drivers/net/wireless/iwlwifi/iwl-scan.c

   1 /******************************************************************************
   2  *
   3  * GPL LICENSE SUMMARY
   4  *
   5  * Copyright(c) 2008 Intel Corporation. All rights reserved.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of version 2 of the GNU General Public License as
   9  * published by the Free Software Foundation.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  19  * USA
  20  *
  21  * The full GNU General Public License is included in this distribution
  22  * in the file called LICENSE.GPL.
  23  *
  24  * Contact Information:
  25  * Tomas Winkler <tomas.winkler@intel.com>
  26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  27  *****************************************************************************/
  28 #include <net/mac80211.h>
  29 #include <linux/etherdevice.h>
  30
  31 #include "iwl-eeprom.h"
  32 #include "iwl-dev.h"
  33 #include "iwl-core.h"
  34 #include "iwl-sta.h"
  35 #include "iwl-io.h"
  36 #include "iwl-helpers.h"
  37
  38 /* For active scan, listen ACTIVE_DWELL_TIME (msec) on each channel after
  39  * sending probe req.  This should be set long enough to hear probe responses
  40  * from more than one AP.  */
  41 #define IWL_ACTIVE_DWELL_TIME_24    (20)       /* all times in msec */
  42 #define IWL_ACTIVE_DWELL_TIME_52    (10)
  43
  44 /* For faster active scanning, scan will move to the next channel if fewer than
  45  * PLCP_QUIET_THRESH packets are heard on this channel within
  46  * ACTIVE_QUIET_TIME after sending probe request.  This shortens the dwell
  47  * time if it's a quiet channel (nothing responded to our probe, and there's
  48  * no other traffic).
  49  * Disable "quiet" feature by setting PLCP_QUIET_THRESH to 0. */
  50 #define IWL_PLCP_QUIET_THRESH       __constant_cpu_to_le16(1)  /* packets */
  51 #define IWL_ACTIVE_QUIET_TIME       __constant_cpu_to_le16(5)  /* msec */
  52
  53 /* For passive scan, listen PASSIVE_DWELL_TIME (msec) on each channel.
  54  * Must be set longer than active dwell time.
  55  * For the most reliable scan, set > AP beacon interval (typically 100msec). */
  56 #define IWL_PASSIVE_DWELL_TIME_24   (20)       /* all times in msec */
  57 #define IWL_PASSIVE_DWELL_TIME_52   (10)
  58 #define IWL_PASSIVE_DWELL_BASE      (100)
  59 #define IWL_CHANNEL_TUNE_TIME       5
  60
  61 static int scan_tx_ant[3] = {
  62         RATE_MCS_ANT_A_MSK, RATE_MCS_ANT_B_MSK, RATE_MCS_ANT_C_MSK
  63 };
  64
  65 static int iwl_is_empty_essid(const char *essid, int essid_len)
  66 {
  67         /* Single white space is for Linksys APs */
  68         if (essid_len == 1 && essid[0] == ' ')
  69                 return 1;
  70
  71         /* Otherwise, if the entire essid is 0, we assume it is hidden */
  72         while (essid_len) {
  73                 essid_len--;
  74                 if (essid[essid_len] != '\0')
  75                         return 0;
  76         }
  77
  78         return 1;
  79 }
  80
  81
  82
  83 const char *iwl_escape_essid(const char *essid, u8 essid_len)
  84 {
  85         static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
  86         const char *s = essid;
  87         char *d = escaped;
  88
  89         if (iwl_is_empty_essid(essid, essid_len)) {
  90                 memcpy(escaped, "<hidden>", sizeof("<hidden>"));
  91                 return escaped;
  92         }
  93
  94         essid_len = min(essid_len, (u8) IW_ESSID_MAX_SIZE);
  95         while (essid_len--) {
  96                 if (*s == '\0') {
  97                         *d++ = '\\';
  98                         *d++ = '0';
  99                         s++;
 100                 } else
 101                         *d++ = *s++;
 102         }
 103         *d = '\0';
 104         return escaped;
 105 }
 106 EXPORT_SYMBOL(iwl_escape_essid);
 107
 108 /**
 109  * iwl_scan_cancel - Cancel any currently executing HW scan
 110  *
 111  * NOTE: priv->mutex is not required before calling this function
 112  */
 113 int iwl_scan_cancel(struct iwl_priv *priv)
 114 {
 115         if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
 116                 clear_bit(STATUS_SCANNING, &priv->status);
 117                 return 0;
 118         }
 119
 120         if (test_bit(STATUS_SCANNING, &priv->status)) {
 121                 if (!test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 122                         IWL_DEBUG_SCAN("Queuing scan abort.\n");
 123                         set_bit(STATUS_SCAN_ABORTING, &priv->status);
 124                         queue_work(priv->workqueue, &priv->abort_scan);
