2 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD$");
30 * IEEE 802.11 scanning support.
34 #include <sys/param.h>
35 #include <sys/systm.h>
37 #include <sys/kernel.h>
38 #include <sys/malloc.h>
39 #include <sys/condvar.h>
41 #include <sys/socket.h>
44 #include <net/if_var.h>
45 #include <net/if_media.h>
46 #include <net/ethernet.h>
48 #include <netproto/802_11/ieee80211_var.h>
50 #include <netproto/802_11/ieee80211_scan_sw.h>
55 struct ieee80211_scan_state base
; /* public state */
57 u_int ss_iflags
; /* flags used internally */
58 #define ISCAN_MINDWELL 0x0001 /* min dwell time reached */
59 #define ISCAN_DISCARD 0x0002 /* discard rx'd frames */
60 #define ISCAN_CANCEL 0x0004 /* cancel current scan */
61 #define ISCAN_ABORT 0x0008 /* end the scan immediately */
62 #define ISCAN_RUNNING 0x0010 /* scan was started */
64 unsigned long ss_chanmindwell
; /* min dwell on curchan */
65 unsigned long ss_scanend
; /* time scan must stop */
66 u_int ss_duration
; /* duration for next scan */
67 struct task ss_scan_start
; /* scan start */
68 struct timeout_task ss_scan_curchan
; /* scan execution */
70 #define SCAN_PRIVATE(ss) ((struct scan_state *) ss)
73 * Amount of time to go off-channel during a background
74 * scan. This value should be large enough to catch most
75 * ap's but short enough that we can return on-channel
76 * before our listen interval expires.
79 * XXX check against configured listen interval
81 #define IEEE80211_SCAN_OFFCHANNEL msecs_to_ticks(150)
84 * Roaming-related defaults. RSSI thresholds are as returned by the
85 * driver (.5dBm). Transmit rate thresholds are IEEE rate codes (i.e
89 #define ROAM_RSSI_11A_DEFAULT 14 /* 11a bss */
90 #define ROAM_RSSI_11B_DEFAULT 14 /* 11b bss */
91 #define ROAM_RSSI_11BONLY_DEFAULT 14 /* 11b-only bss */
92 /* transmit rate thresholds */
93 #define ROAM_RATE_11A_DEFAULT 2*12 /* 11a bss */
94 #define ROAM_RATE_11B_DEFAULT 2*5 /* 11b bss */
95 #define ROAM_RATE_11BONLY_DEFAULT 2*1 /* 11b-only bss */
96 #define ROAM_RATE_HALF_DEFAULT 2*6 /* half-width 11a/g bss */
97 #define ROAM_RATE_QUARTER_DEFAULT 2*3 /* quarter-width 11a/g bss */
98 #define ROAM_MCS_11N_DEFAULT (1 | IEEE80211_RATE_MCS) /* 11n bss */
100 static void scan_curchan(struct ieee80211_scan_state
*, unsigned long);
101 static void scan_mindwell(struct ieee80211_scan_state
*);
102 static void scan_signal(struct ieee80211_scan_state
*, int);
103 static void scan_signal_locked(struct ieee80211_scan_state
*, int);
104 static void scan_start(void *, int);
105 static void scan_curchan_task(void *, int);
106 static void scan_end(struct ieee80211_scan_state
*, int);
107 static void scan_done(struct ieee80211_scan_state
*, int);
109 MALLOC_DEFINE(M_80211_SCAN
, "80211scan", "802.11 scan state");
112 ieee80211_swscan_detach(struct ieee80211com
*ic
)
114 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
117 scan_signal(ss
, ISCAN_ABORT
);
118 ieee80211_draintask(ic
, &SCAN_PRIVATE(ss
)->ss_scan_start
);
119 taskqueue_drain_timeout(ic
->ic_tq
,
120 &SCAN_PRIVATE(ss
)->ss_scan_curchan
);
121 KASSERT((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0,
122 ("scan still running"));
125 * For now, do the ss_ops detach here rather
126 * than ieee80211_scan_detach().
128 * I'll figure out how to cleanly split things up
131 if (ss
->ss_ops
!= NULL
) {
132 ss
->ss_ops
->scan_detach(ss
);
136 IEEE80211_FREE(SCAN_PRIVATE(ss
), M_80211_SCAN
);
141 ieee80211_swscan_vattach(struct ieee80211vap
*vap
)
143 /* nothing to do for now */
145 * TODO: all of the vap scan calls should be methods!
