1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Scanning implementation
   4 *
   5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   6 * Copyright 2004, Instant802 Networks, Inc.
   7 * Copyright 2005, Devicescape Software, Inc.
   8 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
   9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  10 * Copyright 2013-2015  Intel Mobile Communications GmbH
  11 * Copyright 2016-2017  Intel Deutschland GmbH
  12 * Copyright (C) 2018-2024 Intel Corporation
  13 */
  14
  15#include <linux/if_arp.h>
  16#include <linux/etherdevice.h>
  17#include <linux/rtnetlink.h>
  18#include <net/sch_generic.h>
  19#include <linux/slab.h>
  20#include <linux/export.h>
  21#include <linux/random.h>
  22#include <net/mac80211.h>
  23
  24#include "ieee80211_i.h"
  25#include "driver-ops.h"
  26#include "mesh.h"
  27
  28#define IEEE80211_PROBE_DELAY (HZ / 33)
  29#define IEEE80211_CHANNEL_TIME (HZ / 33)
  30#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9)
  31
  32void ieee80211_rx_bss_put(struct ieee80211_local *local,
  33			  struct ieee80211_bss *bss)
  34{
  35	if (!bss)
  36		return;
  37	cfg80211_put_bss(local->hw.wiphy,
  38			 container_of((void *)bss, struct cfg80211_bss, priv));
  39}
  40
  41static bool is_uapsd_supported(struct ieee802_11_elems *elems)
  42{
  43	u8 qos_info;
  44
  45	if (elems->wmm_info && elems->wmm_info_len == 7
  46	    && elems->wmm_info[5] == 1)
  47		qos_info = elems->wmm_info[6];
  48	else if (elems->wmm_param && elems->wmm_param_len == 24
  49		 && elems->wmm_param[5] == 1)
  50		qos_info = elems->wmm_param[6];
  51	else
  52		/* no valid wmm information or parameter element found */
  53		return false;
  54
  55	return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD;
  56}
  57
  58struct inform_bss_update_data {
  59	struct ieee80211_rx_status *rx_status;
  60	bool beacon;
  61};
  62
  63void ieee80211_inform_bss(struct wiphy *wiphy,
  64			  struct cfg80211_bss *cbss,
  65			  const struct cfg80211_bss_ies *ies,
  66			  void *data)
  67{
  68	struct ieee80211_local *local = wiphy_priv(wiphy);
  69	struct inform_bss_update_data *update_data = data;
  70	struct ieee80211_bss *bss = (void *)cbss->priv;
  71	struct ieee80211_rx_status *rx_status;
  72	struct ieee802_11_elems *elems;
  73	int clen, srlen;
  74
  75	/* This happens while joining an IBSS */
  76	if (!update_data)
  77		return;
  78
  79	elems = ieee802_11_parse_elems(ies->data, ies->len, false, NULL);
  80	if (!elems)
  81		return;
  82
  83	rx_status = update_data->rx_status;
  84
  85	if (update_data->beacon)
  86		bss->device_ts_beacon = rx_status->device_timestamp;
  87	else
  88		bss->device_ts_presp = rx_status->device_timestamp;
  89
  90	if (elems->parse_error) {
  91		if (update_data->beacon)
  92			bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON;
  93		else
  94			bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP;
  95	} else {
  96		if (update_data->beacon)
  97			bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON;
  98		else
  99			bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP;
 100	}
 101
 102	/* save the ERP value so that it is available at association time */
 103	if (elems->erp_info && (!elems->parse_error ||
 104				!(bss->valid_data & IEEE80211_BSS_VALID_ERP))) {
 105		bss->erp_value = elems->erp_info[0];
 106		bss->has_erp_value = true;
 107		if (!elems->parse_error)
 108			bss->valid_data |= IEEE80211_BSS_VALID_ERP;
 109	}
 110
 111	/* replace old supported rates if we get new values */
 112	if (!elems->parse_error ||
 113	    !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
 114		srlen = 0;
 115		if (elems->supp_rates) {
 116			clen = IEEE80211_MAX_SUPP_RATES;
 117			if (clen > elems->supp_rates_len)
 118				clen = elems->supp_rates_len;
 119			memcpy(bss->supp_rates, elems->supp_rates, clen);
 120			srlen += clen;
 121		}
 122		if (elems->ext_supp_rates) {
 123			clen = IEEE80211_MAX_SUPP_RATES - srlen;
 124			if (clen > elems->ext_supp_rates_len)
 125				clen = elems->ext_supp_rates_len;
 126			memcpy(bss->supp_rates + srlen, elems->ext_supp_rates,
 127			       clen);
 128			srlen += clen;
 129		}
 130		if (srlen) {
 131			bss->supp_rates_len = srlen;
 132			if (!elems->parse_error)
 133				bss->valid_data |= IEEE80211_BSS_VALID_RATES;
 134		}
 135	}
 136
 137	if (!elems->parse_error ||
 138	    !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) {
 139		bss->wmm_used = elems->wmm_param || elems->wmm_info;
 140		bss->uapsd_supported = is_uapsd_supported(elems);
 141		if (!elems->parse_error)
 142			bss->valid_data |= IEEE80211_BSS_VALID_WMM;
 143	}
 144
 145	if (update_data->beacon) {
 146		struct ieee80211_supported_band *sband =
 147			local->hw.wiphy->bands[rx_status->band];
 148		if (!(rx_status->encoding == RX_ENC_HT) &&
 149		    !(rx_status->encoding == RX_ENC_VHT))
 150			bss->beacon_rate =
 151				&sband->bitrates[rx_status->rate_idx];
 152	}
 153
 154	if (elems->vht_cap_elem)
 155		bss->vht_cap_info =
 156			le32_to_cpu(elems->vht_cap_elem->vht_cap_info);
 157	else
 158		bss->vht_cap_info = 0;
 159
 160	kfree(elems);
 161}
 162
 163struct ieee80211_bss *
 164ieee80211_bss_info_update(struct ieee80211_local *local,
 165			  struct ieee80211_rx_status *rx_status,
 166			  struct ieee80211_mgmt *mgmt, size_t len,
 167			  struct ieee80211_channel *channel)
 168{
 169	bool beacon = ieee80211_is_beacon(mgmt->frame_control) ||
 170		      ieee80211_is_s1g_beacon(mgmt->frame_control);
 171	struct cfg80211_bss *cbss;
 172	struct inform_bss_update_data update_data = {
 173		.rx_status = rx_status,
 174		.beacon = beacon,
 175	};
 176	struct cfg80211_inform_bss bss_meta = {
 177		.boottime_ns = rx_status->boottime_ns,
 178		.drv_data = (void *)&update_data,
 179	};
 180	bool signal_valid;
 181	struct ieee80211_sub_if_data *scan_sdata;
 182
 183	if (rx_status->flag & RX_FLAG_NO_SIGNAL_VAL)
