sys/dev/iwm/if_iwm_scan.c

   1 /*      $OpenBSD: if_iwm.c,v 1.39 2015/03/23 00:35:19 jsg Exp $ */
   2
   3 /*
   4  * Copyright (c) 2014 genua mbh <info@genua.de>
   5  * Copyright (c) 2014 Fixup Software Ltd.
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 /*-
  21  * Based on BSD-licensed source modules in the Linux iwlwifi driver,
  22  * which were used as the reference documentation for this implementation.
  23  *
  24  * Driver version we are currently based off of is
  25  * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd)
  26  *
  27  ***********************************************************************
  28  *
  29  * This file is provided under a dual BSD/GPLv2 license.  When using or
  30  * redistributing this file, you may do so under either license.
  31  *
  32  * GPL LICENSE SUMMARY
  33  *
  34  * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
  35  *
  36  * This program is free software; you can redistribute it and/or modify
  37  * it under the terms of version 2 of the GNU General Public License as
  38  * published by the Free Software Foundation.
  39  *
  40  * This program is distributed in the hope that it will be useful, but
  41  * WITHOUT ANY WARRANTY; without even the implied warranty of
  42  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  43  * General Public License for more details.
  44  *
  45  * You should have received a copy of the GNU General Public License
  46  * along with this program; if not, write to the Free Software
  47  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  48  * USA
  49  *
  50  * The full GNU General Public License is included in this distribution
  51  * in the file called COPYING.
  52  *
  53  * Contact Information:
  54  *  Intel Linux Wireless <ilw@linux.intel.com>
  55  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  56  *
  57  *
  58  * BSD LICENSE
  59  *
  60  * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
  61  * All rights reserved.
  62  *
  63  * Redistribution and use in source and binary forms, with or without
  64  * modification, are permitted provided that the following conditions
  65  * are met:
  66  *
  67  *  * Redistributions of source code must retain the above copyright
  68  *    notice, this list of conditions and the following disclaimer.
  69  *  * Redistributions in binary form must reproduce the above copyright
  70  *    notice, this list of conditions and the following disclaimer in
  71  *    the documentation and/or other materials provided with the
  72  *    distribution.
  73  *  * Neither the name Intel Corporation nor the names of its
  74  *    contributors may be used to endorse or promote products derived
  75  *    from this software without specific prior written permission.
  76  *
  77  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  78  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  79  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  80  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  81  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  82  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  83  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  84  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  85  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  86  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  87  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  88  */
  89
  90 /*-
  91  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
  92  *
  93  * Permission to use, copy, modify, and distribute this software for any
  94  * purpose with or without fee is hereby granted, provided that the above
  95  * copyright notice and this permission notice appear in all copies.
  96  *
  97  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  98  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  99  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 100  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 101  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 102  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 103  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 104  */
