sys/netproto/802_11/wlan/ieee80211_scan_sw.c

   1 /*-
   2  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include <sys/cdefs.h>
  27 __FBSDID("$FreeBSD$");
  28
  29 /*
  30  * IEEE 802.11 scanning support.
  31  */
  32 #include "opt_wlan.h"
  33
  34 #include <sys/param.h>
  35 #include <sys/systm.h>
  36 #include <sys/proc.h>
  37 #include <sys/kernel.h>
  38 #include <sys/malloc.h>
  39 #include <sys/condvar.h>
  40
  41 #include <sys/socket.h>
  42
  43 #include <net/if.h>
  44 #include <net/if_var.h>
  45 #include <net/if_media.h>
  46 #include <net/ethernet.h>
  47
  48 #include <netproto/802_11/ieee80211_var.h>
  49
  50 #include <netproto/802_11/ieee80211_scan_sw.h>
  51
  52 #include <net/bpf.h>
  53
  54 struct scan_state {
  55         struct ieee80211_scan_state base;       /* public state */
  56
  57         u_int                   ss_iflags;      /* flags used internally */
  58 #define ISCAN_MINDWELL          0x0001          /* min dwell time reached */
  59 #define ISCAN_DISCARD           0x0002          /* discard rx'd frames */
  60 #define ISCAN_CANCEL            0x0004          /* cancel current scan */
  61 #define ISCAN_ABORT             0x0008          /* end the scan immediately */
  62 #define ISCAN_RUNNING           0x0010          /* scan was started */
  63
  64         unsigned long           ss_chanmindwell;  /* min dwell on curchan */
  65         unsigned long           ss_scanend;     /* time scan must stop */
  66         u_int                   ss_duration;    /* duration for next scan */
  67         struct task             ss_scan_start;  /* scan start */
  68         struct timeout_task     ss_scan_curchan;  /* scan execution */
  69 };
  70 #define SCAN_PRIVATE(ss)        ((struct scan_state *) ss)
  71
  72 /*
  73  * Amount of time to go off-channel during a background
  74  * scan.  This value should be large enough to catch most
  75  * ap's but short enough that we can return on-channel
  76  * before our listen interval expires.
  77  *
  78  * XXX tunable
  79  * XXX check against configured listen interval
  80  */
  81 #define IEEE80211_SCAN_OFFCHANNEL       msecs_to_ticks(150)
  82
  83 /*
  84  * Roaming-related defaults.  RSSI thresholds are as returned by the
  85  * driver (.5dBm).  Transmit rate thresholds are IEEE rate codes (i.e
  86  * .5M units) or MCS.
  87  */
  88 /* rssi thresholds */
  89 #define ROAM_RSSI_11A_DEFAULT           14      /* 11a bss */
  90 #define ROAM_RSSI_11B_DEFAULT           14      /* 11b bss */
  91 #define ROAM_RSSI_11BONLY_DEFAULT       14      /* 11b-only bss */
  92 /* transmit rate thresholds */
  93 #define ROAM_RATE_11A_DEFAULT           2*12    /* 11a bss */
  94 #define ROAM_RATE_11B_DEFAULT           2*5     /* 11b bss */
  95 #define ROAM_RATE_11BONLY_DEFAULT       2*1     /* 11b-only bss */
  96 #define ROAM_RATE_HALF_DEFAULT          2*6     /* half-width 11a/g bss */
  97 #define ROAM_RATE_QUARTER_DEFAULT       2*3     /* quarter-width 11a/g bss */
  98 #define ROAM_MCS_11N_DEFAULT            (1 | IEEE80211_RATE_MCS) /* 11n bss */
  99
 100 static  void scan_curchan(struct ieee80211_scan_state *, unsigned long);
 101 static  void scan_mindwell(struct ieee80211_scan_state *);
 102 static  void scan_signal(struct ieee80211_scan_state *, int);
 103 static  void scan_signal_locked(struct ieee80211_scan_state *, int);
 104 static  void scan_start(void *, int);
 105 static  void scan_curchan_task(void *, int);
 106 static  void scan_end(struct ieee80211_scan_state *, int);
 107 static  void scan_done(struct ieee80211_scan_state *, int);
 108
 109 MALLOC_DEFINE(M_80211_SCAN, "80211scan", "802.11 scan state");
 110
 111 static void
 112 ieee80211_swscan_detach(struct ieee80211com *ic)
 113 {
 114         struct ieee80211_scan_state *ss = ic->ic_scan;
 115
 116         if (ss != NULL) {
 117                 scan_signal(ss, ISCAN_ABORT);
 118                 ieee80211_draintask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
 119                 taskqueue_drain_timeout(ic->ic_tq,
 120                     &SCAN_PRIVATE(ss)->ss_scan_curchan);
 121                 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0,
 122                     ("scan still running"));
 123
 124                 /*
 125                  * For now, do the ss_ops detach here rather
 126                  * than ieee80211_scan_detach().
 127                  *
 128                  * I'll figure out how to cleanly split things up
 129                  * at a later date.