 184		bss_meta.signal = 0; /* invalid signal indication */
 185	else if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
 186		bss_meta.signal = rx_status->signal * 100;
 187	else if (ieee80211_hw_check(&local->hw, SIGNAL_UNSPEC))
 188		bss_meta.signal = (rx_status->signal * 100) / local->hw.max_signal;
 189
 190	bss_meta.chan = channel;
 191
 192	rcu_read_lock();
 193	scan_sdata = rcu_dereference(local->scan_sdata);
 194	if (scan_sdata && scan_sdata->vif.type == NL80211_IFTYPE_STATION &&
 195	    scan_sdata->vif.cfg.assoc &&
 196	    ieee80211_have_rx_timestamp(rx_status)) {
 197		struct ieee80211_bss_conf *link_conf = NULL;
 198
 199		/* for an MLO connection, set the TSF data only in case we have
 200		 * an indication on which of the links the frame was received
 201		 */
 202		if (ieee80211_vif_is_mld(&scan_sdata->vif)) {
 203			if (rx_status->link_valid) {
 204				s8 link_id = rx_status->link_id;
 205
 206				link_conf =
 207					rcu_dereference(scan_sdata->vif.link_conf[link_id]);
 208			}
 209		} else {
 210			link_conf = &scan_sdata->vif.bss_conf;
 211		}
 212
 213		if (link_conf) {
 214			bss_meta.parent_tsf =
 215				ieee80211_calculate_rx_timestamp(local,
 216								 rx_status,
 217								 len + FCS_LEN,
 218								 24);
 219
 220			ether_addr_copy(bss_meta.parent_bssid,
 221					link_conf->bssid);
 222		}
 223	}
 224	rcu_read_unlock();
 225
 226	cbss = cfg80211_inform_bss_frame_data(local->hw.wiphy, &bss_meta,
 227					      mgmt, len, GFP_ATOMIC);
 228	if (!cbss)
 229		return NULL;
 230
 231	/* In case the signal is invalid update the status */
 232	signal_valid = channel == cbss->channel;
 233	if (!signal_valid)
 234		rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
 235
 236	return (void *)cbss->priv;
 237}
 238
 239static bool ieee80211_scan_accept_presp(struct ieee80211_sub_if_data *sdata,
 240					struct ieee80211_channel *channel,
 241					u32 scan_flags, const u8 *da)
 242{
 243	if (!sdata)
 244		return false;
 245
 246	/* accept broadcast on 6 GHz and for OCE */
 247	if (is_broadcast_ether_addr(da) &&
 248	    (channel->band == NL80211_BAND_6GHZ ||
 249	     scan_flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP))
 250		return true;
 251
 252	if (scan_flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
 253		return true;
 254	return ether_addr_equal(da, sdata->vif.addr);
 255}
 256
 257void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
 258{
 259	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
 260	struct ieee80211_mgmt *mgmt = (void *)skb->data;
 261	struct ieee80211_bss *bss;
 262	struct ieee80211_channel *channel;
 263	size_t min_hdr_len = offsetof(struct ieee80211_mgmt,
 264				      u.probe_resp.variable);
 265
 266	if (!ieee80211_is_probe_resp(mgmt->frame_control) &&
 267	    !ieee80211_is_beacon(mgmt->frame_control) &&
 268	    !ieee80211_is_s1g_beacon(mgmt->frame_control))
 269		return;
 270
 271	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
 272		if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
 273			min_hdr_len = offsetof(struct ieee80211_ext,
 274					       u.s1g_short_beacon.variable);
 275		else
 276			min_hdr_len = offsetof(struct ieee80211_ext,
 277					       u.s1g_beacon);
 278	}
 279
 280	if (skb->len < min_hdr_len)
 281		return;
 282
 283	if (test_and_clear_bit(SCAN_BEACON_WAIT, &local->scanning)) {
 284		/*
 285		 * we were passive scanning because of radar/no-IR, but
 286		 * the beacon/proberesp rx gives us an opportunity to upgrade
 287		 * to active scan
 288		 */
 289		set_bit(SCAN_BEACON_DONE, &local->scanning);
 290		wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
 291	}
 292
 293	channel = ieee80211_get_channel_khz(local->hw.wiphy,
 294					    ieee80211_rx_status_to_khz(rx_status));
 295
 296	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
 297		return;
 298
 299	if (ieee80211_is_probe_resp(mgmt->frame_control)) {
 300		struct ieee80211_sub_if_data *sdata1, *sdata2;
 301		struct cfg80211_scan_request *scan_req;
 302		struct cfg80211_sched_scan_request *sched_scan_req;
 303		u32 scan_req_flags = 0, sched_scan_req_flags = 0;
 304
 305		sdata1 = rcu_dereference(local->scan_sdata);
 306		sdata2 = rcu_dereference(local->sched_scan_sdata);
 307
 308		if (likely(!sdata1 && !sdata2))
 309			return;
 310
 311		scan_req = rcu_dereference(local->scan_req);
 312		sched_scan_req = rcu_dereference(local->sched_scan_req);
 313
 314		if (scan_req)
 315			scan_req_flags = scan_req->flags;
 316
 317		if (sched_scan_req)
 318			sched_scan_req_flags = sched_scan_req->flags;
 319
 320		/* ignore ProbeResp to foreign address or non-bcast (OCE)
 321		 * unless scanning with randomised address
 322		 */
 323		if (!ieee80211_scan_accept_presp(sdata1, channel,
 324						 scan_req_flags,
 325						 mgmt->da) &&
 326		    !ieee80211_scan_accept_presp(sdata2, channel,
 327						 sched_scan_req_flags,
 328						 mgmt->da))
 329			return;
 330	} else {
 331		/* Beacons are expected only with broadcast address */
 332		if (!is_broadcast_ether_addr(mgmt->da))
 333			return;
 334	}
 335
 336	/* Do not update the BSS table in case of only monitor interfaces */
 337	if (local->open_count == local->monitors)
 338		return;
 339
 340	bss = ieee80211_bss_info_update(local, rx_status,
 341					mgmt, skb->len,
 342					channel);
 343	if (bss)
 344		ieee80211_rx_bss_put(local, bss);
 345}
 346
 347static void ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef)
 348{
 349	memset(chandef, 0, sizeof(*chandef));
 350
 351	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 352}
 353
 354/* return false if no more work */
 355static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata)
 356{
 357	struct ieee80211_local *local = sdata->local;
 358	struct cfg80211_scan_request *req;
 359	struct cfg80211_chan_def chandef;
 360	u8 bands_used = 0;
 361	int i, ielen;
 362	u32 *n_chans;
 363	u32 flags = 0;
 364
 365	req = rcu_dereference_protected(local->scan_req,
