sys/net80211/ieee80211_scan_sw.c

   1 /*-
   2  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include <sys/cdefs.h>
  27 __FBSDID("$FreeBSD$");
  28
  29 /*
  30  * IEEE 802.11 scanning support.
  31  */
  32 #include "opt_wlan.h"
  33
  34 #include <sys/param.h>
  35 #include <sys/systm.h>
  36 #include <sys/proc.h>
  37 #include <sys/kernel.h>
  38 #include <sys/malloc.h>
  39 #include <sys/condvar.h>
  40
  41 #include <sys/socket.h>
  42
  43 #include <net/if.h>
  44 #include <net/if_var.h>
  45 #include <net/if_media.h>
  46 #include <net/ethernet.h>
  47
  48 #include <net80211/ieee80211_var.h>
  49
  50 #include <net80211/ieee80211_scan_sw.h>
  51
  52 #include <net/bpf.h>
  53
  54 struct scan_state {
  55         struct ieee80211_scan_state base;       /* public state */
  56
  57         u_int                   ss_iflags;      /* flags used internally */
  58 #define ISCAN_MINDWELL          0x0001          /* min dwell time reached */
  59 #define ISCAN_DISCARD           0x0002          /* discard rx'd frames */
  60 #define ISCAN_CANCEL            0x0004          /* cancel current scan */
  61 #define ISCAN_ABORT             0x0008          /* end the scan immediately */
  62 #define ISCAN_RUNNING           0x0010          /* scan was started */
  63
  64         unsigned long           ss_chanmindwell;  /* min dwell on curchan */
  65         unsigned long           ss_scanend;     /* time scan must stop */
  66         u_int                   ss_duration;    /* duration for next scan */
  67         struct task             ss_scan_start;  /* scan start */
  68         struct timeout_task     ss_scan_curchan;  /* scan execution */
  69 };
  70 #define SCAN_PRIVATE(ss)        ((struct scan_state *) ss)
  71
  72 /*
  73  * Amount of time to go off-channel during a background
  74  * scan.  This value should be large enough to catch most
  75  * ap's but short enough that we can return on-channel
  76  * before our listen interval expires.
  77  *
  78  * XXX tunable
  79  * XXX check against configured listen interval
  80  */
  81 #define IEEE80211_SCAN_OFFCHANNEL       msecs_to_ticks(150)
  82
  83 static  void scan_curchan(struct ieee80211_scan_state *, unsigned long);
  84 static  void scan_mindwell(struct ieee80211_scan_state *);
  85 static  void scan_signal(struct ieee80211_scan_state *, int);
  86 static  void scan_signal_locked(struct ieee80211_scan_state *, int);
  87 static  void scan_start(void *, int);
  88 static  void scan_curchan_task(void *, int);
  89 static  void scan_end(struct ieee80211_scan_state *, int);
  90 static  void scan_done(struct ieee80211_scan_state *, int);
  91
  92 MALLOC_DEFINE(M_80211_SCAN, "80211scan", "802.11 scan state");
  93
  94 static void
  95 ieee80211_swscan_detach(struct ieee80211com *ic)
  96 {
  97         struct ieee80211_scan_state *ss = ic->ic_scan;
  98
  99         if (ss != NULL) {
 100                 scan_signal(ss, ISCAN_ABORT);
 101                 ieee80211_draintask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
 102                 taskqueue_drain_timeout(ic->ic_tq,
 103                     &SCAN_PRIVATE(ss)->ss_scan_curchan);
 104                 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0,
 105                     ("scan still running"));
 106
 107                 /*
 108                  * For now, do the ss_ops detach here rather
 109                  * than ieee80211_scan_detach().
 110                  *
 111                  * I'll figure out how to cleanly split things up
 112                  * at a later date.
 113                  */
 114                 if (ss->ss_ops != NULL) {
 115                         ss->ss_ops->scan_detach(ss);
 116                         ss->ss_ops = NULL;
 117                 }
 118                 ic->ic_scan = NULL;
 119                 IEEE80211_FREE(SCAN_PRIVATE(ss), M_80211_SCAN);
 120         }
 121 }
 122
 123 static void
 124 ieee80211_swscan_vattach(struct ieee80211vap *vap)
 125 {
 126         /* nothing to do for now */
 127         /*
 128          * TODO: all of the vap scan calls should be methods!
