2 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. The name of the author may not be used to endorse or promote products
14 * derived from this software without specific prior written permission.
16 * Alternatively, this software may be distributed under the terms of the
17 * GNU General Public License ("GPL") version 2 as published by the Free
18 * Software Foundation.
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 * $Id: ieee80211_scan.c 3787 2008-07-17 04:50:29Z proski $
38 * IEEE 802.11 scanning support.
40 #ifndef AUTOCONF_INCLUDED
41 #include <linux/config.h>
43 #include <linux/version.h>
44 #include <linux/module.h>
45 #include <linux/skbuff.h>
46 #include <linux/netdevice.h>
47 #include <linux/etherdevice.h>
48 #include <linux/random.h>
49 #include <linux/interrupt.h>
50 #include <linux/delay.h>
54 #include <net80211/ieee80211_var.h>
55 #include <net80211/if_athproto.h>
58 struct ieee80211_scan_state base
; /* public state */
60 u_int ss_iflags
; /* flags used internally */
61 #define ISCAN_MINDWELL 0x0001 /* min dwell time reached */
62 #define ISCAN_DISCARD 0x0002 /* discard rx'd frames */
63 #define ISCAN_CANCEL 0x0004 /* cancel current scan */
64 #define ISCAN_START 0x0008 /* 1st time through next_scan */
65 unsigned long ss_chanmindwell
; /* min dwell on curchan */
66 unsigned long ss_scanend
; /* time scan must stop */
67 u_int ss_duration
; /* duration for next scan */
68 struct tasklet_struct ss_pwrsav
; /* sta ps ena tasklet */
69 struct timer_list ss_scan_timer
; /* scan timer */
71 #define SCAN_PRIVATE(_ss) ((struct scan_state *)(_ss))
74 * Amount of time to go off-channel during a background
75 * scan. This value should be large enough to catch most
76 * APs but short enough that we can return on-channel
77 * before our listen interval expires.
80 * XXX check against configured listen interval
82 #define IEEE80211_SCAN_OFFCHANNEL msecs_to_jiffies(150)
85 * Roaming-related defaults. RSSI thresholds are as returned by the
86 * driver (dBm). Transmit rate thresholds are IEEE rate codes (i.e
89 #define SCAN_VALID_DEFAULT 60 /* scan cache valid age (secs) */
90 #define ROAM_RSSI_11A_DEFAULT 9 /* rssi threshold for 11a bss */
91 #define ROAM_RSSI_11G_DEFAULT 9 /* rssi threshold for 11g bss */
92 #define ROAM_RSSI_11BONLY_DEFAULT 9 /* rssi threshold for 11b-only bss */
93 #define ROAM_RATE_11A_DEFAULT 2 * 24 /* tx rate threshold for 11a bss */
94 #define ROAM_RATE_11G_DEFAULT 2 * 9 /* tx rate threshold for 11g bss */
95 #define ROAM_RATE_11BONLY_DEFAULT 2 * 5 /* tx rate threshold for 11b-only bss */
97 static void scan_restart_pwrsav(unsigned long);
98 static void scan_next(unsigned long);
101 ieee80211_scan_attach(struct ieee80211com
*ic
)
103 struct scan_state
*ss
;
105 ic
->ic_roaming
= IEEE80211_ROAMING_AUTO
;
107 MALLOC(ss
, struct scan_state
*, sizeof(struct scan_state
),
108 M_80211_SCAN
, M_NOWAIT
| M_ZERO
);
110 init_timer(&ss
->ss_scan_timer
);
111 ss
->ss_scan_timer
.function
= scan_next
;
112 ss
->ss_scan_timer
.data
= (unsigned long) ss
;
113 tasklet_init(&ss
->ss_pwrsav
, scan_restart_pwrsav
,
115 ic
->ic_scan
= &ss
->base
;
121 ieee80211_scan_detach(struct ieee80211com
*ic
)
123 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
126 del_timer(&SCAN_PRIVATE(ss
)->ss_scan_timer
);
127 tasklet_kill(&SCAN_PRIVATE(ss
)->ss_pwrsav
);
128 if (ss
->ss_ops
!= NULL
) {
129 ss
->ss_ops
->scan_detach(ss
);
132 ic
->ic_flags
&= ~IEEE80211_F_SCAN
;
134 FREE(SCAN_PRIVATE(ss
), M_80211_SCAN
);
139 ieee80211_scan_vattach(struct ieee80211vap
*vap
)
141 vap
->iv_bgscanidle
= msecs_to_jiffies(IEEE80211_BGSCAN_IDLE_DEFAULT
);
142 vap
->iv_bgscanintvl
= IEEE80211_BGSCAN_INTVAL_DEFAULT
* HZ
;
143 vap
->iv_scanvalid
= SCAN_VALID_DEFAULT
* HZ
;
144 vap
->iv_roam
.rssi11a
= ROAM_RSSI_11A_DEFAULT
;
145 vap
->iv_roam
.rssi11g
= ROAM_RSSI_11G_DEFAULT
;
146 vap
->iv_roam
.rssi11bOnly
= ROAM_RSSI_11BONLY_DEFAULT
;
147 vap
->iv_roam
.rate11a
= ROAM_RATE_11A_DEFAULT
;
148 vap
->iv_roam
.rate11g
= ROAM_RATE_11G_DEFAULT
;
149 vap
->iv_roam
.rate11bOnly
= ROAM_RATE_11BONLY_DEFAULT
;
153 ieee80211_scan_vdetach(struct ieee80211vap
*vap
)
155 struct ieee80211com
*ic
= vap
->iv_ic
;
156 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
158 IEEE80211_LOCK_IRQ(ic
);
159 if (ss
->ss_vap
== vap
) {
160 if (ic
->ic_flags
& IEEE80211_F_SCAN
) {
161 del_timer(&SCAN_PRIVATE(ss
)->ss_scan_timer
);
162 ic
->ic_flags
&= ~IEEE80211_F_SCAN
;
164 if (ss
->ss_ops
!= NULL
) {
165 ss
->ss_ops
->scan_detach(ss
);
169 IEEE80211_UNLOCK_IRQ(ic
);
173 * Simple-minded scanner module support.
