drivers/net/wireless/intel/iwlwifi/mvm/scan.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  11  * Copyright(c) 2018 - 2019 Intel Corporation
  12  *
  13  * This program is free software; you can redistribute it and/or modify
  14  * it under the terms of version 2 of the GNU General Public License as
  15  * published by the Free Software Foundation.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  20  * General Public License for more details.
  21  *
  22  * The full GNU General Public License is included in this distribution
  23  * in the file called COPYING.
  24  *
  25  * Contact Information:
  26  *  Intel Linux Wireless <linuxwifi@intel.com>
  27  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  28  *
  29  * BSD LICENSE
  30  *
  31  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  32  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  33  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  34  * Copyright(c) 2018 - 2019 Intel Corporation
  35  * All rights reserved.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  *
  41  *  * Redistributions of source code must retain the above copyright
  42  *    notice, this list of conditions and the following disclaimer.
  43  *  * Redistributions in binary form must reproduce the above copyright
  44  *    notice, this list of conditions and the following disclaimer in
  45  *    the documentation and/or other materials provided with the
  46  *    distribution.
  47  *  * Neither the name Intel Corporation nor the names of its
  48  *    contributors may be used to endorse or promote products derived
  49  *    from this software without specific prior written permission.
  50  *
  51  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  52  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  53  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  54  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  55  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  56  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  57  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  61  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  62  *
  63  *****************************************************************************/
  64
  65 #include <linux/etherdevice.h>
  66 #include <net/mac80211.h>
  67
  68 #include "mvm.h"
  69 #include "fw/api/scan.h"
  70 #include "iwl-io.h"
  71
  72 #define IWL_DENSE_EBS_SCAN_RATIO 5
  73 #define IWL_SPARSE_EBS_SCAN_RATIO 1
  74
  75 #define IWL_SCAN_DWELL_ACTIVE           10
  76 #define IWL_SCAN_DWELL_PASSIVE          110
  77 #define IWL_SCAN_DWELL_FRAGMENTED       44
  78 #define IWL_SCAN_DWELL_EXTENDED         90
  79 #define IWL_SCAN_NUM_OF_FRAGS           3
  80
  81
  82 /* adaptive dwell max budget time [TU] for full scan */
  83 #define IWL_SCAN_ADWELL_MAX_BUDGET_FULL_SCAN 300
  84 /* adaptive dwell max budget time [TU] for directed scan */
  85 #define IWL_SCAN_ADWELL_MAX_BUDGET_DIRECTED_SCAN 100
  86 /* adaptive dwell default high band APs number */
  87 #define IWL_SCAN_ADWELL_DEFAULT_HB_N_APS 8
  88 /* adaptive dwell default low band APs number */
  89 #define IWL_SCAN_ADWELL_DEFAULT_LB_N_APS 2
  90 /* adaptive dwell default APs number in social channels (1, 6, 11) */
  91 #define IWL_SCAN_ADWELL_DEFAULT_N_APS_SOCIAL 10
  92
  93 struct iwl_mvm_scan_timing_params {
  94         u32 suspend_time;
  95         u32 max_out_time;
  96 };
  97
  98 static struct iwl_mvm_scan_timing_params scan_timing[] = {
  99         [IWL_SCAN_TYPE_UNASSOC] = {
 100                 .suspend_time = 0,
 101                 .max_out_time = 0,
 102         },
 103         [IWL_SCAN_TYPE_WILD] = {
 104                 .suspend_time = 30,
 105                 .max_out_time = 120,
 106         },
 107         [IWL_SCAN_TYPE_MILD] = {
 108                 .suspend_time = 120,
 109                 .max_out_time = 120,
 110         },
 111         [IWL_SCAN_TYPE_FRAGMENTED] = {
 112                 .suspend_time = 95,
 113                 .max_out_time = 44,
 114         },
 115         [IWL_SCAN_TYPE_FAST_BALANCE] = {
 116                 .suspend_time = 30,
 117                 .max_out_time = 37,
 118         },
 119 };
 120
 121 struct iwl_mvm_scan_params {
 122         /* For CDB this is low band scan type, for non-CDB - type. */
 123         enum iwl_mvm_scan_type type;
 124         enum iwl_mvm_scan_type hb_type;
 125         u32 n_channels;
 126         u16 delay;
 127         int n_ssids;
 128         struct cfg80211_ssid *ssids;
 129         struct ieee80211_channel **channels;
 130         u32 flags;
 131         u8 *mac_addr;
 132         u8 *mac_addr_mask;
 133         bool no_cck;
 134         bool pass_all;
 135         int n_match_sets;
 136         struct iwl_scan_probe_req preq;
 137         struct cfg80211_match_set *match_sets;
 138         int n_scan_plans;
 139         struct cfg80211_sched_scan_plan *scan_plans;
 140         u32 measurement_dwell;
 141 };
 142
 143 static inline void *iwl_mvm_get_scan_req_umac_data(struct iwl_mvm *mvm)
 144 {
 145         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
 146
 147         if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm))
 148                 return (void *)&cmd->v8.data;
 149
 150         if (iwl_mvm_is_adaptive_dwell_supported(mvm))
 151                 return (void *)&cmd->v7.data;
 152
 153         if (iwl_mvm_cdb_scan_api(mvm))
 154                 return (void *)&cmd->v6.data;
 155
 156         return (void *)&cmd->v1.data;
 157 }
 158
 159 static inline struct iwl_scan_umac_chan_param *
 160 iwl_mvm_get_scan_req_umac_channel(struct iwl_mvm *mvm)
 161 {
 162         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
 163
 164         if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm))
 165                 return &cmd->v8.channel;
 166
 167         if (iwl_mvm_is_adaptive_dwell_supported(mvm))
 168                 return &cmd->v7.channel;
 169
 170         if (iwl_mvm_cdb_scan_api(mvm))
 171                 return &cmd->v6.channel;
 172
 173         return &cmd->v1.channel;
 174 }
 175
 176 static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 177 {
 178         if (mvm->scan_rx_ant != ANT_NONE)
 179                 return mvm->scan_rx_ant;
 180         return iwl_mvm_get_valid_rx_ant(mvm);
 181 }
 182
 183 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 184 {
 185         u16 rx_chain;
 186         u8 rx_ant;
 187
 188         rx_ant = iwl_mvm_scan_rx_ant(mvm);
 189         rx_chain = rx_ant << PHY_RX_CHAIN_VALID_POS;
 190         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
 191         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_SEL_POS;
 192         rx_chain |= 0x1 << PHY_RX_CHAIN_DRIVER_FORCE_POS;
 193         return cpu_to_le16(rx_chain);
 194 }
 195
 196 static __le32 iwl_mvm_scan_rxon_flags(enum nl80211_band band)
 197 {
 198         if (band == NL80211_BAND_2GHZ)
 199                 return cpu_to_le32(PHY_BAND_24);
 200         else
 201                 return cpu_to_le32(PHY_BAND_5);
 202 }
 203
 204 static inline __le32
 205 iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum nl80211_band band,
 206                           bool no_cck)
 207 {
 208         u32 tx_ant;
 209
 210         iwl_mvm_toggle_tx_ant(mvm, &mvm->scan_last_antenna_idx);
 211         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 212
 213         if (band == NL80211_BAND_2GHZ && !no_cck)
 214                 return cpu_to_le32(IWL_RATE_1M_PLCP | RATE_MCS_CCK_MSK |
 215                                    tx_ant);
 216         else
 217                 return cpu_to_le32(IWL_RATE_6M_PLCP | tx_ant);
 218 }
 219
 220 static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
 221                                             struct ieee80211_vif *vif)
 222 {
 223         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 224         int *global_cnt = data;
 225
 226         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
 227             mvmvif->phy_ctxt->id < NUM_PHY_CTX)
 228                 *global_cnt += 1;
 229 }
 230
 231 static enum iwl_mvm_traffic_load iwl_mvm_get_traffic_load(struct iwl_mvm *mvm)
 232 {
 233         return mvm->tcm.result.global_load;
 234 }
 235
 236 static enum iwl_mvm_traffic_load
 237 iwl_mvm_get_traffic_load_band(struct iwl_mvm *mvm, enum nl80211_band band)
 238 {
 239         return mvm->tcm.result.band_load[band];
 240 }
 241
 242 struct iwl_is_dcm_with_go_iterator_data {
 243         struct ieee80211_vif *current_vif;
 244         bool is_dcm_with_p2p_go;
 245 };
 246
 247 static void iwl_mvm_is_dcm_with_go_iterator(void *_data, u8 *mac,
 248                                             struct ieee80211_vif *vif)
 249 {
 250         struct iwl_is_dcm_with_go_iterator_data *data = _data;
 251         struct iwl_mvm_vif *other_mvmvif = iwl_mvm_vif_from_mac80211(vif);
 252         struct iwl_mvm_vif *curr_mvmvif =
 253                 iwl_mvm_vif_from_mac80211(data->current_vif);
 254
 255         /* exclude the given vif */
 256         if (vif == data->current_vif)
 257                 return;
 258
 259         if (vif->type == NL80211_IFTYPE_AP && vif->p2p &&
 260             other_mvmvif->phy_ctxt && curr_mvmvif->phy_ctxt &&
 261             other_mvmvif->phy_ctxt->id != curr_mvmvif->phy_ctxt->id)
 262                 data->is_dcm_with_p2p_go = true;
 263 }
 264
 265 static enum
 266 iwl_mvm_scan_type _iwl_mvm_get_scan_type(struct iwl_mvm *mvm,
 267                                          struct ieee80211_vif *vif,
 268                                          enum iwl_mvm_traffic_load load,
 269                                          bool low_latency)
 270 {
 271         int global_cnt = 0;
 272
 273         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
 274                                             IEEE80211_IFACE_ITER_NORMAL,
 275                                             iwl_mvm_scan_condition_iterator,
 276                                             &global_cnt);
 277         if (!global_cnt)
 278                 return IWL_SCAN_TYPE_UNASSOC;
 279
 280         if (fw_has_api(&mvm->fw->ucode_capa,
 281                        IWL_UCODE_TLV_API_FRAGMENTED_SCAN)) {
 282                 if ((load == IWL_MVM_TRAFFIC_HIGH || low_latency) &&
 283                     (!vif || vif->type != NL80211_IFTYPE_P2P_DEVICE))
 284                         return IWL_SCAN_TYPE_FRAGMENTED;
 285
 286                 /* in case of DCM with GO where BSS DTIM interval < 220msec
 287                  * set all scan requests as fast-balance scan
 288                  * */
 289                 if (vif && vif->type == NL80211_IFTYPE_STATION &&
 290                     vif->bss_conf.dtim_period < 220) {
 291                         struct iwl_is_dcm_with_go_iterator_data data = {
 292                                 .current_vif = vif,
 293                                 .is_dcm_with_p2p_go = false,
 294                         };
 295
 296                         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
 297                                                 IEEE80211_IFACE_ITER_NORMAL,
 298                                                 iwl_mvm_is_dcm_with_go_iterator,
 299                                                 &data);