 366					lockdep_is_held(&local->hw.wiphy->mtx));
 367
 368	if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
 369		return false;
 370
 371	if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {
 372		local->hw_scan_req->req.n_channels = req->n_channels;
 373
 374		for (i = 0; i < req->n_channels; i++) {
 375			local->hw_scan_req->req.channels[i] = req->channels[i];
 376			bands_used |= BIT(req->channels[i]->band);
 377		}
 
 
 378	} else {
 379		do {
 380			if (local->hw_scan_band == NUM_NL80211_BANDS)
 381				return false;
 382
 383			n_chans = &local->hw_scan_req->req.n_channels;
 384			*n_chans = 0;
 385
 386			for (i = 0; i < req->n_channels; i++) {
 387				if (req->channels[i]->band !=
 388				    local->hw_scan_band)
 389					continue;
 390				local->hw_scan_req->req.channels[(*n_chans)++] =
 391							req->channels[i];
 392
 393				bands_used |= BIT(req->channels[i]->band);
 394			}
 395
 396			local->hw_scan_band++;
 397		} while (!*n_chans);
 398	}
 399
 
 400	ieee80211_prepare_scan_chandef(&chandef);
 401
 402	if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
 403		flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
 404
 405	ielen = ieee80211_build_preq_ies(sdata,
 406					 (u8 *)local->hw_scan_req->req.ie,
 407					 local->hw_scan_ies_bufsize,
 408					 &local->hw_scan_req->ies,
 409					 req->ie, req->ie_len,
 410					 bands_used, req->rates, &chandef,
 411					 flags);
 412	if (ielen < 0)
 413		return false;
 414	local->hw_scan_req->req.ie_len = ielen;
 415	local->hw_scan_req->req.no_cck = req->no_cck;
 416	ether_addr_copy(local->hw_scan_req->req.mac_addr, req->mac_addr);
 417	ether_addr_copy(local->hw_scan_req->req.mac_addr_mask,
 418			req->mac_addr_mask);
 419	ether_addr_copy(local->hw_scan_req->req.bssid, req->bssid);
 420
 421	return true;
 422}
 423
 424static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 425{
 426	struct ieee80211_local *local = hw_to_local(hw);
 427	bool hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
 428	bool was_scanning = local->scanning;
 429	struct cfg80211_scan_request *scan_req;
 430	struct ieee80211_sub_if_data *scan_sdata;
 431	struct ieee80211_sub_if_data *sdata;
 432
 433	lockdep_assert_wiphy(local->hw.wiphy);
 434
 435	/*
 436	 * It's ok to abort a not-yet-running scan (that
 437	 * we have one at all will be verified by checking
 438	 * local->scan_req next), but not to complete it
 439	 * successfully.
 440	 */
 441	if (WARN_ON(!local->scanning && !aborted))
 442		aborted = true;
 443
 444	if (WARN_ON(!local->scan_req))
 445		return;
 446
 447	scan_sdata = rcu_dereference_protected(local->scan_sdata,
 448					       lockdep_is_held(&local->hw.wiphy->mtx));
 449
 450	if (hw_scan && !aborted &&
 451	    !ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS) &&
 452	    ieee80211_prep_hw_scan(scan_sdata)) {
 453		int rc;
 454
 455		rc = drv_hw_scan(local,
 456			rcu_dereference_protected(local->scan_sdata,
 457						  lockdep_is_held(&local->hw.wiphy->mtx)),
 458			local->hw_scan_req);
 459
 460		if (rc == 0)
 461			return;
 462
 463		/* HW scan failed and is going to be reported as aborted,
 464		 * so clear old scan info.
 465		 */
 466		memset(&local->scan_info, 0, sizeof(local->scan_info));
 467		aborted = true;
 468	}
 469
 470	kfree(local->hw_scan_req);
 471	local->hw_scan_req = NULL;
 472
 473	scan_req = rcu_dereference_protected(local->scan_req,
 474					     lockdep_is_held(&local->hw.wiphy->mtx));
 475
 476	RCU_INIT_POINTER(local->scan_req, NULL);
 477	RCU_INIT_POINTER(local->scan_sdata, NULL);
 478
 479	local->scanning = 0;
 480	local->scan_chandef.chan = NULL;
 481
 482	synchronize_rcu();
 483
 484	if (scan_req != local->int_scan_req) {
 485		local->scan_info.aborted = aborted;
 486		cfg80211_scan_done(scan_req, &local->scan_info);
 487	}
 488
 489	/* Set power back to normal operating levels. */
 490	ieee80211_hw_conf_chan(local);
 491
 492	if (!hw_scan && was_scanning) {
 493		ieee80211_configure_filter(local);
 494		drv_sw_scan_complete(local, scan_sdata);
 495		ieee80211_offchannel_return(local);
 496	}
 497
 498	ieee80211_recalc_idle(local);
 499
 500	ieee80211_mlme_notify_scan_completed(local);
 501	ieee80211_ibss_notify_scan_completed(local);
 502
 503	/* Requeue all the work that might have been ignored while
 504	 * the scan was in progress; if there was none this will
 505	 * just be a no-op for the particular interface.
 506	 */
 507	list_for_each_entry(sdata, &local->interfaces, list) {
 508		if (ieee80211_sdata_running(sdata))
 509			wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
 510	}
 511
 512	if (was_scanning)
 513		ieee80211_start_next_roc(local);
 514}
 515
 516void ieee80211_scan_completed(struct ieee80211_hw *hw,
 517			      struct cfg80211_scan_info *info)
 518{
 519	struct ieee80211_local *local = hw_to_local(hw);
 520
 521	trace_api_scan_completed(local, info->aborted);
 522
 523	set_bit(SCAN_COMPLETED, &local->scanning);
 524	if (info->aborted)
 525		set_bit(SCAN_ABORTED, &local->scanning);
 526
 527	memcpy(&local->scan_info, info, sizeof(*info));
 528
 529	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
 530}
 531EXPORT_SYMBOL(ieee80211_scan_completed);
 532
 533static int ieee80211_start_sw_scan(struct ieee80211_local *local,
 534				   struct ieee80211_sub_if_data *sdata)
 535{
 536	/* Software scan is not supported in multi-channel cases */
 537	if (!local->emulate_chanctx)
 538		return -EOPNOTSUPP;
 539
 540	/*
 541	 * Hardware/driver doesn't support hw_scan, so use software
 542	 * scanning instead. First send a nullfunc frame with power save
 543	 * bit on so that AP will buffer the frames for us while we are not
 544	 * listening, then send probe requests to each channel and wait for
 545	 * the responses. After all channels are scanned, tune back to the
 546	 * original channel and send a nullfunc frame with power save bit
 547	 * off to trigger the AP to send us all the buffered frames.