 130                  */
 131                 if (ss->ss_ops != NULL) {
 132                         ss->ss_ops->scan_detach(ss);
 133                         ss->ss_ops = NULL;
 134                 }
 135                 ic->ic_scan = NULL;
 136                 IEEE80211_FREE(SCAN_PRIVATE(ss), M_80211_SCAN);
 137         }
 138 }
 139
 140 static void
 141 ieee80211_swscan_vattach(struct ieee80211vap *vap)
 142 {
 143         /* nothing to do for now */
 144         /*
 145          * TODO: all of the vap scan calls should be methods!
 146          */
 147
 148 }
 149
 150 static void
 151 ieee80211_swscan_vdetach(struct ieee80211vap *vap)
 152 {
 153         struct ieee80211com *ic = vap->iv_ic;
 154         struct ieee80211_scan_state *ss = ic->ic_scan;
 155
 156         IEEE80211_LOCK_ASSERT(ic);
 157
 158         if (ss != NULL && ss->ss_vap == vap &&
 159             (ic->ic_flags & IEEE80211_F_SCAN))
 160                 scan_signal_locked(ss, ISCAN_ABORT);
 161 }
 162
 163 static void
 164 ieee80211_swscan_set_scan_duration(struct ieee80211vap *vap, u_int duration)
 165 {
 166         struct ieee80211com *ic = vap->iv_ic;
 167         struct ieee80211_scan_state *ss = ic->ic_scan;
 168
 169         IEEE80211_LOCK_ASSERT(ic);
 170
 171         /* NB: flush frames rx'd before 1st channel change */
 172         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
 173         SCAN_PRIVATE(ss)->ss_duration = duration;
 174 }
 175
 176 /*
 177  * Start a scan unless one is already going.
 178  */
 179 static int
 180 ieee80211_swscan_start_scan_locked(const struct ieee80211_scanner *scan,
 181     struct ieee80211vap *vap, int flags, u_int duration,
 182     u_int mindwell, u_int maxdwell,
 183     u_int nssid, const struct ieee80211_scan_ssid ssids[])
 184 {
 185         struct ieee80211com *ic = vap->iv_ic;
 186         struct ieee80211_scan_state *ss = ic->ic_scan;
 187
 188         IEEE80211_LOCK_ASSERT(ic);
 189
 190         if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
 191                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 192                     "%s: scan inhibited by pending channel change\n", __func__);
 193         } else if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 194                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 195                     "%s: %s scan, duration %u mindwell %u maxdwell %u, desired mode %s, %s%s%s%s%s%s\n"
 196                     , __func__
 197                     , flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive"
 198                     , duration, mindwell, maxdwell
 199                     , ieee80211_phymode_name[vap->iv_des_mode]
 200                     , flags & IEEE80211_SCAN_FLUSH ? "flush" : "append"
 201                     , flags & IEEE80211_SCAN_NOPICK ? ", nopick" : ""
 202                     , flags & IEEE80211_SCAN_NOJOIN ? ", nojoin" : ""
 203                     , flags & IEEE80211_SCAN_NOBCAST ? ", nobcast" : ""
 204                     , flags & IEEE80211_SCAN_PICK1ST ? ", pick1st" : ""
 205                     , flags & IEEE80211_SCAN_ONCE ? ", once" : ""
 206                 );
 207
 208                 ieee80211_scan_update_locked(vap, scan);
 209                 if (ss->ss_ops != NULL) {
 210                         if ((flags & IEEE80211_SCAN_NOSSID) == 0)
 211                                 ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
 212
 213                         /* NB: top 4 bits for internal use */
 214                         ss->ss_flags = flags & 0xfff;
 215                         if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 216                                 vap->iv_stats.is_scan_active++;
 217                         else
 218                                 vap->iv_stats.is_scan_passive++;
 219                         if (flags & IEEE80211_SCAN_FLUSH)
 220                                 ss->ss_ops->scan_flush(ss);
 221                         if (flags & IEEE80211_SCAN_BGSCAN)
 222                                 ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
 223
 224                         /* Set duration for this particular scan */
 225                         ieee80211_swscan_set_scan_duration(vap, duration);
 226
 227                         ss->ss_next = 0;
 228                         ss->ss_mindwell = mindwell;
 229                         ss->ss_maxdwell = maxdwell;
 230                         /* NB: scan_start must be before the scan runtask */
 231                         ss->ss_ops->scan_start(ss, vap);
 232 #ifdef IEEE80211_DEBUG
 233                         if (ieee80211_msg_scan(vap))
 234                                 ieee80211_scan_dump(ss);
 235 #endif /* IEEE80211_DEBUG */
 236                         ic->ic_flags |= IEEE80211_F_SCAN;
 237
 238                         /* Start scan task */
 239                         ieee80211_runtask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
 240                 }
 241                 return 1;
 242         } else {
 243                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 244                     "%s: %s scan already in progress\n", __func__,
 245                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
 246         }
 247         return 0;
 248 }
 249
 250
 251 /*
 252  * Start a scan unless one is already going.
 253  *
 254  * Called without the comlock held; grab the comlock as appropriate.