 300                         if (data.is_dcm_with_p2p_go)
 301                                 return IWL_SCAN_TYPE_FAST_BALANCE;
 302                 }
 303         }
 304
 305         if (load >= IWL_MVM_TRAFFIC_MEDIUM || low_latency)
 306                 return IWL_SCAN_TYPE_MILD;
 307
 308         return IWL_SCAN_TYPE_WILD;
 309 }
 310
 311 static enum
 312 iwl_mvm_scan_type iwl_mvm_get_scan_type(struct iwl_mvm *mvm,
 313                                         struct ieee80211_vif *vif)
 314 {
 315         enum iwl_mvm_traffic_load load;
 316         bool low_latency;
 317
 318         load = iwl_mvm_get_traffic_load(mvm);
 319         low_latency = iwl_mvm_low_latency(mvm);
 320
 321         return _iwl_mvm_get_scan_type(mvm, vif, load, low_latency);
 322 }
 323
 324 static enum
 325 iwl_mvm_scan_type iwl_mvm_get_scan_type_band(struct iwl_mvm *mvm,
 326                                              struct ieee80211_vif *vif,
 327                                              enum nl80211_band band)
 328 {
 329         enum iwl_mvm_traffic_load load;
 330         bool low_latency;
 331
 332         load = iwl_mvm_get_traffic_load_band(mvm, band);
 333         low_latency = iwl_mvm_low_latency_band(mvm, band);
 334
 335         return _iwl_mvm_get_scan_type(mvm, vif, load, low_latency);
 336 }
 337
 338 static int
 339 iwl_mvm_get_measurement_dwell(struct iwl_mvm *mvm,
 340                               struct cfg80211_scan_request *req,
 341                               struct iwl_mvm_scan_params *params)
 342 {
 343         u32 duration = scan_timing[params->type].max_out_time;
 344
 345         if (!req->duration)
 346                 return 0;
 347
 348         if (iwl_mvm_is_cdb_supported(mvm)) {
 349                 u32 hb_time = scan_timing[params->hb_type].max_out_time;
 350
 351                 duration = min_t(u32, duration, hb_time);
 352         }
 353
 354         if (req->duration_mandatory && req->duration > duration) {
 355                 IWL_DEBUG_SCAN(mvm,
 356                                "Measurement scan - too long dwell %hu (max out time %u)\n",
 357                                req->duration,
 358                                duration);
 359                 return -EOPNOTSUPP;
 360         }
 361
 362         return min_t(u32, (u32)req->duration, duration);
 363 }
 364
 365 static inline bool iwl_mvm_rrm_scan_needed(struct iwl_mvm *mvm)
 366 {
 367         /* require rrm scan whenever the fw supports it */
 368         return fw_has_capa(&mvm->fw->ucode_capa,
 369                            IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT);
 370 }
 371
 372 static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm)
 373 {
 374         int max_probe_len;
 375
 376         max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
 377
 378         /* we create the 802.11 header and SSID element */
 379         max_probe_len -= 24 + 2;
 380
 381         /* DS parameter set element is added on 2.4GHZ band if required */
 382         if (iwl_mvm_rrm_scan_needed(mvm))
 383                 max_probe_len -= 3;
 384
 385         return max_probe_len;
 386 }
 387
 388 int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm)
 389 {
 390         int max_ie_len = iwl_mvm_max_scan_ie_fw_cmd_room(mvm);
 391
 392         /* TODO: [BUG] This function should return the maximum allowed size of
 393          * scan IEs, however the LMAC scan api contains both 2GHZ and 5GHZ IEs
 394          * in the same command. So the correct implementation of this function
 395          * is just iwl_mvm_max_scan_ie_fw_cmd_room() / 2. Currently the scan
 396          * command has only 512 bytes and it would leave us with about 240
 397          * bytes for scan IEs, which is clearly not enough. So meanwhile
 398          * we will report an incorrect value. This may result in a failure to
 399          * issue a scan in unified_scan_lmac and unified_sched_scan_lmac
 400          * functions with -ENOBUFS, if a large enough probe will be provided.
 401          */
 402         return max_ie_len;
 403 }
 404
 405 void iwl_mvm_rx_lmac_scan_iter_complete_notif(struct iwl_mvm *mvm,
 406                                               struct iwl_rx_cmd_buffer *rxb)
 407 {
 408         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 409         struct iwl_lmac_scan_complete_notif *notif = (void *)pkt->data;
 410
 411         IWL_DEBUG_SCAN(mvm,
 412                        "Scan offload iteration complete: status=0x%x scanned channels=%d\n",
 413                        notif->status, notif->scanned_channels);
 414
 415         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
 416                 IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
 417                 ieee80211_sched_scan_results(mvm->hw);
 418                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 419         }
 420 }
 421
 422 void iwl_mvm_rx_scan_match_found(struct iwl_mvm *mvm,
 423                                  struct iwl_rx_cmd_buffer *rxb)
 424 {
 425         IWL_DEBUG_SCAN(mvm, "Scheduled scan results\n");
 426         ieee80211_sched_scan_results(mvm->hw);
 427 }
 428
 429 static const char *iwl_mvm_ebs_status_str(enum iwl_scan_ebs_status status)
 430 {
 431         switch (status) {
 432         case IWL_SCAN_EBS_SUCCESS:
 433                 return "successful";
 434         case IWL_SCAN_EBS_INACTIVE:
 435                 return "inactive";
 436         case IWL_SCAN_EBS_FAILED:
 437         case IWL_SCAN_EBS_CHAN_NOT_FOUND:
 438         default:
 439                 return "failed";
 440         }
 441 }
 442
 443 void iwl_mvm_rx_lmac_scan_complete_notif(struct iwl_mvm *mvm,
 444                                          struct iwl_rx_cmd_buffer *rxb)
 445 {
 446         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 447         struct iwl_periodic_scan_complete *scan_notif = (void *)pkt->data;
 448         bool aborted = (scan_notif->status == IWL_SCAN_OFFLOAD_ABORTED);
 449
 450         /* If this happens, the firmware has mistakenly sent an LMAC
 451          * notification during UMAC scans -- warn and ignore it.
 452          */
 453         if (WARN_ON_ONCE(fw_has_capa(&mvm->fw->ucode_capa,
 454                                      IWL_UCODE_TLV_CAPA_UMAC_SCAN)))
 455                 return;
 456
 457         /* scan status must be locked for proper checking */
 458         lockdep_assert_held(&mvm->mutex);
 459
 460         /* We first check if we were stopping a scan, in which case we
 461          * just clear the stopping flag.  Then we check if it was a
 462          * firmware initiated stop, in which case we need to inform
 463          * mac80211.
 464          * Note that we can have a stopping and a running scan
 465          * simultaneously, but we can't have two different types of
 466          * scans stopping or running at the same time (since LMAC
 467          * doesn't support it).
 468          */
 469
 470         if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_SCHED) {
 471                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR);
 472
 473                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 474                                aborted ? "aborted" : "completed",
 475                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 476                 IWL_DEBUG_SCAN(mvm,
 477                                "Last line %d, Last iteration %d, Time after last iteration %d\n",
 478                                scan_notif->last_schedule_line,
 479                                scan_notif->last_schedule_iteration,
 480                                __le32_to_cpu(scan_notif->time_after_last_iter));
 481
 482                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_SCHED;
 483         } else if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR) {
 484                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s\n",
 485                                aborted ? "aborted" : "completed",
 486                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 487
 488                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_REGULAR;
 489         } else if (mvm->scan_status & IWL_MVM_SCAN_SCHED) {
 490                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_REGULAR);
 491
 492                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 493                                aborted ? "aborted" : "completed",
 494                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 495                 IWL_DEBUG_SCAN(mvm,
 496                                "Last line %d, Last iteration %d, Time after last iteration %d (FW)\n",
 497                                scan_notif->last_schedule_line,
 498                                scan_notif->last_schedule_iteration,
 499                                __le32_to_cpu(scan_notif->time_after_last_iter));
 500
 501                 mvm->scan_status &= ~IWL_MVM_SCAN_SCHED;
 502                 ieee80211_sched_scan_stopped(mvm->hw);
 503                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 504         } else if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
 505                 struct cfg80211_scan_info info = {
 506                         .aborted = aborted,
 507                 };
 508
 509                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s (FW)\n",
 510                                aborted ? "aborted" : "completed",
 511                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 512
 513                 mvm->scan_status &= ~IWL_MVM_SCAN_REGULAR;
 514                 ieee80211_scan_completed(mvm->hw, &info);
 515                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 516                 cancel_delayed_work(&mvm->scan_timeout_dwork);
 517                 iwl_mvm_resume_tcm(mvm);
 518         } else {
 519                 IWL_ERR(mvm,
 520                         "got scan complete notification but no scan is running\n");
 521         }
 522
 523         mvm->last_ebs_successful =
 524                         scan_notif->ebs_status == IWL_SCAN_EBS_SUCCESS ||
 525                         scan_notif->ebs_status == IWL_SCAN_EBS_INACTIVE;
 526 }
 527
 528 static int iwl_ssid_exist(u8 *ssid, u8 ssid_len, struct iwl_ssid_ie *ssid_list)
 529 {
 530         int i;
 531
 532         for (i = 0; i < PROBE_OPTION_MAX; i++) {
 533                 if (!ssid_list[i].len)
 534                         break;
 535                 if (ssid_list[i].len == ssid_len &&
 536                     !memcmp(ssid_list->ssid, ssid, ssid_len))
 537                         return i;
 538         }
 539         return -1;
 540 }
 541
 542 /* We insert the SSIDs in an inverted order, because the FW will
 543  * invert it back.
 544  */
 545 static void iwl_scan_build_ssids(struct iwl_mvm_scan_params *params,
 546                                  struct iwl_ssid_ie *ssids,
 547                                  u32 *ssid_bitmap)
 548 {
 549         int i, j;
 550         int index;
 551
 552         /*
 553          * copy SSIDs from match list.
 554          * iwl_config_sched_scan_profiles() uses the order of these ssids to
 555          * config match list.