151 ieee80211_swscan_vdetach(struct ieee80211vap
*vap
)
153 struct ieee80211com
*ic
= vap
->iv_ic
;
154 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
156 IEEE80211_LOCK_ASSERT(ic
);
158 if (ss
!= NULL
&& ss
->ss_vap
== vap
&&
159 (ic
->ic_flags
& IEEE80211_F_SCAN
))
160 scan_signal_locked(ss
, ISCAN_ABORT
);
164 ieee80211_swscan_set_scan_duration(struct ieee80211vap
*vap
, u_int duration
)
166 struct ieee80211com
*ic
= vap
->iv_ic
;
167 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
169 IEEE80211_LOCK_ASSERT(ic
);
171 /* NB: flush frames rx'd before 1st channel change */
172 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_DISCARD
;
173 SCAN_PRIVATE(ss
)->ss_duration
= duration
;
177 * Start a scan unless one is already going.
180 ieee80211_swscan_start_scan_locked(const struct ieee80211_scanner
*scan
,
181 struct ieee80211vap
*vap
, int flags
, u_int duration
,
182 u_int mindwell
, u_int maxdwell
,
183 u_int nssid
, const struct ieee80211_scan_ssid ssids
[])
185 struct ieee80211com
*ic
= vap
->iv_ic
;
186 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
188 IEEE80211_LOCK_ASSERT(ic
);
190 if (ic
->ic_flags
& IEEE80211_F_CSAPENDING
) {
191 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
192 "%s: scan inhibited by pending channel change\n", __func__
);
193 } else if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0) {
194 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
195 "%s: %s scan, duration %u mindwell %u maxdwell %u, desired mode %s, %s%s%s%s%s%s\n"
197 , flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive"
198 , duration
, mindwell
, maxdwell
199 , ieee80211_phymode_name
[vap
->iv_des_mode
]
200 , flags
& IEEE80211_SCAN_FLUSH
? "flush" : "append"
201 , flags
& IEEE80211_SCAN_NOPICK
? ", nopick" : ""
202 , flags
& IEEE80211_SCAN_NOJOIN
? ", nojoin" : ""
203 , flags
& IEEE80211_SCAN_NOBCAST
? ", nobcast" : ""
204 , flags
& IEEE80211_SCAN_PICK1ST
? ", pick1st" : ""
205 , flags
& IEEE80211_SCAN_ONCE
? ", once" : ""
208 ieee80211_scan_update_locked(vap
, scan
);
209 if (ss
->ss_ops
!= NULL
) {
210 if ((flags
& IEEE80211_SCAN_NOSSID
) == 0)
211 ieee80211_scan_copy_ssid(vap
, ss
, nssid
, ssids
);
213 /* NB: top 4 bits for internal use */
214 ss
->ss_flags
= flags
& 0xfff;
215 if (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
)
216 vap
->iv_stats
.is_scan_active
++;
218 vap
->iv_stats
.is_scan_passive
++;
219 if (flags
& IEEE80211_SCAN_FLUSH
)
220 ss
->ss_ops
->scan_flush(ss
);
221 if (flags
& IEEE80211_SCAN_BGSCAN
)
222 ic
->ic_flags_ext
|= IEEE80211_FEXT_BGSCAN
;
224 /* Set duration for this particular scan */
225 ieee80211_swscan_set_scan_duration(vap
, duration
);
228 ss
->ss_mindwell
= mindwell
;
229 ss
->ss_maxdwell
= maxdwell
;
230 /* NB: scan_start must be before the scan runtask */
231 ss
->ss_ops
->scan_start(ss
, vap
);
232 #ifdef IEEE80211_DEBUG
233 if (ieee80211_msg_scan(vap
))
234 ieee80211_scan_dump(ss
);
235 #endif /* IEEE80211_DEBUG */
236 ic
->ic_flags
|= IEEE80211_F_SCAN
;
238 /* Start scan task */
239 ieee80211_runtask(ic
, &SCAN_PRIVATE(ss
)->ss_scan_start
);
243 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
244 "%s: %s scan already in progress\n", __func__
,
245 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive");
252 * Start a scan unless one is already going.
254 * Called without the comlock held; grab the comlock as appropriate.
257 ieee80211_swscan_start_scan(const struct ieee80211_scanner
*scan
,
258 struct ieee80211vap
*vap
, int flags
,
259 u_int duration
, u_int mindwell
, u_int maxdwell
,
260 u_int nssid
, const struct ieee80211_scan_ssid ssids
[])
262 struct ieee80211com
*ic
= vap
->iv_ic
;
265 IEEE80211_UNLOCK_ASSERT(ic
);
268 result
= ieee80211_swscan_start_scan_locked(scan
, vap
, flags
, duration
,
269 mindwell
, maxdwell
, nssid
, ssids
);
270 IEEE80211_UNLOCK(ic
);
276 * Check the scan cache for an ap/channel to use; if that
277 * fails then kick off a new scan.
