1 /* $OpenBSD: if_iwm.c,v 1.39 2015/03/23 00:35:19 jsg Exp $ */ 2 3 /* 4 * Copyright (c) 2014 genua mbh <info@genua.de> 5 * Copyright (c) 2014 Fixup Software Ltd. 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 /*- 21 * Based on BSD-licensed source modules in the Linux iwlwifi driver, 22 * which were used as the reference documentation for this implementation. 23 * 24 * Driver version we are currently based off of is 25 * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd) 26 * 27 *********************************************************************** 28 * 29 * This file is provided under a dual BSD/GPLv2 license. When using or 30 * redistributing this file, you may do so under either license. 31 * 32 * GPL LICENSE SUMMARY 33 * 34 * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved. 35 * 36 * This program is free software; you can redistribute it and/or modify 37 * it under the terms of version 2 of the GNU General Public License as 38 * published by the Free Software Foundation. 39 * 40 * This program is distributed in the hope that it will be useful, but 41 * WITHOUT ANY WARRANTY; without even the implied warranty of 42 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 43 * General Public License for more details. 44 * 45 * You should have received a copy of the GNU General Public License 46 * along with this program; if not, write to the Free Software 47 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110, 48 * USA 49 * 50 * The full GNU General Public License is included in this distribution 51 * in the file called COPYING. 52 * 53 * Contact Information: 54 * Intel Linux Wireless <ilw@linux.intel.com> 55 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497 56 * 57 * 58 * BSD LICENSE 59 * 60 * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved. 61 * All rights reserved. 62 * 63 * Redistribution and use in source and binary forms, with or without 64 * modification, are permitted provided that the following conditions 65 * are met: 66 * 67 * * Redistributions of source code must retain the above copyright 68 * notice, this list of conditions and the following disclaimer. 69 * * Redistributions in binary form must reproduce the above copyright 70 * notice, this list of conditions and the following disclaimer in 71 * the documentation and/or other materials provided with the 72 * distribution. 73 * * Neither the name Intel Corporation nor the names of its 74 * contributors may be used to endorse or promote products derived 75 * from this software without specific prior written permission. 76 * 77 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 78 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 79 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 80 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 81 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 82 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 83 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 84 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 85 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 86 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 87 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 88 */ 89 90 /*- 91 * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr> 92 * 93 * Permission to use, copy, modify, and distribute this software for any 94 * purpose with or without fee is hereby granted, provided that the above 95 * copyright notice and this permission notice appear in all copies. 