{
 988	dwell->active = IWL_SCAN_DWELL_ACTIVE;
 989	dwell->passive = IWL_SCAN_DWELL_PASSIVE;
 990	dwell->fragmented = IWL_SCAN_DWELL_FRAGMENTED;
 991	dwell->extended = IWL_SCAN_DWELL_EXTENDED;
 992}
 993
 994static void iwl_mvm_fill_channels(struct iwl_mvm *mvm, u8 *channels)
 995{
 996	struct ieee80211_supported_band *band;
 997	int i, j = 0;
 998
 999	band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
1000	for (i = 0; i < band->n_channels; i++, j++)
1001		channels[j] = band->channels[i].hw_value;
1002	band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
1003	for (i = 0; i < band->n_channels; i++, j++)
1004		channels[j] = band->channels[i].hw_value;
1005}
1006
1007static void iwl_mvm_fill_scan_config_v1(struct iwl_mvm *mvm, void *config,
1008					u32 flags, u8 channel_flags)
1009{
1010	enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, false);
1011	struct iwl_scan_config_v1 *cfg = config;
1012
1013	cfg->flags = cpu_to_le32(flags);
1014	cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
1015	cfg->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
1016	cfg->legacy_rates = iwl_mvm_scan_config_rates(mvm);
1017	cfg->out_of_channel_time = cpu_to_le32(scan_timing[type].max_out_time);
1018	cfg->suspend_time = cpu_to_le32(scan_timing[type].suspend_time);
1019
1020	iwl_mvm_fill_scan_dwell(mvm, &cfg->dwell);
1021
1022	memcpy(&cfg->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
1023
1024	cfg->bcast_sta_id = mvm->aux_sta.sta_id;
1025	cfg->channel_flags = channel_flags;
1026
1027	iwl_mvm_fill_channels(mvm, cfg->channel_array);
1028}
1029
1030static void iwl_mvm_fill_scan_config(struct iwl_mvm *mvm, void *config,
1031				     u32 flags, u8 channel_flags)
1032{
1033	enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, false);
1034	struct iwl_scan_config *cfg = config;
1035
1036	cfg->flags = cpu_to_le32(flags);
1037	cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
1038	cfg->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
1039	cfg->legacy_rates = iwl_mvm_scan_config_rates(mvm);
1040	cfg->out_of_channel_time[0] =
1041		cpu_to_le32(scan_timing[type].max_out_time);
1042	cfg->suspend_time[0] = cpu_to_le32(scan_timing[type].suspend_time);
1043
1044	if (iwl_mvm_is_cdb_supported(mvm)) {
1045		cfg->suspend_time[1] =
1046			cpu_to_le32(scan_timing[type].suspend_time);
1047		cfg->out_of_channel_time[1] =
1048			cpu_to_le32(scan_timing[type].max_out_time);
1049	}
1050
1051	iwl_mvm_fill_scan_dwell(mvm, &cfg->dwell);
1052
1053	memcpy(&cfg->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
1054
1055	cfg->bcast_sta_id = mvm->aux_sta.sta_id;
1056	cfg->channel_flags = channel_flags;
1057
1058	iwl_mvm_fill_channels(mvm, cfg->channel_array);
1059}
1060
1061int iwl_mvm_config_scan(struct iwl_mvm *mvm)
1062{
1063	void *cfg;
1064	int ret, cmd_size;
 
 
 
 
1065	struct iwl_host_cmd cmd = {
1066		.id = iwl_cmd_id(SCAN_CFG_CMD, IWL_ALWAYS_LONG_GROUP, 0),
1067	};
1068	enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, false);
1069	int num_channels =
1070		mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels +
1071		mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels;
1072	u32 flags;
1073	u8 channel_flags;
1074
1075	if (WARN_ON(num_channels > mvm->fw->ucode_capa.n_scan_channels))
1076		return -ENOBUFS;
1077
1078	if (type == mvm->scan_type)
 
 
1079		return 0;
 
1080
1081	if (iwl_mvm_has_new_tx_api(mvm))
1082		cmd_size = sizeof(struct iwl_scan_config);
1083	else
1084		cmd_size = sizeof(struct iwl_scan_config_v1);
1085	cmd_size += mvm->fw->ucode_capa.n_scan_channels;
1086
1087	cfg = kzalloc(cmd_size, GFP_KERNEL);
1088	if (!cfg)
1089		return -ENOMEM;
1090
1091	flags = SCAN_CONFIG_FLAG_ACTIVATE |
1092		 SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS |
1093		 SCAN_CONFIG_FLAG_SET_TX_CHAINS |
1094		 SCAN_CONFIG_FLAG_SET_RX_CHAINS |
1095		 SCAN_CONFIG_FLAG_SET_AUX_STA_ID |
1096		 SCAN_CONFIG_FLAG_SET_ALL_TIMES |
1097		 SCAN_CONFIG_FLAG_SET_LEGACY_RATES |
1098		 SCAN_CONFIG_FLAG_SET_MAC_ADDR |
1099		 SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS |
1100		 SCAN_CONFIG_N_CHANNELS(num_channels) |
1101		 (type == IWL_SCAN_TYPE_FRAGMENTED ?