 105 #include <sys/cdefs.h>
 106 __FBSDID("$FreeBSD$");
 107
 108 #include "opt_wlan.h"
 109
 110 #include <sys/param.h>
 111 #include <sys/bus.h>
 112 #include <sys/conf.h>
 113 #include <sys/endian.h>
 114 #include <sys/firmware.h>
 115 #include <sys/kernel.h>
 116 #include <sys/malloc.h>
 117 #include <sys/mbuf.h>
 118 #include <sys/mutex.h>
 119 #include <sys/module.h>
 120 #include <sys/proc.h>
 121 #include <sys/rman.h>
 122 #include <sys/socket.h>
 123 #include <sys/sockio.h>
 124 #include <sys/sysctl.h>
 125 #include <sys/linker.h>
 126
 127 #include <machine/bus.h>
 128 #include <machine/endian.h>
 129 #include <machine/resource.h>
 130
 131 #include <dev/pci/pcivar.h>
 132 #include <dev/pci/pcireg.h>
 133
 134 #include <net/bpf.h>
 135
 136 #include <net/if.h>
 137 #include <net/if_var.h>
 138 #include <net/if_arp.h>
 139 #include <net/if_dl.h>
 140 #include <net/if_media.h>
 141 #include <net/if_types.h>
 142
 143 #include <netinet/in.h>
 144 #include <netinet/in_systm.h>
 145 #include <netinet/if_ether.h>
 146 #include <netinet/ip.h>
 147
 148 #include <net80211/ieee80211_var.h>
 149 #include <net80211/ieee80211_regdomain.h>
 150 #include <net80211/ieee80211_ratectl.h>
 151 #include <net80211/ieee80211_radiotap.h>
 152
 153 #include <dev/iwm/if_iwmreg.h>
 154 #include <dev/iwm/if_iwmvar.h>
 155 #include <dev/iwm/if_iwm_debug.h>
 156 #include <dev/iwm/if_iwm_util.h>
 157 #include <dev/iwm/if_iwm_scan.h>
 158
 159 /*
 160  * BEGIN mvm/scan.c
 161  */
 162
 163 #define IWM_PLCP_QUIET_THRESH 1
 164 #define IWM_ACTIVE_QUIET_TIME 10
 165 #define LONG_OUT_TIME_PERIOD (600 * IEEE80211_DUR_TU)
 166 #define SHORT_OUT_TIME_PERIOD (200 * IEEE80211_DUR_TU)
 167 #define SUSPEND_TIME_PERIOD (100 * IEEE80211_DUR_TU)
 168
 169 static uint16_t
 170 iwm_mvm_scan_rx_chain(struct iwm_softc *sc)
 171 {
 172         uint16_t rx_chain;
 173         uint8_t rx_ant;
 174
 175         rx_ant = iwm_fw_valid_rx_ant(sc);
 176         rx_chain = rx_ant << IWM_PHY_RX_CHAIN_VALID_POS;
 177         rx_chain |= rx_ant << IWM_PHY_RX_CHAIN_FORCE_MIMO_SEL_POS;
 178         rx_chain |= rx_ant << IWM_PHY_RX_CHAIN_FORCE_SEL_POS;
 179         rx_chain |= 0x1 << IWM_PHY_RX_CHAIN_DRIVER_FORCE_POS;
 180         return htole16(rx_chain);
 181 }
 182
 183 #if 0
 184 static uint32_t
 185 iwm_mvm_scan_max_out_time(struct iwm_softc *sc, uint32_t flags, int is_assoc)
 186 {
 187         if (!is_assoc)
 188                 return 0;
 189         if (flags & 0x1)
 190                 return htole32(SHORT_OUT_TIME_PERIOD);
 191         return htole32(LONG_OUT_TIME_PERIOD);
 192 }
 193
 194 static uint32_t
 195 iwm_mvm_scan_suspend_time(struct iwm_softc *sc, int is_assoc)
 196 {
 197         if (!is_assoc)
 198                 return 0;
 199         return htole32(SUSPEND_TIME_PERIOD);
 200 }
 201 #endif
 202
 203 static uint32_t
 204 iwm_mvm_scan_rate_n_flags(struct iwm_softc *sc, int flags, int no_cck)
 205 {
 206         uint32_t tx_ant;
 207         int i, ind;
 208
 209         for (i = 0, ind = sc->sc_scan_last_antenna;
 210             i < IWM_RATE_MCS_ANT_NUM; i++) {
 211                 ind = (ind + 1) % IWM_RATE_MCS_ANT_NUM;
 212                 if (iwm_fw_valid_tx_ant(sc) & (1 << ind)) {
 213                         sc->sc_scan_last_antenna = ind;
 214                         break;
 215                 }
 216         }
 217         tx_ant = (1 << sc->sc_scan_last_antenna) << IWM_RATE_MCS_ANT_POS;
 218
 219         if ((flags & IEEE80211_CHAN_2GHZ) && !no_cck)
 220                 return htole32(IWM_RATE_1M_PLCP | IWM_RATE_MCS_CCK_MSK |
 221                                    tx_ant);
 222         else
 223                 return htole32(IWM_RATE_6M_PLCP | tx_ant);
 224 }
 225
 226 #if 0
 227 /*
 228  * If req->n_ssids > 0, it means we should do an active scan.
