1 /*- 2 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/cdefs.h> 27 /* 28 * IEEE 802.11 scanning support. 29 */ 30 #include "opt_wlan.h" 31 32 #include <sys/param.h> 33 #include <sys/systm.h> 34 #include <sys/proc.h> 35 #include <sys/kernel.h> 36 #include <sys/malloc.h> 37 #include <sys/condvar.h> 38 39 #include <sys/socket.h> 40 41 #include <net/if.h> 42 #include <net/if_var.h> 43 #include <net/if_media.h> 44 #include <net/if_private.h> 45 #include <net/ethernet.h> 46 47 #include <net80211/ieee80211_var.h> 48 49 #include <net80211/ieee80211_scan_sw.h> 50 51 #include <net/bpf.h> 52 53 struct scan_state { 54 struct ieee80211_scan_state base; /* public state */ 55 56 u_int ss_iflags; /* flags used internally */ 57 #define ISCAN_MINDWELL 0x0001 /* min dwell time reached */ 58 #define ISCAN_DISCARD 0x0002 /* discard rx'd frames */ 59 #define ISCAN_INTERRUPT 0x0004 /* interrupt current scan */ 60 #define ISCAN_CANCEL 0x0008 /* cancel current scan */ 61 #define ISCAN_PAUSE (ISCAN_INTERRUPT | ISCAN_CANCEL) 62 #define ISCAN_ABORT 0x0010 /* end the scan immediately */ 63 #define ISCAN_RUNNING 0x0020 /* scan was started */ 64 65 unsigned long ss_chanmindwell; /* min dwell on curchan */ 66 unsigned long ss_scanend; /* time scan must stop */ 67 u_int ss_duration; /* duration for next scan */ 68 struct task ss_scan_start; /* scan start */ 69 struct timeout_task ss_scan_curchan; /* scan execution */ 70 }; 71 #define SCAN_PRIVATE(ss) ((struct scan_state *) ss) 72 73 /* 74 * Amount of time to go off-channel during a background 75 * scan. This value should be large enough to catch most 76 * ap's but short enough that we can return on-channel 77 * before our listen interval expires. 78 * 79 * XXX tunable 80 * XXX check against configured listen interval 81 */ 82 #define IEEE80211_SCAN_OFFCHANNEL msecs_to_ticks(150) 83 84 static void scan_curchan(struct ieee80211_scan_state *, unsigned long); 85 static void scan_mindwell(struct ieee80211_scan_state *); 86 static void scan_signal(struct ieee80211_scan_state *, int); 87 static void scan_signal_locked(struct ieee80211_scan_state *, int); 88 static void scan_start(void *, int); 89 static void scan_curchan_task(void *, int); 90 static void scan_end(struct ieee80211_scan_state *, int); 91 static void scan_done(struct ieee80211_scan_state *, int); 92 93 MALLOC_DEFINE(M_80211_SCAN, "80211scan", "802.11 scan state"); 94 95 static void 96 ieee80211_swscan_detach(struct ieee80211com *ic) 97 { 98 struct ieee80211_scan_state *ss = ic->ic_scan; 99 100 if (ss != NULL) { 101 scan_signal(ss, ISCAN_ABORT); 102 ieee80211_draintask(ic, &SCAN_PRIVATE(ss)->ss_scan_start); 103 taskqueue_drain_timeout(ic->ic_tq, 104 &SCAN_PRIVATE(ss)->ss_scan_curchan); 105 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, 106 ("scan still running")); 107 108 /* 109 * For now, do the ss_ops detach here rather 110 * than ieee80211_scan_detach(). 111 * 112 * I'll figure out how to cleanly split things up 113 * at a later date. 114 */ 115 if (ss->ss_ops != NULL) { 116 ss->ss_ops->scan_detach(ss); 117 ss->ss_ops = NULL; 118 } 119 ic->ic_scan = NULL; 120 IEEE80211_FREE(SCAN_PRIVATE(ss), M_80211_SCAN); 121 } 122 } 123 124 static void 125 ieee80211_swscan_vattach(struct ieee80211vap *vap) 126 { 127 /* nothing to do for now */ 128 /* 129 * TODO: all of the vap scan calls should be methods! 130 */ 131 132 } 133 134 static void 135 ieee80211_swscan_vdetach(struct ieee80211vap *vap) 136 { 137 struct ieee80211com *ic = vap->iv_ic; 138 struct ieee80211_scan_state *ss = ic->ic_scan; 139 140 IEEE80211_LOCK_ASSERT(ic); 141 142 if (ss != NULL && ss->ss_vap == vap && 143 (ic->ic_flags & IEEE80211_F_SCAN)) 144 scan_signal_locked(ss, ISCAN_ABORT); 145 } 146 147 static void 148 ieee80211_swscan_set_scan_duration(struct ieee80211vap *vap, u_int duration) 149 { 150 struct ieee80211com *ic = vap->iv_ic; 151 struct ieee80211_scan_state *ss = ic->ic_scan; 152 153 IEEE80211_LOCK_ASSERT(ic); 154 155 /* NB: flush frames rx'd before 1st channel change */ 156 SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD; 157 SCAN_PRIVATE(ss)->ss_duration = duration; 158 } 159 160 /* 161 * Start a scan unless one is already going. 