1/* $OpenBSD: if_iwm.c,v 1.39 2015/03/23 00:35:19 jsg Exp $ */ 2 3/* 4 * Copyright (c) 2014 genua mbh <info@genua.de> 5 * Copyright (c) 2014 Fixup Software Ltd. 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20/*- 21 * Based on BSD-licensed source modules in the Linux iwlwifi driver, 22 * which were used as the reference documentation for this implementation. 23 * 24 * Driver version we are currently based off of is 25 * Linux 3.14.3 (tag id a2df521e42b1d9a23f620ac79dbfe8655a8391dd) 26 * 27 *********************************************************************** 28 * 29 * This file is provided under a dual BSD/GPLv2 license. When using or 30 * redistributing this file, you may do so under either license. 31 * 32 * GPL LICENSE SUMMARY 33 * 34 * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved. 35 * 36 * This program is free software; you can redistribute it and/or modify 37 * it under the terms of version 2 of the GNU General Public License as 38 * published by the Free Software Foundation. 39 * 40 * This program is distributed in the hope that it will be useful, but 41 * WITHOUT ANY WARRANTY; without even the implied warranty of 42 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 43 * General Public License for more details. 44 * 45 * You should have received a copy of the GNU General Public License 46 * along with this program; if not, write to the Free Software 47 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110, 48 * USA 49 * 50 * The full GNU General Public License is included in this distribution 51 * in the file called COPYING. 52 * 53 * Contact Information: 54 * Intel Linux Wireless <ilw@linux.intel.com> 55 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497 56 * 57 * 58 * BSD LICENSE 59 * 60 * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved. 61 * All rights reserved. 62 * 63 * Redistribution and use in source and binary forms, with or without 64 * modification, are permitted provided that the following conditions 65 * are met: 66 * 67 * * Redistributions of source code must retain the above copyright 68 * notice, this list of conditions and the following disclaimer. 69 * * Redistributions in binary form must reproduce the above copyright 70 * notice, this list of conditions and the following disclaimer in 71 * the documentation and/or other materials provided with the 72 * distribution. 73 * * Neither the name Intel Corporation nor the names of its 74 * contributors may be used to endorse or promote products derived 75 * from this software without specific prior written permission. 76 * 77 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 78 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 79 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 80 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 81 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 82 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 83 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 84 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 85 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 86 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 87 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 88 */ 89 90/*- 91 * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr> 92 * 93 * Permission to use, copy, modify, and distribute this software for any 94 * purpose with or without fee is hereby granted, provided that the above 95 * copyright notice and this permission notice appear in all copies. 