SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/iwlwifi/iwl-scan.c

   1 /******************************************************************************
   2  *
   3  * GPL LICENSE SUMMARY
   4  *
   5  * Copyright(c) 2008 Intel Corporation. All rights reserved.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of version 2 of the GNU General Public License as
   9  * published by the Free Software Foundation.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  19  * USA
  20  *
  21  * The full GNU General Public License is included in this distribution
  22  * in the file called LICENSE.GPL.
  23  *
  24  * Contact Information:
  25  * Tomas Winkler <tomas.winkler@intel.com>
  26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  27  *****************************************************************************/
  28 #include <net/mac80211.h>
  29 #include <linux/etherdevice.h>
  30
  31 #include "iwl-eeprom.h"
  32 #include "iwl-dev.h"
  33 #include "iwl-core.h"
  34 #include "iwl-sta.h"
  35 #include "iwl-io.h"
  36 #include "iwl-helpers.h"
  37
  38 /* For active scan, listen ACTIVE_DWELL_TIME (msec) on each channel after
  39  * sending probe req.  This should be set long enough to hear probe responses
  40  * from more than one AP.  */
  41 #define IWL_ACTIVE_DWELL_TIME_24    (20)       /* all times in msec */
  42 #define IWL_ACTIVE_DWELL_TIME_52    (10)
  43
  44 /* For faster active scanning, scan will move to the next channel if fewer than
  45  * PLCP_QUIET_THRESH packets are heard on this channel within
  46  * ACTIVE_QUIET_TIME after sending probe request.  This shortens the dwell
  47  * time if it's a quiet channel (nothing responded to our probe, and there's
  48  * no other traffic).
  49  * Disable "quiet" feature by setting PLCP_QUIET_THRESH to 0. */
  50 #define IWL_PLCP_QUIET_THRESH       __constant_cpu_to_le16(1)  /* packets */
  51 #define IWL_ACTIVE_QUIET_TIME       __constant_cpu_to_le16(5)  /* msec */
  52
  53 /* For passive scan, listen PASSIVE_DWELL_TIME (msec) on each channel.
  54  * Must be set longer than active dwell time.
  55  * For the most reliable scan, set > AP beacon interval (typically 100msec). */
  56 #define IWL_PASSIVE_DWELL_TIME_24   (20)       /* all times in msec */
  57 #define IWL_PASSIVE_DWELL_TIME_52   (10)
  58 #define IWL_PASSIVE_DWELL_BASE      (100)
  59 #define IWL_CHANNEL_TUNE_TIME       5
  60
  61 static int scan_tx_ant[3] = {
  62         RATE_MCS_ANT_A_MSK, RATE_MCS_ANT_B_MSK, RATE_MCS_ANT_C_MSK
  63 };
  64
  65 static int iwl_is_empty_essid(const char *essid, int essid_len)
  66 {
  67         /* Single white space is for Linksys APs */
  68         if (essid_len == 1 && essid[0] == ' ')
  69                 return 1;
  70
  71         /* Otherwise, if the entire essid is 0, we assume it is hidden */
  72         while (essid_len) {
  73                 essid_len--;
  74                 if (essid[essid_len] != '\0')
  75                         return 0;
  76         }
  77
  78         return 1;
  79 }
  80
  81
  82
  83 const char *iwl_escape_essid(const char *essid, u8 essid_len)
  84 {
  85         static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
  86         const char *s = essid;
  87         char *d = escaped;
  88
  89         if (iwl_is_empty_essid(essid, essid_len)) {
  90                 memcpy(escaped, "<hidden>", sizeof("<hidden>"));
  91                 return escaped;
  92         }
  93
  94         essid_len = min(essid_len, (u8) IW_ESSID_MAX_SIZE);
  95         while (essid_len--) {
  96                 if (*s == '\0') {
  97                         *d++ = '\\';
  98                         *d++ = '0';
  99                         s++;
 100                 } else
 101                         *d++ = *s++;
 102         }
 103         *d = '\0';
 104         return escaped;
 105 }
 106 EXPORT_SYMBOL(iwl_escape_essid);
 107
 108 /**
 109  * iwl_scan_cancel - Cancel any currently executing HW scan
 110  *
 111  * NOTE: priv->mutex is not required before calling this function
 112  */
 113 int iwl_scan_cancel(struct iwl_priv *priv)
 114 {
 115         if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
 116                 clear_bit(STATUS_SCANNING, &priv->status);
 117                 return 0;
 118         }
 119
 120         if (test_bit(STATUS_SCANNING, &priv->status)) {
 121                 if (!test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 122                         IWL_DEBUG_SCAN("Queuing scan abort.\n");
 123                         set_bit(STATUS_SCAN_ABORTING, &priv->status);
 124                         queue_work(priv->workqueue, &priv->abort_scan);
 125
 126                 } else
 127                         IWL_DEBUG_SCAN("Scan abort already in progress.\n");
