scan.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Scanning implementation
   4 *
   5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   6 * Copyright 2004, Instant802 Networks, Inc.
   7 * Copyright 2005, Devicescape Software, Inc.
   8 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
   9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  10 * Copyright 2013-2015  Intel Mobile Communications GmbH
  11 * Copyright 2016-2017  Intel Deutschland GmbH
  12 * Copyright (C) 2018-2025 Intel Corporation
  13 */
  14
  15#include <linux/if_arp.h>
  16#include <linux/etherdevice.h>
  17#include <linux/rtnetlink.h>
  18#include <net/sch_generic.h>
  19#include <linux/slab.h>
  20#include <linux/export.h>
  21#include <linux/random.h>
  22#include <net/mac80211.h>
  23
  24#include "ieee80211_i.h"
  25#include "driver-ops.h"
  26#include "mesh.h"
  27
  28#define IEEE80211_PROBE_DELAY (HZ / 33)
  29#define IEEE80211_CHANNEL_TIME (HZ / 33)
  30#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9)
  31
  32void ieee80211_rx_bss_put(struct ieee80211_local *local,
  33			  struct ieee80211_bss *bss)
  34{
  35	if (!bss)
  36		return;
  37	cfg80211_put_bss(local->hw.wiphy,
  38			 container_of((void *)bss, struct cfg80211_bss, priv));
  39}
  40
  41static bool is_uapsd_supported(struct ieee802_11_elems *elems)
  42{
  43	u8 qos_info;
  44
  45	if (elems->wmm_info && elems->wmm_info_len == 7
  46	    && elems->wmm_info[5] == 1)
  47		qos_info = elems->wmm_info[6];
  48	else if (elems->wmm_param && elems->wmm_param_len == 24
  49		 && elems->wmm_param[5] == 1)
  50		qos_info = elems->wmm_param[6];
  51	else
  52		/* no valid wmm information or parameter element found */
  53		return false;
  54
  55	return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD;
  56}
  57
  58struct inform_bss_update_data {
  59	struct ieee80211_rx_status *rx_status;
  60	bool beacon;
  61};
  62
  63void ieee80211_inform_bss(struct wiphy *wiphy,
  64			  struct cfg80211_bss *cbss,
  65			  const struct cfg80211_bss_ies *ies,
  66			  void *data)
  67{
  68	struct ieee80211_local *local = wiphy_priv(wiphy);
  69	struct inform_bss_update_data *update_data = data;
  70	struct ieee80211_bss *bss = (void *)cbss->priv;
  71	struct ieee80211_rx_status *rx_status;
  72	struct ieee802_11_elems *elems;
  73	int clen, srlen;
  74
  75	/* This happens while joining an IBSS */
  76	if (!update_data)
  77		return;
  78
  79	elems = ieee802_11_parse_elems(ies->data, ies->len,
  80				       update_data->beacon ?
  81					IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON :
  82					IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP,
  83				       NULL);
  84	if (!elems)
  85		return;
  86
  87	rx_status = update_data->rx_status;
  88
  89	if (update_data->beacon)
  90		bss->device_ts_beacon = rx_status->device_timestamp;
  91	else
  92		bss->device_ts_presp = rx_status->device_timestamp;
  93
  94	if (elems->parse_error) {
  95		if (update_data->beacon)
  96			bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON;
  97		else
  98			bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP;
  99	} else {
 100		if (update_data->beacon)
 101			bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON;
 102		else
 103			bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP;
 104	}
 105
 106	/* save the ERP value so that it is available at association time */
 107	if (elems->erp_info && (!elems->parse_error ||
 108				!(bss->valid_data & IEEE80211_BSS_VALID_ERP))) {
 109		bss->erp_value = elems->erp_info[0];
 110		bss->has_erp_value = true;
 111		if (!elems->parse_error)
 112			bss->valid_data |= IEEE80211_BSS_VALID_ERP;
 113	}
 114
 115	/* replace old supported rates if we get new values */
 116	if (!elems->parse_error ||
 117	    !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
 118		srlen = 0;
 119		if (elems->supp_rates) {
 120			clen = IEEE80211_MAX_SUPP_RATES;
 121			if (clen > elems->supp_rates_len)
 122				clen = elems->supp_rates_len;
 123			memcpy(bss->supp_rates, elems->supp_rates, clen);
 124			srlen += clen;
 125		}
 126		if (elems->ext_supp_rates) {
 127			clen = IEEE80211_MAX_SUPP_RATES - srlen;
 128			if (clen > elems->ext_supp_rates_len)
 129				clen = elems->ext_supp_rates_len;
 130			memcpy(bss->supp_rates + srlen, elems->ext_supp_rates,
 131			       clen);
 132			srlen += clen;
 133		}
 134		if (srlen) {
 135			bss->supp_rates_len = srlen;
 136			if (!elems->parse_error)
 137				bss->valid_data |= IEEE80211_BSS_VALID_RATES;
 138		}
 139	}
 140
 141	if (!elems->parse_error ||
 142	    !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) {
 143		bss->wmm_used = elems->wmm_param || elems->wmm_info;
 144		bss->uapsd_supported = is_uapsd_supported(elems);
 145		if (!elems->parse_error)
 146			bss->valid_data |= IEEE80211_BSS_VALID_WMM;
 147	}
 148
 149	if (update_data->beacon) {
 150		struct ieee80211_supported_band *sband =
 151			local->hw.wiphy->bands[rx_status->band];
 152		if (!(rx_status->encoding == RX_ENC_HT) &&
 153		    !(rx_status->encoding == RX_ENC_VHT))
 154			bss->beacon_rate =
 155				&sband->bitrates[rx_status->rate_idx];
 156	}
 157
 158	if (elems->vht_cap_elem)
 159		bss->vht_cap_info =
 160			le32_to_cpu(elems->vht_cap_elem->vht_cap_info);
 161	else
 162		bss->vht_cap_info = 0;
 163
 164	kfree(elems);
 165}
 166
 167struct ieee80211_bss *
 168ieee80211_bss_info_update(struct ieee80211_local *local,
 169			  struct ieee80211_rx_status *rx_status,
 170			  struct ieee80211_mgmt *mgmt, size_t len,
 171			  struct ieee80211_channel *channel)
 172{
 173	bool beacon = ieee80211_is_beacon(mgmt->frame_control) ||
 174		      ieee80211_is_s1g_beacon(mgmt->frame_control);
 175	struct cfg80211_bss *cbss;
 176	struct inform_bss_update_data update_data = {