 255  */
 256 static int
 257 ieee80211_swscan_start_scan(const struct ieee80211_scanner *scan,
 258     struct ieee80211vap *vap, int flags,
 259     u_int duration, u_int mindwell, u_int maxdwell,
 260     u_int nssid, const struct ieee80211_scan_ssid ssids[])
 261 {
 262         struct ieee80211com *ic = vap->iv_ic;
 263         int result;
 264
 265         IEEE80211_UNLOCK_ASSERT(ic);
 266
 267         IEEE80211_LOCK(ic);
 268         result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
 269             mindwell, maxdwell, nssid, ssids);
 270         IEEE80211_UNLOCK(ic);
 271
 272         return result;
 273 }
 274
 275 /*
 276  * Check the scan cache for an ap/channel to use; if that
 277  * fails then kick off a new scan.
 278  *
 279  * Called with the comlock held.
 280  *
 281  * XXX TODO: split out!
 282  */
 283 static int
 284 ieee80211_swscan_check_scan(const struct ieee80211_scanner *scan,
 285     struct ieee80211vap *vap, int flags,
 286     u_int duration, u_int mindwell, u_int maxdwell,
 287     u_int nssid, const struct ieee80211_scan_ssid ssids[])
 288 {
 289         struct ieee80211com *ic = vap->iv_ic;
 290         struct ieee80211_scan_state *ss = ic->ic_scan;
 291         int result;
 292
 293         IEEE80211_LOCK_ASSERT(ic);
 294
 295         if (ss->ss_ops != NULL) {
 296                 /* XXX verify ss_ops matches vap->iv_opmode */
 297                 if ((flags & IEEE80211_SCAN_NOSSID) == 0) {
 298                         /*
 299                          * Update the ssid list and mark flags so if
 300                          * we call start_scan it doesn't duplicate work.
 301                          */
 302                         ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
 303                         flags |= IEEE80211_SCAN_NOSSID;
 304                 }
 305                 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
 306                     (flags & IEEE80211_SCAN_FLUSH) == 0 &&
 307                     ieee80211_time_before(ticks, ic->ic_lastscan + vap->iv_scanvalid)) {
 308                         /*
 309                          * We're not currently scanning and the cache is
 310                          * deemed hot enough to consult.  Lock out others
 311                          * by marking IEEE80211_F_SCAN while we decide if
 312                          * something is already in the scan cache we can
 313                          * use.  Also discard any frames that might come
 314                          * in while temporarily marked as scanning.
 315                          */
 316                         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
 317                         ic->ic_flags |= IEEE80211_F_SCAN;
 318
 319                         /* NB: need to use supplied flags in check */
 320                         ss->ss_flags = flags & 0xff;
 321                         result = ss->ss_ops->scan_end(ss, vap);
 322
 323                         ic->ic_flags &= ~IEEE80211_F_SCAN;
 324                         SCAN_PRIVATE(ss)->ss_iflags &= ~ISCAN_DISCARD;
 325                         if (result) {
 326                                 ieee80211_notify_scan_done(vap);
 327                                 return 1;
 328                         }
 329                 }
 330         }
 331         result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
 332             mindwell, maxdwell, nssid, ssids);
 333
 334         return result;
 335 }
 336
 337 /*
 338  * Restart a previous scan.  If the previous scan completed
 339  * then we start again using the existing channel list.
 340  */
 341 static int
 342 ieee80211_swscan_bg_scan(const struct ieee80211_scanner *scan,
 343     struct ieee80211vap *vap, int flags)
 344 {
 345         struct ieee80211com *ic = vap->iv_ic;
 346         struct ieee80211_scan_state *ss = ic->ic_scan;
 347
 348         /* XXX assert unlocked? */
 349         // IEEE80211_UNLOCK_ASSERT(ic);
 350
 351         IEEE80211_LOCK(ic);
 352         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 353                 u_int duration;
 354                 /*
 355                  * Go off-channel for a fixed interval that is large
 356                  * enough to catch most ap's but short enough that
 357                  * we can return on-channel before our listen interval
 358                  * expires.
 359                  */
 360                 duration = IEEE80211_SCAN_OFFCHANNEL;
 361
 362                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 363                     "%s: %s scan, ticks %u duration %u\n", __func__,
 364                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive",
 365                     ticks, duration);
 366
 367                 ieee80211_scan_update_locked(vap, scan);
 368                 if (ss->ss_ops != NULL) {
 369                         ss->ss_vap = vap;
 370                         /*
 371                          * A background scan does not select a new sta; it
 372                          * just refreshes the scan cache.  Also, indicate
 373                          * the scan logic should follow the beacon schedule:
 374                          * we go off-channel and scan for a while, then
 375                          * return to the bss channel to receive a beacon,
 376                          * then go off-channel again.  All during this time
 377                          * we notify the ap we're in power save mode.  When
 378                          * the scan is complete we leave power save mode.
 379                          * If any beacon indicates there are frames pending
 380                          * for us then we drop out of power save mode
 381                          * (and background scan) automatically by way of the
 382                          * usual sta power save logic.
 383                          */
 384                         ss->ss_flags |= IEEE80211_SCAN_NOPICK
 385                                      |  IEEE80211_SCAN_BGSCAN
 386                                      |  flags
 387                                      ;
 388                         /* if previous scan completed, restart */
 389                         if (ss->ss_next >= ss->ss_last) {
 390                                 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 391                                         vap->iv_stats.is_scan_active++;
 392                                 else
 393                                         vap->iv_stats.is_scan_passive++;
 394                                 /*
 395                                  * NB: beware of the scan cache being flushed;
 396                                  *     if the channel list is empty use the
 397                                  *     scan_start method to populate it.
