drivers/net/wireless/iwlwifi/mvm/scan.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of version 2 of the GNU General Public License as
  13  * published by the Free Software Foundation.
  14  *
  15  * This program is distributed in the hope that it will be useful, but
  16  * WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  23  * USA
  24  *
  25  * The full GNU General Public License is included in this distribution
  26  * in the file called COPYING.
  27  *
  28  * Contact Information:
  29  *  Intel Linux Wireless <ilw@linux.intel.com>
  30  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  31  *
  32  * BSD LICENSE
  33  *
  34  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  35  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  36  * All rights reserved.
  37  *
  38  * Redistribution and use in source and binary forms, with or without
  39  * modification, are permitted provided that the following conditions
  40  * are met:
  41  *
  42  *  * Redistributions of source code must retain the above copyright
  43  *    notice, this list of conditions and the following disclaimer.
  44  *  * Redistributions in binary form must reproduce the above copyright
  45  *    notice, this list of conditions and the following disclaimer in
  46  *    the documentation and/or other materials provided with the
  47  *    distribution.
  48  *  * Neither the name Intel Corporation nor the names of its
  49  *    contributors may be used to endorse or promote products derived
  50  *    from this software without specific prior written permission.
  51  *
  52  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  53  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  54  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  55  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  56  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  57  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  58  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  59  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  60  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  61  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  62  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  63  *
  64  *****************************************************************************/
  65
  66 #include <linux/etherdevice.h>
  67 #include <net/mac80211.h>
  68
  69 #include "mvm.h"
  70 #include "fw-api-scan.h"
  71
  72 #define IWL_DENSE_EBS_SCAN_RATIO 5
  73 #define IWL_SPARSE_EBS_SCAN_RATIO 1
  74
  75 struct iwl_mvm_scan_params {
  76         u32 max_out_time;
  77         u32 suspend_time;
  78         bool passive_fragmented;
  79         u32 n_channels;
  80         u16 delay;
  81         int n_ssids;
  82         struct cfg80211_ssid *ssids;
  83         struct ieee80211_channel **channels;
  84         u16 interval; /* interval between scans (in secs) */
  85         u32 flags;
  86         u8 *mac_addr;
  87         u8 *mac_addr_mask;
  88         bool no_cck;
  89         bool pass_all;
  90         int n_match_sets;
  91         struct iwl_scan_probe_req preq;
  92         struct cfg80211_match_set *match_sets;
  93         struct _dwell {
  94                 u16 passive;
  95                 u16 active;
  96                 u16 fragmented;
  97         } dwell[IEEE80211_NUM_BANDS];
  98         struct {
  99                 u8 iterations;
 100                 u8 full_scan_mul; /* not used for UMAC */
 101         } schedule[2];
 102 };
 103
 104 static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 105 {
 106         if (mvm->scan_rx_ant != ANT_NONE)
 107                 return mvm->scan_rx_ant;
 108         return iwl_mvm_get_valid_rx_ant(mvm);
 109 }
 110
 111 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 112 {
 113         u16 rx_chain;
 114         u8 rx_ant;
 115
 116         rx_ant = iwl_mvm_scan_rx_ant(mvm);
 117         rx_chain = rx_ant << PHY_RX_CHAIN_VALID_POS;
 118         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
 119         rx_chain |= rx_ant << PHY_RX_CHAIN_FORCE_SEL_POS;
 120         rx_chain |= 0x1 << PHY_RX_CHAIN_DRIVER_FORCE_POS;
 121         return cpu_to_le16(rx_chain);
 122 }
 123
 124 static __le32 iwl_mvm_scan_rxon_flags(enum ieee80211_band band)
 125 {
 126         if (band == IEEE80211_BAND_2GHZ)
 127                 return cpu_to_le32(PHY_BAND_24);
 128         else
 129                 return cpu_to_le32(PHY_BAND_5);
 130 }
 131
 132 static inline __le32
 133 iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum ieee80211_band band,
 134                           bool no_cck)
 135 {
 136         u32 tx_ant;
 137
 138         mvm->scan_last_antenna_idx =
 139                 iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
 140                                      mvm->scan_last_antenna_idx);
 141         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 142
 143         if (band == IEEE80211_BAND_2GHZ && !no_cck)
 144                 return cpu_to_le32(IWL_RATE_1M_PLCP | RATE_MCS_CCK_MSK |
 145                                    tx_ant);
 146         else
 147                 return cpu_to_le32(IWL_RATE_6M_PLCP | tx_ant);
 148 }
 149
 150 /*
 151  * If req->n_ssids > 0, it means we should do an active scan.
 152  * In case of active scan w/o directed scan, we receive a zero-length SSID
 153  * just to notify that this scan is active and not passive.
 154  * In order to notify the FW of the number of SSIDs we wish to scan (including
 155  * the zero-length one), we need to set the corresponding bits in chan->type,
 156  * one for each SSID, and set the active bit (first). If the first SSID is
 157  * already included in the probe template, so we need to set only
 158  * req->n_ssids - 1 bits in addition to the first bit.
 159  */
 160 static u16 iwl_mvm_get_active_dwell(struct iwl_mvm *mvm,
 161                                     enum ieee80211_band band, int n_ssids)
 162 {
 163         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_BASIC_DWELL))
 164                 return 10;
 165         if (band == IEEE80211_BAND_2GHZ)
 166                 return 20  + 3 * (n_ssids + 1);
 167         return 10  + 2 * (n_ssids + 1);
 168 }
 169
 170 static u16 iwl_mvm_get_passive_dwell(struct iwl_mvm *mvm,
 171                                      enum ieee80211_band band)
 172 {
 173         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_BASIC_DWELL))
 174                         return 110;
 175         return band == IEEE80211_BAND_2GHZ ? 100 + 20 : 100 + 10;
 176 }
 177
 178 static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
 179                                             struct ieee80211_vif *vif)
 180 {
 181         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 182         int *global_cnt = data;
 183
 184         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
 185             mvmvif->phy_ctxt->id < MAX_PHYS)
 186                 *global_cnt += 1;
 187 }
 188
 189 static void iwl_mvm_scan_calc_dwell(struct iwl_mvm *mvm,
 190                                     struct ieee80211_vif *vif,
 191                                     struct iwl_mvm_scan_params *params)
 192 {
 193         int global_cnt = 0;
 194         enum ieee80211_band band;
 195         u8 frag_passive_dwell = 0;
 196
 197         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
 198                                             IEEE80211_IFACE_ITER_NORMAL,
 199                                             iwl_mvm_scan_condition_iterator,
 200                                             &global_cnt);
 201         if (!global_cnt)
 202                 goto not_bound;
 203
 204         params->suspend_time = 30;
 205         params->max_out_time = 120;
 206
 207         if (iwl_mvm_low_latency(mvm)) {
 208                 if (fw_has_api(&mvm->fw->ucode_capa,
 209                                IWL_UCODE_TLV_API_FRAGMENTED_SCAN)) {
 210
 211                         params->suspend_time = 105;
 212                         /*
 213                          * If there is more than one active interface make
 214                          * passive scan more fragmented.
