1 /*-
2 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include <sys/cdefs.h>
27 /*
28 * IEEE 802.11 scanning support.
29 */
30 #include "opt_wlan.h"
31
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/proc.h>
35 #include <sys/kernel.h>
36 #include <sys/malloc.h>
37 #include <sys/condvar.h>
38
39 #include <sys/socket.h>
40
41 #include <net/if.h>
42 #include <net/if_var.h>
43 #include <net/if_media.h>
44 #include <net/if_private.h>
45 #include <net/ethernet.h>
46
47 #include <net80211/ieee80211_var.h>
48
49 #include <net80211/ieee80211_scan_sw.h>
50
51 #include <net/bpf.h>
52
53 struct scan_state {
54 struct ieee80211_scan_state base; /* public state */
55
56 u_int ss_iflags; /* flags used internally */
57 #define ISCAN_MINDWELL 0x0001 /* min dwell time reached */
58 #define ISCAN_DISCARD 0x0002 /* discard rx'd frames */
59 #define ISCAN_INTERRUPT 0x0004 /* interrupt current scan */
60 #define ISCAN_CANCEL 0x0008 /* cancel current scan */
61 #define ISCAN_PAUSE (ISCAN_INTERRUPT | ISCAN_CANCEL)
62 #define ISCAN_ABORT 0x0010 /* end the scan immediately */
63 #define ISCAN_RUNNING 0x0020 /* scan was started */
64
65 unsigned long ss_chanmindwell; /* min dwell on curchan */
66 unsigned long ss_scanend; /* time scan must stop */
67 u_int ss_duration; /* duration for next scan */
68 struct task ss_scan_start; /* scan start */
69 struct timeout_task ss_scan_curchan; /* scan execution */
70 };
71 #define SCAN_PRIVATE(ss) ((struct scan_state *) ss)
72
73 /*
74 * Amount of time to go off-channel during a background
75 * scan. This value should be large enough to catch most
76 * ap's but short enough that we can return on-channel
77 * before our listen interval expires.
78 *
79 * XXX tunable
80 * XXX check against configured listen interval
81 */
82 #define IEEE80211_SCAN_OFFCHANNEL msecs_to_ticks(150)
83
84 static void scan_curchan(struct ieee80211_scan_state *, unsigned long);
85 static void scan_mindwell(struct ieee80211_scan_state *);
86 static void scan_signal(struct ieee80211_scan_state *, int);
87 static void scan_signal_locked(struct ieee80211_scan_state *, int);
88 static void scan_start(void *, int);
89 static void scan_curchan_task(void *, int);
90 static void scan_end(struct ieee80211_scan_state *, int);
91 static void scan_done(struct ieee80211_scan_state *, int);
92
93 MALLOC_DEFINE(M_80211_SCAN, "80211scan", "802.11 scan state");
94
95 static void
ieee80211_swscan_detach(struct ieee80211com * ic)96 ieee80211_swscan_detach(struct ieee80211com *ic)
97 {
98 struct ieee80211_scan_state *ss = ic->ic_scan;
99
100 if (ss != NULL) {
101 scan_signal(ss, ISCAN_ABORT);
102 ieee80211_draintask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
103 taskqueue_drain_timeout(ic->ic_tq,
104 &SCAN_PRIVATE(ss)->ss_scan_curchan);
105 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0,
106 ("scan still running"));
107
108 /*
109 * For now, do the ss_ops detach here rather
110 * than ieee80211_scan_detach().
111 *
112 * I'll figure out how to cleanly split things up
113 * at a later date.
114 */
115 if (ss->ss_ops != NULL) {
116 ss->ss_ops->scan_detach(ss);
117 ss->ss_ops = NULL;
118 }
119 ic->ic_scan = NULL;
120 IEEE80211_FREE(SCAN_PRIVATE(ss), M_80211_SCAN);
121 }
122 }
123
124 static void
ieee80211_swscan_vattach(struct ieee80211vap * vap)125 ieee80211_swscan_vattach(struct ieee80211vap *vap)
126 {
127 /* nothing to do for now */
128 /*
129 * TODO: all of the vap scan calls should be methods!
130 */
131
132 }
133
134 static void
ieee80211_swscan_vdetach(struct ieee80211vap * vap)135 ieee80211_swscan_vdetach(struct ieee80211vap *vap)
136 {
137 struct ieee80211com *ic = vap->iv_ic;
138 struct ieee80211_scan_state *ss = ic->ic_scan;
139
140 IEEE80211_LOCK_ASSERT(ic);
141
142 if (ss != NULL && ss->ss_vap == vap &&
143 (ic->ic_flags & IEEE80211_F_SCAN))
144 scan_signal_locked(ss, ISCAN_ABORT);
145 }
146
147 static void
ieee80211_swscan_set_scan_duration(struct ieee80211vap * vap,u_int duration)148 ieee80211_swscan_set_scan_duration(struct ieee80211vap *vap, u_int duration)
149 {
150 struct ieee80211com *ic = vap->iv_ic;
151 struct ieee80211_scan_state *ss = ic->ic_scan;
152
153 IEEE80211_LOCK_ASSERT(ic);
154
155 /* NB: flush frames rx'd before 1st channel change */
156 SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
157 SCAN_PRIVATE(ss)->ss_duration = duration;
158 }
159
160 /*
161 * Start a scan unless one is already going.