279 * Called with the comlock held.
281 * XXX TODO: split out!
284 ieee80211_swscan_check_scan(const struct ieee80211_scanner
*scan
,
285 struct ieee80211vap
*vap
, int flags
,
286 u_int duration
, u_int mindwell
, u_int maxdwell
,
287 u_int nssid
, const struct ieee80211_scan_ssid ssids
[])
289 struct ieee80211com
*ic
= vap
->iv_ic
;
290 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
293 IEEE80211_LOCK_ASSERT(ic
);
295 if (ss
->ss_ops
!= NULL
) {
296 /* XXX verify ss_ops matches vap->iv_opmode */
297 if ((flags
& IEEE80211_SCAN_NOSSID
) == 0) {
299 * Update the ssid list and mark flags so if
300 * we call start_scan it doesn't duplicate work.
302 ieee80211_scan_copy_ssid(vap
, ss
, nssid
, ssids
);
303 flags
|= IEEE80211_SCAN_NOSSID
;
305 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0 &&
306 (flags
& IEEE80211_SCAN_FLUSH
) == 0 &&
307 ieee80211_time_before(ticks
, ic
->ic_lastscan
+ vap
->iv_scanvalid
)) {
309 * We're not currently scanning and the cache is
310 * deemed hot enough to consult. Lock out others
311 * by marking IEEE80211_F_SCAN while we decide if
312 * something is already in the scan cache we can
313 * use. Also discard any frames that might come
314 * in while temporarily marked as scanning.
316 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_DISCARD
;
317 ic
->ic_flags
|= IEEE80211_F_SCAN
;
319 /* NB: need to use supplied flags in check */
320 ss
->ss_flags
= flags
& 0xff;
321 result
= ss
->ss_ops
->scan_end(ss
, vap
);
323 ic
->ic_flags
&= ~IEEE80211_F_SCAN
;
324 SCAN_PRIVATE(ss
)->ss_iflags
&= ~ISCAN_DISCARD
;
326 ieee80211_notify_scan_done(vap
);
331 result
= ieee80211_swscan_start_scan_locked(scan
, vap
, flags
, duration
,
332 mindwell
, maxdwell
, nssid
, ssids
);
338 * Restart a previous scan. If the previous scan completed
339 * then we start again using the existing channel list.
342 ieee80211_swscan_bg_scan(const struct ieee80211_scanner
*scan
,
343 struct ieee80211vap
*vap
, int flags
)
345 struct ieee80211com
*ic
= vap
->iv_ic
;
346 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
348 /* XXX assert unlocked? */
349 // IEEE80211_UNLOCK_ASSERT(ic);
352 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0) {
355 * Go off-channel for a fixed interval that is large
356 * enough to catch most ap's but short enough that
357 * we can return on-channel before our listen interval
360 duration
= IEEE80211_SCAN_OFFCHANNEL
;
362 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
363 "%s: %s scan, ticks %u duration %u\n", __func__
,
364 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive",
367 ieee80211_scan_update_locked(vap
, scan
);
368 if (ss
->ss_ops
!= NULL
) {
371 * A background scan does not select a new sta; it
372 * just refreshes the scan cache. Also, indicate
373 * the scan logic should follow the beacon schedule:
374 * we go off-channel and scan for a while, then
375 * return to the bss channel to receive a beacon,
376 * then go off-channel again. All during this time
377 * we notify the ap we're in power save mode. When
378 * the scan is complete we leave power save mode.
379 * If any beacon indicates there are frames pending
380 * for us then we drop out of power save mode
381 * (and background scan) automatically by way of the
382 * usual sta power save logic.
384 ss
->ss_flags
|= IEEE80211_SCAN_NOPICK
385 | IEEE80211_SCAN_BGSCAN
388 /* if previous scan completed, restart */
389 if (ss
->ss_next
>= ss
->ss_last
) {
390 if (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
)
391 vap
->iv_stats
.is_scan_active
++;
393 vap
->iv_stats
.is_scan_passive
++;
395 * NB: beware of the scan cache being flushed;
396 * if the channel list is empty use the
397 * scan_start method to populate it.