 556          */
 557         for (i = 0, j = params->n_match_sets - 1;
 558              j >= 0 && i < PROBE_OPTION_MAX;
 559              i++, j--) {
 560                 /* skip empty SSID matchsets */
 561                 if (!params->match_sets[j].ssid.ssid_len)
 562                         continue;
 563                 ssids[i].id = WLAN_EID_SSID;
 564                 ssids[i].len = params->match_sets[j].ssid.ssid_len;
 565                 memcpy(ssids[i].ssid, params->match_sets[j].ssid.ssid,
 566                        ssids[i].len);
 567         }
 568
 569         /* add SSIDs from scan SSID list */
 570         *ssid_bitmap = 0;
 571         for (j = params->n_ssids - 1;
 572              j >= 0 && i < PROBE_OPTION_MAX;
 573              i++, j--) {
 574                 index = iwl_ssid_exist(params->ssids[j].ssid,
 575                                        params->ssids[j].ssid_len,
 576                                        ssids);
 577                 if (index < 0) {
 578                         ssids[i].id = WLAN_EID_SSID;
 579                         ssids[i].len = params->ssids[j].ssid_len;
 580                         memcpy(ssids[i].ssid, params->ssids[j].ssid,
 581                                ssids[i].len);
 582                         *ssid_bitmap |= BIT(i);
 583                 } else {
 584                         *ssid_bitmap |= BIT(index);
 585                 }
 586         }
 587 }
 588
 589 static int
 590 iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
 591                                    struct cfg80211_sched_scan_request *req)
 592 {
 593         struct iwl_scan_offload_profile *profile;
 594         struct iwl_scan_offload_profile_cfg *profile_cfg;
 595         struct iwl_scan_offload_blacklist *blacklist;
 596         struct iwl_host_cmd cmd = {
 597                 .id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
 598                 .len[1] = sizeof(*profile_cfg),
 599                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
 600                 .dataflags[1] = IWL_HCMD_DFL_NOCOPY,
 601         };
 602         int blacklist_len;
 603         int i;
 604         int ret;
 605
 606         if (WARN_ON(req->n_match_sets > IWL_SCAN_MAX_PROFILES))
 607                 return -EIO;
 608
 609         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SHORT_BL)
 610                 blacklist_len = IWL_SCAN_SHORT_BLACKLIST_LEN;
 611         else
 612                 blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 613
 614         blacklist = kcalloc(blacklist_len, sizeof(*blacklist), GFP_KERNEL);
 615         if (!blacklist)
 616                 return -ENOMEM;
 617
 618         profile_cfg = kzalloc(sizeof(*profile_cfg), GFP_KERNEL);
 619         if (!profile_cfg) {
 620                 ret = -ENOMEM;
 621                 goto free_blacklist;
 622         }
 623
 624         cmd.data[0] = blacklist;
 625         cmd.len[0] = sizeof(*blacklist) * blacklist_len;
 626         cmd.data[1] = profile_cfg;
 627
 628         /* No blacklist configuration */
 629
 630         profile_cfg->num_profiles = req->n_match_sets;
 631         profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
 632         profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
 633         profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
 634         if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
 635                 profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 636
 637         for (i = 0; i < req->n_match_sets; i++) {
 638                 profile = &profile_cfg->profiles[i];
 639                 profile->ssid_index = i;
 640                 /* Support any cipher and auth algorithm */
 641                 profile->unicast_cipher = 0xff;
 642                 profile->auth_alg = 0xff;
 643                 profile->network_type = IWL_NETWORK_TYPE_ANY;
 644                 profile->band_selection = IWL_SCAN_OFFLOAD_SELECT_ANY;
 645                 profile->client_bitmap = SCAN_CLIENT_SCHED_SCAN;
 646         }
 647
 648         IWL_DEBUG_SCAN(mvm, "Sending scheduled scan profile config\n");
 649
 650         ret = iwl_mvm_send_cmd(mvm, &cmd);
 651         kfree(profile_cfg);
 652 free_blacklist:
 653         kfree(blacklist);
 654
 655         return ret;
 656 }
 657
 658 static bool iwl_mvm_scan_pass_all(struct iwl_mvm *mvm,
 659                                   struct cfg80211_sched_scan_request *req)
 660 {
 661         if (req->n_match_sets && req->match_sets[0].ssid.ssid_len) {
 662                 IWL_DEBUG_SCAN(mvm,
 663                                "Sending scheduled scan with filtering, n_match_sets %d\n",
 664                                req->n_match_sets);
 665                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
 666                 return false;
 667         }
 668
 669         IWL_DEBUG_SCAN(mvm, "Sending Scheduled scan without filtering\n");
 670
 671         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
 672         return true;
 673 }
 674
 675 static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
 676 {
 677         int ret;
 678         struct iwl_host_cmd cmd = {
 679                 .id = SCAN_OFFLOAD_ABORT_CMD,
 680         };
 681         u32 status = CAN_ABORT_STATUS;
 682
 683         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
 684         if (ret)
 685                 return ret;
 686
 687         if (status != CAN_ABORT_STATUS) {
 688                 /*
 689                  * The scan abort will return 1 for success or
 690                  * 2 for "failure".  A failure condition can be
 691                  * due to simply not being in an active scan which
 692                  * can occur if we send the scan abort before the
 693                  * microcode has notified us that a scan is completed.
 694                  */
 695                 IWL_DEBUG_SCAN(mvm, "SCAN OFFLOAD ABORT ret %d.\n", status);
 696                 ret = -ENOENT;
 697         }
 698
 699         return ret;
 700 }
 701
 702 static void iwl_mvm_scan_fill_tx_cmd(struct iwl_mvm *mvm,
 703                                      struct iwl_scan_req_tx_cmd *tx_cmd,
 704                                      bool no_cck)
 705 {
 706         tx_cmd[0].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 707                                          TX_CMD_FLG_BT_DIS);
 708         tx_cmd[0].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 709                                                            NL80211_BAND_2GHZ,
 710                                                            no_cck);
 711         tx_cmd[0].sta_id = mvm->aux_sta.sta_id;
 712
 713         tx_cmd[1].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 714                                          TX_CMD_FLG_BT_DIS);
 715         tx_cmd[1].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 716                                                            NL80211_BAND_5GHZ,
 717                                                            no_cck);
 718         tx_cmd[1].sta_id = mvm->aux_sta.sta_id;
 719 }
 720
 721 static void
 722 iwl_mvm_lmac_scan_cfg_channels(struct iwl_mvm *mvm,
 723                                struct ieee80211_channel **channels,
 724                                int n_channels, u32 ssid_bitmap,
 725                                struct iwl_scan_req_lmac *cmd)
 726 {
 727         struct iwl_scan_channel_cfg_lmac *channel_cfg = (void *)&cmd->data;
 728         int i;
 729
 730         for (i = 0; i < n_channels; i++) {
 731                 channel_cfg[i].channel_num =
 732                         cpu_to_le16(channels[i]->hw_value);
 733                 channel_cfg[i].iter_count = cpu_to_le16(1);
 734                 channel_cfg[i].iter_interval = 0;
 735                 channel_cfg[i].flags =
 736                         cpu_to_le32(IWL_UNIFIED_SCAN_CHANNEL_PARTIAL |
 737                                     ssid_bitmap);
 738         }
 739 }
 740
 741 static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,
 742                                            size_t len, u8 *const pos)
 743 {
 744         static const u8 before_ds_params[] = {
 745                         WLAN_EID_SSID,
 746                         WLAN_EID_SUPP_RATES,
 747                         WLAN_EID_REQUEST,
 748                         WLAN_EID_EXT_SUPP_RATES,
 749         };
 750         size_t offs;
 751         u8 *newpos = pos;
 752
 753         if (!iwl_mvm_rrm_scan_needed(mvm)) {
 754                 memcpy(newpos, ies, len);
 755                 return newpos + len;
 756         }
 757
 758         offs = ieee80211_ie_split(ies, len,
 759                                   before_ds_params,
 760                                   ARRAY_SIZE(before_ds_params),
 761                                   0);
 762
 763         memcpy(newpos, ies, offs);
 764         newpos += offs;
 765
 766         /* Add a placeholder for DS Parameter Set element */
 767         *newpos++ = WLAN_EID_DS_PARAMS;
 768         *newpos++ = 1;
 769         *newpos++ = 0;
 770
 771         memcpy(newpos, ies + offs, len - offs);
 772         newpos += len - offs;
 773
 774         return newpos;
 775 }
 776
 777 #define WFA_TPC_IE_LEN  9
 778
 779 static void iwl_mvm_add_tpc_report_ie(u8 *pos)
 780 {
 781         pos[0] = WLAN_EID_VENDOR_SPECIFIC;
 782         pos[1] = WFA_TPC_IE_LEN - 2;
 783         pos[2] = (WLAN_OUI_MICROSOFT >> 16) & 0xff;
 784         pos[3] = (WLAN_OUI_MICROSOFT >> 8) & 0xff;
 785         pos[4] = WLAN_OUI_MICROSOFT & 0xff;
 786         pos[5] = WLAN_OUI_TYPE_MICROSOFT_TPC;
 787         pos[6] = 0;
 788         /* pos[7] - tx power will be inserted by the FW */
 789         pos[7] = 0;
 790         pos[8] = 0;
 791 }
 792
 793 static void
 794 iwl_mvm_build_scan_probe(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 795                          struct ieee80211_scan_ies *ies,
 796                          struct iwl_mvm_scan_params *params)
 797 {
 798         struct ieee80211_mgmt *frame = (void *)params->preq.buf;
 799         u8 *pos, *newpos;
 800         const u8 *mac_addr = params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
 801                 params->mac_addr : NULL;
 802
 803         /*
 804          * Unfortunately, right now the offload scan doesn't support randomising
 805          * within the firmware, so until the firmware API is ready we implement
 806          * it in the driver. This means that the scan iterations won't really be
 807          * random, only when it's restarted, but at least that helps a bit.