 177		.rx_status = rx_status,
 178		.beacon = beacon,
 179	};
 180	struct cfg80211_inform_bss bss_meta = {
 181		.boottime_ns = rx_status->boottime_ns,
 182		.drv_data = (void *)&update_data,
 183	};
 184	bool signal_valid;
 185	struct ieee80211_sub_if_data *scan_sdata;
 186
 187	if (rx_status->flag & RX_FLAG_NO_SIGNAL_VAL)
 188		bss_meta.signal = 0; /* invalid signal indication */
 189	else if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
 190		bss_meta.signal = rx_status->signal * 100;
 191	else if (ieee80211_hw_check(&local->hw, SIGNAL_UNSPEC))
 192		bss_meta.signal = (rx_status->signal * 100) / local->hw.max_signal;
 193
 194	bss_meta.chan = channel;
 195
 196	rcu_read_lock();
 197	scan_sdata = rcu_dereference(local->scan_sdata);
 198	if (scan_sdata && scan_sdata->vif.type == NL80211_IFTYPE_STATION &&
 199	    scan_sdata->vif.cfg.assoc &&
 200	    ieee80211_have_rx_timestamp(rx_status)) {
 201		struct ieee80211_bss_conf *link_conf = NULL;
 202
 203		/* for an MLO connection, set the TSF data only in case we have
 204		 * an indication on which of the links the frame was received
 205		 */
 206		if (ieee80211_vif_is_mld(&scan_sdata->vif)) {
 207			if (rx_status->link_valid) {
 208				s8 link_id = rx_status->link_id;
 209
 210				link_conf =
 211					rcu_dereference(scan_sdata->vif.link_conf[link_id]);
 212			}
 213		} else {
 214			link_conf = &scan_sdata->vif.bss_conf;
 215		}
 216
 217		if (link_conf) {
 218			bss_meta.parent_tsf =
 219				ieee80211_calculate_rx_timestamp(local,
 220								 rx_status,
 221								 len + FCS_LEN,
 222								 24);
 223
 224			ether_addr_copy(bss_meta.parent_bssid,
 225					link_conf->bssid);
 226		}
 227	}
 228	rcu_read_unlock();
 229
 230	cbss = cfg80211_inform_bss_frame_data(local->hw.wiphy, &bss_meta,
 231					      mgmt, len, GFP_ATOMIC);
 232	if (!cbss)
 233		return NULL;
 234
 235	/* In case the signal is invalid update the status */
 236	signal_valid = channel == cbss->channel;
 237	if (!signal_valid)
 238		rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
 239
 240	return (void *)cbss->priv;
 241}
 242
 243static bool ieee80211_scan_accept_presp(struct ieee80211_sub_if_data *sdata,
 244					struct ieee80211_channel *channel,
 245					u32 scan_flags, const u8 *da)
 246{
 247	struct ieee80211_link_data *link_sdata;
 248	u8 link_id;
 249
 250	if (!sdata)
 251		return false;
 252
 253	/* accept broadcast on 6 GHz and for OCE */
 254	if (is_broadcast_ether_addr(da) &&
 255	    (channel->band == NL80211_BAND_6GHZ ||
 256	     scan_flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP))
 257		return true;
 258
 259	if (scan_flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
 260		return true;
 261
 262	if (ether_addr_equal(da, sdata->vif.addr))
 263		return true;
 264
 265	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
 266		link_sdata = rcu_dereference(sdata->link[link_id]);
 267		if (!link_sdata)
 268			continue;
 269
 270		if (ether_addr_equal(da, link_sdata->conf->addr))
 271			return true;
 272	}
 273
 274	return false;
 275}
 276
 277void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
 278{
 279	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
 280	struct ieee80211_mgmt *mgmt = (void *)skb->data;
 281	struct ieee80211_bss *bss;
 282	struct ieee80211_channel *channel;
 283	struct ieee80211_ext *ext;
 284	size_t min_hdr_len = offsetof(struct ieee80211_mgmt,
 285				      u.probe_resp.variable);
 286
 287	if (!ieee80211_is_probe_resp(mgmt->frame_control) &&
 288	    !ieee80211_is_beacon(mgmt->frame_control) &&
 289	    !ieee80211_is_s1g_beacon(mgmt->frame_control))
 290		return;
 291
 292	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
 293		ext = (struct ieee80211_ext *)mgmt;
 294		min_hdr_len =
 295			offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
 296			ieee80211_s1g_optional_len(ext->frame_control);
 297	}
 298
 299	if (skb->len < min_hdr_len)
 300		return;
 301
 302	if (test_and_clear_bit(SCAN_BEACON_WAIT, &local->scanning)) {
 303		/*
 304		 * we were passive scanning because of radar/no-IR, but
 305		 * the beacon/proberesp rx gives us an opportunity to upgrade
 306		 * to active scan
 307		 */
 308		set_bit(SCAN_BEACON_DONE, &local->scanning);
 309		wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
 310	}
 311
 312	channel = ieee80211_get_channel_khz(local->hw.wiphy,
 313					    ieee80211_rx_status_to_khz(rx_status));
 314
 315	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
 316		return;
 317
 318	if (ieee80211_is_probe_resp(mgmt->frame_control)) {
 319		struct ieee80211_sub_if_data *sdata1, *sdata2;
 320		struct cfg80211_scan_request *scan_req;
 321		struct cfg80211_sched_scan_request *sched_scan_req;
 322		u32 scan_req_flags = 0, sched_scan_req_flags = 0;
 323
 324		sdata1 = rcu_dereference(local->scan_sdata);
 325		sdata2 = rcu_dereference(local->sched_scan_sdata);
 326
 327		if (likely(!sdata1 && !sdata2))
 328			return;
 329
 330		scan_req = rcu_dereference(local->scan_req);
 331		sched_scan_req = rcu_dereference(local->sched_scan_req);
 332
 333		if (scan_req)
 334			scan_req_flags = scan_req->flags;
 335
 336		if (sched_scan_req)
 337			sched_scan_req_flags = sched_scan_req->flags;
 338
 339		/* ignore ProbeResp to foreign address or non-bcast (OCE)
 340		 * unless scanning with randomised address
 341		 */
 342		if (!ieee80211_scan_accept_presp(sdata1, channel,
 343						 scan_req_flags,
 344						 mgmt->da) &&
 345		    !ieee80211_scan_accept_presp(sdata2, channel,
 346						 sched_scan_req_flags,
 347						 mgmt->da))
 348			return;
 349	} else {
 350		/*
 351		 * Non-S1G beacons are expected only with broadcast address.
 352		 * S1G beacons only carry the SA so no DA check is required
 353		 * nor possible.