400 if (ss
->ss_last
!= 0)
401 ss
->ss_ops
->scan_restart(ss
, vap
);
403 ss
->ss_ops
->scan_start(ss
, vap
);
404 #ifdef IEEE80211_DEBUG
405 if (ieee80211_msg_scan(vap
))
406 ieee80211_scan_dump(ss
);
407 #endif /* IEEE80211_DEBUG */
410 ieee80211_swscan_set_scan_duration(vap
, duration
);
411 ss
->ss_maxdwell
= duration
;
412 ic
->ic_flags
|= IEEE80211_F_SCAN
;
413 ic
->ic_flags_ext
|= IEEE80211_FEXT_BGSCAN
;
414 ieee80211_runtask(ic
,
415 &SCAN_PRIVATE(ss
)->ss_scan_start
);
420 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
421 "%s: %s scan already in progress\n", __func__
,
422 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive");
424 IEEE80211_UNLOCK(ic
);
426 /* NB: racey, does it matter? */
427 return (ic
->ic_flags
& IEEE80211_F_SCAN
);
431 * Taskqueue work to cancel a scan.
433 * Note: for offload scan devices, we may want to call into the
434 * driver to try and cancel scanning, however it may not be cancelable.
437 cancel_scan(struct ieee80211vap
*vap
, int any
, const char *func
)
439 struct ieee80211com
*ic
= vap
->iv_ic
;
440 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
443 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) &&
444 (any
|| ss
->ss_vap
== vap
) &&
445 (SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_CANCEL
) == 0) {
446 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
447 "%s: cancel %s scan\n", func
,
448 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
?
449 "active" : "passive");
451 /* clear bg scan NOPICK */
452 ss
->ss_flags
&= ~IEEE80211_SCAN_NOPICK
;
453 /* mark cancel request and wake up the scan task */
454 scan_signal_locked(ss
, ISCAN_CANCEL
);
456 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
457 "%s: called; F_SCAN=%d, vap=%s, CANCEL=%d\n",
459 !! (ic
->ic_flags
& IEEE80211_F_SCAN
),
460 (ss
->ss_vap
== vap
? "match" : "nomatch"),
461 !! (SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_CANCEL
));
463 IEEE80211_UNLOCK(ic
);
467 * Cancel any scan currently going on for the specified vap.
470 ieee80211_swscan_cancel_scan(struct ieee80211vap
*vap
)
472 cancel_scan(vap
, 0, __func__
);
476 * Cancel any scan currently going on.
479 ieee80211_swscan_cancel_anyscan(struct ieee80211vap
*vap
)
481 /* XXX for now - just don't do this per packet. */
482 if (vap
->iv_flags_ext
& IEEE80211_FEXT_SCAN_OFFLOAD
)
485 cancel_scan(vap
, 1, __func__
);
489 * Manually switch to the next channel in the channel list.
490 * Provided for drivers that manage scanning themselves
491 * (e.g. for firmware-based devices).
494 ieee80211_swscan_scan_next(struct ieee80211vap
*vap
)
496 struct ieee80211_scan_state
*ss
= vap
->iv_ic
->ic_scan
;
498 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
, "%s: called\n", __func__
);
500 /* wake up the scan task */
505 * Manually stop a scan that is currently running.
506 * Provided for drivers that are not able to scan single channels
507 * (e.g. for firmware-based devices).
510 ieee80211_swscan_scan_done(struct ieee80211vap
*vap
)
512 struct ieee80211com
*ic
= vap
->iv_ic
;
513 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
515 IEEE80211_LOCK_ASSERT(ic
);
517 scan_signal_locked(ss
, 0);
521 * Probe the current channel, if allowed, while scanning.
522 * If the channel is not marked passive-only then send
523 * a probe request immediately. Otherwise mark state and
524 * listen for beacons on the channel; if we receive something
525 * then we'll transmit a probe request.
528 ieee80211_swscan_probe_curchan(struct ieee80211vap
*vap
, int force
)
530 struct ieee80211com
*ic
= vap
->iv_ic
;
531 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
532 struct ifnet
*ifp
= vap
->iv_ifp
;
536 * Full-offload scan devices don't require this.
538 if (vap
->iv_flags_ext
& IEEE80211_FEXT_SCAN_OFFLOAD
)
542 * Send directed probe requests followed by any
543 * broadcast probe request.
544 * XXX remove dependence on ic/vap->iv_bss
546 for (i
= 0; i
< ss
->ss_nssid
; i
++)
547 ieee80211_send_probereq(vap
->iv_bss
,
548 vap
->iv_myaddr
, ifp
->if_broadcastaddr
,
549 ifp
->if_broadcastaddr
,
550 ss
->ss_ssid
[i
].ssid
, ss
->ss_ssid
[i
].len
);
551 if ((ss
->ss_flags
& IEEE80211_SCAN_NOBCAST
) == 0)
552 ieee80211_send_probereq(vap
->iv_bss
,
553 vap
->iv_myaddr
, ifp
->if_broadcastaddr
,
554 ifp
->if_broadcastaddr
,
559 * Scan curchan. If this is an active scan and the channel
560 * is not marked passive then send probe request frame(s).