175 #define IEEE80211_SCANNER_MAX (IEEE80211_M_MONITOR+1)
177 static const char *scan_modnames
[IEEE80211_SCANNER_MAX
] = {
178 [IEEE80211_M_IBSS
] = "wlan_scan_sta",
179 [IEEE80211_M_STA
] = "wlan_scan_sta",
180 [IEEE80211_M_AHDEMO
] = "wlan_scan_sta",
181 [IEEE80211_M_HOSTAP
] = "wlan_scan_ap",
183 static const struct ieee80211_scanner
*scanners
[IEEE80211_SCANNER_MAX
];
185 /* If try load is set, this function will attempt to automatically load the
186 * requested module if it is not present. This is on operation that may sleep.
188 * if !!tryload, then Context: process
190 const struct ieee80211_scanner
*
191 ieee80211_scanner_get(enum ieee80211_opmode mode
, int tryload
)
194 if (mode
>= IEEE80211_SCANNER_MAX
)
196 if (scan_modnames
[mode
] == NULL
)
198 if (scanners
[mode
] == NULL
&& tryload
) {
199 err
= ieee80211_load_module(scan_modnames
[mode
]);
200 if (scanners
[mode
] == NULL
|| err
)
201 printk(KERN_WARNING
"unable to load %s\n", scan_modnames
[mode
]);
203 return scanners
[mode
];
205 EXPORT_SYMBOL(ieee80211_scanner_get
);
208 ieee80211_scanner_register(enum ieee80211_opmode mode
,
209 const struct ieee80211_scanner
*scan
)
211 if (mode
>= IEEE80211_SCANNER_MAX
)
213 scanners
[mode
] = scan
;
215 EXPORT_SYMBOL(ieee80211_scanner_register
);
218 ieee80211_scanner_unregister(enum ieee80211_opmode mode
,
219 const struct ieee80211_scanner
*scan
)
221 if (mode
>= IEEE80211_SCANNER_MAX
)
223 if (scanners
[mode
] == scan
)
224 scanners
[mode
] = NULL
;
226 EXPORT_SYMBOL(ieee80211_scanner_unregister
);
229 ieee80211_scanner_unregister_all(const struct ieee80211_scanner
*scan
)
233 for (m
= 0; m
< IEEE80211_SCANNER_MAX
; m
++)
234 if (scanners
[m
] == scan
)
237 EXPORT_SYMBOL(ieee80211_scanner_unregister_all
);
240 change_channel(struct ieee80211com
*ic
,
241 struct ieee80211_channel
*chan
)
243 ic
->ic_curchan
= chan
;
244 ic
->ic_set_channel(ic
);
248 channel_type(const struct ieee80211_channel
*c
)
250 if (IEEE80211_IS_CHAN_ST(c
))
252 if (IEEE80211_IS_CHAN_108A(c
))
254 if (IEEE80211_IS_CHAN_108G(c
))
256 if (IEEE80211_IS_CHAN_A(c
))
258 if (IEEE80211_IS_CHAN_ANYG(c
))
260 if (IEEE80211_IS_CHAN_B(c
))
266 ieee80211_scan_dump_channels(const struct ieee80211_scan_state
*ss
)
268 struct ieee80211com
*ic
= ss
->ss_vap
->iv_ic
;
273 for (i
= ss
->ss_next
; i
< ss
->ss_last
; i
++) {
274 const struct ieee80211_channel
*c
= ss
->ss_chans
[i
];
276 printk("%s%u%c", sep
, ieee80211_chan2ieee(ic
, c
),
281 EXPORT_SYMBOL(ieee80211_scan_dump_channels
);
284 * Enable station power save mode and start/restart the scanning thread.