 398                                  */
 399                                 ss->ss_next = 0;
 400                                 if (ss->ss_last != 0)
 401                                         ss->ss_ops->scan_restart(ss, vap);
 402                                 else {
 403                                         ss->ss_ops->scan_start(ss, vap);
 404 #ifdef IEEE80211_DEBUG
 405                                         if (ieee80211_msg_scan(vap))
 406                                                 ieee80211_scan_dump(ss);
 407 #endif /* IEEE80211_DEBUG */
 408                                 }
 409                         }
 410                         ieee80211_swscan_set_scan_duration(vap, duration);
 411                         ss->ss_maxdwell = duration;
 412                         ic->ic_flags |= IEEE80211_F_SCAN;
 413                         ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
 414                         ieee80211_runtask(ic,
 415                             &SCAN_PRIVATE(ss)->ss_scan_start);
 416                 } else {
 417                         /* XXX msg+stat */
 418                 }
 419         } else {
 420                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 421                     "%s: %s scan already in progress\n", __func__,
 422                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
 423         }
 424         IEEE80211_UNLOCK(ic);
 425
 426         /* NB: racey, does it matter? */
 427         return (ic->ic_flags & IEEE80211_F_SCAN);
 428 }
 429
 430 /*
 431  * Taskqueue work to cancel a scan.
 432  *
 433  * Note: for offload scan devices, we may want to call into the
 434  * driver to try and cancel scanning, however it may not be cancelable.
 435  */
 436 static void
 437 cancel_scan(struct ieee80211vap *vap, int any, const char *func)
 438 {
 439         struct ieee80211com *ic = vap->iv_ic;
 440         struct ieee80211_scan_state *ss = ic->ic_scan;
 441
 442         IEEE80211_LOCK(ic);
 443         if ((ic->ic_flags & IEEE80211_F_SCAN) &&
 444             (any || ss->ss_vap == vap) &&
 445             (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_CANCEL) == 0) {
 446                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 447                     "%s: cancel %s scan\n", func,
 448                     ss->ss_flags & IEEE80211_SCAN_ACTIVE ?
 449                         "active" : "passive");
 450
 451                 /* clear bg scan NOPICK */
 452                 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
 453                 /* mark cancel request and wake up the scan task */
 454                 scan_signal_locked(ss, ISCAN_CANCEL);
 455         } else {
 456                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 457                     "%s: called; F_SCAN=%d, vap=%s, CANCEL=%d\n",
 458                         func,
 459                         !! (ic->ic_flags & IEEE80211_F_SCAN),
 460                         (ss->ss_vap == vap ? "match" : "nomatch"),
 461                         !! (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_CANCEL));
 462         }
 463         IEEE80211_UNLOCK(ic);
 464 }
 465
 466 /*
 467  * Cancel any scan currently going on for the specified vap.
 468  */
 469 static void
 470 ieee80211_swscan_cancel_scan(struct ieee80211vap *vap)
 471 {
 472         cancel_scan(vap, 0, __func__);
 473 }
 474
 475 /*
 476  * Cancel any scan currently going on.
 477  */
 478 static void
 479 ieee80211_swscan_cancel_anyscan(struct ieee80211vap *vap)
 480 {
 481         /* XXX for now - just don't do this per packet. */
 482         if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD)
 483                 return;
 484
 485         cancel_scan(vap, 1, __func__);
 486 }
 487
 488 /*
 489  * Manually switch to the next channel in the channel list.
 490  * Provided for drivers that manage scanning themselves
 491  * (e.g. for firmware-based devices).
 492  */
 493 static void
 494 ieee80211_swscan_scan_next(struct ieee80211vap *vap)
 495 {
 496         struct ieee80211_scan_state *ss = vap->iv_ic->ic_scan;
 497
 498         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: called\n", __func__);
 499
 500         /* wake up the scan task */
 501         scan_signal(ss, 0);
 502 }
 503
 504 /*
 505  * Manually stop a scan that is currently running.
 506  * Provided for drivers that are not able to scan single channels
 507  * (e.g. for firmware-based devices).
 508  */
 509 static void
 510 ieee80211_swscan_scan_done(struct ieee80211vap *vap)
 511 {
 512         struct ieee80211com *ic = vap->iv_ic;
 513         struct ieee80211_scan_state *ss = ic->ic_scan;
 514
 515         IEEE80211_LOCK_ASSERT(ic);
 516
 517         scan_signal_locked(ss, 0);
 518 }
 519
 520 /*
 521  * Probe the current channel, if allowed, while scanning.
 522  * If the channel is not marked passive-only then send
 523  * a probe request immediately.  Otherwise mark state and
 524  * listen for beacons on the channel; if we receive something
 525  * then we'll transmit a probe request.