561 * Arrange for the channel change after maxdwell ticks.
564 scan_curchan(struct ieee80211_scan_state
*ss
, unsigned long maxdwell
)
566 struct ieee80211vap
*vap
= ss
->ss_vap
;
567 struct ieee80211com
*ic
= ss
->ss_ic
;
569 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
570 "%s: calling; maxdwell=%lu\n",
574 if (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
)
575 ieee80211_probe_curchan(vap
, 0);
576 taskqueue_enqueue_timeout(ic
->ic_tq
,
577 &SCAN_PRIVATE(ss
)->ss_scan_curchan
, maxdwell
);
578 IEEE80211_UNLOCK(ic
);
582 scan_signal(struct ieee80211_scan_state
*ss
, int iflags
)
584 struct ieee80211com
*ic
= ss
->ss_ic
;
586 IEEE80211_UNLOCK_ASSERT(ic
);
589 scan_signal_locked(ss
, iflags
);
590 IEEE80211_UNLOCK(ic
);
594 scan_signal_locked(struct ieee80211_scan_state
*ss
, int iflags
)
596 struct scan_state
*ss_priv
= SCAN_PRIVATE(ss
);
597 struct timeout_task
*scan_task
= &ss_priv
->ss_scan_curchan
;
598 struct ieee80211com
*ic
= ss
->ss_ic
;
600 IEEE80211_LOCK_ASSERT(ic
);
602 ss_priv
->ss_iflags
|= iflags
;
603 if (ss_priv
->ss_iflags
& ISCAN_RUNNING
) {
604 if (taskqueue_cancel_timeout(ic
->ic_tq
, scan_task
, NULL
) == 0)
605 taskqueue_enqueue_timeout(ic
->ic_tq
, scan_task
, 0);
610 * Handle mindwell requirements completed; initiate a channel
611 * change to the next channel asap.
614 scan_mindwell(struct ieee80211_scan_state
*ss
)
617 IEEE80211_DPRINTF(ss
->ss_vap
, IEEE80211_MSG_SCAN
, "%s: called\n",
624 scan_start(void *arg
, int pending
)
626 #define ISCAN_REP (ISCAN_MINDWELL | ISCAN_DISCARD)
627 struct ieee80211_scan_state
*ss
= (struct ieee80211_scan_state
*) arg
;
628 struct scan_state
*ss_priv
= SCAN_PRIVATE(ss
);
629 struct ieee80211vap
*vap
= ss
->ss_vap
;
630 struct ieee80211com
*ic
= ss
->ss_ic
;
633 if (vap
== NULL
|| (ic
->ic_flags
& IEEE80211_F_SCAN
) == 0 ||
634 (ss_priv
->ss_iflags
& ISCAN_ABORT
)) {
635 /* Cancelled before we started */
640 if (ss
->ss_next
== ss
->ss_last
) {
641 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
642 "%s: no channels to scan\n", __func__
);
648 * Put the station into power save mode.
650 * This is only required if we're not a full-offload device;
651 * those devices manage scan/traffic differently.
653 if (((vap
->iv_flags_ext
& IEEE80211_FEXT_SCAN_OFFLOAD
) == 0) &&
654 vap
->iv_opmode
== IEEE80211_M_STA
&&
655 vap
->iv_state
== IEEE80211_S_RUN
) {
656 if ((vap
->iv_bss
->ni_flags
& IEEE80211_NODE_PWR_MGT
) == 0) {
657 /* Enable station power save mode */
658 vap
->iv_sta_ps(vap
, 1);
659 /* Wait until null data frame will be ACK'ed */
660 #if defined(__DragonFly__)
661 lksleep(vap
, IEEE80211_LOCK_OBJ(ic
), PCATCH
,
662 "sta_ps", msecs_to_ticks(10));
664 mtx_sleep(vap
, IEEE80211_LOCK_OBJ(ic
), PCATCH
,
665 "sta_ps", msecs_to_ticks(10));
667 if (ss_priv
->ss_iflags
& ISCAN_ABORT
) {
674 ss_priv
->ss_scanend
= ticks
+ ss_priv
->ss_duration
;
676 /* XXX scan state can change! Re-validate scan state! */
678 IEEE80211_UNLOCK(ic
);
680 ic
->ic_scan_start(ic
); /* notify driver */
682 scan_curchan_task(ss
, 0);
686 scan_curchan_task(void *arg
, int pending
)
688 struct ieee80211_scan_state
*ss
= arg
;
689 struct scan_state
*ss_priv
= SCAN_PRIVATE(ss
);
690 struct ieee80211com
*ic
= ss
->ss_ic
;
691 struct ieee80211_channel
*chan
;
692 unsigned long maxdwell
;
697 scandone
= (ss
->ss_next
>= ss
->ss_last
) ||
698 (ss_priv
->ss_iflags
& ISCAN_CANCEL
) != 0;
700 IEEE80211_DPRINTF(ss
->ss_vap
, IEEE80211_MSG_SCAN
,
701 "%s: loop start; scandone=%d\n",
705 if (scandone
|| (ss
->ss_flags
& IEEE80211_SCAN_GOTPICK
) ||
706 (ss_priv
->ss_iflags
& ISCAN_ABORT
) ||
707 ieee80211_time_after(ticks
+ ss
->ss_mindwell
, ss_priv
->ss_scanend
)) {
708 ss_priv
->ss_iflags
&= ~ISCAN_RUNNING
;
709 scan_end(ss
, scandone
);
712 ss_priv
->ss_iflags
|= ISCAN_RUNNING
;
714 chan
= ss
->ss_chans
[ss
->ss_next
++];
717 * Watch for truncation due to the scan end time.