96 * 97 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 98 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 99 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 100 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 101 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 102 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 103 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 104 */ 105 #include <sys/cdefs.h> 106 __FBSDID("$FreeBSD$"); 107 108 #include "opt_wlan.h" 109 #include "opt_iwm.h" 110 111 #include <sys/param.h> 112 #include <sys/bus.h> 113 #include <sys/conf.h> 114 #include <sys/endian.h> 115 #include <sys/firmware.h> 116 #include <sys/kernel.h> 117 #include <sys/malloc.h> 118 #include <sys/mbuf.h> 119 #include <sys/mutex.h> 120 #include <sys/module.h> 121 #include <sys/proc.h> 122 #include <sys/rman.h> 123 #include <sys/socket.h> 124 #include <sys/sockio.h> 125 #include <sys/sysctl.h> 126 #include <sys/linker.h> 127 128 #include <machine/bus.h> 129 #include <machine/endian.h> 130 #include <machine/resource.h> 131 132 #include <dev/pci/pcivar.h> 133 #include <dev/pci/pcireg.h> 134 135 #include <net/bpf.h> 136 137 #include <net/if.h> 138 #include <net/if_var.h> 139 #include <net/if_arp.h> 140 #include <net/if_dl.h> 141 #include <net/if_media.h> 142 #include <net/if_types.h> 143 144 #include <netinet/in.h> 145 #include <netinet/in_systm.h> 146 #include <netinet/if_ether.h> 147 #include <netinet/ip.h> 148 149 #include <net80211/ieee80211_var.h> 150 #include <net80211/ieee80211_regdomain.h> 151 #include <net80211/ieee80211_ratectl.h> 152 #include <net80211/ieee80211_radiotap.h> 153 154 #include <dev/iwm/if_iwmreg.h> 155 #include <dev/iwm/if_iwmvar.h> 156 #include <dev/iwm/if_iwm_debug.h> 157 #include <dev/iwm/if_iwm_notif_wait.h> 158 #include <dev/iwm/if_iwm_util.h> 159 #include <dev/iwm/if_iwm_scan.h> 160 161 /* 162 * BEGIN mvm/scan.c 163 */ 164 165 #define IWM_DENSE_EBS_SCAN_RATIO 5 166 #define IWM_SPARSE_EBS_SCAN_RATIO 1 167 168 static uint16_t 169 iwm_mvm_scan_rx_chain(struct iwm_softc *sc) 170 { 171 uint16_t rx_chain; 172 uint8_t rx_ant; 173 174 rx_ant = iwm_mvm_get_valid_rx_ant(sc); 175 rx_chain = rx_ant << IWM_PHY_RX_CHAIN_VALID_POS; 176 rx_chain |= rx_ant << IWM_PHY_RX_CHAIN_FORCE_MIMO_SEL_POS; 177 rx_chain |= rx_ant << IWM_PHY_RX_CHAIN_FORCE_SEL_POS; 178 rx_chain |= 0x1 << IWM_PHY_RX_CHAIN_DRIVER_FORCE_POS; 179 return htole16(rx_chain); 180 } 181 182 static uint32_t 183 iwm_mvm_scan_rxon_flags(struct ieee80211_channel *c) 184 { 185 if (IEEE80211_IS_CHAN_2GHZ(c)) 186 return htole32(IWM_PHY_BAND_24); 187 else 188 return htole32(IWM_PHY_BAND_5); 189 } 190 191 static uint32_t 192 iwm_mvm_scan_rate_n_flags(struct iwm_softc *sc, int flags, int no_cck) 193 { 194 uint32_t tx_ant; 195 int i, ind; 196 197 for (i = 0, ind = sc->sc_scan_last_antenna; 198 i < IWM_RATE_MCS_ANT_NUM; i++) { 199 ind = (ind + 1) % IWM_RATE_MCS_ANT_NUM; 200 if (iwm_mvm_get_valid_tx_ant(sc) & (1 << ind)) { 201 sc->sc_scan_last_antenna = ind; 202 break; 203 } 204 } 205 tx_ant = (1 << sc->sc_scan_last_antenna) << IWM_RATE_MCS_ANT_POS; 206 207 if ((flags & IEEE80211_CHAN_2GHZ) && !no_cck) 208 return htole32(IWM_RATE_1M_PLCP | IWM_RATE_MCS_CCK_MSK | 209 tx_ant); 210 else 211 return htole32(IWM_RATE_6M_PLCP | tx_ant); 212 } 213 214 static inline boolean_t 215 iwm_mvm_rrm_scan_needed(struct iwm_softc *sc) 216 { 217 /* require rrm scan whenever the fw supports it */ 218 return fw_has_capa(&sc->ucode_capa, 219 IWM_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT); 220 } 221 222 #ifdef IWM_DEBUG 223 static const