drivers/net/wireless/iwlwifi/mvm/scan.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of version 2 of the GNU General Public License as
  13  * published by the Free Software Foundation.
  14  *
  15  * This program is distributed in the hope that it will be useful, but
  16  * WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  23  * USA
  24  *
  25  * The full GNU General Public License is included in this distribution
  26  * in the file called COPYING.
  27  *
  28  * Contact Information:
  29  *  Intel Linux Wireless <ilw@linux.intel.com>
  30  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  31  *
  32  * BSD LICENSE
  33  *
  34  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  35  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  36  * All rights reserved.
  37  *
  38  * Redistribution and use in source and binary forms, with or without
  39  * modification, are permitted provided that the following conditions
  40  * are met:
  41  *
  42  *  * Redistributions of source code must retain the above copyright
  43  *    notice, this list of conditions and the following disclaimer.
  44  *  * Redistributions in binary form must reproduce the above copyright
  45  *    notice, this list of conditions and the following disclaimer in
  46  *    the documentation and/or other materials provided with the
  47  *    distribution.
  48  *  * Neither the name Intel Corporation nor the names of its
  49  *    contributors may be used to endorse or promote products derived
  50  *    from this software without specific prior written permission.
  51  *
  52  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  53  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  54  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  55  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  56  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  57  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  58  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  59  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  60  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  61  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  62  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  63  *
  64  *****************************************************************************/
  65
  66 #include <linux/etherdevice.h>
  67 #include <net/mac80211.h>
  68
  69 #include "mvm.h"
  70 #include "iwl-eeprom-parse.h"
  71 #include "fw-api-scan.h"
  72
  73 #define IWL_PLCP_QUIET_THRESH 1
  74 #define IWL_ACTIVE_QUIET_TIME 10
  75 #define IWL_DENSE_EBS_SCAN_RATIO 5
  76 #define IWL_SPARSE_EBS_SCAN_RATIO 1
  77
  78 struct iwl_mvm_scan_params {
  79         u32 max_out_time;
  80         u32 suspend_time;
  81         bool passive_fragmented;
  82         struct _dwell {
  83                 u16 passive;
  84                 u16 active;
  85                 u16 fragmented;
  86         } dwell[IEEE80211_NUM_BANDS];
  87 };
  88
  89 enum iwl_umac_scan_uid_type {
  90         IWL_UMAC_SCAN_UID_REG_SCAN      = BIT(0),
  91         IWL_UMAC_SCAN_UID_SCHED_SCAN    = BIT(1),
  92         IWL_UMAC_SCAN_UID_ALL           = IWL_UMAC_SCAN_UID_REG_SCAN |
  93                                           IWL_UMAC_SCAN_UID_SCHED_SCAN,
  94 };
  95
  96 static int iwl_umac_scan_stop(struct iwl_mvm *mvm,
  97                               enum iwl_umac_scan_uid_type type, bool notify);
  98
  99 static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 100 {
 101         if (mvm->scan_rx_ant != ANT_NONE)
 102                 return mvm->scan_rx_ant;
 103         return iwl_mvm_get_valid_rx_ant(mvm);
 104 }
 105
 106 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 107 {
 108         u16 rx_chain;
 109         u8 rx_ant;
 110
 111         rx_ant = iwl_mvm_scan_rx_ant(mvm);
 112         rx_chain = rx_ant << PHY_RX_CHAIN_VALID_POS;
 113         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
 114         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_SEL_POS;
 115         rx_chain |= 0x1 << PHY_RX_CHAIN_DRIVER_FORCE_POS;
 116         return cpu_to_le16(rx_chain);
 117 }
 118
 119 static __le32 iwl_mvm_scan_rxon_flags(enum ieee80211_band band)
 120 {
 121         if (band == IEEE80211_BAND_2GHZ)
 122                 return cpu_to_le32(PHY_BAND_24);
 123         else
 124                 return cpu_to_le32(PHY_BAND_5);
 125 }
 126
 127 static inline __le32
 128 iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum ieee80211_band band,
 129                           bool no_cck)
 130 {
 131         u32 tx_ant;
 132
 133         mvm->scan_last_antenna_idx =
 134                 iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
 135                                      mvm->scan_last_antenna_idx);
 136         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 137
 138         if (band == IEEE80211_BAND_2GHZ && !no_cck)
 139                 return cpu_to_le32(IWL_RATE_1M_PLCP | RATE_MCS_CCK_MSK |
 140                                    tx_ant);
 141         else
 142                 return cpu_to_le32(IWL_RATE_6M_PLCP | tx_ant);
 143 }
 144
 145 /*
 146  * We insert the SSIDs in an inverted order, because the FW will
 147  * invert it back. The most prioritized SSID, which is first in the
 148  * request list, is not copied here, but inserted directly to the probe
 149  * request.
 150  */
 151 static void iwl_mvm_scan_fill_ssids(struct iwl_ssid_ie *cmd_ssid,
 152                                     struct cfg80211_ssid *ssids,
 153                                     int n_ssids, int first)
 154 {
 155         int fw_idx, req_idx;
 156
 157         for (req_idx = n_ssids - 1, fw_idx = 0; req_idx >= first;
 158              req_idx--, fw_idx++) {
 159                 cmd_ssid[fw_idx].id = WLAN_EID_SSID;
 160                 cmd_ssid[fw_idx].len = ssids[req_idx].ssid_len;
 161                 memcpy(cmd_ssid[fw_idx].ssid,
 162                        ssids[req_idx].ssid,
 163                        ssids[req_idx].ssid_len);
 164         }
 165 }
 166
 167 /*
 168  * If req->n_ssids > 0, it means we should do an active scan.
 169  * In case of active scan w/o directed scan, we receive a zero-length SSID
 170  * just to notify that this scan is active and not passive.
 171  * In order to notify the FW of the number of SSIDs we wish to scan (including
 172  * the zero-length one), we need to set the corresponding bits in chan->type,
 173  * one for each SSID, and set the active bit (first). If the first SSID is
 174  * already included in the probe template, so we need to set only
 175  * req->n_ssids - 1 bits in addition to the first bit.
 176  */
 177 static u16 iwl_mvm_get_active_dwell(struct iwl_mvm *mvm,
 178                                     enum ieee80211_band band, int n_ssids)
 179 {
 180         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_BASIC_DWELL)
 181                 return 10;
 182         if (band == IEEE80211_BAND_2GHZ)
 183                 return 20  + 3 * (n_ssids + 1);
 184         return 10  + 2 * (n_ssids + 1);
 185 }
 186
 187 static u16 iwl_mvm_get_passive_dwell(struct iwl_mvm *mvm,
 188                                      enum ieee80211_band band)
 189 {
 190         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_BASIC_DWELL)
 191                         return 110;
 192         return band == IEEE80211_BAND_2GHZ ? 100 + 20 : 100 + 10;
 193 }
 194
 195 static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
 196                                             struct ieee80211_vif *vif)
 197 {
 198         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 199         int *global_cnt = data;
 200
 201         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
 202             mvmvif->phy_ctxt->id < MAX_PHYS)
 203                 *global_cnt += 1;
 204 }
 205
 206 static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
 207                                      struct ieee80211_vif *vif,
 208                                      int n_ssids, u32 flags,
 209                                      struct iwl_mvm_scan_params *params)
 210 {
 211         int global_cnt = 0;
 212         enum ieee80211_band band;
 213         u8 frag_passive_dwell = 0;
 214
 215         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
 216                                             IEEE80211_IFACE_ITER_NORMAL,
 217                                             iwl_mvm_scan_condition_iterator,
 218                                             &global_cnt);
 219
 220         if (!global_cnt)
 221                 goto not_bound;
 222
 223         params->suspend_time = 30;
 224         params->max_out_time = 120;
 225
 226         if (iwl_mvm_low_latency(mvm)) {
 227                 if (mvm->fw->ucode_capa.api[0] &
 228                     IWL_UCODE_TLV_API_FRAGMENTED_SCAN) {
 229                         params->suspend_time = 105;
 230                         /*
 231                          * If there is more than one active interface make
 232                          * passive scan more fragmented.