719 if (ieee80211_time_after(ticks
+ ss
->ss_maxdwell
, ss_priv
->ss_scanend
))
720 maxdwell
= ss_priv
->ss_scanend
- ticks
;
722 maxdwell
= ss
->ss_maxdwell
;
724 IEEE80211_DPRINTF(ss
->ss_vap
, IEEE80211_MSG_SCAN
,
725 "%s: chan %3d%c -> %3d%c [%s, dwell min %lums max %lums]\n",
727 ieee80211_chan2ieee(ic
, ic
->ic_curchan
),
728 ieee80211_channel_type_char(ic
->ic_curchan
),
729 ieee80211_chan2ieee(ic
, chan
),
730 ieee80211_channel_type_char(chan
),
731 (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
) &&
732 (chan
->ic_flags
& IEEE80211_CHAN_PASSIVE
) == 0 ?
733 "active" : "passive",
734 ticks_to_msecs(ss
->ss_mindwell
), ticks_to_msecs(maxdwell
));
737 * Potentially change channel and phy mode.
739 ic
->ic_curchan
= chan
;
740 ic
->ic_rt
= ieee80211_get_ratetable(chan
);
741 IEEE80211_UNLOCK(ic
);
743 * Perform the channel change and scan unlocked so the driver
744 * may sleep. Once set_channel returns the hardware has
745 * completed the channel change.
747 ic
->ic_set_channel(ic
);
748 ieee80211_radiotap_chan_change(ic
);
751 * Scan curchan. Drivers for "intelligent hardware"
752 * override ic_scan_curchan to tell the device to do
753 * the work. Otherwise we manage the work ourselves;
754 * sending a probe request (as needed), and arming the
755 * timeout to switch channels after maxdwell ticks.
757 * scan_curchan should only pause for the time required to
758 * prepare/initiate the hardware for the scan (if at all).
760 ic
->ic_scan_curchan(ss
, maxdwell
);
763 /* XXX scan state can change! Re-validate scan state! */
765 ss_priv
->ss_chanmindwell
= ticks
+ ss
->ss_mindwell
;
766 /* clear mindwell lock and initial channel change flush */
767 ss_priv
->ss_iflags
&= ~ISCAN_REP
;
769 if (ss_priv
->ss_iflags
& (ISCAN_CANCEL
|ISCAN_ABORT
)) {
770 taskqueue_cancel_timeout(ic
->ic_tq
, &ss_priv
->ss_scan_curchan
,
775 IEEE80211_DPRINTF(ss
->ss_vap
, IEEE80211_MSG_SCAN
, "%s: waiting\n",
777 IEEE80211_UNLOCK(ic
);
781 scan_end(struct ieee80211_scan_state
*ss
, int scandone
)
783 struct scan_state
*ss_priv
= SCAN_PRIVATE(ss
);
784 struct ieee80211vap
*vap
= ss
->ss_vap
;
785 struct ieee80211com
*ic
= ss
->ss_ic
;
787 IEEE80211_LOCK_ASSERT(ic
);
789 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
, "%s: out\n", __func__
);
791 if (ss_priv
->ss_iflags
& ISCAN_ABORT
) {
792 scan_done(ss
, scandone
);
796 IEEE80211_UNLOCK(ic
);
797 ic
->ic_scan_end(ic
); /* notify driver */
799 /* XXX scan state can change! Re-validate scan state! */
802 * Since a cancellation may have occurred during one of the
803 * driver calls (whilst unlocked), update scandone.