 129          */
 130
 131 }
 132
 133 static void
 134 ieee80211_swscan_vdetach(struct ieee80211vap *vap)
 135 {
 136         struct ieee80211com *ic = vap->iv_ic;
 137         struct ieee80211_scan_state *ss = ic->ic_scan;
 138
 139         IEEE80211_LOCK_ASSERT(ic);
 140
 141         if (ss != NULL && ss->ss_vap == vap &&
 142             (ic->ic_flags & IEEE80211_F_SCAN))
 143                 scan_signal_locked(ss, ISCAN_ABORT);
 144 }
 145
 146 static void
 147 ieee80211_swscan_set_scan_duration(struct ieee80211vap *vap, u_int duration)
 148 {
 149         struct ieee80211com *ic = vap->iv_ic;
 150         struct ieee80211_scan_state *ss = ic->ic_scan;
 151
 152         IEEE80211_LOCK_ASSERT(ic);
 153
 154         /* NB: flush frames rx'd before 1st channel change */
 155         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
 156         SCAN_PRIVATE(ss)->ss_duration = duration;
 157 }
 158
 159 /*
 160  * Start a scan unless one is already going.
 161  */
 162 static int
 163 ieee80211_swscan_start_scan_locked(const struct ieee80211_scanner *scan,
 164         struct ieee80211vap *vap, int flags, u_int duration,
 165         u_int mindwell, u_int maxdwell,
 166         u_int nssid, const struct ieee80211_scan_ssid ssids[])
 167 {
 168         struct ieee80211com *ic = vap->iv_ic;
 169         struct ieee80211_scan_state *ss = ic->ic_scan;
 170
 171         IEEE80211_LOCK_ASSERT(ic);
 172
 173         if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
 174                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 175                     "%s: scan inhibited by pending channel change\n", __func__);
 176         } else if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 177                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 178                     "%s: %s scan, duration %u mindwell %u maxdwell %u, desired mode %s, %s%s%s%s%s%s\n"
 179                     , __func__
 180                     , flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive"
 181                     , duration, mindwell, maxdwell
 182                     , ieee80211_phymode_name[vap->iv_des_mode]
 183                     , flags & IEEE80211_SCAN_FLUSH ? "flush" : "append"
 184                     , flags & IEEE80211_SCAN_NOPICK ? ", nopick" : ""
 185                     , flags & IEEE80211_SCAN_NOJOIN ? ", nojoin" : ""
 186                     , flags & IEEE80211_SCAN_NOBCAST ? ", nobcast" : ""
 187                     , flags & IEEE80211_SCAN_PICK1ST ? ", pick1st" : ""
 188                     , flags & IEEE80211_SCAN_ONCE ? ", once" : ""
 189                 );
 190
 191                 ieee80211_scan_update_locked(vap, scan);
 192                 if (ss->ss_ops != NULL) {
 193                         if ((flags & IEEE80211_SCAN_NOSSID) == 0)
 194                                 ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
 195
 196                         /* NB: top 4 bits for internal use */
 197                         ss->ss_flags = flags & 0xfff;
 198                         if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 199                                 vap->iv_stats.is_scan_active++;
 200                         else
 201                                 vap->iv_stats.is_scan_passive++;
 202                         if (flags & IEEE80211_SCAN_FLUSH)
 203                                 ss->ss_ops->scan_flush(ss);
 204                         if (flags & IEEE80211_SCAN_BGSCAN)
 205                                 ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
 206
 207                         /* Set duration for this particular scan */
 208                         ieee80211_swscan_set_scan_duration(vap, duration);
 209
 210                         ss->ss_next = 0;
 211                         ss->ss_mindwell = mindwell;
 212                         ss->ss_maxdwell = maxdwell;
 213                         /* NB: scan_start must be before the scan runtask */
 214                         ss->ss_ops->scan_start(ss, vap);
 215 #ifdef IEEE80211_DEBUG
 216                         if (ieee80211_msg_scan(vap))
 217                                 ieee80211_scan_dump(ss);
 218 #endif /* IEEE80211_DEBUG */
 219                         ic->ic_flags |= IEEE80211_F_SCAN;
 220
 221                         /* Start scan task */
 222                         ieee80211_runtask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
 223                 }
 224                 return 1;
 225         } else {
 226                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 227                     "%s: %s scan already in progress\n", __func__,
 228                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
 229         }
 230         return 0;
 231 }
 232
 233
 234 /*
 235  * Start a scan unless one is already going.
 236  *
 237  * Called without the comlock held; grab the comlock as appropriate.
 238  */
 239 static int
 240 ieee80211_swscan_start_scan(const struct ieee80211_scanner *scan,
 241     struct ieee80211vap *vap, int flags,
 242     u_int duration, u_int mindwell, u_int maxdwell,
 243     u_int nssid, const struct ieee80211_scan_ssid ssids[])
 244 {
 245         struct ieee80211com *ic = vap->iv_ic;
 246         int result;
 247
 248         IEEE80211_UNLOCK_ASSERT(ic);
 249
 250         IEEE80211_LOCK(ic);
 251         result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
 252             mindwell, maxdwell, nssid, ssids);
 253         IEEE80211_UNLOCK(ic);
 254
 255         return result;
 256 }
 257
 258 /*
 259  * Check the scan cache for an ap/channel to use; if that
 260  * fails then kick off a new scan.