 233                          */
 234                         frag_passive_dwell = 40;
 235                         params->max_out_time = frag_passive_dwell;
 236                 } else {
 237                         params->suspend_time = 120;
 238                         params->max_out_time = 120;
 239                 }
 240         }
 241
 242         if (frag_passive_dwell && (mvm->fw->ucode_capa.api[0] &
 243                                    IWL_UCODE_TLV_API_FRAGMENTED_SCAN)) {
 244                 /*
 245                  * P2P device scan should not be fragmented to avoid negative
 246                  * impact on P2P device discovery. Configure max_out_time to be
 247                  * equal to dwell time on passive channel. Take a longest
 248                  * possible value, one that corresponds to 2GHz band
 249                  */
 250                 if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
 251                         u32 passive_dwell =
 252                                 iwl_mvm_get_passive_dwell(mvm,
 253                                                           IEEE80211_BAND_2GHZ);
 254                         params->max_out_time = passive_dwell;
 255                 } else {
 256                         params->passive_fragmented = true;
 257                 }
 258         }
 259
 260         if (flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
 261                 params->max_out_time = 200;
 262
 263 not_bound:
 264
 265         for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
 266                 if (params->passive_fragmented)
 267                         params->dwell[band].fragmented = frag_passive_dwell;
 268
 269                 params->dwell[band].passive = iwl_mvm_get_passive_dwell(mvm,
 270                                                                         band);
 271                 params->dwell[band].active = iwl_mvm_get_active_dwell(mvm, band,
 272                                                                       n_ssids);
 273         }
 274 }
 275
 276 static inline bool iwl_mvm_rrm_scan_needed(struct iwl_mvm *mvm)
 277 {
 278         /* require rrm scan whenever the fw supports it */
 279         return mvm->fw->ucode_capa.capa[0] &
 280                IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT;
 281 }
 282
 283 static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm,
 284                                            bool is_sched_scan)
 285 {
 286         int max_probe_len;
 287
 288         max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
 289
 290         /* we create the 802.11 header and SSID element */
 291         max_probe_len -= 24 + 2;
 292
 293         /* DS parameter set element is added on 2.4GHZ band if required */
 294         if (iwl_mvm_rrm_scan_needed(mvm))
 295                 max_probe_len -= 3;
 296
 297         return max_probe_len;
 298 }
 299
 300 int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm, bool is_sched_scan)
 301 {
 302         int max_ie_len = iwl_mvm_max_scan_ie_fw_cmd_room(mvm, is_sched_scan);
 303
 304         /* TODO: [BUG] This function should return the maximum allowed size of
 305          * scan IEs, however the LMAC scan api contains both 2GHZ and 5GHZ IEs
 306          * in the same command. So the correct implementation of this function
 307          * is just iwl_mvm_max_scan_ie_fw_cmd_room() / 2. Currently the scan
 308          * command has only 512 bytes and it would leave us with about 240
 309          * bytes for scan IEs, which is clearly not enough. So meanwhile
 310          * we will report an incorrect value. This may result in a failure to
 311          * issue a scan in unified_scan_lmac and unified_sched_scan_lmac
 312          * functions with -ENOBUFS, if a large enough probe will be provided.
 313          */
 314         return max_ie_len;
 315 }
 316
 317 int iwl_mvm_rx_scan_offload_iter_complete_notif(struct iwl_mvm *mvm,
 318                                                 struct iwl_rx_cmd_buffer *rxb,
 319                                                 struct iwl_device_cmd *cmd)
 320 {
 321         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 322         struct iwl_scan_complete_notif *notif = (void *)pkt->data;
 323
 324         IWL_DEBUG_SCAN(mvm,
 325                        "Scan offload iteration complete: status=0x%x scanned channels=%d\n",
 326                        notif->status, notif->scanned_channels);
 327         return 0;
 328 }
 329
 330 int iwl_mvm_rx_scan_offload_results(struct iwl_mvm *mvm,
 331                                     struct iwl_rx_cmd_buffer *rxb,
 332                                     struct iwl_device_cmd *cmd)
 333 {
 334         IWL_DEBUG_SCAN(mvm, "Scheduled scan results\n");
 335         ieee80211_sched_scan_results(mvm->hw);
 336
 337         return 0;
 338 }
 339
 340 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
 341                                            struct iwl_rx_cmd_buffer *rxb,
 342                                            struct iwl_device_cmd *cmd)
 343 {
 344         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 345         struct iwl_periodic_scan_complete *scan_notif;
 346
 347         scan_notif = (void *)pkt->data;
 348
 349         /* scan status must be locked for proper checking */
 350         lockdep_assert_held(&mvm->mutex);
 351
 352         IWL_DEBUG_SCAN(mvm,
 353                        "%s completed, status %s, EBS status %s\n",
 354                        mvm->scan_status == IWL_MVM_SCAN_SCHED ?
 355                                 "Scheduled scan" : "Scan",
 356                        scan_notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
 357                                 "completed" : "aborted",
 358                        scan_notif->ebs_status == IWL_SCAN_EBS_SUCCESS ?
 359                                 "success" : "failed");
 360
 361
 362         /* only call mac80211 completion if the stop was initiated by FW */
 363         if (mvm->scan_status == IWL_MVM_SCAN_SCHED) {
 364                 mvm->scan_status = IWL_MVM_SCAN_NONE;
 365                 ieee80211_sched_scan_stopped(mvm->hw);
 366         } else if (mvm->scan_status == IWL_MVM_SCAN_OS) {
 367                 mvm->scan_status = IWL_MVM_SCAN_NONE;
 368                 ieee80211_scan_completed(mvm->hw,
 369                                 scan_notif->status == IWL_SCAN_OFFLOAD_ABORTED);
 370                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 371         }
 372
 373         if (scan_notif->ebs_status)
 374                 mvm->last_ebs_successful = false;
 375
 376         return 0;
 377 }
 378
 379 static int iwl_ssid_exist(u8 *ssid, u8 ssid_len, struct iwl_ssid_ie *ssid_list)
 380 {
 381         int i;
 382
 383         for (i = 0; i < PROBE_OPTION_MAX; i++) {
 384                 if (!ssid_list[i].len)
 385                         break;
 386                 if (ssid_list[i].len == ssid_len &&
 387                     !memcmp(ssid_list->ssid, ssid, ssid_len))
 388                         return i;
 389         }
 390         return -1;
 391 }
 392
 393 static void iwl_scan_offload_build_ssid(struct cfg80211_sched_scan_request *req,
 394                                         struct iwl_ssid_ie *direct_scan,
 395                                         u32 *ssid_bitmap, bool basic_ssid)
 396 {
 397         int i, j;
 398         int index;
 399
 400         /*
 401          * copy SSIDs from match list.
 402          * iwl_config_sched_scan_profiles() uses the order of these ssids to
 403          * config match list.