287 scan_restart_pwrsav(unsigned long arg
)
289 struct scan_state
*ss
= (struct scan_state
*)arg
;
290 struct ieee80211vap
*vap
= ss
->base
.ss_vap
;
291 struct ieee80211com
*ic
= vap
->iv_ic
;
294 ieee80211_sta_pwrsave(vap
, 1);
296 * Use an initial 1ms delay to ensure the null
297 * data frame has a chance to go out.
298 * XXX: 1ms is a lot, better to trigger scan
301 delay
= msecs_to_jiffies(1);
304 ic
->ic_scan_start(ic
); /* notify driver */
305 ss
->ss_scanend
= jiffies
+ delay
+ ss
->ss_duration
;
306 ss
->ss_iflags
|= ISCAN_START
;
307 mod_timer(&ss
->ss_scan_timer
, jiffies
+ delay
);
311 * Start/restart scanning. If we're operating in station mode
312 * and associated notify the ap we're going into power save mode
313 * and schedule a callback to initiate the work (where there's a
314 * better context for doing the work). Otherwise, start the scan
318 scan_restart(struct scan_state
*ss
, u_int duration
)
320 struct ieee80211vap
*vap
= ss
->base
.ss_vap
;
321 struct ieee80211com
*ic
= vap
->iv_ic
;
323 if (ss
->base
.ss_next
== ss
->base
.ss_last
) {
324 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
325 "%s: no channels to scan\n", __func__
);
328 if ((vap
->iv_opmode
== IEEE80211_M_STA
) &&
329 (vap
->iv_state
== IEEE80211_S_RUN
) &&
330 !(IEEE80211_VAP_IS_SLEEPING(vap
))) {
332 * Initiate power save before going off-channel.
333 * Note that we cannot do this directly because
334 * of locking issues; instead we defer it to a
337 ss
->ss_duration
= duration
;
338 tasklet_schedule(&ss
->ss_pwrsav
);
340 ic
->ic_scan_start(ic
); /* notify driver */
341 ss
->ss_scanend
= jiffies
+ duration
;
342 ss
->ss_iflags
|= ISCAN_START
;
343 mod_timer(&ss
->ss_scan_timer
, jiffies
);
350 copy_ssid(struct ieee80211vap
*vap
, struct ieee80211_scan_state
*ss
,
351 int nssid
, const struct ieee80211_scan_ssid ssids
[])
353 if (nssid
> IEEE80211_SCAN_MAX_SSID
) {
355 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
356 "%s: too many ssid %d, ignoring all of them\n",
360 memcpy(ss
->ss_ssid
, ssids
, nssid
* sizeof(ssids
[0]));
361 ss
->ss_nssid
= nssid
;
365 * Start a scan unless one is already going.
368 ieee80211_start_scan(struct ieee80211vap
*vap
, int flags
, u_int duration
,
369 u_int nssid
, const struct ieee80211_scan_ssid ssids
[])
371 struct ieee80211com
*ic
= vap
->iv_ic
;
372 const struct ieee80211_scanner
*scan
;
373 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
376 scan
= ieee80211_scanner_get(vap
->iv_opmode
, 0);
378 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
379 "%s: no scanner support for mode %u\n",
380 __func__
, vap
->iv_opmode
);
385 IEEE80211_LOCK_IRQ(ic
);
386 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0) {
387 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
388 "%s: %s scan, duration %lu, desired mode %s, %s%s%s%s\n",
390 flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive",
392 ieee80211_phymode_name
[vap
->iv_des_mode
],
393 flags
& IEEE80211_SCAN_FLUSH
? "flush" : "append",
394 flags
& IEEE80211_SCAN_NOPICK
? ", nopick" : "",
395 flags
& IEEE80211_SCAN_PICK1ST
? ", pick1st" : "",
396 flags
& IEEE80211_SCAN_ONCE
? ", once" : "");
399 if (ss
->ss_ops
!= scan
) {
400 /* switch scanners; detach old, attach new */
401 if (ss
->ss_ops
!= NULL
)
402 ss
->ss_ops
->scan_detach(ss
);
403 if (!scan
->scan_attach(ss
)) {
404 /* XXX attach failure */
410 if (ss
->ss_ops
!= NULL
) {
411 if ((flags
& IEEE80211_SCAN_NOSSID
) == 0)
412 copy_ssid(vap
, ss
, nssid
, ssids
);
414 /* NB: top 4 bits for internal use */
415 ss
->ss_flags
= flags
& 0xfff;
416 if (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
)
417 vap
->iv_stats
.is_scan_active
++;
419 vap
->iv_stats
.is_scan_passive
++;
420 if (flags
& IEEE80211_SCAN_FLUSH
)
421 ss
->ss_ops
->scan_flush(ss
);
423 /* NB: flush frames rx'd before 1st channel change */
424 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_DISCARD
;
425 ss
->ss_ops
->scan_start(ss
, vap
);
426 if (scan_restart(SCAN_PRIVATE(ss
), duration
))
427 ic
->ic_flags
|= IEEE80211_F_SCAN
;
430 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
431 "%s: %s scan already in progress\n", __func__
,
432 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive");
434 /* If the running scanning has the flag SCAN_NOPICK set, but
435 * the requested scan has not, then we update the running scan
436 * flag. This is needed when wpa_supplicant is used with
437 * ap_scan=1. Without it, the driver will never associate. */
438 if (((flags
& IEEE80211_SCAN_NOPICK
) == 0) &&
439 (ss
->ss_flags
& IEEE80211_SCAN_NOPICK
)) {
440 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
441 "%s: clearing SCAN_NOPICK flag\n",
443 ss
->ss_flags
&= ~IEEE80211_SCAN_NOPICK
;
447 scanning
= (ic
->ic_flags
& IEEE80211_F_SCAN
);
448 IEEE80211_UNLOCK_IRQ(ic
);
452 EXPORT_SYMBOL(ieee80211_start_scan
);
455 * Check the scan cache for an ap/channel to use; if that
456 * fails then kick off a new scan.