 261  *
 262  * Called with the comlock held.
 263  *
 264  * XXX TODO: split out!
 265  */
 266 static int
 267 ieee80211_swscan_check_scan(const struct ieee80211_scanner *scan,
 268     struct ieee80211vap *vap, int flags,
 269     u_int duration, u_int mindwell, u_int maxdwell,
 270     u_int nssid, const struct ieee80211_scan_ssid ssids[])
 271 {
 272         struct ieee80211com *ic = vap->iv_ic;
 273         struct ieee80211_scan_state *ss = ic->ic_scan;
 274         int result;
 275
 276         IEEE80211_LOCK_ASSERT(ic);
 277
 278         if (ss->ss_ops != NULL) {
 279                 /* XXX verify ss_ops matches vap->iv_opmode */
 280                 if ((flags & IEEE80211_SCAN_NOSSID) == 0) {
 281                         /*
 282                          * Update the ssid list and mark flags so if
 283                          * we call start_scan it doesn't duplicate work.
 284                          */
 285                         ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
 286                         flags |= IEEE80211_SCAN_NOSSID;
 287                 }
 288                 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
 289                     (flags & IEEE80211_SCAN_FLUSH) == 0 &&
 290                     ieee80211_time_before(ticks, ic->ic_lastscan + vap->iv_scanvalid)) {
 291                         /*
 292                          * We're not currently scanning and the cache is
 293                          * deemed hot enough to consult.  Lock out others
 294                          * by marking IEEE80211_F_SCAN while we decide if
 295                          * something is already in the scan cache we can
 296                          * use.  Also discard any frames that might come
 297                          * in while temporarily marked as scanning.
 298                          */
 299                         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
 300                         ic->ic_flags |= IEEE80211_F_SCAN;
 301
 302                         /* NB: need to use supplied flags in check */
 303                         ss->ss_flags = flags & 0xff;
 304                         result = ss->ss_ops->scan_end(ss, vap);
 305
 306                         ic->ic_flags &= ~IEEE80211_F_SCAN;
 307                         SCAN_PRIVATE(ss)->ss_iflags &= ~ISCAN_DISCARD;
 308                         if (result) {
 309                                 ieee80211_notify_scan_done(vap);
 310                                 return 1;
 311                         }
 312                 }
 313         }
 314         result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
 315             mindwell, maxdwell, nssid, ssids);
 316
 317         return result;
 318 }
 319
 320 /*
 321  * Restart a previous scan.  If the previous scan completed
 322  * then we start again using the existing channel list.
 323  */
 324 static int
 325 ieee80211_swscan_bg_scan(const struct ieee80211_scanner *scan,
 326     struct ieee80211vap *vap, int flags)
 327 {
 328         struct ieee80211com *ic = vap->iv_ic;
 329         struct ieee80211_scan_state *ss = ic->ic_scan;
 330
 331         /* XXX assert unlocked? */
 332         // IEEE80211_UNLOCK_ASSERT(ic);
 333
 334         IEEE80211_LOCK(ic);
 335         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 336                 u_int duration;
 337                 /*
 338                  * Go off-channel for a fixed interval that is large
 339                  * enough to catch most ap's but short enough that
 340                  * we can return on-channel before our listen interval
 341                  * expires.
 342                  */
 343                 duration = IEEE80211_SCAN_OFFCHANNEL;
 344
 345                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 346                     "%s: %s scan, ticks %u duration %u\n", __func__,
 347                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive",
 348                     ticks, duration);
 349
 350                 ieee80211_scan_update_locked(vap, scan);
 351                 if (ss->ss_ops != NULL) {
 352                         ss->ss_vap = vap;
 353                         /*
 354                          * A background scan does not select a new sta; it
 355                          * just refreshes the scan cache.  Also, indicate
 356                          * the scan logic should follow the beacon schedule:
 357                          * we go off-channel and scan for a while, then
 358                          * return to the bss channel to receive a beacon,
 359                          * then go off-channel again.  All during this time
 360                          * we notify the ap we're in power save mode.  When
 361                          * the scan is complete we leave power save mode.
 362                          * If any beacon indicates there are frames pending
 363                          * for us then we drop out of power save mode
 364                          * (and background scan) automatically by way of the
 365                          * usual sta power save logic.
 366                          */
 367                         ss->ss_flags |= IEEE80211_SCAN_NOPICK
 368                                      |  IEEE80211_SCAN_BGSCAN
 369                                      |  flags
 370                                      ;
 371                         /* if previous scan completed, restart */
 372                         if (ss->ss_next >= ss->ss_last) {
 373                                 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 374                                         vap->iv_stats.is_scan_active++;
 375                                 else
 376                                         vap->iv_stats.is_scan_passive++;
 377                                 /*
 378                                  * NB: beware of the scan cache being flushed;
 379                                  *     if the channel list is empty use the
 380                                  *     scan_start method to populate it.