805 if (scandone
== 0 && (ss_priv
->ss_iflags
& ISCAN_CANCEL
) != 0) {
807 if_printf(vap
->iv_ifp
,
808 "%s: OOPS! scan cancelled during driver call (1)!\n",
814 * Record scan complete time. Note that we also do
815 * this when canceled so any background scan will
816 * not be restarted for a while.
819 ic
->ic_lastscan
= ticks
;
820 /* return to the bss channel */
821 if (ic
->ic_bsschan
!= IEEE80211_CHAN_ANYC
&&
822 ic
->ic_curchan
!= ic
->ic_bsschan
) {
823 ieee80211_setupcurchan(ic
, ic
->ic_bsschan
);
824 IEEE80211_UNLOCK(ic
);
825 ic
->ic_set_channel(ic
);
826 ieee80211_radiotap_chan_change(ic
);
829 /* clear internal flags and any indication of a pick */
830 ss_priv
->ss_iflags
&= ~ISCAN_REP
;
831 ss
->ss_flags
&= ~IEEE80211_SCAN_GOTPICK
;
834 * If not canceled and scan completed, do post-processing.
835 * If the callback function returns 0, then it wants to
836 * continue/restart scanning. Unfortunately we needed to
837 * notify the driver to end the scan above to avoid having
838 * rx frames alter the scan candidate list.
840 if ((ss_priv
->ss_iflags
& ISCAN_CANCEL
) == 0 &&
841 !ss
->ss_ops
->scan_end(ss
, vap
) &&
842 (ss
->ss_flags
& IEEE80211_SCAN_ONCE
) == 0 &&
843 ieee80211_time_before(ticks
+ ss
->ss_mindwell
, ss_priv
->ss_scanend
)) {
844 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
846 "[ticks %u, dwell min %lu scanend %lu]\n",
848 ticks
, ss
->ss_mindwell
, ss_priv
->ss_scanend
);
849 ss
->ss_next
= 0; /* reset to beginning */
850 if (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
)
851 vap
->iv_stats
.is_scan_active
++;
853 vap
->iv_stats
.is_scan_passive
++;
855 ss
->ss_ops
->scan_restart(ss
, vap
); /* XXX? */
856 ieee80211_runtask(ic
, &ss_priv
->ss_scan_start
);
857 IEEE80211_UNLOCK(ic
);
861 /* past here, scandone is ``true'' if not in bg mode */
862 if ((ss
->ss_flags
& IEEE80211_SCAN_BGSCAN
) == 0)
865 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
866 "%s: %s, [ticks %u, dwell min %lu scanend %lu]\n",
867 __func__
, scandone
? "done" : "stopped",
868 ticks
, ss
->ss_mindwell
, ss_priv
->ss_scanend
);
871 * Since a cancellation may have occurred during one of the
872 * driver calls (whilst unlocked), update scandone.
874 if (scandone
== 0 && (ss_priv
->ss_iflags
& ISCAN_CANCEL
) != 0) {
876 if_printf(vap
->iv_ifp
,
877 "%s: OOPS! scan cancelled during driver call (2)!\n",
882 scan_done(ss
, scandone
);
886 scan_done(struct ieee80211_scan_state
*ss
, int scandone
)
888 struct scan_state
*ss_priv
= SCAN_PRIVATE(ss
);
889 struct ieee80211com
*ic
= ss
->ss_ic
;
890 struct ieee80211vap
*vap
= ss
->ss_vap
;
892 IEEE80211_LOCK_ASSERT(ic
);
895 * Clear the SCAN bit first in case frames are
896 * pending on the station power save queue. If
897 * we defer this then the dispatch of the frames
898 * may generate a request to cancel scanning.
900 ic
->ic_flags
&= ~IEEE80211_F_SCAN
;
903 * Drop out of power save mode when a scan has
904 * completed. If this scan was prematurely terminated
905 * because it is a background scan then don't notify
906 * the ap; we'll either return to scanning after we
907 * receive the beacon frame or we'll drop out of power
908 * save mode because the beacon indicates we have frames
913 * If we're not a scan offload device, come back out of
914 * station powersave. Offload devices handle this themselves.