 808          */
 809         if (mac_addr)
 810                 get_random_mask_addr(frame->sa, mac_addr,
 811                                      params->mac_addr_mask);
 812         else
 813                 memcpy(frame->sa, vif->addr, ETH_ALEN);
 814
 815         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 816         eth_broadcast_addr(frame->da);
 817         eth_broadcast_addr(frame->bssid);
 818         frame->seq_ctrl = 0;
 819
 820         pos = frame->u.probe_req.variable;
 821         *pos++ = WLAN_EID_SSID;
 822         *pos++ = 0;
 823
 824         params->preq.mac_header.offset = 0;
 825         params->preq.mac_header.len = cpu_to_le16(24 + 2);
 826
 827         /* Insert ds parameter set element on 2.4 GHz band */
 828         newpos = iwl_mvm_copy_and_insert_ds_elem(mvm,
 829                                                  ies->ies[NL80211_BAND_2GHZ],
 830                                                  ies->len[NL80211_BAND_2GHZ],
 831                                                  pos);
 832         params->preq.band_data[0].offset = cpu_to_le16(pos - params->preq.buf);
 833         params->preq.band_data[0].len = cpu_to_le16(newpos - pos);
 834         pos = newpos;
 835
 836         memcpy(pos, ies->ies[NL80211_BAND_5GHZ],
 837                ies->len[NL80211_BAND_5GHZ]);
 838         params->preq.band_data[1].offset = cpu_to_le16(pos - params->preq.buf);
 839         params->preq.band_data[1].len =
 840                 cpu_to_le16(ies->len[NL80211_BAND_5GHZ]);
 841         pos += ies->len[NL80211_BAND_5GHZ];
 842
 843         memcpy(pos, ies->common_ies, ies->common_ie_len);
 844         params->preq.common_data.offset = cpu_to_le16(pos - params->preq.buf);
 845
 846         if (iwl_mvm_rrm_scan_needed(mvm) &&
 847             !fw_has_capa(&mvm->fw->ucode_capa,
 848                          IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT)) {
 849                 iwl_mvm_add_tpc_report_ie(pos + ies->common_ie_len);
 850                 params->preq.common_data.len = cpu_to_le16(ies->common_ie_len +
 851                                                            WFA_TPC_IE_LEN);
 852         } else {
 853                 params->preq.common_data.len = cpu_to_le16(ies->common_ie_len);
 854         }
 855 }
 856
 857 static void iwl_mvm_scan_lmac_dwell(struct iwl_mvm *mvm,
 858                                     struct iwl_scan_req_lmac *cmd,
 859                                     struct iwl_mvm_scan_params *params)
 860 {
 861         cmd->active_dwell = IWL_SCAN_DWELL_ACTIVE;
 862         cmd->passive_dwell = IWL_SCAN_DWELL_PASSIVE;
 863         cmd->fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
 864         cmd->extended_dwell = IWL_SCAN_DWELL_EXTENDED;
 865         cmd->max_out_time = cpu_to_le32(scan_timing[params->type].max_out_time);
 866         cmd->suspend_time = cpu_to_le32(scan_timing[params->type].suspend_time);
 867         cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
 868 }
 869
 870 static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,
 871                                      struct ieee80211_scan_ies *ies,
 872                                      int n_channels)
 873 {
 874         return ((n_ssids <= PROBE_OPTION_MAX) &&
 875                 (n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
 876                 (ies->common_ie_len +
 877                  ies->len[NL80211_BAND_2GHZ] +
 878                  ies->len[NL80211_BAND_5GHZ] <=
 879                  iwl_mvm_max_scan_ie_fw_cmd_room(mvm)));
 880 }
 881
 882 static inline bool iwl_mvm_scan_use_ebs(struct iwl_mvm *mvm,
 883                                         struct ieee80211_vif *vif)
 884 {
 885         const struct iwl_ucode_capabilities *capa = &mvm->fw->ucode_capa;
 886         bool low_latency;
 887
 888         if (iwl_mvm_is_cdb_supported(mvm))
 889                 low_latency = iwl_mvm_low_latency_band(mvm, NL80211_BAND_5GHZ);
 890         else
 891                 low_latency = iwl_mvm_low_latency(mvm);
 892
 893         /* We can only use EBS if:
 894          *      1. the feature is supported;
 895          *      2. the last EBS was successful;
 896          *      3. if only single scan, the single scan EBS API is supported;
 897          *      4. it's not a p2p find operation.
 898          *      5. we are not in low latency mode,
 899          *         or if fragmented ebs is supported by the FW
 900          */
 901         return ((capa->flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT) &&
 902                 mvm->last_ebs_successful && IWL_MVM_ENABLE_EBS &&
 903                 vif->type != NL80211_IFTYPE_P2P_DEVICE &&
 904                 (!low_latency || iwl_mvm_is_frag_ebs_supported(mvm)));
 905 }
 906
 907 static inline bool iwl_mvm_is_regular_scan(struct iwl_mvm_scan_params *params)
 908 {
 909         return params->n_scan_plans == 1 &&
 910                 params->scan_plans[0].iterations == 1;
 911 }
 912
 913 static bool iwl_mvm_is_scan_fragmented(enum iwl_mvm_scan_type type)
 914 {
 915         return (type == IWL_SCAN_TYPE_FRAGMENTED ||
 916                 type == IWL_SCAN_TYPE_FAST_BALANCE);
 917 }
 918
 919 static int iwl_mvm_scan_lmac_flags(struct iwl_mvm *mvm,
 920                                    struct iwl_mvm_scan_params *params,
 921                                    struct ieee80211_vif *vif)
 922 {
 923         int flags = 0;
 924
 925         if (params->n_ssids == 0)
 926                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 927
 928         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
 929                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
 930
 931         if (iwl_mvm_is_scan_fragmented(params->type))
 932                 flags |= IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED;
 933
 934         if (iwl_mvm_rrm_scan_needed(mvm) &&
 935             fw_has_capa(&mvm->fw->ucode_capa,
 936                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
 937                 flags |= IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED;
 938
 939         if (params->pass_all)
 940                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
 941         else
 942                 flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
 943
 944 #ifdef CONFIG_IWLWIFI_DEBUGFS
 945         if (mvm->scan_iter_notif_enabled)
 946                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 947 #endif
 948
 949         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
 950                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 951
 952         if (iwl_mvm_is_regular_scan(params) &&
 953             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
 954             !iwl_mvm_is_scan_fragmented(params->type))
 955                 flags |= IWL_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL;
 956
 957         return flags;
 958 }
 959
 960 static int iwl_mvm_scan_lmac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 961                              struct iwl_mvm_scan_params *params)
 962 {
 963         struct iwl_scan_req_lmac *cmd = mvm->scan_cmd;
 964         struct iwl_scan_probe_req *preq =
 965                 (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
 966                          mvm->fw->ucode_capa.n_scan_channels);
 967         u32 ssid_bitmap = 0;
 968         int i;
 969
 970         lockdep_assert_held(&mvm->mutex);
 971
 972         memset(cmd, 0, ksize(cmd));
 973
 974         if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
 975                 return -EINVAL;
 976
 977         iwl_mvm_scan_lmac_dwell(mvm, cmd, params);
 978
 979         cmd->rx_chain_select = iwl_mvm_scan_rx_chain(mvm);
 980         cmd->iter_num = cpu_to_le32(1);
 981         cmd->n_channels = (u8)params->n_channels;
 982
 983         cmd->delay = cpu_to_le32(params->delay);
 984
 985         cmd->scan_flags = cpu_to_le32(iwl_mvm_scan_lmac_flags(mvm, params,
 986                                                               vif));
 987
 988         cmd->flags = iwl_mvm_scan_rxon_flags(params->channels[0]->band);
 989         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
 990                                         MAC_FILTER_IN_BEACON);
 991         iwl_mvm_scan_fill_tx_cmd(mvm, cmd->tx_cmd, params->no_cck);
 992         iwl_scan_build_ssids(params, cmd->direct_scan, &ssid_bitmap);
 993
 994         /* this API uses bits 1-20 instead of 0-19 */
 995         ssid_bitmap <<= 1;
 996
 997         for (i = 0; i < params->n_scan_plans; i++) {
 998                 struct cfg80211_sched_scan_plan *scan_plan =
 999                         &params->scan_plans[i];
1000
1001                 cmd->schedule[i].delay =
1002                         cpu_to_le16(scan_plan->interval);
1003                 cmd->schedule[i].iterations = scan_plan->iterations;
1004                 cmd->schedule[i].full_scan_mul = 1;
1005         }
1006
1007         /*
1008          * If the number of iterations of the last scan plan is set to
1009          * zero, it should run infinitely. However, this is not always the case.
1010          * For example, when regular scan is requested the driver sets one scan
1011          * plan with one iteration.
1012          */
1013         if (!cmd->schedule[i - 1].iterations)
1014                 cmd->schedule[i - 1].iterations = 0xff;
1015
1016         if (iwl_mvm_scan_use_ebs(mvm, vif)) {
1017                 cmd->channel_opt[0].flags =
1018                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
1019                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1020                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
1021                 cmd->channel_opt[0].non_ebs_ratio =
1022                         cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
1023                 cmd->channel_opt[1].flags =
1024                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
1025                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1026                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
1027                 cmd->channel_opt[1].non_ebs_ratio =
1028                         cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
1029         }
1030
1031         iwl_mvm_lmac_scan_cfg_channels(mvm, params->channels,
1032                                        params->n_channels, ssid_bitmap, cmd);
1033
1034         *preq = params->preq;
1035
1036         return 0;
1037 }
1038
1039 static int rate_to_scan_rate_flag(unsigned int rate)
1040 {
1041         static const int rate_to_scan_rate[IWL_RATE_COUNT] = {
1042                 [IWL_RATE_1M_INDEX]     = SCAN_CONFIG_RATE_1M,
1043                 [IWL_RATE_2M_INDEX]     = SCAN_CONFIG_RATE_2M,
1044                 [IWL_RATE_5M_INDEX]     = SCAN_CONFIG_RATE_5M,
