ieee80211_scan_sta.c revision 184302
1170530Ssam/*-
2178354Ssam * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
3170530Ssam * All rights reserved.
4170530Ssam *
5170530Ssam * Redistribution and use in source and binary forms, with or without
6170530Ssam * modification, are permitted provided that the following conditions
7170530Ssam * are met:
8170530Ssam * 1. Redistributions of source code must retain the above copyright
9170530Ssam *    notice, this list of conditions and the following disclaimer.
10170530Ssam * 2. Redistributions in binary form must reproduce the above copyright
11170530Ssam *    notice, this list of conditions and the following disclaimer in the
12170530Ssam *    documentation and/or other materials provided with the distribution.
13170530Ssam *
14170530Ssam * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15170530Ssam * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16170530Ssam * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17170530Ssam * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18170530Ssam * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19170530Ssam * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20170530Ssam * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21170530Ssam * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22170530Ssam * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23170530Ssam * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24170530Ssam */
25170530Ssam
26170530Ssam#include <sys/cdefs.h>
27170530Ssam__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_scan_sta.c 184302 2008-10-26 21:56:27Z sam $");
28170530Ssam
29170530Ssam/*
30170530Ssam * IEEE 802.11 station scanning support.
31170530Ssam */
32178354Ssam#include "opt_wlan.h"
33178354Ssam
34170530Ssam#include <sys/param.h>
35170530Ssam#include <sys/systm.h>
36170530Ssam#include <sys/kernel.h>
37170530Ssam#include <sys/module.h>
38170530Ssam
39170530Ssam#include <sys/socket.h>
40170530Ssam
41170530Ssam#include <net/if.h>
42170530Ssam#include <net/if_media.h>
43170530Ssam#include <net/ethernet.h>
44170530Ssam
45170530Ssam#include <net80211/ieee80211_var.h>
46178354Ssam#include <net80211/ieee80211_input.h>
47178354Ssam#include <net80211/ieee80211_regdomain.h>
48170530Ssam
49170530Ssam#include <net/bpf.h>
50170530Ssam
51170530Ssam/*
52170530Ssam * Parameters for managing cache entries:
53170530Ssam *
54170530Ssam * o a station with STA_FAILS_MAX failures is not considered
55170530Ssam *   when picking a candidate
56170530Ssam * o a station that hasn't had an update in STA_PURGE_SCANS
57170530Ssam *   (background) scans is discarded
58170530Ssam * o after STA_FAILS_AGE seconds we clear the failure count
59170530Ssam */
60170530Ssam#define	STA_FAILS_MAX	2		/* assoc failures before ignored */
61170530Ssam#define	STA_FAILS_AGE	(2*60)		/* time before clearing fails (secs) */
62170530Ssam#define	STA_PURGE_SCANS	2		/* age for purging entries (scans) */
63170530Ssam
64170530Ssam/* XXX tunable */
65170530Ssam#define	STA_RSSI_MIN	8		/* min acceptable rssi */
66170530Ssam#define	STA_RSSI_MAX	40		/* max rssi for comparison */
67170530Ssam
68170530Ssamstruct sta_entry {
69170530Ssam	struct ieee80211_scan_entry base;
70170530Ssam	TAILQ_ENTRY(sta_entry) se_list;
71170530Ssam	LIST_ENTRY(sta_entry) se_hash;
72170530Ssam	uint8_t		se_fails;		/* failure to associate count */
73170530Ssam	uint8_t		se_seen;		/* seen during current scan */
74170530Ssam	uint8_t		se_notseen;		/* not seen in previous scans */
75170530Ssam	uint8_t		se_flags;
76184302Ssam#define	STA_DEMOTE11B	0x01			/* match w/ demoted 11b chan */