162 */
163 static int
ieee80211_swscan_start_scan_locked(const struct ieee80211_scanner * scan,struct ieee80211vap * vap,int flags,u_int duration,u_int mindwell,u_int maxdwell,u_int nssid,const struct ieee80211_scan_ssid ssids[])164 ieee80211_swscan_start_scan_locked(const struct ieee80211_scanner *scan,
165 struct ieee80211vap *vap, int flags, u_int duration,
166 u_int mindwell, u_int maxdwell,
167 u_int nssid, const struct ieee80211_scan_ssid ssids[])
168 {
169 struct ieee80211com *ic = vap->iv_ic;
170 struct ieee80211_scan_state *ss = ic->ic_scan;
171
172 IEEE80211_LOCK_ASSERT(ic);
173
174 if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
175 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
176 "%s: scan inhibited by pending channel change\n", __func__);
177 } else if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
178 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
179 "%s: %s scan, duration %u mindwell %u maxdwell %u, desired mode %s, %s%s%s%s%s%s\n"
180 , __func__
181 , flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive"
182 , duration, mindwell, maxdwell
183 , ieee80211_phymode_name[vap->iv_des_mode]
184 , flags & IEEE80211_SCAN_FLUSH ? "flush" : "append"
185 , flags & IEEE80211_SCAN_NOPICK ? ", nopick" : ""
186 , flags & IEEE80211_SCAN_NOJOIN ? ", nojoin" : ""
187 , flags & IEEE80211_SCAN_NOBCAST ? ", nobcast" : ""
188 , flags & IEEE80211_SCAN_PICK1ST ? ", pick1st" : ""
189 , flags & IEEE80211_SCAN_ONCE ? ", once" : ""
190 );
191
192 ieee80211_scan_update_locked(vap, scan);
193 if (ss->ss_ops != NULL) {
194 if ((flags & IEEE80211_SCAN_NOSSID) == 0)
195 ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
196
197 ss->ss_flags = flags & IEEE80211_SCAN_PUBLIC_MASK;
198 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
199 vap->iv_stats.is_scan_active++;
200 else
201 vap->iv_stats.is_scan_passive++;
202 if (flags & IEEE80211_SCAN_FLUSH)
203 ss->ss_ops->scan_flush(ss);
204 if (flags & IEEE80211_SCAN_BGSCAN)
205 ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
206
207 /* Set duration for this particular scan */
208 ieee80211_swscan_set_scan_duration(vap, duration);
209
210 ss->ss_next = 0;
211 ss->ss_mindwell = mindwell;
212 ss->ss_maxdwell = maxdwell;
213 /* NB: scan_start must be before the scan runtask */
214 ss->ss_ops->scan_start(ss, vap);
215 #ifdef IEEE80211_DEBUG
216 if (ieee80211_msg_scan(vap))
217 ieee80211_scan_dump(ss);
218 #endif /* IEEE80211_DEBUG */
219 ic->ic_flags |= IEEE80211_F_SCAN;
220
221 /* Start scan task */
222 ieee80211_runtask(ic, &SCAN_PRIVATE(ss)->ss_scan_start);
223 }
224 return 1;
225 } else {
226 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
227 "%s: %s scan already in progress\n", __func__,
228 ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
229 }
230 return 0;
231 }
232
233 /*
234 * Start a scan unless one is already going.
235 *
236 * Called without the comlock held; grab the comlock as appropriate.
237 */
238 static int
ieee80211_swscan_start_scan(const struct ieee80211_scanner * scan,struct ieee80211vap * vap,int flags,u_int duration,u_int mindwell,u_int maxdwell,u_int nssid,const struct ieee80211_scan_ssid ssids[])239 ieee80211_swscan_start_scan(const struct ieee80211_scanner *scan,
240 struct ieee80211vap *vap, int flags,
241 u_int duration, u_int mindwell, u_int maxdwell,
242 u_int nssid, const struct ieee80211_scan_ssid ssids[])
243 {
244 struct ieee80211com *ic = vap->iv_ic;
245 int result;
246
247 IEEE80211_UNLOCK_ASSERT(ic);
248
249 IEEE80211_LOCK(ic);
250 result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
251 mindwell, maxdwell, nssid, ssids);
252 IEEE80211_UNLOCK(ic);
253
254 return result;
255 }
256
257 /*
258 * Check the scan cache for an ap/channel to use; if that
259 * fails then kick off a new scan.
260 *
261 * Called with the comlock held.
262 *
263 * XXX TODO: split out!
264 */
265 static int
ieee80211_swscan_check_scan(const struct ieee80211_scanner * scan,struct ieee80211vap * vap,int flags,u_int duration,u_int mindwell,u_int maxdwell,u_int nssid,const struct ieee80211_scan_ssid ssids[])266 ieee80211_swscan_check_scan(const struct ieee80211_scanner *scan,
267 struct ieee80211vap *vap, int flags,
268 u_int duration, u_int mindwell, u_int maxdwell,
269 u_int nssid, const struct ieee80211_scan_ssid ssids[])
270 {
271 struct ieee80211com *ic = vap->iv_ic;
272 struct ieee80211_scan_state *ss = ic->ic_scan;
273 int result;
274
275 IEEE80211_LOCK_ASSERT(ic);
276
277 if (ss->ss_ops != NULL) {
278 /* XXX verify ss_ops matches vap->iv_opmode */
279 if ((flags & IEEE80211_SCAN_NOSSID) == 0) {
280 /*
281 * Update the ssid list and mark flags so if
282 * we call start_scan it doesn't duplicate work.