 229  * In case of active scan w/o directed scan, we receive a zero-length SSID
 230  * just to notify that this scan is active and not passive.
 231  * In order to notify the FW of the number of SSIDs we wish to scan (including
 232  * the zero-length one), we need to set the corresponding bits in chan->type,
 233  * one for each SSID, and set the active bit (first). If the first SSID is
 234  * already included in the probe template, so we need to set only
 235  * req->n_ssids - 1 bits in addition to the first bit.
 236  */
 237 static uint16_t
 238 iwm_mvm_get_active_dwell(struct iwm_softc *sc, int flags, int n_ssids)
 239 {
 240         if (flags & IEEE80211_CHAN_2GHZ)
 241                 return 30  + 3 * (n_ssids + 1);
 242         return 20  + 2 * (n_ssids + 1);
 243 }
 244
 245 static uint16_t
 246 iwm_mvm_get_passive_dwell(struct iwm_softc *sc, int flags)
 247 {
 248         return (flags & IEEE80211_CHAN_2GHZ) ? 100 + 20 : 100 + 10;
 249 }
 250 #endif
 251
 252 static int
 253 iwm_mvm_scan_skip_channel(struct ieee80211_channel *c)
 254 {
 255         if (IEEE80211_IS_CHAN_2GHZ(c) && IEEE80211_IS_CHAN_B(c))
 256                 return 0;
 257         else if (IEEE80211_IS_CHAN_5GHZ(c) && IEEE80211_IS_CHAN_A(c))
 258                 return 0;
 259         else
 260                 return 1;
 261 }
 262
 263 static uint8_t
 264 iwm_mvm_lmac_scan_fill_channels(struct iwm_softc *sc,
 265     struct iwm_scan_channel_cfg_lmac *chan, int n_ssids)
 266 {
 267         struct ieee80211com *ic = &sc->sc_ic;
 268         struct ieee80211_channel *c;
 269         uint8_t nchan;
 270         int j;
 271
 272         for (nchan = j = 0;
 273             j < ic->ic_nchans && nchan < sc->sc_capa_n_scan_channels; j++) {
 274                 c = &ic->ic_channels[j];
 275                 /* For 2GHz, only populate 11b channels */
 276                 /* For 5GHz, only populate 11a channels */
 277                 /*
 278                  * Catch other channels, in case we have 900MHz channels or
 279                  * something in the chanlist.
 280                  */
 281                 if (iwm_mvm_scan_skip_channel(c)) {
 282                         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM,
 283                             "%s: skipping channel (freq=%d, ieee=%d, flags=0x%08x)\n",
 284                             __func__, c->ic_freq, c->ic_ieee, c->ic_flags);
 285                         continue;
 286                 }
 287
 288                 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM,
 289                     "Adding channel %d (%d Mhz) to the list\n",
 290                     nchan, c->ic_freq);
 291                 chan->channel_num = htole16(ieee80211_mhz2ieee(c->ic_freq, 0));
 292                 chan->iter_count = htole16(1);
 293                 chan->iter_interval = htole32(0);
 294                 chan->flags = htole32(IWM_UNIFIED_SCAN_CHANNEL_PARTIAL);
 295 #if 0 /* makes scanning while associated less useful */
 296                 if (n_ssids != 0)
 297                         chan->flags |= htole32(1 << 1); /* select SSID 0 */
 298 #endif
 299                 chan++;
 300                 nchan++;
 301         }
 302
 303         return nchan;
 304 }
 305
 306 static uint8_t
 307 iwm_mvm_umac_scan_fill_channels(struct iwm_softc *sc,
 308     struct iwm_scan_channel_cfg_umac *chan, int n_ssids)
 309 {
 310         struct ieee80211com *ic = &sc->sc_ic;
 311         struct ieee80211_channel *c;
 312         uint8_t nchan;
 313         int j;
 314
 315         for (nchan = j = 0;
 316             j < ic->ic_nchans && nchan < sc->sc_capa_n_scan_channels; j++) {
 317                 c = &ic->ic_channels[j];
 318                 /* For 2GHz, only populate 11b channels */
 319                 /* For 5GHz, only populate 11a channels */
 320                 /*
 321                  * Catch other channels, in case we have 900MHz channels or
 322                  * something in the chanlist.