459 ieee80211_check_scan(struct ieee80211vap
*vap
, int flags
, u_int duration
,
460 u_int nssid
, const struct ieee80211_scan_ssid ssids
[],
461 int (*action
)(struct ieee80211vap
*, const struct ieee80211_scan_entry
*))
463 struct ieee80211com
*ic
= vap
->iv_ic
;
464 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
465 int checkscanlist
= 0;
468 * Check if there's a list of scan candidates already.
469 * XXX want more than the ap we're currently associated with
471 IEEE80211_LOCK_IRQ(ic
);
472 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
473 "%s: %s scan, duration %lu, desired mode %s, %s%s%s%s\n",
475 flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive",
477 ieee80211_phymode_name
[vap
->iv_des_mode
],
478 flags
& IEEE80211_SCAN_FLUSH
? "flush" : "append",
479 flags
& IEEE80211_SCAN_NOPICK
? ", nopick" : "",
480 flags
& IEEE80211_SCAN_PICK1ST
? ", pick1st" : "",
481 flags
& IEEE80211_SCAN_ONCE
? ", once" : "",
482 flags
& IEEE80211_SCAN_USECACHE
? ", usecache" : "");
484 if (ss
->ss_ops
!= NULL
) {
485 /* XXX verify ss_ops matches vap->iv_opmode */
486 if ((flags
& IEEE80211_SCAN_NOSSID
) == 0) {
488 * Update the ssid list and mark flags so if
489 * we call start_scan it doesn't duplicate work.
491 copy_ssid(vap
, ss
, nssid
, ssids
);
492 flags
|= IEEE80211_SCAN_NOSSID
;
494 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0 &&
495 time_before(jiffies
, ic
->ic_lastscan
+ vap
->iv_scanvalid
)) {
497 * We're not currently scanning and the cache is
498 * deemed hot enough to consult. Lock out others
499 * by marking IEEE80211_F_SCAN while we decide if
500 * something is already in the scan cache we can
501 * use. Also discard any frames that might come
502 * in while temporarily marked as scanning.
504 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_DISCARD
;
505 ic
->ic_flags
|= IEEE80211_F_SCAN
;
509 IEEE80211_UNLOCK_IRQ(ic
);
512 * ss must be filled out so scan may be restarted "outside"
513 * of the current callstack.
515 ss
->ss_flags
= flags
;
516 ss
->ss_duration
= duration
;
517 if (ss
->ss_ops
->scan_end(ss
, ss
->ss_vap
, action
, flags
& IEEE80211_SCAN_KEEPMODE
)) {
518 /* found an ap, just clear the flag */
519 ic
->ic_flags
&= ~IEEE80211_F_SCAN
;
522 /* no ap, clear the flag before starting a scan */
523 ic
->ic_flags
&= ~IEEE80211_F_SCAN
;
525 if ((flags
& IEEE80211_SCAN_USECACHE
) == 0)
526 return ieee80211_start_scan(vap
, flags
, duration
, nssid
, ssids
);
528 /* If we *must* use the cache and no ap was found, return failure */
534 * Restart a previous scan. If the previous scan completed
535 * then we start again using the existing channel list.
538 ieee80211_bg_scan(struct ieee80211vap
*vap
)
540 struct ieee80211com
*ic
= vap
->iv_ic
;
541 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
544 IEEE80211_LOCK_IRQ(ic
);
545 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0) {
548 * Go off-channel for a fixed interval that is large
549 * enough to catch most APs but short enough that
550 * we can return on-channel before our listen interval
553 duration
= IEEE80211_SCAN_OFFCHANNEL
;
555 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
556 "%s: %s scan, jiffies %lu duration %lu\n", __func__
,
557 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive",
560 if (ss
->ss_ops
!= NULL
) {
563 * A background scan does not select a new STA; it
564 * just refreshes the scan cache. Also, indicate
565 * the scan logic should follow the beacon schedule:
566 * we go off-channel and scan for a while, then
567 * return to the bss channel to receive a beacon,
568 * then go off-channel again. All during this time
569 * we notify the ap we're in power save mode. When
570 * the scan is complete, we leave power save mode.