 354		 */
 355		if (!ieee80211_is_s1g_beacon(mgmt->frame_control) &&
 356		    !is_broadcast_ether_addr(mgmt->da))
 357			return;
 358	}
 359
 360	/* Do not update the BSS table in case of only monitor interfaces */
 361	if (local->open_count == local->monitors)
 362		return;
 363
 364	bss = ieee80211_bss_info_update(local, rx_status,
 365					mgmt, skb->len,
 366					channel);
 367	if (bss)
 368		ieee80211_rx_bss_put(local, bss);
 369}
 370
 371static void ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef)
 372{
 373	memset(chandef, 0, sizeof(*chandef));
 374
 375	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 376}
 377
 378/* return false if no more work */
 379static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata)
 380{
 381	struct ieee80211_local *local = sdata->local;
 382	struct cfg80211_scan_request *req;
 383	struct cfg80211_chan_def chandef;
 384	u8 bands_used = 0;
 385	int i, ielen;
 386	u32 *n_chans;
 387	u32 flags = 0;
 388
 389	req = rcu_dereference_protected(local->scan_req,
 390					lockdep_is_held(&local->hw.wiphy->mtx));
 391
 392	if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
 393		return false;
 394
 395	if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {
 396		local->hw_scan_req->req.n_channels = req->n_channels;
 397
 398		for (i = 0; i < req->n_channels; i++) {
 399			local->hw_scan_req->req.channels[i] = req->channels[i];
 400			bands_used |= BIT(req->channels[i]->band);
 401		}
 402	} else {
 403		do {
 404			if (local->hw_scan_band == NUM_NL80211_BANDS)
 405				return false;
 406
 407			n_chans = &local->hw_scan_req->req.n_channels;
 408			*n_chans = 0;
 409
 410			for (i = 0; i < req->n_channels; i++) {
 411				if (req->channels[i]->band !=
 412				    local->hw_scan_band)
 413					continue;
 414				local->hw_scan_req->req.channels[(*n_chans)++] =
 415							req->channels[i];
 416
 417				bands_used |= BIT(req->channels[i]->band);
 418			}
 419
 420			local->hw_scan_band++;
 421		} while (!*n_chans);
 422	}
 423
 424	ieee80211_prepare_scan_chandef(&chandef);
 425
 426	if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
 427		flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
 428
 429	ielen = ieee80211_build_preq_ies(sdata,
 430					 (u8 *)local->hw_scan_req->req.ie,
 431					 local->hw_scan_ies_bufsize,
 432					 &local->hw_scan_req->ies,
 433					 req->ie, req->ie_len,
 434					 bands_used, req->rates, &chandef,
 435					 flags);
 436	if (ielen < 0)
 437		return false;
 438	local->hw_scan_req->req.ie_len = ielen;
 439	local->hw_scan_req->req.no_cck = req->no_cck;
 440	ether_addr_copy(local->hw_scan_req->req.mac_addr, req->mac_addr);
 441	ether_addr_copy(local->hw_scan_req->req.mac_addr_mask,
 442			req->mac_addr_mask);
 443	ether_addr_copy(local->hw_scan_req->req.bssid, req->bssid);
 444
 445	return true;
 446}
 447
 448static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 449{
 450	struct ieee80211_local *local = hw_to_local(hw);
 451	bool hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
 452	bool was_scanning = local->scanning;
 453	struct cfg80211_scan_request *scan_req;
 454	struct ieee80211_sub_if_data *scan_sdata;
 455	struct ieee80211_sub_if_data *sdata;
 456
 457	lockdep_assert_wiphy(local->hw.wiphy);
 458
 459	/*
 460	 * It's ok to abort a not-yet-running scan (that
 461	 * we have one at all will be verified by checking
 462	 * local->scan_req next), but not to complete it
 463	 * successfully.
 464	 */
 465	if (WARN_ON(!local->scanning && !aborted))
 466		aborted = true;
 467
 468	if (WARN_ON(!local->scan_req))
 469		return;
 470
 471	scan_sdata = rcu_dereference_protected(local->scan_sdata,
 472					       lockdep_is_held(&local->hw.wiphy->mtx));
 473
 474	if (hw_scan && !aborted &&
 475	    !ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS) &&
 476	    ieee80211_prep_hw_scan(scan_sdata)) {
 477		int rc;
 478
 479		rc = drv_hw_scan(local,
 480			rcu_dereference_protected(local->scan_sdata,
 481						  lockdep_is_held(&local->hw.wiphy->mtx)),
 482			local->hw_scan_req);
 483
 484		if (rc == 0)
 485			return;
 486
 487		/* HW scan failed and is going to be reported as aborted,
 488		 * so clear old scan info.
 489		 */
 490		memset(&local->scan_info, 0, sizeof(local->scan_info));
 491		aborted = true;
 492	}
 493
 494	kfree(local->hw_scan_req);
 495	local->hw_scan_req = NULL;
 496
 497	scan_req = rcu_dereference_protected(local->scan_req,
 498					     lockdep_is_held(&local->hw.wiphy->mtx));
 499
 500	RCU_INIT_POINTER(local->scan_req, NULL);
 501	RCU_INIT_POINTER(local->scan_sdata, NULL);
 502
 503	local->scanning = 0;
 504	local->scan_chandef.chan = NULL;
 505
 506	synchronize_rcu();
 507
 508	if (scan_req != local->int_scan_req) {
 509		local->scan_info.aborted = aborted;
 510		cfg80211_scan_done(scan_req, &local->scan_info);
 511	}
 512
 513	/* Set power back to normal operating levels. */
 514	ieee80211_hw_conf_chan(local);
 515
 516	if (!hw_scan && was_scanning) {
 517		ieee80211_configure_filter(local);
 518		drv_sw_scan_complete(local, scan_sdata);
 519		ieee80211_offchannel_return(local);
 520	}
 521
 522	ieee80211_recalc_idle(local);
 523
 524	ieee80211_mlme_notify_scan_completed(local);
 525	ieee80211_ibss_notify_scan_completed(local);
 526
 527	/* Requeue all the work that might have been ignored while
 528	 * the scan was in progress; if there was none this will
 529	 * just be a no-op for the particular interface.