283 */
284 ieee80211_scan_copy_ssid(vap, ss, nssid, ssids);
285 flags |= IEEE80211_SCAN_NOSSID;
286 }
287 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
288 (flags & IEEE80211_SCAN_FLUSH) == 0 &&
289 ieee80211_time_before(ticks, ic->ic_lastscan + vap->iv_scanvalid)) {
290 /*
291 * We're not currently scanning and the cache is
292 * deemed hot enough to consult. Lock out others
293 * by marking IEEE80211_F_SCAN while we decide if
294 * something is already in the scan cache we can
295 * use. Also discard any frames that might come
296 * in while temporarily marked as scanning.
297 */
298 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
299 "cache hot; ic_lastscan=%d, scanvalid=%d, ticks=%d\n",
300 ic->ic_lastscan,
301 vap->iv_scanvalid,
302 ticks);
303 SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_DISCARD;
304 ic->ic_flags |= IEEE80211_F_SCAN;
305
306 /* NB: need to use supplied flags in check */
307 ss->ss_flags = flags & IEEE80211_SCAN_PUBLIC_MASK;
308 result = ss->ss_ops->scan_end(ss, vap);
309
310 ic->ic_flags &= ~IEEE80211_F_SCAN;
311 SCAN_PRIVATE(ss)->ss_iflags &= ~ISCAN_DISCARD;
312 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
313 "%s: scan_end returned %d\n", __func__, result);
314 if (result) {
315 ieee80211_notify_scan_done(vap);
316 return 1;
317 }
318 }
319 }
320 result = ieee80211_swscan_start_scan_locked(scan, vap, flags, duration,
321 mindwell, maxdwell, nssid, ssids);
322
323 return result;
324 }
325
326 /*
327 * Restart a previous scan. If the previous scan completed
328 * then we start again using the existing channel list.
329 */
330 static int
ieee80211_swscan_bg_scan(const struct ieee80211_scanner * scan,struct ieee80211vap * vap,int flags)331 ieee80211_swscan_bg_scan(const struct ieee80211_scanner *scan,
332 struct ieee80211vap *vap, int flags)
333 {
334 struct ieee80211com *ic = vap->iv_ic;
335 struct ieee80211_scan_state *ss = ic->ic_scan;
336 bool scanning;
337
338 /* XXX assert unlocked? */
339 // IEEE80211_UNLOCK_ASSERT(ic);
340
341 IEEE80211_LOCK(ic);
342 scanning = ic->ic_flags & IEEE80211_F_SCAN;
343 if (!scanning) {
344 u_int duration;
345 /*
346 * Go off-channel for a fixed interval that is large
347 * enough to catch most ap's but short enough that
348 * we can return on-channel before our listen interval
349 * expires.
350 */
351 duration = IEEE80211_SCAN_OFFCHANNEL;
352
353 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
354 "%s: %s scan, ticks %u duration %u\n", __func__,
355 ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive",
356 ticks, duration);
357
358 ieee80211_scan_update_locked(vap, scan);
359 if (ss->ss_ops != NULL) {
360 ss->ss_vap = vap;
361 /*
362 * A background scan does not select a new sta; it
363 * just refreshes the scan cache. Also, indicate
364 * the scan logic should follow the beacon schedule:
365 * we go off-channel and scan for a while, then
366 * return to the bss channel to receive a beacon,
367 * then go off-channel again. All during this time
368 * we notify the ap we're in power save mode. When
369 * the scan is complete we leave power save mode.
370 * If any beacon indicates there are frames pending
371 * for us then we drop out of power save mode
372 * (and background scan) automatically by way of the
373 * usual sta power save logic.
374 */
375 ss->ss_flags |= IEEE80211_SCAN_NOPICK
376 | IEEE80211_SCAN_BGSCAN
377 | flags
378 ;
379 /* if previous scan completed, restart */
380 if (ss->ss_next >= ss->ss_last) {
381 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
382 vap->iv_stats.is_scan_active++;
383 else
384 vap->iv_stats.is_scan_passive++;
385 /*
386 * NB: beware of the scan cache being flushed;
387 * if the channel list is empty use the
388 * scan_start method to populate it.
