sys/net80211/ieee80211_scan_sw.c

   1 /*-
   2  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include <sys/cdefs.h>
  27 /*
  28  * IEEE 802.11 scanning support.
  29  */
  30 #include "opt_wlan.h"
  31
  32 #include <sys/param.h>
  33 #include <sys/systm.h>
  34 #include <sys/proc.h>
  35 #include <sys/kernel.h>
  36 #include <sys/malloc.h>
  37 #include <sys/condvar.h>
  38
  39 #include <sys/socket.h>
  40
  41 #include <net/if.h>
  42 #include <net/if_var.h>
  43 #include <net/if_media.h>
  44 #include <net/if_private.h>
  45 #include <net/ethernet.h>
  46
  47 #include <net80211/ieee80211_var.h>
  48
  49 #include <net80211/ieee80211_scan_sw.h>
  50
  51 #include <net/bpf.h>
  52
  53 struct scan_state {
  54         struct ieee80211_scan_state base;       /* public state */
  55
  56         u_int                   ss_iflags;      /* flags used internally */
  57 #define ISCAN_MINDWELL          0x0001          /* min dwell time reached */
  58 #define ISCAN_DISCARD           0x0002          /* discard rx'd frames */
  59 #define ISCAN_INTERRUPT         0x0004          /* interrupt current scan */
  60 #define ISCAN_CANCEL            0x0008          /* cancel current scan */
  61 #define ISCAN_PAUSE             (ISCAN_INTERRUPT | ISCAN_CANCEL)
  62 #define ISCAN_ABORT             0x0010          /* end the scan immediately */
  63 #define ISCAN_RUNNING           0x0020          /* scan was started */
  64
  65         unsigned long           ss_chanmindwell;  /* min dwell on curchan */
  66         unsigned long           ss_scanend;     /* time scan must stop */
  67         u_int                   ss_duration;    /* duration for next scan */
  68         struct task             ss_scan_start;  /* scan start */
  69         struct timeout_task     ss_scan_curchan;  /* scan execution */
  70 };
  71 #define SCAN_PRIVATE(ss)        ((struct scan_state *) ss)
  72
  73 /*
  74  * Amount of time to go off-channel during a background
  75  * scan.  This value should be large enough to catch most
  76  * ap's but short enough that we can return on-channel
  77  * before our listen interval expires.
  78  *
  79  * XXX tunable
  80  * XXX check against configured listen interval
  81  */
  82 #define IEEE80211_SCAN_OFFCHANNEL       msecs_to_ticks(150)
  83
  84 static  void scan_curchan(struct ieee80211_scan_state *, unsigned long);
  85 static  void scan_mindwell(struct ieee80211_scan_state *);
  86 static  void scan_signal(struct ieee80211_scan_state *, int);
  87 static  void scan_signal_locked(struct ieee80211_scan_state *, int);
  88 static  void scan_start(void *, int);
  89 static  void scan_curchan_task(void *, int);
  90 static  void scan_end(struct ieee80211_scan_state *, int);
  91 static  void scan_done(struct ieee80211_scan_state *, int);
  92
  93 MALLOC_DEFINE(M_80211_SCAN, "80211scan", "802.11 scan state");
  94
  95 static void
  96 ieee80211_swscan_detach(struct ieee80211com *ic)
  97 {
  98         struct ieee80211_scan_state *ss = ic->ic_scan;
  99
 100         if (ss != NULL) {
 101                 scan_signal(ss, ISCAN_ABORT);
 102                 ieee80211_draintask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
 103                 taskqueue_drain_timeout(ic->ic_tq,
 104                     &SCAN_PRIVATE(ss)->ss_scan_curchan);
 105                 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0,
 106                     ("scan still running"));
 107
 108                 /*
 109                  * For now, do the ss_ops detach here rather
 110                  * than ieee80211_scan_detach().
 111                  *
 112                  * I'll figure out how to cleanly split things up
 113                  * at a later date.
 114                  */
 115                 if (ss->ss_ops != NULL) {
 116                         ss->ss_ops->scan_detach(ss);
 117                         ss->ss_ops = NULL;
 118                 }
 119                 ic->ic_scan = NULL;
 120                 IEEE80211_FREE(SCAN_PRIVATE(ss), M_80211_SCAN);
 121         }
 122 }
 123
 124 static void
 125 ieee80211_swscan_vattach(struct ieee80211vap *vap)
 126 {
 127         /* nothing to do for now */
 128         /*
 129          * TODO: all of the vap scan calls should be methods!
 130          */
 131
 132 }
 133
 134 static void
 135 ieee80211_swscan_vdetach(struct ieee80211vap *vap)
 136 {
 137         struct ieee80211com *ic = vap->iv_ic;
 138         struct ieee80211_scan_state *ss = ic->ic_scan;
 139
 140         IEEE80211_LOCK_ASSERT(ic);
 141
 142         if (ss != NULL && ss->ss_vap == vap &&
 143             (ic->ic_flags & IEEE80211_F_SCAN))
 144                 scan_signal_locked(ss, ISCAN_ABORT);
 145 }
 146
 147 static void
 148 ieee80211_swscan_set_scan_duration(struct ieee80211vap *vap, u_int duration)
 149 {
 150         struct ieee80211com *ic = vap->iv_ic;
 151         struct ieee80211_scan_state *ss = ic->ic_scan;
 152
 153         IEEE80211_LOCK_ASSERT(ic);
 154
 155         /* NB: flush frames rx'd before 1st channel change */
 156         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
 157         SCAN_PRIVATE(ss)->ss_duration = duration;
 158 }
 159
 160 /*
 161  * Start a scan unless one is already going.