 404          */
 405         for (i = 0; i < req->n_match_sets && i < PROBE_OPTION_MAX; i++) {
 406                 /* skip empty SSID matchsets */
 407                 if (!req->match_sets[i].ssid.ssid_len)
 408                         continue;
 409                 direct_scan[i].id = WLAN_EID_SSID;
 410                 direct_scan[i].len = req->match_sets[i].ssid.ssid_len;
 411                 memcpy(direct_scan[i].ssid, req->match_sets[i].ssid.ssid,
 412                        direct_scan[i].len);
 413         }
 414
 415         /* add SSIDs from scan SSID list */
 416         *ssid_bitmap = 0;
 417         for (j = 0; j < req->n_ssids && i < PROBE_OPTION_MAX; j++) {
 418                 index = iwl_ssid_exist(req->ssids[j].ssid,
 419                                        req->ssids[j].ssid_len,
 420                                        direct_scan);
 421                 if (index < 0) {
 422                         if (!req->ssids[j].ssid_len && basic_ssid)
 423                                 continue;
 424                         direct_scan[i].id = WLAN_EID_SSID;
 425                         direct_scan[i].len = req->ssids[j].ssid_len;
 426                         memcpy(direct_scan[i].ssid, req->ssids[j].ssid,
 427                                direct_scan[i].len);
 428                         *ssid_bitmap |= BIT(i + 1);
 429                         i++;
 430                 } else {
 431                         *ssid_bitmap |= BIT(index + 1);
 432                 }
 433         }
 434 }
 435
 436 int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
 437                                        struct cfg80211_sched_scan_request *req)
 438 {
 439         struct iwl_scan_offload_profile *profile;
 440         struct iwl_scan_offload_profile_cfg *profile_cfg;
 441         struct iwl_scan_offload_blacklist *blacklist;
 442         struct iwl_host_cmd cmd = {
 443                 .id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
 444                 .len[1] = sizeof(*profile_cfg),
 445                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
 446                 .dataflags[1] = IWL_HCMD_DFL_NOCOPY,
 447         };
 448         int blacklist_len;
 449         int i;
 450         int ret;
 451
 452         if (WARN_ON(req->n_match_sets > IWL_SCAN_MAX_PROFILES))
 453                         return -EIO;
 454
 455         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SHORT_BL)
 456                 blacklist_len = IWL_SCAN_SHORT_BLACKLIST_LEN;
 457         else
 458                 blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 459
 460         blacklist = kzalloc(sizeof(*blacklist) * blacklist_len, GFP_KERNEL);
 461         if (!blacklist)
 462                 return -ENOMEM;
 463
 464         profile_cfg = kzalloc(sizeof(*profile_cfg), GFP_KERNEL);
 465         if (!profile_cfg) {
 466                 ret = -ENOMEM;
 467                 goto free_blacklist;
 468         }
 469
 470         cmd.data[0] = blacklist;
 471         cmd.len[0] = sizeof(*blacklist) * blacklist_len;
 472         cmd.data[1] = profile_cfg;
 473
 474         /* No blacklist configuration */
 475
 476         profile_cfg->num_profiles = req->n_match_sets;
 477         profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
 478         profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
 479         profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
 480         if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
 481                 profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 482
 483         for (i = 0; i < req->n_match_sets; i++) {
 484                 profile = &profile_cfg->profiles[i];
 485                 profile->ssid_index = i;
 486                 /* Support any cipher and auth algorithm */
 487                 profile->unicast_cipher = 0xff;
 488                 profile->auth_alg = 0xff;
 489                 profile->network_type = IWL_NETWORK_TYPE_ANY;
 490                 profile->band_selection = IWL_SCAN_OFFLOAD_SELECT_ANY;
 491                 profile->client_bitmap = SCAN_CLIENT_SCHED_SCAN;
 492         }
 493
 494         IWL_DEBUG_SCAN(mvm, "Sending scheduled scan profile config\n");
 495
 496         ret = iwl_mvm_send_cmd(mvm, &cmd);
 497         kfree(profile_cfg);
 498 free_blacklist:
 499         kfree(blacklist);
 500
 501         return ret;
 502 }
 503
 504 static bool iwl_mvm_scan_pass_all(struct iwl_mvm *mvm,
 505                                   struct cfg80211_sched_scan_request *req)
 506 {
 507         if (req->n_match_sets && req->match_sets[0].ssid.ssid_len) {
 508                 IWL_DEBUG_SCAN(mvm,
 509                                "Sending scheduled scan with filtering, n_match_sets %d\n",
 510                                req->n_match_sets);
 511                 return false;
 512         }
 513
 514         IWL_DEBUG_SCAN(mvm, "Sending Scheduled scan without filtering\n");
 515         return true;
 516 }
 517
 518 int iwl_mvm_scan_offload_start(struct iwl_mvm *mvm,
 519                                struct ieee80211_vif *vif,
 520                                struct cfg80211_sched_scan_request *req,
 521                                struct ieee80211_scan_ies *ies)
 522 {
 523         int ret;
 524
 525         if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN) {
 526                 ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
 527                 if (ret)
 528                         return ret;
 529                 ret = iwl_mvm_sched_scan_umac(mvm, vif, req, ies);
 530         } else {
 531                 mvm->scan_status = IWL_MVM_SCAN_SCHED;
 532                 ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
 533                 if (ret)
 534                         return ret;
 535                 ret = iwl_mvm_unified_sched_scan_lmac(mvm, vif, req, ies);
 536         }
 537
 538         return ret;
 539 }
 540
 541 static int iwl_mvm_send_scan_offload_abort(struct iwl_mvm *mvm)
 542 {
 543         int ret;
 544         struct iwl_host_cmd cmd = {
 545                 .id = SCAN_OFFLOAD_ABORT_CMD,
 546         };
 547         u32 status;
 548
 549         /* Exit instantly with error when device is not ready
 550          * to receive scan abort command or it does not perform
 551          * scheduled scan currently */
 552         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
 553                 return -EIO;
 554
 555         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
 556         if (ret)
 557                 return ret;
 558
 559         if (status != CAN_ABORT_STATUS) {
 560                 /*
 561                  * The scan abort will return 1 for success or
 562                  * 2 for "failure".  A failure condition can be
 563                  * due to simply not being in an active scan which
 564                  * can occur if we send the scan abort before the
 565                  * microcode has notified us that a scan is completed.
 566                  */
 567                 IWL_DEBUG_SCAN(mvm, "SCAN OFFLOAD ABORT ret %d.\n", status);
 568                 ret = -ENOENT;
 569         }
 570
 571         return ret;
 572 }
 573
 574 int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
 575 {
 576         int ret;
 577         struct iwl_notification_wait wait_scan_done;
 578         static const u8 scan_done_notif[] = { SCAN_OFFLOAD_COMPLETE, };
 579         bool sched = mvm->scan_status == IWL_MVM_SCAN_SCHED;
 580
 581         lockdep_assert_held(&mvm->mutex);
 582
 583         if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)
 584                 return iwl_umac_scan_stop(mvm, IWL_UMAC_SCAN_UID_SCHED_SCAN,
 585                                           notify);
 586
 587         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
 588                 return 0;
 589
 590         if (iwl_mvm_is_radio_killed(mvm))
 591                 goto out;
 592
 593         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
 594                                    scan_done_notif,
 595                                    ARRAY_SIZE(scan_done_notif),
 596                                    NULL, NULL);
 597
 598         ret = iwl_mvm_send_scan_offload_abort(mvm);
 599         if (ret) {
 600                 IWL_DEBUG_SCAN(mvm, "Send stop %sscan failed %d\n",
 601                                sched ? "offloaded " : "", ret);
 602                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
 603                 return ret;
 604         }
 605
 606         IWL_DEBUG_SCAN(mvm, "Successfully sent stop %sscan\n",
 607                        sched ? "offloaded " : "");
 608
 609         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
 610         if (ret)
 611                 return ret;
 612
 613         /*
 614          * Clear the scan status so the next scan requests will succeed. This
 615          * also ensures the Rx handler doesn't do anything, as the scan was
 616          * stopped from above. Since the rx handler won't do anything now,
 617          * we have to release the scan reference here.