 128
 129                 return test_bit(STATUS_SCANNING, &priv->status);
 130         }
 131
 132         return 0;
 133 }
 134 EXPORT_SYMBOL(iwl_scan_cancel);
 135 /**
 136  * iwl_scan_cancel_timeout - Cancel any currently executing HW scan
 137  * @ms: amount of time to wait (in milliseconds) for scan to abort
 138  *
 139  * NOTE: priv->mutex must be held before calling this function
 140  */
 141 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms)
 142 {
 143         unsigned long now = jiffies;
 144         int ret;
 145
 146         ret = iwl_scan_cancel(priv);
 147         if (ret && ms) {
 148                 mutex_unlock(&priv->mutex);
 149                 while (!time_after(jiffies, now + msecs_to_jiffies(ms)) &&
 150                                 test_bit(STATUS_SCANNING, &priv->status))
 151                         msleep(1);
 152                 mutex_lock(&priv->mutex);
 153
 154                 return test_bit(STATUS_SCANNING, &priv->status);
 155         }
 156
 157         return ret;
 158 }
 159 EXPORT_SYMBOL(iwl_scan_cancel_timeout);
 160
 161 static int iwl_send_scan_abort(struct iwl_priv *priv)
 162 {
 163         int ret = 0;
 164         struct iwl_rx_packet *res;
 165         struct iwl_host_cmd cmd = {
 166                 .id = REPLY_SCAN_ABORT_CMD,
 167                 .meta.flags = CMD_WANT_SKB,
 168         };
 169
 170         /* If there isn't a scan actively going on in the hardware
 171          * then we are in between scan bands and not actually
 172          * actively scanning, so don't send the abort command */
 173         if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
 174                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 175                 return 0;
 176         }
 177
 178         ret = iwl_send_cmd_sync(priv, &cmd);
 179         if (ret) {
 180                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 181                 return ret;
 182         }
 183
 184         res = (struct iwl_rx_packet *)cmd.meta.u.skb->data;
 185         if (res->u.status != CAN_ABORT_STATUS) {
 186                 /* The scan abort will return 1 for success or
 187                  * 2 for "failure".  A failure condition can be
 188                  * due to simply not being in an active scan which
 189                  * can occur if we send the scan abort before we
 190                  * the microcode has notified us that a scan is
 191                  * completed. */
 192                 IWL_DEBUG_INFO("SCAN_ABORT returned %d.\n", res->u.status);
 193                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 194                 clear_bit(STATUS_SCAN_HW, &priv->status);
 195         }
 196
 197         dev_kfree_skb_any(cmd.meta.u.skb);
 198
 199         return ret;
 200 }
 201
 202
 203 /* Service response to REPLY_SCAN_CMD (0x80) */
 204 static void iwl_rx_reply_scan(struct iwl_priv *priv,
 205                               struct iwl_rx_mem_buffer *rxb)
 206 {
 207 #ifdef CONFIG_IWLWIFI_DEBUG
 208         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 209         struct iwl_scanreq_notification *notif =
 210             (struct iwl_scanreq_notification *)pkt->u.raw;
 211
 212         IWL_DEBUG_RX("Scan request status = 0x%x\n", notif->status);
 213 #endif
 214 }
 215
 216 /* Service SCAN_START_NOTIFICATION (0x82) */
 217 static void iwl_rx_scan_start_notif(struct iwl_priv *priv,
 218                                     struct iwl_rx_mem_buffer *rxb)
 219 {
 220         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 221         struct iwl_scanstart_notification *notif =
 222             (struct iwl_scanstart_notification *)pkt->u.raw;
 223         priv->scan_start_tsf = le32_to_cpu(notif->tsf_low);
 224         IWL_DEBUG_SCAN("Scan start: "
 225                        "%d [802.11%s] "
 226                        "(TSF: 0x%08X:%08X) - %d (beacon timer %u)\n",
 227                        notif->channel,
 228                        notif->band ? "bg" : "a",
 229                        notif->tsf_high,
 230                        notif->tsf_low, notif->status, notif->beacon_timer);
 231 }
 232
 233 /* Service SCAN_RESULTS_NOTIFICATION (0x83) */
 234 static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
 235                                       struct iwl_rx_mem_buffer *rxb)
 236 {
 237 #ifdef CONFIG_IWLWIFI_DEBUG
 238         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 239         struct iwl_scanresults_notification *notif =
 240             (struct iwl_scanresults_notification *)pkt->u.raw;
 241
 242         IWL_DEBUG_SCAN("Scan ch.res: "
 243                        "%d [802.11%s] "
 244                        "(TSF: 0x%08X:%08X) - %d "
 245                        "elapsed=%lu usec (%dms since last)\n",