96 * 97 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 98 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 99 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 100 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 101 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 102 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 103 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 104 */ 105#include <sys/cdefs.h> 106__FBSDID("$FreeBSD$"); 107 108#include "opt_wlan.h" 109#include "opt_iwm.h" 110 111#include <sys/param.h> 112#include <sys/bus.h> 113#include <sys/conf.h> 114#include <sys/endian.h> 115#include <sys/firmware.h> 116#include <sys/kernel.h> 117#include <sys/malloc.h> 118#include <sys/mbuf.h> 119#include <sys/mutex.h> 120#include <sys/module.h> 121#include <sys/proc.h> 122#include <sys/rman.h> 123#include <sys/socket.h> 124#include <sys/sockio.h> 125#include <sys/sysctl.h> 126#include <sys/linker.h> 127 128#include <machine/bus.h> 129#include <machine/endian.h> 130#include <machine/resource.h> 131 132#include <dev/pci/pcivar.h> 133#include <dev/pci/pcireg.h> 134 135#include <net/bpf.h> 136 137#include <net/if.h> 138#include <net/if_var.h> 139#include <net/if_arp.h> 140#include <net/if_dl.h> 141#include <net/if_media.h> 142#include <net/if_types.h> 143 144#include <netinet/in.h> 145#include <netinet/in_systm.h> 146#include <netinet/if_ether.h> 147#include <netinet/ip.h> 148 149#include <net80211/ieee80211_var.h> 150#include <net80211/ieee80211_regdomain.h> 151#include <net80211/ieee80211_ratectl.h> 152#include <net80211/ieee80211_radiotap.h> 153 154#include <dev/iwm/if_iwmreg.h> 155#include <dev/iwm/if_iwmvar.h> 156#include <dev/iwm/if_iwm_debug.h> 157#include <dev/iwm/if_iwm_notif_wait.h> 158#include <dev/iwm/if_iwm_util.h> 159#include <dev/iwm/if_iwm_scan.h> 160 161/* 162 * BEGIN mvm/scan.c 163 */ 164 165#define IWM_DENSE_EBS_SCAN_RATIO 5 166#define IWM_SPARSE_EBS_SCAN_RATIO 1 167 168static uint16_t 169iwm_scan_rx_chain(struct iwm_softc *sc) 170{ 171 uint16_t rx_chain; 172 uint8_t rx_ant; 173 174 rx_ant = iwm_get_valid_rx_ant(sc); 175 rx_chain = rx_ant << IWM_PHY_RX_CHAIN_VALID_POS; 176 rx_chain |= rx_ant << IWM_PHY_RX_CHAIN_FORCE_MIMO_SEL_POS; 177 rx_chain |= rx_ant << IWM_PHY_RX_CHAIN_FORCE_SEL_POS; 178 rx_chain |= 0x1 << IWM_PHY_RX_CHAIN_DRIVER_FORCE_POS; 179 return htole16(rx_chain); 180} 181 182static uint32_t 183iwm_scan_rxon_flags(struct ieee80211_channel *c) 184{ 185 if (IEEE80211_IS_CHAN_2GHZ(c)) 186 return htole32(IWM_PHY_BAND_24); 187 else 188 return htole32(IWM_PHY_BAND_5); 189} 190 191static uint32_t 192iwm_scan_rate_n_flags(struct iwm_softc *sc, int flags, int no_cck) 193{ 194 uint32_t tx_ant; 195 int i, ind; 196 197 for (i = 0, ind = sc->sc_scan_last_antenna; 198 i < IWM_RATE_MCS_ANT_NUM; i++) { 199 ind = (ind + 1) % IWM_RATE_MCS_ANT_NUM; 200 if (iwm_get_valid_tx_ant(sc) & (1 << ind)) { 201 sc->sc_scan_last_antenna = ind; 202 break; 203 } 204 } 205 tx_ant = (1 << sc->sc_scan_last_antenna) << IWM_RATE_MCS_ANT_POS; 206 207 if ((flags & IEEE80211_CHAN_2GHZ) && !no_cck) 208 return htole32(IWM_RATE_1M_PLCP | IWM_RATE_MCS_CCK_MSK | 209 tx_ant); 210 else 211 return htole32(IWM_RATE_6M_PLCP | tx_ant); 212} 213 214static inline boolean_t 215iwm_rrm_scan_needed(struct iwm_softc *sc) 216{ 217 /* require rrm scan whenever the fw supports it */ 218 return iwm_fw_has_capa(sc, IWM_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT); 219} 220 221#ifdef IWM_DEBUG 222static const char * 223iwm_ebs_status_str(enum iwm_scan_ebs_status status) 224{ 225 switch (status) { 226 case IWM_SCAN_EBS_SUCCESS: 227 return "successful"; 228 case IWM_SCAN_EBS_INACTIVE: 229 return "inactive"; 230 case IWM_SCAN_EBS_FAILED: 231 case IWM_SCAN_EBS_CHAN_NOT_FOUND: 232 