 381                                  */
 382                                 ss->ss_next = 0;
 383                                 if (ss->ss_last != 0)
 384                                         ss->ss_ops->scan_restart(ss, vap);
 385                                 else {
 386                                         ss->ss_ops->scan_start(ss, vap);
 387 #ifdef IEEE80211_DEBUG
 388                                         if (ieee80211_msg_scan(vap))
 389                                                 ieee80211_scan_dump(ss);
 390 #endif /* IEEE80211_DEBUG */
 391                                 }
 392                         }
 393                         ieee80211_swscan_set_scan_duration(vap, duration);
 394                         ss->ss_maxdwell = duration;
 395                         ic->ic_flags |= IEEE80211_F_SCAN;
 396                         ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
 397                         ieee80211_runtask(ic,
 398                             &SCAN_PRIVATE(ss)->ss_scan_start);
 399                 } else {
 400                         /* XXX msg+stat */
 401                 }
 402         } else {
 403                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 404                     "%s: %s scan already in progress\n", __func__,
 405                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
 406         }
 407         IEEE80211_UNLOCK(ic);
 408
 409         /* NB: racey, does it matter? */
 410         return (ic->ic_flags & IEEE80211_F_SCAN);
 411 }
 412
 413 static void
 414 cancel_scan(struct ieee80211vap *vap, int any, const char *func)
 415 {
 416         struct ieee80211com *ic = vap->iv_ic;
 417         struct ieee80211_scan_state *ss = ic->ic_scan;
 418
 419         IEEE80211_LOCK(ic);
 420         if ((ic->ic_flags & IEEE80211_F_SCAN) &&
 421             (any || ss->ss_vap == vap) &&
 422             (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_CANCEL) == 0) {
 423                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 424                     "%s: cancel %s scan\n", func,
 425                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ?
 426                         "active" : "passive");
 427
 428                 /* clear bg scan NOPICK */
 429                 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
 430                 /* mark cancel request and wake up the scan task */
 431                 scan_signal_locked(ss, ISCAN_CANCEL);
 432         } else {
 433                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 434                     "%s: called; F_SCAN=%d, vap=%s, CANCEL=%d\n",
 435                         func,
 436                         !! (ic->ic_flags & IEEE80211_F_SCAN),
 437                         (ss->ss_vap == vap ? "match" : "nomatch"),
 438                         !! (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_CANCEL));
 439         }
 440         IEEE80211_UNLOCK(ic);
 441 }
 442
 443 /*
 444  * Cancel any scan currently going on for the specified vap.
 445  */
 446 static void
 447 ieee80211_swscan_cancel_scan(struct ieee80211vap *vap)
 448 {
 449         cancel_scan(vap, 0, __func__);
 450 }
 451
 452 /*
 453  * Cancel any scan currently going on.
 454  */
 455 static void
 456 ieee80211_swscan_cancel_anyscan(struct ieee80211vap *vap)
 457 {
 458         cancel_scan(vap, 1, __func__);
 459 }
 460
 461 /*
 462  * Manually switch to the next channel in the channel list.
 463  * Provided for drivers that manage scanning themselves
 464  * (e.g. for firmware-based devices).
 465  */
 466 static void
 467 ieee80211_swscan_scan_next(struct ieee80211vap *vap)
 468 {
 469         struct ieee80211_scan_state *ss = vap->iv_ic->ic_scan;
 470
 471         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: called\n", __func__);
 472
 473         /* wake up the scan task */
 474         scan_signal(ss, 0);
 475 }
 476
 477 /*
 478  * Manually stop a scan that is currently running.
 479  * Provided for drivers that are not able to scan single channels
 480  * (e.g. for firmware-based devices).
 481  */
 482 static void
 483 ieee80211_swscan_scan_done(struct ieee80211vap *vap)
 484 {
 485         struct ieee80211com *ic = vap->iv_ic;
 486         struct ieee80211_scan_state *ss = ic->ic_scan;
 487
 488         IEEE80211_LOCK_ASSERT(ic);
 489
 490         scan_signal_locked(ss, 0);
 491 }
 492
 493 /*
 494  * Probe the current channel, if allowed, while scanning.
 495  * If the channel is not marked passive-only then send
 496  * a probe request immediately.  Otherwise mark state and
 497  * listen for beacons on the channel; if we receive something
 498  * then we'll transmit a probe request.
 499  */
 500 static void
 501 ieee80211_swscan_probe_curchan(struct ieee80211vap *vap, int force)
 502 {
 503         struct ieee80211com *ic = vap->iv_ic;
 504         struct ieee80211_scan_state *ss = ic->ic_scan;
 505         struct ifnet *ifp = vap->iv_ifp;
 506         int i;
 507
 508         /*
 509          * Send directed probe requests followed by any
 510          * broadcast probe request.