916 if ((vap
->iv_flags_ext
& IEEE80211_FEXT_SCAN_OFFLOAD
) == 0)
917 vap
->iv_sta_ps(vap
, 0);
918 if (ss
->ss_next
>= ss
->ss_last
)
919 ic
->ic_flags_ext
&= ~IEEE80211_FEXT_BGSCAN
;
920 ieee80211_notify_scan_done(vap
);
922 ss_priv
->ss_iflags
&= ~(ISCAN_CANCEL
|ISCAN_ABORT
);
923 ss_priv
->ss_scanend
= 0;
924 ss
->ss_flags
&= ~(IEEE80211_SCAN_ONCE
| IEEE80211_SCAN_PICK1ST
);
925 IEEE80211_UNLOCK(ic
);
930 * Process a beacon or probe response frame.
933 ieee80211_swscan_add_scan(struct ieee80211vap
*vap
,
934 struct ieee80211_channel
*curchan
,
935 const struct ieee80211_scanparams
*sp
,
936 const struct ieee80211_frame
*wh
,
937 int subtype
, int rssi
, int noise
)
939 struct ieee80211com
*ic
= vap
->iv_ic
;
940 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
944 * Frames received during startup are discarded to avoid
945 * using scan state setup on the initial entry to the timer
946 * callback. This can occur because the device may enable
947 * rx prior to our doing the initial channel change in the
950 if (SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_DISCARD
)
952 #ifdef IEEE80211_DEBUG
953 if (ieee80211_msg_scan(vap
) && (ic
->ic_flags
& IEEE80211_F_SCAN
))
954 ieee80211_scan_dump_probe_beacon(subtype
, 1, wh
->i_addr2
, sp
, rssi
);
956 if (ss
->ss_ops
!= NULL
&&
957 ss
->ss_ops
->scan_add(ss
, curchan
, sp
, wh
, subtype
, rssi
, noise
)) {
959 * If we've reached the min dwell time terminate
960 * the timer so we'll switch to the next channel.
962 if ((SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_MINDWELL
) == 0 &&
963 ieee80211_time_after_eq(ticks
, SCAN_PRIVATE(ss
)->ss_chanmindwell
)) {
964 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
965 "%s: chan %3d%c min dwell met (%u > %lu)\n",
967 ieee80211_chan2ieee(ic
, ic
->ic_curchan
),
968 ieee80211_channel_type_char(ic
->ic_curchan
),
969 ticks
, SCAN_PRIVATE(ss
)->ss_chanmindwell
);
970 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_MINDWELL
;
972 * NB: trigger at next clock tick or wait for the
975 ic
->ic_scan_mindwell(ss
);
980 static struct ieee80211_scan_methods swscan_methods
= {
981 .sc_attach
= ieee80211_swscan_attach
,
982 .sc_detach
= ieee80211_swscan_detach
,
983 .sc_vattach
= ieee80211_swscan_vattach
,
984 .sc_vdetach
= ieee80211_swscan_vdetach
,
985 .sc_set_scan_duration
= ieee80211_swscan_set_scan_duration
,
986 .sc_start_scan
= ieee80211_swscan_start_scan
,
987 .sc_check_scan
= ieee80211_swscan_check_scan
,
988 .sc_bg_scan
= ieee80211_swscan_bg_scan
,
989 .sc_cancel_scan
= ieee80211_swscan_cancel_scan
,
990 .sc_cancel_anyscan
= ieee80211_swscan_cancel_anyscan
,
991 .sc_scan_next
= ieee80211_swscan_scan_next
,
992 .sc_scan_done
= ieee80211_swscan_scan_done
,
993 .sc_scan_probe_curchan
= ieee80211_swscan_probe_curchan
,
994 .sc_add_scan
= ieee80211_swscan_add_scan
998 * Default scan attach method.
1001 ieee80211_swscan_attach(struct ieee80211com
*ic
)
1003 struct scan_state
*ss
;
1006 * Setup the default methods
1008 ic
->ic_scan_methods
= &swscan_methods
;
1010 /* Allocate initial scan state */
1011 #if defined(__DragonFly__)
1012 ss
= (struct scan_state
*) kmalloc(sizeof(struct scan_state
),
1013 M_80211_SCAN
, M_INTWAIT
| M_ZERO
);
1015 ss
= (struct scan_state
*) IEEE80211_MALLOC(sizeof(struct scan_state
),
1016 M_80211_SCAN
, IEEE80211_M_NOWAIT
| IEEE80211_M_ZERO
);
1022 TASK_INIT(&ss
->ss_scan_start
, 0, scan_start
, ss
);
1023 TIMEOUT_TASK_INIT(ic
->ic_tq
, &ss
->ss_scan_curchan
, 0,
1024 scan_curchan_task
, ss
);
1026 ic
->ic_scan
= &ss
->base
;
1027 ss
->base
.ss_ic
= ic
;
1029 ic
->ic_scan_curchan
= scan_curchan
;
1030 ic
->ic_scan_mindwell
= scan_mindwell
;