1102		  SCAN_CONFIG_FLAG_SET_FRAGMENTED :
1103		  SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED);
1104
1105	channel_flags = IWL_CHANNEL_FLAG_EBS |
1106			IWL_CHANNEL_FLAG_ACCURATE_EBS |
1107			IWL_CHANNEL_FLAG_EBS_ADD |
1108			IWL_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE;
1109
1110	if (iwl_mvm_has_new_tx_api(mvm)) {
1111		flags |= (type == IWL_SCAN_TYPE_FRAGMENTED) ?
1112			 SCAN_CONFIG_FLAG_SET_LMAC2_FRAGMENTED :
1113			 SCAN_CONFIG_FLAG_CLEAR_LMAC2_FRAGMENTED;
1114		iwl_mvm_fill_scan_config(mvm, cfg, flags, channel_flags);
1115	} else {
1116		iwl_mvm_fill_scan_config_v1(mvm, cfg, flags, channel_flags);
1117	}
 
 
 
1118
1119	cmd.data[0] = cfg;
 
 
 
 
 
 
 
1120	cmd.len[0] = cmd_size;
1121	cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
1122
1123	IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
1124
1125	ret = iwl_mvm_send_cmd(mvm, &cmd);
1126	if (!ret)
1127		mvm->scan_type = type;
1128
1129	kfree(cfg);
1130	return ret;
1131}
1132
1133static int iwl_mvm_scan_uid_by_status(struct iwl_mvm *mvm, int status)
1134{
1135	int i;
1136
1137	for (i = 0; i < mvm->max_scans; i++)
1138		if (mvm->scan_uid_status[i] == status)
1139			return i;
1140
1141	return -ENOENT;
1142}
1143
1144static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
1145				    struct iwl_scan_req_umac *cmd,
1146				    struct iwl_mvm_scan_params *params)
1147{
1148	struct iwl_mvm_scan_timing_params *timing, *hb_timing;
1149	u8 active_dwell, passive_dwell;
1150
1151	timing = &scan_timing[params->type];
1152	active_dwell = params->measurement_dwell ?
1153		params->measurement_dwell : IWL_SCAN_DWELL_ACTIVE;
1154	passive_dwell = params->measurement_dwell ?
1155		params->measurement_dwell : IWL_SCAN_DWELL_PASSIVE;
1156
1157	if (iwl_mvm_is_adaptive_dwell_supported(mvm)) {
1158		cmd->v7.adwell_default_n_aps_social =
1159			IWL_SCAN_ADWELL_DEFAULT_N_APS_SOCIAL;
1160		cmd->v7.adwell_default_n_aps =
1161			IWL_SCAN_ADWELL_DEFAULT_N_APS;
1162
1163		/* if custom max budget was configured with debugfs */
1164		if (IWL_MVM_ADWELL_MAX_BUDGET)
1165			cmd->v7.adwell_max_budget =
1166				cpu_to_le16(IWL_MVM_ADWELL_MAX_BUDGET);
1167		else if (params->ssids && params->ssids[0].ssid_len)
1168			cmd->v7.adwell_max_budget =
1169				cpu_to_le16(IWL_SCAN_ADWELL_MAX_BUDGET_DIRECTED_SCAN);
1170		else
1171			cmd->v7.adwell_max_budget =
1172				cpu_to_le16(IWL_SCAN_ADWELL_MAX_BUDGET_FULL_SCAN);
1173
1174		cmd->v7.scan_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1175		cmd->v7.max_out_time[SCAN_LB_LMAC_IDX] =
1176			cpu_to_le32(timing->max_out_time);
1177		cmd->v7.suspend_time[SCAN_LB_LMAC_IDX] =
1178			cpu_to_le32(timing->suspend_time);
1179
1180		if (iwl_mvm_is_cdb_supported(mvm)) {
1181			hb_timing = &scan_timing[params->type];
1182
1183			cmd->v7.max_out_time[SCAN_HB_LMAC_IDX] =
1184				cpu_to_le32(hb_timing->max_out_time);
1185			cmd->v7.suspend_time[SCAN_HB_LMAC_IDX] =
1186				cpu_to_le32(hb_timing->suspend_time);
1187		}
1188
1189		if (!iwl_mvm_is_adaptive_dwell_v2_supported(mvm)) {
1190			cmd->v7.active_dwell = active_dwell;
1191			cmd->v7.passive_dwell = passive_dwell;
1192			cmd->v7.fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
1193		} else {
1194			cmd->v8.active_dwell[SCAN_LB_LMAC_IDX] = active_dwell;
1195			cmd->v8.passive_dwell[SCAN_LB_LMAC_IDX] = passive_dwell;
1196			if (iwl_mvm_is_cdb_supported(mvm)) {
1197				cmd->v8.active_dwell[SCAN_HB_LMAC_IDX] =
1198					active_dwell;
1199				cmd->v8.passive_dwell[SCAN_HB_LMAC_IDX] =
1200					passive_dwell;
1201			}
1202		}
1203	} else {
1204		cmd->v1.extended_dwell = params->measurement_dwell ?