1045                 [IWL_RATE_11M_INDEX]    = SCAN_CONFIG_RATE_11M,
1046                 [IWL_RATE_6M_INDEX]     = SCAN_CONFIG_RATE_6M,
1047                 [IWL_RATE_9M_INDEX]     = SCAN_CONFIG_RATE_9M,
1048                 [IWL_RATE_12M_INDEX]    = SCAN_CONFIG_RATE_12M,
1049                 [IWL_RATE_18M_INDEX]    = SCAN_CONFIG_RATE_18M,
1050                 [IWL_RATE_24M_INDEX]    = SCAN_CONFIG_RATE_24M,
1051                 [IWL_RATE_36M_INDEX]    = SCAN_CONFIG_RATE_36M,
1052                 [IWL_RATE_48M_INDEX]    = SCAN_CONFIG_RATE_48M,
1053                 [IWL_RATE_54M_INDEX]    = SCAN_CONFIG_RATE_54M,
1054         };
1055
1056         return rate_to_scan_rate[rate];
1057 }
1058
1059 static __le32 iwl_mvm_scan_config_rates(struct iwl_mvm *mvm)
1060 {
1061         struct ieee80211_supported_band *band;
1062         unsigned int rates = 0;
1063         int i;
1064
1065         band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
1066         for (i = 0; i < band->n_bitrates; i++)
1067                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
1068         band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
1069         for (i = 0; i < band->n_bitrates; i++)
1070                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
1071
1072         /* Set both basic rates and supported rates */
1073         rates |= SCAN_CONFIG_SUPPORTED_RATE(rates);
1074
1075         return cpu_to_le32(rates);
1076 }
1077
1078 static void iwl_mvm_fill_scan_dwell(struct iwl_mvm *mvm,
1079                                     struct iwl_scan_dwell *dwell)
1080 {
1081         dwell->active = IWL_SCAN_DWELL_ACTIVE;
1082         dwell->passive = IWL_SCAN_DWELL_PASSIVE;
1083         dwell->fragmented = IWL_SCAN_DWELL_FRAGMENTED;
1084         dwell->extended = IWL_SCAN_DWELL_EXTENDED;
1085 }
1086
1087 static void iwl_mvm_fill_channels(struct iwl_mvm *mvm, u8 *channels,
1088                                   u32 max_channels)
1089 {
1090         struct ieee80211_supported_band *band;
1091         int i, j = 0;
1092
1093         band = &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
1094         for (i = 0; i < band->n_channels && j < max_channels; i++, j++)
1095                 channels[j] = band->channels[i].hw_value;
1096         band = &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
1097         for (i = 0; i < band->n_channels && j < max_channels; i++, j++)
1098                 channels[j] = band->channels[i].hw_value;
1099 }
1100
1101 static void iwl_mvm_fill_scan_config_v1(struct iwl_mvm *mvm, void *config,
1102                                         u32 flags, u8 channel_flags,
1103                                         u32 max_channels)
1104 {
1105         enum iwl_mvm_scan_type type = iwl_mvm_get_scan_type(mvm, NULL);
1106         struct iwl_scan_config_v1 *cfg = config;
1107
1108         cfg->flags = cpu_to_le32(flags);
1109         cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
1110         cfg->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
1111         cfg->legacy_rates = iwl_mvm_scan_config_rates(mvm);
1112         cfg->out_of_channel_time = cpu_to_le32(scan_timing[type].max_out_time);
1113         cfg->suspend_time = cpu_to_le32(scan_timing[type].suspend_time);
1114
1115         iwl_mvm_fill_scan_dwell(mvm, &cfg->dwell);
1116
1117         memcpy(&cfg->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
1118
1119         cfg->bcast_sta_id = mvm->aux_sta.sta_id;
1120         cfg->channel_flags = channel_flags;
1121
1122         iwl_mvm_fill_channels(mvm, cfg->channel_array, max_channels);
1123 }
1124
1125 static void iwl_mvm_fill_scan_config(struct iwl_mvm *mvm, void *config,
1126                                      u32 flags, u8 channel_flags,
1127                                      u32 max_channels)
1128 {
1129         struct iwl_scan_config *cfg = config;
1130
1131         cfg->flags = cpu_to_le32(flags);
1132         cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
1133         cfg->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
1134         cfg->legacy_rates = iwl_mvm_scan_config_rates(mvm);
1135
1136         if (iwl_mvm_is_cdb_supported(mvm)) {
1137                 enum iwl_mvm_scan_type lb_type, hb_type;
1138
1139                 lb_type = iwl_mvm_get_scan_type_band(mvm, NULL,
1140                                                      NL80211_BAND_2GHZ);
1141                 hb_type = iwl_mvm_get_scan_type_band(mvm, NULL,
1142                                                      NL80211_BAND_5GHZ);
1143
1144                 cfg->out_of_channel_time[SCAN_LB_LMAC_IDX] =
1145                         cpu_to_le32(scan_timing[lb_type].max_out_time);
1146                 cfg->suspend_time[SCAN_LB_LMAC_IDX] =
1147                         cpu_to_le32(scan_timing[lb_type].suspend_time);
1148
1149                 cfg->out_of_channel_time[SCAN_HB_LMAC_IDX] =
1150                         cpu_to_le32(scan_timing[hb_type].max_out_time);
1151                 cfg->suspend_time[SCAN_HB_LMAC_IDX] =
1152                         cpu_to_le32(scan_timing[hb_type].suspend_time);
1153         } else {
1154                 enum iwl_mvm_scan_type type =
1155                         iwl_mvm_get_scan_type(mvm, NULL);
1156
1157                 cfg->out_of_channel_time[SCAN_LB_LMAC_IDX] =
1158                         cpu_to_le32(scan_timing[type].max_out_time);
1159                 cfg->suspend_time[SCAN_LB_LMAC_IDX] =
1160                         cpu_to_le32(scan_timing[type].suspend_time);
1161         }
1162
1163         iwl_mvm_fill_scan_dwell(mvm, &cfg->dwell);
1164
1165         memcpy(&cfg->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
1166
1167         cfg->bcast_sta_id = mvm->aux_sta.sta_id;
1168         cfg->channel_flags = channel_flags;
1169
1170         iwl_mvm_fill_channels(mvm, cfg->channel_array, max_channels);
1171 }
1172
1173 int iwl_mvm_config_scan(struct iwl_mvm *mvm)
1174 {
1175         void *cfg;
1176         int ret, cmd_size;
1177         struct iwl_host_cmd cmd = {
1178                 .id = iwl_cmd_id(SCAN_CFG_CMD, IWL_ALWAYS_LONG_GROUP, 0),
1179         };
1180         enum iwl_mvm_scan_type type;
1181         enum iwl_mvm_scan_type hb_type = IWL_SCAN_TYPE_NOT_SET;
1182         int num_channels =
1183                 mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels +
1184                 mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels;
1185         u32 flags;
1186         u8 channel_flags;
1187
1188         if (WARN_ON(num_channels > mvm->fw->ucode_capa.n_scan_channels))
1189                 num_channels = mvm->fw->ucode_capa.n_scan_channels;
1190
1191         if (iwl_mvm_is_cdb_supported(mvm)) {
1192                 type = iwl_mvm_get_scan_type_band(mvm, NULL,
1193                                                   NL80211_BAND_2GHZ);
1194                 hb_type = iwl_mvm_get_scan_type_band(mvm, NULL,
1195                                                      NL80211_BAND_5GHZ);
1196                 if (type == mvm->scan_type && hb_type == mvm->hb_scan_type)
1197                         return 0;
1198         } else {
1199                 type = iwl_mvm_get_scan_type(mvm, NULL);
1200                 if (type == mvm->scan_type)
1201                         return 0;
1202         }
1203
1204         if (iwl_mvm_cdb_scan_api(mvm))
1205                 cmd_size = sizeof(struct iwl_scan_config);
1206         else
1207                 cmd_size = sizeof(struct iwl_scan_config_v1);
1208         cmd_size += mvm->fw->ucode_capa.n_scan_channels;
1209
1210         cfg = kzalloc(cmd_size, GFP_KERNEL);
1211         if (!cfg)
1212                 return -ENOMEM;
1213
1214         flags = SCAN_CONFIG_FLAG_ACTIVATE |
1215                  SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS |
1216                  SCAN_CONFIG_FLAG_SET_TX_CHAINS |
1217                  SCAN_CONFIG_FLAG_SET_RX_CHAINS |
1218                  SCAN_CONFIG_FLAG_SET_AUX_STA_ID |
1219                  SCAN_CONFIG_FLAG_SET_ALL_TIMES |
1220                  SCAN_CONFIG_FLAG_SET_LEGACY_RATES |
1221                  SCAN_CONFIG_FLAG_SET_MAC_ADDR |
1222                  SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS |
1223                  SCAN_CONFIG_N_CHANNELS(num_channels) |
1224                  (iwl_mvm_is_scan_fragmented(type) ?
1225                   SCAN_CONFIG_FLAG_SET_FRAGMENTED :
1226                   SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED);
1227
1228         channel_flags = IWL_CHANNEL_FLAG_EBS |
1229                         IWL_CHANNEL_FLAG_ACCURATE_EBS |
1230                         IWL_CHANNEL_FLAG_EBS_ADD |
1231                         IWL_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE;
1232
1233         /*
1234          * Check for fragmented scan on LMAC2 - high band.
1235          * LMAC1 - low band is checked above.
1236          */
1237         if (iwl_mvm_cdb_scan_api(mvm)) {
1238                 if (iwl_mvm_is_cdb_supported(mvm))
1239                         flags |= (iwl_mvm_is_scan_fragmented(hb_type)) ?
1240                                  SCAN_CONFIG_FLAG_SET_LMAC2_FRAGMENTED :
1241                                  SCAN_CONFIG_FLAG_CLEAR_LMAC2_FRAGMENTED;
1242                 iwl_mvm_fill_scan_config(mvm, cfg, flags, channel_flags,
1243                                          num_channels);
1244         } else {
1245                 iwl_mvm_fill_scan_config_v1(mvm, cfg, flags, channel_flags,
1246                                             num_channels);
1247         }
1248
1249         cmd.data[0] = cfg;
1250         cmd.len[0] = cmd_size;
1251         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
1252
1253         IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
1254
1255         ret = iwl_mvm_send_cmd(mvm, &cmd);
1256         if (!ret) {
1257                 mvm->scan_type = type;
1258                 mvm->hb_scan_type = hb_type;
1259         }
1260
1261         kfree(cfg);
1262         return ret;
1263 }
1264
1265 static int iwl_mvm_scan_uid_by_status(struct iwl_mvm *mvm, int status)
1266 {
1267         int i;
1268
1269         for (i = 0; i < mvm->max_scans; i++)
1270                 if (mvm->scan_uid_status[i] == status)
1271                         return i;
1272
1273         return -ENOENT;
1274 }
1275
1276 static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
1277                                     struct iwl_scan_req_umac *cmd,
1278                                     struct iwl_mvm_scan_params *params)
1279 {
1280         struct iwl_mvm_scan_timing_params *timing, *hb_timing;
1281         u8 active_dwell, passive_dwell;
1282
1283         timing = &scan_timing[params->type];
1284         active_dwell = params->measurement_dwell ?
1285                 params->measurement_dwell : IWL_SCAN_DWELL_ACTIVE;
1286         passive_dwell = params->measurement_dwell ?