default: 233 return "failed"; 234 } 235} 236 237static const char * 238iwm_offload_status_str(enum iwm_scan_offload_complete_status status) 239{ 240 return (status == IWM_SCAN_OFFLOAD_ABORTED) ? "aborted" : "completed"; 241} 242#endif 243 244void 245iwm_rx_lmac_scan_complete_notif(struct iwm_softc *sc, 246 struct iwm_rx_packet *pkt) 247{ 248 struct iwm_periodic_scan_complete *scan_notif = (void *)pkt->data; 249 250 /* If this happens, the firmware has mistakenly sent an LMAC 251 * notification during UMAC scans -- warn and ignore it. 252 */ 253 if (iwm_fw_has_capa(sc, IWM_UCODE_TLV_CAPA_UMAC_SCAN)) { 254 device_printf(sc->sc_dev, 255 "%s: Mistakenly got LMAC notification during UMAC scan\n", 256 __func__); 257 return; 258 } 259 260 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Regular scan %s, EBS status %s (FW)\n", 261 iwm_offload_status_str(scan_notif->status), 262 iwm_ebs_status_str(scan_notif->ebs_status)); 263 264 sc->last_ebs_successful = 265 scan_notif->ebs_status == IWM_SCAN_EBS_SUCCESS || 266 scan_notif->ebs_status == IWM_SCAN_EBS_INACTIVE; 267 268} 269 270void 271iwm_rx_umac_scan_complete_notif(struct iwm_softc *sc, 272 struct iwm_rx_packet *pkt) 273{ 274 struct iwm_umac_scan_complete *notif = (void *)pkt->data; 275 276 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 277 "Scan completed, uid %u, status %s, EBS status %s\n", 278 le32toh(notif->uid), 279 iwm_offload_status_str(notif->status), 280 iwm_ebs_status_str(notif->ebs_status)); 281 282 if (notif->ebs_status != IWM_SCAN_EBS_SUCCESS && 283 notif->ebs_status != IWM_SCAN_EBS_INACTIVE) 284 sc->last_ebs_successful = FALSE; 285} 286 287static int 288iwm_scan_skip_channel(struct ieee80211_channel *c) 289{ 290 if (IEEE80211_IS_CHAN_2GHZ(c) && IEEE80211_IS_CHAN_B(c)) 291 return 0; 292 else if (IEEE80211_IS_CHAN_5GHZ(c) && IEEE80211_IS_CHAN_A(c)) 293 return 0; 294 else 295 return 1; 296} 297 298static uint8_t 299iwm_lmac_scan_fill_channels(struct iwm_softc *sc, 300 struct iwm_scan_channel_cfg_lmac *chan, int n_ssids) 301{ 302 struct ieee80211com *ic = &sc->sc_ic; 303 struct ieee80211_scan_state *ss = ic->ic_scan; 304 struct ieee80211_channel *c; 305 uint8_t nchan; 306 int j; 307 308 for (nchan = j = 0; 309 j < ss->ss_last && nchan < sc->sc_fw.ucode_capa.n_scan_channels; 310 j++) { 311 c = ss->ss_chans[j]; 312 /* 313 * Catch other channels, in case we have 900MHz channels or 314 * something in the chanlist. 315 */ 316 if (!IEEE80211_IS_CHAN_2GHZ(c) && !IEEE80211_IS_CHAN_5GHZ(c)) { 317 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 318 "%s: skipping channel (freq=%d, ieee=%d, flags=0x%08x)\n", 319 __func__, c->ic_freq, c->ic_ieee, c->ic_flags); 320 continue; 321 } 322 323 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 324 "Adding channel %d (%d Mhz) to the list\n", 325 nchan, c->ic_freq); 326 chan->channel_num = htole16(ieee80211_mhz2ieee(c->ic_freq, 0)); 327 chan->iter_count = htole16(1); 328 chan->iter_interval = htole32(0); 329 chan->flags = htole32(IWM_UNIFIED_SCAN_CHANNEL_PARTIAL); 330 chan->flags |= htole32(IWM_SCAN_CHANNEL_NSSIDS(n_ssids)); 331 /* XXX IEEE80211_SCAN_NOBCAST flag is never set. */ 332 if (!IEEE80211_IS_CHAN_PASSIVE(c) && 333 (!(ss->ss_flags & IEEE80211_SCAN_NOBCAST) || n_ssids != 0)) 334 chan->flags |= htole32(IWM_SCAN_CHANNEL_TYPE_ACTIVE); 335 chan++; 336 nchan++; 337 } 338 339 return nchan; 340} 341 342static uint8_t 343iwm_umac_scan_fill_channels(struct iwm_softc *sc, 344 struct iwm_scan_channel_cfg_umac *chan, int n_ssids) 345{ 346 struct ieee80211com *ic = &sc->sc_ic; 347 struct ieee80211_scan_state *ss = ic->ic_scan; 348 struct ieee80211_channel *c; 349 uint8_t nchan; 350 int j; 351 352 for (nchan = j = 0; 353 j < ss->ss_last && nchan < sc->sc_fw.ucode_capa.n_scan_channels; 354 j++) { 355 c = ss->ss_chans[j]; 356 /* 357 * Catch other channels, in case we have 900MHz channels or 358 * something in the chanlist. 