162 */ 163 static int 164 ieee80211_swscan_start_scan_locked(const struct ieee80211_scanner *scan, 165 struct ieee80211vap *vap, int flags, u_int duration, 166 u_int mindwell, u_int maxdwell, 167 u_int nssid, const struct ieee80211_scan_ssid ssids[]) 168 { 169 struct ieee80211com *ic = vap->iv_ic; 170 struct ieee80211_scan_state *ss = ic->ic_scan; 171 172 IEEE80211_LOCK_ASSERT(ic); 173 174 if (ic->ic_flags & IEEE80211_F_CSAPENDING) { 175 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 176 "%s: scan inhibited by pending channel change\n", __func__); 177 } else if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 178 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 179 "%s: %s scan, duration %u mindwell %u maxdwell %u, desired mode %s, %s%s%s%s%s%s\n" 180 , __func__ 181 , flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive" 182 , duration, mindwell, maxdwell 183 , ieee80211_phymode_name[vap->iv_des_mode] 184 , flags & IEEE80211_SCAN_FLUSH ? "flush" : "append" 185 , flags & IEEE80211_SCAN_NOPICK ? ", nopick" : "" 186 , flags & IEEE80211_SCAN_NOJOIN ? ", nojoin" : "" 187 , flags & IEEE80211_SCAN_NOBCAST ? ", nobcast" : "" 188 , flags & IEEE80211_SCAN_PICK1ST ? ", pick1st" : "" 189 , flags & IEEE80211_SCAN_ONCE ? ", once" : "" 190 ); 191 192 ieee80211_scan_update_locked(vap, scan); 193 if (ss->ss_ops != NULL) { 194 if ((flags & IEEE80211_SCAN_NOSSID) == 0) 195 ieee80211_scan_copy_ssid(vap, ss, nssid, ssids); 196 197 ss->ss_flags = flags & IEEE80211_SCAN_PUBLIC_MASK; 198 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE) 199 vap->iv_stats.is_scan_active++; 200 else 201 vap->iv_stats.is_scan_passive++; 202 if (flags & IEEE80211_SCAN_FLUSH) 203 ss->ss_ops->scan_flush(ss); 204 /* Only BGSCAN if enabled and requested. */ 205 if ((vap->iv_flags & IEEE80211_F_BGSCAN) != 0 && 206 (flags & IEEE80211_SCAN_BGSCAN) != 0) 207 ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN; 208 209 /* Set duration for this particular scan */ 210 ieee80211_swscan_set_scan_duration(vap, duration); 211 212 ss->ss_next = 0; 213 ss->ss_mindwell = mindwell; 214 ss->ss_maxdwell = maxdwell; 215 /* NB: scan_start must be before the scan runtask */ 216 ss->ss_ops->scan_start(ss, vap); 217 #ifdef IEEE80211_DEBUG 218 if (ieee80211_msg_scan(vap)) 219 ieee80211_scan_dump(ss); 220 #endif /* IEEE80211_DEBUG */ 221 ic->ic_flags |= IEEE80211_F_SCAN; 222 223 /* Start scan task */ 224 ieee80211_runtask(ic, &SCAN_PRIVATE(ss)->ss_scan_start); 225 } 226 return 1; 227 } else { 228 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 229 "%s: %s scan already in progress\n", __func__, 230 ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive"); 231 } 232 return 0; 233 } 234 235 /* 236 * Start a scan unless one is already going. 237 * 238 * Called without the comlock held; grab the comlock as appropriate. 239 */ 240 static int 241 ieee80211_swscan_start_scan(const struct ieee80211_scanner *scan, 242 struct ieee80211vap *vap, int flags, 243 u_int duration, u_int mindwell, u_int maxdwell, 244 u_int nssid, const struct ieee80211_scan_ssid ssids[]) 245 { 246 struct ieee80211com *ic = vap->iv_ic; 247 int result; 248 249 IEEE80211_UNLOCK_ASSERT(ic); 250 251 IEEE80211_LOCK(ic); 252 result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration, 253 mindwell, maxdwell, nssid, ssids); 254 IEEE80211_UNLOCK(ic); 255 256 return result; 257 } 258 259 /* 260 * Check the scan cache for an ap/channel to use; if that 261 * fails then kick off a new scan. 262 * 263 * Called with the comlock held. 264 * 265 * XXX TODO: split out! 266 */ 267 static int 268 ieee80211_swscan_check_scan(const struct ieee80211_scanner *scan, 269 struct ieee80211vap *vap, int flags, 270 u_int duration, u_int mindwell, u_int maxdwell, 271 u_int nssid, const struct ieee80211_scan_ssid ssids[]) 272 { 273 struct ieee80211com *ic = vap->iv_ic; 274 struct ieee80211_scan_state *ss = ic->ic_scan; 275 int result; 276 277 IEEE80211_LOCK_ASSERT(ic); 278 279 if (ss->ss_ops != NULL) { 280 /* XXX verify ss_ops matches vap->iv_opmode */ 281 if ((flags & IEEE80211_SCAN_NOSSID) == 0) { 282 /* 283 * Update the ssid list and mark flags so if 284 * we call start_scan it doesn't duplicate work. 285 */ 286 ieee80211_scan_copy_ssid(vap, ss, nssid, ssids); 287 flags |= IEEE80211_SCAN_NOSSID; 288 } 289 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 && 290 (flags & IEEE80211_SCAN_FLUSH) == 0 && 291 ieee80211_time_before(ticks, ic->ic_lastscan + vap->iv_scanvalid)) { 292 /* 293 * We're not currently scanning and the cache is 294 * deemed hot enough to consult. Lock out others 295 * by marking IEEE80211_F_SCAN while we decide if 296 * something is already in the scan cache we can 297 * use. Also discard any frames that might come 298 * in while temporarily marked as scanning. 299 */ 300 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 301 "cache hot; ic_lastscan=%d, scanvalid=%d, ticks=%d\n", 302 ic->ic_lastscan, 303 vap->iv_scanvalid, 304 ticks); 305 SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD; 306 ic->ic_flags |= IEEE80211_F_SCAN; 307 308 /* NB: need to use supplied flags in check */ 309 ss->ss_flags = flags & IEEE80211_SCAN_PUBLIC_MASK; 310 result = ss->ss_ops->scan_end(ss, vap); 311 312 ic->ic_flags &= ~IEEE80211_F_SCAN; 313 SCAN_PRIVATE(ss)->ss_iflags &= ~ISCAN_DISCARD; 314 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 315 "%s: scan_end returned %d\n", __func__, result); 316 if (result) { 317 ieee80211_notify_scan_done(vap); 318 return 1; 319 } 320 } 321 } 322 result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration, 323 mindwell, maxdwell, nssid, ssids); 324 325 return result; 326 } 327 328 /* 329 * Restart a previous scan. If the previous scan completed 330 * then we start again using the existing channel list. 331 */ 332 static int 333 ieee80211_swscan_bg_scan(const struct ieee80211_scanner *scan, 334 struct ieee80211vap *vap, int flags) 335 { 336 struct ieee80211com *ic = vap->iv_ic; 337 struct ieee80211_scan_state *ss = ic->ic_scan; 338 bool scanning; 339 340 /* XXX assert unlocked? */ 341 // IEEE80211_UNLOCK_ASSERT(ic); 342 343 IEEE80211_LOCK(ic); 344 KASSERT((vap->iv_flags & IEEE80211_F_BGSCAN) != 0, 345 ("%s: vap %p iv_flags %#010x no IEEE80211_F_BGSCAN set", 346 __func__, vap, vap->iv_flags)); 347 348 scanning = ic->ic_flags & IEEE80211_F_SCAN; 349 if (!scanning) { 350 u_int duration; 351 /* 352 * Go off-channel for a fixed interval that is large 353 * enough to catch most ap's but short enough that 354 * we can return on-channel before our listen interval 355 * expires. 356 */ 357 duration = IEEE80211_SCAN_OFFCHANNEL; 358 359 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 360 "%s: %s scan, ticks %u duration %u\n", __func__, 361 ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive", 362 ticks, duration); 363 364 ieee80211_scan_update_locked(vap, scan); 365 if (ss->ss_ops != NULL) { 366 ss->ss_vap = vap; 367 /* 368 * A background scan does not select a new sta; it 369 * just refreshes the scan cache. Also, indicate 370 * the scan logic should follow the beacon schedule: 371 * we go off-channel and scan for a while, then 372 * return to the bss channel to receive a beacon, 373 * then go off-channel again. All during this time 374 * we notify the ap we're in power save mode. When 375 * the scan is complete we leave power save mode. 376 * If any beacon indicates there are frames pending 377 * for us then we drop out of power save mode 378 * (and background scan) automatically by way of the 379 * usual sta power save logic. 380 */ 381 ss->ss_flags |= IEEE80211_SCAN_NOPICK 382 | IEEE80211_SCAN_BGSCAN 383 | flags 384 ; 385 /* if previous scan completed, restart */ 386 if (ss->ss_next >= ss->ss_last) { 387 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE) 388 vap->iv_stats.is_scan_active++; 389 else 390 vap->iv_stats.is_scan_passive++; 391 /* 392 * NB: beware of the scan cache being flushed; 393 * if the channel list is empty use the 394 * scan_start method to populate it. 395 */ 396 ss->ss_next = 0; 397 if (ss->ss_last != 0) { 398 ieee80211_notify_scan_done(vap); 399 ss->ss_ops->scan_restart(ss, vap); 400 } else { 401 ss->ss_ops->scan_start(ss, vap); 