 526  */
 527 static void
 528 ieee80211_swscan_probe_curchan(struct ieee80211vap *vap, int force)
 529 {
 530         struct ieee80211com *ic = vap->iv_ic;
 531         struct ieee80211_scan_state *ss = ic->ic_scan;
 532         struct ifnet *ifp = vap->iv_ifp;
 533         int i;
 534
 535         /*
 536          * Full-offload scan devices don't require this.
 537          */
 538         if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD)
 539                 return;
 540
 541         /*
 542          * Send directed probe requests followed by any
 543          * broadcast probe request.
 544          * XXX remove dependence on ic/vap->iv_bss
 545          */
 546         for (i = 0; i < ss->ss_nssid; i++)
 547                 ieee80211_send_probereq(vap->iv_bss,
 548                         vap->iv_myaddr, ifp->if_broadcastaddr,
 549                         ifp->if_broadcastaddr,
 550                         ss->ss_ssid[i].ssid, ss->ss_ssid[i].len);
 551         if ((ss->ss_flags & IEEE80211_SCAN_NOBCAST) == 0)
 552                 ieee80211_send_probereq(vap->iv_bss,
 553                         vap->iv_myaddr, ifp->if_broadcastaddr,
 554                         ifp->if_broadcastaddr,
 555                         "", 0);
 556 }
 557
 558 /*
 559  * Scan curchan.  If this is an active scan and the channel
 560  * is not marked passive then send probe request frame(s).
 561  * Arrange for the channel change after maxdwell ticks.
 562  */
 563 static void
 564 scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
 565 {
 566         struct ieee80211vap *vap  = ss->ss_vap;
 567         struct ieee80211com *ic = ss->ss_ic;
 568
 569         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 570             "%s: calling; maxdwell=%lu\n",
 571             __func__,
 572             maxdwell);
 573         IEEE80211_LOCK(ic);
 574         if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 575                 ieee80211_probe_curchan(vap, 0);
 576         taskqueue_enqueue_timeout(ic->ic_tq,
 577             &SCAN_PRIVATE(ss)->ss_scan_curchan, maxdwell);
 578         IEEE80211_UNLOCK(ic);
 579 }
 580
 581 static void
 582 scan_signal(struct ieee80211_scan_state *ss, int iflags)
 583 {
 584         struct ieee80211com *ic = ss->ss_ic;
 585
 586         IEEE80211_UNLOCK_ASSERT(ic);
 587
 588         IEEE80211_LOCK(ic);
 589         scan_signal_locked(ss, iflags);
 590         IEEE80211_UNLOCK(ic);
 591 }
 592
 593 static void
 594 scan_signal_locked(struct ieee80211_scan_state *ss, int iflags)
 595 {
 596         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 597         struct timeout_task *scan_task = &ss_priv->ss_scan_curchan;
 598         struct ieee80211com *ic = ss->ss_ic;
 599
 600         IEEE80211_LOCK_ASSERT(ic);
 601
 602         ss_priv->ss_iflags |= iflags;
 603         if (ss_priv->ss_iflags & ISCAN_RUNNING) {
 604                 if (taskqueue_cancel_timeout(ic->ic_tq, scan_task, NULL) == 0)
 605                         taskqueue_enqueue_timeout(ic->ic_tq, scan_task, 0);
 606         }
 607 }
 608
 609 /*
 610  * Handle mindwell requirements completed; initiate a channel
 611  * change to the next channel asap.
 612  */
 613 static void
 614 scan_mindwell(struct ieee80211_scan_state *ss)
 615 {
 616
 617         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: called\n",
 618             __func__);
 619
 620         scan_signal(ss, 0);
 621 }
 622
 623 static void
 624 scan_start(void *arg, int pending)
 625 {
 626 #define ISCAN_REP       (ISCAN_MINDWELL | ISCAN_DISCARD)
 627         struct ieee80211_scan_state *ss = (struct ieee80211_scan_state *) arg;
 628         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 629         struct ieee80211vap *vap = ss->ss_vap;
 630         struct ieee80211com *ic = ss->ss_ic;
 631
 632         IEEE80211_LOCK(ic);
 633         if (vap == NULL || (ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
 634             (ss_priv->ss_iflags & ISCAN_ABORT)) {
 635                 /* Cancelled before we started */
 636                 scan_done(ss, 0);
 637                 return;
 638         }
 639
 640         if (ss->ss_next == ss->ss_last) {
 641                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 642                         "%s: no channels to scan\n", __func__);
 643                 scan_done(ss, 1);
 644                 return;
 645         }
 646
 647         /*
 648          * Put the station into power save mode.
 649          *
 650          * This is only required if we're not a full-offload device;
 651          * those devices manage scan/traffic differently.