389 */
390 ss->ss_next = 0;
391 if (ss->ss_last != 0) {
392 ieee80211_notify_scan_done(vap);
393 ss->ss_ops->scan_restart(ss, vap);
394 } else {
395 ss->ss_ops->scan_start(ss, vap);
396 #ifdef IEEE80211_DEBUG
397 if (ieee80211_msg_scan(vap))
398 ieee80211_scan_dump(ss);
399 #endif /* IEEE80211_DEBUG */
400 }
401 }
402 ieee80211_swscan_set_scan_duration(vap, duration);
403 ss->ss_maxdwell = duration;
404 ic->ic_flags |= IEEE80211_F_SCAN;
405 ic->ic_flags_ext |= IEEE80211_FEXT_BGSCAN;
406 ieee80211_runtask(ic,
407 &SCAN_PRIVATE(ss)->ss_scan_start);
408 scanning = true;
409 } else {
410 /* XXX msg+stat */
411 }
412 } else {
413 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
414 "%s: %s scan already in progress\n", __func__,
415 ss->ss_flags & IEEE80211_SCAN_ACTIVE ? "active" : "passive");
416 }
417 IEEE80211_UNLOCK(ic);
418
419 return (scanning);
420 }
421
422 /*
423 * Taskqueue work to cancel a scan.
424 *
425 * Note: for offload scan devices, we may want to call into the
426 * driver to try and cancel scanning, however it may not be cancelable.
427 */
428 static void
cancel_scan(struct ieee80211vap * vap,int any,const char * func)429 cancel_scan(struct ieee80211vap *vap, int any, const char *func)
430 {
431 struct ieee80211com *ic = vap->iv_ic;
432 struct ieee80211_scan_state *ss = ic->ic_scan;
433 struct scan_state *ss_priv = SCAN_PRIVATE(ss);
434 int signal;
435
436 IEEE80211_LOCK(ic);
437 signal = any ? ISCAN_PAUSE : ISCAN_CANCEL;
438 if ((ic->ic_flags & IEEE80211_F_SCAN) &&
439 (any || ss->ss_vap == vap) &&
440 (ss_priv->ss_iflags & signal) == 0) {
441 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
442 "%s: %s %s scan\n", func,
443 any ? "pause" : "cancel",
444 ss->ss_flags & IEEE80211_SCAN_ACTIVE ?
445 "active" : "passive");
446
447 /* clear bg scan NOPICK */
448 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
449 /* mark request and wake up the scan task */
450 scan_signal_locked(ss, signal);
451 } else {
452 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
453 "%s: called; F_SCAN=%d, vap=%s, signal=%d\n",
454 func,
455 !! (ic->ic_flags & IEEE80211_F_SCAN),
456 (ss->ss_vap == vap ? "match" : "nomatch"),
457 !! (ss_priv->ss_iflags & signal));
458 }
459 IEEE80211_UNLOCK(ic);
460 }
461
462 /*
463 * Cancel any scan currently going on for the specified vap.
464 */
465 static void
ieee80211_swscan_cancel_scan(struct ieee80211vap * vap)466 ieee80211_swscan_cancel_scan(struct ieee80211vap *vap)
467 {
468 cancel_scan(vap, 0, __func__);
469 }
470
471 /*
472 * Cancel any scan currently going on.
473 */
474 static void
ieee80211_swscan_cancel_anyscan(struct ieee80211vap * vap)475 ieee80211_swscan_cancel_anyscan(struct ieee80211vap *vap)
476 {
477
478 /* XXX for now - just don't do this per packet. */
479 if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD)
480 return;
481
482 cancel_scan(vap, 1, __func__);
483 }
484
485 /*
486 * Manually switch to the next channel in the channel list.
487 * Provided for drivers that manage scanning themselves
488 * (e.g. for firmware-based devices).
489 */
490 static void
ieee80211_swscan_scan_next(struct ieee80211vap * vap)491 ieee80211_swscan_scan_next(struct ieee80211vap *vap)
492 {
493 struct ieee80211_scan_state *ss = vap->iv_ic->ic_scan;
494
495 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: called\n", __func__);
496
497 /* wake up the scan task */
498 scan_signal(ss, 0);
499 }
500
501 /*
502 * Manually stop a scan that is currently running.
503 * Provided for drivers that are not able to scan single channels
504 * (e.g. for firmware-based devices).
505 */
506 static void
ieee80211_swscan_scan_done(struct ieee80211vap * vap)507 ieee80211_swscan_scan_done(struct ieee80211vap *vap)
508 {
509 struct ieee80211com *ic = vap->iv_ic;
510 struct ieee80211_scan_state *ss = ic->ic_scan;
511
512 IEEE80211_LOCK_ASSERT(ic);
513
514 scan_signal_locked(ss, 0);
515 }
516
517 /*
518 * Probe the current channel, if allowed, while scanning.
519 * If the channel is not marked passive-only then send
520 * a probe request immediately. Otherwise mark state and
521 * listen for beacons on the channel; if we receive something
522 * then we'll transmit a probe request.
523 */
524 static void
ieee80211_swscan_probe_curchan(struct ieee80211vap * vap,int force)525 ieee80211_swscan_probe_curchan(struct ieee80211vap *vap, int force)
526 {
527 struct ieee80211com *ic = vap->iv_ic;
528 struct ieee80211_scan_state *ss = ic->ic_scan;
529 struct ifnet *ifp = vap->iv_ifp;
530 int i;
531
532 /*
533 * Full-offload scan devices don't require this.
534 */
535 if (vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD)
536 return;
537
538 /*
539 * Send directed probe requests followed by any
540 * broadcast probe request.