402 #ifdef IEEE80211_DEBUG 403 if (ieee80211_msg_scan(vap)) 404 ieee80211_scan_dump(ss); 405 #endif /* IEEE80211_DEBUG */ 406 } 407 } 408 ieee80211_swscan_set_scan_duration(vap, duration); 409 ss->ss_maxdwell = duration; 410 ic->ic_flags |= IEEE80211_F_SCAN; 411 ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN; 412 ieee80211_runtask(ic, 413 &SCAN_PRIVATE(ss)->ss_scan_start); 414 scanning = true; 415 } else { 416 /* XXX msg+stat */ 417 } 418 } else { 419 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 420 "%s: %s scan already in progress\n", __func__, 421 ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive"); 422 } 423 IEEE80211_UNLOCK(ic); 424 425 return (scanning); 426 } 427 428 /* 429 * Taskqueue work to cancel a scan. 430 * 431 * Note: for offload scan devices, we may want to call into the 432 * driver to try and cancel scanning, however it may not be cancelable. 433 */ 434 static void 435 cancel_scan(struct ieee80211vap *vap, int any, const char *func) 436 { 437 struct ieee80211com *ic = vap->iv_ic; 438 struct ieee80211_scan_state *ss = ic->ic_scan; 439 struct scan_state *ss_priv = SCAN_PRIVATE(ss); 440 int signal; 441 442 IEEE80211_LOCK(ic); 443 signal = any ? ISCAN_PAUSE : ISCAN_CANCEL; 444 if ((ic->ic_flags & IEEE80211_F_SCAN) && 445 (any || ss->ss_vap == vap) && 446 (ss_priv->ss_iflags & signal) == 0) { 447 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 448 "%s: %s %s scan\n", func, 449 any ? "pause" : "cancel", 450 ss->ss_flags & IEEE80211_SCAN_ACTIVE ? 451 "active" : "passive"); 452 453 /* clear bg scan NOPICK */ 454 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK; 455 /* mark request and wake up the scan task */ 456 scan_signal_locked(ss, signal); 457 } else { 458 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 459 "%s: called; F_SCAN=%d, vap=%s, signal=%d\n", 460 func, 461 !! (ic->ic_flags & IEEE80211_F_SCAN), 462 (ss->ss_vap == vap ? "match" : "nomatch"), 463 !! (ss_priv->ss_iflags & signal)); 464 } 465 IEEE80211_UNLOCK(ic); 466 } 467 468 /* 469 * Cancel any scan currently going on for the specified vap. 470 */ 471 static void 472 ieee80211_swscan_cancel_scan(struct ieee80211vap *vap) 473 { 474 cancel_scan(vap, 0, __func__); 475 } 476 477 /* 478 * Cancel any scan currently going on. 479 */ 480 static void 481 ieee80211_swscan_cancel_anyscan(struct ieee80211vap *vap) 482 { 483 484 /* XXX for now - just don't do this per packet. */ 485 if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) 486 return; 487 488 cancel_scan(vap, 1, __func__); 489 } 490 491 /* 492 * Manually switch to the next channel in the channel list. 493 * Provided for drivers that manage scanning themselves 494 * (e.g. for firmware-based devices). 495 */ 496 static void 497 ieee80211_swscan_scan_next(struct ieee80211vap *vap) 498 { 499 struct ieee80211_scan_state *ss = vap->iv_ic->ic_scan; 500 501 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: called\n", __func__); 502 503 /* wake up the scan task */ 504 scan_signal(ss, 0); 505 } 506 507 /* 508 * Manually stop a scan that is currently running. 509 * Provided for drivers that are not able to scan single channels 510 * (e.g. for firmware-based devices). 511 */ 512 static void 513 ieee80211_swscan_scan_done(struct ieee80211vap *vap) 514 { 515 struct ieee80211com *ic = vap->iv_ic; 516 struct ieee80211_scan_state *ss = ic->ic_scan; 517 518 IEEE80211_LOCK_ASSERT(ic); 519 520 scan_signal_locked(ss, 0); 521 } 522 523 /* 524 * Probe the current channel, if allowed, while scanning. 525 * If the channel is not marked passive-only then send 526 * a probe request immediately. Otherwise mark state and 527 * listen for beacons on the channel; if we receive something 528 * then we'll transmit a probe request. 529 */ 530 static void 531 ieee80211_swscan_probe_curchan(struct ieee80211vap *vap, bool force __unused) 532 { 533 struct ieee80211com *ic = vap->iv_ic; 534 struct ieee80211_scan_state *ss = ic->ic_scan; 535 int i; 536 537 /* 538 * Full-offload scan devices don't require this. 539 */ 540 if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) 541 return; 542 543 /* 544 * Send directed probe requests followed by any 545 * broadcast probe request. 