77170530Ssam	uint32_t	se_avgrssi;		/* LPF rssi state */
78170530Ssam	unsigned long	se_lastupdate;		/* time of last update */
79170530Ssam	unsigned long	se_lastfail;		/* time of last failure */
80170530Ssam	unsigned long	se_lastassoc;		/* time of last association */
81170530Ssam	u_int		se_scangen;		/* iterator scan gen# */
82178354Ssam	u_int		se_countrygen;		/* gen# of last cc notify */
83170530Ssam};
84170530Ssam
85170530Ssam#define	STA_HASHSIZE	32
86170530Ssam/* simple hash is enough for variation of macaddr */
87170530Ssam#define	STA_HASH(addr)	\
88170530Ssam	(((const uint8_t *)(addr))[IEEE80211_ADDR_LEN - 1] % STA_HASHSIZE)
89170530Ssam
90170530Ssamstruct sta_table {
91170530Ssam	struct mtx	st_lock;		/* on scan table */
92170530Ssam	TAILQ_HEAD(, sta_entry) st_entry;	/* all entries */
93170530Ssam	LIST_HEAD(, sta_entry) st_hash[STA_HASHSIZE];
94178354Ssam	struct mtx	st_scanlock;		/* on st_scaniter */
95178354Ssam	u_int		st_scaniter;		/* gen# for iterator */
96178354Ssam	u_int		st_scangen;		/* scan generation # */
97170530Ssam	int		st_newscan;
98178354Ssam	/* ap-related state */
99178354Ssam	int		st_maxrssi[IEEE80211_CHAN_MAX];
100170530Ssam};
101170530Ssam
102170530Ssamstatic void sta_flush_table(struct sta_table *);
103171409Ssam/*
104171409Ssam * match_bss returns a bitmask describing if an entry is suitable
105171409Ssam * for use.  If non-zero the entry was deemed not suitable and it's
106171409Ssam * contents explains why.  The following flags are or'd to to this
107171409Ssam * mask and can be used to figure out why the entry was rejected.
108171409Ssam */
109184302Ssam#define	MATCH_CHANNEL		0x0001	/* channel mismatch */
110184302Ssam#define	MATCH_CAPINFO		0x0002	/* capabilities mismatch, e.g. no ess */
111184302Ssam#define	MATCH_PRIVACY		0x0004	/* privacy mismatch */
112184302Ssam#define	MATCH_RATE		0x0008	/* rate set mismatch */
113184302Ssam#define	MATCH_SSID		0x0010	/* ssid mismatch */
114184302Ssam#define	MATCH_BSSID		0x0020	/* bssid mismatch */
115184302Ssam#define	MATCH_FAILS		0x0040	/* too many failed auth attempts */
116184302Ssam#define	MATCH_NOTSEEN		0x0080	/* not seen in recent scans */
117184302Ssam#define	MATCH_RSSI		0x0100	/* rssi deemed too low to use */
118184302Ssam#define	MATCH_CC		0x0200	/* country code mismatch */
119178354Ssamstatic int match_bss(struct ieee80211vap *,
120170530Ssam	const struct ieee80211_scan_state *, struct sta_entry *, int);
121178354Ssamstatic void adhoc_age(struct ieee80211_scan_state *);
122170530Ssam
123178354Ssamstatic __inline int
124178354Ssamisocmp(const uint8_t cc1[], const uint8_t cc2[])
125178354Ssam{
126178354Ssam     return (cc1[0] == cc2[0] && cc1[1] == cc2[1]);
127178354Ssam}
128178354Ssam
129170530Ssam/* number of references from net80211 layer */
130170530Ssamstatic	int nrefs = 0;
131170530Ssam
132170530Ssam/*
133170530Ssam * Attach prior to any scanning work.
134170530Ssam */
135170530Ssamstatic int
136170530Ssamsta_attach(struct ieee80211_scan_state *ss)
137170530Ssam{
138170530Ssam	struct sta_table *st;
139170530Ssam
140184210Sdes	MALLOC(st, struct sta_table *, sizeof(struct sta_table),
141170530Ssam		M_80211_SCAN, M_NOWAIT | M_ZERO);
142170530Ssam	if (st == NULL)
143170530Ssam		return 0;
144170530Ssam	mtx_init(&st->st_lock, "scantable", "802.11 scan table", MTX_DEF);
145170530Ssam	mtx_init(&st->st_scanlock, "scangen", "802.11 scangen", MTX_DEF);
146170530Ssam	TAILQ_INIT(&st->st_entry);
147170530Ssam	ss->ss_priv = st;
148170530Ssam	nrefs++;			/* NB: we assume caller locking */
149170530Ssam	return 1;
150170530Ssam}
151170530Ssam
152170530Ssam/*
153170530Ssam * Cleanup any private state.