 246                        notif->channel,
 247                        notif->band ? "bg" : "a",
 248                        le32_to_cpu(notif->tsf_high),
 249                        le32_to_cpu(notif->tsf_low),
 250                        le32_to_cpu(notif->statistics[0]),
 251                        le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf,
 252                        jiffies_to_msecs(elapsed_jiffies
 253                                         (priv->last_scan_jiffies, jiffies)));
 254 #endif
 255
 256         priv->last_scan_jiffies = jiffies;
 257         priv->next_scan_jiffies = 0;
 258 }
 259
 260 /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
 261 static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
 262                                        struct iwl_rx_mem_buffer *rxb)
 263 {
 264         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
 265         struct iwl_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
 266
 267         IWL_DEBUG_SCAN("Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
 268                        scan_notif->scanned_channels,
 269                        scan_notif->tsf_low,
 270                        scan_notif->tsf_high, scan_notif->status);
 271
 272         /* The HW is no longer scanning */
 273         clear_bit(STATUS_SCAN_HW, &priv->status);
 274
 275         /* The scan completion notification came in, so kill that timer... */
 276         cancel_delayed_work(&priv->scan_check);
 277
 278         IWL_DEBUG_INFO("Scan pass on %sGHz took %dms\n",
 279                        (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
 280                                                 "2.4" : "5.2",
 281                        jiffies_to_msecs(elapsed_jiffies
 282                                         (priv->scan_pass_start, jiffies)));
 283
 284         /* Remove this scanned band from the list of pending
 285          * bands to scan, band G precedes A in order of scanning
 286          * as seen in iwl_bg_request_scan */
 287         if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
 288                 priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
 289         else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
 290                 priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
 291
 292         /* If a request to abort was given, or the scan did not succeed
 293          * then we reset the scan state machine and terminate,
 294          * re-queuing another scan if one has been requested */
 295         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 296                 IWL_DEBUG_INFO("Aborted scan completed.\n");
 297                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
 298         } else {
 299                 /* If there are more bands on this scan pass reschedule */
 300                 if (priv->scan_bands)
 301                         goto reschedule;
 302         }
 303
 304         priv->last_scan_jiffies = jiffies;
 305         priv->next_scan_jiffies = 0;
 306         IWL_DEBUG_INFO("Setting scan to off\n");
 307
 308         clear_bit(STATUS_SCANNING, &priv->status);
 309
 310         IWL_DEBUG_INFO("Scan took %dms\n",
 311                 jiffies_to_msecs(elapsed_jiffies(priv->scan_start, jiffies)));
 312
 313         queue_work(priv->workqueue, &priv->scan_completed);
 314
 315         return;
 316
 317 reschedule:
 318         priv->scan_pass_start = jiffies;
 319         queue_work(priv->workqueue, &priv->request_scan);
 320 }
 321
 322 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv)
 323 {
 324         /* scan handlers */
 325         priv->rx_handlers[REPLY_SCAN_CMD] = iwl_rx_reply_scan;
 326         priv->rx_handlers[SCAN_START_NOTIFICATION] = iwl_rx_scan_start_notif;
 327         priv->rx_handlers[SCAN_RESULTS_NOTIFICATION] =
 328                                         iwl_rx_scan_results_notif;
 329         priv->rx_handlers[SCAN_COMPLETE_NOTIFICATION] =
 330                                         iwl_rx_scan_complete_notif;
 331 }
 332 EXPORT_SYMBOL(iwl_setup_rx_scan_handlers);
 333
 334 static inline u16 iwl_get_active_dwell_time(struct iwl_priv *priv,
 335                                                 enum ieee80211_band band)
 336 {
 337         if (band == IEEE80211_BAND_5GHZ)
 338                 return IWL_ACTIVE_DWELL_TIME_52;
 339         else
 340                 return IWL_ACTIVE_DWELL_TIME_24;
 341 }
 342
 343 static u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
 344                                           enum ieee80211_band band)
 345 {
 346         u16 active = iwl_get_active_dwell_time(priv, band);
 347         u16 passive = (band != IEEE80211_BAND_5GHZ) ?