1205			params->measurement_dwell : IWL_SCAN_DWELL_EXTENDED;
1206		cmd->v1.active_dwell = active_dwell;
1207		cmd->v1.passive_dwell = passive_dwell;
1208		cmd->v1.fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
1209
1210		if (iwl_mvm_is_cdb_supported(mvm)) {
1211			hb_timing = &scan_timing[params->type];
1212
1213			cmd->v6.max_out_time[SCAN_HB_LMAC_IDX] =
1214					cpu_to_le32(hb_timing->max_out_time);
1215			cmd->v6.suspend_time[SCAN_HB_LMAC_IDX] =
1216					cpu_to_le32(hb_timing->suspend_time);
1217		}
1218
1219		if (iwl_mvm_has_new_tx_api(mvm)) {
1220			cmd->v6.scan_priority =
1221				cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1222			cmd->v6.max_out_time[SCAN_LB_LMAC_IDX] =
1223				cpu_to_le32(timing->max_out_time);
1224			cmd->v6.suspend_time[SCAN_LB_LMAC_IDX] =
1225				cpu_to_le32(timing->suspend_time);
1226		} else {
1227			cmd->v1.scan_priority =
1228				cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1229			cmd->v1.max_out_time =
1230				cpu_to_le32(timing->max_out_time);
1231			cmd->v1.suspend_time =
1232				cpu_to_le32(timing->suspend_time);
1233		}
1234	}
1235}
1236
1237static void
1238iwl_mvm_umac_scan_cfg_channels(struct iwl_mvm *mvm,
1239			       struct ieee80211_channel **channels,
1240			       int n_channels, u32 ssid_bitmap,
1241			       struct iwl_scan_channel_cfg_umac *channel_cfg)
1242{
 
1243	int i;
1244
1245	for (i = 0; i < n_channels; i++) {
1246		channel_cfg[i].flags = cpu_to_le32(ssid_bitmap);
1247		channel_cfg[i].channel_num = channels[i]->hw_value;
1248		channel_cfg[i].iter_count = 1;
1249		channel_cfg[i].iter_interval = 0;
1250	}
1251}
1252
1253static u16 iwl_mvm_scan_umac_flags(struct iwl_mvm *mvm,
1254				   struct iwl_mvm_scan_params *params,
1255				   struct ieee80211_vif *vif)
1256{
1257	u16 flags = 0;
1258
1259	if (params->n_ssids == 0)
1260		flags = IWL_UMAC_SCAN_GEN_FLAGS_PASSIVE;
1261
1262	if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
1263		flags |= IWL_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT;
1264
1265	if (params->type == IWL_SCAN_TYPE_FRAGMENTED) {
1266		flags |= IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED;
1267		if (iwl_mvm_is_cdb_supported(mvm))
1268			flags |= IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED;
1269	}
1270
1271	if (iwl_mvm_rrm_scan_needed(mvm) &&
1272	    fw_has_capa(&mvm->fw->ucode_capa,
1273			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
1274		flags |= IWL_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED;
1275
1276	if (params->pass_all)
1277		flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
1278	else
1279		flags |= IWL_UMAC_SCAN_GEN_FLAGS_MATCH;
1280
1281	if (!iwl_mvm_is_regular_scan(params))
1282		flags |= IWL_UMAC_SCAN_GEN_FLAGS_PERIODIC;
1283
1284	if (params->measurement_dwell)
1285		flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1286
1287#ifdef CONFIG_IWLWIFI_DEBUGFS
1288	if (mvm->scan_iter_notif_enabled)
1289		flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1290#endif
1291
1292	if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
1293		flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1294
1295	if (iwl_mvm_is_adaptive_dwell_supported(mvm) && IWL_MVM_ADWELL_ENABLE &&
1296	    vif->type != NL80211_IFTYPE_P2P_DEVICE)
1297		flags |= IWL_UMAC_SCAN_GEN_FLAGS_ADAPTIVE_DWELL;
1298
1299	/*
1300	 * Extended dwell is relevant only for low band to start with, as it is
1301	 * being used for social channles only (1, 6, 11), so we can check
1302	 * only scan type on low band also for CDB.