 548	 *
 549	 * Note that while local->sw_scanning is true everything else but
 550	 * nullfunc frames and probe requests will be dropped in
 551	 * ieee80211_tx_h_check_assoc().
 552	 */
 553	drv_sw_scan_start(local, sdata, local->scan_addr);
 554
 555	local->leave_oper_channel_time = jiffies;
 556	local->next_scan_state = SCAN_DECISION;
 557	local->scan_channel_idx = 0;
 558
 559	ieee80211_offchannel_stop_vifs(local);
 560
 561	/* ensure nullfunc is transmitted before leaving operating channel */
 562	ieee80211_flush_queues(local, NULL, false);
 563
 564	ieee80211_configure_filter(local);
 565
 566	/* We need to set power level at maximum rate for scanning. */
 567	ieee80211_hw_conf_chan(local);
 568
 569	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
 570
 571	return 0;
 572}
 573
 574static bool __ieee80211_can_leave_ch(struct ieee80211_sub_if_data *sdata)
 575{
 576	struct ieee80211_local *local = sdata->local;
 577	struct ieee80211_sub_if_data *sdata_iter;
 578	unsigned int link_id;
 579
 580	lockdep_assert_wiphy(local->hw.wiphy);
 581
 582	if (!ieee80211_is_radar_required(local))
 583		return true;
 584
 585	if (!regulatory_pre_cac_allowed(local->hw.wiphy))
 586		return false;
 587
 588	list_for_each_entry(sdata_iter, &local->interfaces, list) {
 589		for_each_valid_link(&sdata_iter->wdev, link_id)
 590			if (sdata_iter->wdev.links[link_id].cac_started)
 591				return false;
 592	}
 593
 594	return true;
 595}
 596
 597static bool ieee80211_can_scan(struct ieee80211_local *local,
 598			       struct ieee80211_sub_if_data *sdata)
 599{
 600	if (!__ieee80211_can_leave_ch(sdata))
 601		return false;
 602
 603	if (!list_empty(&local->roc_list))
 604		return false;
 605
 606	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 607	    sdata->u.mgd.flags & IEEE80211_STA_CONNECTION_POLL)
 608		return false;
 609
 610	return true;
 611}
 612
 613void ieee80211_run_deferred_scan(struct ieee80211_local *local)
 614{
 615	lockdep_assert_wiphy(local->hw.wiphy);
 616
 617	if (!local->scan_req || local->scanning)
 618		return;
 619
 620	if (!ieee80211_can_scan(local,
 621				rcu_dereference_protected(
 622					local->scan_sdata,
 623					lockdep_is_held(&local->hw.wiphy->mtx))))
 624		return;
 625
 626	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
 627				 round_jiffies_relative(0));
 628}
 629
 630static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,
 631					  const u8 *src, const u8 *dst,
 632					  const u8 *ssid, size_t ssid_len,
 633					  const u8 *ie, size_t ie_len,
 634					  u32 ratemask, u32 flags, u32 tx_flags,
 635					  struct ieee80211_channel *channel)
 636{
 637	struct sk_buff *skb;
 638
 639	skb = ieee80211_build_probe_req(sdata, src, dst, ratemask, channel,
 640					ssid, ssid_len,
 641					ie, ie_len, flags);
 642
 643	if (skb) {
 644		if (flags & IEEE80211_PROBE_FLAG_RANDOM_SN) {
 645			struct ieee80211_hdr *hdr = (void *)skb->data;
 646			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 647			u16 sn = get_random_u16();
 648
 649			info->control.flags |= IEEE80211_TX_CTRL_NO_SEQNO;
 650			hdr->seq_ctrl =
 651				cpu_to_le16(IEEE80211_SN_TO_SEQ(sn));
 652		}
 653		IEEE80211_SKB_CB(skb)->flags |= tx_flags;
 654		IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_DONT_USE_RATE_MASK;
 655		ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band);
 656	}
 657}
 658
 659static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
 660					    unsigned long *next_delay)
 661{
 662	int i;
 663	struct ieee80211_sub_if_data *sdata;
 664	struct cfg80211_scan_request *scan_req;
 665	enum nl80211_band band = local->hw.conf.chandef.chan->band;
 666	u32 flags = 0, tx_flags;
 667
 668	scan_req = rcu_dereference_protected(local->scan_req,
 669					     lockdep_is_held(&local->hw.wiphy->mtx));
 670
 671	tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
 672	if (scan_req->no_cck)
 673		tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 674	if (scan_req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
 675		flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
 676	if (scan_req->flags & NL80211_SCAN_FLAG_RANDOM_SN)
 677		flags |= IEEE80211_PROBE_FLAG_RANDOM_SN;
 678
 679	sdata = rcu_dereference_protected(local->scan_sdata,
 680					  lockdep_is_held(&local->hw.wiphy->mtx));
 681
 682	for (i = 0; i < scan_req->n_ssids; i++)
 683		ieee80211_send_scan_probe_req(
 684			sdata, local->scan_addr, scan_req->bssid,
 685			scan_req->ssids[i].ssid, scan_req->ssids[i].ssid_len,
 686			scan_req->ie, scan_req->ie_len,
 687			scan_req->rates[band], flags,
 688			tx_flags, local->hw.conf.chandef.chan);
 689
 690	/*
 691	 * After sending probe requests, wait for probe responses
 692	 * on the channel.
 693	 */
 694	*next_delay = msecs_to_jiffies(scan_req->duration) >
 695		      IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME ?
 696		      msecs_to_jiffies(scan_req->duration) - IEEE80211_PROBE_DELAY :
 697		      IEEE80211_CHANNEL_TIME;
 698	local->next_scan_state = SCAN_DECISION;
 699}
 700
 701static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 702				  struct cfg80211_scan_request *req)
 703{
 704	struct ieee80211_local *local = sdata->local;
 705	bool hw_scan = local->ops->hw_scan;
 706	int rc;
 707
 708	lockdep_assert_wiphy(local->hw.wiphy);
 709
 710	if (local->scan_req)
 711		return -EBUSY;
 712
 713	/* For an MLO connection, if a link ID was specified, validate that it
 714	 * is indeed active.