 125
 126                 } else
 127                         IWL_DEBUG_SCAN("Scan abort already in progress.\n");
 128
 129                 return test_bit(STATUS_SCANNING, &priv->status);
 130         }
 131
 132         return 0;
 133 }
 134 EXPORT_SYMBOL(iwl_scan_cancel);
 135 /**
 136  * iwl_scan_cancel_timeout - Cancel any currently executing HW scan
 137  * @ms: amount of time to wait (in milliseconds) for scan to abort
 138  *
 139  * NOTE: priv->mutex must be held before calling this function
 140  */
 141 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms)
 142 {
 143         unsigned long now = jiffies;
 144         int ret;
 145
 146         ret = iwl_scan_cancel(priv);
 147         if (ret && ms) {
 148                 mutex_unlock(&priv->mutex);
 149                 while (!time_after(jiffies, now + msecs_to_jiffies(ms)) &&
 150                                 test_bit(STATUS_SCANNING, &priv->status))
 151                         msleep(1);
 152                 mutex_lock(&priv->mutex);
 153
 154                 return test_bit(STATUS_SCANNING, &priv->status);
 155         }
 156
 157         return ret;
 158 }
 159 EXPORT_SYMBOL(iwl_scan_cancel_timeout);
 160
 161 static int iwl_send_scan_abort(struct iwl_priv *priv)
 162 {
 163         int ret = 0;
 164         struct iwl_rx_packet *res;
 165         struct iwl_host_cmd cmd = {
 166                 .id = REPLY_SCAN_ABORT_CMD,
 167                 .meta.flags = CMD_WANT_SKB,
 168         };
 169
 170         /* If there isn't a scan actively going on in the hardware
 171          * then we are in between scan bands and not actually
 172          * actively scanning, so don't send the abort command */
 173         if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
 174                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 175                 return 0;
 176         }
 177
 178         ret = iwl_send_cmd_sync(priv, &cmd);
 179         if (ret) {
 180                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 181                 return ret;
 182         }
 183
 184         res = (struct iwl_rx_packet *)cmd.meta.u.skb->data;
 185         if (res->u.status != CAN_ABORT_STATUS) {
 186                 /* The scan abort will return 1 for success or
 187                  * 2 for "failure".  A failure condition can be
 188                  * due to simply not being in an active scan which
 189                  * can occur if we send the scan abort before we
 190                  * the microcode has notified us that a scan is
 191                  * completed. */
 192                 IWL_DEBUG_INFO("SCAN_ABORT returned %d.\n", res->u.status);
 193                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 194                 clear_bit(STATUS_SCAN_HW, &priv->status);
 195         }
 196
 197         dev_kfree_skb_any(cmd.meta.u.skb);
 198
 199         return ret;
 200 }
 201
 202
 203 /* Service response to REPLY_SCAN_CMD (0x80) */
 204 static void iwl_rx_reply_scan(struct iwl_priv *priv,
 205                               struct iwl_rx_mem_buffer *rxb)
 206 {
 207 #ifdef CONFIG_IWLWIFI_DEBUG
 208         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 209         struct iwl_scanreq_notification *notif =
 210             (struct iwl_scanreq_notification *)pkt->u.raw;
 211
 212         IWL_DEBUG_RX("Scan request status = 0x%x\n", notif->status);
 213 #endif
 214 }
 215
 216 /* Service SCAN_START_NOTIFICATION (0x82) */
 217 static void iwl_rx_scan_start_notif(struct iwl_priv *priv,
 218                                     struct iwl_rx_mem_buffer *rxb)
 219 {
 220         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 221         struct iwl_scanstart_notification *notif =
 222             (struct iwl_scanstart_notification *)pkt->u.raw;
 223         priv->scan_start_tsf = le32_to_cpu(notif->tsf_low);
 224         IWL_DEBUG_SCAN("Scan start: "
 225                        "%d [802.11%s] "
 226                        "(TSF: 0x%08X:%08X) - %d (beacon timer %u)\n",
 227                        notif->channel,
 228                        notif->band ? "bg" : "a",
 229                        notif->tsf_high,
 230                        notif->tsf_low, notif->status, notif->beacon_timer);
 231 }
 232
 233 /* Service SCAN_RESULTS_NOTIFICATION (0x83) */
 234 static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
 235                                       struct iwl_rx_mem_buffer *rxb)
 236 {
 237 #ifdef CONFIG_IWLWIFI_DEBUG
 238         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 239         struct iwl_scanresults_notification *notif =