 215                          */
 216                         frag_passive_dwell = 40;
 217                         params->max_out_time = frag_passive_dwell;
 218                 } else {
 219                         params->suspend_time = 120;
 220                         params->max_out_time = 120;
 221                 }
 222         }
 223
 224         if (frag_passive_dwell &&
 225             fw_has_api(&mvm->fw->ucode_capa,
 226                        IWL_UCODE_TLV_API_FRAGMENTED_SCAN)) {
 227                 /*
 228                  * P2P device scan should not be fragmented to avoid negative
 229                  * impact on P2P device discovery. Configure max_out_time to be
 230                  * equal to dwell time on passive channel. Take a longest
 231                  * possible value, one that corresponds to 2GHz band
 232                  */
 233                 if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
 234                         u32 passive_dwell =
 235                                 iwl_mvm_get_passive_dwell(mvm,
 236                                                           IEEE80211_BAND_2GHZ);
 237                         params->max_out_time = passive_dwell;
 238                 } else {
 239                         params->passive_fragmented = true;
 240                 }
 241         }
 242
 243         if ((params->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
 244             (params->max_out_time > 200))
 245                 params->max_out_time = 200;
 246
 247 not_bound:
 248
 249         for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
 250                 if (params->passive_fragmented)
 251                         params->dwell[band].fragmented = frag_passive_dwell;
 252
 253                 params->dwell[band].passive = iwl_mvm_get_passive_dwell(mvm,
 254                                                                         band);
 255                 params->dwell[band].active =
 256                         iwl_mvm_get_active_dwell(mvm, band, params->n_ssids);
 257         }
 258
 259         IWL_DEBUG_SCAN(mvm,
 260                        "scan parameters: max_out_time %d, suspend_time %d, passive_fragmented %d\n",
 261                        params->max_out_time, params->suspend_time,
 262                        params->passive_fragmented);
 263         IWL_DEBUG_SCAN(mvm,
 264                        "dwell[IEEE80211_BAND_2GHZ]: passive %d, active %d, fragmented %d\n",
 265                        params->dwell[IEEE80211_BAND_2GHZ].passive,
 266                        params->dwell[IEEE80211_BAND_2GHZ].active,
 267                        params->dwell[IEEE80211_BAND_2GHZ].fragmented);
 268         IWL_DEBUG_SCAN(mvm,
 269                        "dwell[IEEE80211_BAND_5GHZ]: passive %d, active %d, fragmented %d\n",
 270                        params->dwell[IEEE80211_BAND_5GHZ].passive,
 271                        params->dwell[IEEE80211_BAND_5GHZ].active,
 272                        params->dwell[IEEE80211_BAND_5GHZ].fragmented);
 273 }
 274
 275 static inline bool iwl_mvm_rrm_scan_needed(struct iwl_mvm *mvm)
 276 {
 277         /* require rrm scan whenever the fw supports it */
 278         return fw_has_capa(&mvm->fw->ucode_capa,
 279                            IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT);
 280 }
 281
 282 static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm)
 283 {
 284         int max_probe_len;
 285
 286         max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
 287
 288         /* we create the 802.11 header and SSID element */
 289         max_probe_len -= 24 + 2;
 290
 291         /* DS parameter set element is added on 2.4GHZ band if required */
 292         if (iwl_mvm_rrm_scan_needed(mvm))
 293                 max_probe_len -= 3;
 294
 295         return max_probe_len;
 296 }
 297
 298 int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm)
 299 {
 300         int max_ie_len = iwl_mvm_max_scan_ie_fw_cmd_room(mvm);
 301
 302         /* TODO: [BUG] This function should return the maximum allowed size of
 303          * scan IEs, however the LMAC scan api contains both 2GHZ and 5GHZ IEs
 304          * in the same command. So the correct implementation of this function
 305          * is just iwl_mvm_max_scan_ie_fw_cmd_room() / 2. Currently the scan
 306          * command has only 512 bytes and it would leave us with about 240
 307          * bytes for scan IEs, which is clearly not enough. So meanwhile
 308          * we will report an incorrect value. This may result in a failure to
 309          * issue a scan in unified_scan_lmac and unified_sched_scan_lmac
 310          * functions with -ENOBUFS, if a large enough probe will be provided.
 311          */
 312         return max_ie_len;
 313 }
 314
 315 static u8 *iwl_mvm_dump_channel_list(struct iwl_scan_results_notif *res,
 316                                      int num_res, u8 *buf, size_t buf_size)
 317 {
 318         int i;
 319         u8 *pos = buf, *end = buf + buf_size;
 320
 321         for (i = 0; pos < end && i < num_res; i++)
 322                 pos += snprintf(pos, end - pos, " %u", res[i].channel);
 323
 324         /* terminate the string in case the buffer was too short */
 325         *(buf + buf_size - 1) = '\0';
 326
 327         return buf;
 328 }
 329
 330 int iwl_mvm_rx_lmac_scan_iter_complete_notif(struct iwl_mvm *mvm,
 331                                              struct iwl_rx_cmd_buffer *rxb,
 332                                              struct iwl_device_cmd *cmd)
 333 {
 334         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 335         struct iwl_lmac_scan_complete_notif *notif = (void *)pkt->data;
 336         u8 buf[256];
 337
 338         IWL_DEBUG_SCAN(mvm,
 339                        "Scan offload iteration complete: status=0x%x scanned channels=%d channels list: %s\n",
 340                        notif->status, notif->scanned_channels,
 341                        iwl_mvm_dump_channel_list(notif->results,
 342                                                  notif->scanned_channels, buf,
 343                                                  sizeof(buf)));
 344         return 0;
 345 }
 346
 347 int iwl_mvm_rx_scan_match_found(struct iwl_mvm *mvm,
 348                                 struct iwl_rx_cmd_buffer *rxb,
 349                                 struct iwl_device_cmd *cmd)
 350 {
 351         IWL_DEBUG_SCAN(mvm, "Scheduled scan results\n");
 352         ieee80211_sched_scan_results(mvm->hw);
 353
 354         return 0;
 355 }
 356
 357 static const char *iwl_mvm_ebs_status_str(enum iwl_scan_ebs_status status)
 358 {
 359         switch (status) {
 360         case IWL_SCAN_EBS_SUCCESS:
 361                 return "successful";
 362         case IWL_SCAN_EBS_INACTIVE:
 363                 return "inactive";
 364         case IWL_SCAN_EBS_FAILED:
 365         case IWL_SCAN_EBS_CHAN_NOT_FOUND:
 366         default:
 367                 return "failed";
 368         }
 369 }
 370
 371 int iwl_mvm_rx_lmac_scan_complete_notif(struct iwl_mvm *mvm,
 372                                         struct iwl_rx_cmd_buffer *rxb,
 373                                         struct iwl_device_cmd *cmd)
 374 {
 375         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 376         struct iwl_periodic_scan_complete *scan_notif = (void *)pkt->data;
 377         bool aborted = (scan_notif->status == IWL_SCAN_OFFLOAD_ABORTED);
 378
 379         /* scan status must be locked for proper checking */
 380         lockdep_assert_held(&mvm->mutex);
 381
 382         /* We first check if we were stopping a scan, in which case we
 383          * just clear the stopping flag.  Then we check if it was a
 384          * firmware initiated stop, in which case we need to inform
 385          * mac80211.
 386          * Note that we can have a stopping and a running scan
 387          * simultaneously, but we can't have two different types of
 388          * scans stopping or running at the same time (since LMAC
 389          * doesn't support it).