541 * XXX remove dependence on ic/vap->iv_bss
542 */
543 for (i = 0; i < ss->ss_nssid; i++)
544 ieee80211_send_probereq(vap->iv_bss,
545 vap->iv_myaddr, ifp->if_broadcastaddr,
546 ifp->if_broadcastaddr,
547 ss->ss_ssid[i].ssid, ss->ss_ssid[i].len);
548 if ((ss->ss_flags & IEEE80211_SCAN_NOBCAST) == 0)
549 ieee80211_send_probereq(vap->iv_bss,
550 vap->iv_myaddr, ifp->if_broadcastaddr,
551 ifp->if_broadcastaddr,
552 "", 0);
553 }
554
555 /*
556 * Scan curchan. If this is an active scan and the channel
557 * is not marked passive then send probe request frame(s).
558 * Arrange for the channel change after maxdwell ticks.
559 */
560 static void
scan_curchan(struct ieee80211_scan_state * ss,unsigned long maxdwell)561 scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
562 {
563 struct ieee80211vap *vap = ss->ss_vap;
564 struct ieee80211com *ic = ss->ss_ic;
565
566 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
567 "%s: calling; maxdwell=%lu\n",
568 __func__,
569 maxdwell);
570 IEEE80211_LOCK(ic);
571 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
572 ieee80211_probe_curchan(vap, 0);
573 taskqueue_enqueue_timeout(ic->ic_tq,
574 &SCAN_PRIVATE(ss)->ss_scan_curchan, maxdwell);
575 IEEE80211_UNLOCK(ic);
576 }
577
578 static void
scan_signal(struct ieee80211_scan_state * ss,int iflags)579 scan_signal(struct ieee80211_scan_state *ss, int iflags)
580 {
581 struct ieee80211com *ic = ss->ss_ic;
582
583 IEEE80211_UNLOCK_ASSERT(ic);
584
585 IEEE80211_LOCK(ic);
586 scan_signal_locked(ss, iflags);
587 IEEE80211_UNLOCK(ic);
588 }
589
590 static void
scan_signal_locked(struct ieee80211_scan_state * ss,int iflags)591 scan_signal_locked(struct ieee80211_scan_state *ss, int iflags)
592 {
593 struct scan_state *ss_priv = SCAN_PRIVATE(ss);
594 struct timeout_task *scan_task = &ss_priv->ss_scan_curchan;
595 struct ieee80211com *ic = ss->ss_ic;
596
597 IEEE80211_LOCK_ASSERT(ic);
598
599 ss_priv->ss_iflags |= iflags;
600 if (ss_priv->ss_iflags & ISCAN_RUNNING) {
601 if (taskqueue_cancel_timeout(ic->ic_tq, scan_task, NULL) == 0)
602 taskqueue_enqueue_timeout(ic->ic_tq, scan_task, 0);
603 }
604 }
605
606 /*
607 * Handle mindwell requirements completed; initiate a channel
608 * change to the next channel asap.
609 */
610 static void
scan_mindwell(struct ieee80211_scan_state * ss)611 scan_mindwell(struct ieee80211_scan_state *ss)
612 {
613
614 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: called\n",
615 __func__);
616
617 scan_signal(ss, 0);
618 }
619
620 static void
scan_start(void * arg,int pending)621 scan_start(void *arg, int pending)
622 {
623 #define ISCAN_REP (ISCAN_MINDWELL | ISCAN_DISCARD)
624 struct ieee80211_scan_state *ss = (struct ieee80211_scan_state *) arg;
625 struct scan_state *ss_priv = SCAN_PRIVATE(ss);
626 struct ieee80211vap *vap = ss->ss_vap;
627 struct ieee80211com *ic = ss->ss_ic;
628
629 IEEE80211_LOCK(ic);
630 if (vap == NULL || (ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
631 (ss_priv->ss_iflags & ISCAN_ABORT)) {
632 /* Cancelled before we started */
633 scan_done(ss, 0);
634 return;
635 }
636
637 if (ss->ss_next == ss->ss_last) {
638 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
639 "%s: no channels to scan\n", __func__);
640 scan_done(ss, 1);
641 return;
642 }
643
644 /*
645 * Put the station into power save mode.
646 *
647 * This is only required if we're not a full-offload devices;
648 * those devices manage scan/traffic differently.
649 */
650 if (((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0) &&
651 vap->iv_opmode == IEEE80211_M_STA &&
652 vap->iv_state == IEEE80211_S_RUN) {
653 if ((vap->iv_bss->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) {
654 /* Enable station power save mode */
655 vap->iv_sta_ps(vap, 1);
656 /* Wait until null data frame will be ACK'ed */
657 mtx_sleep(vap, IEEE80211_LOCK_OBJ(ic), PCATCH,
658 "sta_ps", msecs_to_ticks(10));
659 if (ss_priv->ss_iflags & ISCAN_ABORT) {
660 scan_done(ss, 0);
661 return;
662 }
663 }
664 }
665
666 ss_priv->ss_scanend = ticks + ss_priv->ss_duration;
667
668 /* XXX scan state can change! Re-validate scan state! */
669
670 IEEE80211_UNLOCK(ic);
671
672 ic->ic_scan_start(ic); /* notify driver */
673
674 scan_curchan_task(ss, 0);
675 }
676
677 static void
scan_curchan_task(void * arg,int pending __unused)678 scan_curchan_task(void *arg, int pending __unused)
679 {
680 struct ieee80211_scan_state *ss = arg;
681 struct scan_state *ss_priv = SCAN_PRIVATE(ss);
682 struct ieee80211com *ic = ss->ss_ic;
683 struct ieee80211_channel *chan;
684 unsigned long maxdwell;
685 int scandone, scanstop;
686
687 IEEE80211_LOCK(ic);
688 end:
689 /*
690 * Note: only /end/ the scan if we're CANCEL rather than
691 * CANCEL+INTERRUPT (ie, 'PAUSE').