1303	 */
1304	if (iwl_mvm_is_regular_scan(params) &&
1305	    vif->type != NL80211_IFTYPE_P2P_DEVICE &&
1306	    params->type != IWL_SCAN_TYPE_FRAGMENTED &&
1307	    !iwl_mvm_is_adaptive_dwell_supported(mvm) &&
1308	    !iwl_mvm_is_oce_supported(mvm))
1309		flags |= IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL;
1310
1311	if (iwl_mvm_is_oce_supported(mvm)) {
1312		if ((params->flags &
1313		     NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE))
1314			flags |= IWL_UMAC_SCAN_GEN_FLAGS_PROB_REQ_HIGH_TX_RATE;
1315		/* Since IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL and
1316		 * NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION shares
1317		 * the same bit, we need to make sure that we use this bit here
1318		 * only when IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL cannot be
1319		 * used. */
1320		if ((params->flags &
1321		     NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) &&
1322		     !WARN_ON_ONCE(!iwl_mvm_is_adaptive_dwell_supported(mvm)))
1323			flags |= IWL_UMAC_SCAN_GEN_FLAGS_PROB_REQ_DEFER_SUPP;
1324		if ((params->flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME))
1325			flags |= IWL_UMAC_SCAN_GEN_FLAGS_MAX_CHNL_TIME;
1326	}
1327
1328	return flags;
1329}
1330
1331static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1332			     struct iwl_mvm_scan_params *params,
1333			     int type)
1334{
1335	struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
1336	struct iwl_scan_umac_chan_param *chan_param;
1337	void *cmd_data = iwl_mvm_get_scan_req_umac_data(mvm);
1338	struct iwl_scan_req_umac_tail *sec_part = cmd_data +
1339		sizeof(struct iwl_scan_channel_cfg_umac) *
1340			mvm->fw->ucode_capa.n_scan_channels;
1341	int uid, i;
1342	u32 ssid_bitmap = 0;
1343	u8 channel_flags = 0;
1344	u16 gen_flags;
1345	struct iwl_mvm_vif *scan_vif = iwl_mvm_vif_from_mac80211(vif);
1346
1347	chan_param = iwl_mvm_get_scan_req_umac_channel(mvm);
1348
1349	lockdep_assert_held(&mvm->mutex);
1350
1351	if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
1352		return -EINVAL;
1353
1354	uid = iwl_mvm_scan_uid_by_status(mvm, 0);
1355	if (uid < 0)
1356		return uid;
1357
1358	memset(cmd, 0, ksize(cmd));
1359
1360	iwl_mvm_scan_umac_dwell(mvm, cmd, params);
1361
1362	mvm->scan_uid_status[uid] = type;
1363
1364	cmd->uid = cpu_to_le32(uid);
1365	gen_flags = iwl_mvm_scan_umac_flags(mvm, params, vif);
1366	cmd->general_flags = cpu_to_le16(gen_flags);
1367	if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm)) {
1368		if (gen_flags & IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED)
1369			cmd->v8.num_of_fragments[SCAN_LB_LMAC_IDX] =
1370							IWL_SCAN_NUM_OF_FRAGS;
1371		if (gen_flags & IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED)
1372			cmd->v8.num_of_fragments[SCAN_HB_LMAC_IDX] =
1373							IWL_SCAN_NUM_OF_FRAGS;
1374	}
1375
1376	cmd->scan_start_mac_id = scan_vif->id;
1377
1378	if (type == IWL_MVM_SCAN_SCHED || type == IWL_MVM_SCAN_NETDETECT)
1379		cmd->flags = cpu_to_le32(IWL_UMAC_SCAN_FLAG_PREEMPTIVE);
1380
1381	if (iwl_mvm_scan_use_ebs(mvm, vif))
1382		channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
1383				IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1384				IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
1385
1386	chan_param->flags = channel_flags;
1387	chan_param->count = params->n_channels;
1388
1389	iwl_scan_build_ssids(params, sec_part->direct_scan, &ssid_bitmap);
1390
1391	iwl_mvm_umac_scan_cfg_channels(mvm, params->channels,
1392				       params->n_channels, ssid_bitmap,
1393				       cmd_data);
1394
1395	for (i = 0; i < params->n_scan_plans; i++) {
1396		struct cfg80211_sched_scan_plan *scan_plan =
1397			&params->scan_plans[i];
1398
1399		sec_part->schedule[i].iter_count = scan_plan->iterations;
1400		sec_part->schedule[i].interval =
1401			cpu_to_le16(scan_plan->interval);
1402	}
1403
1404	/*
1405	 * If the number of iterations of the last scan plan is set to
1406	 * zero, it should run infinitely. However, this is not always the case.
1407	 * For example, when regular scan is requested the driver sets one scan
1408	 * plan with one iteration.