546 * XXX remove dependence on ic/vap->iv_bss 547 */ 548 for (i = 0; i < ss->ss_nssid; i++) 549 ieee80211_send_probereq(vap->iv_bss, 550 vap->iv_myaddr, 551 ieee80211_vap_get_broadcast_address(vap), 552 ieee80211_vap_get_broadcast_address(vap), 553 ss->ss_ssid[i].ssid, ss->ss_ssid[i].len); 554 if ((ss->ss_flags & IEEE80211_SCAN_NOBCAST) == 0) 555 ieee80211_send_probereq(vap->iv_bss, 556 vap->iv_myaddr, 557 ieee80211_vap_get_broadcast_address(vap), 558 ieee80211_vap_get_broadcast_address(vap), 559 "", 0); 560 } 561 562 /* 563 * Scan curchan. If this is an active scan and the channel 564 * is not marked passive then send probe request frame(s). 565 * Arrange for the channel change after maxdwell ticks. 566 */ 567 static void 568 scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell) 569 { 570 struct ieee80211vap *vap = ss->ss_vap; 571 struct ieee80211com *ic = ss->ss_ic; 572 573 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 574 "%s: calling; maxdwell=%lu\n", 575 __func__, 576 maxdwell); 577 IEEE80211_LOCK(ic); 578 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE) 579 ieee80211_probe_curchan(vap, false); 580 taskqueue_enqueue_timeout(ic->ic_tq, 581 &SCAN_PRIVATE(ss)->ss_scan_curchan, maxdwell); 582 IEEE80211_UNLOCK(ic); 583 } 584 585 static void 586 scan_signal(struct ieee80211_scan_state *ss, int iflags) 587 { 588 struct ieee80211com *ic = ss->ss_ic; 589 590 IEEE80211_UNLOCK_ASSERT(ic); 591 592 IEEE80211_LOCK(ic); 593 scan_signal_locked(ss, iflags); 594 IEEE80211_UNLOCK(ic); 595 } 596 597 static void 598 scan_signal_locked(struct ieee80211_scan_state *ss, int iflags) 599 { 600 struct scan_state *ss_priv = SCAN_PRIVATE(ss); 601 struct timeout_task *scan_task = &ss_priv->ss_scan_curchan; 602 struct ieee80211com *ic = ss->ss_ic; 603 604 IEEE80211_LOCK_ASSERT(ic); 605 606 ss_priv->ss_iflags |= iflags; 607 if (ss_priv->ss_iflags & ISCAN_RUNNING) { 608 if (taskqueue_cancel_timeout(ic->ic_tq, scan_task, NULL) == 0) 609 taskqueue_enqueue_timeout(ic->ic_tq, scan_task, 0); 610 } 611 } 612 613 /* 614 * Handle mindwell requirements completed; initiate a channel 615 * change to the next channel asap. 616 */ 617 static void 618 scan_mindwell(struct ieee80211_scan_state *ss) 619 { 620 621 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: called\n", 622 __func__); 623 624 scan_signal(ss, 0); 625 } 626 627 static void 628 scan_start(void *arg, int pending) 629 { 630 #define ISCAN_REP (ISCAN_MINDWELL | ISCAN_DISCARD) 631 struct ieee80211_scan_state *ss = (struct ieee80211_scan_state *) arg; 632 struct scan_state *ss_priv = SCAN_PRIVATE(ss); 633 struct ieee80211vap *vap = ss->ss_vap; 634 struct ieee80211com *ic = ss->ss_ic; 635 636 IEEE80211_LOCK(ic); 637 if (vap == NULL || (ic->ic_flags & IEEE80211_F_SCAN) == 0 || 638 (ss_priv->ss_iflags & ISCAN_ABORT)) { 639 /* Cancelled before we started */ 640 scan_done(ss, 0); 641 return; 642 } 643 644 if (ss->ss_next == ss->ss_last) { 645 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 646 "%s: no channels to scan\n", __func__); 647 scan_done(ss, 1); 648 return; 649 } 650 651 /* 652 * Put the station into power save mode. 653 * 654 * This is only required if we're not a full-offload devices; 655 * those devices manage scan/traffic differently. 656 */ 657 if (((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0) && 658 vap->iv_opmode == IEEE80211_M_STA && 659 vap->iv_state == IEEE80211_S_RUN) { 660 if ((vap->iv_bss->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) { 661 /* Enable station power save mode */ 662 vap->iv_sta_ps(vap, 1); 663 /* Wait until null data frame will be ACK'ed */ 664 mtx_sleep(vap, IEEE80211_LOCK_OBJ(ic), PCATCH, 665 "sta_ps", msecs_to_ticks(10)); 666 if (ss_priv->ss_iflags & ISCAN_ABORT) { 667 scan_done(ss, 0); 668 return; 669 } 670 } 671 } 672 673 ss_priv->ss_scanend = ticks + ss_priv->ss_duration; 674 675 /* XXX scan state can change! Re-validate scan state! */ 676 677 IEEE80211_UNLOCK(ic); 678 679 ic->ic_scan_start(ic); /* notify driver */ 680 681 scan_curchan_task(ss, 0); 682 } 683 684 static void 685 scan_curchan_task(void *arg, int pending __unused) 686 { 687 struct ieee80211_scan_state *ss = arg; 688 struct scan_state *ss_priv = SCAN_PRIVATE(ss); 689 struct ieee80211com *ic = ss->ss_ic; 690 struct ieee80211_channel *chan; 691 unsigned long maxdwell; 692 int scandone, scanstop; 693 694 IEEE80211_LOCK(ic); 695 end: 696 /* 697 * Note: only /end/ the scan if we're CANCEL rather than 698 * CANCEL+INTERRUPT (ie, 'PAUSE'). 