571 * If any beacon indicates there are frames pending
572 * for us then we drop out of power save mode
573 * (and background scan) automatically by way of the
574 * usual STA power save logic.
576 ss
->ss_flags
|= IEEE80211_SCAN_NOPICK
|
577 IEEE80211_SCAN_BGSCAN
;
579 /* If previous scan completed, restart */
580 if (ss
->ss_next
>= ss
->ss_last
) {
582 if (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
)
583 vap
->iv_stats
.is_scan_active
++;
585 vap
->iv_stats
.is_scan_passive
++;
586 ss
->ss_ops
->scan_restart(ss
, vap
);
589 /* NB: Flush frames RX'd before 1st channel change */
590 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_DISCARD
;
591 ss
->ss_mindwell
= duration
;
592 if (scan_restart(SCAN_PRIVATE(ss
), duration
)) {
593 ic
->ic_flags
|= IEEE80211_F_SCAN
;
594 ic
->ic_flags_ext
|= IEEE80211_FEXT_BGSCAN
;
600 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
601 "%s: %s scan already in progress\n", __func__
,
602 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive");
605 scanning
= (ic
->ic_flags
& IEEE80211_F_SCAN
);
606 IEEE80211_UNLOCK_IRQ(ic
);
610 EXPORT_SYMBOL(ieee80211_bg_scan
);
611 EXPORT_SYMBOL(ieee80211_cancel_scan
);
614 * Cancel any scan currently going on.
617 ieee80211_cancel_scan(struct ieee80211vap
*vap
)
619 struct ieee80211com
*ic
= vap
->iv_ic
;
620 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
622 IEEE80211_LOCK_IRQ(ic
);
623 if (ic
->ic_flags
& IEEE80211_F_SCAN
) {
624 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
625 "%s: cancel %s scan\n", __func__
,
626 ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
? "active" : "passive");
628 /* clear bg scan NOPICK and mark cancel request */
629 ss
->ss_flags
&= ~IEEE80211_SCAN_NOPICK
;
630 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_CANCEL
;
631 ss
->ss_ops
->scan_cancel(ss
, vap
);
632 /* force it to fire asap */
633 mod_timer(&SCAN_PRIVATE(ss
)->ss_scan_timer
, jiffies
);
635 IEEE80211_UNLOCK_IRQ(ic
);
639 * Switch to the next channel marked for scanning.
642 scan_next(unsigned long arg
)
644 #define ISCAN_REP (ISCAN_MINDWELL | ISCAN_START | ISCAN_DISCARD)
645 struct ieee80211_scan_state
*ss
= (struct ieee80211_scan_state
*)arg
;
646 struct ieee80211vap
*vap
= ss
->ss_vap
;
647 struct ieee80211com
*ic
= vap
->iv_ic
;
648 struct ieee80211_channel
*chan
;
649 unsigned long maxdwell
, scanend
;
650 int scanning
, scandone
, i
;
652 IEEE80211_LOCK_IRQ(ic
);
653 scanning
= (ic
->ic_flags
& IEEE80211_F_SCAN
) != 0;
654 IEEE80211_UNLOCK_IRQ(ic
);
655 if (!scanning
) /* canceled */
659 scandone
= (ss
->ss_next
>= ss
->ss_last
) ||
660 ((SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_CANCEL
) != 0);
661 scanend
= SCAN_PRIVATE(ss
)->ss_scanend
;
663 (ss
->ss_flags
& IEEE80211_SCAN_GOTPICK
) == 0 &&
664 ((SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_START
) ||
665 time_before(jiffies
+ ss
->ss_mindwell
, scanend
))) {
666 chan
= ss
->ss_chans
[ss
->ss_next
++];
669 * Watch for truncation due to the scan end time.
671 if (time_after(jiffies
+ ss
->ss_maxdwell
, scanend
))
672 maxdwell
= scanend
- jiffies
;
674 maxdwell
= ss
->ss_maxdwell
;
676 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
677 "%s: chan %3d%c -> %3d%c [%s, dwell min %lu max %lu]\n",
679 ieee80211_chan2ieee(ic
, ic
->ic_curchan
),
680 channel_type(ic
->ic_curchan
),
681 ieee80211_chan2ieee(ic
, chan
), channel_type(chan
),
682 (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
) &&
683 (chan
->ic_flags
& IEEE80211_CHAN_PASSIVE
) == 0 ?
684 "active" : "passive",
685 ss
->ss_mindwell
, maxdwell
);
688 * Potentially change channel and phy mode.
690 change_channel(ic
, chan
);
693 * If doing an active scan and the channel is not
694 * marked passive-only then send a probe request.
695 * Otherwise just listen for traffic on the channel.