char * 224 iwm_mvm_ebs_status_str(enum iwm_scan_ebs_status status) 225 { 226 switch (status) { 227 case IWM_SCAN_EBS_SUCCESS: 228 return "successful"; 229 case IWM_SCAN_EBS_INACTIVE: 230 return "inactive"; 231 case IWM_SCAN_EBS_FAILED: 232 case IWM_SCAN_EBS_CHAN_NOT_FOUND: 233 default: 234 return "failed"; 235 } 236 } 237 238 static const char * 239 iwm_mvm_offload_status_str(enum iwm_scan_offload_complete_status status) 240 { 241 return (status == IWM_SCAN_OFFLOAD_ABORTED) ? "aborted" : "completed"; 242 } 243 #endif 244 245 void 246 iwm_mvm_rx_lmac_scan_complete_notif(struct iwm_softc *sc, 247 struct iwm_rx_packet *pkt) 248 { 249 struct iwm_periodic_scan_complete *scan_notif = (void *)pkt->data; 250 251 /* If this happens, the firmware has mistakenly sent an LMAC 252 * notification during UMAC scans -- warn and ignore it. 253 */ 254 if (fw_has_capa(&sc->ucode_capa, IWM_UCODE_TLV_CAPA_UMAC_SCAN)) { 255 device_printf(sc->sc_dev, 256 "%s: Mistakenly got LMAC notification during UMAC scan\n", 257 __func__); 258 return; 259 } 260 261 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Regular scan %s, EBS status %s (FW)\n", 262 iwm_mvm_offload_status_str(scan_notif->status), 263 iwm_mvm_ebs_status_str(scan_notif->ebs_status)); 264 265 sc->last_ebs_successful = 266 scan_notif->ebs_status == IWM_SCAN_EBS_SUCCESS || 267 scan_notif->ebs_status == IWM_SCAN_EBS_INACTIVE; 268 269 } 270 271 void 272 iwm_mvm_rx_umac_scan_complete_notif(struct iwm_softc *sc, 273 struct iwm_rx_packet *pkt) 274 { 275 struct iwm_umac_scan_complete *notif = (void *)pkt->data; 276 277 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 278 "Scan completed, uid %u, status %s, EBS status %s\n", 279 le32toh(notif->uid), 280 iwm_mvm_offload_status_str(notif->status), 281 iwm_mvm_ebs_status_str(notif->ebs_status)); 282 283 if (notif->ebs_status != IWM_SCAN_EBS_SUCCESS && 284 notif->ebs_status != IWM_SCAN_EBS_INACTIVE) 285 sc->last_ebs_successful = FALSE; 286 } 287 288 static int 289 iwm_mvm_scan_skip_channel(struct ieee80211_channel *c) 290 { 291 if (IEEE80211_IS_CHAN_2GHZ(c) && IEEE80211_IS_CHAN_B(c)) 292 return 0; 293 else if (IEEE80211_IS_CHAN_5GHZ(c) && IEEE80211_IS_CHAN_A(c)) 294 return 0; 295 else 296 return 1; 297 } 298 299 static uint8_t 300 iwm_mvm_lmac_scan_fill_channels(struct iwm_softc *sc, 301 struct iwm_scan_channel_cfg_lmac *chan, int n_ssids) 302 { 303 struct ieee80211com *ic = &sc->sc_ic; 304 struct ieee80211_scan_state *ss = ic->ic_scan; 305 struct ieee80211_channel *c; 306 uint8_t nchan; 307 int j; 308 309 for (nchan = j = 0; 310 j < ic->ic_nchans && nchan < sc->ucode_capa.n_scan_channels; j++) { 311 c = &ic->ic_channels[j]; 312 /* For 2GHz, only populate 11b channels */ 313 /* For 5GHz, only populate 11a channels */ 314 /* 315 * Catch other channels, in case we have 900MHz channels or 316 * something in the chanlist. 317 */ 318 if (iwm_mvm_scan_skip_channel(c)) { 319 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 320 "%s: skipping channel (freq=%d, ieee=%d, flags=0x%08x)\n", 321 __func__, c->ic_freq, c->ic_ieee, c->ic_flags); 322 continue; 323 } 324 325 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 326 "Adding channel %d (%d Mhz) to the list\n", 327 nchan, c->ic_freq); 328 chan->channel_num = htole16(ieee80211_mhz2ieee(c->ic_freq, 0)); 329 chan->iter_count = htole16(1); 330 chan->iter_interval = htole32(0); 331 chan->flags = htole32(IWM_UNIFIED_SCAN_CHANNEL_PARTIAL); 332 chan->flags |= htole32(IWM_SCAN_CHANNEL_NSSIDS(n_ssids)); 333 /* XXX IEEE80211_SCAN_NOBCAST flag is never set. */ 334 if (!IEEE80211_IS_CHAN_PASSIVE(c) && 335 (!