 348             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_24 :
 349             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_52;
 350
 351         if (iwl_is_associated(priv)) {
 352                 /* If we're associated, we clamp the maximum passive
 353                  * dwell time to be 98% of the beacon interval (minus
 354                  * 2 * channel tune time) */
 355                 passive = priv->beacon_int;
 356                 if ((passive > IWL_PASSIVE_DWELL_BASE) || !passive)
 357                         passive = IWL_PASSIVE_DWELL_BASE;
 358                 passive = (passive * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
 359         }
 360
 361         if (passive <= active)
 362                 passive = active + 1;
 363
 364         return passive;
 365 }
 366
 367 static int iwl_get_channels_for_scan(struct iwl_priv *priv,
 368                                      enum ieee80211_band band,
 369                                      u8 is_active, u8 direct_mask,
 370                                      struct iwl_scan_channel *scan_ch)
 371 {
 372         const struct ieee80211_channel *channels = NULL;
 373         const struct ieee80211_supported_band *sband;
 374         const struct iwl_channel_info *ch_info;
 375         u16 passive_dwell = 0;
 376         u16 active_dwell = 0;
 377         int added, i;
 378
 379         sband = iwl_get_hw_mode(priv, band);
 380         if (!sband)
 381                 return 0;
 382
 383         channels = sband->channels;
 384
 385         active_dwell = iwl_get_active_dwell_time(priv, band);
 386         passive_dwell = iwl_get_passive_dwell_time(priv, band);
 387
 388         for (i = 0, added = 0; i < sband->n_channels; i++) {
 389                 if (channels[i].flags & IEEE80211_CHAN_DISABLED)
 390                         continue;
 391
 392                 scan_ch->channel =
 393                         ieee80211_frequency_to_channel(channels[i].center_freq);
 394
 395                 ch_info = iwl_get_channel_info(priv, band, scan_ch->channel);
 396                 if (!is_channel_valid(ch_info)) {
 397                         IWL_DEBUG_SCAN("Channel %d is INVALID for this band.\n",
 398                                        scan_ch->channel);
 399                         continue;
 400                 }
 401
 402                 if (!is_active || is_channel_passive(ch_info) ||
 403                     (channels[i].flags & IEEE80211_CHAN_PASSIVE_SCAN))
 404                         scan_ch->type = 0;
 405                 else
 406                         scan_ch->type = 1;
 407
 408                 if (scan_ch->type & 1)
 409                         scan_ch->type |= (direct_mask << 1);
 410
 411                 scan_ch->active_dwell = cpu_to_le16(active_dwell);
 412                 scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
 413
 414                 /* Set txpower levels to defaults */
 415                 scan_ch->dsp_atten = 110;
 416
 417                 if (band == IEEE80211_BAND_5GHZ)
 418                         scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
 419                 else {
 420                         scan_ch->tx_gain = ((1 << 5) | (5 << 3));
 421                         /* NOTE: if we were doing 6Mb OFDM for scans we'd use
 422                          * power level:
 423                          * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
 424                          */
 425                 }
 426
 427                 IWL_DEBUG_SCAN("Scanning %d [%s %d]\n",
 428                                scan_ch->channel,
 429                                (scan_ch->type & 1) ? "ACTIVE" : "PASSIVE",
 430                                (scan_ch->type & 1) ?