 715	 */
 716	if (ieee80211_vif_is_mld(&sdata->vif) && req->tsf_report_link_id >= 0 &&
 717	    !(sdata->vif.active_links & BIT(req->tsf_report_link_id)))
 718		return -EINVAL;
 719
 720	if (!__ieee80211_can_leave_ch(sdata))
 721		return -EBUSY;
 722
 723	if (!ieee80211_can_scan(local, sdata)) {
 724		/* wait for the work to finish/time out */
 725		rcu_assign_pointer(local->scan_req, req);
 726		rcu_assign_pointer(local->scan_sdata, sdata);
 727		return 0;
 728	}
 729
 730 again:
 731	if (hw_scan) {
 732		u8 *ies;
 733
 734		local->hw_scan_ies_bufsize = local->scan_ies_len + req->ie_len;
 735
 736		if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {
 737			int i, n_bands = 0;
 738			u8 bands_counted = 0;
 739
 740			for (i = 0; i < req->n_channels; i++) {
 741				if (bands_counted & BIT(req->channels[i]->band))
 742					continue;
 743				bands_counted |= BIT(req->channels[i]->band);
 744				n_bands++;
 745			}
 746
 747			local->hw_scan_ies_bufsize *= n_bands;
 748		}
 749
 750		local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req,
 751							 req.channels,
 752							 req->n_channels) +
 753					     local->hw_scan_ies_bufsize,
 754					     GFP_KERNEL);
 755		if (!local->hw_scan_req)
 756			return -ENOMEM;
 757
 758		local->hw_scan_req->req.ssids = req->ssids;
 759		local->hw_scan_req->req.n_ssids = req->n_ssids;
 760		/* None of the channels are actually set
 761		 * up but let UBSAN know the boundaries.
 762		 */
 763		local->hw_scan_req->req.n_channels = req->n_channels;
 764
 765		ies = (u8 *)local->hw_scan_req +
 766			sizeof(*local->hw_scan_req) +
 767			req->n_channels * sizeof(req->channels[0]);
 768		local->hw_scan_req->req.ie = ies;
 769		local->hw_scan_req->req.flags = req->flags;
 770		eth_broadcast_addr(local->hw_scan_req->req.bssid);
 771		local->hw_scan_req->req.duration = req->duration;
 772		local->hw_scan_req->req.duration_mandatory =
 773			req->duration_mandatory;
 774		local->hw_scan_req->req.tsf_report_link_id =
 775			req->tsf_report_link_id;
 776
 777		local->hw_scan_band = 0;
 778		local->hw_scan_req->req.n_6ghz_params = req->n_6ghz_params;
 779		local->hw_scan_req->req.scan_6ghz_params =
 780			req->scan_6ghz_params;
 781		local->hw_scan_req->req.scan_6ghz = req->scan_6ghz;
 782
 783		/*
 784		 * After allocating local->hw_scan_req, we must
 785		 * go through until ieee80211_prep_hw_scan(), so
 786		 * anything that might be changed here and leave
 787		 * this function early must not go after this
 788		 * allocation.
 789		 */
 790	}
 791
 792	rcu_assign_pointer(local->scan_req, req);
 793	rcu_assign_pointer(local->scan_sdata, sdata);
 794
 795	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
 796		get_random_mask_addr(local->scan_addr,
 797				     req->mac_addr,
 798				     req->mac_addr_mask);
 799	else
 800		memcpy(local->scan_addr, sdata->vif.addr, ETH_ALEN);
 801
 802	if (hw_scan) {
 803		__set_bit(SCAN_HW_SCANNING, &local->scanning);
 804	} else if ((req->n_channels == 1) &&
 805		   (req->channels[0] == local->hw.conf.chandef.chan)) {
 806		/*
 807		 * If we are scanning only on the operating channel
 808		 * then we do not need to stop normal activities
 809		 */
 810		unsigned long next_delay;
 811
 812		__set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
 813
 814		ieee80211_recalc_idle(local);
 815
 816		/* Notify driver scan is starting, keep order of operations
 817		 * same as normal software scan, in case that matters. */
 818		drv_sw_scan_start(local, sdata, local->scan_addr);
 819
 820		ieee80211_configure_filter(local); /* accept probe-responses */
 821
 822		/* We need to ensure power level is at max for scanning. */
 823		ieee80211_hw_conf_chan(local);
 824
 825		if ((req->channels[0]->flags & (IEEE80211_CHAN_NO_IR |
 826						IEEE80211_CHAN_RADAR)) ||
 827		    !req->n_ssids) {
 828			next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
 829			if (req->n_ssids)
 830				set_bit(SCAN_BEACON_WAIT, &local->scanning);
 831		} else {
 832			ieee80211_scan_state_send_probe(local, &next_delay);
 833			next_delay = IEEE80211_CHANNEL_TIME;
 834		}
 835
 836		/* Now, just wait a bit and we are all done! */
 837		wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
 838					 next_delay);
 839		return 0;
 840	} else {
 841		/* Do normal software scan */
 842		__set_bit(SCAN_SW_SCANNING, &local->scanning);
 843	}
 844
 845	ieee80211_recalc_idle(local);
 846
 847	if (hw_scan) {
 848		WARN_ON(!ieee80211_prep_hw_scan(sdata));
 849		rc = drv_hw_scan(local, sdata, local->hw_scan_req);
 850	} else {
 851		rc = ieee80211_start_sw_scan(local, sdata);
 852	}
 853
 854	if (rc) {
 855		kfree(local->hw_scan_req);
 856		local->hw_scan_req = NULL;
 857		local->scanning = 0;
 858
 859		ieee80211_recalc_idle(local);
 860
 861		local->scan_req = NULL;
 862		RCU_INIT_POINTER(local->scan_sdata, NULL);
 863	}
 864
 865	if (hw_scan && rc == 1) {
 866		/*
 867		 * we can't fall back to software for P2P-GO
 868		 * as it must update NoA etc.