(ss->ss_flags & IEEE80211_SCAN_NOBCAST) || n_ssids != 0)) 336 chan->flags |= htole32(IWM_SCAN_CHANNEL_TYPE_ACTIVE); 337 chan++; 338 nchan++; 339 } 340 341 return nchan; 342 } 343 344 static uint8_t 345 iwm_mvm_umac_scan_fill_channels(struct iwm_softc *sc, 346 struct iwm_scan_channel_cfg_umac *chan, int n_ssids) 347 { 348 struct ieee80211com *ic = &sc->sc_ic; 349 struct ieee80211_channel *c; 350 uint8_t nchan; 351 int j; 352 353 for (nchan = j = 0; 354 j < ic->ic_nchans && nchan < sc->ucode_capa.n_scan_channels; j++) { 355 c = &ic->ic_channels[j]; 356 /* For 2GHz, only populate 11b channels */ 357 /* For 5GHz, only populate 11a channels */ 358 /* 359 * Catch other channels, in case we have 900MHz channels or 360 * something in the chanlist. 361 */ 362 if (iwm_mvm_scan_skip_channel(c)) { 363 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 364 "%s: skipping channel (freq=%d, ieee=%d, flags=0x%08x)\n", 365 __func__, c->ic_freq, c->ic_ieee, c->ic_flags); 366 continue; 367 } 368 369 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 370 "Adding channel %d (%d Mhz) to the list\n", 371 nchan, c->ic_freq); 372 chan->channel_num = ieee80211_mhz2ieee(c->ic_freq, 0); 373 chan->iter_count = 1; 374 chan->iter_interval = htole16(0); 375 chan->flags = htole32(IWM_SCAN_CHANNEL_UMAC_NSSIDS(n_ssids)); 376 chan++; 377 nchan++; 378 } 379 380 return nchan; 381 } 382 383 static int 384 iwm_mvm_fill_probe_req(struct iwm_softc *sc, struct iwm_scan_probe_req *preq) 385 { 386 struct ieee80211com *ic = &sc->sc_ic; 387 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 388 struct ieee80211_frame *wh = (struct ieee80211_frame *)preq->buf; 389 struct ieee80211_rateset *rs; 390 size_t remain = sizeof(preq->buf); 391 uint8_t *frm, *pos; 392 393 memset(preq, 0, sizeof(*preq)); 394 395 /* Ensure enough space for header and SSID IE. */ 396 if (remain < sizeof(*wh) + 2) 397 return ENOBUFS; 398 399 /* 400 * Build a probe request frame. Most of the following code is a 401 * copy & paste of what is done in net80211. 402 */ 403 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | 404 IEEE80211_FC0_SUBTYPE_PROBE_REQ; 405 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 406 IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr); 407 IEEE80211_ADDR_COPY(wh->i_addr2, vap ? vap->iv_myaddr : ic->ic_macaddr); 408 IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr); 409 *(uint16_t *)&wh->i_dur[0] = 0; /* filled by HW */ 410 *(uint16_t *)&wh->i_seq[0] = 0; /* filled by HW */ 411 412 frm = (uint8_t *)(wh + 1); 413 frm = ieee80211_add_ssid(frm, NULL, 0); 414 415 /* Tell the firmware where the MAC header is. */ 416 preq->mac_header.offset = 0; 417 preq->mac_header.len = htole16(frm - (uint8_t *)wh); 418 remain -= frm - (uint8_t *)wh; 419 420 /* Fill in 2GHz IEs and tell firmware where they are. */ 421 rs = &ic->ic_sup_rates[IEEE80211_MODE_11G]; 422 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 423 if (remain < 4 + rs->rs_nrates) 424 return ENOBUFS; 425 } else if (remain < 2 + rs->rs_nrates) { 426 return ENOBUFS; 427 } 428 preq->band_data[0].offset = htole16(frm - (uint8_t *)wh); 429 pos = frm; 430 frm = ieee80211_add_rates(frm, rs); 431 if (rs->rs_nrates > IEEE80211_RATE_SIZE) 432 frm = ieee80211_add_xrates(frm, rs); 433 preq->band_data[0].len = htole16(frm - pos); 434 remain -= frm - pos; 435 436 if (iwm_mvm_rrm_scan_needed(sc)) { 437 if (remain < 3) 438 return ENOBUFS; 439 *frm++ = IEEE80211_ELEMID_DSPARMS; 440 *frm++ = 1; 441 *frm++ = 0; 442 remain -= 3; 443 } 444 445 if (sc->nvm_data->sku_cap_band_52GHz_enable) { 446 /* Fill in 5GHz IEs. */ 447 rs = &ic->ic_sup_rates[IEEE80211_MODE_11A]; 448 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 449 if (remain < 4 + rs->rs_nrates) 450 return ENOBUFS; 451 } else if (remain < 2 + rs->rs_nrates) { 452 return ENOBUFS; 453 } 454 preq->band_data[1].offset = htole16(frm - (uint8_t *)wh); 455 pos = frm; 456 frm = ieee80211_add_rates(frm, rs); 457 if (rs->rs_nrates > IEEE80211_RATE_SIZE) 458 frm = ieee80211_add_xrates(frm, rs); 459 preq->band_data[1].len = htole16(frm - pos); 460 remain -= frm - pos; 461 } 462 463 /* Send 11n IEs on both 2GHz and 5GHz bands. */ 464 preq->common_data.offset = htole16(frm - (uint8_t *)wh); 465 pos = frm; 466 #if 0 467 if (ic->ic_flags & IEEE80211_F_HTON) { 468 if (remain < 28) 469 return ENOBUFS; 470 frm = ieee80211_add_htcaps(frm, ic); 471 /* XXX add WME info? */ 472 } 473 #endif 474 preq->common_data.len = htole16(frm - pos); 475 476 return 0; 477 } 478 479 int 480 iwm_mvm_config_umac_scan(struct iwm_softc *sc) 481 { 482 struct ieee80211com *ic = &sc->sc_ic; 483 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 484 485 struct iwm_scan_config *scan_config; 486 int ret, j, nchan; 487 size_t cmd_size; 488 struct ieee80211_channel *c; 489 struct iwm_host_cmd hcmd = { 490 .id = iwm_cmd_id(IWM_SCAN_CFG_CMD, IWM_ALWAYS_LONG_GROUP, 0), 491 .flags = IWM_CMD_SYNC, 492 }; 493 static const uint32_t rates = (IWM_SCAN_CONFIG_RATE_1M | 494 IWM_SCAN_CONFIG_RATE_2M | IWM_SCAN_CONFIG_RATE_5M | 495 IWM_SCAN_CONFIG_RATE_11M | IWM_SCAN_CONFIG_RATE_6M | 496 IWM_SCAN_CONFIG_RATE_9M | IWM_SCAN_CONFIG_RATE_12M | 497 IWM_SCAN_CONFIG_RATE_18M | IWM_SCAN_CONFIG_RATE_24M | 498 IWM_SCAN_CONFIG_RATE_36M | IWM_SCAN_CONFIG_RATE_48M | 499 IWM_SCAN_CONFIG_RATE_54M); 500 501 cmd_size = sizeof(*scan_config) + sc->ucode_capa.n_scan_channels; 502 503 scan_config = malloc(cmd_size, M_DEVBUF, M_NOWAIT | M_ZERO); 504 if (scan_config == NULL) 505 return ENOMEM; 506 507 scan_config->tx_chains = htole32(iwm_mvm_get_valid_tx_ant(sc)); 508 scan_config->rx_chains = htole32(iwm_mvm_get_valid_rx_ant(sc)); 509 scan_config->legacy_rates = htole32(rates | 510 IWM_SCAN_CONFIG_SUPPORTED_RATE(rates)); 511 512 /* These timings correspond to iwlwifi's UNASSOC scan. */ 513 scan_config->dwell_active = 10; 514 scan_config->dwell_passive = 110; 515 scan_config->dwell_fragmented = 44; 516 scan_config->dwell_extended = 90; 517 scan_config->out_of_channel_time = htole32(0); 518 scan_config->suspend_time = htole32(0); 519 520 IEEE80211_ADDR_COPY(scan_config->mac_addr, 521 vap ? vap->iv_myaddr : ic->ic_macaddr); 522 523 scan_config->bcast_sta_id = sc->sc_aux_sta.sta_id; 524 scan_config->channel_flags = IWM_CHANNEL_FLAG_EBS | 525 IWM_CHANNEL_FLAG_ACCURATE_EBS | IWM_CHANNEL_FLAG_EBS_ADD | 526 IWM_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE; 527 528 for (nchan = j = 0; 529 j < ic->ic_nchans && nchan < sc->ucode_capa.n_scan_channels; j++) { 530 c = &ic->ic_channels[j]; 531 /* For 2GHz, only populate 11b channels */ 532 /* For 5GHz, only populate 11a channels */ 533 /* 534 * Catch other channels, in case we have 900MHz channels or 535 * something in the chanlist. 