 431                                active_dwell : passive_dwell);
 432
 433                 scan_ch++;
 434                 added++;
 435         }
 436
 437         IWL_DEBUG_SCAN("total channels to scan %d \n", added);
 438         return added;
 439 }
 440
 441 void iwl_init_scan_params(struct iwl_priv *priv)
 442 {
 443         if (!priv->scan_tx_ant[IEEE80211_BAND_5GHZ])
 444                 priv->scan_tx_ant[IEEE80211_BAND_5GHZ] = RATE_MCS_ANT_INIT_IND;
 445         if (!priv->scan_tx_ant[IEEE80211_BAND_2GHZ])
 446                 priv->scan_tx_ant[IEEE80211_BAND_2GHZ] = RATE_MCS_ANT_INIT_IND;
 447 }
 448
 449 int iwl_scan_initiate(struct iwl_priv *priv)
 450 {
 451         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
 452                 IWL_ERROR("APs don't scan.\n");
 453                 return 0;
 454         }
 455
 456         if (!iwl_is_ready_rf(priv)) {
 457                 IWL_DEBUG_SCAN("Aborting scan due to not ready.\n");
 458                 return -EIO;
 459         }
 460
 461         if (test_bit(STATUS_SCANNING, &priv->status)) {
 462                 IWL_DEBUG_SCAN("Scan already in progress.\n");
 463                 return -EAGAIN;
 464         }
 465
 466         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 467                 IWL_DEBUG_SCAN("Scan request while abort pending.  "
 468                                "Queuing.\n");
 469                 return -EAGAIN;
 470         }
 471
 472         IWL_DEBUG_INFO("Starting scan...\n");
 473         if (priv->cfg->sku & IWL_SKU_G)
 474                 priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
 475         if (priv->cfg->sku & IWL_SKU_A)
 476                 priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
 477         set_bit(STATUS_SCANNING, &priv->status);
 478         priv->scan_start = jiffies;
 479         priv->scan_pass_start = priv->scan_start;
 480
 481         queue_work(priv->workqueue, &priv->request_scan);
 482
 483         return 0;
 484 }
 485 EXPORT_SYMBOL(iwl_scan_initiate);
 486
 487 #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
 488
 489 static void iwl_bg_scan_check(struct work_struct *data)
 490 {
 491         struct iwl_priv *priv =
 492             container_of(data, struct iwl_priv, scan_check.work);
 493
 494         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
 495                 return;
 496
 497         mutex_lock(&priv->mutex);
 498         if (test_bit(STATUS_SCANNING, &priv->status) ||
 499             test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 500                 IWL_DEBUG(IWL_DL_SCAN, "Scan completion watchdog resetting "
 501                         "adapter (%dms)\n",
 502                         jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
 503
 504                 if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
 505                         iwl_send_scan_abort(priv);
 506         }
 507         mutex_unlock(&priv->mutex);
 508 }
 509 /**
 510  * iwl_supported_rate_to_ie - fill in the supported rate in IE field
 511  *
 512  * return : set the bit for each supported rate insert in ie
 513  */
 514 static u16 iwl_supported_rate_to_ie(u8 *ie, u16 supported_rate,
 515                                     u16 basic_rate, int *left)
 516 {
 517         u16 ret_rates = 0, bit;
 518         int i;
 519         u8 *cnt = ie;
 520         u8 *rates = ie + 1;
 521
 522         for (bit = 1, i = 0; i < IWL_RATE_COUNT; i++, bit <<= 1) {
 523                 if (bit & supported_rate) {
 524                         ret_rates |= bit;
 525                         rates[*cnt] = iwl_rates[i].ieee |
 526                                 ((bit & basic_rate) ? 0x80 : 0x00);
 527                         (*cnt)++;
 528                         (*left)--;
 529                         if ((*left <= 0) ||
 530                             (*cnt >= IWL_SUPPORTED_RATES_IE_LEN))
 531                                 break;
 532                 }
 533         }
 534
 535         return ret_rates;
 536 }
 537
 538
 539 static void iwl_ht_cap_to_ie(const struct ieee80211_supported_band *sband,
 540                              u8 *pos, int *left)
 541 {
 542         struct ieee80211_ht_cap *ht_cap;
 543
 544         if (!sband || !sband->ht_info.ht_supported)
 545                 return;
 546
 547         if (*left < sizeof(struct ieee80211_ht_cap))
 548                 return;
 549
 550         *pos++ = sizeof(struct ieee80211_ht_cap);
 551         ht_cap = (struct ieee80211_ht_cap *) pos;
 552
 553         ht_cap->cap_info = cpu_to_le16(sband->ht_info.cap);
 554         memcpy(ht_cap->supp_mcs_set, sband->ht_info.supp_mcs_set, 16);
 555         ht_cap->ampdu_params_info =
 556                 (sband->ht_info.ampdu_factor & IEEE80211_HT_CAP_AMPDU_FACTOR) |
 557                 ((sband->ht_info.ampdu_density << 2) &
 558                         IEEE80211_HT_CAP_AMPDU_DENSITY);
 559         *left -= sizeof(struct ieee80211_ht_cap);
 560 }
 561
 562 /**
 563  * iwl_fill_probe_req - fill in all required fields and IE for probe request
 564  */
 565
 566 static u16 iwl_fill_probe_req(struct iwl_priv *priv,
 567                                   enum ieee80211_band band,
 568                                   struct ieee80211_mgmt *frame,
 569                                   int left)
 570 {
 571         int len = 0;