 869		 */
 870		if (ieee80211_vif_type_p2p(&sdata->vif) ==
 871				NL80211_IFTYPE_P2P_GO)
 872			return -EOPNOTSUPP;
 873		hw_scan = false;
 874		goto again;
 875	}
 876
 877	return rc;
 878}
 879
 880static unsigned long
 881ieee80211_scan_get_channel_time(struct ieee80211_channel *chan)
 882{
 883	/*
 884	 * TODO: channel switching also consumes quite some time,
 885	 * add that delay as well to get a better estimation
 886	 */
 887	if (chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR))
 888		return IEEE80211_PASSIVE_CHANNEL_TIME;
 889	return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME;
 890}
 891
 892static void ieee80211_scan_state_decision(struct ieee80211_local *local,
 893					  unsigned long *next_delay)
 894{
 895	bool associated = false;
 896	bool tx_empty = true;
 897	bool bad_latency;
 898	struct ieee80211_sub_if_data *sdata;
 899	struct ieee80211_channel *next_chan;
 900	enum mac80211_scan_state next_scan_state;
 901	struct cfg80211_scan_request *scan_req;
 902
 903	lockdep_assert_wiphy(local->hw.wiphy);
 904
 905	/*
 906	 * check if at least one STA interface is associated,
 907	 * check if at least one STA interface has pending tx frames
 908	 * and grab the lowest used beacon interval
 909	 */
 910	list_for_each_entry(sdata, &local->interfaces, list) {
 911		if (!ieee80211_sdata_running(sdata))
 912			continue;
 913
 914		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
 915			if (sdata->u.mgd.associated) {
 916				associated = true;
 917
 918				if (!qdisc_all_tx_empty(sdata->dev)) {
 919					tx_empty = false;
 920					break;
 921				}
 922			}
 923		}
 924	}
 925
 926	scan_req = rcu_dereference_protected(local->scan_req,
 927					     lockdep_is_held(&local->hw.wiphy->mtx));
 928
 929	next_chan = scan_req->channels[local->scan_channel_idx];
 930
 931	/*
 932	 * we're currently scanning a different channel, let's
 933	 * see if we can scan another channel without interfering
 934	 * with the current traffic situation.
 935	 *
 936	 * Keep good latency, do not stay off-channel more than 125 ms.
 937	 */
 938
 939	bad_latency = time_after(jiffies +
 940				 ieee80211_scan_get_channel_time(next_chan),
 941				 local->leave_oper_channel_time + HZ / 8);
 942
 943	if (associated && !tx_empty) {
 944		if (scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
 945			next_scan_state = SCAN_ABORT;
 946		else
 947			next_scan_state = SCAN_SUSPEND;
 948	} else if (associated && bad_latency) {
 949		next_scan_state = SCAN_SUSPEND;
 950	} else {
 951		next_scan_state = SCAN_SET_CHANNEL;
 952	}
 953
 954	local->next_scan_state = next_scan_state;
 955
 956	*next_delay = 0;
 957}
 958
 959static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
 960					     unsigned long *next_delay)
 961{
 962	int skip;
 963	struct ieee80211_channel *chan;
 964	struct cfg80211_scan_request *scan_req;
 965
 966	scan_req = rcu_dereference_protected(local->scan_req,
 967					     lockdep_is_held(&local->hw.wiphy->mtx));
 968
 969	skip = 0;
 970	chan = scan_req->channels[local->scan_channel_idx];
 971
 972	local->scan_chandef.chan = chan;
 973	local->scan_chandef.center_freq1 = chan->center_freq;
 974	local->scan_chandef.freq1_offset = chan->freq_offset;
 975	local->scan_chandef.center_freq2 = 0;
 976
 977	/* For scanning on the S1G band, detect the channel width according to
 978	 * the channel being scanned.
 979	 */
 980	if (chan->band == NL80211_BAND_S1GHZ) {
 981		local->scan_chandef.width = ieee80211_s1g_channel_width(chan);
 982		goto set_channel;
 983	}
 984
 985	/* If scanning on oper channel, use whatever channel-type
 986	 * is currently in use.
 987	 */
 988	if (chan == local->hw.conf.chandef.chan)
 989		local->scan_chandef = local->hw.conf.chandef;
 990	else
 991		local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
 992
 993set_channel:
 994	if (ieee80211_hw_conf_chan(local))
 995		skip = 1;
 996
 997	/* advance state machine to next channel/band */
 998	local->scan_channel_idx++;
 999
1000	if (skip) {
1001		/* if we skip this channel return to the decision state */
1002		local->next_scan_state = SCAN_DECISION;
1003		return;
1004	}
1005
1006	/*
1007	 * Probe delay is used to update the NAV, cf. 11.1.3.2.2
1008	 * (which unfortunately doesn't say _why_ step a) is done,
1009	 * but it waits for the probe delay or until a frame is
1010	 * received - and the received frame would update the NAV).
1011	 * For now, we do not support waiting until a frame is
1012	 * received.
1013	 *
1014	 * In any case, it is not necessary for a passive scan.
1015	 */
1016	if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) ||
1017	    !scan_req->n_ssids) {
1018		*next_delay = max(msecs_to_jiffies(scan_req->duration),
1019				  IEEE80211_PASSIVE_CHANNEL_TIME);
 
 
1020		local->next_scan_state = SCAN_DECISION;
1021		if (scan_req->n_ssids)
1022			set_bit(SCAN_BEACON_WAIT, &local->scanning);
1023		return;
1024	}
1025
1026	/* active scan, send probes */
1027	*next_delay = IEEE80211_PROBE_DELAY;
1028	local->next_scan_state = SCAN_SEND_PROBE;
1029}
1030
1031static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
1032					 unsigned long *next_delay)
1033{
1034	/* switch back to the operating channel */
1035	local->scan_chandef.chan = NULL;
1036	ieee80211_hw_conf_chan(local);
1037
1038	/* disable PS */
1039	ieee80211_offchannel_return(local);
1040
1041	*next_delay = HZ / 5;
1042	/* afterwards, resume scan & go to next channel */
1043	local->next_scan_state = SCAN_RESUME;
1044}
1045
1046static void ieee80211_scan_state_resume(struct ieee80211_local *local,
1047					unsigned long *next_delay)
1048{
1049	ieee80211_offchannel_stop_vifs(local);
1050
1051	if (local->ops->flush) {
1052		ieee80211_flush_queues(local, NULL, false);
1053		*next_delay = 0;
1054	} else
1055		*next_delay = HZ / 10;
1056
1057	/* remember when we left the operating channel */
1058	local->leave_oper_channel_time = jiffies;
1059
1060	/* advance to the next channel to be scanned */
1061	local->next_scan_state = SCAN_SET_CHANNEL;
1062}
1063
1064void ieee80211_scan_work(struct wiphy *wiphy, struct wiphy_work *work)
1065{