 618          */
 619         if (mvm->scan_status == IWL_MVM_SCAN_OS)
 620                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 621
 622 out:
 623         mvm->scan_status = IWL_MVM_SCAN_NONE;
 624
 625         if (notify) {
 626                 if (sched)
 627                         ieee80211_sched_scan_stopped(mvm->hw);
 628                 else
 629                         ieee80211_scan_completed(mvm->hw, true);
 630         }
 631
 632         return 0;
 633 }
 634
 635 static void iwl_mvm_unified_scan_fill_tx_cmd(struct iwl_mvm *mvm,
 636                                              struct iwl_scan_req_tx_cmd *tx_cmd,
 637                                              bool no_cck)
 638 {
 639         tx_cmd[0].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 640                                          TX_CMD_FLG_BT_DIS);
 641         tx_cmd[0].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 642                                                            IEEE80211_BAND_2GHZ,
 643                                                            no_cck);
 644         tx_cmd[0].sta_id = mvm->aux_sta.sta_id;
 645
 646         tx_cmd[1].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 647                                          TX_CMD_FLG_BT_DIS);
 648         tx_cmd[1].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 649                                                            IEEE80211_BAND_5GHZ,
 650                                                            no_cck);
 651         tx_cmd[1].sta_id = mvm->aux_sta.sta_id;
 652 }
 653
 654 static void
 655 iwl_mvm_lmac_scan_cfg_channels(struct iwl_mvm *mvm,
 656                                struct ieee80211_channel **channels,
 657                                int n_channels, u32 ssid_bitmap,
 658                                struct iwl_scan_req_unified_lmac *cmd)
 659 {
 660         struct iwl_scan_channel_cfg_lmac *channel_cfg = (void *)&cmd->data;
 661         int i;
 662
 663         for (i = 0; i < n_channels; i++) {
 664                 channel_cfg[i].channel_num =
 665                         cpu_to_le16(channels[i]->hw_value);
 666                 channel_cfg[i].iter_count = cpu_to_le16(1);
 667                 channel_cfg[i].iter_interval = 0;
 668                 channel_cfg[i].flags =
 669                         cpu_to_le32(IWL_UNIFIED_SCAN_CHANNEL_PARTIAL |
 670                                     ssid_bitmap);
 671         }
 672 }
 673
 674 static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,
 675                                            size_t len, u8 *const pos)
 676 {
 677         static const u8 before_ds_params[] = {
 678                         WLAN_EID_SSID,
 679                         WLAN_EID_SUPP_RATES,
 680                         WLAN_EID_REQUEST,
 681                         WLAN_EID_EXT_SUPP_RATES,
 682         };
 683         size_t offs;
 684         u8 *newpos = pos;
 685
 686         if (!iwl_mvm_rrm_scan_needed(mvm)) {
 687                 memcpy(newpos, ies, len);
 688                 return newpos + len;
 689         }
 690
 691         offs = ieee80211_ie_split(ies, len,
 692                                   before_ds_params,
 693                                   ARRAY_SIZE(before_ds_params),
 694                                   0);
 695
 696         memcpy(newpos, ies, offs);
 697         newpos += offs;
 698
 699         /* Add a placeholder for DS Parameter Set element */
 700         *newpos++ = WLAN_EID_DS_PARAMS;
 701         *newpos++ = 1;
 702         *newpos++ = 0;
 703
 704         memcpy(newpos, ies + offs, len - offs);
 705         newpos += len - offs;
 706
 707         return newpos;
 708 }
 709
 710 static void
 711 iwl_mvm_build_unified_scan_probe(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 712                                  struct ieee80211_scan_ies *ies,
 713                                  struct iwl_scan_probe_req *preq,
 714                                  const u8 *mac_addr, const u8 *mac_addr_mask)
 715 {
 716         struct ieee80211_mgmt *frame = (struct ieee80211_mgmt *)preq->buf;
 717         u8 *pos, *newpos;
 718
 719         /*
 720          * Unfortunately, right now the offload scan doesn't support randomising
 721          * within the firmware, so until the firmware API is ready we implement
 722          * it in the driver. This means that the scan iterations won't really be
 723          * random, only when it's restarted, but at least that helps a bit.
 724          */
 725         if (mac_addr)
 726                 get_random_mask_addr(frame->sa, mac_addr, mac_addr_mask);
 727         else
 728                 memcpy(frame->sa, vif->addr, ETH_ALEN);
 729
 730         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 731         eth_broadcast_addr(frame->da);
 732         eth_broadcast_addr(frame->bssid);
 733         frame->seq_ctrl = 0;
 734
 735         pos = frame->u.probe_req.variable;
 736         *pos++ = WLAN_EID_SSID;
 737         *pos++ = 0;
 738
 739         preq->mac_header.offset = 0;
 740         preq->mac_header.len = cpu_to_le16(24 + 2);
 741
 742         /* Insert ds parameter set element on 2.4 GHz band */
 743         newpos = iwl_mvm_copy_and_insert_ds_elem(mvm,
 744                                                  ies->ies[IEEE80211_BAND_2GHZ],
 745                                                  ies->len[IEEE80211_BAND_2GHZ],
 746                                                  pos);
 747         preq->band_data[0].offset = cpu_to_le16(pos - preq->buf);
 748         preq->band_data[0].len = cpu_to_le16(newpos - pos);
 749         pos = newpos;
 750
 751         memcpy(pos, ies->ies[IEEE80211_BAND_5GHZ],
 752                ies->len[IEEE80211_BAND_5GHZ]);
 753         preq->band_data[1].offset = cpu_to_le16(pos - preq->buf);
 754         preq->band_data[1].len = cpu_to_le16(ies->len[IEEE80211_BAND_5GHZ]);
 755         pos += ies->len[IEEE80211_BAND_5GHZ];
 756
 757         memcpy(pos, ies->common_ies, ies->common_ie_len);
 758         preq->common_data.offset = cpu_to_le16(pos - preq->buf);
 759         preq->common_data.len = cpu_to_le16(ies->common_ie_len);
 760 }
 761
 762 static void
 763 iwl_mvm_build_generic_unified_scan_cmd(struct iwl_mvm *mvm,
 764                                        struct iwl_scan_req_unified_lmac *cmd,
 765                                        struct iwl_mvm_scan_params *params)
 766 {
 767         memset(cmd, 0, ksize(cmd));
 768         cmd->active_dwell = params->dwell[IEEE80211_BAND_2GHZ].active;
 769         cmd->passive_dwell = params->dwell[IEEE80211_BAND_2GHZ].passive;
 770         if (params->passive_fragmented)
 771                 cmd->fragmented_dwell =
 772                                 params->dwell[IEEE80211_BAND_2GHZ].fragmented;
 773         cmd->rx_chain_select = iwl_mvm_scan_rx_chain(mvm);
 774         cmd->max_out_time = cpu_to_le32(params->max_out_time);
 775         cmd->suspend_time = cpu_to_le32(params->suspend_time);
 776         cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
 777         cmd->iter_num = cpu_to_le32(1);
 778
 779         if (iwl_mvm_rrm_scan_needed(mvm))
 780                 cmd->scan_flags |=
 781                         cpu_to_le32(IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED);
 782 }
 783
 784 int iwl_mvm_unified_scan_lmac(struct iwl_mvm *mvm,
 785                               struct ieee80211_vif *vif,
 786                               struct ieee80211_scan_request *req)
 787 {
 788         struct iwl_host_cmd hcmd = {
 789                 .id = SCAN_OFFLOAD_REQUEST_CMD,
 790                 .len = { sizeof(struct iwl_scan_req_unified_lmac) +
 791                          sizeof(struct iwl_scan_channel_cfg_lmac) *
 792                                 mvm->fw->ucode_capa.n_scan_channels +
 793                          sizeof(struct iwl_scan_probe_req), },
 794                 .data = { mvm->scan_cmd, },
 795                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
 796         };
 797         struct iwl_scan_req_unified_lmac *cmd = mvm->scan_cmd;
 798         struct iwl_scan_probe_req *preq;
 799         struct iwl_mvm_scan_params params = {};
 800         u32 flags;
 801         u32 ssid_bitmap = 0;
 802         int ret, i;
 803
 804         lockdep_assert_held(&mvm->mutex);
 805
 806         /* we should have failed registration if scan_cmd was NULL */
 807         if (WARN_ON(mvm->scan_cmd == NULL))
 808                 return -ENOMEM;
 809
 810         if (req->req.n_ssids > PROBE_OPTION_MAX ||
 811             req->ies.common_ie_len + req->ies.len[NL80211_BAND_2GHZ] +
 812             req->ies.len[NL80211_BAND_5GHZ] >
 813                 iwl_mvm_max_scan_ie_fw_cmd_room(mvm, false) ||
 814             req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
 815                 return -ENOBUFS;
 816
 817         mvm->scan_status = IWL_MVM_SCAN_OS;
 818
 819         iwl_mvm_scan_calc_params(mvm, vif, req->req.n_ssids, req->req.flags,
 820                                  &params);
 821
 822         iwl_mvm_build_generic_unified_scan_cmd(mvm, cmd, &params);
 823
 824         cmd->n_channels = (u8)req->req.n_channels;
 825
 826         flags = IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
 827
 828         if (req->req.n_ssids == 1 && req->req.ssids[0].ssid_len != 0)
 829                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
 830
 831         if (params.passive_fragmented)
 832                 flags |= IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED;
 833
 834         if (req->req.n_ssids == 0)
 835                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 836
 837         cmd->scan_flags |= cpu_to_le32(flags);
 838
 839         cmd->flags = iwl_mvm_scan_rxon_flags(req->req.channels[0]->band);
 840         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
 841                                         MAC_FILTER_IN_BEACON);
 842         iwl_mvm_unified_scan_fill_tx_cmd(mvm, cmd->tx_cmd, req->req.no_cck);
 843         iwl_mvm_scan_fill_ssids(cmd->direct_scan, req->req.ssids,
 844                                 req->req.n_ssids, 0);
 845
 846         cmd->schedule[0].delay = 0;
 847         cmd->schedule[0].iterations = 1;
 848         cmd->schedule[0].full_scan_mul = 0;
 849         cmd->schedule[1].delay = 0;
 850         cmd->schedule[1].iterations = 0;
 851         cmd->schedule[1].full_scan_mul = 0;
 852
 853         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
 854             mvm->last_ebs_successful) {
 855                 cmd->channel_opt[0].flags =
 856                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 857                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 858                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 859                 cmd->channel_opt[0].non_ebs_ratio =
 860                         cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
 861                 cmd->channel_opt[1].flags =
 862                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 863                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 864                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 865                 cmd->channel_opt[1].non_ebs_ratio =
 866                         cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
 867         }
 868
 869         for (i = 1; i <= req->req.n_ssids; i++)
 870                 ssid_bitmap |= BIT(i);
 871
 872         iwl_mvm_lmac_scan_cfg_channels(mvm, req->req.channels,
 873                                        req->req.n_channels, ssid_bitmap,
 874                                        cmd);
 875
 876         preq = (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
 877                         mvm->fw->ucode_capa.n_scan_channels);
 878
 879         iwl_mvm_build_unified_scan_probe(mvm, vif, &req->ies, preq,
 880                 req->req.flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
 881                         req->req.mac_addr : NULL,
 882                 req->req.mac_addr_mask);
 883
 884         ret = iwl_mvm_send_cmd(mvm, &hcmd);
 885         if (!ret) {
 886                 IWL_DEBUG_SCAN(mvm, "Scan request was sent successfully\n");
 887         } else {
 888                 /*
 889                  * If the scan failed, it usually means that the FW was unable
 890                  * to allocate the time events. Warn on it, but maybe we
 891                  * should try to send the command again with different params.