 323                  */
 324                 if (iwm_mvm_scan_skip_channel(c)) {
 325                         IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM,
 326                             "%s: skipping channel (freq=%d, ieee=%d, flags=0x%08x)\n",
 327                             __func__, c->ic_freq, c->ic_ieee, c->ic_flags);
 328                         continue;
 329                 }
 330
 331                 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM,
 332                     "Adding channel %d (%d Mhz) to the list\n",
 333                     nchan, c->ic_freq);
 334                 chan->channel_num = ieee80211_mhz2ieee(c->ic_freq, 0);
 335                 chan->iter_count = 1;
 336                 chan->iter_interval = htole16(0);
 337                 chan->flags = htole32(0);
 338 #if 0 /* makes scanning while associated less useful */
 339                 if (n_ssids != 0)
 340                         chan->flags = htole32(1 << 0); /* select SSID 0 */
 341 #endif
 342                 chan++;
 343                 nchan++;
 344         }
 345
 346         return nchan;
 347 }
 348
 349 static int
 350 iwm_mvm_fill_probe_req(struct iwm_softc *sc, struct iwm_scan_probe_req *preq)
 351 {
 352         struct ieee80211com *ic = &sc->sc_ic;
 353         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 354         struct ieee80211_frame *wh = (struct ieee80211_frame *)preq->buf;
 355         struct ieee80211_rateset *rs;
 356         size_t remain = sizeof(preq->buf);
 357         uint8_t *frm, *pos;
 358         int ssid_len = 0;
 359         const uint8_t *ssid = NULL;
 360
 361         memset(preq, 0, sizeof(*preq));
 362
 363         /* Ensure enough space for header and SSID IE. */
 364         if (remain < sizeof(*wh) + 2 + ssid_len)
 365                 return ENOBUFS;
 366
 367         /*
 368          * Build a probe request frame.  Most of the following code is a
 369          * copy & paste of what is done in net80211.
 370          */
 371         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
 372             IEEE80211_FC0_SUBTYPE_PROBE_REQ;
 373         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
 374         IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
 375         IEEE80211_ADDR_COPY(wh->i_addr2, vap ? vap->iv_myaddr : ic->ic_macaddr);
 376         IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);
 377         *(uint16_t *)&wh->i_dur[0] = 0; /* filled by HW */
 378         *(uint16_t *)&wh->i_seq[0] = 0; /* filled by HW */
 379
 380         frm = (uint8_t *)(wh + 1);
 381         frm = ieee80211_add_ssid(frm, ssid, ssid_len);
 382
 383         /* Tell the firmware where the MAC header is. */
 384         preq->mac_header.offset = 0;
 385         preq->mac_header.len = htole16(frm - (uint8_t *)wh);
 386         remain -= frm - (uint8_t *)wh;
 387
 388         /* Fill in 2GHz IEs and tell firmware where they are. */
 389         rs = &ic->ic_sup_rates[IEEE80211_MODE_11G];
 390         if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
 391                 if (remain < 4 + rs->rs_nrates)
 392                         return ENOBUFS;
 393         } else if (remain < 2 + rs->rs_nrates) {
 394                 return ENOBUFS;
 395         }
 396         preq->band_data[0].offset = htole16(frm - (uint8_t *)wh);
 397         pos = frm;
 398         frm = ieee80211_add_rates(frm, rs);
 399         if (rs->rs_nrates > IEEE80211_RATE_SIZE)
 400                 frm = ieee80211_add_xrates(frm, rs);
 401         preq->band_data[0].len = htole16(frm - pos);
 402         remain -= frm - pos;
 403
 404         if (isset(sc->sc_enabled_capa,
 405             IWM_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT)) {
 406                 if (remain < 3)
 407                         return ENOBUFS;
 408                 *frm++ = IEEE80211_ELEMID_DSPARMS;
 409                 *frm++ = 1;
 410                 *frm++ = 0;
 411                 remain -= 3;
 412         }
 413
 414         if (sc->sc_nvm.sku_cap_band_52GHz_enable) {