 390          */
 391
 392         if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_SCHED) {
 393                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR);
 394
 395                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s\n",
 396                                aborted ? "aborted" : "completed",
 397                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 398
 399                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_SCHED;
 400         } else if (mvm->scan_status & IWL_MVM_SCAN_STOPPING_REGULAR) {
 401                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s\n",
 402                                aborted ? "aborted" : "completed",
 403                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 404
 405                 mvm->scan_status &= ~IWL_MVM_SCAN_STOPPING_REGULAR;
 406         } else if (mvm->scan_status & IWL_MVM_SCAN_SCHED) {
 407                 WARN_ON_ONCE(mvm->scan_status & IWL_MVM_SCAN_REGULAR);
 408
 409                 IWL_DEBUG_SCAN(mvm, "Scheduled scan %s, EBS status %s (FW)\n",
 410                                aborted ? "aborted" : "completed",
 411                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 412
 413                 mvm->scan_status &= ~IWL_MVM_SCAN_SCHED;
 414                 ieee80211_sched_scan_stopped(mvm->hw);
 415         } else if (mvm->scan_status & IWL_MVM_SCAN_REGULAR) {
 416                 IWL_DEBUG_SCAN(mvm, "Regular scan %s, EBS status %s (FW)\n",
 417                                aborted ? "aborted" : "completed",
 418                                iwl_mvm_ebs_status_str(scan_notif->ebs_status));
 419
 420                 mvm->scan_status &= ~IWL_MVM_SCAN_REGULAR;
 421                 ieee80211_scan_completed(mvm->hw,
 422                                 scan_notif->status == IWL_SCAN_OFFLOAD_ABORTED);
 423                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 424         }
 425
 426         mvm->last_ebs_successful =
 427                         scan_notif->ebs_status == IWL_SCAN_EBS_SUCCESS ||
 428                         scan_notif->ebs_status == IWL_SCAN_EBS_INACTIVE;
 429
 430         return 0;
 431 }
 432
 433 static int iwl_ssid_exist(u8 *ssid, u8 ssid_len, struct iwl_ssid_ie *ssid_list)
 434 {
 435         int i;
 436
 437         for (i = 0; i < PROBE_OPTION_MAX; i++) {
 438                 if (!ssid_list[i].len)
 439                         break;
 440                 if (ssid_list[i].len == ssid_len &&
 441                     !memcmp(ssid_list->ssid, ssid, ssid_len))
 442                         return i;
 443         }
 444         return -1;
 445 }
 446
 447 /* We insert the SSIDs in an inverted order, because the FW will
 448  * invert it back.
 449  */
 450 static void iwl_scan_build_ssids(struct iwl_mvm_scan_params *params,
 451                                  struct iwl_ssid_ie *ssids,
 452                                  u32 *ssid_bitmap)
 453 {
 454         int i, j;
 455         int index;
 456
 457         /*
 458          * copy SSIDs from match list.
 459          * iwl_config_sched_scan_profiles() uses the order of these ssids to
 460          * config match list.
 461          */
 462         for (i = 0, j = params->n_match_sets - 1;
 463              j >= 0 && i < PROBE_OPTION_MAX;
 464              i++, j--) {
 465                 /* skip empty SSID matchsets */
 466                 if (!params->match_sets[j].ssid.ssid_len)
 467                         continue;
 468                 ssids[i].id = WLAN_EID_SSID;
 469                 ssids[i].len = params->match_sets[j].ssid.ssid_len;
 470                 memcpy(ssids[i].ssid, params->match_sets[j].ssid.ssid,
 471                        ssids[i].len);
 472         }
 473
 474         /* add SSIDs from scan SSID list */
 475         *ssid_bitmap = 0;
 476         for (j = params->n_ssids - 1;
 477              j >= 0 && i < PROBE_OPTION_MAX;
 478              i++, j--) {
 479                 index = iwl_ssid_exist(params->ssids[j].ssid,
 480                                        params->ssids[j].ssid_len,
 481                                        ssids);
 482                 if (index < 0) {
 483                         ssids[i].id = WLAN_EID_SSID;
 484                         ssids[i].len = params->ssids[j].ssid_len;
 485                         memcpy(ssids[i].ssid, params->ssids[j].ssid,
 486                                ssids[i].len);
 487                         *ssid_bitmap |= BIT(i);
 488                 } else {
 489                         *ssid_bitmap |= BIT(index);
 490                 }
 491         }
 492 }
 493
 494 static int
 495 iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
 496                                    struct cfg80211_sched_scan_request *req)
 497 {
 498         struct iwl_scan_offload_profile *profile;
 499         struct iwl_scan_offload_profile_cfg *profile_cfg;
 500         struct iwl_scan_offload_blacklist *blacklist;
 501         struct iwl_host_cmd cmd = {
 502                 .id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
 503                 .len[1] = sizeof(*profile_cfg),
 504                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
 505                 .dataflags[1] = IWL_HCMD_DFL_NOCOPY,
 506         };
 507         int blacklist_len;
 508         int i;
 509         int ret;
 510
 511         if (WARN_ON(req->n_match_sets > IWL_SCAN_MAX_PROFILES))
 512                         return -EIO;
 513
 514         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SHORT_BL)
 515                 blacklist_len = IWL_SCAN_SHORT_BLACKLIST_LEN;
 516         else
 517                 blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 518
 519         blacklist = kzalloc(sizeof(*blacklist) * blacklist_len, GFP_KERNEL);
 520         if (!blacklist)
 521                 return -ENOMEM;
 522
 523         profile_cfg = kzalloc(sizeof(*profile_cfg), GFP_KERNEL);
 524         if (!profile_cfg) {
 525                 ret = -ENOMEM;
 526                 goto free_blacklist;
 527         }
 528
 529         cmd.data[0] = blacklist;
 530         cmd.len[0] = sizeof(*blacklist) * blacklist_len;
 531         cmd.data[1] = profile_cfg;
 532
 533         /* No blacklist configuration */
 534
 535         profile_cfg->num_profiles = req->n_match_sets;
 536         profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
 537         profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
 538         profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
 539         if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
 540                 profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
 541
 542         for (i = 0; i < req->n_match_sets; i++) {
 543                 profile = &profile_cfg->profiles[i];
 544                 profile->ssid_index = i;
 545                 /* Support any cipher and auth algorithm */
 546                 profile->unicast_cipher = 0xff;
 547                 profile->auth_alg = 0xff;
 548                 profile->network_type = IWL_NETWORK_TYPE_ANY;
 549                 profile->band_selection = IWL_SCAN_OFFLOAD_SELECT_ANY;
 550                 profile->client_bitmap = SCAN_CLIENT_SCHED_SCAN;
 551         }
 552
 553         IWL_DEBUG_SCAN(mvm, "Sending scheduled scan profile config\n");
 554
 555         ret = iwl_mvm_send_cmd(mvm, &cmd);
 556         kfree(profile_cfg);
 557 free_blacklist:
 558         kfree(blacklist);
 559
 560         return ret;
 561 }
 562
 563 static bool iwl_mvm_scan_pass_all(struct iwl_mvm *mvm,
 564                                   struct cfg80211_sched_scan_request *req)
 565 {
 566         if (req->n_match_sets && req->match_sets[0].ssid.ssid_len) {
 567                 IWL_DEBUG_SCAN(mvm,
 568                                "Sending scheduled scan with filtering, n_match_sets %d\n",
 569                                req->n_match_sets);
 570                 return false;
 571         }
 572
 573         IWL_DEBUG_SCAN(mvm, "Sending Scheduled scan without filtering\n");
 574         return true;
 575 }
 576
 577 static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
 578 {
 579         int ret;
 580         struct iwl_host_cmd cmd = {
 581                 .id = SCAN_OFFLOAD_ABORT_CMD,
 582         };
 583         u32 status;
 584
 585         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
 586         if (ret)
 587                 return ret;
 588
 589         if (status != CAN_ABORT_STATUS) {
 590                 /*
 591                  * The scan abort will return 1 for success or
 592                  * 2 for "failure".  A failure condition can be
 593                  * due to simply not being in an active scan which
 594                  * can occur if we send the scan abort before the
 595                  * microcode has notified us that a scan is completed.