 892                  */
 893                 IWL_ERR(mvm, "Scan failed! ret %d\n", ret);
 894                 mvm->scan_status = IWL_MVM_SCAN_NONE;
 895                 ret = -EIO;
 896         }
 897         return ret;
 898 }
 899
 900 int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
 901                                     struct ieee80211_vif *vif,
 902                                     struct cfg80211_sched_scan_request *req,
 903                                     struct ieee80211_scan_ies *ies)
 904 {
 905         struct iwl_host_cmd hcmd = {
 906                 .id = SCAN_OFFLOAD_REQUEST_CMD,
 907                 .len = { sizeof(struct iwl_scan_req_unified_lmac) +
 908                          sizeof(struct iwl_scan_channel_cfg_lmac) *
 909                                 mvm->fw->ucode_capa.n_scan_channels +
 910                          sizeof(struct iwl_scan_probe_req), },
 911                 .data = { mvm->scan_cmd, },
 912                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
 913         };
 914         struct iwl_scan_req_unified_lmac *cmd = mvm->scan_cmd;
 915         struct iwl_scan_probe_req *preq;
 916         struct iwl_mvm_scan_params params = {};
 917         int ret;
 918         u32 flags = 0, ssid_bitmap = 0;
 919
 920         lockdep_assert_held(&mvm->mutex);
 921
 922         /* we should have failed registration if scan_cmd was NULL */
 923         if (WARN_ON(mvm->scan_cmd == NULL))
 924                 return -ENOMEM;
 925
 926         if (req->n_ssids > PROBE_OPTION_MAX ||
 927             ies->common_ie_len + ies->len[NL80211_BAND_2GHZ] +
 928             ies->len[NL80211_BAND_5GHZ] >
 929                 iwl_mvm_max_scan_ie_fw_cmd_room(mvm, true) ||
 930             req->n_channels > mvm->fw->ucode_capa.n_scan_channels)
 931                 return -ENOBUFS;
 932
 933         iwl_mvm_scan_calc_params(mvm, vif, req->n_ssids, 0, &params);
 934
 935         iwl_mvm_build_generic_unified_scan_cmd(mvm, cmd, &params);
 936
 937         cmd->n_channels = (u8)req->n_channels;
 938
 939         if (iwl_mvm_scan_pass_all(mvm, req))
 940                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
 941         else
 942                 flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
 943
 944         if (req->n_ssids == 1 && req->ssids[0].ssid_len != 0)
 945                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
 946
 947         if (params.passive_fragmented)
 948                 flags |= IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED;
 949
 950         if (req->n_ssids == 0)
 951                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 952
 953 #ifdef CONFIG_IWLWIFI_DEBUGFS
 954         if (mvm->scan_iter_notif_enabled)
 955                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 956 #endif
 957
 958         cmd->scan_flags |= cpu_to_le32(flags);
 959
 960         cmd->flags = iwl_mvm_scan_rxon_flags(req->channels[0]->band);
 961         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
 962                                         MAC_FILTER_IN_BEACON);
 963         iwl_mvm_unified_scan_fill_tx_cmd(mvm, cmd->tx_cmd, false);
 964         iwl_scan_offload_build_ssid(req, cmd->direct_scan, &ssid_bitmap, false);
 965
 966         cmd->schedule[0].delay = cpu_to_le16(req->interval / MSEC_PER_SEC);
 967         cmd->schedule[0].iterations = IWL_FAST_SCHED_SCAN_ITERATIONS;
 968         cmd->schedule[0].full_scan_mul = 1;
 969
 970         cmd->schedule[1].delay = cpu_to_le16(req->interval / MSEC_PER_SEC);
 971         cmd->schedule[1].iterations = 0xff;
 972         cmd->schedule[1].full_scan_mul = IWL_FULL_SCAN_MULTIPLIER;
 973
 974         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
 975             mvm->last_ebs_successful) {
 976                 cmd->channel_opt[0].flags =
 977                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 978                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 979                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 980                 cmd->channel_opt[0].non_ebs_ratio =
 981                         cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
 982                 cmd->channel_opt[1].flags =
 983                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 984                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 985                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 986                 cmd->channel_opt[1].non_ebs_ratio =
 987                         cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
 988         }
 989
 990         iwl_mvm_lmac_scan_cfg_channels(mvm, req->channels, req->n_channels,
 991                                        ssid_bitmap, cmd);
 992
 993         preq = (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
 994                         mvm->fw->ucode_capa.n_scan_channels);
 995
 996         iwl_mvm_build_unified_scan_probe(mvm, vif, ies, preq,
 997                 req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
 998                         req->mac_addr : NULL,
 999                 req->mac_addr_mask);
1000
1001         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1002         if (!ret) {
1003                 IWL_DEBUG_SCAN(mvm,
1004                                "Sched scan request was sent successfully\n");
1005         } else {
1006                 /*
1007                  * If the scan failed, it usually means that the FW was unable
1008                  * to allocate the time events. Warn on it, but maybe we
1009                  * should try to send the command again with different params.