 652          */
 653         if (((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0) &&
 654             vap->iv_opmode == IEEE80211_M_STA &&
 655             vap->iv_state == IEEE80211_S_RUN) {
 656                 if ((vap->iv_bss->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) {
 657                         /* Enable station power save mode */
 658                         vap->iv_sta_ps(vap, 1);
 659                         /* Wait until null data frame will be ACK'ed */
 660 #if defined(__DragonFly__)
 661                         lksleep(vap, IEEE80211_LOCK_OBJ(ic), PCATCH,
 662                             "sta_ps", msecs_to_ticks(10));
 663 #else
 664                         mtx_sleep(vap, IEEE80211_LOCK_OBJ(ic), PCATCH,
 665                             "sta_ps", msecs_to_ticks(10));
 666 #endif
 667                         if (ss_priv->ss_iflags & ISCAN_ABORT) {
 668                                 scan_done(ss, 0);
 669                                 return;
 670                         }
 671                 }
 672         }
 673
 674         ss_priv->ss_scanend = ticks + ss_priv->ss_duration;
 675
 676         /* XXX scan state can change! Re-validate scan state! */
 677
 678         IEEE80211_UNLOCK(ic);
 679
 680         ic->ic_scan_start(ic);          /* notify driver */
 681
 682         scan_curchan_task(ss, 0);
 683 }
 684
 685 static void
 686 scan_curchan_task(void *arg, int pending)
 687 {
 688         struct ieee80211_scan_state *ss = arg;
 689         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 690         struct ieee80211com *ic = ss->ss_ic;
 691         struct ieee80211_channel *chan;
 692         unsigned long maxdwell;
 693         int scandone;
 694
 695         IEEE80211_LOCK(ic);
 696 end:
 697         scandone = (ss->ss_next >= ss->ss_last) ||
 698             (ss_priv->ss_iflags & ISCAN_CANCEL) != 0;
 699
 700         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
 701             "%s: loop start; scandone=%d\n",
 702             __func__,
 703             scandone);
 704
 705         if (scandone || (ss->ss_flags & IEEE80211_SCAN_GOTPICK) ||
 706             (ss_priv->ss_iflags & ISCAN_ABORT) ||
 707              ieee80211_time_after(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
 708                 ss_priv->ss_iflags &= ~ISCAN_RUNNING;
 709                 scan_end(ss, scandone);
 710                 return;
 711         } else
 712                 ss_priv->ss_iflags |= ISCAN_RUNNING;
 713
 714         chan = ss->ss_chans[ss->ss_next++];
 715
 716         /*
 717          * Watch for truncation due to the scan end time.
 718          */
 719         if (ieee80211_time_after(ticks + ss->ss_maxdwell, ss_priv->ss_scanend))
 720                 maxdwell = ss_priv->ss_scanend - ticks;
 721         else
 722                 maxdwell = ss->ss_maxdwell;
 723
 724         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
 725             "%s: chan %3d%c -> %3d%c [%s, dwell min %lums max %lums]\n",
 726             __func__,
 727             ieee80211_chan2ieee(ic, ic->ic_curchan),
 728             ieee80211_channel_type_char(ic->ic_curchan),
 729             ieee80211_chan2ieee(ic, chan),
 730             ieee80211_channel_type_char(chan),
 731             (ss->ss_flags & IEEE80211_SCAN_ACTIVE) &&
 732                 (chan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 ?
 733                 "active" : "passive",
 734             ticks_to_msecs(ss->ss_mindwell), ticks_to_msecs(maxdwell));
 735
 736         /*
 737          * Potentially change channel and phy mode.
 738          */
 739         ic->ic_curchan = chan;
 740         ic->ic_rt = ieee80211_get_ratetable(chan);
 741         IEEE80211_UNLOCK(ic);
 742         /*
 743          * Perform the channel change and scan unlocked so the driver
 744          * may sleep. Once set_channel returns the hardware has
 745          * completed the channel change.
 746          */
 747         ic->ic_set_channel(ic);
 748         ieee80211_radiotap_chan_change(ic);
 749
 750         /*
 751          * Scan curchan.  Drivers for "intelligent hardware"
 752          * override ic_scan_curchan to tell the device to do
 753          * the work.  Otherwise we manage the work ourselves;
 754          * sending a probe request (as needed), and arming the
 755          * timeout to switch channels after maxdwell ticks.
 756          *
 757          * scan_curchan should only pause for the time required to
 758          * prepare/initiate the hardware for the scan (if at all).
 759          */
 760         ic->ic_scan_curchan(ss, maxdwell);
 761         IEEE80211_LOCK(ic);
 762
 763         /* XXX scan state can change! Re-validate scan state! */
 764
 765         ss_priv->ss_chanmindwell = ticks + ss->ss_mindwell;
 766         /* clear mindwell lock and initial channel change flush */
 767         ss_priv->ss_iflags &= ~ISCAN_REP;
 768
 769         if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) {
 770                 taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan,
 771                     NULL);
 772                 goto end;
 773         }
 774
 775         IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n",
 776             __func__);
 777         IEEE80211_UNLOCK(ic);
 778 }
 779
 780 static void
 781 scan_end(struct ieee80211_scan_state *ss, int scandone)
 782 {
 783         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 784         struct ieee80211vap *vap = ss->ss_vap;
 785         struct ieee80211com *ic = ss->ss_ic;
 786
 787         IEEE80211_LOCK_ASSERT(ic);
 788
 789         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: out\n", __func__);
 790
 791         if (ss_priv->ss_iflags & ISCAN_ABORT) {
 792                 scan_done(ss, scandone);
 793                 return;
 794         }
 795
 796         IEEE80211_UNLOCK(ic);
 797         ic->ic_scan_end(ic);            /* notify driver */
 798         IEEE80211_LOCK(ic);
 799         /* XXX scan state can change! Re-validate scan state! */
 800
 801         /*
 802          * Since a cancellation may have occurred during one of the
 803          * driver calls (whilst unlocked), update scandone.