692 *
693 * We can stop the scan if we hit cancel, but we shouldn't
694 * call scan_end(ss, 1) if we're just PAUSEing the scan.
695 */
696 scandone = (ss->ss_next >= ss->ss_last) ||
697 ((ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL);
698 scanstop = (ss->ss_next >= ss->ss_last) ||
699 ((ss_priv->ss_iflags & ISCAN_CANCEL) != 0);
700
701 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
702 "%s: loop start; scandone=%d, scanstop=%d, ss_iflags=0x%x, ss_next=%u, ss_last=%u\n",
703 __func__,
704 scandone,
705 scanstop,
706 (uint32_t) ss_priv->ss_iflags,
707 (uint32_t) ss->ss_next,
708 (uint32_t) ss->ss_last);
709
710 if (scanstop || (ss->ss_flags & IEEE80211_SCAN_GOTPICK) ||
711 (ss_priv->ss_iflags & ISCAN_ABORT) ||
712 ieee80211_time_after(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
713 ss_priv->ss_iflags &= ~ISCAN_RUNNING;
714 scan_end(ss, scandone);
715 return;
716 } else
717 ss_priv->ss_iflags |= ISCAN_RUNNING;
718
719 chan = ss->ss_chans[ss->ss_next++];
720
721 /*
722 * Watch for truncation due to the scan end time.
723 */
724 if (ieee80211_time_after(ticks + ss->ss_maxdwell, ss_priv->ss_scanend))
725 maxdwell = ss_priv->ss_scanend - ticks;
726 else
727 maxdwell = ss->ss_maxdwell;
728
729 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN,
730 "%s: chan %3d%c -> %3d%c [%s, dwell min %lums max %lums]\n",
731 __func__,
732 ieee80211_chan2ieee(ic, ic->ic_curchan),
733 ieee80211_channel_type_char(ic->ic_curchan),
734 ieee80211_chan2ieee(ic, chan),
735 ieee80211_channel_type_char(chan),
736 (ss->ss_flags & IEEE80211_SCAN_ACTIVE) &&
737 (chan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 ?
738 "active" : "passive",
739 ticks_to_msecs(ss->ss_mindwell), ticks_to_msecs(maxdwell));
740
741 /*
742 * Potentially change channel and phy mode.
743 */
744 ic->ic_curchan = chan;
745 ic->ic_rt = ieee80211_get_ratetable(chan);
746 IEEE80211_UNLOCK(ic);
747 /*
748 * Perform the channel change and scan unlocked so the driver
749 * may sleep. Once set_channel returns the hardware has
750 * completed the channel change.
751 */
752 ic->ic_set_channel(ic);
753 ieee80211_radiotap_chan_change(ic);
754
755 /*
756 * Scan curchan. Drivers for "intelligent hardware"
757 * override ic_scan_curchan to tell the device to do
758 * the work. Otherwise we manage the work ourselves;
759 * sending a probe request (as needed), and arming the
760 * timeout to switch channels after maxdwell ticks.
761 *
762 * scan_curchan should only pause for the time required to
763 * prepare/initiate the hardware for the scan (if at all).
764 */
765 ic->ic_scan_curchan(ss, maxdwell);
766 IEEE80211_LOCK(ic);
767
768 /* XXX scan state can change! Re-validate scan state! */
769
770 ss_priv->ss_chanmindwell = ticks + ss->ss_mindwell;
771 /* clear mindwell lock and initial channel change flush */
772 ss_priv->ss_iflags &= ~ISCAN_REP;
773
774 if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) {
775 taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan,
776 NULL);
777 goto end;
778 }
779
780 IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n",
781 __func__);
782 IEEE80211_UNLOCK(ic);
783 }
784
785 static void
scan_end(struct ieee80211_scan_state * ss,int scandone)786 scan_end(struct ieee80211_scan_state *ss, int scandone)
787 {
788 struct scan_state *ss_priv = SCAN_PRIVATE(ss);
789 struct ieee80211vap *vap = ss->ss_vap;
790 struct ieee80211com *ic = ss->ss_ic;
791
792 IEEE80211_LOCK_ASSERT(ic);
793
794 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, "%s: out\n", __func__);
795
796 if (ss_priv->ss_iflags & ISCAN_ABORT) {
797 scan_done(ss, scandone);
798 return;
799 }
800
801 IEEE80211_UNLOCK(ic);
802 ic->ic_scan_end(ic); /* notify driver */
803 IEEE80211_LOCK(ic);
804 /* XXX scan state can change! Re-validate scan state! */
805
806 /*
807 * Since a cancellation may have occurred during one of the
808 * driver calls (whilst unlocked), update scandone.