 415                 /* Fill in 5GHz IEs. */
 416                 rs = &ic->ic_sup_rates[IEEE80211_MODE_11A];
 417                 if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
 418                         if (remain < 4 + rs->rs_nrates)
 419                                 return ENOBUFS;
 420                 } else if (remain < 2 + rs->rs_nrates) {
 421                         return ENOBUFS;
 422                 }
 423                 preq->band_data[1].offset = htole16(frm - (uint8_t *)wh);
 424                 pos = frm;
 425                 frm = ieee80211_add_rates(frm, rs);
 426                 if (rs->rs_nrates > IEEE80211_RATE_SIZE)
 427                         frm = ieee80211_add_xrates(frm, rs);
 428                 preq->band_data[1].len = htole16(frm - pos);
 429                 remain -= frm - pos;
 430         }
 431
 432         /* Send 11n IEs on both 2GHz and 5GHz bands. */
 433         preq->common_data.offset = htole16(frm - (uint8_t *)wh);
 434         pos = frm;
 435 #if 0
 436         if (ic->ic_flags & IEEE80211_F_HTON) {
 437                 if (remain < 28)
 438                         return ENOBUFS;
 439                 frm = ieee80211_add_htcaps(frm, ic);
 440                 /* XXX add WME info? */
 441         }
 442 #endif
 443         preq->common_data.len = htole16(frm - pos);
 444
 445         return 0;
 446 }
 447
 448 int
 449 iwm_mvm_config_umac_scan(struct iwm_softc *sc)
 450 {
 451         struct ieee80211com *ic = &sc->sc_ic;
 452         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 453
 454         struct iwm_scan_config *scan_config;
 455         int ret, j, nchan;
 456         size_t cmd_size;
 457         struct ieee80211_channel *c;
 458         struct iwm_host_cmd hcmd = {
 459                 .id = iwm_cmd_id(IWM_SCAN_CFG_CMD, IWM_ALWAYS_LONG_GROUP, 0),
 460                 .flags = IWM_CMD_SYNC,
 461         };
 462         static const uint32_t rates = (IWM_SCAN_CONFIG_RATE_1M |
 463             IWM_SCAN_CONFIG_RATE_2M | IWM_SCAN_CONFIG_RATE_5M |
 464             IWM_SCAN_CONFIG_RATE_11M | IWM_SCAN_CONFIG_RATE_6M |
 465             IWM_SCAN_CONFIG_RATE_9M | IWM_SCAN_CONFIG_RATE_12M |
 466             IWM_SCAN_CONFIG_RATE_18M | IWM_SCAN_CONFIG_RATE_24M |
 467             IWM_SCAN_CONFIG_RATE_36M | IWM_SCAN_CONFIG_RATE_48M |
 468             IWM_SCAN_CONFIG_RATE_54M);
 469
 470         cmd_size = sizeof(*scan_config) + sc->sc_capa_n_scan_channels;
 471
 472         scan_config = malloc(cmd_size, M_DEVBUF, M_NOWAIT | M_ZERO);
 473         if (scan_config == NULL)
 474                 return ENOMEM;
 475
 476         scan_config->tx_chains = htole32(iwm_fw_valid_tx_ant(sc));
 477         scan_config->rx_chains = htole32(iwm_fw_valid_rx_ant(sc));
 478         scan_config->legacy_rates = htole32(rates |
 479             IWM_SCAN_CONFIG_SUPPORTED_RATE(rates));
 480
 481         /* These timings correspond to iwlwifi's UNASSOC scan. */
 482         scan_config->dwell_active = 10;
 483         scan_config->dwell_passive = 110;
 484         scan_config->dwell_fragmented = 44;
 485         scan_config->dwell_extended = 90;
 486         scan_config->out_of_channel_time = htole32(0);
 487         scan_config->suspend_time = htole32(0);
 488
 489         IEEE80211_ADDR_COPY(scan_config->mac_addr,
 490             vap ? vap->iv_myaddr : ic->ic_macaddr);
 491
 492         scan_config->bcast_sta_id = sc->sc_aux_sta.sta_id;
 493         scan_config->channel_flags = IWM_CHANNEL_FLAG_EBS |
 494             IWM_CHANNEL_FLAG_ACCURATE_EBS | IWM_CHANNEL_FLAG_EBS_ADD |
 495             IWM_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE;
 496
 497         for (nchan = j = 0;
 498             j < ic->ic_nchans && nchan < sc->sc_capa_n_scan_channels; j++) {
 499                 c = &ic->ic_channels[j];
 500                 /* For 2GHz, only populate 11b channels */
 501                 /* For 5GHz, only populate 11a channels */
 502                 /*
 503                  * Catch other channels, in case we have 900MHz channels or
 504                  * something in the chanlist.