 162  */
 163 static int
 164 ieee80211_swscan_start_scan_locked(const struct ieee80211_scanner *scan,
 165         struct ieee80211vap *vap, int flags, u_int duration,
 166         u_int mindwell, u_int maxdwell,
 167         u_int nssid, const struct ieee80211_scan_ssid ssids[])
 168 {
 169         struct ieee80211com *ic = vap->iv_ic;
 170         struct ieee80211_scan_state *ss = ic->ic_scan;
 171
 172         IEEE80211_LOCK_ASSERT(ic);
 173
 174         if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
 175                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 176                     "%s: scan inhibited by pending channel change\n", __func__);
 177         } else if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 178                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 179                     "%s: %s scan, duration %u mindwell %u maxdwell %u, desired mode %s, %s%s%s%s%s%s\n"
 180                     , __func__
 181                     , flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive"
 182                     , duration, mindwell, maxdwell
 183                     , ieee80211_phymode_name[vap->iv_des_mode]
 184                     , flags & IEEE80211_SCAN_FLUSH ? "flush" : "append"
 185                     , flags & IEEE80211_SCAN_NOPICK ? ", nopick" : ""
 186                     , flags & IEEE80211_SCAN_NOJOIN ? ", nojoin" : ""
 187                     , flags & IEEE80211_SCAN_NOBCAST ? ", nobcast" : ""
 188                     , flags & IEEE80211_SCAN_PICK1ST ? ", pick1st" : ""
 189                     , flags & IEEE80211_SCAN_ONCE ? ", once" : ""
 190                 );
 191
 192                 ieee80211_scan_update_locked(vap, scan);
 193                 if (ss->ss_ops != NULL) {
 194                         if ((flags & IEEE80211_SCAN_NOSSID) == 0)
 195                                 ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
 196
 197                         ss->ss_flags = flags & IEEE80211_SCAN_PUBLIC_MASK;
 198                         if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 199                                 vap->iv_stats.is_scan_active++;
 200                         else
 201                                 vap->iv_stats.is_scan_passive++;
 202                         if (flags & IEEE80211_SCAN_FLUSH)
 203                                 ss->ss_ops->scan_flush(ss);
 204                         if (flags & IEEE80211_SCAN_BGSCAN)
 205                                 ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
 206
 207                         /* Set duration for this particular scan */
 208                         ieee80211_swscan_set_scan_duration(vap, duration);
 209
 210                         ss->ss_next = 0;
 211                         ss->ss_mindwell = mindwell;
 212                         ss->ss_maxdwell = maxdwell;
 213                         /* NB: scan_start must be before the scan runtask */
 214                         ss->ss_ops->scan_start(ss, vap);
 215 #ifdef IEEE80211_DEBUG
 216                         if (ieee80211_msg_scan(vap))
 217                                 ieee80211_scan_dump(ss);
 218 #endif /* IEEE80211_DEBUG */
 219                         ic->ic_flags |= IEEE80211_F_SCAN;
 220
 221                         /* Start scan task */
 222                         ieee80211_runtask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
 223                 }
 224                 return 1;
 225         } else {
 226                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 227                     "%s: %s scan already in progress\n", __func__,
 228                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
 229         }
 230         return 0;
 231 }
 232
 233 /*
 234  * Start a scan unless one is already going.
 235  *
 236  * Called without the comlock held; grab the comlock as appropriate.
 237  */
 238 static int
 239 ieee80211_swscan_start_scan(const struct ieee80211_scanner *scan,
 240     struct ieee80211vap *vap, int flags,
 241     u_int duration, u_int mindwell, u_int maxdwell,
 242     u_int nssid, const struct ieee80211_scan_ssid ssids[])
 243 {
 244         struct ieee80211com *ic = vap->iv_ic;
 245         int result;
 246
 247         IEEE80211_UNLOCK_ASSERT(ic);
 248
 249         IEEE80211_LOCK(ic);
 250         result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
 251             mindwell, maxdwell, nssid, ssids);
 252         IEEE80211_UNLOCK(ic);
 253
 254         return result;
 255 }
 256
 257 /*
 258  * Check the scan cache for an ap/channel to use; if that
 259  * fails then kick off a new scan.
 260  *
 261  * Called with the comlock held.
 262  *
 263  * XXX TODO: split out!
 264  */
 265 static int
 266 ieee80211_swscan_check_scan(const struct ieee80211_scanner *scan,
 267     struct ieee80211vap *vap, int flags,
 268     u_int duration, u_int mindwell, u_int maxdwell,
 269     u_int nssid, const struct ieee80211_scan_ssid ssids[])
 270 {
 271         struct ieee80211com *ic = vap->iv_ic;
 272         struct ieee80211_scan_state *ss = ic->ic_scan;
 273         int result;
 274
 275         IEEE80211_LOCK_ASSERT(ic);
 276
 277         if (ss->ss_ops != NULL) {
 278                 /* XXX verify ss_ops matches vap->iv_opmode */
 279                 if ((flags & IEEE80211_SCAN_NOSSID) == 0) {
 280                         /*
 281                          * Update the ssid list and mark flags so if
 282                          * we call start_scan it doesn't duplicate work.