1287                 params->measurement_dwell : IWL_SCAN_DWELL_PASSIVE;
1288
1289         if (iwl_mvm_is_adaptive_dwell_supported(mvm)) {
1290                 cmd->v7.adwell_default_n_aps_social =
1291                         IWL_SCAN_ADWELL_DEFAULT_N_APS_SOCIAL;
1292                 cmd->v7.adwell_default_n_aps =
1293                         IWL_SCAN_ADWELL_DEFAULT_LB_N_APS;
1294
1295                 if (iwl_mvm_is_adwell_hb_ap_num_supported(mvm))
1296                         cmd->v9.adwell_default_hb_n_aps =
1297                                 IWL_SCAN_ADWELL_DEFAULT_HB_N_APS;
1298
1299                 /* if custom max budget was configured with debugfs */
1300                 if (IWL_MVM_ADWELL_MAX_BUDGET)
1301                         cmd->v7.adwell_max_budget =
1302                                 cpu_to_le16(IWL_MVM_ADWELL_MAX_BUDGET);
1303                 else if (params->ssids && params->ssids[0].ssid_len)
1304                         cmd->v7.adwell_max_budget =
1305                                 cpu_to_le16(IWL_SCAN_ADWELL_MAX_BUDGET_DIRECTED_SCAN);
1306                 else
1307                         cmd->v7.adwell_max_budget =
1308                                 cpu_to_le16(IWL_SCAN_ADWELL_MAX_BUDGET_FULL_SCAN);
1309
1310                 cmd->v7.scan_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1311                 cmd->v7.max_out_time[SCAN_LB_LMAC_IDX] =
1312                         cpu_to_le32(timing->max_out_time);
1313                 cmd->v7.suspend_time[SCAN_LB_LMAC_IDX] =
1314                         cpu_to_le32(timing->suspend_time);
1315
1316                 if (iwl_mvm_is_cdb_supported(mvm)) {
1317                         hb_timing = &scan_timing[params->hb_type];
1318
1319                         cmd->v7.max_out_time[SCAN_HB_LMAC_IDX] =
1320                                 cpu_to_le32(hb_timing->max_out_time);
1321                         cmd->v7.suspend_time[SCAN_HB_LMAC_IDX] =
1322                                 cpu_to_le32(hb_timing->suspend_time);
1323                 }
1324
1325                 if (!iwl_mvm_is_adaptive_dwell_v2_supported(mvm)) {
1326                         cmd->v7.active_dwell = active_dwell;
1327                         cmd->v7.passive_dwell = passive_dwell;
1328                         cmd->v7.fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
1329                 } else {
1330                         cmd->v8.active_dwell[SCAN_LB_LMAC_IDX] = active_dwell;
1331                         cmd->v8.passive_dwell[SCAN_LB_LMAC_IDX] = passive_dwell;
1332                         if (iwl_mvm_is_cdb_supported(mvm)) {
1333                                 cmd->v8.active_dwell[SCAN_HB_LMAC_IDX] =
1334                                         active_dwell;
1335                                 cmd->v8.passive_dwell[SCAN_HB_LMAC_IDX] =
1336                                         passive_dwell;
1337                         }
1338                 }
1339         } else {
1340                 cmd->v1.extended_dwell = params->measurement_dwell ?
1341                         params->measurement_dwell : IWL_SCAN_DWELL_EXTENDED;
1342                 cmd->v1.active_dwell = active_dwell;
1343                 cmd->v1.passive_dwell = passive_dwell;
1344                 cmd->v1.fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
1345
1346                 if (iwl_mvm_is_cdb_supported(mvm)) {
1347                         hb_timing = &scan_timing[params->hb_type];
1348
1349                         cmd->v6.max_out_time[SCAN_HB_LMAC_IDX] =
1350                                         cpu_to_le32(hb_timing->max_out_time);
1351                         cmd->v6.suspend_time[SCAN_HB_LMAC_IDX] =
1352                                         cpu_to_le32(hb_timing->suspend_time);
1353                 }
1354
1355                 if (iwl_mvm_cdb_scan_api(mvm)) {
1356                         cmd->v6.scan_priority =
1357                                 cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1358                         cmd->v6.max_out_time[SCAN_LB_LMAC_IDX] =
1359                                 cpu_to_le32(timing->max_out_time);
1360                         cmd->v6.suspend_time[SCAN_LB_LMAC_IDX] =
1361                                 cpu_to_le32(timing->suspend_time);
1362                 } else {
1363                         cmd->v1.scan_priority =
1364                                 cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1365                         cmd->v1.max_out_time =
1366                                 cpu_to_le32(timing->max_out_time);
1367                         cmd->v1.suspend_time =
1368                                 cpu_to_le32(timing->suspend_time);
1369                 }
1370         }
1371
1372         if (iwl_mvm_is_regular_scan(params))
1373                 cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
1374         else
1375                 cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_2);
1376 }
1377
1378 static void
1379 iwl_mvm_umac_scan_cfg_channels(struct iwl_mvm *mvm,
1380                                struct ieee80211_channel **channels,
1381                                int n_channels, u32 ssid_bitmap,
1382                                struct iwl_scan_channel_cfg_umac *channel_cfg)
1383 {
1384         int i;
1385
1386         for (i = 0; i < n_channels; i++) {
1387                 channel_cfg[i].flags = cpu_to_le32(ssid_bitmap);
1388                 channel_cfg[i].channel_num = channels[i]->hw_value;
1389                 channel_cfg[i].iter_count = 1;
1390                 channel_cfg[i].iter_interval = 0;
1391         }
1392 }
1393
1394 static u16 iwl_mvm_scan_umac_flags(struct iwl_mvm *mvm,
1395                                    struct iwl_mvm_scan_params *params,
1396                                    struct ieee80211_vif *vif)
1397 {
1398         u16 flags = 0;
1399
1400         if (params->n_ssids == 0)
1401                 flags = IWL_UMAC_SCAN_GEN_FLAGS_PASSIVE;
1402
1403         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
1404                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT;
1405
1406         if (iwl_mvm_is_scan_fragmented(params->type))
1407                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED;
1408
1409         if (iwl_mvm_is_cdb_supported(mvm) &&
1410             iwl_mvm_is_scan_fragmented(params->hb_type))
1411                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED;
1412
1413         if (iwl_mvm_rrm_scan_needed(mvm) &&
1414             fw_has_capa(&mvm->fw->ucode_capa,
1415                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
1416                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED;
1417
1418         if (params->pass_all)
1419                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
1420         else
1421                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_MATCH;
1422
1423         if (!iwl_mvm_is_regular_scan(params))
1424                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PERIODIC;
1425
1426         if (params->measurement_dwell)
1427                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1428
1429 #ifdef CONFIG_IWLWIFI_DEBUGFS
1430         if (mvm->scan_iter_notif_enabled)
1431                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1432 #endif
1433
1434         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_ENABLED)
1435                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1436
1437         if (iwl_mvm_is_adaptive_dwell_supported(mvm) && IWL_MVM_ADWELL_ENABLE &&
1438             vif->type != NL80211_IFTYPE_P2P_DEVICE)
1439                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ADAPTIVE_DWELL;
1440
1441         /*
1442          * Extended dwell is relevant only for low band to start with, as it is
1443          * being used for social channles only (1, 6, 11), so we can check
1444          * only scan type on low band also for CDB.
1445          */
1446         if (iwl_mvm_is_regular_scan(params) &&
1447             vif->type != NL80211_IFTYPE_P2P_DEVICE &&
1448             !iwl_mvm_is_scan_fragmented(params->type) &&
1449             !iwl_mvm_is_adaptive_dwell_supported(mvm) &&
1450             !iwl_mvm_is_oce_supported(mvm))
1451                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL;
1452
1453         if (iwl_mvm_is_oce_supported(mvm)) {
1454                 if ((params->flags &
1455                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE))
1456                         flags |= IWL_UMAC_SCAN_GEN_FLAGS_PROB_REQ_HIGH_TX_RATE;
1457                 /* Since IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL and
1458                  * NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION shares
1459                  * the same bit, we need to make sure that we use this bit here
1460                  * only when IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL cannot be
1461                  * used. */
1462                 if ((params->flags &
1463                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) &&
1464                      !WARN_ON_ONCE(!iwl_mvm_is_adaptive_dwell_supported(mvm)))
1465                         flags |= IWL_UMAC_SCAN_GEN_FLAGS_PROB_REQ_DEFER_SUPP;
1466                 if ((params->flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME))
1467                         flags |= IWL_UMAC_SCAN_GEN_FLAGS_MAX_CHNL_TIME;
1468         }
1469
1470         return flags;
1471 }
1472
1473 static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1474                              struct iwl_mvm_scan_params *params,
1475                              int type)
1476 {
1477         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
1478         struct iwl_scan_umac_chan_param *chan_param;
1479         void *cmd_data = iwl_mvm_get_scan_req_umac_data(mvm);
1480         struct iwl_scan_req_umac_tail *sec_part = cmd_data +
1481                 sizeof(struct iwl_scan_channel_cfg_umac) *
1482                         mvm->fw->ucode_capa.n_scan_channels;
1483         int uid, i;
1484         u32 ssid_bitmap = 0;
1485         u8 channel_flags = 0;
1486         u16 gen_flags;
1487         struct iwl_mvm_vif *scan_vif = iwl_mvm_vif_from_mac80211(vif);
1488
1489         chan_param = iwl_mvm_get_scan_req_umac_channel(mvm);
1490
1491         lockdep_assert_held(&mvm->mutex);
1492
1493         if (WARN_ON(params->n_scan_plans > IWL_MAX_SCHED_SCAN_PLANS))
1494                 return -EINVAL;
1495
1496         uid = iwl_mvm_scan_uid_by_status(mvm, 0);
1497         if (uid < 0)
1498                 return uid;
1499
1500         memset(cmd, 0, ksize(cmd));
1501
1502         iwl_mvm_scan_umac_dwell(mvm, cmd, params);
1503
1504         mvm->scan_uid_status[uid] = type;
1505
1506         cmd->uid = cpu_to_le32(uid);
1507         gen_flags = iwl_mvm_scan_umac_flags(mvm, params, vif);
1508         cmd->general_flags = cpu_to_le16(gen_flags);
1509         if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm)) {
1510                 if (gen_flags & IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED)
1511                         cmd->v8.num_of_fragments[SCAN_LB_LMAC_IDX] =
1512                                                         IWL_SCAN_NUM_OF_FRAGS;
1513                 if (gen_flags & IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED)
1514                         cmd->v8.num_of_fragments[SCAN_HB_LMAC_IDX] =
1515                                                         IWL_SCAN_NUM_OF_FRAGS;
1516
1517                 cmd->v8.general_flags2 =
1518                         IWL_UMAC_SCAN_GEN_FLAGS2_ALLOW_CHNL_REORDER;
1519         }
1520
1521         cmd->scan_start_mac_id = scan_vif->id;
1522
1523         if (type == IWL_MVM_SCAN_SCHED || type == IWL_MVM_SCAN_NETDETECT)
1524                 cmd->flags = cpu_to_le32(IWL_UMAC_SCAN_FLAG_PREEMPTIVE);
1525
1526         if (iwl_mvm_scan_use_ebs(mvm, vif)) {
1527                 channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
1528                                 IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1529                                 IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
1530
1531                 /* set fragmented ebs for fragmented scan on HB channels */
1532                 if (iwl_mvm_is_frag_ebs_supported(mvm)) {
1533                         if (gen_flags &
1534                             IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED ||
1535                             (!iwl_mvm_is_cdb_supported(mvm) &&
1536                              gen_flags & IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED))
1537                                 channel_flags |= IWL_SCAN_CHANNEL_FLAG_EBS_FRAG;
1538                 }
1539         }
1540
1541         chan_param->flags = channel_flags;
1542         chan_param->count = params->n_channels;
1543
1544         iwl_scan_build_ssids(params, sec_part->direct_scan, &ssid_bitmap);
1545
1546         iwl_mvm_umac_scan_cfg_channels(mvm, params->channels,
1547                                        params->n_channels, ssid_bitmap,
1548                                        cmd_data);
1549
1550         for (i = 0; i < params->n_scan_plans; i++) {
1551                 struct cfg80211_sched_scan_plan *scan_plan =
1552                         &params->scan_plans[i];
1553
1554                 sec_part->schedule[i].iter_count = scan_plan->iterations;
1555                 sec_part->schedule[i].interval =
1556                         cpu_to_le16(scan_plan->interval);
1557         }
1558
1559         /*
1560          * If the number of iterations of the last scan plan is set to
1561          * zero, it should run infinitely. However, this is not always the case.