 240             (struct iwl_scanresults_notification *)pkt->u.raw;
 241
 242         IWL_DEBUG_SCAN("Scan ch.res: "
 243                        "%d [802.11%s] "
 244                        "(TSF: 0x%08X:%08X) - %d "
 245                        "elapsed=%lu usec (%dms since last)\n",
 246                        notif->channel,
 247                        notif->band ? "bg" : "a",
 248                        le32_to_cpu(notif->tsf_high),
 249                        le32_to_cpu(notif->tsf_low),
 250                        le32_to_cpu(notif->statistics[0]),
 251                        le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf,
 252                        jiffies_to_msecs(elapsed_jiffies
 253                                         (priv->last_scan_jiffies, jiffies)));
 254 #endif
 255
 256         priv->last_scan_jiffies = jiffies;
 257         priv->next_scan_jiffies = 0;
 258 }
 259
 260 /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
 261 static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
 262                                        struct iwl_rx_mem_buffer *rxb)
 263 {
 264         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 265         struct iwl_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
 266
 267         IWL_DEBUG_SCAN("Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
 268                        scan_notif->scanned_channels,
 269                        scan_notif->tsf_low,
 270                        scan_notif->tsf_high, scan_notif->status);
 271
 272         /* The HW is no longer scanning */
 273         clear_bit(STATUS_SCAN_HW, &priv->status);
 274
 275         /* The scan completion notification came in, so kill that timer... */
 276         cancel_delayed_work(&priv->scan_check);
 277
 278         IWL_DEBUG_INFO("Scan pass on %sGHz took %dms\n",
 279                        (priv->scan_bands == 2) ? "2.4" : "5.2",
 280                        jiffies_to_msecs(elapsed_jiffies
 281                                         (priv->scan_pass_start, jiffies)));
 282
 283         /* Remove this scanned band from the list
 284          * of pending bands to scan */
 285         priv->scan_bands--;
 286
 287         /* If a request to abort was given, or the scan did not succeed
 288          * then we reset the scan state machine and terminate,
 289          * re-queuing another scan if one has been requested */
 290         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 291                 IWL_DEBUG_INFO("Aborted scan completed.\n");
 292                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 293         } else {
 294                 /* If there are more bands on this scan pass reschedule */
 295                 if (priv->scan_bands > 0)
 296                         goto reschedule;
 297         }
 298
 299         priv->last_scan_jiffies = jiffies;
 300         priv->next_scan_jiffies = 0;
 301         IWL_DEBUG_INFO("Setting scan to off\n");
 302
 303         clear_bit(STATUS_SCANNING, &priv->status);
 304
 305         IWL_DEBUG_INFO("Scan took %dms\n",
 306                 jiffies_to_msecs(elapsed_jiffies(priv->scan_start, jiffies)));
 307
 308         queue_work(priv->workqueue, &priv->scan_completed);
 309
 310         return;
 311
 312 reschedule:
 313         priv->scan_pass_start = jiffies;
 314         queue_work(priv->workqueue, &priv->request_scan);
 315 }
 316
 317 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv)
 318 {
 319         /* scan handlers */
 320         priv->rx_handlers[REPLY_SCAN_CMD] = iwl_rx_reply_scan;
 321         priv->rx_handlers[SCAN_START_NOTIFICATION] = iwl_rx_scan_start_notif;
 322         priv->rx_handlers[SCAN_RESULTS_NOTIFICATION] =
 323                                         iwl_rx_scan_results_notif;
 324         priv->rx_handlers[SCAN_COMPLETE_NOTIFICATION] =
 325                                         iwl_rx_scan_complete_notif;
 326 }
 327 EXPORT_SYMBOL(iwl_setup_rx_scan_handlers);
 328
 329 static inline u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
 330                                                 enum ieee80211_band band)
 331 {
 332         if (band == IEEE80211_BAND_5GHZ)
 333                 return IWL_ACTIVE_DWELL_TIME_52;
 334         else
 335                 return IWL_ACTIVE_DWELL_TIME_24;
 336 }
 337
 338 static u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
 339                                           enum ieee80211_band band)
 340 {
 341         u16 active = iwl_get_active_dwell_time(priv, band);
 342         u16 passive = (band != IEEE80211_BAND_5GHZ) ?