 283                          */
 284                         ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
 285                         flags |= IEEE80211_SCAN_NOSSID;
 286                 }
 287                 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
 288                     (flags & IEEE80211_SCAN_FLUSH) == 0 &&
 289                     ieee80211_time_before(ticks, ic->ic_lastscan + vap->iv_scanvalid)) {
 290                         /*
 291                          * We're not currently scanning and the cache is
 292                          * deemed hot enough to consult.  Lock out others
 293                          * by marking IEEE80211_F_SCAN while we decide if
 294                          * something is already in the scan cache we can
 295                          * use.  Also discard any frames that might come
 296                          * in while temporarily marked as scanning.
 297                          */
 298                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 299                             "cache hot; ic_lastscan=%d, scanvalid=%d, ticks=%d\n",
 300                             ic->ic_lastscan,
 301                             vap->iv_scanvalid,
 302                             ticks);
 303                         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
 304                         ic->ic_flags |= IEEE80211_F_SCAN;
 305
 306                         /* NB: need to use supplied flags in check */
 307                         ss->ss_flags = flags & IEEE80211_SCAN_PUBLIC_MASK;
 308                         result = ss->ss_ops->scan_end(ss, vap);
 309
 310                         ic->ic_flags &= ~IEEE80211_F_SCAN;
 311                         SCAN_PRIVATE(ss)->ss_iflags &= ~ISCAN_DISCARD;
 312                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 313                             "%s: scan_end returned %d\n", __func__, result);
 314                         if (result) {
 315                                 ieee80211_notify_scan_done(vap);
 316                                 return 1;
 317                         }
 318                 }
 319         }
 320         result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
 321             mindwell, maxdwell, nssid, ssids);
 322
 323         return result;
 324 }
 325
 326 /*
 327  * Restart a previous scan.  If the previous scan completed
 328  * then we start again using the existing channel list.
 329  */
 330 static int
 331 ieee80211_swscan_bg_scan(const struct ieee80211_scanner *scan,
 332     struct ieee80211vap *vap, int flags)
 333 {
 334         struct ieee80211com *ic = vap->iv_ic;
 335         struct ieee80211_scan_state *ss = ic->ic_scan;
 336         bool scanning;
 337
 338         /* XXX assert unlocked? */
 339         // IEEE80211_UNLOCK_ASSERT(ic);
 340
 341         IEEE80211_LOCK(ic);
 342         scanning = ic->ic_flags & IEEE80211_F_SCAN;
 343         if (!scanning) {
 344                 u_int duration;
 345                 /*
 346                  * Go off-channel for a fixed interval that is large
 347                  * enough to catch most ap's but short enough that
 348                  * we can return on-channel before our listen interval
 349                  * expires.
 350                  */
 351                 duration = IEEE80211_SCAN_OFFCHANNEL;
 352
 353                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 354                     "%s: %s scan, ticks %u duration %u\n", __func__,
 355                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive",
 356                     ticks, duration);
 357
 358                 ieee80211_scan_update_locked(vap, scan);
 359                 if (ss->ss_ops != NULL) {
 360                         ss->ss_vap = vap;
 361                         /*
 362                          * A background scan does not select a new sta; it
 363                          * just refreshes the scan cache.  Also, indicate
 364                          * the scan logic should follow the beacon schedule:
 365                          * we go off-channel and scan for a while, then
 366                          * return to the bss channel to receive a beacon,
 367                          * then go off-channel again.  All during this time
 368                          * we notify the ap we're in power save mode.  When
 369                          * the scan is complete we leave power save mode.
 370                          * If any beacon indicates there are frames pending
 371                          * for us then we drop out of power save mode
 372                          * (and background scan) automatically by way of the
 373                          * usual sta power save logic.
 374                          */
 375                         ss->ss_flags |= IEEE80211_SCAN_NOPICK
 376                                      |  IEEE80211_SCAN_BGSCAN
 377                                      |  flags
 378                                      ;
 379                         /* if previous scan completed, restart */
 380                         if (ss->ss_next >= ss->ss_last) {
 381                                 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 382                                         vap->iv_stats.is_scan_active++;
 383                                 else
 384                                         vap->iv_stats.is_scan_passive++;
 385                                 /*
 386                                  * NB: beware of the scan cache being flushed;
 387                                  *     if the channel list is empty use the
 388                                  *     scan_start method to populate it.