 505                  */
 506                 if (iwm_mvm_scan_skip_channel(c))
 507                         continue;
 508                 scan_config->channel_array[nchan++] =
 509                     ieee80211_mhz2ieee(c->ic_freq, 0);
 510         }
 511
 512         scan_config->flags = htole32(IWM_SCAN_CONFIG_FLAG_ACTIVATE |
 513             IWM_SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS |
 514             IWM_SCAN_CONFIG_FLAG_SET_TX_CHAINS |
 515             IWM_SCAN_CONFIG_FLAG_SET_RX_CHAINS |
 516             IWM_SCAN_CONFIG_FLAG_SET_AUX_STA_ID |
 517             IWM_SCAN_CONFIG_FLAG_SET_ALL_TIMES |
 518             IWM_SCAN_CONFIG_FLAG_SET_LEGACY_RATES |
 519             IWM_SCAN_CONFIG_FLAG_SET_MAC_ADDR |
 520             IWM_SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS|
 521             IWM_SCAN_CONFIG_N_CHANNELS(nchan) |
 522             IWM_SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED);
 523
 524         hcmd.data[0] = scan_config;
 525         hcmd.len[0] = cmd_size;
 526
 527         IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Sending UMAC scan config\n");
 528
 529         ret = iwm_send_cmd(sc, &hcmd);
 530         if (!ret)
 531                 IWM_DPRINTF(sc, IWM_DEBUG_SCAN,
 532                     "UMAC scan config was sent successfully\n");
 533
 534         free(scan_config, M_DEVBUF);
 535         return ret;
 536 }
 537
 538 int
 539 iwm_mvm_umac_scan(struct iwm_softc *sc)
 540 {
 541         struct iwm_host_cmd hcmd = {
 542                 .id = iwm_cmd_id(IWM_SCAN_REQ_UMAC, IWM_ALWAYS_LONG_GROUP, 0),
 543                 .len = { 0, },
 544                 .data = { NULL, },
 545                 .flags = IWM_CMD_SYNC,
 546         };
 547         struct iwm_scan_req_umac *req;
 548         struct iwm_scan_req_umac_tail *tail;
 549         size_t req_len;
 550         int ssid_len = 0;
 551         const uint8_t *ssid = NULL;
 552         int ret;
 553
 554         req_len = sizeof(struct iwm_scan_req_umac) +
 555             (sizeof(struct iwm_scan_channel_cfg_umac) *
 556             sc->sc_capa_n_scan_channels) +
 557             sizeof(struct iwm_scan_req_umac_tail);
 558         if (req_len > IWM_MAX_CMD_PAYLOAD_SIZE)
 559                 return ENOMEM;
 560         req = malloc(req_len, M_DEVBUF, M_NOWAIT | M_ZERO);
 561         if (req == NULL)
 562                 return ENOMEM;
 563
 564         hcmd.len[0] = (uint16_t)req_len;
 565         hcmd.data[0] = (void *)req;
 566
 567         IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Handling ieee80211 scan request\n");
 568
 569         /* These timings correspond to iwlwifi's UNASSOC scan. */
 570         req->active_dwell = 10;
 571         req->passive_dwell = 110;
 572         req->fragmented_dwell = 44;
 573         req->extended_dwell = 90;
 574         req->max_out_time = 0;
 575         req->suspend_time = 0;
 576
 577         req->scan_priority = htole32(IWM_SCAN_PRIORITY_HIGH);
 578         req->ooc_priority = htole32(IWM_SCAN_PRIORITY_HIGH);
 579
 580         req->n_channels = iwm_mvm_umac_scan_fill_channels(sc,
 581             (struct iwm_scan_channel_cfg_umac *)req->data, ssid_len != 0);
 582
 583         req->general_flags = htole32(IWM_UMAC_SCAN_GEN_FLAGS_PASS_ALL |