536 */ 537 if (iwm_mvm_scan_skip_channel(c)) 538 continue; 539 scan_config->channel_array[nchan++] = 540 ieee80211_mhz2ieee(c->ic_freq, 0); 541 } 542 543 scan_config->flags = htole32(IWM_SCAN_CONFIG_FLAG_ACTIVATE | 544 IWM_SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS | 545 IWM_SCAN_CONFIG_FLAG_SET_TX_CHAINS | 546 IWM_SCAN_CONFIG_FLAG_SET_RX_CHAINS | 547 IWM_SCAN_CONFIG_FLAG_SET_AUX_STA_ID | 548 IWM_SCAN_CONFIG_FLAG_SET_ALL_TIMES | 549 IWM_SCAN_CONFIG_FLAG_SET_LEGACY_RATES | 550 IWM_SCAN_CONFIG_FLAG_SET_MAC_ADDR | 551 IWM_SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS| 552 IWM_SCAN_CONFIG_N_CHANNELS(nchan) | 553 IWM_SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED); 554 555 hcmd.data[0] = scan_config; 556 hcmd.len[0] = cmd_size; 557 558 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Sending UMAC scan config\n"); 559 560 ret = iwm_send_cmd(sc, &hcmd); 561 if (!ret) 562 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 563 "UMAC scan config was sent successfully\n"); 564 565 free(scan_config, M_DEVBUF); 566 return ret; 567 } 568 569 static boolean_t 570 iwm_mvm_scan_use_ebs(struct iwm_softc *sc) 571 { 572 const struct iwm_ucode_capabilities *capa = &sc->ucode_capa; 573 574 /* We can only use EBS if: 575 * 1. the feature is supported; 576 * 2. the last EBS was successful; 577 * 3. if only single scan, the single scan EBS API is supported; 578 * 4. it's not a p2p find operation. 579 */ 580 return ((capa->flags & IWM_UCODE_TLV_FLAGS_EBS_SUPPORT) && 581 sc->last_ebs_successful); 582 } 583 584 int 585 iwm_mvm_umac_scan(struct iwm_softc *sc) 586 { 587 struct iwm_host_cmd hcmd = { 588 .id = iwm_cmd_id(IWM_SCAN_REQ_UMAC, IWM_ALWAYS_LONG_GROUP, 0), 589 .len = { 0, }, 590 .data = { NULL, }, 591 .flags = IWM_CMD_SYNC, 592 }; 593 struct ieee80211_scan_state *ss = sc->sc_ic.ic_scan; 594 struct iwm_scan_req_umac *req; 595 struct iwm_scan_req_umac_tail *tail; 596 size_t req_len; 597 uint8_t i, nssid; 598 int ret; 599 600 req_len = sizeof(struct iwm_scan_req_umac) + 601 (sizeof(struct iwm_scan_channel_cfg_umac) * 602 sc->ucode_capa.n_scan_channels) + 603 sizeof(struct iwm_scan_req_umac_tail); 604 if (req_len > IWM_MAX_CMD_PAYLOAD_SIZE) 605 return ENOMEM; 606 req = malloc(req_len, M_DEVBUF, M_NOWAIT | M_ZERO); 607 if (req == NULL) 608 return ENOMEM; 609 610 hcmd.len[0] = (uint16_t)req_len; 611 hcmd.data[0] = (void *)req; 612 613 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Handling ieee80211 scan request\n"); 614 615 /* These timings correspond to iwlwifi's UNASSOC scan. */ 616 req->active_dwell = 10; 617 req->passive_dwell = 110; 618 req->fragmented_dwell = 44; 619 req->extended_dwell = 90; 620 req->max_out_time = 0; 621 req->suspend_time = 0; 622 623 req->scan_priority = htole32(IWM_SCAN_PRIORITY_HIGH); 624 req->ooc_priority = htole32(IWM_SCAN_PRIORITY_HIGH); 625 626 nssid = MIN(ss->ss_nssid, IWM_PROBE_OPTION_MAX); 627 req->n_channels = iwm_mvm_umac_scan_fill_channels(sc, 628 (struct iwm_scan_channel_cfg_umac *)req->data, nssid); 629 630 req->general_flags = htole32(IWM_UMAC_SCAN_GEN_FLAGS_PASS_ALL | 631 IWM_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE | 632 IWM_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL); 633 634 tail = (void *)((char *)&req->data + 635 sizeof(struct iwm_scan_channel_cfg_umac) * 636 sc->ucode_capa.n_scan_channels); 637 638 /* Check if we're doing an active directed scan. */ 639 for (i = 0; i < nssid; i++) { 640 tail->direct_scan[i].id = IEEE80211_ELEMID_SSID; 641 tail->direct_scan[i].len = MIN(ss->ss_ssid[i].len, 642 IEEE80211_NWID_LEN); 643 memcpy(tail->direct_scan[i].ssid, ss->ss_ssid[i].ssid, 644 tail->direct_scan[i].len); 645 /* XXX debug */ 646 } 647 if (nssid != 0) { 648 req->general_flags |= 649 htole32(IWM_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT); 650 } else 651 req->general_flags |= htole32(IWM_UMAC_SCAN_GEN_FLAGS_PASSIVE); 