 343             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_24 :
 344             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_52;
 345
 346         if (iwl_is_associated(priv)) {
 347                 /* If we're associated, we clamp the maximum passive
 348                  * dwell time to be 98% of the beacon interval (minus
 349                  * 2 * channel tune time) */
 350                 passive = priv->beacon_int;
 351                 if ((passive > IWL_PASSIVE_DWELL_BASE) || !passive)
 352                         passive = IWL_PASSIVE_DWELL_BASE;
 353                 passive = (passive * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
 354         }
 355
 356         if (passive <= active)
 357                 passive = active + 1;
 358
 359         return passive;
 360 }
 361
 362 static int iwl_get_channels_for_scan(struct iwl_priv *priv,
 363                                      enum ieee80211_band band,
 364                                      u8 is_active, u8 direct_mask,
 365                                      struct iwl_scan_channel *scan_ch)
 366 {
 367         const struct ieee80211_channel *channels = NULL;
 368         const struct ieee80211_supported_band *sband;
 369         const struct iwl_channel_info *ch_info;
 370         u16 passive_dwell = 0;
 371         u16 active_dwell = 0;
 372         int added, i;
 373
 374         sband = iwl_get_hw_mode(priv, band);
 375         if (!sband)
 376                 return 0;
 377
 378         channels = sband->channels;
 379
 380         active_dwell = iwl_get_active_dwell_time(priv, band);
 381         passive_dwell = iwl_get_passive_dwell_time(priv, band);
 382
 383         for (i = 0, added = 0; i < sband->n_channels; i++) {
 384                 if (channels[i].flags & IEEE80211_CHAN_DISABLED)
 385                         continue;
 386
 387                 scan_ch->channel =
 388                         ieee80211_frequency_to_channel(channels[i].center_freq);
 389
 390                 ch_info = iwl_get_channel_info(priv, band, scan_ch->channel);
 391                 if (!is_channel_valid(ch_info)) {
 392                         IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
 393                                        scan_ch->channel);
 394                         continue;
 395                 }
 396
 397                 if (!is_active || is_channel_passive(ch_info) ||
 398                     (channels[i].flags & IEEE80211_CHAN_PASSIVE_SCAN))
 399                         scan_ch->type = 0;
 400                 else
 401                         scan_ch->type = 1;
 402
 403                 if (scan_ch->type & 1)
 404                         scan_ch->type |= (direct_mask << 1);
 405
 406                 scan_ch->active_dwell = cpu_to_le16(active_dwell);
 407                 scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
 408
 409                 /* Set txpower levels to defaults */
 410                 scan_ch->dsp_atten = 110;
 411
 412                 if (band == IEEE80211_BAND_5GHZ)
 413                         scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
 414                 else {
 415                         scan_ch->tx_gain = ((1 << 5) | (5 << 3));
 416                         /* NOTE: if we were doing 6Mb OFDM for scans we'd use
 417                          * power level:
 418                          * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
 419                          */
 420                 }
 421
 422                 IWL_DEBUG_SCAN("Scanning %d [%s %d]\n",
 423                                scan_ch->channel,
 424                                (scan_ch->type & 1) ? "ACTIVE" : "PASSIVE",
 425                                (scan_ch->type & 1) ?