 596                  */
 597                 IWL_DEBUG_SCAN(mvm, "SCAN OFFLOAD ABORT ret %d.\n", status);
 598                 ret = -ENOENT;
 599         }
 600
 601         return ret;
 602 }
 603
 604 static void iwl_mvm_scan_fill_tx_cmd(struct iwl_mvm *mvm,
 605                                      struct iwl_scan_req_tx_cmd *tx_cmd,
 606                                      bool no_cck)
 607 {
 608         tx_cmd[0].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 609                                          TX_CMD_FLG_BT_DIS);
 610         tx_cmd[0].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 611                                                            IEEE80211_BAND_2GHZ,
 612                                                            no_cck);
 613         tx_cmd[0].sta_id = mvm->aux_sta.sta_id;
 614
 615         tx_cmd[1].tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
 616                                          TX_CMD_FLG_BT_DIS);
 617         tx_cmd[1].rate_n_flags = iwl_mvm_scan_rate_n_flags(mvm,
 618                                                            IEEE80211_BAND_5GHZ,
 619                                                            no_cck);
 620         tx_cmd[1].sta_id = mvm->aux_sta.sta_id;
 621 }
 622
 623 static void
 624 iwl_mvm_lmac_scan_cfg_channels(struct iwl_mvm *mvm,
 625                                struct ieee80211_channel **channels,
 626                                int n_channels, u32 ssid_bitmap,
 627                                struct iwl_scan_req_lmac *cmd)
 628 {
 629         struct iwl_scan_channel_cfg_lmac *channel_cfg = (void *)&cmd->data;
 630         int i;
 631
 632         for (i = 0; i < n_channels; i++) {
 633                 channel_cfg[i].channel_num =
 634                         cpu_to_le16(channels[i]->hw_value);
 635                 channel_cfg[i].iter_count = cpu_to_le16(1);
 636                 channel_cfg[i].iter_interval = 0;
 637                 channel_cfg[i].flags =
 638                         cpu_to_le32(IWL_UNIFIED_SCAN_CHANNEL_PARTIAL |
 639                                     ssid_bitmap);
 640         }
 641 }
 642
 643 static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,
 644                                            size_t len, u8 *const pos)
 645 {
 646         static const u8 before_ds_params[] = {
 647                         WLAN_EID_SSID,
 648                         WLAN_EID_SUPP_RATES,
 649                         WLAN_EID_REQUEST,
 650                         WLAN_EID_EXT_SUPP_RATES,
 651         };
 652         size_t offs;
 653         u8 *newpos = pos;
 654
 655         if (!iwl_mvm_rrm_scan_needed(mvm)) {
 656                 memcpy(newpos, ies, len);
 657                 return newpos + len;
 658         }
 659
 660         offs = ieee80211_ie_split(ies, len,
 661                                   before_ds_params,
 662                                   ARRAY_SIZE(before_ds_params),
 663                                   0);
 664
 665         memcpy(newpos, ies, offs);
 666         newpos += offs;
 667
 668         /* Add a placeholder for DS Parameter Set element */
 669         *newpos++ = WLAN_EID_DS_PARAMS;
 670         *newpos++ = 1;
 671         *newpos++ = 0;
 672
 673         memcpy(newpos, ies + offs, len - offs);
 674         newpos += len - offs;
 675
 676         return newpos;
 677 }
 678
 679 static void
 680 iwl_mvm_build_scan_probe(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 681                          struct ieee80211_scan_ies *ies,
 682                          struct iwl_mvm_scan_params *params)
 683 {
 684         struct ieee80211_mgmt *frame = (void *)params->preq.buf;
 685         u8 *pos, *newpos;
 686         const u8 *mac_addr = params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
 687                 params->mac_addr : NULL;
 688
 689         /*
 690          * Unfortunately, right now the offload scan doesn't support randomising
 691          * within the firmware, so until the firmware API is ready we implement
 692          * it in the driver. This means that the scan iterations won't really be
 693          * random, only when it's restarted, but at least that helps a bit.
 694          */
 695         if (mac_addr)
 696                 get_random_mask_addr(frame->sa, mac_addr,
 697                                      params->mac_addr_mask);
 698         else
 699                 memcpy(frame->sa, vif->addr, ETH_ALEN);
 700
 701         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 702         eth_broadcast_addr(frame->da);
 703         eth_broadcast_addr(frame->bssid);
 704         frame->seq_ctrl = 0;
 705
 706         pos = frame->u.probe_req.variable;
 707         *pos++ = WLAN_EID_SSID;
 708         *pos++ = 0;
 709
 710         params->preq.mac_header.offset = 0;
 711         params->preq.mac_header.len = cpu_to_le16(24 + 2);
 712
 713         /* Insert ds parameter set element on 2.4 GHz band */
 714         newpos = iwl_mvm_copy_and_insert_ds_elem(mvm,
 715                                                  ies->ies[IEEE80211_BAND_2GHZ],
 716                                                  ies->len[IEEE80211_BAND_2GHZ],
 717                                                  pos);
 718         params->preq.band_data[0].offset = cpu_to_le16(pos - params->preq.buf);
 719         params->preq.band_data[0].len = cpu_to_le16(newpos - pos);
 720         pos = newpos;
 721
 722         memcpy(pos, ies->ies[IEEE80211_BAND_5GHZ],
 723                ies->len[IEEE80211_BAND_5GHZ]);
 724         params->preq.band_data[1].offset = cpu_to_le16(pos - params->preq.buf);
 725         params->preq.band_data[1].len =
 726                 cpu_to_le16(ies->len[IEEE80211_BAND_5GHZ]);
 727         pos += ies->len[IEEE80211_BAND_5GHZ];
 728
 729         memcpy(pos, ies->common_ies, ies->common_ie_len);
 730         params->preq.common_data.offset = cpu_to_le16(pos - params->preq.buf);
 731         params->preq.common_data.len = cpu_to_le16(ies->common_ie_len);
 732 }
 733
 734 static __le32 iwl_mvm_scan_priority(struct iwl_mvm *mvm,
 735                                     enum iwl_scan_priority_ext prio)
 736 {
 737         if (fw_has_api(&mvm->fw->ucode_capa,
 738                        IWL_UCODE_TLV_API_EXT_SCAN_PRIORITY))
 739                 return cpu_to_le32(prio);
 740
 741         if (prio <= IWL_SCAN_PRIORITY_EXT_2)
 742                 return cpu_to_le32(IWL_SCAN_PRIORITY_LOW);
 743
 744         if (prio <= IWL_SCAN_PRIORITY_EXT_4)
 745                 return cpu_to_le32(IWL_SCAN_PRIORITY_MEDIUM);
 746
 747         return cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
 748 }
 749
 750 static void iwl_mvm_scan_lmac_dwell(struct iwl_mvm *mvm,
 751                                     struct iwl_scan_req_lmac *cmd,
 752                                     struct iwl_mvm_scan_params *params)
 753 {
 754         cmd->active_dwell = params->dwell[IEEE80211_BAND_2GHZ].active;
 755         cmd->passive_dwell = params->dwell[IEEE80211_BAND_2GHZ].passive;
 756         if (params->passive_fragmented)
 757                 cmd->fragmented_dwell =
 758                                 params->dwell[IEEE80211_BAND_2GHZ].fragmented;
 759         cmd->max_out_time = cpu_to_le32(params->max_out_time);
 760         cmd->suspend_time = cpu_to_le32(params->suspend_time);
 761         cmd->scan_prio = iwl_mvm_scan_priority(mvm, IWL_SCAN_PRIORITY_EXT_6);
 762 }
 763
 764 static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,
 765                                      struct ieee80211_scan_ies *ies,
 766                                      int n_channels)
 767 {
 768         return ((n_ssids <= PROBE_OPTION_MAX) &&
 769                 (n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
 770                 (ies->common_ie_len +
 771                  ies->len[NL80211_BAND_2GHZ] +
 772                  ies->len[NL80211_BAND_5GHZ] <=
 773                  iwl_mvm_max_scan_ie_fw_cmd_room(mvm)));
 774 }
 775
 776 static inline bool iwl_mvm_scan_use_ebs(struct iwl_mvm *mvm,
 777                                         struct ieee80211_vif *vif,
 778                                         int n_iterations)
 779 {
 780         const struct iwl_ucode_capabilities *capa = &mvm->fw->ucode_capa;
 781
 782         /* We can only use EBS if:
 783          *      1. the feature is supported;
 784          *      2. the last EBS was successful;
 785          *      3. if only single scan, the single scan EBS API is supported;
 786          *      4. it's not a p2p find operation.