699 * 700 * We can stop the scan if we hit cancel, but we shouldn't 701 * call scan_end(ss, 1) if we're just PAUSEing the scan. 702 */ 703 scandone = (ss->ss_next >= ss->ss_last) || 704 ((ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL); 705 scanstop = (ss->ss_next >= ss->ss_last) || 706 ((ss_priv->ss_iflags & ISCAN_CANCEL) != 0); 707 708 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, 709 "%s: loop start; scandone=%d, scanstop=%d, ss_iflags=0x%x, ss_next=%u, ss_last=%u\n", 710 __func__, 711 scandone, 712 scanstop, 713 (uint32_t) ss_priv->ss_iflags, 714 (uint32_t) ss->ss_next, 715 (uint32_t) ss->ss_last); 716 717 if (scanstop || (ss->ss_flags & IEEE80211_SCAN_GOTPICK) || 718 (ss_priv->ss_iflags & ISCAN_ABORT) || 719 ieee80211_time_after(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) { 720 ss_priv->ss_iflags &= ~ISCAN_RUNNING; 721 scan_end(ss, scandone); 722 return; 723 } else 724 ss_priv->ss_iflags |= ISCAN_RUNNING; 725 726 chan = ss->ss_chans[ss->ss_next++]; 727 728 /* 729 * Watch for truncation due to the scan end time. 730 */ 731 if (ieee80211_time_after(ticks + ss->ss_maxdwell, ss_priv->ss_scanend)) 732 maxdwell = ss_priv->ss_scanend - ticks; 733 else 734 maxdwell = ss->ss_maxdwell; 735 736 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, 737 "%s: chan %3d%c -> %3d%c [%s, dwell min %lums max %lums]\n", 738 __func__, 739 ieee80211_chan2ieee(ic, ic->ic_curchan), 740 ieee80211_channel_type_char(ic->ic_curchan), 741 ieee80211_chan2ieee(ic, chan), 742 ieee80211_channel_type_char(chan), 743 (ss->ss_flags & IEEE80211_SCAN_ACTIVE) && 744 (chan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 ? 745 "active" : "passive", 746 ticks_to_msecs(ss->ss_mindwell), ticks_to_msecs(maxdwell)); 747 748 /* 749 * Potentially change channel and phy mode. 750 */ 751 ic->ic_curchan = chan; 752 ic->ic_rt = ieee80211_get_ratetable(chan); 753 IEEE80211_UNLOCK(ic); 754 /* 755 * Perform the channel change and scan unlocked so the driver 756 * may sleep. Once set_channel returns the hardware has 757 * completed the channel change. 758 */ 759 ic->ic_set_channel(ic); 760 ieee80211_radiotap_chan_change(ic); 761 762 /* 763 * Scan curchan. Drivers for "intelligent hardware" 764 * override ic_scan_curchan to tell the device to do 765 * the work. Otherwise we manage the work ourselves; 766 * sending a probe request (as needed), and arming the 767 * timeout to switch channels after maxdwell ticks. 768 * 769 * scan_curchan should only pause for the time required to 770 * prepare/initiate the hardware for the scan (if at all). 771 */ 772 ic->ic_scan_curchan(ss, maxdwell); 773 IEEE80211_LOCK(ic); 774 775 /* XXX scan state can change! Re-validate scan state! */ 776 777 ss_priv->ss_chanmindwell = ticks + ss->ss_mindwell; 778 /* clear mindwell lock and initial channel change flush */ 779 ss_priv->ss_iflags &= ~ISCAN_REP; 780 781 if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) { 782 taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan, 783 NULL); 784 goto end; 785 } 786 787 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n", 788 __func__); 789 IEEE80211_UNLOCK(ic); 790 } 791 792 static void 793 scan_end(struct ieee80211_scan_state *ss, int scandone) 794 { 795 struct scan_state *ss_priv = SCAN_PRIVATE(ss); 796 struct ieee80211vap *vap = ss->ss_vap; 797 struct ieee80211com *ic = ss->ss_ic; 798 799 IEEE80211_LOCK_ASSERT(ic); 800 801 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: out\n", __func__); 802 803 if (ss_priv->ss_iflags & ISCAN_ABORT) { 804 scan_done(ss, scandone); 805 return; 806 } 807 808 IEEE80211_UNLOCK(ic); 809 ic->ic_scan_end(ic); /* notify driver */ 810 IEEE80211_LOCK(ic); 811 /* XXX scan state can change! Re-validate scan state! */ 812 813 /* 814 * Since a cancellation may have occurred during one of the 815 * driver calls (whilst unlocked), update scandone. 