1066	struct ieee80211_local *local =
1067		container_of(work, struct ieee80211_local, scan_work.work);
1068	struct ieee80211_sub_if_data *sdata;
1069	struct cfg80211_scan_request *scan_req;
1070	unsigned long next_delay = 0;
1071	bool aborted;
1072
1073	lockdep_assert_wiphy(local->hw.wiphy);
1074
1075	if (!ieee80211_can_run_worker(local)) {
1076		aborted = true;
1077		goto out_complete;
1078	}
1079
1080	sdata = rcu_dereference_protected(local->scan_sdata,
1081					  lockdep_is_held(&local->hw.wiphy->mtx));
1082	scan_req = rcu_dereference_protected(local->scan_req,
1083					     lockdep_is_held(&local->hw.wiphy->mtx));
1084
1085	/* When scanning on-channel, the first-callback means completed. */
1086	if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) {
1087		aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
1088		goto out_complete;
1089	}
1090
1091	if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) {
1092		aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
1093		goto out_complete;
1094	}
1095
1096	if (!sdata || !scan_req)
1097		return;
1098
1099	if (!local->scanning) {
1100		int rc;
1101
1102		RCU_INIT_POINTER(local->scan_req, NULL);
1103		RCU_INIT_POINTER(local->scan_sdata, NULL);
1104
1105		rc = __ieee80211_start_scan(sdata, scan_req);
1106		if (!rc)
1107			return;
1108		/* need to complete scan in cfg80211 */
1109		rcu_assign_pointer(local->scan_req, scan_req);
1110		aborted = true;
1111		goto out_complete;
1112	}
1113
1114	clear_bit(SCAN_BEACON_WAIT, &local->scanning);
1115
1116	/*
1117	 * as long as no delay is required advance immediately
1118	 * without scheduling a new work
1119	 */
1120	do {
1121		if (!ieee80211_sdata_running(sdata)) {
1122			aborted = true;
1123			goto out_complete;
1124		}
1125
1126		if (test_and_clear_bit(SCAN_BEACON_DONE, &local->scanning) &&
1127		    local->next_scan_state == SCAN_DECISION)
1128			local->next_scan_state = SCAN_SEND_PROBE;
1129
1130		switch (local->next_scan_state) {
1131		case SCAN_DECISION:
1132			/* if no more bands/channels left, complete scan */
1133			if (local->scan_channel_idx >= scan_req->n_channels) {
1134				aborted = false;
1135				goto out_complete;
1136			}
1137			ieee80211_scan_state_decision(local, &next_delay);
1138			break;
1139		case SCAN_SET_CHANNEL:
1140			ieee80211_scan_state_set_channel(local, &next_delay);
1141			break;
1142		case SCAN_SEND_PROBE:
1143			ieee80211_scan_state_send_probe(local, &next_delay);
1144			break;
1145		case SCAN_SUSPEND:
1146			ieee80211_scan_state_suspend(local, &next_delay);
1147			break;
1148		case SCAN_RESUME:
1149			ieee80211_scan_state_resume(local, &next_delay);
1150			break;
1151		case SCAN_ABORT:
1152			aborted = true;
1153			goto out_complete;
1154		}
1155	} while (next_delay == 0);
1156
1157	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
1158				 next_delay);
1159	return;
1160
1161out_complete:
1162	__ieee80211_scan_completed(&local->hw, aborted);
1163}
1164
1165int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
1166			   struct cfg80211_scan_request *req)
1167{
1168	lockdep_assert_wiphy(sdata->local->hw.wiphy);
1169
1170	return __ieee80211_start_scan(sdata, req);
1171}
1172
1173int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
1174				const u8 *ssid, u8 ssid_len,
1175				struct ieee80211_channel **channels,
1176				unsigned int n_channels)
1177{
1178	struct ieee80211_local *local = sdata->local;
1179	int i, n_ch = 0;
1180	enum nl80211_band band;
1181
1182	lockdep_assert_wiphy(local->hw.wiphy);
1183
1184	/* busy scanning */
1185	if (local->scan_req)
1186		return -EBUSY;
1187
1188	/* fill internal scan request */
1189	if (!channels) {
1190		int max_n;
1191
1192		for (band = 0; band < NUM_NL80211_BANDS; band++) {
1193			if (!local->hw.wiphy->bands[band] ||
1194			    band == NL80211_BAND_6GHZ)
1195				continue;
1196
1197			max_n = local->hw.wiphy->bands[band]->n_channels;
1198			for (i = 0; i < max_n; i++) {
1199				struct ieee80211_channel *tmp_ch =
1200				    &local->hw.wiphy->bands[band]->channels[i];
1201
1202				if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR |
1203						     IEEE80211_CHAN_DISABLED) ||
1204				    !cfg80211_wdev_channel_allowed(&sdata->wdev,
1205								   tmp_ch))
1206					continue;
1207
1208				local->int_scan_req->channels[n_ch] = tmp_ch;
1209				n_ch++;
1210			}
1211		}
1212
1213		if (WARN_ON_ONCE(n_ch == 0))
1214			return -EINVAL;
1215
1216		local->int_scan_req->n_channels = n_ch;
1217	} else {
1218		for (i = 0; i < n_channels; i++) {
1219			if (channels[i]->flags & (IEEE80211_CHAN_NO_IR |
1220						  IEEE80211_CHAN_DISABLED) ||
1221			    !cfg80211_wdev_channel_allowed(&sdata->wdev,
1222							   channels[i]))
1223				continue;
1224
1225			local->int_scan_req->channels[n_ch] = channels[i];
1226			n_ch++;
1227		}
1228
1229		if (n_ch == 0)
1230			return -EINVAL;
1231
1232		local->int_scan_req->n_channels = n_ch;
1233	}
1234
1235	local->int_scan_req->ssids = &local->scan_ssid;
1236	local->int_scan_req->n_ssids = 1;
1237	memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
1238	local->int_scan_req->ssids[0].ssid_len = ssid_len;
1239
1240	return __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
 
 
1241}
1242
1243void ieee80211_scan_cancel(struct ieee80211_local *local)
1244{
1245	/* ensure a new scan cannot be queued */
1246	lockdep_assert_wiphy(local->hw.wiphy);
1247
1248	/*
1249	 * We are canceling software scan, or deferred scan that was not
1250	 * yet really started (see __ieee80211_start_scan ).
1251	 *
1252	 * Regarding hardware scan:
1253	 * - we can not call  __ieee80211_scan_completed() as when
1254	 *   SCAN_HW_SCANNING bit is set this function change
1255	 *   local->hw_scan_req to operate on 5G band, what race with
1256	 *   driver which can use local->hw_scan_req
1257	 *
1258	 * - we can not cancel scan_work since driver can schedule it
1259	 *   by ieee80211_scan_completed(..., true) to finish scan
1260	 *
1261	 * Hence we only call the cancel_hw_scan() callback, but the low-level
1262	 * driver is still responsible for calling ieee80211_scan_completed()
1263	 * after the scan was completed/aborted.