 787          */
 788         return ((capa->flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT) &&
 789                 mvm->last_ebs_successful &&
 790                 (n_iterations > 1 ||
 791                  fw_has_api(capa, IWL_UCODE_TLV_API_SINGLE_SCAN_EBS)) &&
 792                 vif->type != NL80211_IFTYPE_P2P_DEVICE);
 793 }
 794
 795 static int iwl_mvm_scan_total_iterations(struct iwl_mvm_scan_params *params)
 796 {
 797         return params->schedule[0].iterations + params->schedule[1].iterations;
 798 }
 799
 800 static int iwl_mvm_scan_lmac_flags(struct iwl_mvm *mvm,
 801                                    struct iwl_mvm_scan_params *params)
 802 {
 803         int flags = 0;
 804
 805         if (params->n_ssids == 0)
 806                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 807
 808         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
 809                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION;
 810
 811         if (params->passive_fragmented)
 812                 flags |= IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED;
 813
 814         if (iwl_mvm_rrm_scan_needed(mvm))
 815                 flags |= IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED;
 816
 817         if (params->pass_all)
 818                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL;
 819         else
 820                 flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
 821
 822 #ifdef CONFIG_IWLWIFI_DEBUGFS
 823         if (mvm->scan_iter_notif_enabled)
 824                 flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
 825 #endif
 826
 827         return flags;
 828 }
 829
 830 static int iwl_mvm_scan_lmac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 831                              struct iwl_mvm_scan_params *params)
 832 {
 833         struct iwl_scan_req_lmac *cmd = mvm->scan_cmd;
 834         struct iwl_scan_probe_req *preq =
 835                 (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
 836                          mvm->fw->ucode_capa.n_scan_channels);
 837         u32 ssid_bitmap = 0;
 838         int n_iterations = iwl_mvm_scan_total_iterations(params);
 839
 840         lockdep_assert_held(&mvm->mutex);
 841
 842         memset(cmd, 0, ksize(cmd));
 843
 844         iwl_mvm_scan_lmac_dwell(mvm, cmd, params);
 845
 846         cmd->rx_chain_select = iwl_mvm_scan_rx_chain(mvm);
 847         cmd->iter_num = cpu_to_le32(1);
 848         cmd->n_channels = (u8)params->n_channels;
 849
 850         cmd->delay = cpu_to_le32(params->delay);
 851
 852         cmd->scan_flags = cpu_to_le32(iwl_mvm_scan_lmac_flags(mvm, params));
 853
 854         cmd->flags = iwl_mvm_scan_rxon_flags(params->channels[0]->band);
 855         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
 856                                         MAC_FILTER_IN_BEACON);
 857         iwl_mvm_scan_fill_tx_cmd(mvm, cmd->tx_cmd, params->no_cck);
 858         iwl_scan_build_ssids(params, cmd->direct_scan, &ssid_bitmap);
 859
 860         /* this API uses bits 1-20 instead of 0-19 */
 861         ssid_bitmap <<= 1;
 862
 863         cmd->schedule[0].delay = cpu_to_le16(params->interval);
 864         cmd->schedule[0].iterations = params->schedule[0].iterations;
 865         cmd->schedule[0].full_scan_mul = params->schedule[0].full_scan_mul;
 866         cmd->schedule[1].delay = cpu_to_le16(params->interval);
 867         cmd->schedule[1].iterations = params->schedule[1].iterations;
 868         cmd->schedule[1].full_scan_mul = params->schedule[1].iterations;
 869
 870         if (iwl_mvm_scan_use_ebs(mvm, vif, n_iterations)) {
 871                 cmd->channel_opt[0].flags =
 872                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 873                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 874                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 875                 cmd->channel_opt[0].non_ebs_ratio =
 876                         cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
 877                 cmd->channel_opt[1].flags =
 878                         cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
 879                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
 880                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
 881                 cmd->channel_opt[1].non_ebs_ratio =
 882                         cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
 883         }
 884
 885         iwl_mvm_lmac_scan_cfg_channels(mvm, params->channels,
 886                                        params->n_channels, ssid_bitmap, cmd);
 887
 888         *preq = params->preq;
 889
 890         return 0;
 891 }
 892
 893 static int rate_to_scan_rate_flag(unsigned int rate)
 894 {
 895         static const int rate_to_scan_rate[IWL_RATE_COUNT] = {
 896                 [IWL_RATE_1M_INDEX]     = SCAN_CONFIG_RATE_1M,
 897                 [IWL_RATE_2M_INDEX]     = SCAN_CONFIG_RATE_2M,
 898                 [IWL_RATE_5M_INDEX]     = SCAN_CONFIG_RATE_5M,
 899                 [IWL_RATE_11M_INDEX]    = SCAN_CONFIG_RATE_11M,
 900                 [IWL_RATE_6M_INDEX]     = SCAN_CONFIG_RATE_6M,
 901                 [IWL_RATE_9M_INDEX]     = SCAN_CONFIG_RATE_9M,
 902                 [IWL_RATE_12M_INDEX]    = SCAN_CONFIG_RATE_12M,
 903                 [IWL_RATE_18M_INDEX]    = SCAN_CONFIG_RATE_18M,
 904                 [IWL_RATE_24M_INDEX]    = SCAN_CONFIG_RATE_24M,
 905                 [IWL_RATE_36M_INDEX]    = SCAN_CONFIG_RATE_36M,
 906                 [IWL_RATE_48M_INDEX]    = SCAN_CONFIG_RATE_48M,
 907                 [IWL_RATE_54M_INDEX]    = SCAN_CONFIG_RATE_54M,
 908         };
 909
 910         return rate_to_scan_rate[rate];
 911 }
 912
 913 static __le32 iwl_mvm_scan_config_rates(struct iwl_mvm *mvm)
 914 {
 915         struct ieee80211_supported_band *band;
 916         unsigned int rates = 0;
 917         int i;
 918
 919         band = &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
 920         for (i = 0; i < band->n_bitrates; i++)
 921                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 922         band = &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 923         for (i = 0; i < band->n_bitrates; i++)
 924                 rates |= rate_to_scan_rate_flag(band->bitrates[i].hw_value);
 925
 926         /* Set both basic rates and supported rates */
 927         rates |= SCAN_CONFIG_SUPPORTED_RATE(rates);
 928
 929         return cpu_to_le32(rates);
 930 }
 931
 932 int iwl_mvm_config_scan(struct iwl_mvm *mvm)
 933 {
 934
 935         struct iwl_scan_config *scan_config;
 936         struct ieee80211_supported_band *band;
 937         int num_channels =
 938                 mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels +
 939                 mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
 940         int ret, i, j = 0, cmd_size, data_size;
 941         struct iwl_host_cmd cmd = {
 942                 .id = SCAN_CFG_CMD,
 943         };
 944
 945         if (WARN_ON(num_channels > mvm->fw->ucode_capa.n_scan_channels))
 946                 return -ENOBUFS;
 947
 948         cmd_size = sizeof(*scan_config) + mvm->fw->ucode_capa.n_scan_channels;
 949
 950         scan_config = kzalloc(cmd_size, GFP_KERNEL);
 951         if (!scan_config)
 952                 return -ENOMEM;
 953
 954         data_size = cmd_size - sizeof(struct iwl_mvm_umac_cmd_hdr);
 955         scan_config->hdr.size = cpu_to_le16(data_size);
 956         scan_config->flags = cpu_to_le32(SCAN_CONFIG_FLAG_ACTIVATE |
 957                                          SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS |
 958                                          SCAN_CONFIG_FLAG_SET_TX_CHAINS |
 959                                          SCAN_CONFIG_FLAG_SET_RX_CHAINS |
 960                                          SCAN_CONFIG_FLAG_SET_ALL_TIMES |
 961                                          SCAN_CONFIG_FLAG_SET_LEGACY_RATES |
 962                                          SCAN_CONFIG_FLAG_SET_MAC_ADDR |
 963                                          SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS|
 964                                          SCAN_CONFIG_N_CHANNELS(num_channels));
 965         scan_config->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
 966         scan_config->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