 426                                active_dwell : passive_dwell);
 427
 428                 scan_ch++;
 429                 added++;
 430         }
 431
 432         IWL_DEBUG_SCAN("total channels to scan %d \n", added);
 433         return added;
 434 }
 435
 436 void iwl_init_scan_params(struct iwl_priv *priv)
 437 {
 438         if (!priv->scan_tx_ant[IEEE80211_BAND_5GHZ])
 439                 priv->scan_tx_ant[IEEE80211_BAND_5GHZ] = RATE_MCS_ANT_INIT_IND;
 440         if (!priv->scan_tx_ant[IEEE80211_BAND_2GHZ])
 441                 priv->scan_tx_ant[IEEE80211_BAND_2GHZ] = RATE_MCS_ANT_INIT_IND;
 442 }
 443
 444 int iwl_scan_initiate(struct iwl_priv *priv)
 445 {
 446         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
 447                 IWL_ERROR("APs don't scan.\n");
 448                 return 0;
 449         }
 450
 451         if (!iwl_is_ready_rf(priv)) {
 452                 IWL_DEBUG_SCAN("Aborting scan due to not ready.\n");
 453                 return -EIO;
 454         }
 455
 456         if (test_bit(STATUS_SCANNING, &priv->status)) {
 457                 IWL_DEBUG_SCAN("Scan already in progress.\n");
 458                 return -EAGAIN;
 459         }
 460
 461         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 462                 IWL_DEBUG_SCAN("Scan request while abort pending.  "
 463                                "Queuing.\n");
 464                 return -EAGAIN;
 465         }
 466
 467         IWL_DEBUG_INFO("Starting scan...\n");
 468         priv->scan_bands = 2;
 469         set_bit(STATUS_SCANNING, &priv->status);
 470         priv->scan_start = jiffies;
 471         priv->scan_pass_start = priv->scan_start;
 472
 473         queue_work(priv->workqueue, &priv->request_scan);
 474
 475         return 0;
 476 }
 477 EXPORT_SYMBOL(iwl_scan_initiate);
 478
 479 #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
 480
 481 static void iwl_bg_scan_check(struct work_struct *data)
 482 {
 483         struct iwl_priv *priv =
 484             container_of(data, struct iwl_priv, scan_check.work);
 485
 486         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
 487                 return;
 488
 489         mutex_lock(&priv->mutex);
 490         if (test_bit(STATUS_SCANNING, &priv->status) ||
 491             test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 492                 IWL_DEBUG(IWL_DL_SCAN, "Scan completion watchdog resetting "
 493                         "adapter (%dms)\n",
 494                         jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
 495
 496                 if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
 497                         iwl_send_scan_abort(priv);
 498         }
 499         mutex_unlock(&priv->mutex);
 500 }
 501 /**
 502  * iwl_supported_rate_to_ie - fill in the supported rate in IE field
 503  *
 504  * return : set the bit for each supported rate insert in ie
 505  */
 506 static u16 iwl_supported_rate_to_ie(u8 *ie, u16 supported_rate,
 507                                     u16 basic_rate, int *left)
 508 {
 509         u16 ret_rates = 0, bit;
 510         int i;
 511         u8 *cnt = ie;
 512         u8 *rates = ie + 1;
 513
 514         for (bit = 1, i = 0; i < IWL_RATE_COUNT; i++, bit <<= 1) {
 515                 if (bit & supported_rate) {
 516                         ret_rates |= bit;
 517                         rates[*cnt] = iwl_rates[i].ieee |
 518                                 ((bit & basic_rate) ? 0x80 : 0x00);
 519                         (*cnt)++;
 520                         (*left)--;
 521                         if ((*left <= 0) ||
 522                             (*cnt >= IWL_SUPPORTED_RATES_IE_LEN))
 523                                 break;
 524                 }
 525         }
 526
 527         return ret_rates;
 528 }
 529
 530
 531 static void iwl_ht_cap_to_ie(const struct ieee80211_supported_band *sband,
 532                              u8 *pos, int *left)
 533 {
 534         struct ieee80211_ht_cap *ht_cap;
 535
 536         if (!sband || !sband->ht_info.ht_supported)
 537                 return;
 538
 539         if (*left < sizeof(struct ieee80211_ht_cap))
 540                 return;
 541
 542         *pos++ = sizeof(struct ieee80211_ht_cap);
 543         ht_cap = (struct ieee80211_ht_cap *) pos;
 544
 545         ht_cap->cap_info = cpu_to_le16(sband->ht_info.cap);
 546         memcpy(ht_cap->supp_mcs_set, sband->ht_info.supp_mcs_set, 16);
 547         ht_cap->ampdu_params_info =
 548                 (sband->ht_info.ampdu_factor & IEEE80211_HT_CAP_AMPDU_FACTOR) |
 549                 ((sband->ht_info.ampdu_density << 2) &
 550                         IEEE80211_HT_CAP_AMPDU_DENSITY);
 551         *left -= sizeof(struct ieee80211_ht_cap);
 552 }
 553
 554 /**
 555  * iwl_fill_probe_req - fill in all required fields and IE for probe request
 556  */
 557
 558 static u16 iwl_fill_probe_req(struct iwl_priv *priv,
 559                                   enum ieee80211_band band,
 560                                   struct ieee80211_mgmt *frame,
 561                                   int left)
 562 {
 563         int len = 0;
 564         u8 *pos = NULL;
 565         u16 active_rates, ret_rates, cck_rates, active_rate_basic;
 566         const struct ieee80211_supported_band *sband =