816 */ 817 if ((scandone == 0) && ((ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL)) { 818 /* XXX printf? */ 819 if_printf(vap->iv_ifp, 820 "%s: OOPS! scan cancelled during driver call (1) (ss_iflags=0x%x)!\n", 821 __func__, 822 ss_priv->ss_iflags); 823 scandone = 1; 824 } 825 826 /* 827 * Record scan complete time. Note that we also do 828 * this when canceled so any background scan will 829 * not be restarted for a while. 830 */ 831 if (scandone) 832 ic->ic_lastscan = ticks; 833 /* return to the bss channel */ 834 if (ic->ic_bsschan != IEEE80211_CHAN_ANYC && 835 ic->ic_curchan != ic->ic_bsschan) { 836 ieee80211_setupcurchan(ic, ic->ic_bsschan); 837 IEEE80211_UNLOCK(ic); 838 ic->ic_set_channel(ic); 839 ieee80211_radiotap_chan_change(ic); 840 IEEE80211_LOCK(ic); 841 } 842 /* clear internal flags and any indication of a pick */ 843 ss_priv->ss_iflags &= ~ISCAN_REP; 844 ss->ss_flags &= ~IEEE80211_SCAN_GOTPICK; 845 846 /* 847 * If not canceled and scan completed, do post-processing. 848 * If the callback function returns 0, then it wants to 849 * continue/restart scanning. Unfortunately we needed to 850 * notify the driver to end the scan above to avoid having 851 * rx frames alter the scan candidate list. 852 */ 853 if ((ss_priv->ss_iflags & ISCAN_CANCEL) == 0 && 854 !ss->ss_ops->scan_end(ss, vap) && 855 (ss->ss_flags & IEEE80211_SCAN_ONCE) == 0 && 856 ieee80211_time_before(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) { 857 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 858 "%s: done, restart " 859 "[ticks %u, dwell min %lu scanend %lu]\n", 860 __func__, 861 ticks, ss->ss_mindwell, ss_priv->ss_scanend); 862 ss->ss_next = 0; /* reset to beginning */ 863 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE) 864 vap->iv_stats.is_scan_active++; 865 else 866 vap->iv_stats.is_scan_passive++; 867 868 ieee80211_notify_scan_done(vap); 869 ss->ss_ops->scan_restart(ss, vap); /* XXX? */ 870 ieee80211_runtask(ic, &ss_priv->ss_scan_start); 871 IEEE80211_UNLOCK(ic); 872 return; 873 } 874 875 /* past here, scandone is ``true'' if not in bg mode */ 876 if ((ss->ss_flags & IEEE80211_SCAN_BGSCAN) == 0) 877 scandone = 1; 878 879 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 880 "%s: %s, [ticks %u, dwell min %lu scanend %lu]\n", 881 __func__, scandone ? "done" : "stopped", 882 ticks, ss->ss_mindwell, ss_priv->ss_scanend); 883 884 /* 885 * Since a cancellation may have occurred during one of the 886 * driver calls (whilst unlocked), update scandone. 887 */ 888 if (scandone == 0 && (ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL) { 889 /* XXX printf? */ 890 if_printf(vap->iv_ifp, 891 "%s: OOPS! scan cancelled during driver call (2) (ss_iflags=0x%x)!\n", 892 __func__, 893 ss_priv->ss_iflags); 894 scandone = 1; 895 } 896 897 scan_done(ss, scandone); 898 } 899 900 static void 901 scan_done(struct ieee80211_scan_state *ss, int scandone) 902 { 903 struct scan_state *ss_priv = SCAN_PRIVATE(ss); 904 struct ieee80211com *ic = ss->ss_ic; 905 struct ieee80211vap *vap = ss->ss_vap; 906 907 IEEE80211_LOCK_ASSERT(ic); 908 909 /* 910 * Clear the SCAN bit first in case frames are 911 * pending on the station power save queue. If 912 * we defer this then the dispatch of the frames 913 * may generate a request to cancel scanning. 914 */ 915 ic->ic_flags &= ~IEEE80211_F_SCAN; 916 917 /* 918 * Drop out of power save mode when a scan has 919 * completed. If this scan was prematurely terminated 920 * because it is a background scan then don't notify 921 * the ap; we'll either return to scanning after we 922 * receive the beacon frame or we'll drop out of power 923 * save mode because the beacon indicates we have frames 924 * waiting for us. 925 */ 926 if (scandone) { 927 /* 928 * If we're not a scan offload device, come back out of 929 * station powersave. Offload devices handle this themselves. 