359 */ 360 if (!IEEE80211_IS_CHAN_2GHZ(c) && !IEEE80211_IS_CHAN_5GHZ(c)) { 361 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 362 "%s: skipping channel (freq=%d, ieee=%d, flags=0x%08x)\n", 363 __func__, c->ic_freq, c->ic_ieee, c->ic_flags); 364 continue; 365 } 366 367 IWM_DPRINTF(sc, IWM_DEBUG_RESET | IWM_DEBUG_EEPROM, 368 "Adding channel %d (%d Mhz) to the list\n", 369 nchan, c->ic_freq); 370 chan->channel_num = ieee80211_mhz2ieee(c->ic_freq, 0); 371 chan->iter_count = 1; 372 chan->iter_interval = htole16(0); 373 chan->flags = htole32(IWM_SCAN_CHANNEL_UMAC_NSSIDS(n_ssids)); 374 chan++; 375 nchan++; 376 } 377 378 return nchan; 379} 380 381static int 382iwm_fill_probe_req(struct iwm_softc *sc, struct iwm_scan_probe_req *preq) 383{ 384 struct ieee80211com *ic = &sc->sc_ic; 385 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 386 struct ieee80211_frame *wh = (struct ieee80211_frame *)preq->buf; 387 struct ieee80211_rateset *rs; 388 size_t remain = sizeof(preq->buf); 389 uint8_t *frm, *pos; 390 391 memset(preq, 0, sizeof(*preq)); 392 393 /* Ensure enough space for header and SSID IE. */ 394 if (remain < sizeof(*wh) + 2) 395 return ENOBUFS; 396 397 /* 398 * Build a probe request frame. Most of the following code is a 399 * copy & paste of what is done in net80211. 400 */ 401 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | 402 IEEE80211_FC0_SUBTYPE_PROBE_REQ; 403 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 404 IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr); 405 IEEE80211_ADDR_COPY(wh->i_addr2, vap ? vap->iv_myaddr : ic->ic_macaddr); 406 IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr); 407 *(uint16_t *)&wh->i_dur[0] = 0; /* filled by HW */ 408 *(uint16_t *)&wh->i_seq[0] = 0; /* filled by HW */ 409 410 frm = (uint8_t *)(wh + 1); 411 frm = ieee80211_add_ssid(frm, NULL, 0); 412 413 /* Tell the firmware where the MAC header is. */ 414 preq->mac_header.offset = 0; 415 preq->mac_header.len = htole16(frm - (uint8_t *)wh); 416 remain -= frm - (uint8_t *)wh; 417 418 /* Fill in 2GHz IEs and tell firmware where they are. */ 419 rs = &ic->ic_sup_rates[IEEE80211_MODE_11G]; 420 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 421 if (remain < 4 + rs->rs_nrates) 422 return ENOBUFS; 423 } else if (remain < 2 + rs->rs_nrates) { 424 return ENOBUFS; 425 } 426 preq->band_data[0].offset = htole16(frm - (uint8_t *)wh); 427 pos = frm; 428 frm = ieee80211_add_rates(frm, rs); 429 if (rs->rs_nrates > IEEE80211_RATE_SIZE) 430 frm = ieee80211_add_xrates(frm, rs); 431 preq->band_data[0].len = htole16(frm - pos); 432 remain -= frm - pos; 433 434 if (iwm_rrm_scan_needed(sc)) { 435 if (remain < 3) 436 return ENOBUFS; 437 *frm++ = IEEE80211_ELEMID_DSPARMS; 438 *frm++ = 1; 439 *frm++ = 0; 440 remain -= 3; 441 } 442 443 if (sc->nvm_data->sku_cap_band_52GHz_enable) { 444 /* Fill in 5GHz IEs. */ 445 rs = &ic->ic_sup_rates[IEEE80211_MODE_11A]; 446 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 447 if (remain < 4 + rs->rs_nrates) 448 return ENOBUFS; 449 } else if (remain < 2 + rs->rs_nrates) { 450 return ENOBUFS; 451 } 452 preq->band_data[1].offset = htole16(frm - (uint8_t *)wh); 453 pos = frm; 454 frm = ieee80211_add_rates(frm, rs); 455 if (rs->rs_nrates > IEEE80211_RATE_SIZE) 456 frm = ieee80211_add_xrates(frm, rs); 457 preq->band_data[1].len = htole16(frm - pos); 458 remain -= frm - pos; 459 } 460 461 /* Send 11n IEs on both 2GHz and 5GHz bands. */ 462 preq->common_data.offset = htole16(frm - (uint8_t *)wh); 463 pos = frm; 464#if 0 465 if (ic->ic_flags & IEEE80211_F_HTON) { 466 if (remain < 28) 467 return ENOBUFS; 468 frm = ieee80211_add_htcaps(frm, ic); 469 /* XXX add WME info? */ 470 } 471#endif 472 preq->common_data.len = htole16(frm - pos); 473 474 return 0; 475} 476 477int 478iwm_config_umac_scan(struct iwm_softc *sc) 479{ 480 struct ieee80211com *ic = &sc->sc_ic; 481 struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); 482 483 struct iwm_scan_config *scan_config; 484 int ret, j, nchan; 485 size_t cmd_size; 486 struct ieee80211_channel *c; 487 struct iwm_host_cmd hcmd = { 488 .id = iwm_cmd_id(IWM_SCAN_CFG_CMD, IWM_ALWAYS_LONG_GROUP, 0), 489 .flags = IWM_CMD_SYNC, 490 }; 491 static const uint32_t rates = (IWM_SCAN_CONFIG_RATE_1M | 492 IWM_SCAN_CONFIG_RATE_2M | IWM_SCAN_CONFIG_RATE_5M | 493 IWM_SCAN_CONFIG_RATE_11M | IWM_SCAN_CONFIG_RATE_6M | 494 IWM_SCAN_CONFIG_RATE_9M | IWM_SCAN_CONFIG_RATE_12M | 495 IWM_SCAN_CONFIG_RATE_18M | IWM_SCAN_CONFIG_RATE_24M | 496 IWM_SCAN_CONFIG_RATE_36M | IWM_SCAN_CONFIG_RATE_48M | 497 IWM_SCAN_CONFIG_RATE_54M); 498 499 cmd_size = sizeof(*scan_config) + sc->sc_fw.ucode_capa.n_scan_channels; 500 501 scan_config = malloc(cmd_size, M_DEVBUF, M_NOWAIT | M_ZERO); 502 if (scan_config == NULL) 503 return ENOMEM; 504 505 scan_config->tx_chains = htole32(iwm_get_valid_tx_ant(sc)); 506 scan_config->rx_chains = htole32(iwm_get_valid_rx_ant(sc)); 507 scan_config->legacy_rates = htole32(rates | 508 IWM_SCAN_CONFIG_SUPPORTED_RATE(rates)); 509 510 /* These timings correspond to iwlwifi's UNASSOC scan. */ 511 scan_config->dwell_active = 10; 512 scan_config->dwell_passive = 110; 513 scan_config->dwell_fragmented = 44; 514 scan_config->dwell_extended = 90; 515 scan_config->out_of_channel_time = htole32(0); 516 scan_config->suspend_time = htole32(0); 517 518 IEEE80211_ADDR_COPY(scan_config->mac_addr, 519 vap ? vap->iv_myaddr : ic->ic_macaddr); 520 521 scan_config->bcast_sta_id = sc->sc_aux_sta.sta_id; 522 scan_config->channel_flags = IWM_CHANNEL_FLAG_EBS | 523 IWM_CHANNEL_FLAG_ACCURATE_EBS | IWM_CHANNEL_FLAG_EBS_ADD | 524 IWM_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE; 525 526 for (nchan = j = 0; 527 j < ic->ic_nchans && nchan < sc->sc_fw.ucode_capa.n_scan_channels; 528 j++) { 529 c = &ic->ic_channels[j]; 530 /* For 2GHz, only populate 11b channels */ 531 /* For 5GHz, only populate 11a channels */ 532 /* 533 * Catch other channels, in case we have 900MHz channels or 534 * something in the chanlist. 535 */ 536 if (iwm_scan_skip_channel(c)) 537 continue; 538 scan_config->channel_array[nchan++] = 539 ieee80211_mhz2ieee(c->ic_freq, 0); 540 } 541 542 scan_config->flags = htole32(IWM_SCAN_CONFIG_FLAG_ACTIVATE | 543 IWM_SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS | 544 IWM_SCAN_CONFIG_FLAG_SET_TX_CHAINS | 545 IWM_SCAN_CONFIG_FLAG_SET_RX_CHAINS | 546 IWM_SCAN_CONFIG_FLAG_SET_AUX_STA_ID | 547 IWM_SCAN_CONFIG_FLAG_SET_ALL_TIMES | 548 IWM_SCAN_CONFIG_FLAG_SET_LEGACY_RATES | 549 IWM_SCAN_CONFIG_FLAG_SET_MAC_ADDR | 550 IWM_SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS| 551 IWM_SCAN_CONFIG_N_CHANNELS(nchan) | 552 IWM_SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED); 553 554 hcmd.data[0] = scan_config; 555 hcmd.len[0] = cmd_size; 556 557 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Sending UMAC scan config\n"); 558 559 ret = iwm_send_cmd(sc, &hcmd); 560 if (!ret) 561 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 562 "UMAC scan config was sent successfully\n"); 563 564 free(scan_config, M_DEVBUF); 565 return ret; 566} 567 568static boolean_t 569iwm_scan_use_ebs(struct iwm_softc *sc) 570{ 571 const struct iwm_ucode_capabilities *capa = &sc->sc_fw.ucode_capa; 572 573 /* We can only use EBS if: 574 * 1. the feature is supported; 575 * 2. the last EBS was successful; 576 * 3. if only single scan, the single scan EBS API is supported; 577 * 4. it's not a p2p find operation. 