154170530Ssam */
155170530Ssamstatic int
156170530Ssamsta_detach(struct ieee80211_scan_state *ss)
157170530Ssam{
158170530Ssam	struct sta_table *st = ss->ss_priv;
159170530Ssam
160170530Ssam	if (st != NULL) {
161170530Ssam		sta_flush_table(st);
162170530Ssam		mtx_destroy(&st->st_lock);
163170530Ssam		mtx_destroy(&st->st_scanlock);
164184210Sdes		FREE(st, M_80211_SCAN);
165170530Ssam		KASSERT(nrefs > 0, ("imbalanced attach/detach"));
166170530Ssam		nrefs--;		/* NB: we assume caller locking */
167170530Ssam	}
168170530Ssam	return 1;
169170530Ssam}
170170530Ssam
171170530Ssam/*
172170530Ssam * Flush all per-scan state.
173170530Ssam */
174170530Ssamstatic int
175170530Ssamsta_flush(struct ieee80211_scan_state *ss)
176170530Ssam{
177170530Ssam	struct sta_table *st = ss->ss_priv;
178170530Ssam
179170530Ssam	mtx_lock(&st->st_lock);
180170530Ssam	sta_flush_table(st);
181170530Ssam	mtx_unlock(&st->st_lock);
182170530Ssam	ss->ss_last = 0;
183170530Ssam	return 0;
184170530Ssam}
185170530Ssam
186170530Ssam/*
187170530Ssam * Flush all entries in the scan cache.
188170530Ssam */
189170530Ssamstatic void
190170530Ssamsta_flush_table(struct sta_table *st)
191170530Ssam{
192170530Ssam	struct sta_entry *se, *next;
193170530Ssam
194170530Ssam	TAILQ_FOREACH_SAFE(se, &st->st_entry, se_list, next) {
195170530Ssam		TAILQ_REMOVE(&st->st_entry, se, se_list);
196170530Ssam		LIST_REMOVE(se, se_hash);
197178354Ssam		ieee80211_ies_cleanup(&se->base.se_ies);
198184210Sdes		FREE(se, M_80211_SCAN);
199170530Ssam	}
200178354Ssam	memset(st->st_maxrssi, 0, sizeof(st->st_maxrssi));
201170530Ssam}
202170530Ssam
203170530Ssam/*
204170530Ssam * Process a beacon or probe response frame; create an
205170530Ssam * entry in the scan cache or update any previous entry.
206170530Ssam */
207170530Ssamstatic int
208170530Ssamsta_add(struct ieee80211_scan_state *ss,
209170530Ssam	const struct ieee80211_scanparams *sp,
210170530Ssam	const struct ieee80211_frame *wh,
211170530Ssam	int subtype, int rssi, int noise, int rstamp)
212170530Ssam{
213170530Ssam#define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
214170530Ssam#define	PICK1ST(_ss) \
215170530Ssam	((ss->ss_flags & (IEEE80211_SCAN_PICK1ST | IEEE80211_SCAN_GOTPICK)) == \
216170530Ssam	IEEE80211_SCAN_PICK1ST)
217170530Ssam	struct sta_table *st = ss->ss_priv;
218170530Ssam	const uint8_t *macaddr = wh->i_addr2;
219178354Ssam	struct ieee80211vap *vap = ss->ss_vap;
220178354Ssam	struct ieee80211com *ic = vap->iv_ic;
221170530Ssam	struct sta_entry *se;
222170530Ssam	struct ieee80211_scan_entry *ise;
223178354Ssam	int hash;
224170530Ssam
225170530Ssam	hash = STA_HASH(macaddr);
226170530Ssam
227170530Ssam	mtx_lock(&st->st_lock);
228170530Ssam	LIST_FOREACH(se, &st->st_hash[hash], se_hash)
229170530Ssam		if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr))
230170530Ssam			goto found;
231184210Sdes	MALLOC(se, struct sta_entry *, sizeof(struct sta_entry),
232170530Ssam		M_80211_SCAN, M_NOWAIT | M_ZERO);
233170530Ssam	if (se == NULL) {
234170530Ssam		mtx_unlock(&st->st_lock);
235170530Ssam		return 0;
236170530Ssam	}
237178354Ssam	se->se_scangen = st->st_scaniter-1;
238178354Ssam	se->se_avgrssi = IEEE80211_RSSI_DUMMY_MARKER;
239170530Ssam	IEEE80211_ADDR_COPY(se->base.se_macaddr, macaddr);
240170530Ssam	TAILQ_INSERT_TAIL(&st->st_entry, se, se_list);
241170530Ssam	LIST_INSERT_HEAD(&st->st_hash[hash], se, se_hash);