930 */ 931 if ((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0) 932 vap->iv_sta_ps(vap, 0); 933 if (ss->ss_next >= ss->ss_last) { 934 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 935 "%s: Dropping out of scan; ss_next=%u, ss_last=%u\n", 936 __func__, 937 (uint32_t) ss->ss_next, 938 (uint32_t) ss->ss_last); 939 ic->ic_flags_ext &= ~IEEE80211_FEXT_BGSCAN; 940 } 941 942 /* send 'scan done' event if not interrupted due to traffic. */ 943 if (!(ss_priv->ss_iflags & ISCAN_INTERRUPT) || 944 (ss->ss_next >= ss->ss_last)) 945 ieee80211_notify_scan_done(vap); 946 } 947 ss_priv->ss_iflags &= ~(ISCAN_PAUSE | ISCAN_ABORT); 948 ss_priv->ss_scanend = 0; 949 ss->ss_flags &= ~(IEEE80211_SCAN_ONCE | IEEE80211_SCAN_PICK1ST); 950 IEEE80211_UNLOCK(ic); 951 #undef ISCAN_REP 952 } 953 954 /* 955 * Process a beacon or probe response frame. 956 */ 957 static void 958 ieee80211_swscan_add_scan(struct ieee80211vap *vap, 959 struct ieee80211_channel *curchan, 960 const struct ieee80211_scanparams *sp, 961 const struct ieee80211_frame *wh, 962 int subtype, int rssi, int noise) 963 { 964 struct ieee80211com *ic = vap->iv_ic; 965 struct ieee80211_scan_state *ss = ic->ic_scan; 966 967 /* XXX locking */ 968 /* 969 * Frames received during startup are discarded to avoid 970 * using scan state setup on the initial entry to the timer 971 * callback. This can occur because the device may enable 972 * rx prior to our doing the initial channel change in the 973 * timer routine. 974 */ 975 if (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_DISCARD) 976 return; 977 #ifdef IEEE80211_DEBUG 978 if (ieee80211_msg_scan(vap) && (ic->ic_flags & IEEE80211_F_SCAN)) 979 ieee80211_scan_dump_probe_beacon(subtype, 1, wh->i_addr2, sp, rssi); 980 #endif 981 if (ss->ss_ops != NULL && 982 ss->ss_ops->scan_add(ss, curchan, sp, wh, subtype, rssi, noise)) { 983 /* 984 * If we've reached the min dwell time terminate 985 * the timer so we'll switch to the next channel. 986 */ 987 if ((SCAN_PRIVATE(ss)->ss_iflags & ISCAN_MINDWELL) == 0 && 988 ieee80211_time_after_eq(ticks, SCAN_PRIVATE(ss)->ss_chanmindwell)) { 989 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 990 "%s: chan %3d%c min dwell met (%u > %lu)\n", 991 __func__, 992 ieee80211_chan2ieee(ic, ic->ic_curchan), 993 ieee80211_channel_type_char(ic->ic_curchan), 994 ticks, SCAN_PRIVATE(ss)->ss_chanmindwell); 995 SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_MINDWELL; 996 /* 997 * NB: trigger at next clock tick or wait for the 998 * hardware. 999 */ 1000 ic->ic_scan_mindwell(ss); 1001 } 1002 } 1003 } 1004 1005 static struct ieee80211_scan_methods swscan_methods = { 1006 .sc_attach = ieee80211_swscan_attach, 1007 .sc_detach = ieee80211_swscan_detach, 1008 .sc_vattach = ieee80211_swscan_vattach, 1009 .sc_vdetach = ieee80211_swscan_vdetach, 1010 .sc_set_scan_duration = ieee80211_swscan_set_scan_duration, 1011 .sc_start_scan = ieee80211_swscan_start_scan, 1012 .sc_check_scan = ieee80211_swscan_check_scan, 1013 .sc_bg_scan = ieee80211_swscan_bg_scan, 1014 .sc_cancel_scan = ieee80211_swscan_cancel_scan, 1015 .sc_cancel_anyscan = ieee80211_swscan_cancel_anyscan, 1016 .sc_scan_next = ieee80211_swscan_scan_next, 1017 .sc_scan_done = ieee80211_swscan_scan_done, 1018 .sc_scan_probe_curchan = ieee80211_swscan_probe_curchan, 1019 .sc_add_scan = ieee80211_swscan_add_scan 1020 }; 1021 1022 /* 1023 * Default scan attach method. 1024 */ 1025 void 1026 ieee80211_swscan_attach(struct ieee80211com *ic) 1027 { 1028 struct scan_state *ss; 1029 1030 /* 1031 * Setup the default methods 1032 */ 1033 ic->ic_scan_methods = &swscan_methods; 1034 1035 /* Allocate initial scan state */ 1036 ss = (struct scan_state *) IEEE80211_MALLOC(sizeof(struct scan_state), 1037 M_80211_SCAN, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO); 1038 if (ss == NULL) { 1039 ic->ic_scan = NULL; 1040 return; 1041 } 1042 TASK_INIT(&ss->ss_scan_start, 0, scan_start, ss); 1043 TIMEOUT_TASK_INIT(ic->ic_tq, &ss->ss_scan_curchan, 0, 1044 scan_curchan_task, ss); 1045 1046 ic->ic_scan = &ss->base; 1047 ss->base.ss_ic = ic; 1048 1049 ic->ic_scan_curchan = scan_curchan; 1050 ic->ic_scan_mindwell = scan_mindwell; 1051 } 1052