578 */ 579 return ((capa->flags & IWM_UCODE_TLV_FLAGS_EBS_SUPPORT) && 580 sc->last_ebs_successful); 581} 582 583static int 584iwm_scan_size(struct iwm_softc *sc) 585{ 586 int base_size; 587 588 if (iwm_fw_has_capa(sc, IWM_UCODE_TLV_CAPA_UMAC_SCAN)) { 589 if (iwm_fw_has_api(sc, IWM_UCODE_TLV_API_ADAPTIVE_DWELL)) 590 base_size = IWM_SCAN_REQ_UMAC_SIZE_V7; 591 else 592 base_size = IWM_SCAN_REQ_UMAC_SIZE_V1; 593 594 return base_size + 595 sizeof(struct iwm_scan_channel_cfg_umac) * 596 sc->sc_fw.ucode_capa.n_scan_channels + 597 sizeof(struct iwm_scan_req_umac_tail); 598 } else { 599 return sizeof(struct iwm_scan_req_lmac) + 600 sizeof(struct iwm_scan_channel_cfg_lmac) * 601 sc->sc_fw.ucode_capa.n_scan_channels + 602 sizeof(struct iwm_scan_probe_req); 603 } 604} 605 606int 607iwm_umac_scan(struct iwm_softc *sc) 608{ 609 struct iwm_host_cmd hcmd = { 610 .id = iwm_cmd_id(IWM_SCAN_REQ_UMAC, IWM_ALWAYS_LONG_GROUP, 0), 611 .len = { 0, }, 612 .data = { NULL, }, 613 .flags = IWM_CMD_SYNC, 614 }; 615 struct ieee80211_scan_state *ss = sc->sc_ic.ic_scan; 616 struct iwm_scan_req_umac *req; 617 struct iwm_scan_req_umac_tail *tail; 618 size_t req_len; 619 uint16_t general_flags; 620 uint8_t channel_flags, i, nssid; 621 int ret; 622 623 req_len = iwm_scan_size(sc); 624 if (req_len > IWM_MAX_CMD_PAYLOAD_SIZE) 625 return ENOMEM; 626 req = malloc(req_len, M_DEVBUF, M_NOWAIT | M_ZERO); 627 if (req == NULL) 628 return ENOMEM; 629 630 hcmd.len[0] = (uint16_t)req_len; 631 hcmd.data[0] = (void *)req; 632 633 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Handling ieee80211 scan request\n"); 634 635 nssid = MIN(ss->ss_nssid, IWM_PROBE_OPTION_MAX); 636 637 general_flags = IWM_UMAC_SCAN_GEN_FLAGS_PASS_ALL | 638 IWM_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE; 639 if (!iwm_fw_has_api(sc, IWM_UCODE_TLV_API_ADAPTIVE_DWELL)) 640 general_flags |= IWM_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL; 641 if (iwm_rrm_scan_needed(sc)) 642 general_flags |= IWM_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED; 643 if (nssid != 0) 644 general_flags |= IWM_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT; 645 else 646 general_flags |= IWM_UMAC_SCAN_GEN_FLAGS_PASSIVE; 647 648 channel_flags = 0; 649 if (iwm_scan_use_ebs(sc)) 650 channel_flags = IWM_SCAN_CHANNEL_FLAG_EBS | 651 IWM_SCAN_CHANNEL_FLAG_EBS_ACCURATE | 652 IWM_SCAN_CHANNEL_FLAG_CACHE_ADD; 653 654 req->general_flags = htole16(general_flags); 655 req->ooc_priority = htole32(IWM_SCAN_PRIORITY_HIGH); 656 657 /* These timings correspond to iwlwifi's UNASSOC scan. */ 658 if (iwm_fw_has_api(sc, IWM_UCODE_TLV_API_ADAPTIVE_DWELL)) { 659 req->v7.active_dwell = 10; 660 req->v7.passive_dwell = 110; 661 req->v7.fragmented_dwell = 44; 662 req->v7.adwell_default_n_aps_social = 10; 663 req->v7.adwell_default_n_aps = 2; 664 req->v7.adwell_max_budget = htole16(300); 665 req->v7.scan_priority = htole32(IWM_SCAN_PRIORITY_HIGH); 666 req->v7.channel.flags = channel_flags; 667 req->v7.channel.count = iwm_umac_scan_fill_channels(sc, 668 (struct iwm_scan_channel_cfg_umac *)req->v7.data, nssid); 669 670 tail = (void *)((char *)&req->v7.data + 671 sizeof(struct iwm_scan_channel_cfg_umac) * 672 sc->sc_fw.ucode_capa.n_scan_channels); 673 } else { 674 