 389                                  */
 390                                 ss->ss_next = 0;
 391                                 if (ss->ss_last != 0) {
 392                                         ieee80211_notify_scan_done(vap);
 393                                         ss->ss_ops->scan_restart(ss, vap);
 394                                 } else {
 395                                         ss->ss_ops->scan_start(ss, vap);
 396 #ifdef IEEE80211_DEBUG
 397                                         if (ieee80211_msg_scan(vap))
 398                                                 ieee80211_scan_dump(ss);
 399 #endif /* IEEE80211_DEBUG */
 400                                 }
 401                         }
 402                         ieee80211_swscan_set_scan_duration(vap, duration);
 403                         ss->ss_maxdwell = duration;
 404                         ic->ic_flags |= IEEE80211_F_SCAN;
 405                         ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
 406                         ieee80211_runtask(ic,
 407                             &SCAN_PRIVATE(ss)->ss_scan_start);
 408                         scanning = true;
 409                 } else {
 410                         /* XXX msg+stat */
 411                 }
 412         } else {
 413                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 414                     "%s: %s scan already in progress\n", __func__,
 415                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
 416         }
 417         IEEE80211_UNLOCK(ic);
 418
 419         return (scanning);
 420 }
 421
 422 /*
 423  * Taskqueue work to cancel a scan.
 424  *
 425  * Note: for offload scan devices, we may want to call into the
 426  * driver to try and cancel scanning, however it may not be cancelable.
 427  */
 428 static void
 429 cancel_scan(struct ieee80211vap *vap, int any, const char *func)
 430 {
 431         struct ieee80211com *ic = vap->iv_ic;
 432         struct ieee80211_scan_state *ss = ic->ic_scan;
 433         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 434         int signal;
 435
 436         IEEE80211_LOCK(ic);
 437         signal = any ? ISCAN_PAUSE : ISCAN_CANCEL;
 438         if ((ic->ic_flags & IEEE80211_F_SCAN) &&
 439             (any || ss->ss_vap == vap) &&
 440             (ss_priv->ss_iflags & signal) == 0) {
 441                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 442                     "%s: %s %s scan\n", func,
 443                     any ? "pause" : "cancel",
 444                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ?
 445                         "active" : "passive");
 446
 447                 /* clear bg scan NOPICK */
 448                 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
 449                 /* mark request and wake up the scan task */
 450                 scan_signal_locked(ss, signal);
 451         } else {
 452                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 453                     "%s: called; F_SCAN=%d, vap=%s, signal=%d\n",
 454                         func,
 455                         !! (ic->ic_flags & IEEE80211_F_SCAN),
 456                         (ss->ss_vap == vap ? "match" : "nomatch"),
 457                         !! (ss_priv->ss_iflags & signal));
 458         }
 459         IEEE80211_UNLOCK(ic);
 460 }
 461
 462 /*
 463  * Cancel any scan currently going on for the specified vap.
 464  */
 465 static void
 466 ieee80211_swscan_cancel_scan(struct ieee80211vap *vap)
 467 {
 468         cancel_scan(vap, 0, __func__);
 469 }
 470
 471 /*
 472  * Cancel any scan currently going on.
 473  */
 474 static void
 475 ieee80211_swscan_cancel_anyscan(struct ieee80211vap *vap)
 476 {
 477
 478         /* XXX for now - just don't do this per packet. */
 479         if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD)
 480                 return;
 481
 482         cancel_scan(vap, 1, __func__);
 483 }
 484
 485 /*
 486  * Manually switch to the next channel in the channel list.
 487  * Provided for drivers that manage scanning themselves
 488  * (e.g. for firmware-based devices).
 489  */
 490 static void
 491 ieee80211_swscan_scan_next(struct ieee80211vap *vap)
 492 {
 493         struct ieee80211_scan_state *ss = vap->iv_ic->ic_scan;
 494
 495         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: called\n", __func__);
 496
 497         /* wake up the scan task */
 498         scan_signal(ss, 0);
 499 }
 500
 501 /*
 502  * Manually stop a scan that is currently running.
 503  * Provided for drivers that are not able to scan single channels
 504  * (e.g. for firmware-based devices).
 505  */
 506 static void
 507 ieee80211_swscan_scan_done(struct ieee80211vap *vap)
 508 {
 509         struct ieee80211com *ic = vap->iv_ic;
 510         struct ieee80211_scan_state *ss = ic->ic_scan;
 511
 512         IEEE80211_LOCK_ASSERT(ic);
 513
 514         scan_signal_locked(ss, 0);
 515 }
 516
 517 /*
 518  * Probe the current channel, if allowed, while scanning.
 519  * If the channel is not marked passive-only then send
 520  * a probe request immediately.  Otherwise mark state and
 521  * listen for beacons on the channel; if we receive something
 522  * then we'll transmit a probe request.
 523  */
 524 static void
 525 ieee80211_swscan_probe_curchan(struct ieee80211vap *vap, int force)
 526 {
 527         struct ieee80211com *ic = vap->iv_ic;
 528         struct ieee80211_scan_state *ss = ic->ic_scan;
 529         struct ifnet *ifp = vap->iv_ifp;
 530         int i;
 531
 532         /*
 533          * Full-offload scan devices don't require this.
 534          */
 535         if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD)
 536                 return;
 537
 538         /*
 539          * Send directed probe requests followed by any
 540          * broadcast probe request.