 967         scan_config->legacy_rates = iwl_mvm_scan_config_rates(mvm);
 968         scan_config->out_of_channel_time = cpu_to_le32(170);
 969         scan_config->suspend_time = cpu_to_le32(30);
 970         scan_config->dwell_active = 20;
 971         scan_config->dwell_passive = 110;
 972         scan_config->dwell_fragmented = 20;
 973
 974         memcpy(&scan_config->mac_addr, &mvm->addresses[0].addr, ETH_ALEN);
 975
 976         scan_config->bcast_sta_id = mvm->aux_sta.sta_id;
 977         scan_config->channel_flags = IWL_CHANNEL_FLAG_EBS |
 978                                      IWL_CHANNEL_FLAG_ACCURATE_EBS |
 979                                      IWL_CHANNEL_FLAG_EBS_ADD |
 980                                      IWL_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE;
 981
 982         band = &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
 983         for (i = 0; i < band->n_channels; i++, j++)
 984                 scan_config->channel_array[j] = band->channels[i].hw_value;
 985         band = &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 986         for (i = 0; i < band->n_channels; i++, j++)
 987                 scan_config->channel_array[j] = band->channels[i].hw_value;
 988
 989         cmd.data[0] = scan_config;
 990         cmd.len[0] = cmd_size;
 991         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
 992
 993         IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
 994
 995         ret = iwl_mvm_send_cmd(mvm, &cmd);
 996
 997         kfree(scan_config);
 998         return ret;
 999 }
1000
1001 static int iwl_mvm_scan_uid_by_status(struct iwl_mvm *mvm, int status)
1002 {
1003         int i;
1004
1005         for (i = 0; i < mvm->max_scans; i++)
1006                 if (mvm->scan_uid_status[i] == status)
1007                         return i;
1008
1009         return -ENOENT;
1010 }
1011
1012 static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
1013                                     struct iwl_scan_req_umac *cmd,
1014                                     struct iwl_mvm_scan_params *params)
1015 {
1016         cmd->active_dwell = params->dwell[IEEE80211_BAND_2GHZ].active;
1017         cmd->passive_dwell = params->dwell[IEEE80211_BAND_2GHZ].passive;
1018         if (params->passive_fragmented)
1019                 cmd->fragmented_dwell =
1020                                 params->dwell[IEEE80211_BAND_2GHZ].fragmented;
1021         cmd->max_out_time = cpu_to_le32(params->max_out_time);
1022         cmd->suspend_time = cpu_to_le32(params->suspend_time);
1023         cmd->scan_priority =
1024                 iwl_mvm_scan_priority(mvm, IWL_SCAN_PRIORITY_EXT_6);
1025
1026         if (iwl_mvm_scan_total_iterations(params) == 0)
1027                 cmd->ooc_priority =
1028                         iwl_mvm_scan_priority(mvm, IWL_SCAN_PRIORITY_EXT_6);
1029         else
1030                 cmd->ooc_priority =
1031                         iwl_mvm_scan_priority(mvm, IWL_SCAN_PRIORITY_EXT_2);
1032 }
1033
1034 static void
1035 iwl_mvm_umac_scan_cfg_channels(struct iwl_mvm *mvm,
1036                                struct ieee80211_channel **channels,
1037                                int n_channels, u32 ssid_bitmap,
1038                                struct iwl_scan_req_umac *cmd)
1039 {
1040         struct iwl_scan_channel_cfg_umac *channel_cfg = (void *)&cmd->data;
1041         int i;
1042
1043         for (i = 0; i < n_channels; i++) {
1044                 channel_cfg[i].flags = cpu_to_le32(ssid_bitmap);
1045                 channel_cfg[i].channel_num = channels[i]->hw_value;
1046                 channel_cfg[i].iter_count = 1;
1047                 channel_cfg[i].iter_interval = 0;
1048         }
1049 }
1050
1051 static u32 iwl_mvm_scan_umac_flags(struct iwl_mvm *mvm,
1052                                    struct iwl_mvm_scan_params *params)
1053 {
1054         int flags = 0;
1055
1056         if (params->n_ssids == 0)
1057                 flags = IWL_UMAC_SCAN_GEN_FLAGS_PASSIVE;
1058
1059         if (params->n_ssids == 1 && params->ssids[0].ssid_len != 0)
1060                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT;
1061
1062         if (params->passive_fragmented)
1063                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED;
1064
1065         if (iwl_mvm_rrm_scan_needed(mvm))
1066                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED;
1067
1068         if (params->pass_all)
1069                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
1070         else
1071                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_MATCH;
1072
1073         if (iwl_mvm_scan_total_iterations(params) > 1)
1074                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_PERIODIC;
1075
1076 #ifdef CONFIG_IWLWIFI_DEBUGFS
1077         if (mvm->scan_iter_notif_enabled)
1078                 flags |= IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE;
1079 #endif
1080         return flags;
1081 }
1082
1083 static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1084                              struct iwl_mvm_scan_params *params,
1085                              int type)
1086 {
1087         struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
1088         struct iwl_scan_req_umac_tail *sec_part = (void *)&cmd->data +
1089                 sizeof(struct iwl_scan_channel_cfg_umac) *
1090                         mvm->fw->ucode_capa.n_scan_channels;
1091         int uid;
1092         u32 ssid_bitmap = 0;
1093         int n_iterations = iwl_mvm_scan_total_iterations(params);
1094
1095         lockdep_assert_held(&mvm->mutex);
1096
1097         uid = iwl_mvm_scan_uid_by_status(mvm, 0);
1098         if (uid < 0)
1099                 return uid;
1100
1101         memset(cmd, 0, ksize(cmd));
1102         cmd->hdr.size = cpu_to_le16(iwl_mvm_scan_size(mvm) -
1103                                     sizeof(struct iwl_mvm_umac_cmd_hdr));
1104
1105         iwl_mvm_scan_umac_dwell(mvm, cmd, params);
1106
1107         mvm->scan_uid_status[uid] = type;
1108
1109         cmd->uid = cpu_to_le32(uid);
1110         cmd->general_flags = cpu_to_le32(iwl_mvm_scan_umac_flags(mvm, params));
1111
1112         if (iwl_mvm_scan_use_ebs(mvm, vif, n_iterations))
1113                 cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
1114                                      IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
1115                                      IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
1116
1117         cmd->n_channels = params->n_channels;
1118
1119         iwl_scan_build_ssids(params, sec_part->direct_scan, &ssid_bitmap);
1120
1121         iwl_mvm_umac_scan_cfg_channels(mvm, params->channels,
1122                                        params->n_channels, ssid_bitmap, cmd);
1123
1124         /* With UMAC we use only one schedule for now, so use the sum
1125          * of the iterations (with a a maximum of 255).
1126          */
1127         sec_part->schedule[0].iter_count =
1128                 (n_iterations > 255) ? 255 : n_iterations;
1129         sec_part->schedule[0].interval = cpu_to_le16(params->interval);
1130
1131         sec_part->delay = cpu_to_le16(params->delay);
1132         sec_part->preq = params->preq;
1133
1134         return 0;
1135 }
1136
1137 static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
1138 {
1139         return hweight32(mvm->scan_status & IWL_MVM_SCAN_MASK);
1140 }
1141
1142 static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
1143 {
1144         /* This looks a bit arbitrary, but the idea is that if we run
1145          * out of possible simultaneous scans and the userspace is
1146          * trying to run a scan type that is already running, we
1147          * return -EBUSY.  But if the userspace wants to start a
1148          * different type of scan, we stop the opposite type to make
1149          * space for the new request.  The reason is backwards
1150          * compatibility with old wpa_supplicant that wouldn't stop a
1151          * scheduled scan before starting a normal scan.
1152          */
1153
1154         if (iwl_mvm_num_scans(mvm) < mvm->max_scans)
1155                 return 0;
1156
1157         /* Use a switch, even though this is a bitmask, so that more
1158          * than one bits set will fall in default and we will warn.