1010                  */
1011                 IWL_ERR(mvm, "Sched scan failed! ret %d\n", ret);
1012                 mvm->scan_status = IWL_MVM_SCAN_NONE;
1013                 ret = -EIO;
1014         }
1015         return ret;
1016 }
1017
1018
1019 int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
1020 {
1021         if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)
1022                 return iwl_umac_scan_stop(mvm, IWL_UMAC_SCAN_UID_REG_SCAN,
1023                                           true);
1024
1025         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
1026                 return 0;
1027
1028         if (iwl_mvm_is_radio_killed(mvm)) {
1029                 ieee80211_scan_completed(mvm->hw, true);
1030                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1031                 mvm->scan_status = IWL_MVM_SCAN_NONE;
1032                 return 0;
1033         }
1034
1035         return iwl_mvm_scan_offload_stop(mvm, true);
1036 }
1037
1038 /* UMAC scan API */
1039
1040 struct iwl_umac_scan_done {
1041         struct iwl_mvm *mvm;
1042         enum iwl_umac_scan_uid_type type;
1043 };
1044
1045 static int rate_to_scan_rate_flag(unsigned int rate)
1046 {
1047         static const int rate_to_scan_rate[IWL_RATE_COUNT] = {
1048                 [IWL_RATE_1M_INDEX]     = SCAN_CONFIG_RATE_1M,
1049                 [IWL_RATE_2M_INDEX]     = SCAN_CONFIG_RATE_2M,
1050                 [IWL_RATE_5M_INDEX]     = SCAN_CONFIG_RATE_5M,
1051                 [IWL_RATE_11M_INDEX]    = SCAN_CONFIG_RATE_11M,
1052                 [IWL_RATE_6M_INDEX]     = SCAN_CONFIG_RATE_6M,
1053                 [IWL_RATE_9M_INDEX]     = SCAN_CONFIG_RATE_9M,
1054                 [IWL_RATE_12M_INDEX]    = SCAN_CONFIG_RATE_12M,
1055                 [IWL_RATE_18M_INDEX]    = SCAN_CONFIG_RATE_18M,
1056                 [IWL_RATE_24M_INDEX]    = SCAN_CONFIG_RATE_24M,
1057                 [IWL_RATE_36M_INDEX]    = SCAN_CONFIG_RATE_36M,
1058                 [IWL_RATE_48M_INDEX]    = SCAN_CONFIG_RATE_48M,
1059                 [IWL_RATE_54M_INDEX]    = SCAN_CONFIG_RATE_54M,
1060         };
1061
1062         return rate_to_scan_rate[rate];
1063 }
1064
1065 static __le32 iwl_mvm_scan_config_rates(struct iwl_mvm *mvm)
1066 {
1067         struct ieee80211_supported_band *band;
1068         unsigned int rates = 0;
1069         int i;
1070
1071         band = &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
1072         for (i = 0; i < band->n_bitrates; i++)
1073                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
1074         band = &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
1075         for (i = 0; i < band->n_bitrates; i++)
1076                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
1077
1078         /* Set both basic rates and supported rates */
1079         rates |= SCAN_CONFIG_SUPPORTED_RATE(rates);
1080
1081         return cpu_to_le32(rates);
1082 }
1083
1084 int iwl_mvm_config_scan(struct iwl_mvm *mvm)
1085 {
1086
1087         struct iwl_scan_config *scan_config;
1088         struct ieee80211_supported_band *band;
1089         int num_channels =
1090                 mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels +
1091                 mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
1092         int ret, i, j = 0, cmd_size, data_size;
1093         struct iwl_host_cmd cmd = {
1094                 .id = SCAN_CFG_CMD,
1095         };
1096
1097         if (WARN_ON(num_channels > mvm->fw->ucode_capa.n_scan_channels))
1098                 return -ENOBUFS;
1099
1100         cmd_size = sizeof(*scan_config) + mvm->fw->ucode_capa.n_scan_channels;
1101
1102         scan_config = kzalloc(cmd_size, GFP_KERNEL);
1103         if (!scan_config)
1104                 return -ENOMEM;
1105
1106         data_size = cmd_size - sizeof(struct iwl_mvm_umac_cmd_hdr);
1107         scan_config->hdr.size = cpu_to_le16(data_size);
1108         scan_config->flags = cpu_to_le32(SCAN_CONFIG_FLAG_ACTIVATE |
1109                                          SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS |
1110                                          SCAN_CONFIG_FLAG_SET_TX_CHAINS |
1111                                          SCAN_CONFIG_FLAG_SET_RX_CHAINS |
1112                                          SCAN_CONFIG_FLAG_SET_ALL_TIMES |
1113                                          SCAN_CONFIG_FLAG_SET_LEGACY_RATES |
1114                                          SCAN_CONFIG_FLAG_SET_MAC_ADDR |
1115                                          SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS|
1116                                          SCAN_CONFIG_N_CHANNELS(num_channels));
1117         scan_config->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
1118         scan_config->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
1119         scan_config->legacy_rates = iwl_mvm_scan_config_rates(mvm);
1120         scan_config->out_of_channel_time = cpu_to_le32(170);
1121         scan_config->suspend_time = cpu_to_le32(30);
1122         scan_config->dwell_active = 20;
1123         scan_config->dwell_passive = 110;
1124         scan_config->dwell_fragmented = 20;
1125
1126         memcpy(&scan_config->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
1127
1128         scan_config->bcast_sta_id = mvm->aux_sta.sta_id;
1129         scan_config->channel_flags = IWL_CHANNEL_FLAG_EBS |
1130                                      IWL_CHANNEL_FLAG_ACCURATE_EBS |
1131                                      IWL_CHANNEL_FLAG_EBS_ADD |
1132                                      IWL_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE;
1133
1134         band = &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
1135         for (i = 0; i < band->n_channels; i++, j++)
1136                 scan_config->channel_array[j] = band->channels[i].hw_value;
1137         band = &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
1138         for (i = 0; i < band->n_channels; i++, j++)
1139                 scan_config->channel_array[j] = band->channels[i].hw_value;
1140
1141         cmd.data[0] = scan_config;
1142         cmd.len[0] = cmd_size;
1143         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
1144
1145         IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
1146
1147         ret = iwl_mvm_send_cmd(mvm, &cmd);
1148
1149         kfree(scan_config);
1150         return ret;
1151 }
1152
1153 static int iwl_mvm_find_scan_uid(struct iwl_mvm *mvm, u32 uid)
1154 {
1155         int i;
1156
1157         for (i = 0; i < IWL_MVM_MAX_SIMULTANEOUS_SCANS; i++)
1158                 if (mvm->scan_uid[i] == uid)
1159                         return i;
1160
1161         return i;
1162 }
1163
1164 static int iwl_mvm_find_free_scan_uid(struct iwl_mvm *mvm)
1165 {
1166         return iwl_mvm_find_scan_uid(mvm, 0);
1167 }
1168
1169 static bool iwl_mvm_find_scan_type(struct iwl_mvm *mvm,
1170                                    enum iwl_umac_scan_uid_type type)
1171 {
1172         int i;
1173
1174         for (i = 0; i < IWL_MVM_MAX_SIMULTANEOUS_SCANS; i++)
1175                 if (mvm->scan_uid[i] & type)
1176                         return true;
1177
1178         return false;
1179 }
1180
1181 static u32 iwl_generate_scan_uid(struct iwl_mvm *mvm,
1182                                  enum iwl_umac_scan_uid_type type)
1183 {
1184         u32 uid;
1185
1186         /* make sure exactly one bit is on in scan type */
1187         WARN_ON(hweight8(type) != 1);
1188
1189         /*
1190          * Make sure scan uids are unique. If one scan lasts long time while
1191          * others are completing frequently, the seq number will wrap up and
1192          * we may have more than one scan with the same uid.