 541          * XXX remove dependence on ic/vap->iv_bss
 542          */
 543         for (i = 0; i < ss->ss_nssid; i++)
 544                 ieee80211_send_probereq(vap->iv_bss,
 545                         vap->iv_myaddr, ifp->if_broadcastaddr,
 546                         ifp->if_broadcastaddr,
 547                         ss->ss_ssid[i].ssid, ss->ss_ssid[i].len);
 548         if ((ss->ss_flags & IEEE80211_SCAN_NOBCAST) == 0)
 549                 ieee80211_send_probereq(vap->iv_bss,
 550                         vap->iv_myaddr, ifp->if_broadcastaddr,
 551                         ifp->if_broadcastaddr,
 552                         "", 0);
 553 }
 554
 555 /*
 556  * Scan curchan.  If this is an active scan and the channel
 557  * is not marked passive then send probe request frame(s).
 558  * Arrange for the channel change after maxdwell ticks.
 559  */
 560 static void
 561 scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
 562 {
 563         struct ieee80211vap *vap  = ss->ss_vap;
 564         struct ieee80211com *ic = ss->ss_ic;
 565
 566         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 567             "%s: calling; maxdwell=%lu\n",
 568             __func__,
 569             maxdwell);
 570         IEEE80211_LOCK(ic);
 571         if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 572                 ieee80211_probe_curchan(vap, 0);
 573         taskqueue_enqueue_timeout(ic->ic_tq,
 574             &SCAN_PRIVATE(ss)->ss_scan_curchan, maxdwell);
 575         IEEE80211_UNLOCK(ic);
 576 }
 577
 578 static void
 579 scan_signal(struct ieee80211_scan_state *ss, int iflags)
 580 {
 581         struct ieee80211com *ic = ss->ss_ic;
 582
 583         IEEE80211_UNLOCK_ASSERT(ic);
 584
 585         IEEE80211_LOCK(ic);
 586         scan_signal_locked(ss, iflags);
 587         IEEE80211_UNLOCK(ic);
 588 }
 589
 590 static void
 591 scan_signal_locked(struct ieee80211_scan_state *ss, int iflags)
 592 {
 593         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 594         struct timeout_task *scan_task = &ss_priv->ss_scan_curchan;
 595         struct ieee80211com *ic = ss->ss_ic;
 596
 597         IEEE80211_LOCK_ASSERT(ic);
 598
 599         ss_priv->ss_iflags |= iflags;
 600         if (ss_priv->ss_iflags & ISCAN_RUNNING) {
 601                 if (taskqueue_cancel_timeout(ic->ic_tq, scan_task, NULL) == 0)
 602                         taskqueue_enqueue_timeout(ic->ic_tq, scan_task, 0);
 603         }
 604 }
 605
 606 /*
 607  * Handle mindwell requirements completed; initiate a channel
 608  * change to the next channel asap.
 609  */
 610 static void
 611 scan_mindwell(struct ieee80211_scan_state *ss)
 612 {
 613
 614         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: called\n",
 615             __func__);
 616
 617         scan_signal(ss, 0);
 618 }
 619
 620 static void
 621 scan_start(void *arg, int pending)
 622 {
 623 #define ISCAN_REP       (ISCAN_MINDWELL | ISCAN_DISCARD)
 624         struct ieee80211_scan_state *ss = (struct ieee80211_scan_state *) arg;
 625         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 626         struct ieee80211vap *vap = ss->ss_vap;
 627         struct ieee80211com *ic = ss->ss_ic;
 628
 629         IEEE80211_LOCK(ic);
 630         if (vap == NULL || (ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
 631             (ss_priv->ss_iflags & ISCAN_ABORT)) {
 632                 /* Cancelled before we started */
 633                 scan_done(ss, 0);
 634                 return;
 635         }
 636
 637         if (ss->ss_next == ss->ss_last) {
 638                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 639                         "%s: no channels to scan\n", __func__);
 640                 scan_done(ss, 1);
 641                 return;
 642         }
 643
 644         /*
 645          * Put the station into power save mode.
 646          *
 647          * This is only required if we're not a full-offload devices;
 648          * those devices manage scan/traffic differently.
 649          */
 650         if (((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0) &&
 651             vap->iv_opmode == IEEE80211_M_STA &&
 652             vap->iv_state == IEEE80211_S_RUN) {
 653                 if ((vap->iv_bss->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) {
 654                         /* Enable station power save mode */
 655                         vap->iv_sta_ps(vap, 1);
 656                         /* Wait until null data frame will be ACK'ed */
 657                         mtx_sleep(vap, IEEE80211_LOCK_OBJ(ic), PCATCH,
 658                             "sta_ps", msecs_to_ticks(10));
 659                         if (ss_priv->ss_iflags & ISCAN_ABORT) {
 660                                 scan_done(ss, 0);
 661                                 return;
 662                         }
 663                 }
 664         }
 665
 666         ss_priv->ss_scanend = ticks + ss_priv->ss_duration;
 667
 668         /* XXX scan state can change! Re-validate scan state! */
 669
 670         IEEE80211_UNLOCK(ic);
 671
 672         ic->ic_scan_start(ic);          /* notify driver */
 673
 674         scan_curchan_task(ss, 0);
 675 }
 676
 677 static void
 678 scan_curchan_task(void *arg, int pending __unused)
 679 {
 680         struct ieee80211_scan_state *ss = arg;
 681         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 682         struct ieee80211com *ic = ss->ss_ic;
 683         struct ieee80211_channel *chan;
 684         unsigned long maxdwell;
 685         int scandone, scanstop;
 686
 687         IEEE80211_LOCK(ic);
 688 end:
 689         /*
 690          * Note: only /end/ the scan if we're CANCEL rather than
 691          * CANCEL+INTERRUPT (ie, 'PAUSE').