652 653 if (iwm_mvm_scan_use_ebs(sc)) 654 req->channel_flags = IWM_SCAN_CHANNEL_FLAG_EBS | 655 IWM_SCAN_CHANNEL_FLAG_EBS_ACCURATE | 656 IWM_SCAN_CHANNEL_FLAG_CACHE_ADD; 657 658 if (iwm_mvm_rrm_scan_needed(sc)) 659 req->general_flags |= 660 htole32(IWM_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED); 661 662 ret = iwm_mvm_fill_probe_req(sc, &tail->preq); 663 if (ret) { 664 free(req, M_DEVBUF); 665 return ret; 666 } 667 668 /* Specify the scan plan: We'll do one iteration. */ 669 tail->schedule[0].interval = 0; 670 tail->schedule[0].iter_count = 1; 671 672 ret = iwm_send_cmd(sc, &hcmd); 673 if (!ret) 674 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 675 "Scan request was sent successfully\n"); 676 free(req, M_DEVBUF); 677 return ret; 678 } 679 680 int 681 iwm_mvm_lmac_scan(struct iwm_softc *sc) 682 { 683 struct iwm_host_cmd hcmd = { 684 .id = IWM_SCAN_OFFLOAD_REQUEST_CMD, 685 .len = { 0, }, 686 .data = { NULL, }, 687 .flags = IWM_CMD_SYNC, 688 }; 689 struct ieee80211_scan_state *ss = sc->sc_ic.ic_scan; 690 struct iwm_scan_req_lmac *req; 691 size_t req_len; 692 uint8_t i, nssid; 693 int ret; 694 695 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 696 "Handling ieee80211 scan request\n"); 697 698 req_len = sizeof(struct iwm_scan_req_lmac) + 699 (sizeof(struct iwm_scan_channel_cfg_lmac) * 700 sc->ucode_capa.n_scan_channels) + sizeof(struct iwm_scan_probe_req); 701 if (req_len > IWM_MAX_CMD_PAYLOAD_SIZE) 702 return ENOMEM; 703 req = malloc(req_len, M_DEVBUF, M_NOWAIT | M_ZERO); 704 if (req == NULL) 705 return ENOMEM; 706 707 hcmd.len[0] = (uint16_t)req_len; 708 hcmd.data[0] = (void *)req; 709 710 /* These timings correspond to iwlwifi's UNASSOC scan. */ 711 req->active_dwell = 10; 712 req->passive_dwell = 110; 713 req->fragmented_dwell = 44; 714 req->extended_dwell = 90; 715 req->max_out_time = 0; 716 req->suspend_time = 0; 717 718 req->scan_prio = htole32(IWM_SCAN_PRIORITY_HIGH); 719 req->rx_chain_select = iwm_mvm_scan_rx_chain(sc); 720 req->iter_num = htole32(1); 721 req->delay = 0; 722 723 req->scan_flags = htole32(IWM_MVM_LMAC_SCAN_FLAG_PASS_ALL | 724 IWM_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE | 725 IWM_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL); 726 if (iwm_mvm_rrm_scan_needed(sc)) 727 req->scan_flags |= htole32(IWM_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED); 728 729 req->flags = iwm_mvm_scan_rxon_flags(&sc->sc_ic.ic_channels[0]); 730 731 req->filter_flags = 732 htole32(IWM_MAC_FILTER_ACCEPT_GRP | IWM_MAC_FILTER_IN_BEACON); 733 734 /* Tx flags 2 GHz. */ 735 req->tx_cmd[0].tx_flags = htole32(IWM_TX_CMD_FLG_SEQ_CTL | 736 IWM_TX_CMD_FLG_BT_DIS); 737 req->tx_cmd[0].rate_n_flags = 738 iwm_mvm_scan_rate_n_flags(sc, IEEE80211_CHAN_2GHZ, 1/*XXX*/); 739 req->tx_cmd[0].sta_id = sc->sc_aux_sta.sta_id; 740 741 /* Tx flags 5 GHz. */ 742 req->tx_cmd[1].tx_flags = htole32(IWM_TX_CMD_FLG_SEQ_CTL | 743 IWM_TX_CMD_FLG_BT_DIS); 744 req->tx_cmd[1].rate_n_flags = 745 iwm_mvm_scan_rate_n_flags(sc, IEEE80211_CHAN_5GHZ, 1/*XXX*/); 746 req->tx_cmd[1].sta_id = sc->sc_aux_sta.sta_id; 747 748 /* Check if we're doing an active directed scan. */ 749 nssid = MIN(ss->ss_nssid, IWM_PROBE_OPTION_MAX); 750 for (i = 0; i < nssid; i++) { 751 req->direct_scan[i].id = IEEE80211_ELEMID_SSID; 752 req->direct_scan[i].len = MIN(ss->ss_ssid[i].len, 753 IEEE80211_NWID_LEN); 754 memcpy(req->direct_scan[i].ssid, ss->ss_ssid[i].ssid, 755 req->direct_scan[i].len); 756 /* XXX debug */ 757 } 758 if (nssid != 0) { 759 req->scan_flags |= 760 