1409	 */
1410	if (!sec_part->schedule[i - 1].iter_count)
1411		sec_part->schedule[i - 1].iter_count = 0xff;
1412
1413	sec_part->delay = cpu_to_le16(params->delay);
1414	sec_part->preq = params->preq;
1415
1416	return 0;
1417}
1418
1419static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
1420{
1421	return hweight32(mvm->scan_status & IWL_MVM_SCAN_MASK);
1422}
1423
1424static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
1425{
1426	bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
1427					 IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
1428
1429	/* This looks a bit arbitrary, but the idea is that if we run
1430	 * out of possible simultaneous scans and the userspace is
1431	 * trying to run a scan type that is already running, we
1432	 * return -EBUSY.  But if the userspace wants to start a
1433	 * different type of scan, we stop the opposite type to make
1434	 * space for the new request.  The reason is backwards
1435	 * compatibility with old wpa_supplicant that wouldn't stop a
1436	 * scheduled scan before starting a normal scan.
1437	 */
1438
1439	if (iwl_mvm_num_scans(mvm) < mvm->max_scans)
1440		return 0;
1441
1442	/* Use a switch, even though this is a bitmask, so that more
1443	 * than one bits set will fall in default and we will warn.
1444	 */
1445	switch (type) {
1446	case IWL_MVM_SCAN_REGULAR:
1447		if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1448			return -EBUSY;
1449		return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
1450	case IWL_MVM_SCAN_SCHED:
1451		if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1452			return -EBUSY;
1453		return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
1454	case IWL_MVM_SCAN_NETDETECT:
1455		/* For non-unified images, there's no need to stop
1456		 * anything for net-detect since the firmware is
1457		 * restarted anyway.  This way, any sched scans that
1458		 * were running will be restarted when we resume.
1459		 */
1460		if (!unified_image)
1461			return 0;
1462
1463		/* If this is a unified image and we ran out of scans,
1464		 * we need to stop something.  Prefer stopping regular
1465		 * scans, because the results are useless at this
1466		 * point, and we should be able to keep running
1467		 * another scheduled scan while suspended.
1468		 */
1469		if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1470			return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR,
1471						 true);
1472		if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1473			return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
1474						 true);
1475
1476		/* fall through, something is wrong if no scan was
1477		 * running but we ran out of scans.
1478		 */
1479	default:
1480		WARN_ON(1);
1481		break;
1482	}
1483
1484	return -EIO;
1485}
1486
1487#define SCAN_TIMEOUT 20000
1488
1489void iwl_mvm_scan_timeout_wk(struct work_struct *work)
1490{
1491	struct delayed_work *delayed_work = to_delayed_work(work);
1492	struct iwl_mvm *mvm = container_of(delayed_work, struct iwl_mvm,
1493					   scan_timeout_dwork);
1494
1495	IWL_ERR(mvm, "regular scan timed out\n");
1496
1497	iwl_force_nmi(mvm->trans);
1498}
1499
1500int iwl_mvm_reg_scan_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1501			   struct cfg80211_scan_request *req,
1502			   struct ieee80211_scan_ies *ies)
1503{
1504	struct iwl_host_cmd hcmd = {
1505		.len = { iwl_mvm_scan_size(mvm), },
1506		.data = { mvm->scan_cmd, },
1507		.dataflags = { IWL_HCMD_DFL_NOCOPY, },
1508	};
1509	struct iwl_mvm_scan_params params = {};
1510	int ret;
1511	struct cfg80211_sched_scan_plan scan_plan = { .iterations = 1 };
1512
1513	lockdep_assert_held(&mvm->mutex);
1514
1515	if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1516		IWL_ERR(mvm, "scan while LAR regdomain is not set\n");
1517		return -EBUSY;
1518	}
1519
1520	ret = iwl_mvm_check_running_scans(mvm, IWL_MVM_SCAN_REGULAR);
1521	if (ret)
1522		return ret;
1523
1524	/* we should have failed registration if scan_cmd was NULL */
1525	if (WARN_ON(!mvm->scan_cmd))
1526		return -ENOMEM;
1527
1528	if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1529		return -ENOBUFS;
1530
1531	params.n_ssids = req->n_ssids;
1532	params.flags = req->flags;
1533	params.n_channels = req->n_channels;
1534	params.delay = 0;
1535	params.ssids = req->ssids;
1536	params.channels = req->channels;
1537	params.mac_addr = req->mac_addr;
1538	params.mac_addr_mask = req->mac_addr_mask;
1539	params.no_cck = req->no_cck;
1540	params.pass_all = true;
1541	params.n_match_sets = 0;
1542	params.match_sets = NULL;
1543
1544	params.scan_plans = &scan_plan;
1545	params.n_scan_plans = 1;
1546
1547	params.type =
1548		iwl_mvm_get_scan_type(mvm,
1549				      vif->type == NL80211_IFTYPE_P2P_DEVICE);
1550
1551	ret = iwl_mvm_get_measurement_dwell(mvm, req, &params);
1552	if (ret < 0)
1553		return ret;
1554
1555	params.measurement_dwell = ret;
1556
1557	iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1558
1559	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1560		hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1561		ret = iwl_mvm_scan_umac(mvm, vif, &params,
1562					IWL_MVM_SCAN_REGULAR);
1563	} else {
1564		hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1565		ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1566	}
1567
1568	if (ret)
1569		return ret;
1570
1571	ret = iwl_mvm_send_cmd(mvm, &hcmd);
1572	if (ret) {
1573		/* If the scan failed, it usually means that the FW was unable
1574		 * to allocate the time events. Warn on it, but maybe we
1575		 * should try to send the command again with different params.