 692          *
 693          * We can stop the scan if we hit cancel, but we shouldn't
 694          * call scan_end(ss, 1) if we're just PAUSEing the scan.
 695          */
 696         scandone = (ss->ss_next >= ss->ss_last) ||
 697             ((ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL);
 698         scanstop = (ss->ss_next >= ss->ss_last) ||
 699             ((ss_priv->ss_iflags & ISCAN_CANCEL) != 0);
 700
 701         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
 702             "%s: loop start; scandone=%d, scanstop=%d, ss_iflags=0x%x, ss_next=%u, ss_last=%u\n",
 703             __func__,
 704             scandone,
 705             scanstop,
 706             (uint32_t) ss_priv->ss_iflags,
 707             (uint32_t) ss->ss_next,
 708             (uint32_t) ss->ss_last);
 709
 710         if (scanstop || (ss->ss_flags & IEEE80211_SCAN_GOTPICK) ||
 711             (ss_priv->ss_iflags & ISCAN_ABORT) ||
 712              ieee80211_time_after(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
 713                 ss_priv->ss_iflags &= ~ISCAN_RUNNING;
 714                 scan_end(ss, scandone);
 715                 return;
 716         } else
 717                 ss_priv->ss_iflags |= ISCAN_RUNNING;
 718
 719         chan = ss->ss_chans[ss->ss_next++];
 720
 721         /*
 722          * Watch for truncation due to the scan end time.
 723          */
 724         if (ieee80211_time_after(ticks + ss->ss_maxdwell, ss_priv->ss_scanend))
 725                 maxdwell = ss_priv->ss_scanend - ticks;
 726         else
 727                 maxdwell = ss->ss_maxdwell;
 728
 729         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
 730             "%s: chan %3d%c -> %3d%c [%s, dwell min %lums max %lums]\n",
 731             __func__,
 732             ieee80211_chan2ieee(ic, ic->ic_curchan),
 733             ieee80211_channel_type_char(ic->ic_curchan),
 734             ieee80211_chan2ieee(ic, chan),
 735             ieee80211_channel_type_char(chan),
 736             (ss->ss_flags & IEEE80211_SCAN_ACTIVE) &&
 737                 (chan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 ?
 738                 "active" : "passive",
 739             ticks_to_msecs(ss->ss_mindwell), ticks_to_msecs(maxdwell));
 740
 741         /*
 742          * Potentially change channel and phy mode.
 743          */
 744         ic->ic_curchan = chan;
 745         ic->ic_rt = ieee80211_get_ratetable(chan);
 746         IEEE80211_UNLOCK(ic);
 747         /*
 748          * Perform the channel change and scan unlocked so the driver
 749          * may sleep. Once set_channel returns the hardware has
 750          * completed the channel change.
 751          */
 752         ic->ic_set_channel(ic);
 753         ieee80211_radiotap_chan_change(ic);
 754
 755         /*
 756          * Scan curchan.  Drivers for "intelligent hardware"
 757          * override ic_scan_curchan to tell the device to do
 758          * the work.  Otherwise we manage the work ourselves;
 759          * sending a probe request (as needed), and arming the
 760          * timeout to switch channels after maxdwell ticks.
 761          *
 762          * scan_curchan should only pause for the time required to
 763          * prepare/initiate the hardware for the scan (if at all).
 764          */
 765         ic->ic_scan_curchan(ss, maxdwell);
 766         IEEE80211_LOCK(ic);
 767
 768         /* XXX scan state can change! Re-validate scan state! */
 769
 770         ss_priv->ss_chanmindwell = ticks + ss->ss_mindwell;
 771         /* clear mindwell lock and initial channel change flush */
 772         ss_priv->ss_iflags &= ~ISCAN_REP;
 773
 774         if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) {
 775                 taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan,
 776                     NULL);
 777                 goto end;
 778         }
 779
 780         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n",
 781             __func__);
 782         IEEE80211_UNLOCK(ic);
 783 }
 784
 785 static void
 786 scan_end(struct ieee80211_scan_state *ss, int scandone)
 787 {
 788         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 789         struct ieee80211vap *vap = ss->ss_vap;
 790         struct ieee80211com *ic = ss->ss_ic;
 791
 792         IEEE80211_LOCK_ASSERT(ic);
 793
 794         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: out\n", __func__);
 795
 796         if (ss_priv->ss_iflags & ISCAN_ABORT) {
 797                 scan_done(ss, scandone);
 798                 return;
 799         }
 800
 801         IEEE80211_UNLOCK(ic);
 802         ic->ic_scan_end(ic);            /* notify driver */
 803         IEEE80211_LOCK(ic);
 804         /* XXX scan state can change! Re-validate scan state! */
 805
 806         /*
 807          * Since a cancellation may have occurred during one of the
 808          * driver calls (whilst unlocked), update scandone.