 584             IWM_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE |
 585             IWM_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL);
 586
 587         tail = (void *)((char *)&req->data +
 588                 sizeof(struct iwm_scan_channel_cfg_umac) *
 589                         sc->sc_capa_n_scan_channels);
 590
 591         /* Check if we're doing an active directed scan. */
 592         if (ssid_len != 0) {
 593                 tail->direct_scan[0].id = IEEE80211_ELEMID_SSID;
 594                 tail->direct_scan[0].len = ssid_len;
 595                 memcpy(tail->direct_scan[0].ssid, ssid, ssid_len);
 596                 req->general_flags |=
 597                     htole32(IWM_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT);
 598         } else {
 599                 req->general_flags |= htole32(IWM_UMAC_SCAN_GEN_FLAGS_PASSIVE);
 600         }
 601
 602         if (isset(sc->sc_enabled_capa,
 603             IWM_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
 604                 req->general_flags |=
 605                     htole32(IWM_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED);
 606
 607         ret = iwm_mvm_fill_probe_req(sc, &tail->preq);
 608         if (ret) {
 609                 free(req, M_DEVBUF);
 610                 return ret;
 611         }
 612
 613         /* Specify the scan plan: We'll do one iteration. */
 614         tail->schedule[0].interval = 0;
 615         tail->schedule[0].iter_count = 1;
 616
 617         ret = iwm_send_cmd(sc, &hcmd);
 618         if (!ret)
 619                 IWM_DPRINTF(sc, IWM_DEBUG_SCAN,
 620                     "Scan request was sent successfully\n");
 621         free(req, M_DEVBUF);
 622         return ret;
 623 }
 624
 625 int
 626 iwm_mvm_lmac_scan(struct iwm_softc *sc)
 627 {
 628         struct iwm_host_cmd hcmd = {
 629                 .id = IWM_SCAN_OFFLOAD_REQUEST_CMD,
 630                 .len = { 0, },
 631                 .data = { NULL, },
 632                 .flags = IWM_CMD_SYNC,
 633         };
 634         struct iwm_scan_req_lmac *req;
 635         size_t req_len;
 636         int ret;
 637         int ssid_len = 0;
 638         const uint8_t *ssid = NULL;
 639
 640         IWM_DPRINTF(sc, IWM_DEBUG_SCAN,
 641             "Handling ieee80211 scan request\n");
 642
 643         req_len = sizeof(struct iwm_scan_req_lmac) +
 644             (sizeof(struct iwm_scan_channel_cfg_lmac) *
 645             sc->sc_capa_n_scan_channels) + sizeof(struct iwm_scan_probe_req);
 646         if (req_len > IWM_MAX_CMD_PAYLOAD_SIZE)
 647                 return ENOMEM;
 648         req = malloc(req_len, M_DEVBUF, M_NOWAIT | M_ZERO);
 649         if (req == NULL)
 650                 return ENOMEM;
 651
 652         hcmd.len[0] = (uint16_t)req_len;
 653         hcmd.data[0] = (void *)req;
 654
 655         /* These timings correspond to iwlwifi's UNASSOC scan. */
 656         req->active_dwell = 10;
 657         req->passive_dwell = 110;
 658         req->fragmented_dwell = 44;
 659         req->extended_dwell = 90;
 660         req->max_out_time = 0;
 661         req->suspend_time = 0;
 662
 663         req->scan_prio = htole32(IWM_SCAN_PRIORITY_HIGH);