1576		 */
1577		IWL_ERR(mvm, "Scan failed! ret %d\n", ret);
1578		return ret;
1579	}
1580
1581	IWL_DEBUG_SCAN(mvm, "Scan request was sent successfully\n");
1582	mvm->scan_status |= IWL_MVM_SCAN_REGULAR;
1583	mvm->scan_vif = iwl_mvm_vif_from_mac80211(vif);
1584	iwl_mvm_ref(mvm, IWL_MVM_REF_SCAN);
1585
1586	schedule_delayed_work(&mvm->scan_timeout_dwork,
1587			      msecs_to_jiffies(SCAN_TIMEOUT));
1588
1589	return 0;
1590}
1591
1592int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
1593			     struct ieee80211_vif *vif,
1594			     struct cfg80211_sched_scan_request *req,
1595			     struct ieee80211_scan_ies *ies,
1596			     int type)
1597{
1598	struct iwl_host_cmd hcmd = {
1599		.len = { iwl_mvm_scan_size(mvm), },
1600		.data = { mvm->scan_cmd, },
1601		.dataflags = { IWL_HCMD_DFL_NOCOPY, },
1602	};
1603	struct iwl_mvm_scan_params params = {};
1604	int ret;
1605
1606	lockdep_assert_held(&mvm->mutex);
1607
1608	if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1609		IWL_ERR(mvm, "sched-scan while LAR regdomain is not set\n");
1610		return -EBUSY;
1611	}
1612
1613	ret = iwl_mvm_check_running_scans(mvm, type);
1614	if (ret)
1615		return ret;
1616
1617	/* we should have failed registration if scan_cmd was NULL */
1618	if (WARN_ON(!mvm->scan_cmd))
1619		return -ENOMEM;
1620
1621	if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1622		return -ENOBUFS;
1623
1624	params.n_ssids = req->n_ssids;
1625	params.flags = req->flags;
1626	params.n_channels = req->n_channels;
1627	params.ssids = req->ssids;
1628	params.channels = req->channels;
1629	params.mac_addr = req->mac_addr;
1630	params.mac_addr_mask = req->mac_addr_mask;
1631	params.no_cck = false;
1632	params.pass_all =  iwl_mvm_scan_pass_all(mvm, req);
1633	params.n_match_sets = req->n_match_sets;
1634	params.match_sets = req->match_sets;
1635	if (!req->n_scan_plans)
1636		return -EINVAL;
1637
1638	params.n_scan_plans = req->n_scan_plans;
1639	params.scan_plans = req->scan_plans;
1640
1641	params.type =
1642		iwl_mvm_get_scan_type(mvm,
1643				      vif->type == NL80211_IFTYPE_P2P_DEVICE);
1644
1645	/* In theory, LMAC scans can handle a 32-bit delay, but since
1646	 * waiting for over 18 hours to start the scan is a bit silly
1647	 * and to keep it aligned with UMAC scans (which only support
1648	 * 16-bit delays), trim it down to 16-bits.
1649	 */
1650	if (req->delay > U16_MAX) {
1651		IWL_DEBUG_SCAN(mvm,
1652			       "delay value is > 16-bits, set to max possible\n");
1653		params.delay = U16_MAX;
1654	} else {
1655		params.delay = req->delay;
1656	}
1657
1658	ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
1659	if (ret)
1660		return ret;
1661
1662	iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1663
1664	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1665		hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1666		ret = iwl_mvm_scan_umac(mvm, vif, &params, type);
1667	} else {
1668		hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1669		ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1670	}
1671
1672	if (ret)
1673		return ret;
1674
1675	ret = iwl_mvm_send_cmd(mvm, &hcmd);
1676	if (!ret) {
1677		IWL_DEBUG_SCAN(mvm,
1678			       "Sched scan request was sent successfully\n");
1679		mvm->scan_status |= type;
1680	} else {
1681		/* If the scan failed, it usually means that the FW was unable
1682		 * to allocate the time events. Warn on it, but maybe we
1683		 * should try to send the command again with different params.