1159          */
1160         switch (type) {
1161         case IWL_MVM_SCAN_REGULAR:
1162                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
1163                         return -EBUSY;
1164                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
1165         case IWL_MVM_SCAN_SCHED:
1166                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
1167                         return -EBUSY;
1168                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
1169         case IWL_MVM_SCAN_NETDETECT:
1170                 /* No need to stop anything for net-detect since the
1171                  * firmware is restarted anyway.  This way, any sched
1172                  * scans that were running will be restarted when we
1173                  * resume.
1174                 */
1175                 return 0;
1176         default:
1177                 WARN_ON(1);
1178                 break;
1179         }
1180
1181         return -EIO;
1182 }
1183
1184 int iwl_mvm_reg_scan_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1185                            struct cfg80211_scan_request *req,
1186                            struct ieee80211_scan_ies *ies)
1187 {
1188         struct iwl_host_cmd hcmd = {
1189                 .len = { iwl_mvm_scan_size(mvm), },
1190                 .data = { mvm->scan_cmd, },
1191                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1192         };
1193         struct iwl_mvm_scan_params params = {};
1194         int ret;
1195
1196         lockdep_assert_held(&mvm->mutex);
1197
1198         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1199                 IWL_ERR(mvm, "scan while LAR regdomain is not set\n");
1200                 return -EBUSY;
1201         }
1202
1203         ret = iwl_mvm_check_running_scans(mvm, IWL_MVM_SCAN_REGULAR);
1204         if (ret)
1205                 return ret;
1206
1207         iwl_mvm_ref(mvm, IWL_MVM_REF_SCAN);
1208
1209         /* we should have failed registration if scan_cmd was NULL */
1210         if (WARN_ON(!mvm->scan_cmd))
1211                 return -ENOMEM;
1212
1213         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1214                 return -ENOBUFS;
1215
1216         params.n_ssids = req->n_ssids;
1217         params.flags = req->flags;
1218         params.n_channels = req->n_channels;
1219         params.delay = 0;
1220         params.interval = 0;
1221         params.ssids = req->ssids;
1222         params.channels = req->channels;
1223         params.mac_addr = req->mac_addr;
1224         params.mac_addr_mask = req->mac_addr_mask;
1225         params.no_cck = req->no_cck;
1226         params.pass_all = true;
1227         params.n_match_sets = 0;
1228         params.match_sets = NULL;
1229
1230         params.schedule[0].iterations = 1;
1231         params.schedule[0].full_scan_mul = 0;
1232         params.schedule[1].iterations = 0;
1233         params.schedule[1].full_scan_mul = 0;
1234
1235         iwl_mvm_scan_calc_dwell(mvm, vif, &params);
1236
1237         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1238
1239         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1240                 hcmd.id = SCAN_REQ_UMAC;
1241                 ret = iwl_mvm_scan_umac(mvm, vif, &params,
1242                                         IWL_MVM_SCAN_REGULAR);
1243         } else {
1244                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1245                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1246         }
1247
1248         if (ret)
1249                 return ret;
1250
1251         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1252         if (!ret) {
1253                 IWL_DEBUG_SCAN(mvm, "Scan request was sent successfully\n");
1254                 mvm->scan_status |= IWL_MVM_SCAN_REGULAR;
1255         } else {
1256                 /* If the scan failed, it usually means that the FW was unable
1257                  * to allocate the time events. Warn on it, but maybe we
1258                  * should try to send the command again with different params.
1259                  */
1260                 IWL_ERR(mvm, "Scan failed! ret %d\n", ret);
1261         }
1262
1263         if (ret)
1264                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1265
1266         return ret;
1267 }
1268
1269 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
1270                              struct ieee80211_vif *vif,
1271                              struct cfg80211_sched_scan_request *req,
1272                              struct ieee80211_scan_ies *ies,
1273                              int type)
1274 {
1275         struct iwl_host_cmd hcmd = {
1276                 .len = { iwl_mvm_scan_size(mvm), },
1277                 .data = { mvm->scan_cmd, },
1278                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
1279         };
1280         struct iwl_mvm_scan_params params = {};
1281         int ret;
1282
1283         lockdep_assert_held(&mvm->mutex);
1284
1285         if (iwl_mvm_is_lar_supported(mvm) && !mvm->lar_regdom_set) {
1286                 IWL_ERR(mvm, "sched-scan while LAR regdomain is not set\n");
1287                 return -EBUSY;
1288         }
1289
1290         ret = iwl_mvm_check_running_scans(mvm, type);
1291         if (ret)
1292                 return ret;
1293
1294         /* we should have failed registration if scan_cmd was NULL */
1295         if (WARN_ON(!mvm->scan_cmd))
1296                 return -ENOMEM;
1297
1298         if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, req->n_channels))
1299                 return -ENOBUFS;
1300
1301         params.n_ssids = req->n_ssids;
1302         params.flags = req->flags;
1303         params.n_channels = req->n_channels;
1304         params.ssids = req->ssids;
1305         params.channels = req->channels;
1306         params.mac_addr = req->mac_addr;
1307         params.mac_addr_mask = req->mac_addr_mask;
1308         params.no_cck = false;
1309         params.pass_all =  iwl_mvm_scan_pass_all(mvm, req);
1310         params.n_match_sets = req->n_match_sets;
1311         params.match_sets = req->match_sets;
1312
1313         params.schedule[0].iterations = IWL_FAST_SCHED_SCAN_ITERATIONS;
1314         params.schedule[0].full_scan_mul = 1;
1315         params.schedule[1].iterations = 0xff;
1316         params.schedule[1].full_scan_mul = IWL_FULL_SCAN_MULTIPLIER;
1317
1318         if (req->interval > U16_MAX) {
1319                 IWL_DEBUG_SCAN(mvm,
1320                                "interval value is > 16-bits, set to max possible\n");
1321                 params.interval = U16_MAX;
1322         } else {
1323                 params.interval = req->interval / MSEC_PER_SEC;
1324         }
1325
1326         /* In theory, LMAC scans can handle a 32-bit delay, but since
1327          * waiting for over 18 hours to start the scan is a bit silly
1328          * and to keep it aligned with UMAC scans (which only support
1329          * 16-bit delays), trim it down to 16-bits.
1330          */
1331         if (req->delay > U16_MAX) {
1332                 IWL_DEBUG_SCAN(mvm,
1333                                "delay value is > 16-bits, set to max possible\n");
1334                 params.delay = U16_MAX;
1335         } else {
1336                 params.delay = req->delay;
1337         }
1338
1339         iwl_mvm_scan_calc_dwell(mvm, vif, &params);
1340
1341         ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
1342         if (ret)
1343                 return ret;
1344
1345         iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
1346
1347         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1348                 hcmd.id = SCAN_REQ_UMAC;
1349                 ret = iwl_mvm_scan_umac(mvm, vif, &params, IWL_MVM_SCAN_SCHED);
1350         } else {
1351                 hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
1352                 ret = iwl_mvm_scan_lmac(mvm, vif, &params);
1353         }
1354
1355         if (ret)
1356                 return ret;
1357
1358         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1359         if (!ret) {
1360                 IWL_DEBUG_SCAN(mvm,
1361                                "Sched scan request was sent successfully\n");
1362                 mvm->scan_status |= type;
1363         } else {
1364                 /* If the scan failed, it usually means that the FW was unable
1365                  * to allocate the time events. Warn on it, but maybe we
1366                  * should try to send the command again with different params.