 511          * XXX remove dependence on ic/vap->iv_bss
 512          */
 513         for (i = 0; i < ss->ss_nssid; i++)
 514                 ieee80211_send_probereq(vap->iv_bss,
 515                         vap->iv_myaddr, ifp->if_broadcastaddr,
 516                         ifp->if_broadcastaddr,
 517                         ss->ss_ssid[i].ssid, ss->ss_ssid[i].len);
 518         if ((ss->ss_flags & IEEE80211_SCAN_NOBCAST) == 0)
 519                 ieee80211_send_probereq(vap->iv_bss,
 520                         vap->iv_myaddr, ifp->if_broadcastaddr,
 521                         ifp->if_broadcastaddr,
 522                         "", 0);
 523 }
 524
 525 /*
 526  * Scan curchan.  If this is an active scan and the channel
 527  * is not marked passive then send probe request frame(s).
 528  * Arrange for the channel change after maxdwell ticks.
 529  */
 530 static void
 531 scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
 532 {
 533         struct ieee80211vap *vap  = ss->ss_vap;
 534         struct ieee80211com *ic = ss->ss_ic;
 535
 536         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 537             "%s: calling; maxdwell=%lu\n",
 538             __func__,
 539             maxdwell);
 540         IEEE80211_LOCK(ic);
 541         if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 542                 ieee80211_probe_curchan(vap, 0);
 543         taskqueue_enqueue_timeout(ic->ic_tq,
 544             &SCAN_PRIVATE(ss)->ss_scan_curchan, maxdwell);
 545         IEEE80211_UNLOCK(ic);
 546 }
 547
 548 static void
 549 scan_signal(struct ieee80211_scan_state *ss, int iflags)
 550 {
 551         struct ieee80211com *ic = ss->ss_ic;
 552
 553         IEEE80211_UNLOCK_ASSERT(ic);
 554
 555         IEEE80211_LOCK(ic);
 556         scan_signal_locked(ss, iflags);
 557         IEEE80211_UNLOCK(ic);
 558 }
 559
 560 static void
 561 scan_signal_locked(struct ieee80211_scan_state *ss, int iflags)
 562 {
 563         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 564         struct timeout_task *scan_task = &ss_priv->ss_scan_curchan;
 565         struct ieee80211com *ic = ss->ss_ic;
 566
 567         IEEE80211_LOCK_ASSERT(ic);
 568
 569         ss_priv->ss_iflags |= iflags;
 570         if (ss_priv->ss_iflags & ISCAN_RUNNING) {
 571                 if (taskqueue_cancel_timeout(ic->ic_tq, scan_task, NULL) == 0)
 572                         taskqueue_enqueue_timeout(ic->ic_tq, scan_task, 0);
 573         }
 574 }
 575
 576 /*
 577  * Handle mindwell requirements completed; initiate a channel
 578  * change to the next channel asap.
 579  */
 580 static void
 581 scan_mindwell(struct ieee80211_scan_state *ss)
 582 {
 583
 584         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: called\n",
 585             __func__);
 586
 587         scan_signal(ss, 0);
 588 }
 589
 590 static void
 591 scan_start(void *arg, int pending)
 592 {
 593 #define ISCAN_REP       (ISCAN_MINDWELL | ISCAN_DISCARD)
 594         struct ieee80211_scan_state *ss = (struct ieee80211_scan_state *) arg;
 595         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 596         struct ieee80211vap *vap = ss->ss_vap;
 597         struct ieee80211com *ic = ss->ss_ic;
 598
 599         IEEE80211_LOCK(ic);
 600         if (vap == NULL || (ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
 601             (ss_priv->ss_iflags & ISCAN_ABORT)) {
 602                 /* Cancelled before we started */
 603                 scan_done(ss, 0);
 604                 return;
 605         }
 606
 607         if (ss->ss_next == ss->ss_last) {
 608                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 609                         "%s: no channels to scan\n", __func__);
 610                 scan_done(ss, 1);
 611                 return;
 612         }
 613
 614         if (vap->iv_opmode == IEEE80211_M_STA &&
 615             vap->iv_state == IEEE80211_S_RUN) {
 616                 if ((vap->iv_bss->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) {
 617                         /* Enable station power save mode */
 618                         vap->iv_sta_ps(vap, 1);
 619                         /* Wait until null data frame will be ACK'ed */
 620                         mtx_sleep(vap, IEEE80211_LOCK_OBJ(ic), PCATCH,
 621                             "sta_ps", msecs_to_ticks(10));
 622                         if (ss_priv->ss_iflags & ISCAN_ABORT) {
 623                                 scan_done(ss, 0);
 624                                 return;
 625                         }
 626                 }
 627         }
 628
 629         ss_priv->ss_scanend = ticks + ss_priv->ss_duration;
 630
 631         /* XXX scan state can change! Re-validate scan state! */
 632
 633         IEEE80211_UNLOCK(ic);
 634
 635         ic->ic_scan_start(ic);          /* notify driver */
 636
 637         scan_curchan_task(ss, 0);
 638 }
 639
 640 static void
 641 scan_curchan_task(void *arg, int pending)
 642 {
 643         struct ieee80211_scan_state *ss = arg;
 644         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 645         struct ieee80211com *ic = ss->ss_ic;
 646         struct ieee80211_channel *chan;
 647         unsigned long maxdwell;
 648         int scandone;
 649
 650         IEEE80211_LOCK(ic);
 651 end:
 652         scandone = (ss->ss_next >= ss->ss_last) ||
 653             (ss_priv->ss_iflags & ISCAN_CANCEL) != 0;
 654
 655         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
 656             "%s: loop start; scandone=%d\n",
 657             __func__,
 658             scandone);
 659
 660         if (scandone || (ss->ss_flags & IEEE80211_SCAN_GOTPICK) ||
 661             (ss_priv->ss_iflags & ISCAN_ABORT) ||
 662              ieee80211_time_after(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
 663                 ss_priv->ss_iflags &= ~ISCAN_RUNNING;
 664                 scan_end(ss, scandone);
 665                 return;
 666         } else
 667                 ss_priv->ss_iflags |= ISCAN_RUNNING;
 668
 669         chan = ss->ss_chans[ss->ss_next++];
 670
 671         /*
 672          * Watch for truncation due to the scan end time.