htole32(IWM_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION); 761 } else 762 req->scan_flags |= htole32(IWM_MVM_LMAC_SCAN_FLAG_PASSIVE); 763 764 req->n_channels = iwm_mvm_lmac_scan_fill_channels(sc, 765 (struct iwm_scan_channel_cfg_lmac *)req->data, nssid); 766 767 ret = iwm_mvm_fill_probe_req(sc, 768 (struct iwm_scan_probe_req *)(req->data + 769 (sizeof(struct iwm_scan_channel_cfg_lmac) * 770 sc->ucode_capa.n_scan_channels))); 771 if (ret) { 772 free(req, M_DEVBUF); 773 return ret; 774 } 775 776 /* Specify the scan plan: We'll do one iteration. */ 777 req->schedule[0].iterations = 1; 778 req->schedule[0].full_scan_mul = 1; 779 780 if (iwm_mvm_scan_use_ebs(sc)) { 781 req->channel_opt[0].flags = 782 htole16(IWM_SCAN_CHANNEL_FLAG_EBS | 783 IWM_SCAN_CHANNEL_FLAG_EBS_ACCURATE | 784 IWM_SCAN_CHANNEL_FLAG_CACHE_ADD); 785 req->channel_opt[0].non_ebs_ratio = 786 htole16(IWM_DENSE_EBS_SCAN_RATIO); 787 req->channel_opt[1].flags = 788 htole16(IWM_SCAN_CHANNEL_FLAG_EBS | 789 IWM_SCAN_CHANNEL_FLAG_EBS_ACCURATE | 790 IWM_SCAN_CHANNEL_FLAG_CACHE_ADD); 791 req->channel_opt[1].non_ebs_ratio = 792 htole16(IWM_SPARSE_EBS_SCAN_RATIO); 793 } 794 795 ret = iwm_send_cmd(sc, &hcmd); 796 if (!ret) { 797 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 798 "Scan request was sent successfully\n"); 799 } 800 free(req, M_DEVBUF); 801 return ret; 802 } 803 804 static int 805 iwm_mvm_lmac_scan_abort(struct iwm_softc *sc) 806 { 807 int ret; 808 struct iwm_host_cmd hcmd = { 809 .id = IWM_SCAN_OFFLOAD_ABORT_CMD, 810 .len = { 0, }, 811 .data = { NULL, }, 812 .flags = IWM_CMD_SYNC, 813 }; 814 uint32_t status; 815 816 ret = iwm_mvm_send_cmd_status(sc, &hcmd, &status); 817 if (ret) 818 return ret; 819 820 if (status != IWM_CAN_ABORT_STATUS) { 821 /* 822 * The scan abort will return 1 for success or 823 * 2 for "failure". A failure condition can be 824 * due to simply not being in an active scan which 825 * can occur if we send the scan abort before the 826 * microcode has notified us that a scan is completed. 827 */ 828 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 829 "SCAN OFFLOAD ABORT ret %d.\n", status); 830 ret = ENOENT; 831 } 832 833 return ret; 834 } 835 836 static int 837 iwm_mvm_umac_scan_abort(struct iwm_softc *sc) 838 { 839 struct iwm_umac_scan_abort cmd = {}; 840 int uid, ret; 841 842 uid = 0; 843 cmd.uid = htole32(uid); 844 845 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Sending scan abort, uid %u\n", uid); 846 847 ret = iwm_mvm_send_cmd_pdu(sc, 848 iwm_cmd_id(IWM_SCAN_ABORT_UMAC, 849 IWM_ALWAYS_LONG_GROUP, 0), 850 0, sizeof(cmd), &cmd); 851 852 return ret; 853 } 854 855 int 856 iwm_mvm_scan_stop_wait(struct iwm_softc *sc) 857 { 858 struct iwm_notification_wait wait_scan_done; 859 static const uint16_t scan_done_notif[] = { IWM_SCAN_COMPLETE_UMAC, 860 IWM_SCAN_OFFLOAD_COMPLETE, }; 861 int ret; 862 863 iwm_init_notification_wait(sc->sc_notif_wait, &wait_scan_done, 864 scan_done_notif, nitems(scan_done_notif), 865 NULL, NULL); 866 867 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Preparing to stop scan\n"); 868 869 if (fw_has_capa(&sc->ucode_capa, IWM_UCODE_TLV_CAPA_UMAC_SCAN)) 870 ret = iwm_mvm_umac_scan_abort(sc); 871 else 872 ret = iwm_mvm_lmac_scan_abort(sc); 873 874 if (ret) { 875 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "couldn't stop scan\n"); 876 iwm_remove_notification(sc->sc_notif_wait, &wait_scan_done); 877 return ret; 878 } 879 880 IWM_UNLOCK(sc); 881 ret = iwm_wait_notification(sc->sc_notif_wait, &wait_scan_done, hz); 882 IWM_LOCK(sc); 883 884 return ret; 885 } 886