1562          * For example, when regular scan is requested the driver sets one scan
1563          * plan with one iteration.
1564          */
1565         if (!sec_part->schedule[i - 1].iter_count)
1566                 sec_part->schedule[i - 1].iter_count = 0xff;
1567
1568         sec_part->delay = cpu_to_le16(params->delay);
1569         sec_part->preq = params->preq;
1570
1571         return 0;
1572 }
1573
1574 static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
1575 {
1576         return hweight32(mvm->scan_status & IWL_MVM_SCAN_MASK);
1577 }
1578
1579 static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
1580 {
1581         bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
1582                                          IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
1583
1584         /* This looks a bit arbitrary, but the idea is that if we run
1585          * out of possible simultaneous scans and the userspace is
1586          * trying to run a scan type that is already running, we
1587          * return -EBUSY.  But if the userspace wants to start a
1588          * different type of scan, we stop the opposite type to make
1589          * space for the new request.  The reason is backwards
1590          * compatibility with old wpa_supplicant that wouldn't stop a
1591          * scheduled scan before starting a normal scan.
1592          */
1593
1594         /* FW supports only a single periodic scan */
1595         if ((type == IWL_MVM_SCAN_SCHED || type == IWL_MVM_SCAN_NETDETECT) &&
1596             mvm->scan_status & (IWL_MVM_SCAN_SCHED | IWL_MVM_SCAN_NETDETECT))
1597                 return -EBUSY;
1598
1599         if (iwl_mvm_num_scans(mvm) < mvm->max_scans)
1600                 return 0;
1601
1602         /* Use a switch, even though this is a bitmask, so that more
1603          * than one bits set will fall in default and we will warn.
1604          */
1605         switch (type) {
1606         case IWL_MVM_SCAN_REGULAR:
1607                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1608                         return -EBUSY;
1609                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
1610         case IWL_MVM_SCAN_SCHED:
1611                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1612                         return -EBUSY;
1613                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
1614         case IWL_MVM_SCAN_NETDETECT:
1615                 /* For non-unified images, there's no need to stop
1616                  * anything for net-detect since the firmware is
1617                  * restarted anyway.  This way, any sched scans that
1618                  * were running will be restarted when we resume.
1619                  */
1620                 if (!unified_image)
1621                         return 0;
1622
1623                 /* If this is a unified image and we ran out of scans,
1624                  * we need to stop something.  Prefer stopping regular
1625                  * scans, because the results are useless at this
1626                  * point, and we should be able to keep running
1627                  * another scheduled scan while suspended.
1628                  */
1629                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1630                         return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR,
1631                                                  true);
1632                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1633                         return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
1634                                                  true);
1635                 /* Something is wrong if no scan was running but we
1636                  * ran out of scans.
1637                  */
1638                 /* fall through */
1639         default:
1640                 WARN_ON(1);
1641                 break;
1642         }
1643
1644         return -EIO;
1645 }
1646
1647 #define SCAN_TIMEOUT 20000
1648
1649 void iwl_mvm_scan_timeout_wk(struct work_struct *work)
1650 {
1651         struct delayed_work *delayed_work = to_delayed_work(work);
1652         struct iwl_mvm *mvm = container_of(delayed_work, struct iwl_mvm,
1653                                            scan_timeout_dwork);
1654
1655         IWL_ERR(mvm, "regular scan timed out\n");
1656
1657         iwl_force_nmi(mvm->trans);
1658 }
1659
1660 static void iwl_mvm_fill_scan_type(struct iwl_mvm *mvm,
1661                                    struct iwl_mvm_scan_params *params,
1662                                    struct ieee80211_vif *vif)
1663 {
1664         if (iwl_mvm_is_cdb_supported(mvm)) {
1665                 params->type =
1666                         iwl_mvm_get_scan_type_band(mvm, vif,
1667                                                    NL80211_BAND_2GHZ);
1668                 params->hb_type =
1669                         iwl_mvm_get_scan_type_band(mvm, vif,
1670                                                    NL80211_BAND_5GHZ);
1671         } else {
1672                 params->type = iwl_mvm_get_scan_type(mvm, vif);
1673         }
1674 }
1675
1676 int iwl_mvm_reg_scan_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1677                            struct cfg80211_scan_request *req,
1678                            struct ieee80211_scan_ies *ies)
1679 {
1680         struct iwl_host_cmd hcmd = {
1681                 .len = { iwl_mvm_scan_size(mvm), },
1682                 .data = { mvm->scan_cmd, },
1683                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1684         };
1685         struct iwl_mvm_scan_params params = {};
1686         int ret;
1687         struct cfg80211_sched_scan_plan scan_plan = { .iterations = 1 };
1688
1689         lockdep_assert_held(&mvm->mutex);
1690
1691         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1692                 IWL_ERR(mvm, "scan while LAR regdomain is not set\n");
1693                 return -EBUSY;
1694         }
1695
1696         ret = iwl_mvm_check_running_scans(mvm, IWL_MVM_SCAN_REGULAR);
1697         if (ret)
1698                 return ret;
1699
1700         /* we should have failed registration if scan_cmd was NULL */
1701         if (WARN_ON(!mvm->scan_cmd))
1702                 return -ENOMEM;
1703
1704         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1705                 return -ENOBUFS;
1706
1707         params.n_ssids = req->n_ssids;
1708         params.flags = req->flags;
1709         params.n_channels = req->n_channels;
1710         params.delay = 0;
1711         params.ssids = req->ssids;
1712         params.channels = req->channels;
1713         params.mac_addr = req->mac_addr;
1714         params.mac_addr_mask = req->mac_addr_mask;
1715         params.no_cck = req->no_cck;
1716         params.pass_all = true;
1717         params.n_match_sets = 0;
1718         params.match_sets = NULL;
1719
1720         params.scan_plans = &scan_plan;
1721         params.n_scan_plans = 1;
1722
1723         iwl_mvm_fill_scan_type(mvm, &params, vif);
1724
1725         ret = iwl_mvm_get_measurement_dwell(mvm, req, &params);
1726         if (ret < 0)
1727                 return ret;
1728
1729         params.measurement_dwell = ret;
1730
1731         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1732
1733         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1734                 hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1735                 ret = iwl_mvm_scan_umac(mvm, vif, &params,
1736                                         IWL_MVM_SCAN_REGULAR);
1737         } else {
1738                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1739                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1740         }
1741
1742         if (ret)
1743                 return ret;
1744
1745         iwl_mvm_pause_tcm(mvm, false);
1746
1747         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1748         if (ret) {
1749                 /* If the scan failed, it usually means that the FW was unable
1750                  * to allocate the time events. Warn on it, but maybe we
1751                  * should try to send the command again with different params.
1752                  */
1753                 IWL_ERR(mvm, "Scan failed! ret %d\n", ret);
1754                 iwl_mvm_resume_tcm(mvm);
1755                 return ret;
1756         }
1757
1758         IWL_DEBUG_SCAN(mvm, "Scan request was sent successfully\n");
1759         mvm->scan_status |= IWL_MVM_SCAN_REGULAR;
1760         mvm->scan_vif = iwl_mvm_vif_from_mac80211(vif);
1761         iwl_mvm_ref(mvm, IWL_MVM_REF_SCAN);
1762
1763         schedule_delayed_work(&mvm->scan_timeout_dwork,
1764                               msecs_to_jiffies(SCAN_TIMEOUT));
1765
1766         return 0;
1767 }
1768
1769 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
1770                              struct ieee80211_vif *vif,
1771                              struct cfg80211_sched_scan_request *req,
1772                              struct ieee80211_scan_ies *ies,
1773                              int type)
1774 {
1775         struct iwl_host_cmd hcmd = {
1776                 .len = { iwl_mvm_scan_size(mvm), },
1777                 .data = { mvm->scan_cmd, },
1778                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1779         };
1780         struct iwl_mvm_scan_params params = {};
1781         int ret;
1782
1783         lockdep_assert_held(&mvm->mutex);
1784
1785         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1786                 IWL_ERR(mvm, "sched-scan while LAR regdomain is not set\n");
1787                 return -EBUSY;
1788         }
1789
1790         ret = iwl_mvm_check_running_scans(mvm, type);
1791         if (ret)
1792                 return ret;
1793
1794         /* we should have failed registration if scan_cmd was NULL */
1795         if (WARN_ON(!mvm->scan_cmd))
1796                 return -ENOMEM;
1797
1798         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1799                 return -ENOBUFS;
1800
1801         params.n_ssids = req->n_ssids;
1802         params.flags = req->flags;
1803         params.n_channels = req->n_channels;
1804         params.ssids = req->ssids;
1805         params.channels = req->channels;
1806         params.mac_addr = req->mac_addr;
1807         params.mac_addr_mask = req->mac_addr_mask;
1808         params.no_cck = false;
1809         params.pass_all =  iwl_mvm_scan_pass_all(mvm, req);
1810         params.n_match_sets = req->n_match_sets;
1811         params.match_sets = req->match_sets;
1812         if (!req->n_scan_plans)
1813                 return -EINVAL;
1814
1815         params.n_scan_plans = req->n_scan_plans;
1816         params.scan_plans = req->scan_plans;
1817
1818         iwl_mvm_fill_scan_type(mvm, &params, vif);
1819
1820         /* In theory, LMAC scans can handle a 32-bit delay, but since
1821          * waiting for over 18 hours to start the scan is a bit silly
1822          * and to keep it aligned with UMAC scans (which only support
1823          * 16-bit delays), trim it down to 16-bits.
1824          */
1825         if (req->delay > U16_MAX) {
1826                 IWL_DEBUG_SCAN(mvm,
1827                                "delay value is > 16-bits, set to max possible\n");
1828                 params.delay = U16_MAX;
1829         } else {
1830                 params.delay = req->delay;
1831         }
1832
1833         ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
1834         if (ret)
1835                 return ret;
1836
1837         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1838
1839         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1840                 hcmd.id = iwl_cmd_id(SCAN_REQ_UMAC, IWL_ALWAYS_LONG_GROUP, 0);
1841                 ret = iwl_mvm_scan_umac(mvm, vif, &params, type);
1842         } else {
1843                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1844                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1845         }
1846
1847         if (ret)
1848                 return ret;
1849
1850         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1851         if (!ret) {
1852                 IWL_DEBUG_SCAN(mvm,
1853                                "Sched scan request was sent successfully\n");
1854                 mvm->scan_status |= type;
1855         } else {
1856                 /* If the scan failed, it usually means that the FW was unable
1857                  * to allocate the time events. Warn on it, but maybe we
1858                  * should try to send the command again with different params.