242170530Ssamfound:
243170530Ssam	ise = &se->base;
244170530Ssam	/* XXX ap beaconing multiple ssid w/ same bssid */
245170530Ssam	if (sp->ssid[1] != 0 &&
246170530Ssam	    (ISPROBE(subtype) || ise->se_ssid[1] == 0))
247170530Ssam		memcpy(ise->se_ssid, sp->ssid, 2+sp->ssid[1]);
248170530Ssam	KASSERT(sp->rates[1] <= IEEE80211_RATE_MAXSIZE,
249170530Ssam		("rate set too large: %u", sp->rates[1]));
250170530Ssam	memcpy(ise->se_rates, sp->rates, 2+sp->rates[1]);
251170530Ssam	if (sp->xrates != NULL) {
252170530Ssam		/* XXX validate xrates[1] */
253178354Ssam		KASSERT(sp->xrates[1] <= IEEE80211_RATE_MAXSIZE,
254170530Ssam			("xrate set too large: %u", sp->xrates[1]));
255170530Ssam		memcpy(ise->se_xrates, sp->xrates, 2+sp->xrates[1]);
256170530Ssam	} else
257170530Ssam		ise->se_xrates[1] = 0;
258170530Ssam	IEEE80211_ADDR_COPY(ise->se_bssid, wh->i_addr3);
259178354Ssam	if ((sp->status & IEEE80211_BPARSE_OFFCHAN) == 0) {
260173368Ssam		/*
261173368Ssam		 * Record rssi data using extended precision LPF filter.
262173368Ssam		 *
263173368Ssam		 * NB: use only on-channel data to insure we get a good
264173368Ssam		 *     estimate of the signal we'll see when associated.
265173368Ssam		 */
266178354Ssam		IEEE80211_RSSI_LPF(se->se_avgrssi, rssi);
267178354Ssam		ise->se_rssi = IEEE80211_RSSI_GET(se->se_avgrssi);
268173368Ssam		ise->se_noise = noise;
269173368Ssam	}
270170530Ssam	ise->se_rstamp = rstamp;
271170530Ssam	memcpy(ise->se_tstamp.data, sp->tstamp, sizeof(ise->se_tstamp));
272170530Ssam	ise->se_intval = sp->bintval;
273170530Ssam	ise->se_capinfo = sp->capinfo;
274173368Ssam	/*
275173368Ssam	 * Beware of overriding se_chan for frames seen
276173368Ssam	 * off-channel; this can cause us to attempt an
277178354Ssam	 * association on the wrong channel.
278173368Ssam	 */
279178354Ssam	if (sp->status & IEEE80211_BPARSE_OFFCHAN) {
280173862Ssam		struct ieee80211_channel *c;
281173368Ssam		/*
282173862Ssam		 * Off-channel, locate the home/bss channel for the sta
283178354Ssam		 * using the value broadcast in the DSPARMS ie.  We know
284178354Ssam		 * sp->chan has this value because it's used to calculate
285178354Ssam		 * IEEE80211_BPARSE_OFFCHAN.
286173368Ssam		 */
287178354Ssam		c = ieee80211_find_channel_byieee(ic, sp->chan,
288178354Ssam		    ic->ic_curchan->ic_flags);
289173956Ssam		if (c != NULL) {
290173956Ssam			ise->se_chan = c;
291173956Ssam		} else if (ise->se_chan == NULL) {
292173862Ssam			/* should not happen, pick something */
293178354Ssam			ise->se_chan = ic->ic_curchan;
294173862Ssam		}
295173862Ssam	} else
296178354Ssam		ise->se_chan = ic->ic_curchan;
297170530Ssam	ise->se_fhdwell = sp->fhdwell;
298170530Ssam	ise->se_fhindex = sp->fhindex;
299170530Ssam	ise->se_erp = sp->erp;
300170530Ssam	ise->se_timoff = sp->timoff;
301170530Ssam	if (sp->tim != NULL) {
302170530Ssam		const struct ieee80211_tim_ie *tim =
303170530Ssam		    (const struct ieee80211_tim_ie *) sp->tim;
304170530Ssam		ise->se_dtimperiod = tim->tim_period;
305170530Ssam	}
306178354Ssam	if (sp->country != NULL) {
307178354Ssam		const struct ieee80211_country_ie *cie =
308178354Ssam		    (const struct ieee80211_country_ie *) sp->country;
309178354Ssam		/*
310178354Ssam		 * If 11d is enabled and we're attempting to join a bss
311178354Ssam		 * that advertises it's country code then compare our
312178354Ssam		 * current settings to what we fetched from the country ie.