 530	 */
 531	list_for_each_entry(sdata, &local->interfaces, list) {
 532		if (ieee80211_sdata_running(sdata))
 533			wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
 534	}
 535
 536	if (was_scanning)
 537		ieee80211_start_next_roc(local);
 538}
 539
 540void ieee80211_scan_completed(struct ieee80211_hw *hw,
 541			      struct cfg80211_scan_info *info)
 542{
 543	struct ieee80211_local *local = hw_to_local(hw);
 544
 545	trace_api_scan_completed(local, info->aborted);
 546
 547	set_bit(SCAN_COMPLETED, &local->scanning);
 548	if (info->aborted)
 549		set_bit(SCAN_ABORTED, &local->scanning);
 550
 551	memcpy(&local->scan_info, info, sizeof(*info));
 552
 553	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
 554}
 555EXPORT_SYMBOL(ieee80211_scan_completed);
 556
 557static int ieee80211_start_sw_scan(struct ieee80211_local *local,
 558				   struct ieee80211_sub_if_data *sdata)
 559{
 560	/* Software scan is not supported in multi-channel cases */
 561	if (!local->emulate_chanctx)
 562		return -EOPNOTSUPP;
 563
 564	/*
 565	 * Hardware/driver doesn't support hw_scan, so use software
 566	 * scanning instead. First send a nullfunc frame with power save
 567	 * bit on so that AP will buffer the frames for us while we are not
 568	 * listening, then send probe requests to each channel and wait for
 569	 * the responses. After all channels are scanned, tune back to the
 570	 * original channel and send a nullfunc frame with power save bit
 571	 * off to trigger the AP to send us all the buffered frames.
 572	 *
 573	 * Note that while local->sw_scanning is true everything else but
 574	 * nullfunc frames and probe requests will be dropped in
 575	 * ieee80211_tx_h_check_assoc().
 576	 */
 577	drv_sw_scan_start(local, sdata, local->scan_addr);
 578
 579	local->leave_oper_channel_time = jiffies;
 580	local->next_scan_state = SCAN_DECISION;
 581	local->scan_channel_idx = 0;
 582
 583	ieee80211_offchannel_stop_vifs(local);
 584
 585	/* ensure nullfunc is transmitted before leaving operating channel */
 586	ieee80211_flush_queues(local, NULL, false);
 587
 588	ieee80211_configure_filter(local);
 589
 590	/* We need to set power level at maximum rate for scanning. */
 591	ieee80211_hw_conf_chan(local);
 592
 593	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
 594
 595	return 0;
 596}
 597
 598static bool __ieee80211_can_leave_ch(struct ieee80211_sub_if_data *sdata,
 599				     struct cfg80211_scan_request *req)
 600{
 601	struct ieee80211_local *local = sdata->local;
 602	struct ieee80211_sub_if_data *sdata_iter;
 603	unsigned int link_id;
 604
 605	lockdep_assert_wiphy(local->hw.wiphy);
 606
 607	if (!ieee80211_is_radar_required(local, req))
 608		return true;
 609
 610	if (!regulatory_pre_cac_allowed(local->hw.wiphy))
 611		return false;
 612
 613	list_for_each_entry(sdata_iter, &local->interfaces, list) {
 614		for_each_valid_link(&sdata_iter->wdev, link_id)
 615			if (sdata_iter->wdev.links[link_id].cac_started)
 616				return false;
 617	}
 618
 619	return true;
 620}
 621
 622static bool ieee80211_can_scan(struct ieee80211_local *local,
 623			       struct ieee80211_sub_if_data *sdata,
 624			       struct cfg80211_scan_request *req)
 625{
 626	if (!__ieee80211_can_leave_ch(sdata, req))
 627		return false;
 628
 629	if (!list_empty(&local->roc_list))
 630		return false;
 631
 632	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 633	    sdata->u.mgd.flags & IEEE80211_STA_CONNECTION_POLL)
 634		return false;
 635
 636	return true;
 637}
 638
 639void ieee80211_run_deferred_scan(struct ieee80211_local *local)
 640{
 641	struct cfg80211_scan_request *req;
 642
 643	lockdep_assert_wiphy(local->hw.wiphy);
 644
 645	if (!local->scan_req || local->scanning)
 646		return;
 647
 648	req = wiphy_dereference(local->hw.wiphy, local->scan_req);
 649	if (!ieee80211_can_scan(local,
 650				rcu_dereference_protected(
 651					local->scan_sdata,
 652					lockdep_is_held(&local->hw.wiphy->mtx)),
 653				req))
 654		return;
 655
 656	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
 657				 round_jiffies_relative(0));
 658}
 659
 660static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,
 661					  const u8 *src, const u8 *dst,
 662					  const u8 *ssid, size_t ssid_len,
 663					  const u8 *ie, size_t ie_len,
 664					  u32 ratemask, u32 flags, u32 tx_flags,
 665					  struct ieee80211_channel *channel)
 666{
 667	struct sk_buff *skb;
 668
 669	skb = ieee80211_build_probe_req(sdata, src, dst, ratemask, channel,
 670					ssid, ssid_len,
 671					ie, ie_len, flags);
 672
 673	if (skb) {
 674		if (flags & IEEE80211_PROBE_FLAG_RANDOM_SN) {
 675			struct ieee80211_hdr *hdr = (void *)skb->data;
 676			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 677			u16 sn = get_random_u16();
 678
 679			info->control.flags |= IEEE80211_TX_CTRL_NO_SEQNO;
 680			hdr->seq_ctrl =
 681				cpu_to_le16(IEEE80211_SN_TO_SEQ(sn));
 682		}
 683		IEEE80211_SKB_CB(skb)->flags |= tx_flags;
 684		IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_DONT_USE_RATE_MASK;
 685		ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band);
 686	}
 687}
 688
 689static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
 690					    unsigned long *next_delay)
 691{
 692	int i;
 693	struct ieee80211_sub_if_data *sdata;
 694	struct cfg80211_scan_request *scan_req;
 695	enum nl80211_band band = local->hw.conf.chandef.chan->band;
 696	u32 flags = 0, tx_flags;
 697
 698	scan_req = rcu_dereference_protected(local->scan_req,
 699					     lockdep_is_held(&local->hw.wiphy->mtx));
 700
 701	tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
 702	if (scan_req->no_cck)
 703		tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 704	if (scan_req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
 705		flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
 706	if (scan_req->flags & NL80211_SCAN_FLAG_RANDOM_SN)
 707		flags |= IEEE80211_PROBE_FLAG_RANDOM_SN;
 708
 709	sdata = rcu_dereference_protected(local->scan_sdata,
 710					  lockdep_is_held(&local->hw.wiphy->mtx));
 711
 712	for (i = 0; i < scan_req->n_ssids; i++)
 713		ieee80211_send_scan_probe_req(
 714			sdata, local->scan_addr, scan_req->bssid,
 715			scan_req->ssids[i].ssid, scan_req->ssids[i].ssid_len,
 716			scan_req->ie, scan_req->ie_len,
 717			scan_req->rates[band], flags,
 718			tx_flags, local->hw.conf.chandef.chan);
 719
 720	/*
 721	 * After sending probe requests, wait for probe responses
 722	 * on the channel.