 809          */
 810         if ((scandone == 0) && ((ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL)) {
 811                 /* XXX printf? */
 812                 if_printf(vap->iv_ifp,
 813                     "%s: OOPS! scan cancelled during driver call (1) (ss_iflags=0x%x)!\n",
 814                     __func__,
 815                     ss_priv->ss_iflags);
 816                 scandone = 1;
 817         }
 818
 819         /*
 820          * Record scan complete time.  Note that we also do
 821          * this when canceled so any background scan will
 822          * not be restarted for a while.
 823          */
 824         if (scandone)
 825                 ic->ic_lastscan = ticks;
 826         /* return to the bss channel */
 827         if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
 828             ic->ic_curchan != ic->ic_bsschan) {
 829                 ieee80211_setupcurchan(ic, ic->ic_bsschan);
 830                 IEEE80211_UNLOCK(ic);
 831                 ic->ic_set_channel(ic);
 832                 ieee80211_radiotap_chan_change(ic);
 833                 IEEE80211_LOCK(ic);
 834         }
 835         /* clear internal flags and any indication of a pick */
 836         ss_priv->ss_iflags &= ~ISCAN_REP;
 837         ss->ss_flags &= ~IEEE80211_SCAN_GOTPICK;
 838
 839         /*
 840          * If not canceled and scan completed, do post-processing.
 841          * If the callback function returns 0, then it wants to
 842          * continue/restart scanning.  Unfortunately we needed to
 843          * notify the driver to end the scan above to avoid having
 844          * rx frames alter the scan candidate list.
 845          */
 846         if ((ss_priv->ss_iflags & ISCAN_CANCEL) == 0 &&
 847             !ss->ss_ops->scan_end(ss, vap) &&
 848             (ss->ss_flags & IEEE80211_SCAN_ONCE) == 0 &&
 849             ieee80211_time_before(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
 850                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 851                     "%s: done, restart "
 852                     "[ticks %u, dwell min %lu scanend %lu]\n",
 853                     __func__,
 854                     ticks, ss->ss_mindwell, ss_priv->ss_scanend);
 855                 ss->ss_next = 0;        /* reset to beginning */
 856                 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 857                         vap->iv_stats.is_scan_active++;
 858                 else
 859                         vap->iv_stats.is_scan_passive++;
 860
 861                 ieee80211_notify_scan_done(vap);
 862                 ss->ss_ops->scan_restart(ss, vap);      /* XXX? */
 863                 ieee80211_runtask(ic, &ss_priv->ss_scan_start);
 864                 IEEE80211_UNLOCK(ic);
 865                 return;
 866         }
 867
 868         /* past here, scandone is ``true'' if not in bg mode */
 869         if ((ss->ss_flags & IEEE80211_SCAN_BGSCAN) == 0)
 870                 scandone = 1;
 871
 872         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 873             "%s: %s, [ticks %u, dwell min %lu scanend %lu]\n",
 874             __func__, scandone ? "done" : "stopped",
 875             ticks, ss->ss_mindwell, ss_priv->ss_scanend);
 876
 877         /*
 878          * Since a cancellation may have occurred during one of the
 879          * driver calls (whilst unlocked), update scandone.
 880          */
 881         if (scandone == 0 && (ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL) {
 882                 /* XXX printf? */
 883                 if_printf(vap->iv_ifp,
 884                     "%s: OOPS! scan cancelled during driver call (2) (ss_iflags=0x%x)!\n",
 885                     __func__,
 886                     ss_priv->ss_iflags);
 887                 scandone = 1;
 888         }
 889
 890         scan_done(ss, scandone);
 891 }
 892
 893 static void
 894 scan_done(struct ieee80211_scan_state *ss, int scandone)
 895 {
 896         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 897         struct ieee80211com *ic = ss->ss_ic;
 898         struct ieee80211vap *vap = ss->ss_vap;
 899
 900         IEEE80211_LOCK_ASSERT(ic);
 901
 902         /*
 903          * Clear the SCAN bit first in case frames are
 904          * pending on the station power save queue.  If
 905          * we defer this then the dispatch of the frames
 906          * may generate a request to cancel scanning.
 907          */
 908         ic->ic_flags &= ~IEEE80211_F_SCAN;
 909
 910         /*
 911          * Drop out of power save mode when a scan has
 912          * completed.  If this scan was prematurely terminated
 913          * because it is a background scan then don't notify
 914          * the ap; we'll either return to scanning after we
 915          * receive the beacon frame or we'll drop out of power
 916          * save mode because the beacon indicates we have frames
 917          * waiting for us.
 918          */
 919         if (scandone) {
 920                 /*
 921                  * If we're not a scan offload device, come back out of
 922                  * station powersave.  Offload devices handle this themselves.