809 */
810 if ((scandone == 0) && ((ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL)) {
811 /* XXX printf? */
812 if_printf(vap->iv_ifp,
813 "%s: OOPS! scan cancelled during driver call (1) (ss_iflags=0x%x)!\n",
814 __func__,
815 ss_priv->ss_iflags);
816 scandone = 1;
817 }
818
819 /*
820 * Record scan complete time. Note that we also do
821 * this when canceled so any background scan will
822 * not be restarted for a while.
823 */
824 if (scandone)
825 ic->ic_lastscan = ticks;
826 /* return to the bss channel */
827 if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
828 ic->ic_curchan != ic->ic_bsschan) {
829 ieee80211_setupcurchan(ic, ic->ic_bsschan);
830 IEEE80211_UNLOCK(ic);
831 ic->ic_set_channel(ic);
832 ieee80211_radiotap_chan_change(ic);
833 IEEE80211_LOCK(ic);
834 }
835 /* clear internal flags and any indication of a pick */
836 ss_priv->ss_iflags &= ~ISCAN_REP;
837 ss->ss_flags &= ~IEEE80211_SCAN_GOTPICK;
838
839 /*
840 * If not canceled and scan completed, do post-processing.
841 * If the callback function returns 0, then it wants to
842 * continue/restart scanning. Unfortunately we needed to
843 * notify the driver to end the scan above to avoid having
844 * rx frames alter the scan candidate list.
845 */
846 if ((ss_priv->ss_iflags & ISCAN_CANCEL) == 0 &&
847 !ss->ss_ops->scan_end(ss, vap) &&
848 (ss->ss_flags & IEEE80211_SCAN_ONCE) == 0 &&
849 ieee80211_time_before(ticks + ss->ss_mindwell, ss_priv->ss_scanend)) {
850 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
851 "%s: done, restart "
852 "[ticks %u, dwell min %lu scanend %lu]\n",
853 __func__,
854 ticks, ss->ss_mindwell, ss_priv->ss_scanend);
855 ss->ss_next = 0; /* reset to beginning */
856 if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
857 vap->iv_stats.is_scan_active++;
858 else
859 vap->iv_stats.is_scan_passive++;
860
861 ieee80211_notify_scan_done(vap);
862 ss->ss_ops->scan_restart(ss, vap); /* XXX? */
863 ieee80211_runtask(ic, &ss_priv->ss_scan_start);
864 IEEE80211_UNLOCK(ic);
865 return;
866 }
867
868 /* past here, scandone is ``true'' if not in bg mode */
869 if ((ss->ss_flags & IEEE80211_SCAN_BGSCAN) == 0)
870 scandone = 1;
871
872 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
873 "%s: %s, [ticks %u, dwell min %lu scanend %lu]\n",
874 __func__, scandone ? "done" : "stopped",
875 ticks, ss->ss_mindwell, ss_priv->ss_scanend);
876
877 /*
878 * Since a cancellation may have occurred during one of the
879 * driver calls (whilst unlocked), update scandone.
880 */
881 if (scandone == 0 && (ss_priv->ss_iflags & ISCAN_PAUSE) == ISCAN_CANCEL) {
882 /* XXX printf? */
883 if_printf(vap->iv_ifp,
884 "%s: OOPS! scan cancelled during driver call (2) (ss_iflags=0x%x)!\n",
885 __func__,
886 ss_priv->ss_iflags);
887 scandone = 1;
888 }
889
890 scan_done(ss, scandone);
891 }
892
893 static void
scan_done(struct ieee80211_scan_state * ss,int scandone)894 scan_done(struct ieee80211_scan_state *ss, int scandone)
895 {
896 struct scan_state *ss_priv = SCAN_PRIVATE(ss);
897 struct ieee80211com *ic = ss->ss_ic;
898 struct ieee80211vap *vap = ss->ss_vap;
899
900 IEEE80211_LOCK_ASSERT(ic);
901
902 /*
903 * Clear the SCAN bit first in case frames are
904 * pending on the station power save queue. If
905 * we defer this then the dispatch of the frames
906 * may generate a request to cancel scanning.
907 */
908 ic->ic_flags &= ~IEEE80211_F_SCAN;
909
910 /*
911 * Drop out of power save mode when a scan has
912 * completed. If this scan was prematurely terminated
913 * because it is a background scan then don't notify
914 * the ap; we'll either return to scanning after we
915 * receive the beacon frame or we'll drop out of power
916 * save mode because the beacon indicates we have frames
917 * waiting for us.
918 */
919 if (scandone) {
920 /*
921 * If we're not a scan offload device, come back out of
922 * station powersave. Offload devices handle this themselves.
923 */
924 if ((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) == 0)
925 vap->iv_sta_ps(vap, 0);
926 if (ss->ss_next >= ss->ss_last) {
927 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
928 "%s: Dropping out of scan; ss_next=%u, ss_last=%u\n",
929 __func__,
930 (uint32_t) ss->ss_next,
931 (uint32_t) ss->ss_last);
932 ic->ic_flags_ext &= ~IEEE80211_FEXT_BGSCAN;
933 }
934
935 /* send 'scan done' event if not interrupted due to traffic. */
936 if (!(ss_priv->ss_iflags & ISCAN_INTERRUPT) ||
937 (ss->ss_next >= ss->ss_last))
938 ieee80211_notify_scan_done(vap);
939 }
940 ss_priv->ss_iflags &= ~(ISCAN_PAUSE | ISCAN_ABORT);
941 ss_priv->ss_scanend = 0;
942 ss->ss_flags &= ~(IEEE80211_SCAN_ONCE | IEEE80211_SCAN_PICK1ST);
943 IEEE80211_UNLOCK(ic);
944 #undef ISCAN_REP
945 }
946
947 /*
948 * Process a beacon or probe response frame.