 723	 */
 724	*next_delay = msecs_to_jiffies(scan_req->duration) >
 725		      IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME ?
 726		      msecs_to_jiffies(scan_req->duration) - IEEE80211_PROBE_DELAY :
 727		      IEEE80211_CHANNEL_TIME;
 728	local->next_scan_state = SCAN_DECISION;
 729}
 730
 731static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 732				  struct cfg80211_scan_request *req)
 733{
 734	struct ieee80211_local *local = sdata->local;
 735	bool hw_scan = local->ops->hw_scan;
 736	int rc;
 737
 738	lockdep_assert_wiphy(local->hw.wiphy);
 739
 740	if (local->scan_req)
 741		return -EBUSY;
 742
 743	/* For an MLO connection, if a link ID was specified, validate that it
 744	 * is indeed active.
 745	 */
 746	if (ieee80211_vif_is_mld(&sdata->vif) && req->tsf_report_link_id >= 0 &&
 747	    !(sdata->vif.active_links & BIT(req->tsf_report_link_id)))
 748		return -EINVAL;
 749
 750	if (!__ieee80211_can_leave_ch(sdata, req))
 751		return -EBUSY;
 752
 753	if (!ieee80211_can_scan(local, sdata, req)) {
 754		/* wait for the work to finish/time out */
 755		rcu_assign_pointer(local->scan_req, req);
 756		rcu_assign_pointer(local->scan_sdata, sdata);
 757		return 0;
 758	}
 759
 760 again:
 761	if (hw_scan) {
 762		u8 *ies;
 763
 764		local->hw_scan_ies_bufsize = local->scan_ies_len + req->ie_len;
 765
 766		if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {
 767			int i, n_bands = 0;
 768			u8 bands_counted = 0;
 769
 770			for (i = 0; i < req->n_channels; i++) {
 771				if (bands_counted & BIT(req->channels[i]->band))
 772					continue;
 773				bands_counted |= BIT(req->channels[i]->band);
 774				n_bands++;
 775			}
 776
 777			local->hw_scan_ies_bufsize *= n_bands;
 778		}
 779
 780		local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req,
 781							 req.channels,
 782							 req->n_channels) +
 783					     local->hw_scan_ies_bufsize,
 784					     GFP_KERNEL);
 785		if (!local->hw_scan_req)
 786			return -ENOMEM;
 787
 788		local->hw_scan_req->req.ssids = req->ssids;
 789		local->hw_scan_req->req.n_ssids = req->n_ssids;
 790		/* None of the channels are actually set
 791		 * up but let UBSAN know the boundaries.
 792		 */
 793		local->hw_scan_req->req.n_channels = req->n_channels;
 794
 795		ies = (u8 *)local->hw_scan_req +
 796			sizeof(*local->hw_scan_req) +
 797			req->n_channels * sizeof(req->channels[0]);
 798		local->hw_scan_req->req.ie = ies;
 799		local->hw_scan_req->req.flags = req->flags;
 800		eth_broadcast_addr(local->hw_scan_req->req.bssid);
 801		local->hw_scan_req->req.duration = req->duration;
 802		local->hw_scan_req->req.duration_mandatory =
 803			req->duration_mandatory;
 804		local->hw_scan_req->req.tsf_report_link_id =
 805			req->tsf_report_link_id;
 806
 807		local->hw_scan_band = 0;
 808		local->hw_scan_req->req.n_6ghz_params = req->n_6ghz_params;
 809		local->hw_scan_req->req.scan_6ghz_params =
 810			req->scan_6ghz_params;
 811		local->hw_scan_req->req.scan_6ghz = req->scan_6ghz;
 812		local->hw_scan_req->req.first_part = req->first_part;
 813
 814		/*
 815		 * After allocating local->hw_scan_req, we must
 816		 * go through until ieee80211_prep_hw_scan(), so
 817		 * anything that might be changed here and leave
 818		 * this function early must not go after this
 819		 * allocation.
 820		 */
 821	}
 822
 823	rcu_assign_pointer(local->scan_req, req);
 824	rcu_assign_pointer(local->scan_sdata, sdata);
 825
 826	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
 827		get_random_mask_addr(local->scan_addr,
 828				     req->mac_addr,
 829				     req->mac_addr_mask);
 830	else
 831		memcpy(local->scan_addr, sdata->vif.addr, ETH_ALEN);
 832
 833	if (hw_scan) {
 834		__set_bit(SCAN_HW_SCANNING, &local->scanning);
 835	} else if ((req->n_channels == 1) &&
 836		   (req->channels[0] == local->hw.conf.chandef.chan)) {
 837		/*
 838		 * If we are scanning only on the operating channel
 839		 * then we do not need to stop normal activities
 840		 */
 841		unsigned long next_delay;
 842
 843		__set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
 844
 845		ieee80211_recalc_idle(local);
 846
 847		/* Notify driver scan is starting, keep order of operations
 848		 * same as normal software scan, in case that matters. */
 849		drv_sw_scan_start(local, sdata, local->scan_addr);
 850
 851		ieee80211_configure_filter(local); /* accept probe-responses */
 852
 853		/* We need to ensure power level is at max for scanning. */
 854		ieee80211_hw_conf_chan(local);
 855
 856		if ((req->channels[0]->flags & (IEEE80211_CHAN_NO_IR |
 857						IEEE80211_CHAN_RADAR)) ||
 858		    !req->n_ssids) {
 859			next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
 860			if (req->n_ssids)
 861				set_bit(SCAN_BEACON_WAIT, &local->scanning);
 862		} else {
 863			ieee80211_scan_state_send_probe(local, &next_delay);
 864			next_delay = IEEE80211_CHANNEL_TIME;
 865		}
 866
 867		/* Now, just wait a bit and we are all done! */
 868		wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
 869					 next_delay);
 870		return 0;
 871	} else {
 872		/* Do normal software scan */
 873		__set_bit(SCAN_SW_SCANNING, &local->scanning);
 874	}
 875
 876	ieee80211_recalc_idle(local);
 877
 878	if (hw_scan) {
 879		WARN_ON(!ieee80211_prep_hw_scan(sdata));
 880		rc = drv_hw_scan(local, sdata, local->hw_scan_req);
 881	} else {
 882		rc = ieee80211_start_sw_scan(local, sdata);
 883	}
 884
 885	if (rc) {
 886		kfree(local->hw_scan_req);
 887		local->hw_scan_req = NULL;
 888		local->scanning = 0;
 889
 890		ieee80211_recalc_idle(local);
 891
 892		local->scan_req = NULL;
 893		RCU_INIT_POINTER(local->scan_sdata, NULL);
 894	}
 895
 896	if (hw_scan && rc == 1) {
 897		/*
 898		 * we can't fall back to software for P2P-GO
 899		 * as it must update NoA etc.