req->v1.active_dwell = 10; 675 req->v1.passive_dwell = 110; 676 req->v1.fragmented_dwell = 44; 677 req->v1.extended_dwell = 90; 678 req->v1.scan_priority = htole32(IWM_SCAN_PRIORITY_HIGH); 679 req->v1.channel.flags = channel_flags; 680 req->v1.channel.count = iwm_umac_scan_fill_channels(sc, 681 (struct iwm_scan_channel_cfg_umac *)req->v1.data, nssid); 682 683 tail = (void *)((char *)&req->v1.data + 684 sizeof(struct iwm_scan_channel_cfg_umac) * 685 sc->sc_fw.ucode_capa.n_scan_channels); 686 } 687 688 /* Check if we're doing an active directed scan. */ 689 for (i = 0; i < nssid; i++) { 690 tail->direct_scan[i].id = IEEE80211_ELEMID_SSID; 691 tail->direct_scan[i].len = MIN(ss->ss_ssid[i].len, 692 IEEE80211_NWID_LEN); 693 memcpy(tail->direct_scan[i].ssid, ss->ss_ssid[i].ssid, 694 tail->direct_scan[i].len); 695 /* XXX debug */ 696 } 697 698 ret = iwm_fill_probe_req(sc, &tail->preq); 699 if (ret) { 700 free(req, M_DEVBUF); 701 return ret; 702 } 703 704 /* Specify the scan plan: We'll do one iteration. */ 705 tail->schedule[0].interval = 0; 706 tail->schedule[0].iter_count = 1; 707 708 ret = iwm_send_cmd(sc, &hcmd); 709 if (!ret) 710 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 711 "Scan request was sent successfully\n"); 712 free(req, M_DEVBUF); 713 return ret; 714} 715 716int 717iwm_lmac_scan(struct iwm_softc *sc) 718{ 719 struct iwm_host_cmd hcmd = { 720 .id = IWM_SCAN_OFFLOAD_REQUEST_CMD, 721 .len = { 0, }, 722 .data = { NULL, }, 723 .flags = IWM_CMD_SYNC, 724 }; 725 struct ieee80211_scan_state *ss = sc->sc_ic.ic_scan; 726 struct iwm_scan_req_lmac *req; 727 size_t req_len; 728 uint8_t i, nssid; 729 int ret; 730 731 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 732 "Handling ieee80211 scan request\n"); 733 734 req_len = iwm_scan_size(sc); 735 if (req_len > IWM_MAX_CMD_PAYLOAD_SIZE) 736 return ENOMEM; 737 req = malloc(req_len, M_DEVBUF, M_NOWAIT | M_ZERO); 738 if (req == NULL) 739 return ENOMEM; 740 741 hcmd.len[0] = (uint16_t)req_len; 742 hcmd.data[0] = (void *)req; 743 744 /* These timings correspond to iwlwifi's UNASSOC scan. */ 745 req->active_dwell = 10; 746 req->passive_dwell = 110; 747 req->fragmented_dwell = 44; 748 req->extended_dwell = 90; 749 req->max_out_time = 0; 750 req->suspend_time = 0; 751 752 req->scan_prio = htole32(IWM_SCAN_PRIORITY_HIGH); 753 req->rx_chain_select = iwm_scan_rx_chain(sc); 754 req->iter_num = htole32(1); 755 req->delay = 0; 756 757 req->scan_flags = htole32(IWM_LMAC_SCAN_FLAG_PASS_ALL | 758 IWM_LMAC_SCAN_FLAG_ITER_COMPLETE | 759 IWM_LMAC_SCAN_FLAG_EXTENDED_DWELL); 760 if (iwm_rrm_scan_needed(sc)) 761 req->scan_flags |= htole32(IWM_LMAC_SCAN_FLAGS_RRM_ENABLED); 762 763 req->flags = iwm_scan_rxon_flags(sc->sc_ic.ic_scan->ss_chans[0]); 764 765 req->filter_flags = 766 htole32(IWM_MAC_FILTER_ACCEPT_GRP | IWM_MAC_FILTER_IN_BEACON); 767 768 /* Tx flags 2 GHz. */ 769 req->tx_cmd[0].tx_flags = htole32(IWM_TX_CMD_FLG_SEQ_CTL | 770 IWM_TX_CMD_FLG_BT_DIS); 771 req->tx_cmd[0].rate_n_flags = 772 iwm_scan_rate_n_flags(sc, IEEE80211_CHAN_2GHZ, 1/*XXX*/); 773 req->tx_cmd[0].sta_id = sc->sc_aux_sta.sta_id; 774 775 /* Tx flags 5 GHz. */ 776 req->tx_cmd[1].tx_flags = htole32(IWM_TX_CMD_FLG_SEQ_CTL | 777 IWM_TX_CMD_FLG_BT_DIS); 778 req->tx_cmd[1].rate_n_flags = 779 iwm_scan_rate_n_flags(sc, IEEE80211_CHAN_5GHZ, 1/*XXX*/); 780 req->tx_cmd[1].sta_id = sc->sc_aux_sta.sta_id; 781 782 /* Check if we're doing an active directed scan. */ 783 nssid = MIN(ss->ss_nssid, IWM_PROBE_OPTION_MAX); 784 for (i = 0; i < nssid; i++) { 785 req->direct_scan[i].id = IEEE80211_ELEMID_SSID; 786 req->direct_scan[i].len = MIN(ss->ss_ssid[i].len, 787 IEEE80211_NWID_LEN); 