697 if ((ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
) &&
698 (chan
->ic_flags
& IEEE80211_CHAN_PASSIVE
) == 0) {
699 struct net_device
*dev
= vap
->iv_dev
;
701 * Send a broadcast probe request followed by
702 * any specified directed probe requests.
703 * XXX suppress broadcast probe req?
704 * XXX remove dependence on vap/vap->iv_bss
705 * XXX move to policy code?
707 ieee80211_send_probereq(vap
->iv_bss
,
708 vap
->iv_myaddr
, dev
->broadcast
,
711 vap
->iv_opt_ie
, vap
->iv_opt_ie_len
);
712 for (i
= 0; i
< ss
->ss_nssid
; i
++)
713 ieee80211_send_probereq(vap
->iv_bss
,
714 vap
->iv_myaddr
, dev
->broadcast
,
718 vap
->iv_opt_ie
, vap
->iv_opt_ie_len
);
720 SCAN_PRIVATE(ss
)->ss_chanmindwell
= jiffies
+ ss
->ss_mindwell
;
721 mod_timer(&SCAN_PRIVATE(ss
)->ss_scan_timer
, jiffies
+ maxdwell
);
722 /* clear mindwell lock and initial channel change flush */
723 SCAN_PRIVATE(ss
)->ss_iflags
&= ~ISCAN_REP
;
725 ic
->ic_scan_end(ic
); /* notify driver */
727 * Record scan complete time. Note that we also do
728 * this when canceled so any background scan will
729 * not be restarted for a while.
732 ic
->ic_lastscan
= jiffies
;
733 /* return to the bss channel */
734 if ((ic
->ic_bsschan
!= IEEE80211_CHAN_ANYC
) &&
735 (ic
->ic_curchan
!= ic
->ic_bsschan
))
736 change_channel(ic
, ic
->ic_bsschan
);
737 /* clear internal flags and any indication of a pick */
738 SCAN_PRIVATE(ss
)->ss_iflags
&= ~ISCAN_REP
;
739 ss
->ss_flags
&= ~IEEE80211_SCAN_GOTPICK
;
742 * If not canceled and scan completed, do post-processing.
743 * If the callback function returns 0, then it wants to
744 * continue/restart scanning. Unfortunately we needed to
745 * notify the driver to end the scan above to avoid having
746 * rx frames alter the scan candidate list.
748 if (((SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_CANCEL
) == 0) &&
749 !ss
->ss_ops
->scan_end(ss
, vap
, NULL
, 0) &&
750 ((ss
->ss_flags
& IEEE80211_SCAN_ONCE
) == 0) &&
751 time_before(jiffies
+ ss
->ss_mindwell
, scanend
)) {
752 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
754 "[jiffies %lu, dwell min %lu scanend %lu]\n",
756 jiffies
, ss
->ss_mindwell
, scanend
);
757 ss
->ss_next
= 0; /* reset to beginning */
758 if (ss
->ss_flags
& IEEE80211_SCAN_ACTIVE
)
759 vap
->iv_stats
.is_scan_active
++;
761 vap
->iv_stats
.is_scan_passive
++;
763 ic
->ic_scan_start(ic
); /* notify driver */
766 if ((ss
->ss_flags
& IEEE80211_SCAN_BGSCAN
) == 0)
769 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
771 "[jiffies %lu, dwell min %lu scanend %lu]\n",
772 __func__
, scandone
? "done" : "stopped",
773 jiffies
, ss
->ss_mindwell
, scanend
);
776 * Clear the SCAN bit first in case frames are
777 * pending on the station power save queue. If
778 * we defer this then the dispatch of the frames
779 * may generate a request to cancel scanning.
781 ic
->ic_flags
&= ~IEEE80211_F_SCAN
;
784 * Drop out of power save mode when a scan has
785 * completed. If this scan was prematurely terminated
786 * because it is a background scan then don't notify
787 * the ap; we'll either return to scanning after we
788 * receive the beacon frame or we'll drop out of power
789 * save mode because the beacon indicates we have frames
793 ieee80211_sta_pwrsave(vap
, 0);
794 if (ss
->ss_next
>= ss
->ss_last
) {
795 ieee80211_notify_scan_done(vap
);
796 ic
->ic_flags_ext
&= ~IEEE80211_FEXT_BGSCAN
;
799 SCAN_PRIVATE(ss
)->ss_iflags
&= ~ISCAN_CANCEL
;
801 ~(IEEE80211_SCAN_ONCE
| IEEE80211_SCAN_PICK1ST
);
807 #ifdef IEEE80211_DEBUG
809 dump_probe_beacon(u_int8_t subtype
, int isnew
,
810 const u_int8_t mac
[IEEE80211_ADDR_LEN
],
811 const struct ieee80211_scanparams
*sp
)
814 printk("[" MAC_FMT
"] %s%s on chan %u (bss chan %u) ",
815 MAC_ADDR(mac
), isnew
? "new " : "",
816 ieee80211_mgt_subtype_name
[subtype
>> IEEE80211_FC0_SUBTYPE_SHIFT
],
817 sp
->chan
, sp
->bchan
);
818 ieee80211_print_essid(sp
->ssid
+ 2, sp
->ssid
[1]);
822 printk("[" MAC_FMT
"] caps 0x%x bintval %u erp 0x%x",
823 MAC_ADDR(mac
), sp
->capinfo
, sp
->bintval
, sp
->erp
);
824 if (sp
->country
!= NULL
) {
826 printk(" country info %*D",
827 sp
->country
[1], sp
->country
+ 2, " ");
830 printk(" country info");
831 for (i
= 0; i
< sp
->country
[1]; i
++)
832 printk(" %02x", sp
->country
[i
+ 2]);
838 #endif /* IEEE80211_DEBUG */
841 * Process a beacon or probe response frame.