 900		 */
 901		if (ieee80211_vif_type_p2p(&sdata->vif) ==
 902				NL80211_IFTYPE_P2P_GO)
 903			return -EOPNOTSUPP;
 904		hw_scan = false;
 905		goto again;
 906	}
 907
 908	return rc;
 909}
 910
 911static unsigned long
 912ieee80211_scan_get_channel_time(struct ieee80211_channel *chan)
 913{
 914	/*
 915	 * TODO: channel switching also consumes quite some time,
 916	 * add that delay as well to get a better estimation
 917	 */
 918	if (chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR))
 919		return IEEE80211_PASSIVE_CHANNEL_TIME;
 920	return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME;
 921}
 922
 923static void ieee80211_scan_state_decision(struct ieee80211_local *local,
 924					  unsigned long *next_delay)
 925{
 926	bool associated = false;
 927	bool tx_empty = true;
 928	bool bad_latency;
 929	struct ieee80211_sub_if_data *sdata;
 930	struct ieee80211_channel *next_chan;
 931	enum mac80211_scan_state next_scan_state;
 932	struct cfg80211_scan_request *scan_req;
 933
 934	lockdep_assert_wiphy(local->hw.wiphy);
 935
 936	/*
 937	 * check if at least one STA interface is associated,
 938	 * check if at least one STA interface has pending tx frames
 939	 * and grab the lowest used beacon interval
 940	 */
 941	list_for_each_entry(sdata, &local->interfaces, list) {
 942		if (!ieee80211_sdata_running(sdata))
 943			continue;
 944
 945		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
 946			if (sdata->u.mgd.associated) {
 947				associated = true;
 948
 949				if (!qdisc_all_tx_empty(sdata->dev)) {
 950					tx_empty = false;
 951					break;
 952				}
 953			}
 954		}
 955	}
 956
 957	scan_req = rcu_dereference_protected(local->scan_req,
 958					     lockdep_is_held(&local->hw.wiphy->mtx));
 959
 960	next_chan = scan_req->channels[local->scan_channel_idx];
 961
 962	/*
 963	 * we're currently scanning a different channel, let's
 964	 * see if we can scan another channel without interfering
 965	 * with the current traffic situation.
 966	 *
 967	 * Keep good latency, do not stay off-channel more than 125 ms.
 968	 */
 969
 970	bad_latency = time_after(jiffies +
 971				 ieee80211_scan_get_channel_time(next_chan),
 972				 local->leave_oper_channel_time + HZ / 8);
 973
 974	if (associated && !tx_empty) {
 975		if (scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
 976			next_scan_state = SCAN_ABORT;
 977		else
 978			next_scan_state = SCAN_SUSPEND;
 979	} else if (associated && bad_latency) {
 980		next_scan_state = SCAN_SUSPEND;
 981	} else {
 982		next_scan_state = SCAN_SET_CHANNEL;
 983	}
 984
 985	local->next_scan_state = next_scan_state;
 986
 987	*next_delay = 0;
 988}
 989
 990static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
 991					     unsigned long *next_delay)
 992{
 993	int skip;
 994	struct ieee80211_channel *chan;
 995	struct cfg80211_scan_request *scan_req;
 996
 997	scan_req = rcu_dereference_protected(local->scan_req,
 998					     lockdep_is_held(&local->hw.wiphy->mtx));
 999
1000	skip = 0;
1001	chan = scan_req->channels[local->scan_channel_idx];
1002
1003	local->scan_chandef.chan = chan;
1004	local->scan_chandef.center_freq1 = chan->center_freq;
1005	local->scan_chandef.freq1_offset = chan->freq_offset;
1006	local->scan_chandef.center_freq2 = 0;
1007
1008	/* For S1G, only scan the 1MHz primaries. */
1009	if (chan->band == NL80211_BAND_S1GHZ) {
1010		local->scan_chandef.width = NL80211_CHAN_WIDTH_1;
1011		local->scan_chandef.s1g_primary_2mhz = false;
1012		goto set_channel;
1013	}
1014
1015	/*
1016	 * If scanning on oper channel, use whatever channel-type
1017	 * is currently in use.
1018	 */
1019	if (chan == local->hw.conf.chandef.chan)
1020		local->scan_chandef = local->hw.conf.chandef;
1021	else
1022		local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
1023
1024set_channel:
1025	if (ieee80211_hw_conf_chan(local))
1026		skip = 1;
1027
1028	/* advance state machine to next channel/band */
1029	local->scan_channel_idx++;
1030
1031	if (skip) {
1032		/* if we skip this channel return to the decision state */
1033		local->next_scan_state = SCAN_DECISION;
1034		return;
1035	}
1036
1037	/*
1038	 * Probe delay is used to update the NAV, cf. 11.1.3.2.2
1039	 * (which unfortunately doesn't say _why_ step a) is done,
1040	 * but it waits for the probe delay or until a frame is
1041	 * received - and the received frame would update the NAV).
1042	 * For now, we do not support waiting until a frame is
1043	 * received.
1044	 *
1045	 * In any case, it is not necessary for a passive scan.