1684		 */
1685		IWL_ERR(mvm, "Sched scan failed! ret %d\n", ret);
1686	}
1687
1688	return ret;
1689}
1690
1691void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
1692					 struct iwl_rx_cmd_buffer *rxb)
1693{
1694	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1695	struct iwl_umac_scan_complete *notif = (void *)pkt->data;
1696	u32 uid = __le32_to_cpu(notif->uid);
1697	bool aborted = (notif->status == IWL_SCAN_OFFLOAD_ABORTED);
1698
1699	if (WARN_ON(!(mvm->scan_uid_status[uid] & mvm->scan_status)))
1700		return;
1701
1702	/* if the scan is already stopping, we don't need to notify mac80211 */
1703	if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_REGULAR) {
1704		struct cfg80211_scan_info info = {
1705			.aborted = aborted,
1706			.scan_start_tsf = mvm->scan_start,
1707		};
1708
1709		memcpy(info.tsf_bssid, mvm->scan_vif->bssid, ETH_ALEN);
1710		ieee80211_scan_completed(mvm->hw, &info);
1711		mvm->scan_vif = NULL;
1712		iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1713		cancel_delayed_work(&mvm->scan_timeout_dwork);
1714	} else if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_SCHED) {
1715		ieee80211_sched_scan_stopped(mvm->hw);
1716		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1717	}
1718
1719	mvm->scan_status &= ~mvm->scan_uid_status[uid];
1720	IWL_DEBUG_SCAN(mvm,
1721		       "Scan completed, uid %u type %u, status %s, EBS status %s\n",
1722		       uid, mvm->scan_uid_status[uid],
1723		       notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
1724				"completed" : "aborted",
1725		       iwl_mvm_ebs_status_str(notif->ebs_status));
1726	IWL_DEBUG_SCAN(mvm,
1727		       "Last line %d, Last iteration %d, Time from last iteration %d\n",
1728		       notif->last_schedule, notif->last_iter,
1729		       __le32_to_cpu(notif->time_from_last_iter));
1730
1731	if (notif->ebs_status != IWL_SCAN_EBS_SUCCESS &&
1732	    notif->ebs_status != IWL_SCAN_EBS_INACTIVE)
1733		mvm->last_ebs_successful = false;
1734
1735	mvm->scan_uid_status[uid] = 0;
1736}
1737
1738void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
1739					      struct iwl_rx_cmd_buffer *rxb)
1740{
1741	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1742	struct iwl_umac_scan_iter_complete_notif *notif = (void *)pkt->data;
1743
1744	mvm->scan_start = le64_to_cpu(notif->start_tsf);
1745
1746	IWL_DEBUG_SCAN(mvm,
1747		       "UMAC Scan iteration complete: status=0x%x scanned_channels=%d\n",
1748		       notif->status, notif->scanned_channels);
 
 
 
1749
1750	if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
1751		IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
1752		ieee80211_sched_scan_results(mvm->hw);
1753		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
1754	}
1755
1756	IWL_DEBUG_SCAN(mvm,
1757		       "UMAC Scan iteration complete: scan started at %llu (TSF)\n",
1758		       mvm->scan_start);
1759}
1760
1761static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type)
1762{
1763	struct iwl_umac_scan_abort cmd = {};
1764	int uid, ret;
1765
1766	lockdep_assert_held(&mvm->mutex);
1767
1768	/* We should always get a valid index here, because we already
1769	 * checked that this type of scan was running in the generic
1770	 * code.
1771	 */
1772	uid = iwl_mvm_scan_uid_by_status(mvm, type);
1773	if (WARN_ON_ONCE(uid < 0))
1774		return uid;
1775
1776	cmd.uid = cpu_to_le32(uid);
1777
1778	IWL_DEBUG_SCAN(mvm, "Sending scan abort, uid %u\n", uid);
1779
1780	ret = iwl_mvm_send_cmd_pdu(mvm,
1781				   iwl_cmd_id(SCAN_ABORT_UMAC,
1782					      IWL_ALWAYS_LONG_GROUP, 0),
1783				   0, sizeof(cmd), &cmd);
1784	if (!ret)
1785		mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT;
1786
1787	return ret;
1788}
1789
1790static int iwl_mvm_scan_stop_wait(struct iwl_mvm *mvm, int type)
1791{
1792	struct iwl_notification_wait wait_scan_done;
1793	static const u16 scan_done_notif[] = { SCAN_COMPLETE_UMAC,
1794					      SCAN_OFFLOAD_COMPLETE, };
1795	int ret;
1796
1797	lockdep_assert_held(&mvm->mutex);
1798
1799	iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
1800				   scan_done_notif,
1801				   ARRAY_SIZE(scan_done_notif),
1802				   NULL, NULL);
1803
1804	IWL_DEBUG_SCAN(mvm, "Preparing to stop scan, type %x\n", type);
1805