1193          */
1194         do {
1195                 uid = type | (mvm->scan_seq_num <<
1196                               IWL_UMAC_SCAN_UID_SEQ_OFFSET);
1197                 mvm->scan_seq_num++;
1198         } while (iwl_mvm_find_scan_uid(mvm, uid) <
1199                  IWL_MVM_MAX_SIMULTANEOUS_SCANS);
1200
1201         IWL_DEBUG_SCAN(mvm, "Generated scan UID %u\n", uid);
1202
1203         return uid;
1204 }
1205
1206 static void
1207 iwl_mvm_build_generic_umac_scan_cmd(struct iwl_mvm *mvm,
1208                                     struct iwl_scan_req_umac *cmd,
1209                                     struct iwl_mvm_scan_params *params)
1210 {
1211         memset(cmd, 0, ksize(cmd));
1212         cmd->hdr.size = cpu_to_le16(iwl_mvm_scan_size(mvm) -
1213                                     sizeof(struct iwl_mvm_umac_cmd_hdr));
1214         cmd->active_dwell = params->dwell[IEEE80211_BAND_2GHZ].active;
1215         cmd->passive_dwell = params->dwell[IEEE80211_BAND_2GHZ].passive;
1216         if (params->passive_fragmented)
1217                 cmd->fragmented_dwell =
1218                                 params->dwell[IEEE80211_BAND_2GHZ].fragmented;
1219         cmd->max_out_time = cpu_to_le32(params->max_out_time);
1220         cmd->suspend_time = cpu_to_le32(params->suspend_time);
1221         cmd->scan_priority = cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
1222 }
1223
1224 static void
1225 iwl_mvm_umac_scan_cfg_channels(struct iwl_mvm *mvm,
1226                                struct ieee80211_channel **channels,
1227                                int n_channels, u32 ssid_bitmap,
1228                                struct iwl_scan_req_umac *cmd)
1229 {
1230         struct iwl_scan_channel_cfg_umac *channel_cfg = (void *)&cmd->data;
1231         int i;
1232
1233         for (i = 0; i < n_channels; i++) {
1234                 channel_cfg[i].flags = cpu_to_le32(ssid_bitmap);
1235                 channel_cfg[i].channel_num = channels[i]->hw_value;
1236                 channel_cfg[i].iter_count = 1;
1237                 channel_cfg[i].iter_interval = 0;
1238         }
1239 }
1240
1241 static u32 iwl_mvm_scan_umac_common_flags(struct iwl_mvm *mvm, int n_ssids,
1242                                           struct cfg80211_ssid *ssids,
1243                                           int fragmented)
1244 {
1245         int flags = 0;
1246
1247         if (n_ssids == 0)
1248                 flags = IWL_UMAC_SCAN_GEN_FLAGS_PASSIVE;
1249
1250         if (n_ssids == 1 && ssids[0].ssid_len != 0)
1251                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT;
1252
1253         if (fragmented)
1254                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED;
1255
1256         if (iwl_mvm_rrm_scan_needed(mvm))
1257                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED;
1258
1259         return flags;
1260 }
1261
1262 int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1263                       struct ieee80211_scan_request *req)
1264 {
1265         struct iwl_host_cmd hcmd = {
1266                 .id = SCAN_REQ_UMAC,
1267                 .len = { iwl_mvm_scan_size(mvm), },
1268                 .data = { mvm->scan_cmd, },
1269                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1270         };
1271         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
1272         struct iwl_scan_req_umac_tail *sec_part = (void *)&cmd->data +
1273                 sizeof(struct iwl_scan_channel_cfg_umac) *
1274                         mvm->fw->ucode_capa.n_scan_channels;
1275         struct iwl_mvm_scan_params params = {};
1276         u32 uid, flags;
1277         u32 ssid_bitmap = 0;
1278         int ret, i, uid_idx;
1279
1280         lockdep_assert_held(&mvm->mutex);
1281
1282         uid_idx = iwl_mvm_find_free_scan_uid(mvm);
1283         if (uid_idx >= IWL_MVM_MAX_SIMULTANEOUS_SCANS)
1284                 return -EBUSY;
1285
1286         /* we should have failed registration if scan_cmd was NULL */
1287         if (WARN_ON(mvm->scan_cmd == NULL))
1288                 return -ENOMEM;
1289
1290         if (WARN_ON(req->req.n_ssids > PROBE_OPTION_MAX ||
1291                     req->ies.common_ie_len +
1292                     req->ies.len[NL80211_BAND_2GHZ] +
1293                     req->ies.len[NL80211_BAND_5GHZ] + 24 + 2 >
1294                     SCAN_OFFLOAD_PROBE_REQ_SIZE || req->req.n_channels >
1295                     mvm->fw->ucode_capa.n_scan_channels))
1296                 return -ENOBUFS;
1297
1298         iwl_mvm_scan_calc_params(mvm, vif, req->req.n_ssids, req->req.flags,
1299                                  &params);
1300
1301         iwl_mvm_build_generic_umac_scan_cmd(mvm, cmd, &params);
1302
1303         uid = iwl_generate_scan_uid(mvm, IWL_UMAC_SCAN_UID_REG_SCAN);
1304         mvm->scan_uid[uid_idx] = uid;
1305         cmd->uid = cpu_to_le32(uid);
1306
1307         cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
1308
1309         flags = iwl_mvm_scan_umac_common_flags(mvm, req->req.n_ssids,
1310                                                req->req.ssids,
1311                                                params.passive_fragmented);
1312
1313         flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
1314
1315         cmd->general_flags = cpu_to_le32(flags);
1316
1317         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
1318             mvm->last_ebs_successful)
1319                 cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
1320                                      IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1321                                      IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
1322
1323         cmd->n_channels = req->req.n_channels;
1324
1325         for (i = 0; i < req->req.n_ssids; i++)
1326                 ssid_bitmap |= BIT(i);
1327
1328         iwl_mvm_umac_scan_cfg_channels(mvm, req->req.channels,
1329                                        req->req.n_channels, ssid_bitmap, cmd);
1330
1331         sec_part->schedule[0].iter_count = 1;
1332         sec_part->delay = 0;
1333
1334         iwl_mvm_build_unified_scan_probe(mvm, vif, &req->ies, &sec_part->preq,
1335                 req->req.flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
1336                         req->req.mac_addr : NULL,
1337                 req->req.mac_addr_mask);
1338
1339         iwl_mvm_scan_fill_ssids(sec_part->direct_scan, req->req.ssids,
1340                                 req->req.n_ssids, 0);
1341
1342         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1343         if (!ret) {
1344                 IWL_DEBUG_SCAN(mvm,
1345                                "Scan request was sent successfully\n");
1346         } else {
1347                 /*
1348                  * If the scan failed, it usually means that the FW was unable
1349                  * to allocate the time events. Warn on it, but maybe we
1350                  * should try to send the command again with different params.
1351                  */
1352                 IWL_ERR(mvm, "Scan failed! ret %d\n", ret);
1353         }
1354         return ret;
1355 }
1356
1357 int iwl_mvm_sched_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1358                             struct cfg80211_sched_scan_request *req,
1359                             struct ieee80211_scan_ies *ies)
1360 {
1361
1362         struct iwl_host_cmd hcmd = {
1363                 .id = SCAN_REQ_UMAC,
1364                 .len = { iwl_mvm_scan_size(mvm), },
1365                 .data = { mvm->scan_cmd, },
1366                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1367         };
1368         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
1369         struct iwl_scan_req_umac_tail *sec_part = (void *)&cmd->data +
1370                 sizeof(struct iwl_scan_channel_cfg_umac) *
1371                         mvm->fw->ucode_capa.n_scan_channels;
1372         struct iwl_mvm_scan_params params = {};
1373         u32 uid, flags;
1374         u32 ssid_bitmap = 0;
1375         int ret, uid_idx;
1376
1377         lockdep_assert_held(&mvm->mutex);
1378
1379         uid_idx = iwl_mvm_find_free_scan_uid(mvm);
1380         if (uid_idx >= IWL_MVM_MAX_SIMULTANEOUS_SCANS)
1381                 return -EBUSY;
1382
1383         /* we should have failed registration if scan_cmd was NULL */
1384         if (WARN_ON(mvm->scan_cmd == NULL))
1385                 return -ENOMEM;
1386
1387         if (WARN_ON(req->n_ssids > PROBE_OPTION_MAX ||
1388                     ies->common_ie_len + ies->len[NL80211_BAND_2GHZ] +
1389                     ies->len[NL80211_BAND_5GHZ] + 24 + 2 >
1390                     SCAN_OFFLOAD_PROBE_REQ_SIZE || req->n_channels >
1391                     mvm->fw->ucode_capa.n_scan_channels))
1392                 return -ENOBUFS;
1393
1394         iwl_mvm_scan_calc_params(mvm, vif, req->n_ssids, req->flags,
1395                                          &params);
1396
1397         iwl_mvm_build_generic_umac_scan_cmd(mvm, cmd, &params);
1398
1399         cmd->flags = cpu_to_le32(IWL_UMAC_SCAN_FLAG_PREEMPTIVE);
1400
1401         uid = iwl_generate_scan_uid(mvm, IWL_UMAC_SCAN_UID_SCHED_SCAN);
1402         mvm->scan_uid[uid_idx] = uid;
1403         cmd->uid = cpu_to_le32(uid);
1404
1405         cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_LOW);
1406
1407         flags = iwl_mvm_scan_umac_common_flags(mvm, req->n_ssids, req->ssids,
1408                                                params.passive_fragmented);
1409
1410         flags |= IWL_UMAC_SCAN_GEN_FLAGS_PERIODIC;
1411
1412         if (iwl_mvm_scan_pass_all(mvm, req))
1413                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
1414         else
1415                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_MATCH;
1416
1417         cmd->general_flags = cpu_to_le32(flags);
1418
1419         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
1420             mvm->last_ebs_successful)
1421                 cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
1422                                      IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1423                                      IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
1424
1425         cmd->n_channels = req->n_channels;
1426
1427         iwl_scan_offload_build_ssid(req, sec_part->direct_scan, &ssid_bitmap,
1428                                     false);
1429
1430         /* This API uses bits 0-19 instead of 1-20. */
1431         ssid_bitmap = ssid_bitmap >> 1;
1432
1433         iwl_mvm_umac_scan_cfg_channels(mvm, req->channels, req->n_channels,
1434                                        ssid_bitmap, cmd);
1435
1436         sec_part->schedule[0].interval =
1437                                 cpu_to_le16(req->interval / MSEC_PER_SEC);
1438         sec_part->schedule[0].iter_count = 0xff;
1439
1440         sec_part->delay = 0;
1441
1442         iwl_mvm_build_unified_scan_probe(mvm, vif, ies, &sec_part->preq,
1443                 req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
1444                         req->mac_addr : NULL,
1445                 req->mac_addr_mask);
1446
1447         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1448         if (!ret) {
1449                 IWL_DEBUG_SCAN(mvm,
1450                                "Sched scan request was sent successfully\n");
1451         } else {
1452                 /*
1453                  * If the scan failed, it usually means that the FW was unable
1454                  * to allocate the time events. Warn on it, but maybe we
1455                  * should try to send the command again with different params.