844 ieee80211_add_scan(struct ieee80211vap
*vap
,
845 const struct ieee80211_scanparams
*sp
,
846 const struct ieee80211_frame
*wh
,
847 int subtype
, int rssi
, u_int64_t rtsf
)
849 struct ieee80211com
*ic
= vap
->iv_ic
;
850 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
853 * Frames received during startup are discarded to avoid
854 * using scan state setup on the initial entry to the timer
855 * callback. This can occur because the device may enable
856 * rx prior to our doing the initial channel change in the
857 * timer routine (we defer the channel change to the timer
858 * code to simplify locking on linux).
860 if (SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_DISCARD
)
862 #ifdef IEEE80211_DEBUG
863 if (ieee80211_msg_scan(vap
) && (ic
->ic_flags
& IEEE80211_F_SCAN
))
864 dump_probe_beacon(subtype
, 1, wh
->i_addr2
, sp
);
866 if (ss
->ss_ops
!= NULL
&&
867 ss
->ss_ops
->scan_add(ss
, sp
, wh
, subtype
, rssi
, rtsf
)) {
869 * If we've reached the min dwell time terminate
870 * the timer so we'll switch to the next channel.
872 if ((SCAN_PRIVATE(ss
)->ss_iflags
& ISCAN_MINDWELL
) == 0 &&
873 time_after_eq(jiffies
, SCAN_PRIVATE(ss
)->ss_chanmindwell
)) {
874 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_SCAN
,
875 "%s: chan %3d%c min dwell met (%lu > %lu)\n",
877 ieee80211_chan2ieee(ic
, ic
->ic_curchan
),
878 channel_type(ic
->ic_curchan
),
879 jiffies
, SCAN_PRIVATE(ss
)->ss_chanmindwell
);
882 * We want to just kick the timer and still
883 * process frames until it fires but linux
884 * will livelock unless we discard frames.
887 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_MINDWELL
;
889 SCAN_PRIVATE(ss
)->ss_iflags
|= ISCAN_DISCARD
;
891 /* NB: trigger at next clock tick */
892 mod_timer(&SCAN_PRIVATE(ss
)->ss_scan_timer
, jiffies
);
898 * Timeout/age scan cache entries; called from sta timeout
899 * timer (XXX should be self-contained).
902 ieee80211_scan_timeout(struct ieee80211com
*ic
)
904 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
906 if (ss
->ss_ops
!= NULL
)
907 ss
->ss_ops
->scan_age(ss
);
911 * Mark a scan cache entry after a successful associate.
914 ieee80211_scan_assoc_success(struct ieee80211com
*ic
, const u_int8_t mac
[])
916 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
918 if (ss
->ss_ops
!= NULL
) {
919 IEEE80211_NOTE_MAC(ss
->ss_vap
, IEEE80211_MSG_SCAN
,
920 mac
, "%s", __func__
);
921 ss
->ss_ops
->scan_assoc_success(ss
, mac
);
926 * Demerit a scan cache entry after failing to associate.
929 ieee80211_scan_assoc_fail(struct ieee80211com
*ic
,
930 const u_int8_t mac
[], int reason
)
932 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
934 if (ss
->ss_ops
!= NULL
) {
935 IEEE80211_NOTE_MAC(ss
->ss_vap
, IEEE80211_MSG_SCAN
, mac
,
936 "%s: reason %u", __func__
, reason
);
937 ss
->ss_ops
->scan_assoc_fail(ss
, mac
, reason
);
942 * Iterate over the contents of the scan cache.
945 ieee80211_scan_iterate(struct ieee80211com
*ic
,
946 ieee80211_scan_iter_func
*f
, void *arg
)
949 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
951 if (ss
->ss_ops
!= NULL
) {
952 res
= ss
->ss_ops
->scan_iterate(ss
, f
, arg
);
958 * Flush the contents of the scan cache.