949 */
950 static void
ieee80211_swscan_add_scan(struct ieee80211vap * vap,struct ieee80211_channel * curchan,const struct ieee80211_scanparams * sp,const struct ieee80211_frame * wh,int subtype,int rssi,int noise)951 ieee80211_swscan_add_scan(struct ieee80211vap *vap,
952 struct ieee80211_channel *curchan,
953 const struct ieee80211_scanparams *sp,
954 const struct ieee80211_frame *wh,
955 int subtype, int rssi, int noise)
956 {
957 struct ieee80211com *ic = vap->iv_ic;
958 struct ieee80211_scan_state *ss = ic->ic_scan;
959
960 /* XXX locking */
961 /*
962 * Frames received during startup are discarded to avoid
963 * using scan state setup on the initial entry to the timer
964 * callback. This can occur because the device may enable
965 * rx prior to our doing the initial channel change in the
966 * timer routine.
967 */
968 if (SCAN_PRIVATE(ss)->ss_iflags & ISCAN_DISCARD)
969 return;
970 #ifdef IEEE80211_DEBUG
971 if (ieee80211_msg_scan(vap) && (ic->ic_flags & IEEE80211_F_SCAN))
972 ieee80211_scan_dump_probe_beacon(subtype, 1, wh->i_addr2, sp, rssi);
973 #endif
974 if (ss->ss_ops != NULL &&
975 ss->ss_ops->scan_add(ss, curchan, sp, wh, subtype, rssi, noise)) {
976 /*
977 * If we've reached the min dwell time terminate
978 * the timer so we'll switch to the next channel.
979 */
980 if ((SCAN_PRIVATE(ss)->ss_iflags & ISCAN_MINDWELL) == 0 &&
981 ieee80211_time_after_eq(ticks, SCAN_PRIVATE(ss)->ss_chanmindwell)) {
982 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
983 "%s: chan %3d%c min dwell met (%u > %lu)\n",
984 __func__,
985 ieee80211_chan2ieee(ic, ic->ic_curchan),
986 ieee80211_channel_type_char(ic->ic_curchan),
987 ticks, SCAN_PRIVATE(ss)->ss_chanmindwell);
988 SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_MINDWELL;
989 /*
990 * NB: trigger at next clock tick or wait for the
991 * hardware.
992 */
993 ic->ic_scan_mindwell(ss);
994 }
995 }
996 }
997
998 static struct ieee80211_scan_methods swscan_methods = {
999 .sc_attach = ieee80211_swscan_attach,
1000 .sc_detach = ieee80211_swscan_detach,
1001 .sc_vattach = ieee80211_swscan_vattach,
1002 .sc_vdetach = ieee80211_swscan_vdetach,
1003 .sc_set_scan_duration = ieee80211_swscan_set_scan_duration,
1004 .sc_start_scan = ieee80211_swscan_start_scan,
1005 .sc_check_scan = ieee80211_swscan_check_scan,
1006 .sc_bg_scan = ieee80211_swscan_bg_scan,
1007 .sc_cancel_scan = ieee80211_swscan_cancel_scan,
1008 .sc_cancel_anyscan = ieee80211_swscan_cancel_anyscan,
1009 .sc_scan_next = ieee80211_swscan_scan_next,
1010 .sc_scan_done = ieee80211_swscan_scan_done,
1011 .sc_scan_probe_curchan = ieee80211_swscan_probe_curchan,
1012 .sc_add_scan = ieee80211_swscan_add_scan
1013 };
1014
1015 /*
1016 * Default scan attach method.
1017 */
1018 void
ieee80211_swscan_attach(struct ieee80211com * ic)1019 ieee80211_swscan_attach(struct ieee80211com *ic)
1020 {
1021 struct scan_state *ss;
1022
1023 /*
1024 * Setup the default methods
1025 */
1026 ic->ic_scan_methods = &swscan_methods;
1027
1028 /* Allocate initial scan state */
1029 ss = (struct scan_state *) IEEE80211_MALLOC(sizeof(struct scan_state),
1030 M_80211_SCAN, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
1031 if (ss == NULL) {
1032 ic->ic_scan = NULL;
1033 return;
1034 }
1035 TASK_INIT(&ss->ss_scan_start, 0, scan_start, ss);
1036 TIMEOUT_TASK_INIT(ic->ic_tq, &ss->ss_scan_curchan, 0,
1037 scan_curchan_task, ss);
1038
1039 ic->ic_scan = &ss->base;
1040 ss->base.ss_ic = ic;
1041
1042 ic->ic_scan_curchan = scan_curchan;
1043 ic->ic_scan_mindwell = scan_mindwell;
1044 }
1045