 673          */
 674         if (ieee80211_time_after(ticks + ss->ss_maxdwell, ss_priv->ss_scanend))
 675                 maxdwell = ss_priv->ss_scanend - ticks;
 676         else
 677                 maxdwell = ss->ss_maxdwell;
 678
 679         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
 680             "%s: chan %3d%c -> %3d%c [%s, dwell min %lums max %lums]\n",
 681             __func__,
 682             ieee80211_chan2ieee(ic, ic->ic_curchan),
 683             ieee80211_channel_type_char(ic->ic_curchan),
 684             ieee80211_chan2ieee(ic, chan),
 685             ieee80211_channel_type_char(chan),
 686             (ss->ss_flags & IEEE80211_SCAN_ACTIVE) &&
 687                 (chan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 ?
 688                 "active" : "passive",
 689             ticks_to_msecs(ss->ss_mindwell), ticks_to_msecs(maxdwell));
 690
 691         /*
 692          * Potentially change channel and phy mode.
 693          */
 694         ic->ic_curchan = chan;
 695         ic->ic_rt = ieee80211_get_ratetable(chan);
 696         IEEE80211_UNLOCK(ic);
 697         /*
 698          * Perform the channel change and scan unlocked so the driver
 699          * may sleep. Once set_channel returns the hardware has
 700          * completed the channel change.
 701          */
 702         ic->ic_set_channel(ic);
 703         ieee80211_radiotap_chan_change(ic);
 704
 705         /*
 706          * Scan curchan.  Drivers for "intelligent hardware"
 707          * override ic_scan_curchan to tell the device to do
 708          * the work.  Otherwise we manage the work ourselves;
 709          * sending a probe request (as needed), and arming the
 710          * timeout to switch channels after maxdwell ticks.
 711          *
 712          * scan_curchan should only pause for the time required to
 713          * prepare/initiate the hardware for the scan (if at all).
 714          */
 715         ic->ic_scan_curchan(ss, maxdwell);
 716         IEEE80211_LOCK(ic);
 717
 718         /* XXX scan state can change! Re-validate scan state! */
 719
 720         ss_priv->ss_chanmindwell = ticks + ss->ss_mindwell;
 721         /* clear mindwell lock and initial channel change flush */
 722         ss_priv->ss_iflags &= ~ISCAN_REP;
 723
 724         if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) {
 725                 taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan,
 726                     NULL);
 727                 goto end;
 728         }
 729
 730         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n",
 731             __func__);
 732         IEEE80211_UNLOCK(ic);
 733 }
 734
 735 static void
 736 scan_end(struct ieee80211_scan_state *ss, int scandone)
 737 {
 738         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 739         struct ieee80211vap *vap = ss->ss_vap;
 740         struct ieee80211com *ic = ss->ss_ic;
 741
 742         IEEE80211_LOCK_ASSERT(ic);
 743
 744         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: out\n", __func__);
 745
 746         if (ss_priv->ss_iflags & ISCAN_ABORT) {
 747                 scan_done(ss, scandone);
 748                 return;
 749         }
 750
 751         IEEE80211_UNLOCK(ic);
 752         ic->ic_scan_end(ic);            /* notify driver */
 753         IEEE80211_LOCK(ic);
 754         /* XXX scan state can change! Re-validate scan state! */
 755
 756         /*
 757          * Since a cancellation may have occurred during one of the
 758          * driver calls (whilst unlocked), update scandone.