1456                  */
1457                 IWL_ERR(mvm, "Sched scan failed! ret %d\n", ret);
1458         }
1459         return ret;
1460 }
1461
1462 int iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
1463                                         struct iwl_rx_cmd_buffer *rxb,
1464                                         struct iwl_device_cmd *cmd)
1465 {
1466         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1467         struct iwl_umac_scan_complete *notif = (void *)pkt->data;
1468         u32 uid = __le32_to_cpu(notif->uid);
1469         bool sched = !!(uid & IWL_UMAC_SCAN_UID_SCHED_SCAN);
1470         int uid_idx = iwl_mvm_find_scan_uid(mvm, uid);
1471
1472         /*
1473          * Scan uid may be set to zero in case of scan abort request from above.
1474          */
1475         if (uid_idx >= IWL_MVM_MAX_SIMULTANEOUS_SCANS)
1476                 return 0;
1477
1478         IWL_DEBUG_SCAN(mvm,
1479                        "Scan completed, uid %u type %s, status %s, EBS status %s\n",
1480                        uid, sched ? "sched" : "regular",
1481                        notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
1482                                 "completed" : "aborted",
1483                        notif->ebs_status == IWL_SCAN_EBS_SUCCESS ?
1484                                 "success" : "failed");
1485
1486         if (notif->ebs_status)
1487                 mvm->last_ebs_successful = false;
1488
1489         mvm->scan_uid[uid_idx] = 0;
1490
1491         if (!sched) {
1492                 ieee80211_scan_completed(mvm->hw,
1493                                          notif->status ==
1494                                                 IWL_SCAN_OFFLOAD_ABORTED);
1495                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1496         } else if (!iwl_mvm_find_scan_type(mvm, IWL_UMAC_SCAN_UID_SCHED_SCAN)) {
1497                 ieee80211_sched_scan_stopped(mvm->hw);
1498         } else {
1499                 IWL_DEBUG_SCAN(mvm, "Another sched scan is running\n");
1500         }
1501
1502         return 0;
1503 }
1504
1505 static bool iwl_scan_umac_done_check(struct iwl_notif_wait_data *notif_wait,
1506                                      struct iwl_rx_packet *pkt, void *data)
1507 {
1508         struct iwl_umac_scan_done *scan_done = data;
1509         struct iwl_umac_scan_complete *notif = (void *)pkt->data;
1510         u32 uid = __le32_to_cpu(notif->uid);
1511         int uid_idx = iwl_mvm_find_scan_uid(scan_done->mvm, uid);
1512
1513         if (WARN_ON(pkt->hdr.cmd != SCAN_COMPLETE_UMAC))
1514                 return false;
1515
1516         if (uid_idx >= IWL_MVM_MAX_SIMULTANEOUS_SCANS)
1517                 return false;
1518
1519         /*
1520          * Clear scan uid of scans that was aborted from above and completed
1521          * in FW so the RX handler does nothing. Set last_ebs_successful here if
1522          * needed.
1523          */
1524         scan_done->mvm->scan_uid[uid_idx] = 0;
1525
1526         if (notif->ebs_status)
1527                 scan_done->mvm->last_ebs_successful = false;
1528
1529         return !iwl_mvm_find_scan_type(scan_done->mvm, scan_done->type);
1530 }
1531
1532 static int iwl_umac_scan_abort_one(struct iwl_mvm *mvm, u32 uid)
1533 {
1534         struct iwl_umac_scan_abort cmd = {
1535                 .hdr.size = cpu_to_le16(sizeof(struct iwl_umac_scan_abort) -
1536                                         sizeof(struct iwl_mvm_umac_cmd_hdr)),
1537                 .uid = cpu_to_le32(uid),
1538         };
1539
1540         lockdep_assert_held(&mvm->mutex);
1541
1542         IWL_DEBUG_SCAN(mvm, "Sending scan abort, uid %u\n", uid);
1543
1544         return iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_UMAC, 0, sizeof(cmd), &cmd);
1545 }
1546
1547 static int iwl_umac_scan_stop(struct iwl_mvm *mvm,
1548                               enum iwl_umac_scan_uid_type type, bool notify)
1549 {
1550         struct iwl_notification_wait wait_scan_done;
1551         static const u8 scan_done_notif[] = { SCAN_COMPLETE_UMAC, };
1552         struct iwl_umac_scan_done scan_done = {
1553                 .mvm = mvm,
1554                 .type = type,
1555         };
1556         int i, ret = -EIO;
1557
1558         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
1559                                    scan_done_notif,
1560                                    ARRAY_SIZE(scan_done_notif),
1561                                    iwl_scan_umac_done_check, &scan_done);
1562
1563         IWL_DEBUG_SCAN(mvm, "Preparing to stop scan, type %x\n", type);
1564
1565         for (i = 0; i < IWL_MVM_MAX_SIMULTANEOUS_SCANS; i++) {
1566                 if (mvm->scan_uid[i] & type) {
1567                         int err;
1568
1569                         if (iwl_mvm_is_radio_killed(mvm) &&
1570                             (type & IWL_UMAC_SCAN_UID_REG_SCAN)) {
1571                                 ieee80211_scan_completed(mvm->hw, true);
1572                                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1573                                 break;
1574                         }
1575
1576                         err = iwl_umac_scan_abort_one(mvm, mvm->scan_uid[i]);
1577                         if (!err)
1578                                 ret = 0;
1579                 }
1580         }
1581
1582         if (ret) {
1583                 IWL_DEBUG_SCAN(mvm, "Couldn't stop scan\n");
1584                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
1585                 return ret;
1586         }
1587
1588         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
1589         if (ret)
1590                 return ret;
1591
1592         if (notify) {
1593                 if (type & IWL_UMAC_SCAN_UID_SCHED_SCAN)
1594                         ieee80211_sched_scan_stopped(mvm->hw);
1595                 if (type & IWL_UMAC_SCAN_UID_REG_SCAN) {
1596                         ieee80211_scan_completed(mvm->hw, true);
1597                         iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1598                 }
1599         }
1600
1601         return ret;
1602 }
1603
1604 int iwl_mvm_scan_size(struct iwl_mvm *mvm)
1605 {
1606         if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)
1607                 return sizeof(struct iwl_scan_req_umac) +
1608                         sizeof(struct iwl_scan_channel_cfg_umac) *
1609                                 mvm->fw->ucode_capa.n_scan_channels +
1610                         sizeof(struct iwl_scan_req_umac_tail);
1611
1612         return sizeof(struct iwl_scan_req_unified_lmac) +
1613                 sizeof(struct iwl_scan_channel_cfg_lmac) *
1614                 mvm->fw->ucode_capa.n_scan_channels +
1615                 sizeof(struct iwl_scan_probe_req);
1616 }