 804          */
 805         if (scandone == 0 && (ss_priv->ss_iflags & ISCAN_CANCEL) != 0) {
 806                 /* XXX printf? */
 807                 if_printf(vap->iv_ifp,
 808                     "%s: OOPS! scan cancelled during driver call (1)!\n",
 809                     __func__);
 810                 scandone = 1;
 811         }
 812
 813         /*
 814          * Record scan complete time.  Note that we also do
 815          * this when canceled so any background scan will
 816          * not be restarted for a while.
 817          */
 818         if (scandone)
 819                 ic->ic_lastscan = ticks;
 820         /* return to the bss channel */
 821         if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
 822             ic->ic_curchan != ic->ic_bsschan) {
 823                 ieee80211_setupcurchan(ic, ic->ic_bsschan);
 824                 IEEE80211_UNLOCK(ic);
 825                 ic->ic_set_channel(ic);
 826                 ieee80211_radiotap_chan_change(ic);
 827                 IEEE80211_LOCK(ic);
 828         }
 829         /* clear internal flags and any indication of a pick */
 830         ss_priv->ss_iflags &= ~ISCAN_REP;
 831         ss->ss_flags &= ~IEEE80211_SCAN_GOTPICK;
 832
 833         /*
 834          * If not canceled and scan completed, do post-processing.
 835          * If the callback function returns 0, then it wants to
 836          * continue/restart scanning.  Unfortunately we needed to
 837          * notify the driver to end the scan above to avoid having
 838          * rx frames alter the scan candidate list.
 839          */
 840         if ((ss_priv->ss_iflags & ISCAN_CANCEL) == 0 &&
 841             !ss->ss_ops->scan_end(ss, vap) &&
 842             (ss->ss_flags & IEEE80211_SCAN_ONCE) == 0 &&
 843             ieee80211_time_before(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
 844                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 845                     "%s: done, restart "
 846                     "[ticks %u, dwell min %lu scanend %lu]\n",
 847                     __func__,
 848                     ticks, ss->ss_mindwell, ss_priv->ss_scanend);
 849                 ss->ss_next = 0;        /* reset to beginning */
 850                 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
 851                         vap->iv_stats.is_scan_active++;
 852                 else
 853                         vap->iv_stats.is_scan_passive++;
 854
 855                 ss->ss_ops->scan_restart(ss, vap);      /* XXX? */
 856                 ieee80211_runtask(ic, &ss_priv->ss_scan_start);
 857                 IEEE80211_UNLOCK(ic);
 858                 return;
 859         }
 860
 861         /* past here, scandone is ``true'' if not in bg mode */
 862         if ((ss->ss_flags & IEEE80211_SCAN_BGSCAN) == 0)
 863                 scandone = 1;
 864
 865         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 866             "%s: %s, [ticks %u, dwell min %lu scanend %lu]\n",
 867             __func__, scandone ? "done" : "stopped",
 868             ticks, ss->ss_mindwell, ss_priv->ss_scanend);
 869
 870         /*
 871          * Since a cancellation may have occurred during one of the
 872          * driver calls (whilst unlocked), update scandone.
 873          */
 874         if (scandone == 0 && (ss_priv->ss_iflags & ISCAN_CANCEL) != 0) {
 875                 /* XXX printf? */
 876                 if_printf(vap->iv_ifp,
 877                     "%s: OOPS! scan cancelled during driver call (2)!\n",
 878                     __func__);
 879                 scandone = 1;
 880         }
 881
 882         scan_done(ss, scandone);
 883 }
 884
 885 static void
 886 scan_done(struct ieee80211_scan_state *ss, int scandone)
 887 {
 888         struct scan_state *ss_priv = SCAN_PRIVATE(ss);
 889         struct ieee80211com *ic = ss->ss_ic;
 890         struct ieee80211vap *vap = ss->ss_vap;
 891
 892         IEEE80211_LOCK_ASSERT(ic);
 893
 894         /*
 895          * Clear the SCAN bit first in case frames are
 896          * pending on the station power save queue.  If
 897          * we defer this then the dispatch of the frames
 898          * may generate a request to cancel scanning.
 899          */
 900         ic->ic_flags &= ~IEEE80211_F_SCAN;
 901
 902         /*
 903          * Drop out of power save mode when a scan has
 904          * completed.  If this scan was prematurely terminated
 905          * because it is a background scan then don't notify
 906          * the ap; we'll either return to scanning after we
 907          * receive the beacon frame or we'll drop out of power
 908          * save mode because the beacon indicates we have frames
 909          * waiting for us.
 910          */
 911         if (scandone) {
 912                 /*
 913                  * If we're not a scan offload device, come back out of
 914                  * station powersave.  Offload devices handle this themselves.