1367                  */
1368                 IWL_ERR(mvm, "Sched scan failed! ret %d\n", ret);
1369         }
1370
1371         return ret;
1372 }
1373
1374 int iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
1375                                         struct iwl_rx_cmd_buffer *rxb,
1376                                         struct iwl_device_cmd *cmd)
1377 {
1378         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1379         struct iwl_umac_scan_complete *notif = (void *)pkt->data;
1380         u32 uid = __le32_to_cpu(notif->uid);
1381         bool aborted = (notif->status == IWL_SCAN_OFFLOAD_ABORTED);
1382
1383         if (WARN_ON(!(mvm->scan_uid_status[uid] & mvm->scan_status)))
1384                 return 0;
1385
1386         /* if the scan is already stopping, we don't need to notify mac80211 */
1387         if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_REGULAR) {
1388                 ieee80211_scan_completed(mvm->hw, aborted);
1389                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1390         } else if (mvm->scan_uid_status[uid] == IWL_MVM_SCAN_SCHED) {
1391                 ieee80211_sched_scan_stopped(mvm->hw);
1392         }
1393
1394         mvm->scan_status &= ~mvm->scan_uid_status[uid];
1395
1396         IWL_DEBUG_SCAN(mvm,
1397                        "Scan completed, uid %u type %u, status %s, EBS status %s\n",
1398                        uid, mvm->scan_uid_status[uid],
1399                        notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
1400                                 "completed" : "aborted",
1401                        iwl_mvm_ebs_status_str(notif->ebs_status));
1402
1403         if (notif->ebs_status != IWL_SCAN_EBS_SUCCESS &&
1404             notif->ebs_status != IWL_SCAN_EBS_INACTIVE)
1405                 mvm->last_ebs_successful = false;
1406
1407         mvm->scan_uid_status[uid] = 0;
1408
1409         return 0;
1410 }
1411
1412 int iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
1413                                              struct iwl_rx_cmd_buffer *rxb,
1414                                              struct iwl_device_cmd *cmd)
1415 {
1416         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1417         struct iwl_umac_scan_iter_complete_notif *notif = (void *)pkt->data;
1418         u8 buf[256];
1419
1420         IWL_DEBUG_SCAN(mvm,
1421                        "UMAC Scan iteration complete: status=0x%x scanned_channels=%d channels list: %s\n",
1422                        notif->status, notif->scanned_channels,
1423                        iwl_mvm_dump_channel_list(notif->results,
1424                                                  notif->scanned_channels, buf,
1425                                                  sizeof(buf)));
1426         return 0;
1427 }
1428
1429 static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type)
1430 {
1431         struct iwl_umac_scan_abort cmd = {
1432                 .hdr.size = cpu_to_le16(sizeof(struct iwl_umac_scan_abort) -
1433                                         sizeof(struct iwl_mvm_umac_cmd_hdr)),
1434         };
1435         int uid, ret;
1436
1437         lockdep_assert_held(&mvm->mutex);
1438
1439         /* We should always get a valid index here, because we already
1440          * checked that this type of scan was running in the generic
1441          * code.
1442          */
1443         uid = iwl_mvm_scan_uid_by_status(mvm, type);
1444         if (WARN_ON_ONCE(uid < 0))
1445                 return uid;
1446
1447         cmd.uid = cpu_to_le32(uid);
1448
1449         IWL_DEBUG_SCAN(mvm, "Sending scan abort, uid %u\n", uid);
1450
1451         ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_UMAC, 0, sizeof(cmd), &cmd);
1452         if (!ret)
1453                 mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT;
1454
1455         return ret;
1456 }
1457
1458 static int iwl_mvm_scan_stop_wait(struct iwl_mvm *mvm, int type)
1459 {
1460         struct iwl_notification_wait wait_scan_done;
1461         static const u8 scan_done_notif[] = { SCAN_COMPLETE_UMAC,
1462                                               SCAN_OFFLOAD_COMPLETE, };
1463         int ret;
1464
1465         lockdep_assert_held(&mvm->mutex);
1466
1467         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
1468                                    scan_done_notif,
1469                                    ARRAY_SIZE(scan_done_notif),
1470                                    NULL, NULL);
1471
1472         IWL_DEBUG_SCAN(mvm, "Preparing to stop scan, type %x\n", type);
1473
1474         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1475                 ret = iwl_mvm_umac_scan_abort(mvm, type);
1476         else
1477                 ret = iwl_mvm_lmac_scan_abort(mvm);
1478
1479         if (ret) {
1480                 IWL_DEBUG_SCAN(mvm, "couldn't stop scan type %d\n", type);
1481                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
1482                 return ret;
1483         }
1484
1485         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
1486
1487         return ret;
1488 }
1489
1490 int iwl_mvm_scan_size(struct iwl_mvm *mvm)
1491 {
1492         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1493                 return sizeof(struct iwl_scan_req_umac) +
1494                         sizeof(struct iwl_scan_channel_cfg_umac) *
1495                                 mvm->fw->ucode_capa.n_scan_channels +
1496                         sizeof(struct iwl_scan_req_umac_tail);
1497
1498         return sizeof(struct iwl_scan_req_lmac) +
1499                 sizeof(struct iwl_scan_channel_cfg_lmac) *
1500                 mvm->fw->ucode_capa.n_scan_channels +
1501                 sizeof(struct iwl_scan_probe_req);
1502 }
1503
1504 /*
1505  * This function is used in nic restart flow, to inform mac80211 about scans
1506  * that was aborted by restart flow or by an assert.
1507  */
1508 void iwl_mvm_report_scan_aborted(struct iwl_mvm *mvm)
1509 {
1510         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1511                 int uid, i;
1512
1513                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_REGULAR);
1514                 if (uid >= 0) {
1515                         ieee80211_scan_completed(mvm->hw, true);
1516                         mvm->scan_uid_status[uid] = 0;
1517                 }
1518                 uid = iwl_mvm_scan_uid_by_status(mvm, IWL_MVM_SCAN_SCHED);
1519                 if (uid >= 0 && !mvm->restart_fw) {
1520                         ieee80211_sched_scan_stopped(mvm->hw);
1521                         mvm->scan_uid_status[uid] = 0;
1522                 }
1523
1524                 /* We shouldn't have any UIDs still set.  Loop over all the
1525                  * UIDs to make sure there's nothing left there and warn if
1526                  * any is found.
1527                  */
1528                 for (i = 0; i < mvm->max_scans; i++) {
1529                         if (WARN_ONCE(mvm->scan_uid_status[i],
1530                                       "UMAC scan UID %d status was not cleaned\n",
1531                                       i))
1532                                 mvm->scan_uid_status[i] = 0;
1533                 }
1534         } else {
1535                 if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
1536                         ieee80211_scan_completed(mvm->hw, true);
1537
1538                 /* Sched scan will be restarted by mac80211 in
1539                  * restart_hw, so do not report if FW is about to be
1540                  * restarted.
1541                  */
1542                 if ((mvm->scan_status & IWL_MVM_SCAN_SCHED) && !mvm->restart_fw)
1543                         ieee80211_sched_scan_stopped(mvm->hw);
1544         }
1545 }
1546
1547 int iwl_mvm_scan_stop(struct iwl_mvm *mvm, int type, bool notify)
1548 {
1549         int ret;
1550
1551         if (!(mvm->scan_status & type))
1552                 return 0;
1553
1554         if (iwl_mvm_is_radio_killed(mvm)) {
1555                 ret = 0;
1556                 goto out;
1557         }
1558
1559         ret = iwl_mvm_scan_stop_wait(mvm, type);
1560         if (!ret)
1561                 mvm->scan_status |= type << IWL_MVM_SCAN_STOPPING_SHIFT;
1562 out:
1563         /* Clear the scan status so the next scan requests will
1564          * succeed and mark the scan as stopping, so that the Rx
1565          * handler doesn't do anything, as the scan was stopped from
1566          * above.
1567          */
1568         mvm->scan_status &= ~type;
1569
1570         if (type == IWL_MVM_SCAN_REGULAR) {
1571                 /* Since the rx handler won't do anything now, we have
1572                  * to release the scan reference here.
1573                  */
1574                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
1575                 if (notify)
1576                         ieee80211_scan_completed(mvm->hw, true);
1577         } else if (notify) {
1578                 ieee80211_sched_scan_stopped(mvm->hw);
1579         }
1580
1581         return ret;
1582 }