 572         u8 *pos = NULL;
 573         u16 active_rates, ret_rates, cck_rates, active_rate_basic;
 574         const struct ieee80211_supported_band *sband =
 575                                                 iwl_get_hw_mode(priv, band);
 576
 577
 578         /* Make sure there is enough space for the probe request,
 579          * two mandatory IEs and the data */
 580         left -= 24;
 581         if (left < 0)
 582                 return 0;
 583
 584         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
 585         memcpy(frame->da, iwl_bcast_addr, ETH_ALEN);
 586         memcpy(frame->sa, priv->mac_addr, ETH_ALEN);
 587         memcpy(frame->bssid, iwl_bcast_addr, ETH_ALEN);
 588         frame->seq_ctrl = 0;
 589
 590         len += 24;
 591
 592         /* ...next IE... */
 593         pos = &frame->u.probe_req.variable[0];
 594
 595         /* fill in our indirect SSID IE */
 596         left -= 2;
 597         if (left < 0)
 598                 return 0;
 599         *pos++ = WLAN_EID_SSID;
 600         *pos++ = 0;
 601
 602         len += 2;
 603
 604         /* fill in supported rate */
 605         left -= 2;
 606         if (left < 0)
 607                 return 0;
 608
 609         *pos++ = WLAN_EID_SUPP_RATES;
 610         *pos = 0;
 611
 612         /* exclude 60M rate */
 613         active_rates = priv->rates_mask;
 614         active_rates &= ~IWL_RATE_60M_MASK;
 615
 616         active_rate_basic = active_rates & IWL_BASIC_RATES_MASK;
 617
 618         cck_rates = IWL_CCK_RATES_MASK & active_rates;
 619         ret_rates = iwl_supported_rate_to_ie(pos, cck_rates,
 620                                              active_rate_basic, &left);
 621         active_rates &= ~ret_rates;
 622
 623         ret_rates = iwl_supported_rate_to_ie(pos, active_rates,
 624                                              active_rate_basic, &left);
 625         active_rates &= ~ret_rates;
 626
 627         len += 2 + *pos;
 628         pos += (*pos) + 1;
 629
 630         if (active_rates == 0)
 631                 goto fill_end;
 632
 633         /* fill in supported extended rate */
 634         /* ...next IE... */
 635         left -= 2;
 636         if (left < 0)
 637                 return 0;
 638         /* ... fill it in... */
 639         *pos++ = WLAN_EID_EXT_SUPP_RATES;
 640         *pos = 0;
 641         iwl_supported_rate_to_ie(pos, active_rates, active_rate_basic, &left);
 642         if (*pos > 0) {
 643                 len += 2 + *pos;
 644                 pos += (*pos) + 1;
 645         } else {
 646                 pos--;
 647         }
 648
 649  fill_end:
 650
 651         left -= 2;
 652         if (left < 0)
 653                 return 0;
 654
 655         *pos++ = WLAN_EID_HT_CAPABILITY;
 656         *pos = 0;
 657         iwl_ht_cap_to_ie(sband, pos, &left);
 658         if (*pos > 0)
 659                 len += 2 + *pos;
 660
 661         return (u16)len;
 662 }
 663
 664 static u32 iwl_scan_tx_ant(struct iwl_priv *priv, enum ieee80211_band band)
 665 {
 666         int i, ind;
 667
 668         ind = priv->scan_tx_ant[band];
 669         for (i = 0; i < priv->hw_params.tx_chains_num; i++) {
 670                 ind = (ind+1) >= priv->hw_params.tx_chains_num ? 0 : ind+1;
 671                 if (priv->hw_params.valid_tx_ant & (1 << ind)) {
 672                         priv->scan_tx_ant[band] = ind;
 673                         break;
 674                 }
 675         }
 676
 677         return scan_tx_ant[ind];
 678 }
 679
 680
 681 static void iwl_bg_request_scan(struct work_struct *data)
 682 {
 683         struct iwl_priv *priv =
 684             container_of(data, struct iwl_priv, request_scan);
 685         struct iwl_host_cmd cmd = {
 686                 .id = REPLY_SCAN_CMD,
 687                 .len = sizeof(struct iwl_scan_cmd),
 688                 .meta.flags = CMD_SIZE_HUGE,
 689         };
 690         struct iwl_scan_cmd *scan;
 691         struct ieee80211_conf *conf = NULL;
 692         int ret = 0;
 693         u32 tx_ant;
 694         u16 cmd_len;
 695         enum ieee80211_band band;
 696         u8 direct_mask;
 697         u8 rx_chain = 0x7; /* bitmap: ABC chains */
 698
 699         conf = ieee80211_get_hw_conf(priv->hw);
 700
 701         mutex_lock(&priv->mutex);
 702
 703         if (!iwl_is_ready(priv)) {
 704                 IWL_WARNING("request scan called when driver not ready.\n");
 705                 goto done;
 706         }
 707
 708         /* Make sure the scan wasn't cancelled before this queued work
 709          * was given the chance to run... */
 710         if (!test_bit(STATUS_SCANNING, &priv->status))
 711                 goto done;
 712
 713         /* This should never be called or scheduled if there is currently
 714          * a scan active in the hardware. */
 715         if (test_bit(STATUS_SCAN_HW, &priv->status)) {
 716                 IWL_DEBUG_INFO("Multiple concurrent scan requests in parallel. "
 717                                "Ignoring second request.\n");
 718                 ret = -EIO;
 719                 goto done;
 720         }
 721
 722         if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
 723                 IWL_DEBUG_SCAN("Aborting scan due to device shutdown\n");
 724                 goto done;
 725         }
 726
 727         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