 915                  */
 916                 if ((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0)
 917                         vap->iv_sta_ps(vap, 0);
 918                 if (ss->ss_next >= ss->ss_last)
 919                         ic->ic_flags_ext &= ~IEEE80211_FEXT_BGSCAN;
 920                 ieee80211_notify_scan_done(vap);
 921         }
 922         ss_priv->ss_iflags &= ~(ISCAN_CANCEL|ISCAN_ABORT);
 923         ss_priv->ss_scanend = 0;
 924         ss->ss_flags &= ~(IEEE80211_SCAN_ONCE | IEEE80211_SCAN_PICK1ST);
 925         IEEE80211_UNLOCK(ic);
 926 #undef ISCAN_REP
 927 }
 928
 929 /*
 930  * Process a beacon or probe response frame.
 931  */
 932 static void
 933 ieee80211_swscan_add_scan(struct ieee80211vap *vap,
 934         struct ieee80211_channel *curchan,
 935         const struct ieee80211_scanparams *sp,
 936         const struct ieee80211_frame *wh,
 937         int subtype, int rssi, int noise)
 938 {
 939         struct ieee80211com *ic = vap->iv_ic;
 940         struct ieee80211_scan_state *ss = ic->ic_scan;
 941
 942         /* XXX locking */
 943         /*
 944          * Frames received during startup are discarded to avoid
 945          * using scan state setup on the initial entry to the timer
 946          * callback.  This can occur because the device may enable
 947          * rx prior to our doing the initial channel change in the
 948          * timer routine.
 949          */
 950         if (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_DISCARD)
 951                 return;
 952 #ifdef IEEE80211_DEBUG
 953         if (ieee80211_msg_scan(vap) && (ic->ic_flags & IEEE80211_F_SCAN))
 954                 ieee80211_scan_dump_probe_beacon(subtype, 1, wh->i_addr2, sp, rssi);
 955 #endif
 956         if (ss->ss_ops != NULL &&
 957             ss->ss_ops->scan_add(ss, curchan, sp, wh, subtype, rssi, noise)) {
 958                 /*
 959                  * If we've reached the min dwell time terminate
 960                  * the timer so we'll switch to the next channel.
 961                  */
 962                 if ((SCAN_PRIVATE(ss)->ss_iflags & ISCAN_MINDWELL) == 0 &&
 963                     ieee80211_time_after_eq(ticks, SCAN_PRIVATE(ss)->ss_chanmindwell)) {
 964                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 965                             "%s: chan %3d%c min dwell met (%u > %lu)\n",
 966                             __func__,
 967                             ieee80211_chan2ieee(ic, ic->ic_curchan),
 968                             ieee80211_channel_type_char(ic->ic_curchan),
 969                             ticks, SCAN_PRIVATE(ss)->ss_chanmindwell);
 970                         SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_MINDWELL;
 971                         /*
 972                          * NB: trigger at next clock tick or wait for the
 973                          * hardware.
 974                          */
 975                         ic->ic_scan_mindwell(ss);
 976                 }
 977         }
 978 }
 979
 980 static struct ieee80211_scan_methods swscan_methods = {
 981         .sc_attach = ieee80211_swscan_attach,
 982         .sc_detach = ieee80211_swscan_detach,
 983         .sc_vattach = ieee80211_swscan_vattach,
 984         .sc_vdetach = ieee80211_swscan_vdetach,
 985         .sc_set_scan_duration = ieee80211_swscan_set_scan_duration,
 986         .sc_start_scan = ieee80211_swscan_start_scan,
 987         .sc_check_scan = ieee80211_swscan_check_scan,
 988         .sc_bg_scan = ieee80211_swscan_bg_scan,
 989         .sc_cancel_scan = ieee80211_swscan_cancel_scan,
 990         .sc_cancel_anyscan = ieee80211_swscan_cancel_anyscan,
 991         .sc_scan_next = ieee80211_swscan_scan_next,
 992         .sc_scan_done = ieee80211_swscan_scan_done,
 993         .sc_scan_probe_curchan = ieee80211_swscan_probe_curchan,
 994         .sc_add_scan = ieee80211_swscan_add_scan
 995 };
 996
 997 /*
 998  * Default scan attach method.
 999  */
1000 void
1001 ieee80211_swscan_attach(struct ieee80211com *ic)
1002 {
1003         struct scan_state *ss;
1004
1005         /*
1006          * Setup the default methods
1007          */
1008         ic->ic_scan_methods = &swscan_methods;
1009
1010         /* Allocate initial scan state */
1011 #if defined(__DragonFly__)
1012         ss = (struct scan_state *) kmalloc(sizeof(struct scan_state),
1013                 M_80211_SCAN, M_INTWAIT | M_ZERO);
1014 #else
1015         ss = (struct scan_state *) IEEE80211_MALLOC(sizeof(struct scan_state),
1016                 M_80211_SCAN, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
1017 #endif
1018         if (ss == NULL) {
1019                 ic->ic_scan = NULL;
1020                 return;
1021         }
1022         TASK_INIT(&ss->ss_scan_start, 0, scan_start, ss);
1023         TIMEOUT_TASK_INIT(ic->ic_tq, &ss->ss_scan_curchan, 0,
1024             scan_curchan_task, ss);
1025
1026         ic->ic_scan = &ss->base;
1027         ss->base.ss_ic = ic;
1028
1029         ic->ic_scan_curchan = scan_curchan;
1030         ic->ic_scan_mindwell = scan_mindwell;
1031 }