 923                  */
 924                 if ((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0)
 925                         vap->iv_sta_ps(vap, 0);
 926                 if (ss->ss_next >= ss->ss_last) {
 927                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 928                             "%s: Dropping out of scan; ss_next=%u, ss_last=%u\n",
 929                             __func__,
 930                             (uint32_t) ss->ss_next,
 931                             (uint32_t) ss->ss_last);
 932                         ic->ic_flags_ext &= ~IEEE80211_FEXT_BGSCAN;
 933                 }
 934
 935                 /* send 'scan done' event if not interrupted due to traffic. */
 936                 if (!(ss_priv->ss_iflags & ISCAN_INTERRUPT) ||
 937                     (ss->ss_next >= ss->ss_last))
 938                         ieee80211_notify_scan_done(vap);
 939         }
 940         ss_priv->ss_iflags &= ~(ISCAN_PAUSE | ISCAN_ABORT);
 941         ss_priv->ss_scanend = 0;
 942         ss->ss_flags &= ~(IEEE80211_SCAN_ONCE | IEEE80211_SCAN_PICK1ST);
 943         IEEE80211_UNLOCK(ic);
 944 #undef ISCAN_REP
 945 }
 946
 947 /*
 948  * Process a beacon or probe response frame.
 949  */
 950 static void
 951 ieee80211_swscan_add_scan(struct ieee80211vap *vap,
 952         struct ieee80211_channel *curchan,
 953         const struct ieee80211_scanparams *sp,
 954         const struct ieee80211_frame *wh,
 955         int subtype, int rssi, int noise)
 956 {
 957         struct ieee80211com *ic = vap->iv_ic;
 958         struct ieee80211_scan_state *ss = ic->ic_scan;
 959
 960         /* XXX locking */
 961         /*
 962          * Frames received during startup are discarded to avoid
 963          * using scan state setup on the initial entry to the timer
 964          * callback.  This can occur because the device may enable
 965          * rx prior to our doing the initial channel change in the
 966          * timer routine.
 967          */
 968         if (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_DISCARD)
 969                 return;
 970 #ifdef IEEE80211_DEBUG
 971         if (ieee80211_msg_scan(vap) && (ic->ic_flags & IEEE80211_F_SCAN))
 972                 ieee80211_scan_dump_probe_beacon(subtype, 1, wh->i_addr2, sp, rssi);
 973 #endif
 974         if (ss->ss_ops != NULL &&
 975             ss->ss_ops->scan_add(ss, curchan, sp, wh, subtype, rssi, noise)) {
 976                 /*
 977                  * If we've reached the min dwell time terminate
 978                  * the timer so we'll switch to the next channel.
 979                  */
 980                 if ((SCAN_PRIVATE(ss)->ss_iflags & ISCAN_MINDWELL) == 0 &&
 981                     ieee80211_time_after_eq(ticks, SCAN_PRIVATE(ss)->ss_chanmindwell)) {
 982                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 983                             "%s: chan %3d%c min dwell met (%u > %lu)\n",
 984                             __func__,
 985                             ieee80211_chan2ieee(ic, ic->ic_curchan),
 986                             ieee80211_channel_type_char(ic->ic_curchan),
 987                             ticks, SCAN_PRIVATE(ss)->ss_chanmindwell);
 988                         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_MINDWELL;
 989                         /*
 990                          * NB: trigger at next clock tick or wait for the
 991                          * hardware.
 992                          */
 993                         ic->ic_scan_mindwell(ss);
 994                 }
 995         }
 996 }
 997
 998 static struct ieee80211_scan_methods swscan_methods = {
 999         .sc_attach = ieee80211_swscan_attach,
1000         .sc_detach = ieee80211_swscan_detach,
1001         .sc_vattach = ieee80211_swscan_vattach,
1002         .sc_vdetach = ieee80211_swscan_vdetach,
1003         .sc_set_scan_duration = ieee80211_swscan_set_scan_duration,
1004         .sc_start_scan = ieee80211_swscan_start_scan,
1005         .sc_check_scan = ieee80211_swscan_check_scan,
1006         .sc_bg_scan = ieee80211_swscan_bg_scan,
1007         .sc_cancel_scan = ieee80211_swscan_cancel_scan,
1008         .sc_cancel_anyscan = ieee80211_swscan_cancel_anyscan,
1009         .sc_scan_next = ieee80211_swscan_scan_next,
1010         .sc_scan_done = ieee80211_swscan_scan_done,
1011         .sc_scan_probe_curchan = ieee80211_swscan_probe_curchan,
1012         .sc_add_scan = ieee80211_swscan_add_scan
1013 };
1014
1015 /*
1016  * Default scan attach method.
1017  */
1018 void
1019 ieee80211_swscan_attach(struct ieee80211com *ic)
1020 {
1021         struct scan_state *ss;
1022
1023         /*
1024          * Setup the default methods
1025          */
1026         ic->ic_scan_methods = &swscan_methods;
1027
1028         /* Allocate initial scan state */
1029         ss = (struct scan_state *) IEEE80211_MALLOC(sizeof(struct scan_state),
1030                 M_80211_SCAN, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
1031         if (ss == NULL) {
1032                 ic->ic_scan = NULL;
1033                 return;
1034         }
1035         TASK_INIT(&ss->ss_scan_start, 0, scan_start, ss);
1036         TIMEOUT_TASK_INIT(ic->ic_tq, &ss->ss_scan_curchan, 0,
1037             scan_curchan_task, ss);
1038
1039         ic->ic_scan = &ss->base;
1040         ss->base.ss_ic = ic;
1041
1042         ic->ic_scan_curchan = scan_curchan;
1043         ic->ic_scan_mindwell = scan_mindwell;
1044 }