 759          */
 760         if (scandone == 0 && (ss_priv->ss_iflags & ISCAN_CANCEL) != 0) {
 761                 /* XXX printf? */
 762                 if_printf(vap->iv_ifp,
 763                     "%s: OOPS! scan cancelled during driver call (1)!\n",
 764                     __func__);
 765                 scandone = 1;
 766         }
 767
 768         /*
 769          * Record scan complete time.  Note that we also do
 770          * this when canceled so any background scan will
 771          * not be restarted for a while.
 772          */
 773         if (scandone)
 774                 ic->ic_lastscan = ticks;
 775         /* return to the bss channel */
 776         if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
 777             ic->ic_curchan != ic->ic_bsschan) {
 778                 ieee80211_setupcurchan(ic, ic->ic_bsschan);
 779                 IEEE80211_UNLOCK(ic);
 780                 ic->ic_set_channel(ic);
 781                 ieee80211_radiotap_chan_change(ic);
 782                 IEEE80211_LOCK(ic);
 783         }
 784         /* clear internal flags and any indication of a pick */
 785         ss_priv->ss_iflags &= ~ISCAN_REP;
 786         ss->ss_flags &= ~IEEE80211_SCAN_GOTPICK;
 787
 788         /*
 789          * If not canceled and scan completed, do post-processing.
 790          * If the callback function returns 0, then it wants to
 791          * continue/restart scanning.  Unfortunately we needed to
 792          * notify the driver to end the scan above to avoid having
 793          * rx frames alter the scan candidate list.
 794          */
 795         if ((ss_priv->ss_iflags & ISCAN_CANCEL) == 0 &&
 796             !ss->ss_ops->scan_end(ss, vap) &&
 797             (ss->ss_flags & IEEE80211_SCAN_ONCE) == 0 &&
 798             ieee80211_time_before(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
 799                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 800                     "%s: done, restart "
 801                     "[ticks %u, dwell min %lu scanend %lu]\n",
 802                     __func__,
 803                     ticks, ss->ss_mindwell, ss_priv->ss_scanend);
 804                 ss->ss_next = 0;        /* reset to beginning */
 805                 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 806                         vap->iv_stats.is_scan_active++;
 807                 else
 808                         vap->iv_stats.is_scan_passive++;
 809
 810                 ss->ss_ops->scan_restart(ss, vap);      /* XXX? */
 811                 ieee80211_runtask(ic, &ss_priv->ss_scan_start);
 812                 IEEE80211_UNLOCK(ic);
 813                 return;
 814         }
 815
 816         /* past here, scandone is ``true'' if not in bg mode */
 817         if ((ss->ss_flags & IEEE80211_SCAN_BGSCAN) == 0)
 818                 scandone = 1;
 819
 820         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 821             "%s: %s, [ticks %u, dwell min %lu scanend %lu]\n",
 822             __func__, scandone ? "done" : "stopped",
 823             ticks, ss->ss_mindwell, ss_priv->ss_scanend);
 824
 825         /*
 826          * Since a cancellation may have occurred during one of the
 827          * driver calls (whilst unlocked), update scandone.
 828          */
 829         if (scandone == 0 && (ss_priv->ss_iflags & ISCAN_CANCEL) != 0) {
 830                 /* XXX printf? */
 831                 if_printf(vap->iv_ifp,
 832                     "%s: OOPS! scan cancelled during driver call (2)!\n",
 833                     __func__);
 834                 scandone = 1;
 835         }
 836
 837         scan_done(ss, scandone);
 838 }
 839
 840 static void
 841 scan_done(struct ieee80211_scan_state *ss, int scandone)
 842 {
 843         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 844         struct ieee80211com *ic = ss->ss_ic;
 845         struct ieee80211vap *vap = ss->ss_vap;
 846
 847         IEEE80211_LOCK_ASSERT(ic);
 848
 849         /*
 850          * Clear the SCAN bit first in case frames are
 851          * pending on the station power save queue.  If
 852          * we defer this then the dispatch of the frames
 853          * may generate a request to cancel scanning.
 854          */
 855         ic->ic_flags &= ~IEEE80211_F_SCAN;
 856
 857         /*
 858          * Drop out of power save mode when a scan has
 859          * completed.  If this scan was prematurely terminated
 860          * because it is a background scan then don't notify
 861          * the ap; we'll either return to scanning after we
 862          * receive the beacon frame or we'll drop out of power
 863          * save mode because the beacon indicates we have frames
 864          * waiting for us.
 865          */
 866         if (scandone) {
 867                 vap->iv_sta_ps(vap, 0);
 868                 if (ss->ss_next >= ss->ss_last)
 869                         ic->ic_flags_ext &= ~IEEE80211_FEXT_BGSCAN;
 870
 871                 ieee80211_notify_scan_done(vap);
 872         }
 873         ss_priv->ss_iflags &= ~(ISCAN_CANCEL|ISCAN_ABORT);
 874         ss_priv->ss_scanend = 0;
 875         ss->ss_flags &= ~(IEEE80211_SCAN_ONCE | IEEE80211_SCAN_PICK1ST);
 876         IEEE80211_UNLOCK(ic);
 877 #undef ISCAN_REP
 878 }
 879
 880 /*
 881  * Process a beacon or probe response frame.