788 memcpy(req->direct_scan[i].ssid, ss->ss_ssid[i].ssid, 789 req->direct_scan[i].len); 790 /* XXX debug */ 791 } 792 if (nssid != 0) { 793 req->scan_flags |= 794 htole32(IWM_LMAC_SCAN_FLAG_PRE_CONNECTION); 795 } else 796 req->scan_flags |= htole32(IWM_LMAC_SCAN_FLAG_PASSIVE); 797 798 req->n_channels = iwm_lmac_scan_fill_channels(sc, 799 (struct iwm_scan_channel_cfg_lmac *)req->data, nssid); 800 801 ret = iwm_fill_probe_req(sc, 802 (struct iwm_scan_probe_req *)(req->data + 803 (sizeof(struct iwm_scan_channel_cfg_lmac) * 804 sc->sc_fw.ucode_capa.n_scan_channels))); 805 if (ret) { 806 free(req, M_DEVBUF); 807 return ret; 808 } 809 810 /* Specify the scan plan: We'll do one iteration. */ 811 req->schedule[0].iterations = 1; 812 req->schedule[0].full_scan_mul = 1; 813 814 if (iwm_scan_use_ebs(sc)) { 815 req->channel_opt[0].flags = 816 htole16(IWM_SCAN_CHANNEL_FLAG_EBS | 817 IWM_SCAN_CHANNEL_FLAG_EBS_ACCURATE | 818 IWM_SCAN_CHANNEL_FLAG_CACHE_ADD); 819 req->channel_opt[0].non_ebs_ratio = 820 htole16(IWM_DENSE_EBS_SCAN_RATIO); 821 req->channel_opt[1].flags = 822 htole16(IWM_SCAN_CHANNEL_FLAG_EBS | 823 IWM_SCAN_CHANNEL_FLAG_EBS_ACCURATE | 824 IWM_SCAN_CHANNEL_FLAG_CACHE_ADD); 825 req->channel_opt[1].non_ebs_ratio = 826 htole16(IWM_SPARSE_EBS_SCAN_RATIO); 827 } 828 829 ret = iwm_send_cmd(sc, &hcmd); 830 if (!ret) { 831 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 832 "Scan request was sent successfully\n"); 833 } 834 free(req, M_DEVBUF); 835 return ret; 836} 837 838static int 839iwm_lmac_scan_abort(struct iwm_softc *sc) 840{ 841 int ret; 842 struct iwm_host_cmd hcmd = { 843 .id = IWM_SCAN_OFFLOAD_ABORT_CMD, 844 .len = { 0, }, 845 .data = { NULL, }, 846 .flags = IWM_CMD_SYNC, 847 }; 848 uint32_t status; 849 850 ret = iwm_send_cmd_status(sc, &hcmd, &status); 851 if (ret) 852 return ret; 853 854 if (status != IWM_CAN_ABORT_STATUS) { 855 /* 856 * The scan abort will return 1 for success or 857 * 2 for "failure". A failure condition can be 858 * due to simply not being in an active scan which 859 * can occur if we send the scan abort before the 860 * microcode has notified us that a scan is completed. 861 */ 862 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, 863 "SCAN OFFLOAD ABORT ret %d.\n", status); 864 ret = ENOENT; 865 } 866 867 return ret; 868} 869 870static int 871iwm_umac_scan_abort(struct iwm_softc *sc) 872{ 873 struct iwm_umac_scan_abort cmd = {}; 874 int uid, ret; 875 876 uid = 0; 877 cmd.uid = htole32(uid); 878 879 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Sending scan abort, uid %u\n", uid); 880 881 ret = iwm_send_cmd_pdu(sc, 882 iwm_cmd_id(IWM_SCAN_ABORT_UMAC, 883 IWM_ALWAYS_LONG_GROUP, 0), 884 0, sizeof(cmd), &cmd); 885 886 return ret; 887} 888 889int 890iwm_scan_stop_wait(struct iwm_softc *sc) 891{ 892 struct iwm_notification_wait wait_scan_done; 893 static const uint16_t scan_done_notif[] = { IWM_SCAN_COMPLETE_UMAC, 894 IWM_SCAN_OFFLOAD_COMPLETE, }; 895 int ret; 896 897 iwm_init_notification_wait(sc->sc_notif_wait, &wait_scan_done, 898 scan_done_notif, nitems(scan_done_notif), 899 NULL, NULL); 900 901 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "Preparing to stop scan\n"); 902 903 if (iwm_fw_has_capa(sc, IWM_UCODE_TLV_CAPA_UMAC_SCAN)) 904 ret = iwm_umac_scan_abort(sc); 905 else 906 ret = iwm_lmac_scan_abort(sc); 907 908 if (ret) { 909 IWM_DPRINTF(sc, IWM_DEBUG_SCAN, "couldn't stop scan\n"); 910 iwm_remove_notification(sc->sc_notif_wait, &wait_scan_done); 911 return ret; 912 } 913 914 IWM_UNLOCK(sc); 915 ret = iwm_wait_notification(sc->sc_notif_wait, &wait_scan_done, hz); 916 IWM_LOCK(sc); 917 918 return ret; 919} 920