1859                  */
1860                 IWL_ERR(mvm, "Sched scan failed! ret %d\n", ret);
1861         }
1862
1863         return ret;
1864 }
1865
1866 void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
1867                                          struct iwl_rx_cmd_buffer *rxb)
1868 {
1869         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1870         struct iwl_umac_scan_complete *notif = (void *)pkt->data;
1871         u32 uid = __le32_to_cpu(notif->uid);
1872         bool aborted = (notif->status == IWL_SCAN_OFFLOAD_ABORTED);
1873
1874         if (WARN_ON(!(mvm->scan_uid_status[uid] & mvm->scan_status)))
1875                 return;
1876
1877         /* if the scan is already stopping, we don't need to notify mac80211 */
1878         if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_REGULAR) {
1879                 struct cfg80211_scan_info info = {
1880                         .aborted = aborted,
1881                         .scan_start_tsf = mvm->scan_start,
1882                 };
1883
1884                 memcpy(info.tsf_bssid, mvm->scan_vif->bssid, ETH_ALEN);
1885                 ieee80211_scan_completed(mvm->hw, &info);
1886                 mvm->scan_vif = NULL;
1887                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1888                 cancel_delayed_work(&mvm->scan_timeout_dwork);
1889                 iwl_mvm_resume_tcm(mvm);
1890         } else if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_SCHED) {
1891                 ieee80211_sched_scan_stopped(mvm->hw);
1892                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
1893         }
1894
1895         mvm->scan_status &= ~mvm->scan_uid_status[uid];
1896         IWL_DEBUG_SCAN(mvm,
1897                        "Scan completed, uid %u type %u, status %s, EBS status %s\n",
1898                        uid, mvm->scan_uid_status[uid],
1899                        notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
1900                                 "completed" : "aborted",
1901                        iwl_mvm_ebs_status_str(notif->ebs_status));
1902         IWL_DEBUG_SCAN(mvm,
1903                        "Last line %d, Last iteration %d, Time from last iteration %d\n",
1904                        notif->last_schedule, notif->last_iter,
1905                        __le32_to_cpu(notif->time_from_last_iter));
1906
1907         if (notif->ebs_status != IWL_SCAN_EBS_SUCCESS &&
1908             notif->ebs_status != IWL_SCAN_EBS_INACTIVE)
1909                 mvm->last_ebs_successful = false;
1910
1911         mvm->scan_uid_status[uid] = 0;
1912
1913         iwl_fw_dbg_apply_point(&mvm->fwrt, IWL_FW_INI_APPLY_SCAN_COMPLETE);
1914 }
1915
1916 void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
1917                                               struct iwl_rx_cmd_buffer *rxb)
1918 {
1919         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1920         struct iwl_umac_scan_iter_complete_notif *notif = (void *)pkt->data;
1921
1922         mvm->scan_start = le64_to_cpu(notif->start_tsf);
1923
1924         IWL_DEBUG_SCAN(mvm,
1925                        "UMAC Scan iteration complete: status=0x%x scanned_channels=%d\n",
1926                        notif->status, notif->scanned_channels);
1927
1928         if (mvm->sched_scan_pass_all == SCHED_SCAN_PASS_ALL_FOUND) {
1929                 IWL_DEBUG_SCAN(mvm, "Pass all scheduled scan results found\n");
1930                 ieee80211_sched_scan_results(mvm->hw);
1931                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_ENABLED;
1932         }
1933
1934         IWL_DEBUG_SCAN(mvm,
1935                        "UMAC Scan iteration complete: scan started at %llu (TSF)\n",
1936                        mvm->scan_start);
1937 }
1938
1939 static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type)
1940 {
1941         struct iwl_umac_scan_abort cmd = {};
1942         int uid, ret;
1943
1944         lockdep_assert_held(&mvm->mutex);
1945
1946         /* We should always get a valid index here, because we already
1947          * checked that this type of scan was running in the generic
1948          * code.
1949          */
1950         uid = iwl_mvm_scan_uid_by_status(mvm, type);
1951         if (WARN_ON_ONCE(uid < 0))
1952                 return uid;
1953
1954         cmd.uid = cpu_to_le32(uid);
1955
1956         IWL_DEBUG_SCAN(mvm, "Sending scan abort, uid %u\n", uid);
1957
1958         ret = iwl_mvm_send_cmd_pdu(mvm,
1959                                    iwl_cmd_id(SCAN_ABORT_UMAC,
1960                                               IWL_ALWAYS_LONG_GROUP, 0),
1961                                    0, sizeof(cmd), &cmd);
1962         if (!ret)
1963                 mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT;
1964
1965         return ret;
1966 }
1967
1968 static int iwl_mvm_scan_stop_wait(struct iwl_mvm *mvm, int type)
1969 {
1970         struct iwl_notification_wait wait_scan_done;
1971         static const u16 scan_done_notif[] = { SCAN_COMPLETE_UMAC,
1972                                               SCAN_OFFLOAD_COMPLETE, };
1973         int ret;
1974
1975         lockdep_assert_held(&mvm->mutex);
1976
1977         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
1978                                    scan_done_notif,
1979                                    ARRAY_SIZE(scan_done_notif),
1980                                    NULL, NULL);
1981
1982         IWL_DEBUG_SCAN(mvm, "Preparing to stop scan, type %x\n", type);
1983
1984         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1985                 ret = iwl_mvm_umac_scan_abort(mvm, type);
1986         else
1987                 ret = iwl_mvm_lmac_scan_abort(mvm);
1988
1989         if (ret) {
1990                 IWL_DEBUG_SCAN(mvm, "couldn't stop scan type %d\n", type);
1991                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
1992                 return ret;
1993         }
1994
1995         return iwl_wait_notification(&mvm->notif_wait, &wait_scan_done,
1996                                      1 * HZ);
1997 }
1998
1999 int iwl_mvm_scan_size(struct iwl_mvm *mvm)
2000 {
2001         int base_size = IWL_SCAN_REQ_UMAC_SIZE_V1;
2002
2003         if (iwl_mvm_is_adaptive_dwell_v2_supported(mvm))
2004                 base_size = IWL_SCAN_REQ_UMAC_SIZE_V8;
2005         else if (iwl_mvm_is_adaptive_dwell_supported(mvm))
2006                 base_size = IWL_SCAN_REQ_UMAC_SIZE_V7;
2007         else if (iwl_mvm_cdb_scan_api(mvm))
2008                 base_size = IWL_SCAN_REQ_UMAC_SIZE_V6;
2009
2010         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2011                 return base_size +
2012                         sizeof(struct iwl_scan_channel_cfg_umac) *
2013                                 mvm->fw->ucode_capa.n_scan_channels +
2014                         sizeof(struct iwl_scan_req_umac_tail);
2015
2016         return sizeof(struct iwl_scan_req_lmac) +
2017                 sizeof(struct iwl_scan_channel_cfg_lmac) *
2018                 mvm->fw->ucode_capa.n_scan_channels +
2019                 sizeof(struct iwl_scan_probe_req);
2020 }
2021
2022 /*
2023  * This function is used in nic restart flow, to inform mac80211 about scans
2024  * that was aborted by restart flow or by an assert.
2025  */
2026 void iwl_mvm_report_scan_aborted(struct iwl_mvm *mvm)
2027 {
2028         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
2029                 int uid, i;
2030
2031                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_REGULAR);
2032                 if (uid >= 0) {
2033                         struct cfg80211_scan_info info = {
2034                                 .aborted = true,
2035                         };
2036
2037                         ieee80211_scan_completed(mvm->hw, &info);
2038                         mvm->scan_uid_status[uid] = 0;
2039                 }
2040                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_SCHED);
2041                 if (uid >= 0 && !mvm->fw_restart) {
2042                         ieee80211_sched_scan_stopped(mvm->hw);
2043                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
2044                         mvm->scan_uid_status[uid] = 0;
2045                 }
2046
2047                 /* We shouldn't have any UIDs still set.  Loop over all the
2048                  * UIDs to make sure there's nothing left there and warn if
2049                  * any is found.
2050                  */
2051                 for (i = 0; i < mvm->max_scans; i++) {
2052                         if (WARN_ONCE(mvm->scan_uid_status[i],
2053                                       "UMAC scan UID %d status was not cleaned\n",
2054                                       i))
2055                                 mvm->scan_uid_status[i] = 0;
2056                 }
2057         } else {
2058                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
2059                         struct cfg80211_scan_info info = {
2060                                 .aborted = true,
2061                         };
2062
2063                         ieee80211_scan_completed(mvm->hw, &info);
2064                 }
2065
2066                 /* Sched scan will be restarted by mac80211 in
2067                  * restart_hw, so do not report if FW is about to be
2068                  * restarted.
2069                  */
2070                 if ((mvm->scan_status & IWL_MVM_SCAN_SCHED) &&
2071                     !mvm->fw_restart) {
2072                         ieee80211_sched_scan_stopped(mvm->hw);
2073                         mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
2074                 }
2075         }
2076 }
2077
2078 int iwl_mvm_scan_stop(struct iwl_mvm *mvm, int type, bool notify)
2079 {
2080         int ret;
2081
2082         if (!(mvm->scan_status & type))
2083                 return 0;
2084
2085         if (iwl_mvm_is_radio_killed(mvm)) {
2086                 ret = 0;
2087                 goto out;
2088         }
2089
2090         ret = iwl_mvm_scan_stop_wait(mvm, type);
2091         if (!ret)
2092                 mvm->scan_status |= type << IWL_MVM_SCAN_STOPPING_SHIFT;
2093 out:
2094         /* Clear the scan status so the next scan requests will
2095          * succeed and mark the scan as stopping, so that the Rx
2096          * handler doesn't do anything, as the scan was stopped from
2097          * above.
2098          */
2099         mvm->scan_status &= ~type;
2100
2101         if (type == IWL_MVM_SCAN_REGULAR) {
2102                 /* Since the rx handler won't do anything now, we have
2103                  * to release the scan reference here.
2104                  */
2105                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
2106                 cancel_delayed_work(&mvm->scan_timeout_dwork);
2107                 if (notify) {
2108                         struct cfg80211_scan_info info = {
2109                                 .aborted = true,
2110                         };
2111
2112                         ieee80211_scan_completed(mvm->hw, &info);
2113                 }
2114         } else if (notify) {
2115                 ieee80211_sched_scan_stopped(mvm->hw);
2116                 mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
2117         }
2118
2119         return ret;
2120 }