 728                 IWL_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
 729                 goto done;
 730         }
 731
 732         if (iwl_is_rfkill(priv)) {
 733                 IWL_DEBUG_HC("Aborting scan due to RF Kill activation\n");
 734                 goto done;
 735         }
 736
 737         if (!test_bit(STATUS_READY, &priv->status)) {
 738                 IWL_DEBUG_HC("Scan request while uninitialized.  Queuing.\n");
 739                 goto done;
 740         }
 741
 742         if (!priv->scan_bands) {
 743                 IWL_DEBUG_HC("Aborting scan due to no requested bands\n");
 744                 goto done;
 745         }
 746
 747         if (!priv->scan) {
 748                 priv->scan = kmalloc(sizeof(struct iwl_scan_cmd) +
 749                                      IWL_MAX_SCAN_SIZE, GFP_KERNEL);
 750                 if (!priv->scan) {
 751                         ret = -ENOMEM;
 752                         goto done;
 753                 }
 754         }
 755         scan = priv->scan;
 756         memset(scan, 0, sizeof(struct iwl_scan_cmd) + IWL_MAX_SCAN_SIZE);
 757
 758         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
 759         scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
 760
 761         if (iwl_is_associated(priv)) {
 762                 u16 interval = 0;
 763                 u32 extra;
 764                 u32 suspend_time = 100;
 765                 u32 scan_suspend_time = 100;
 766                 unsigned long flags;
 767
 768                 IWL_DEBUG_INFO("Scanning while associated...\n");
 769
 770                 spin_lock_irqsave(&priv->lock, flags);
 771                 interval = priv->beacon_int;
 772                 spin_unlock_irqrestore(&priv->lock, flags);
 773
 774                 scan->suspend_time = 0;
 775                 scan->max_out_time = cpu_to_le32(200 * 1024);
 776                 if (!interval)
 777                         interval = suspend_time;
 778
 779                 extra = (suspend_time / interval) << 22;
 780                 scan_suspend_time = (extra |
 781                     ((suspend_time % interval) * 1024));
 782                 scan->suspend_time = cpu_to_le32(scan_suspend_time);
 783                 IWL_DEBUG_SCAN("suspend_time 0x%X beacon interval %d\n",
 784                                scan_suspend_time, interval);
 785         }
 786
 787         /* We should add the ability for user to lock to PASSIVE ONLY */
 788         if (priv->one_direct_scan) {
 789                 IWL_DEBUG_SCAN("Start direct scan for '%s'\n",
 790                                 iwl_escape_essid(priv->direct_ssid,
 791                                 priv->direct_ssid_len));
 792                 scan->direct_scan[0].id = WLAN_EID_SSID;
 793                 scan->direct_scan[0].len = priv->direct_ssid_len;
 794                 memcpy(scan->direct_scan[0].ssid,
 795                        priv->direct_ssid, priv->direct_ssid_len);
 796                 direct_mask = 1;
 797         } else if (!iwl_is_associated(priv) && priv->essid_len) {
 798                 IWL_DEBUG_SCAN("Start direct scan for '%s' (not associated)\n",
 799                                 iwl_escape_essid(priv->essid, priv->essid_len));
 800                 scan->direct_scan[0].id = WLAN_EID_SSID;
 801                 scan->direct_scan[0].len = priv->essid_len;
 802                 memcpy(scan->direct_scan[0].ssid, priv->essid, priv->essid_len);
 803                 direct_mask = 1;
 804         } else {
 805                 IWL_DEBUG_SCAN("Start indirect scan.\n");
 806                 direct_mask = 0;
 807         }
 808
 809         scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
 810         scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
 811         scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 812
 813
 814         if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
 815                 band = IEEE80211_BAND_2GHZ;
 816                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
 817                 tx_ant = iwl_scan_tx_ant(priv, band);
 818                 if (priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_PURE_40_MSK)
 819                         scan->tx_cmd.rate_n_flags =
 820                                 iwl_hw_set_rate_n_flags(IWL_RATE_6M_PLCP,
 821                                                         tx_ant);
 822                 else
 823                         scan->tx_cmd.rate_n_flags =
 824                                 iwl_hw_set_rate_n_flags(IWL_RATE_1M_PLCP,
 825                                                         tx_ant |
 826                                                         RATE_MCS_CCK_MSK);
 827                 scan->good_CRC_th = 0;
 828         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
 829                 band = IEEE80211_BAND_5GHZ;
 830                 tx_ant = iwl_scan_tx_ant(priv, band);
 831                 scan->tx_cmd.rate_n_flags =
 832                                 iwl_hw_set_rate_n_flags(IWL_RATE_6M_PLCP,
 833                                                         tx_ant);
 834                 scan->good_CRC_th = IWL_GOOD_CRC_TH;
 835
 836                 /* Force use of chains B and C (0x6) for scan Rx for 4965
 837                  * Avoid A (0x1) because of its off-channel reception on A-band.