 567                                                 iwl_get_hw_mode(priv, band);
 568
 569
 570         /* Make sure there is enough space for the probe request,
 571          * two mandatory IEs and the data */
 572         left -= 24;
 573         if (left < 0)
 574                 return 0;
 575
 576         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 577         memcpy(frame->da, iwl_bcast_addr, ETH_ALEN);
 578         memcpy(frame->sa, priv->mac_addr, ETH_ALEN);
 579         memcpy(frame->bssid, iwl_bcast_addr, ETH_ALEN);
 580         frame->seq_ctrl = 0;
 581
 582         len += 24;
 583
 584         /* ...next IE... */
 585         pos = &frame->u.probe_req.variable[0];
 586
 587         /* fill in our indirect SSID IE */
 588         left -= 2;
 589         if (left < 0)
 590                 return 0;
 591         *pos++ = WLAN_EID_SSID;
 592         *pos++ = 0;
 593
 594         len += 2;
 595
 596         /* fill in supported rate */
 597         left -= 2;
 598         if (left < 0)
 599                 return 0;
 600
 601         *pos++ = WLAN_EID_SUPP_RATES;
 602         *pos = 0;
 603
 604         /* exclude 60M rate */
 605         active_rates = priv->rates_mask;
 606         active_rates &= ~IWL_RATE_60M_MASK;
 607
 608         active_rate_basic = active_rates & IWL_BASIC_RATES_MASK;
 609
 610         cck_rates = IWL_CCK_RATES_MASK & active_rates;
 611         ret_rates = iwl_supported_rate_to_ie(pos, cck_rates,
 612                                              active_rate_basic, &left);
 613         active_rates &= ~ret_rates;
 614
 615         ret_rates = iwl_supported_rate_to_ie(pos, active_rates,
 616                                              active_rate_basic, &left);
 617         active_rates &= ~ret_rates;
 618
 619         len += 2 + *pos;
 620         pos += (*pos) + 1;
 621
 622         if (active_rates == 0)
 623                 goto fill_end;
 624
 625         /* fill in supported extended rate */
 626         /* ...next IE... */
 627         left -= 2;
 628         if (left < 0)
 629                 return 0;
 630         /* ... fill it in... */
 631         *pos++ = WLAN_EID_EXT_SUPP_RATES;
 632         *pos = 0;
 633         iwl_supported_rate_to_ie(pos, active_rates, active_rate_basic, &left);
 634         if (*pos > 0) {
 635                 len += 2 + *pos;
 636                 pos += (*pos) + 1;
 637         } else {
 638                 pos--;
 639         }
 640
 641  fill_end:
 642
 643         left -= 2;
 644         if (left < 0)
 645                 return 0;
 646
 647         *pos++ = WLAN_EID_HT_CAPABILITY;
 648         *pos = 0;
 649         iwl_ht_cap_to_ie(sband, pos, &left);
 650         if (*pos > 0)
 651                 len += 2 + *pos;
 652
 653         return (u16)len;
 654 }
 655
 656 static u32 iwl_scan_tx_ant(struct iwl_priv *priv, enum ieee80211_band band)
 657 {
 658         int i, ind;
 659
 660         ind = priv->scan_tx_ant[band];
 661         for (i = 0; i < priv->hw_params.tx_chains_num; i++) {
 662                 ind = (ind+1) >= priv->hw_params.tx_chains_num ? 0 : ind+1;
 663                 if (priv->hw_params.valid_tx_ant & (1 << ind)) {
 664                         priv->scan_tx_ant[band] = ind;
 665                         break;
 666                 }
 667         }
 668
 669         return scan_tx_ant[ind];
 670 }
 671
 672
 673 static void iwl_bg_request_scan(struct work_struct *data)
 674 {
 675         struct iwl_priv *priv =
 676             container_of(data, struct iwl_priv, request_scan);
 677         struct iwl_host_cmd cmd = {
 678                 .id = REPLY_SCAN_CMD,
 679                 .len = sizeof(struct iwl_scan_cmd),
 680                 .meta.flags = CMD_SIZE_HUGE,
 681         };
 682         struct iwl_scan_cmd *scan;
 683         struct ieee80211_conf *conf = NULL;
 684         int ret = 0;
 685         u32 tx_ant;
 686         u16 cmd_len;
 687         enum ieee80211_band band;
 688         u8 direct_mask;
 689         u8 rx_chain = 0x7; /* bitmap: ABC chains */
 690
 691         conf = ieee80211_get_hw_conf(priv->hw);
 692
 693         mutex_lock(&priv->mutex);
 694
 695         if (!iwl_is_ready(priv)) {
 696                 IWL_WARNING("request scan called when driver not ready.\n");
 697                 goto done;
 698         }
 699
 700         /* Make sure the scan wasn't cancelled before this queued work
 701          * was given the chance to run... */
 702         if (!test_bit(STATUS_SCANNING, &priv->status))
 703                 goto done;
 704
 705         /* This should never be called or scheduled if there is currently
 706          * a scan active in the hardware. */
 707         if (test_bit(STATUS_SCAN_HW, &priv->status)) {
 708                 IWL_DEBUG_INFO("Multiple concurrent scan requests in parallel. "
 709                                "Ignoring second request.\n");
 710                 ret = -EIO;
 711                 goto done;
 712         }
 713
 714         if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
 715                 IWL_DEBUG_SCAN("Aborting scan due to device shutdown\n");
 716                 goto done;
 717         }
 718
 719         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 720                 IWL_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