961 ieee80211_scan_flush(struct ieee80211com
*ic
)
963 struct ieee80211_scan_state
*ss
= ic
->ic_scan
;
965 if (ss
->ss_ops
!= NULL
) {
966 IEEE80211_DPRINTF(ss
->ss_vap
, IEEE80211_MSG_SCAN
,
968 ss
->ss_ops
->scan_flush(ss
);
973 * Execute radar channel change. This is called when a radar/dfs
974 * signal is detected. AP mode only. Return 1 on success, 0 on
978 ieee80211_scan_dfs_action(struct ieee80211vap
*vap
,
979 const struct ieee80211_scan_entry
*se
)
981 struct ieee80211com
*ic
= vap
->iv_ic
;
982 struct ieee80211_channel
*new_channel
= NULL
;
984 if (!IEEE80211_IS_MODE_DFS_MASTER(vap
->iv_opmode
))
987 new_channel
= se
->se_chan
;
988 if (new_channel
!= NULL
) {
989 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
990 "%s: new channel found in scan cache\n",
994 /* No channel was found via scan module, means no good scanlist
996 int chanStart
, i
, count
;
997 u_int32_t curChanFlags
;
999 if ((ic
->ic_curchan
!= NULL
) &&
1000 (ic
->ic_curchan
!= IEEE80211_CHAN_ANYC
)) {
1001 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1002 "%s: ic_curchan is %3d (%4d MHz)\n",
1003 __func__
, ic
->ic_curchan
->ic_ieee
,
1004 ic
->ic_curchan
->ic_freq
);
1007 if ((ic
->ic_bsschan
!= NULL
) &&
1008 (ic
->ic_bsschan
!= IEEE80211_CHAN_ANYC
)) {
1009 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1010 "%s: ic_bsschan is %3d (%4d MHz)\n",
1011 __func__
, ic
->ic_bsschan
->ic_ieee
,
1012 ic
->ic_bsschan
->ic_freq
);
1015 /* According to FCC/ETSI rules on uniform spreading, we shall
1016 * select a channel out of the list of usable channels so that
1017 * the probability of selecting a given channel shall be the
1018 * same for all channels (reference: ETSI 301 893 v1.3.1
1020 /* First, we count the usable channels */
1022 curChanFlags
= (ic
->ic_bsschan
->ic_flags
) &
1023 ~(IEEE80211_CHAN_RADAR
);
1024 for (i
= 0; i
< ic
->ic_nchans
; i
++) {
1025 if ((ic
->ic_channels
[i
].ic_ieee
!=
1026 ic
->ic_bsschan
->ic_ieee
) &&
1027 (ic
->ic_channels
[i
].ic_flags
== curChanFlags
)) {
1028 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1029 "%s: usable channel %3d "
1032 ic
->ic_channels
[i
].ic_ieee
,
1033 ic
->ic_channels
[i
].ic_freq
);
1039 /* Next, we pickup a random usable channel */
1040 chanStart
= jiffies
% count
;
1043 for (i
= 0; i
< ic
->ic_nchans
; i
++) {
1044 if ((ic
->ic_channels
[i
].ic_ieee
!=
1045 ic
->ic_bsschan
->ic_ieee
) &&
1046 (ic
->ic_channels
[i
].ic_flags
==
1048 if (count
++ == chanStart
) {
1050 &ic
->ic_channels
[i
];
1057 if (new_channel
!= NULL
)
1058 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1059 "%s: new random channel found %3d "
1060 "(%4d MHz)\n", __func__
,
1061 new_channel
->ic_ieee
,
1062 new_channel
->ic_freq
);
1066 /* Search for the first channel with no radar detected */
1068 for (n
= 0; n
< ic
->ic_nchans
; n
++) {
1069 if (0 == (ic
->ic_channels
[n
].ic_flags
&
1070 IEEE80211_CHAN_RADAR
)) {
1071 new_channel
= &ic
->ic_channels
[n
];
1075 if (new_channel
!= NULL
)
1076 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1077 "%s: new non-radar channel found\n",
1080 if (new_channel
!= NULL
) {
1081 /* A suitable scan entry was found, so change channels */
1082 if (vap
->iv_state
== IEEE80211_S_RUN
) {
1083 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1084 "%s: CSA switching to channel %3d (%4d MHz)\n",
1086 new_channel
->ic_ieee
,
1087 new_channel
->ic_freq
);
1089 ic
->ic_chanchange_chan
= new_channel
->ic_ieee
;
1090 ic
->ic_chanchange_tbtt
=
1091 IEEE80211_RADAR_CHANCHANGE_TBTT_COUNT
;
1092 ic
->ic_flags
|= IEEE80211_F_CHANSWITCH
;
1095 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1096 "%s: directly switching to channel "
1097 "%3d (%4d MHz)\n", __func__
,
1098 new_channel
->ic_ieee
,
1099 new_channel
->ic_freq
);
1101 /* VAP is not in run state yet. so
1102 * change the channel here. */
1103 change_channel(ic
, new_channel
);
1104 ic
->ic_bsschan
= new_channel
;
1106 vap
->iv_bss
->ni_chan
= new_channel
;
1109 /* A suitable scan entry was not found */
1110 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_DOTH
,
1111 "%s: new channel not found\n", __func__
);
1117 EXPORT_SYMBOL(ieee80211_scan_dfs_action
);