 664         req->rx_chain_select = iwm_mvm_scan_rx_chain(sc);
 665         req->iter_num = htole32(1);
 666         req->delay = 0;
 667
 668         req->scan_flags = htole32(IWM_MVM_LMAC_SCAN_FLAG_PASS_ALL |
 669             IWM_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE |
 670             IWM_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL);
 671         if (ssid_len == 0)
 672                 req->scan_flags |= htole32(IWM_MVM_LMAC_SCAN_FLAG_PASSIVE);
 673         else
 674                 req->scan_flags |=
 675                     htole32(IWM_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION);
 676         if (isset(sc->sc_enabled_capa,
 677             IWM_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
 678                 req->scan_flags |= htole32(IWM_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED);
 679
 680         req->flags = htole32(IWM_PHY_BAND_24);
 681         if (sc->sc_nvm.sku_cap_band_52GHz_enable)
 682                 req->flags |= htole32(IWM_PHY_BAND_5);
 683         req->filter_flags =
 684             htole32(IWM_MAC_FILTER_ACCEPT_GRP | IWM_MAC_FILTER_IN_BEACON);
 685
 686         /* Tx flags 2 GHz. */
 687         req->tx_cmd[0].tx_flags = htole32(IWM_TX_CMD_FLG_SEQ_CTL |
 688             IWM_TX_CMD_FLG_BT_DIS);
 689         req->tx_cmd[0].rate_n_flags =
 690             iwm_mvm_scan_rate_n_flags(sc, IEEE80211_CHAN_2GHZ, 1/*XXX*/);
 691         req->tx_cmd[0].sta_id = sc->sc_aux_sta.sta_id;
 692
 693         /* Tx flags 5 GHz. */
 694         req->tx_cmd[1].tx_flags = htole32(IWM_TX_CMD_FLG_SEQ_CTL |
 695             IWM_TX_CMD_FLG_BT_DIS);
 696         req->tx_cmd[1].rate_n_flags =
 697             iwm_mvm_scan_rate_n_flags(sc, IEEE80211_CHAN_5GHZ, 1/*XXX*/);
 698         req->tx_cmd[1].sta_id = sc->sc_aux_sta.sta_id;
 699
 700         /* Check if we're doing an active directed scan. */
 701         if (ssid_len != 0) {
 702                 req->direct_scan[0].id = IEEE80211_ELEMID_SSID;
 703                 req->direct_scan[0].len = ssid_len;
 704                 memcpy(req->direct_scan[0].ssid, ssid, ssid_len);
 705         }
 706
 707         req->n_channels = iwm_mvm_lmac_scan_fill_channels(sc,
 708             (struct iwm_scan_channel_cfg_lmac *)req->data,
 709             ssid_len != 0);
 710
 711         ret = iwm_mvm_fill_probe_req(sc,
 712                             (struct iwm_scan_probe_req *)(req->data +
 713                             (sizeof(struct iwm_scan_channel_cfg_lmac) *
 714                             sc->sc_capa_n_scan_channels)));
 715         if (ret) {
 716                 free(req, M_DEVBUF);
 717                 return ret;
 718         }
 719
 720         /* Specify the scan plan: We'll do one iteration. */
 721         req->schedule[0].iterations = 1;
 722         req->schedule[0].full_scan_mul = 1;
 723
 724         /* Disable EBS. */
 725         req->channel_opt[0].non_ebs_ratio = 1;
 726         req->channel_opt[1].non_ebs_ratio = 1;
 727
 728         ret = iwm_send_cmd(sc, &hcmd);
 729         if (!ret) {
 730                 IWM_DPRINTF(sc, IWM_DEBUG_SCAN,
 731                     "Scan request was sent successfully\n");
 732         }
 733         free(req, M_DEVBUF);
 734         return ret;
 735 }