 721                 goto done;
 722         }
 723
 724         if (iwl_is_rfkill(priv)) {
 725                 IWL_DEBUG_HC("Aborting scan due to RF Kill activation\n");
 726                 goto done;
 727         }
 728
 729         if (!test_bit(STATUS_READY, &priv->status)) {
 730                 IWL_DEBUG_HC("Scan request while uninitialized.  Queuing.\n");
 731                 goto done;
 732         }
 733
 734         if (!priv->scan_bands) {
 735                 IWL_DEBUG_HC("Aborting scan due to no requested bands\n");
 736                 goto done;
 737         }
 738
 739         if (!priv->scan) {
 740                 priv->scan = kmalloc(sizeof(struct iwl_scan_cmd) +
 741                                      IWL_MAX_SCAN_SIZE, GFP_KERNEL);
 742                 if (!priv->scan) {
 743                         ret = -ENOMEM;
 744                         goto done;
 745                 }
 746         }
 747         scan = priv->scan;
 748         memset(scan, 0, sizeof(struct iwl_scan_cmd) + IWL_MAX_SCAN_SIZE);
 749
 750         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
 751         scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
 752
 753         if (iwl_is_associated(priv)) {
 754                 u16 interval = 0;
 755                 u32 extra;
 756                 u32 suspend_time = 100;
 757                 u32 scan_suspend_time = 100;
 758                 unsigned long flags;
 759
 760                 IWL_DEBUG_INFO("Scanning while associated...\n");
 761
 762                 spin_lock_irqsave(&priv->lock, flags);
 763                 interval = priv->beacon_int;
 764                 spin_unlock_irqrestore(&priv->lock, flags);
 765
 766                 scan->suspend_time = 0;
 767                 scan->max_out_time = cpu_to_le32(200 * 1024);
 768                 if (!interval)
 769                         interval = suspend_time;
 770
 771                 extra = (suspend_time / interval) << 22;
 772                 scan_suspend_time = (extra |
 773                     ((suspend_time % interval) * 1024));
 774                 scan->suspend_time = cpu_to_le32(scan_suspend_time);
 775                 IWL_DEBUG_SCAN("suspend_time 0x%X beacon interval %d\n",
 776                                scan_suspend_time, interval);
 777         }
 778
 779         /* We should add the ability for user to lock to PASSIVE ONLY */
 780         if (priv->one_direct_scan) {
 781                 IWL_DEBUG_SCAN("Start direct scan for '%s'\n",
 782                                 iwl_escape_essid(priv->direct_ssid,
 783                                 priv->direct_ssid_len));
 784                 scan->direct_scan[0].id = WLAN_EID_SSID;
 785                 scan->direct_scan[0].len = priv->direct_ssid_len;
 786                 memcpy(scan->direct_scan[0].ssid,
 787                        priv->direct_ssid, priv->direct_ssid_len);
 788                 direct_mask = 1;
 789         } else if (!iwl_is_associated(priv) && priv->essid_len) {
 790                 IWL_DEBUG_SCAN("Start direct scan for '%s' (not associated)\n",
 791                                 iwl_escape_essid(priv->essid, priv->essid_len));
 792                 scan->direct_scan[0].id = WLAN_EID_SSID;
 793                 scan->direct_scan[0].len = priv->essid_len;
 794                 memcpy(scan->direct_scan[0].ssid, priv->essid, priv->essid_len);
 795                 direct_mask = 1;
 796         } else {
 797                 IWL_DEBUG_SCAN("Start indirect scan.\n");
 798                 direct_mask = 0;
 799         }
 800
 801         scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
 802         scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
 803         scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 804
 805
 806         switch (priv->scan_bands) {
 807         case 2:
 808                 band = IEEE80211_BAND_2GHZ;
 809                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
 810                 tx_ant = iwl_scan_tx_ant(priv, band);
 811                 if (priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_PURE_40_MSK)
 812                         scan->tx_cmd.rate_n_flags =
 813                                 iwl_hw_set_rate_n_flags(IWL_RATE_6M_PLCP,
 814                                                         tx_ant);
 815                 else
 816                         scan->tx_cmd.rate_n_flags =
 817                                 iwl_hw_set_rate_n_flags(IWL_RATE_1M_PLCP,
 818                                                         tx_ant |
 819                                                         RATE_MCS_CCK_MSK);
 820                 scan->good_CRC_th = 0;
 821                 break;
 822
 823         case 1:
 824                 band = IEEE80211_BAND_5GHZ;
 825                 tx_ant = iwl_scan_tx_ant(priv, band);
 826                 scan->tx_cmd.rate_n_flags =
 827                                 iwl_hw_set_rate_n_flags(IWL_RATE_6M_PLCP,
 828                                                         tx_ant);
 829                 scan->good_CRC_th = IWL_GOOD_CRC_TH;
 830
 831                 /* Force use of chains B and C (0x6) for scan Rx for 4965
 832                  * Avoid A (0x1) because of its off-channel reception on A-band.