1046	 */
1047	if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) ||
1048	    !scan_req->n_ssids) {
1049		*next_delay = max(msecs_to_jiffies(scan_req->duration),
1050				  IEEE80211_PASSIVE_CHANNEL_TIME);
1051		local->next_scan_state = SCAN_DECISION;
1052		if (scan_req->n_ssids)
1053			set_bit(SCAN_BEACON_WAIT, &local->scanning);
1054		return;
1055	}
1056
1057	/* active scan, send probes */
1058	*next_delay = IEEE80211_PROBE_DELAY;
1059	local->next_scan_state = SCAN_SEND_PROBE;
1060}
1061
1062static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
1063					 unsigned long *next_delay)
1064{
1065	/* switch back to the operating channel */
1066	local->scan_chandef.chan = NULL;
1067	ieee80211_hw_conf_chan(local);
1068
1069	/* disable PS */
1070	ieee80211_offchannel_return(local);
1071
1072	*next_delay = HZ / 5;
1073	/* afterwards, resume scan & go to next channel */
1074	local->next_scan_state = SCAN_RESUME;
1075}
1076
1077static void ieee80211_scan_state_resume(struct ieee80211_local *local,
1078					unsigned long *next_delay)
1079{
1080	ieee80211_offchannel_stop_vifs(local);
1081
1082	if (local->ops->flush) {
1083		ieee80211_flush_queues(local, NULL, false);
1084		*next_delay = 0;
1085	} else
1086		*next_delay = HZ / 10;
1087
1088	/* remember when we left the operating channel */
1089	local->leave_oper_channel_time = jiffies;
1090
1091	/* advance to the next channel to be scanned */
1092	local->next_scan_state = SCAN_SET_CHANNEL;
1093}
1094
1095void ieee80211_scan_work(struct wiphy *wiphy, struct wiphy_work *work)
1096{
1097	struct ieee80211_local *local =
1098		container_of(work, struct ieee80211_local, scan_work.work);
1099	struct ieee80211_sub_if_data *sdata;
1100	struct cfg80211_scan_request *scan_req;
1101	unsigned long next_delay = 0;
1102	bool aborted;
1103
1104	lockdep_assert_wiphy(local->hw.wiphy);
1105
1106	if (!ieee80211_can_run_worker(local)) {
1107		aborted = true;
1108		goto out_complete;
1109	}
1110
1111	sdata = rcu_dereference_protected(local->scan_sdata,
1112					  lockdep_is_held(&local->hw.wiphy->mtx));
1113	scan_req = rcu_dereference_protected(local->scan_req,
1114					     lockdep_is_held(&local->hw.wiphy->mtx));
1115
1116	/* When scanning on-channel, the first-callback means completed. */
1117	if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) {
1118		aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
1119		goto out_complete;
1120	}
1121
1122	if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) {
1123		aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
1124		goto out_complete;
1125	}
1126
1127	if (!sdata || !scan_req)
1128		return;
1129
1130	if (!local->scanning) {
1131		int rc;
1132
1133		RCU_INIT_POINTER(local->scan_req, NULL);
1134		RCU_INIT_POINTER(local->scan_sdata, NULL);
1135
1136		rc = __ieee80211_start_scan(sdata, scan_req);
1137		if (!rc)
1138			return;
1139		/* need to complete scan in cfg80211 */
1140		rcu_assign_pointer(local->scan_req, scan_req);
1141		aborted = true;
1142		goto out_complete;
1143	}
1144
1145	clear_bit(SCAN_BEACON_WAIT, &local->scanning);
1146
1147	/*
1148	 * as long as no delay is required advance immediately
1149	 * without scheduling a new work
1150	 */
1151	do {
1152		if (!ieee80211_sdata_running(sdata)) {
1153			aborted = true;
1154			goto out_complete;
1155		}
1156
1157		if (test_and_clear_bit(SCAN_BEACON_DONE, &local->scanning) &&
1158		    local->next_scan_state == SCAN_DECISION)
1159			local->next_scan_state = SCAN_SEND_PROBE;
1160
1161		switch (local->next_scan_state) {
1162		case SCAN_DECISION:
1163			/* if no more bands/channels left, complete scan */
1164			if (local->scan_channel_idx >= scan_req->n_channels) {
1165				aborted = false;
1166				goto out_complete;
1167			}
1168			ieee80211_scan_state_decision(local, &next_delay);
1169			break;
1170		case SCAN_SET_CHANNEL:
1171			ieee80211_scan_state_set_channel(local, &next_delay);
1172			break;
1173		case SCAN_SEND_PROBE:
1174			ieee80211_scan_state_send_probe(local, &next_delay);
1175			break;
1176		case SCAN_SUSPEND:
1177			ieee80211_scan_state_suspend(local, &next_delay);
1178			break;
1179		case SCAN_RESUME:
1180			ieee80211_scan_state_resume(local, &next_delay);
1181			break;
1182		case SCAN_ABORT:
1183			aborted = true;
1184			goto out_complete;
1185		}
1186	} while (next_delay == 0);
1187
1188	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
1189				 next_delay);
1190	return;
1191
1192out_complete:
1193	__ieee80211_scan_completed(&local->hw, aborted);
1194}
1195
1196int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
1197			   struct cfg80211_scan_request *req)
1198{
1199	lockdep_assert_wiphy(sdata->local->hw.wiphy);
1200
1201	return __ieee80211_start_scan(sdata, req);
1202}
1203
1204int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
1205				const u8 *ssid, u8 ssid_len,
1206				struct ieee80211_channel **channels,
1207				unsigned int n_channels)
1208{
1209	struct ieee80211_local *local = sdata->local;
1210	int i, n_ch = 0;
1211	enum nl80211_band band;
1212
1213	lockdep_assert_wiphy(local->hw.wiphy);
1214
1215	/* busy scanning */
1216	if (local->scan_req)
1217		return -EBUSY;
1218
1219	/* fill internal scan request */
1220	if (!channels) {
1221		int max_n;
1222
1223		for (band = 0; band < NUM_NL80211_BANDS; band++) {
1224			if (!local->hw.wiphy->bands[band] ||
1225			    band == NL80211_BAND_6GHZ ||
1226			    band == NL80211_BAND_S1GHZ)
1227				continue;
1228
1229			max_n = local->hw.wiphy->bands[band]->n_channels;
1230			for (i = 0; i < max_n; i++) {
1231				struct ieee80211_channel *tmp_ch =
1232				    &local->hw.wiphy->bands[band]->channels[i];
1233
1234				if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR |
1235						     IEEE80211_CHAN_DISABLED) ||
1236				    !cfg80211_wdev_channel_allowed(&sdata->wdev,
1237								   tmp_ch))
1238					continue;
1239
1240				local->int_scan_req->channels[n_ch] = tmp_ch;
1241				n_ch++;
1242			}
1243		}
1244
1245		if (WARN_ON_ONCE(n_ch == 0))
1246			return -EINVAL;
1247
1248		local->int_scan_req->n_channels = n_ch;
1249	} else {
1250		for (i = 0; i < n_channels; i++) {
1251			if (channels[i]->flags & (IEEE80211_CHAN_NO_IR |
1252						  IEEE80211_CHAN_DISABLED) ||
1253			    !cfg80211_wdev_channel_allowed(&sdata->wdev,
1254							   channels[i]))
1255				continue;
1256
1257			local->int_scan_req->channels[n_ch] = channels[i];
1258			n_ch++;
1259		}
1260
1261		if (n_ch == 0)
1262			return -EINVAL;
1263
1264		local->int_scan_req->n_channels = n_ch;
1265	}
1266
1267	local->int_scan_req->ssids = &local->scan_ssid;
1268	local->int_scan_req->n_ssids = 1;
1269	memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
1270	local->int_scan_req->ssids[0].ssid_len = ssid_len;
1271
1272	return __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
1273}
1274
1275void ieee80211_scan_cancel(struct ieee80211_local *local)
1276{
1277	/* ensure a new scan cannot be queued */
1278	lockdep_assert_wiphy(local->hw.wiphy);
1279
1280	/*
1281	 * We are canceling software scan, or deferred scan that was not
1282	 * yet really started (see __ieee80211_start_scan ).
1283	 *
1284	 * Regarding hardware scan:
1285	 * - we can not call  __ieee80211_scan_completed() as when
1286	 *   SCAN_HW_SCANNING bit is set this function change
1287	 *   local->hw_scan_req to operate on 5G band, what race with
1288	 *   driver which can use local->hw_scan_req
1289	 *
1290	 * - we can not cancel scan_work since driver can schedule it
1291	 *   by ieee80211_scan_completed(..., true) to finish scan
1292	 *
1293	 * Hence we only call the cancel_hw_scan() callback, but the low-level
1294	 * driver is still responsible for calling ieee80211_scan_completed()
1295	 * after the scan was completed/aborted.