1264	 */
1265
1266	if (!local->scan_req)
1267		return;
1268
1269	/*
1270	 * We have a scan running and the driver already reported completion,
1271	 * but the worker hasn't run yet or is stuck on the mutex - mark it as
1272	 * cancelled.
1273	 */
1274	if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
1275	    test_bit(SCAN_COMPLETED, &local->scanning)) {
1276		set_bit(SCAN_HW_CANCELLED, &local->scanning);
1277		return;
1278	}
1279
1280	if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
1281		/*
1282		 * Make sure that __ieee80211_scan_completed doesn't trigger a
1283		 * scan on another band.
1284		 */
1285		set_bit(SCAN_HW_CANCELLED, &local->scanning);
1286		if (local->ops->cancel_hw_scan)
1287			drv_cancel_hw_scan(local,
1288				rcu_dereference_protected(local->scan_sdata,
1289						lockdep_is_held(&local->hw.wiphy->mtx)));
1290		return;
1291	}
1292
1293	wiphy_delayed_work_cancel(local->hw.wiphy, &local->scan_work);
1294	/* and clean up */
1295	memset(&local->scan_info, 0, sizeof(local->scan_info));
1296	__ieee80211_scan_completed(&local->hw, true);
1297}
1298
1299int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
1300					struct cfg80211_sched_scan_request *req)
1301{
1302	struct ieee80211_local *local = sdata->local;
1303	struct ieee80211_scan_ies sched_scan_ies = {};
1304	struct cfg80211_chan_def chandef;
1305	int ret, i, iebufsz, num_bands = 0;
1306	u32 rate_masks[NUM_NL80211_BANDS] = {};
1307	u8 bands_used = 0;
1308	u8 *ie;
1309	u32 flags = 0;
1310
1311	lockdep_assert_wiphy(local->hw.wiphy);
1312
1313	iebufsz = local->scan_ies_len + req->ie_len;
1314
1315	if (!local->ops->sched_scan_start)
1316		return -EOPNOTSUPP;
1317
1318	for (i = 0; i < NUM_NL80211_BANDS; i++) {
1319		if (local->hw.wiphy->bands[i]) {
1320			bands_used |= BIT(i);
1321			rate_masks[i] = (u32) -1;
1322			num_bands++;
1323		}
1324	}
1325
1326	if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
1327		flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
1328
1329	ie = kcalloc(iebufsz, num_bands, GFP_KERNEL);
1330	if (!ie) {
1331		ret = -ENOMEM;
1332		goto out;
1333	}
1334
1335	ieee80211_prepare_scan_chandef(&chandef);
1336
1337	ret = ieee80211_build_preq_ies(sdata, ie, num_bands * iebufsz,
1338				       &sched_scan_ies, req->ie,
1339				       req->ie_len, bands_used, rate_masks,
1340				       &chandef, flags);
1341	if (ret < 0)
1342		goto error;
1343
1344	ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
1345	if (ret == 0) {
1346		rcu_assign_pointer(local->sched_scan_sdata, sdata);
1347		rcu_assign_pointer(local->sched_scan_req, req);
1348	}
1349
1350error:
1351	kfree(ie);
1352out:
1353	if (ret) {
1354		/* Clean in case of failure after HW restart or upon resume. */
1355		RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
1356		RCU_INIT_POINTER(local->sched_scan_req, NULL);
1357	}
1358
1359	return ret;
1360}
1361
1362int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
1363				       struct cfg80211_sched_scan_request *req)
1364{
1365	struct ieee80211_local *local = sdata->local;
1366
1367	lockdep_assert_wiphy(local->hw.wiphy);
1368
1369	if (rcu_access_pointer(local->sched_scan_sdata))
1370		return -EBUSY;
1371
1372	return __ieee80211_request_sched_scan_start(sdata, req);
1373}
1374
1375int ieee80211_request_sched_scan_stop(struct ieee80211_local *local)
1376{
1377	struct ieee80211_sub_if_data *sched_scan_sdata;
1378	int ret = -ENOENT;
1379
1380	lockdep_assert_wiphy(local->hw.wiphy);
1381
1382	if (!local->ops->sched_scan_stop)
1383		return -EOPNOTSUPP;
1384
1385	/* We don't want to restart sched scan anymore. */
1386	RCU_INIT_POINTER(local->sched_scan_req, NULL);
1387
1388	sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
1389						lockdep_is_held(&local->hw.wiphy->mtx));
1390	if (sched_scan_sdata) {
1391		ret = drv_sched_scan_stop(local, sched_scan_sdata);
1392		if (!ret)
1393			RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
1394	}
1395
1396	return ret;
1397}
1398
1399void ieee80211_sched_scan_results(struct ieee80211_hw *hw)
1400{
1401	struct ieee80211_local *local = hw_to_local(hw);
1402
1403	trace_api_sched_scan_results(local);
1404
1405	cfg80211_sched_scan_results(hw->wiphy, 0);
1406}
1407EXPORT_SYMBOL(ieee80211_sched_scan_results);
1408
1409void ieee80211_sched_scan_end(struct ieee80211_local *local)
1410{
1411	lockdep_assert_wiphy(local->hw.wiphy);
1412
1413	if (!rcu_access_pointer(local->sched_scan_sdata))
1414		return;
1415
1416	RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
1417
1418	/* If sched scan was aborted by the driver. */
1419	RCU_INIT_POINTER(local->sched_scan_req, NULL);
1420
1421	cfg80211_sched_scan_stopped_locked(local->hw.wiphy, 0);
1422}
1423
1424void ieee80211_sched_scan_stopped_work(struct wiphy *wiphy,
1425				       struct wiphy_work *work)
1426{
1427	struct ieee80211_local *local =
1428		container_of(work, struct ieee80211_local,
1429			     sched_scan_stopped_work);
1430
1431	ieee80211_sched_scan_end(local);
1432}
1433
1434void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
1435{
1436	struct ieee80211_local *local = hw_to_local(hw);
1437
1438	trace_api_sched_scan_stopped(local);
1439
1440	/*
1441	 * this shouldn't really happen, so for simplicity
1442	 * simply ignore it, and let mac80211 reconfigure
1443	 * the sched scan later on.
1444	 */
1445	if (local->in_reconfig)
1446		return;
1447
1448	wiphy_work_queue(hw->wiphy, &local->sched_scan_stopped_work);
1449}
1450EXPORT_SYMBOL(ieee80211_sched_scan_stopped);