 833                  * MIMO is not used here, but value is required */
 834                 if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
 835                         rx_chain = 0x6;
 836
 837                 break;
 838         default:
 839                 IWL_WARNING("Invalid scan band count\n");
 840                 goto done;
 841         }
 842
 843         scan->rx_chain = RXON_RX_CHAIN_DRIVER_FORCE_MSK |
 844                                 cpu_to_le16((0x7 << RXON_RX_CHAIN_VALID_POS) |
 845                                 (rx_chain << RXON_RX_CHAIN_FORCE_SEL_POS) |
 846                                 (0x7 << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS));
 847
 848         cmd_len = iwl_fill_probe_req(priv, band,
 849                                      (struct ieee80211_mgmt *)scan->data,
 850                                      IWL_MAX_SCAN_SIZE - sizeof(*scan));
 851
 852         scan->tx_cmd.len = cpu_to_le16(cmd_len);
 853
 854         if (priv->iw_mode == IEEE80211_IF_TYPE_MNTR)
 855                 scan->filter_flags = RXON_FILTER_PROMISC_MSK;
 856
 857         scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
 858                                RXON_FILTER_BCON_AWARE_MSK);
 859
 860         if (direct_mask)
 861                 scan->channel_count =
 862                         iwl_get_channels_for_scan(priv, band, 1, /* active */
 863                                                   direct_mask,
 864                                 (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 865         else
 866                 scan->channel_count =
 867                         iwl_get_channels_for_scan(priv, band, 0, /* passive */
 868                                                   direct_mask,
 869                                 (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 870         if (scan->channel_count == 0) {
 871                 IWL_DEBUG_SCAN("channel count %d\n", scan->channel_count);
 872                 goto done;
 873         }
 874
 875         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
 876             scan->channel_count * sizeof(struct iwl_scan_channel);
 877         cmd.data = scan;
 878         scan->len = cpu_to_le16(cmd.len);
 879
 880         set_bit(STATUS_SCAN_HW, &priv->status);
 881         ret = iwl_send_cmd_sync(priv, &cmd);
 882         if (ret)
 883                 goto done;
 884
 885         queue_delayed_work(priv->workqueue, &priv->scan_check,
 886                            IWL_SCAN_CHECK_WATCHDOG);
 887
 888         mutex_unlock(&priv->mutex);
 889         return;
 890
 891  done:
 892         /* inform mac80211 scan aborted */
 893         queue_work(priv->workqueue, &priv->scan_completed);
 894         mutex_unlock(&priv->mutex);
 895 }
 896
 897 static void iwl_bg_abort_scan(struct work_struct *work)
 898 {
 899         struct iwl_priv *priv = container_of(work, struct iwl_priv, abort_scan);
 900
 901         if (!iwl_is_ready(priv))
 902                 return;
 903
 904         mutex_lock(&priv->mutex);
 905
 906         set_bit(STATUS_SCAN_ABORTING, &priv->status);
 907         iwl_send_scan_abort(priv);
 908
 909         mutex_unlock(&priv->mutex);
 910 }
 911
 912 void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 913 {
 914         /*  FIXME: move here when resolved PENDING
 915          *  INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed); */
 916         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
 917         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
 918         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 919 }
 920 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
 921