1296	 */
1297
1298	if (!local->scan_req)
1299		return;
1300
1301	/*
1302	 * We have a scan running and the driver already reported completion,
1303	 * but the worker hasn't run yet or is stuck on the mutex - mark it as
1304	 * cancelled.
1305	 */
1306	if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
1307	    test_bit(SCAN_COMPLETED, &local->scanning)) {
1308		set_bit(SCAN_HW_CANCELLED, &local->scanning);
1309		return;
1310	}
1311
1312	if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
1313		/*
1314		 * Make sure that __ieee80211_scan_completed doesn't trigger a
1315		 * scan on another band.
1316		 */
1317		set_bit(SCAN_HW_CANCELLED, &local->scanning);
1318		if (local->ops->cancel_hw_scan)
1319			drv_cancel_hw_scan(local,
1320				rcu_dereference_protected(local->scan_sdata,
1321						lockdep_is_held(&local->hw.wiphy->mtx)));
1322		return;
1323	}
1324
1325	wiphy_delayed_work_cancel(local->hw.wiphy, &local->scan_work);
1326	/* and clean up */
1327	memset(&local->scan_info, 0, sizeof(local->scan_info));
1328	__ieee80211_scan_completed(&local->hw, true);
1329}
1330
1331int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
1332					struct cfg80211_sched_scan_request *req)
1333{
1334	struct ieee80211_local *local = sdata->local;
1335	struct ieee80211_scan_ies sched_scan_ies = {};
1336	struct cfg80211_chan_def chandef;
1337	int ret, i, iebufsz, num_bands = 0;
1338	u32 rate_masks[NUM_NL80211_BANDS] = {};
1339	u8 bands_used = 0;
1340	u8 *ie;
1341	u32 flags = 0;
1342
1343	lockdep_assert_wiphy(local->hw.wiphy);
1344
1345	iebufsz = local->scan_ies_len + req->ie_len;
1346
1347	if (!local->ops->sched_scan_start)
1348		return -EOPNOTSUPP;
1349
1350	for (i = 0; i < NUM_NL80211_BANDS; i++) {
1351		if (local->hw.wiphy->bands[i]) {
1352			bands_used |= BIT(i);
1353			rate_masks[i] = (u32) -1;
1354			num_bands++;
1355		}
1356	}
1357
1358	if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
1359		flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
1360
1361	ie = kcalloc(iebufsz, num_bands, GFP_KERNEL);
1362	if (!ie) {
1363		ret = -ENOMEM;
1364		goto out;
1365	}
1366
1367	ieee80211_prepare_scan_chandef(&chandef);
1368
1369	ret = ieee80211_build_preq_ies(sdata, ie, num_bands * iebufsz,
1370				       &sched_scan_ies, req->ie,
1371				       req->ie_len, bands_used, rate_masks,
1372				       &chandef, flags);
1373	if (ret < 0)
1374		goto error;
1375
1376	ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
1377	if (ret == 0) {
1378		rcu_assign_pointer(local->sched_scan_sdata, sdata);
1379		rcu_assign_pointer(local->sched_scan_req, req);
1380	}
1381
1382error:
1383	kfree(ie);
1384out:
1385	if (ret) {
1386		/* Clean in case of failure after HW restart or upon resume. */
1387		RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
1388		RCU_INIT_POINTER(local->sched_scan_req, NULL);
1389	}
1390
1391	return ret;
1392}
1393
1394int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
1395				       struct cfg80211_sched_scan_request *req)
1396{
1397	struct ieee80211_local *local = sdata->local;
1398
1399	lockdep_assert_wiphy(local->hw.wiphy);
1400
1401	if (rcu_access_pointer(local->sched_scan_sdata))
1402		return -EBUSY;
1403
1404	return __ieee80211_request_sched_scan_start(sdata, req);
1405}
1406
1407int ieee80211_request_sched_scan_stop(struct ieee80211_local *local)
1408{
1409	struct ieee80211_sub_if_data *sched_scan_sdata;
1410	int ret = -ENOENT;
1411
1412	lockdep_assert_wiphy(local->hw.wiphy);
1413
1414	if (!local->ops->sched_scan_stop)
1415		return -EOPNOTSUPP;
1416
1417	/* We don't want to restart sched scan anymore. */
1418	RCU_INIT_POINTER(local->sched_scan_req, NULL);
1419
1420	sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
1421						lockdep_is_held(&local->hw.wiphy->mtx));
1422	if (sched_scan_sdata) {
1423		ret = drv_sched_scan_stop(local, sched_scan_sdata);
1424		if (!ret)
1425			RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
1426	}
1427
1428	return ret;
1429}
1430
1431void ieee80211_sched_scan_results(struct ieee80211_hw *hw)
1432{
1433	struct ieee80211_local *local = hw_to_local(hw);
1434
1435	trace_api_sched_scan_results(local);
1436
1437	cfg80211_sched_scan_results(hw->wiphy, 0);
1438}
1439EXPORT_SYMBOL(ieee80211_sched_scan_results);
1440
1441void ieee80211_sched_scan_end(struct ieee80211_local *local)
1442{
1443	lockdep_assert_wiphy(local->hw.wiphy);
1444
1445	if (!rcu_access_pointer(local->sched_scan_sdata))
1446		return;
1447
1448	RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
1449
1450	/* If sched scan was aborted by the driver. */
1451	RCU_INIT_POINTER(local->sched_scan_req, NULL);
1452
1453	cfg80211_sched_scan_stopped_locked(local->hw.wiphy, 0);
1454}
1455
1456void ieee80211_sched_scan_stopped_work(struct wiphy *wiphy,
1457				       struct wiphy_work *work)
1458{
1459	struct ieee80211_local *local =
1460		container_of(work, struct ieee80211_local,
1461			     sched_scan_stopped_work);
1462
1463	ieee80211_sched_scan_end(local);
1464}
1465
1466void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
1467{
1468	struct ieee80211_local *local = hw_to_local(hw);
1469
1470	trace_api_sched_scan_stopped(local);
1471
1472	/*
1473	 * this shouldn't really happen, so for simplicity
1474	 * simply ignore it, and let mac80211 reconfigure
1475	 * the sched scan later on.
1476	 */
1477	if (local->in_reconfig)
1478		return;
1479
1480	wiphy_work_queue(hw->wiphy, &local->sched_scan_stopped_work);
1481}
1482EXPORT_SYMBOL(ieee80211_sched_scan_stopped);