 838                  * MIMO is not used here, but value is required */
 839                 if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
 840                         rx_chain = 0x6;
 841         } else {
 842                 IWL_WARNING("Invalid scan band count\n");
 843                 goto done;
 844         }
 845
 846         scan->rx_chain = RXON_RX_CHAIN_DRIVER_FORCE_MSK |
 847                                 cpu_to_le16((0x7 << RXON_RX_CHAIN_VALID_POS) |
 848                                 (rx_chain << RXON_RX_CHAIN_FORCE_SEL_POS) |
 849                                 (0x7 << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS));
 850
 851         cmd_len = iwl_fill_probe_req(priv, band,
 852                                      (struct ieee80211_mgmt *)scan->data,
 853                                      IWL_MAX_SCAN_SIZE - sizeof(*scan));
 854
 855         scan->tx_cmd.len = cpu_to_le16(cmd_len);
 856
 857         if (priv->iw_mode == IEEE80211_IF_TYPE_MNTR)
 858                 scan->filter_flags = RXON_FILTER_PROMISC_MSK;
 859
 860         scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
 861                                RXON_FILTER_BCON_AWARE_MSK);
 862
 863         if (direct_mask)
 864                 scan->channel_count =
 865                         iwl_get_channels_for_scan(priv, band, 1, /* active */
 866                                                   direct_mask,
 867                                 (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 868         else
 869                 scan->channel_count =
 870                         iwl_get_channels_for_scan(priv, band, 0, /* passive */
 871                                                   direct_mask,
 872                                 (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 873         if (scan->channel_count == 0) {
 874                 IWL_DEBUG_SCAN("channel count %d\n", scan->channel_count);
 875                 goto done;
 876         }
 877
 878         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
 879             scan->channel_count * sizeof(struct iwl_scan_channel);
 880         cmd.data = scan;
 881         scan->len = cpu_to_le16(cmd.len);
 882
 883         set_bit(STATUS_SCAN_HW, &priv->status);
 884         ret = iwl_send_cmd_sync(priv, &cmd);
 885         if (ret)
 886                 goto done;
 887
 888         queue_delayed_work(priv->workqueue, &priv->scan_check,
 889                            IWL_SCAN_CHECK_WATCHDOG);
 890
 891         mutex_unlock(&priv->mutex);
 892         return;
 893
 894  done:
 895         /* inform mac80211 scan aborted */
 896         queue_work(priv->workqueue, &priv->scan_completed);
 897         mutex_unlock(&priv->mutex);
 898 }
 899
 900 static void iwl_bg_abort_scan(struct work_struct *work)
 901 {
 902         struct iwl_priv *priv = container_of(work, struct iwl_priv, abort_scan);
 903
 904         if (!iwl_is_ready(priv))
 905                 return;
 906
 907         mutex_lock(&priv->mutex);
 908
 909         set_bit(STATUS_SCAN_ABORTING, &priv->status);
 910         iwl_send_scan_abort(priv);
 911
 912         mutex_unlock(&priv->mutex);
 913 }
 914
 915 void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 916 {
 917         /*  FIXME: move here when resolved PENDING
 918          *  INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed); */
 919         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
 920         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
 921         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 922 }
 923 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
 924