1806	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1807		ret = iwl_mvm_umac_scan_abort(mvm, type);
1808	else
1809		ret = iwl_mvm_lmac_scan_abort(mvm);
1810
1811	if (ret) {
1812		IWL_DEBUG_SCAN(mvm, "couldn't stop scan type %d\n", type);
1813		iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
1814		return ret;
1815	}
1816
1817	ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
1818
1819	return ret;
1820}
1821
1822int iwl_mvm_scan_size(struct iwl_mvm *mvm)
1823{
1824	int base_size = IWL_SCAN_REQ_UMAC_SIZE_V1;
1825
1826	if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm))
1827		base_size = IWL_SCAN_REQ_UMAC_SIZE_V8;
1828	else if (iwl_mvm_is_adaptive_dwell_supported(mvm))
1829		base_size = IWL_SCAN_REQ_UMAC_SIZE_V7;
1830	else if (iwl_mvm_has_new_tx_api(mvm))
1831		base_size = IWL_SCAN_REQ_UMAC_SIZE_V6;
1832
1833	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1834		return base_size +
1835			sizeof(struct iwl_scan_channel_cfg_umac) *
1836				mvm->fw->ucode_capa.n_scan_channels +
1837			sizeof(struct iwl_scan_req_umac_tail);
1838
1839	return sizeof(struct iwl_scan_req_lmac) +
1840		sizeof(struct iwl_scan_channel_cfg_lmac) *
1841		mvm->fw->ucode_capa.n_scan_channels +
1842		sizeof(struct iwl_scan_probe_req);
1843}
1844
1845/*
1846 * This function is used in nic restart flow, to inform mac80211 about scans
1847 * that was aborted by restart flow or by an assert.
1848 */
1849void iwl_mvm_report_scan_aborted(struct iwl_mvm *mvm)
1850{
1851	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1852		int uid, i;
1853
1854		uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_REGULAR);
1855		if (uid >= 0) {
1856			struct cfg80211_scan_info info = {
1857				.aborted = true,
1858			};
1859
1860			ieee80211_scan_completed(mvm->hw, &info);
1861			mvm->scan_uid_status[uid] = 0;
1862		}
1863		uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_SCHED);
1864		if (uid >= 0 && !mvm->fw_restart) {
1865			ieee80211_sched_scan_stopped(mvm->hw);
1866			mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1867			mvm->scan_uid_status[uid] = 0;
1868		}
1869
1870		/* We shouldn't have any UIDs still set.  Loop over all the
1871		 * UIDs to make sure there's nothing left there and warn if
1872		 * any is found.
1873		 */
1874		for (i = 0; i < mvm->max_scans; i++) {
1875			if (WARN_ONCE(mvm->scan_uid_status[i],
1876				      "UMAC scan UID %d status was not cleaned\n",
1877				      i))
1878				mvm->scan_uid_status[i] = 0;
1879		}
1880	} else {
1881		if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
1882			struct cfg80211_scan_info info = {
1883				.aborted = true,
1884			};
1885
1886			ieee80211_scan_completed(mvm->hw, &info);
1887		}
1888
1889		/* Sched scan will be restarted by mac80211 in
1890		 * restart_hw, so do not report if FW is about to be
1891		 * restarted.
1892		 */
1893		if ((mvm->scan_status & IWL_MVM_SCAN_SCHED) &&
1894		    !mvm->fw_restart) {
1895			ieee80211_sched_scan_stopped(mvm->hw);
1896			mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1897		}
1898	}
1899}
1900
1901int iwl_mvm_scan_stop(struct iwl_mvm *mvm, int type, bool notify)
1902{
1903	int ret;
1904
1905	if (!(mvm->scan_status & type))
1906		return 0;
1907
1908	if (iwl_mvm_is_radio_killed(mvm)) {
1909		ret = 0;
1910		goto out;
1911	}
1912
1913	ret = iwl_mvm_scan_stop_wait(mvm, type);
1914	if (!ret)
1915		mvm->scan_status |= type << IWL_MVM_SCAN_STOPPING_SHIFT;
1916out:
1917	/* Clear the scan status so the next scan requests will
1918	 * succeed and mark the scan as stopping, so that the Rx
1919	 * handler doesn't do anything, as the scan was stopped from
1920	 * above.
1921	 */
1922	mvm->scan_status &= ~type;
1923
1924	if (type == IWL_MVM_SCAN_REGULAR) {
1925		/* Since the rx handler won't do anything now, we have
1926		 * to release the scan reference here.
1927		 */
1928		iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1929		cancel_delayed_work(&mvm->scan_timeout_dwork);
1930		if (notify) {
1931			struct cfg80211_scan_info info = {
1932				.aborted = true,
1933			};
1934
1935			ieee80211_scan_completed(mvm->hw, &info);
1936		}
1937	} else if (notify) {
1938		ieee80211_sched_scan_stopped(mvm->hw);
1939		mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1940	}
1941
1942	return ret;
1943}