 882  */
 883 static void
 884 ieee80211_swscan_add_scan(struct ieee80211vap *vap,
 885         struct ieee80211_channel *curchan,
 886         const struct ieee80211_scanparams *sp,
 887         const struct ieee80211_frame *wh,
 888         int subtype, int rssi, int noise)
 889 {
 890         struct ieee80211com *ic = vap->iv_ic;
 891         struct ieee80211_scan_state *ss = ic->ic_scan;
 892
 893         /* XXX locking */
 894         /*
 895          * Frames received during startup are discarded to avoid
 896          * using scan state setup on the initial entry to the timer
 897          * callback.  This can occur because the device may enable
 898          * rx prior to our doing the initial channel change in the
 899          * timer routine.
 900          */
 901         if (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_DISCARD)
 902                 return;
 903 #ifdef IEEE80211_DEBUG
 904         if (ieee80211_msg_scan(vap) && (ic->ic_flags & IEEE80211_F_SCAN))
 905                 ieee80211_scan_dump_probe_beacon(subtype, 1, wh->i_addr2, sp, rssi);
 906 #endif
 907         if (ss->ss_ops != NULL &&
 908             ss->ss_ops->scan_add(ss, curchan, sp, wh, subtype, rssi, noise)) {
 909                 /*
 910                  * If we've reached the min dwell time terminate
 911                  * the timer so we'll switch to the next channel.
 912                  */
 913                 if ((SCAN_PRIVATE(ss)->ss_iflags & ISCAN_MINDWELL) == 0 &&
 914                     ieee80211_time_after_eq(ticks, SCAN_PRIVATE(ss)->ss_chanmindwell)) {
 915                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 916                             "%s: chan %3d%c min dwell met (%u > %lu)\n",
 917                             __func__,
 918                             ieee80211_chan2ieee(ic, ic->ic_curchan),
 919                             ieee80211_channel_type_char(ic->ic_curchan),
 920                             ticks, SCAN_PRIVATE(ss)->ss_chanmindwell);
 921                         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_MINDWELL;
 922                         /*
 923                          * NB: trigger at next clock tick or wait for the
 924                          * hardware.
 925                          */
 926                         ic->ic_scan_mindwell(ss);
 927                 }
 928         }
 929 }
 930
 931 static struct ieee80211_scan_methods swscan_methods = {
 932         .sc_attach = ieee80211_swscan_attach,
 933         .sc_detach = ieee80211_swscan_detach,
 934         .sc_vattach = ieee80211_swscan_vattach,
 935         .sc_vdetach = ieee80211_swscan_vdetach,
 936         .sc_set_scan_duration = ieee80211_swscan_set_scan_duration,
 937         .sc_start_scan = ieee80211_swscan_start_scan,
 938         .sc_check_scan = ieee80211_swscan_check_scan,
 939         .sc_bg_scan = ieee80211_swscan_bg_scan,
 940         .sc_cancel_scan = ieee80211_swscan_cancel_scan,
 941         .sc_cancel_anyscan = ieee80211_swscan_cancel_anyscan,
 942         .sc_scan_next = ieee80211_swscan_scan_next,
 943         .sc_scan_done = ieee80211_swscan_scan_done,
 944         .sc_scan_probe_curchan = ieee80211_swscan_probe_curchan,
 945         .sc_add_scan = ieee80211_swscan_add_scan
 946 };
 947
 948 /*
 949  * Default scan attach method.
 950  */
 951 void
 952 ieee80211_swscan_attach(struct ieee80211com *ic)
 953 {
 954         struct scan_state *ss;
 955
 956         /*
 957          * Setup the default methods
 958          */
 959         ic->ic_scan_methods = &swscan_methods;
 960
 961         /* Allocate initial scan state */
 962         ss = (struct scan_state *) IEEE80211_MALLOC(sizeof(struct scan_state),
 963                 M_80211_SCAN, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
 964         if (ss == NULL) {
 965                 ic->ic_scan = NULL;
 966                 return;
 967         }
 968         TASK_INIT(&ss->ss_scan_start, 0, scan_start, ss);
 969         TIMEOUT_TASK_INIT(ic->ic_tq, &ss->ss_scan_curchan, 0,
 970             scan_curchan_task, ss);
 971
 972         ic->ic_scan = &ss->base;
 973         ss->base.ss_ic = ic;
 974
 975         ic->ic_scan_curchan = scan_curchan;
 976         ic->ic_scan_mindwell = scan_mindwell;
 977 }