313178354Ssam		 * If our country code is unspecified or different then
314178354Ssam		 * dispatch an event to user space that identifies the
315178354Ssam		 * country code so our regdomain config can be changed.
316178354Ssam		 */
317178354Ssam		/* XXX only for STA mode? */
318178354Ssam		if ((IEEE80211_IS_CHAN_11D(ise->se_chan) ||
319178354Ssam		    (vap->iv_flags_ext & IEEE80211_FEXT_DOTD)) &&
320178354Ssam		    (ic->ic_regdomain.country == CTRY_DEFAULT ||
321178354Ssam		     !isocmp(cie->cc, ic->ic_regdomain.isocc))) {
322178354Ssam			/* only issue one notify event per scan */
323178354Ssam			if (se->se_countrygen != st->st_scangen) {
324178354Ssam				ieee80211_notify_country(vap, ise->se_bssid,
325178354Ssam				    cie->cc);
326178354Ssam				se->se_countrygen = st->st_scangen;
327178354Ssam			}
328178354Ssam		}
329178354Ssam		ise->se_cc[0] = cie->cc[0];
330178354Ssam		ise->se_cc[1] = cie->cc[1];
331178354Ssam	}
332178354Ssam	/* NB: no need to setup ie ptrs; they are not (currently) used */
333178354Ssam	(void) ieee80211_ies_init(&ise->se_ies, sp->ies, sp->ies_len);
334170530Ssam
335170530Ssam	/* clear failure count after STA_FAIL_AGE passes */
336170530Ssam	if (se->se_fails && (ticks - se->se_lastfail) > STA_FAILS_AGE*hz) {
337170530Ssam		se->se_fails = 0;
338178354Ssam		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_SCAN, macaddr,
339170530Ssam		    "%s: fails %u", __func__, se->se_fails);
340170530Ssam	}
341170530Ssam
342170530Ssam	se->se_lastupdate = ticks;		/* update time */
343170530Ssam	se->se_seen = 1;
344170530Ssam	se->se_notseen = 0;
345170530Ssam
346178354Ssam	if (rssi > st->st_maxrssi[sp->bchan])
347178354Ssam		st->st_maxrssi[sp->bchan] = rssi;
348178354Ssam
349170530Ssam	mtx_unlock(&st->st_lock);
350170530Ssam
351170530Ssam	/*
352170530Ssam	 * If looking for a quick choice and nothing's
353170530Ssam	 * been found check here.
354170530Ssam	 */
355178354Ssam	if (PICK1ST(ss) && match_bss(vap, ss, se, IEEE80211_MSG_SCAN) == 0)
356170530Ssam		ss->ss_flags |= IEEE80211_SCAN_GOTPICK;
357170530Ssam
358170530Ssam	return 1;
359170530Ssam#undef PICK1ST
360170530Ssam#undef ISPROBE
361170530Ssam}
362170530Ssam
363170530Ssam/*
364170530Ssam * Check if a channel is excluded by user request.
365170530Ssam */
366170530Ssamstatic int
367178354Ssamisexcluded(struct ieee80211vap *vap, const struct ieee80211_channel *c)
368170530Ssam{
369178354Ssam	return (isclr(vap->iv_ic->ic_chan_active, c->ic_ieee) ||
370178354Ssam	    (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
371178354Ssam	     c->ic_freq != vap->iv_des_chan->ic_freq));
372170530Ssam}
373170530Ssam
374170530Ssamstatic struct ieee80211_channel *
375170530Ssamfind11gchannel(struct ieee80211com *ic, int i, int freq)
376170530Ssam{
377170530Ssam	struct ieee80211_channel *c;
378170530Ssam	int j;
379170530Ssam
380170530Ssam	/*
381170530Ssam	 * The normal ordering in the channel list is b channel
382170530Ssam	 * immediately followed by g so optimize the search for
383170530Ssam	 * this.  We'll still do a full search just in case.
384170530Ssam	 */
385170530Ssam	for (j = i+1; j < ic->ic_nchans; j++) {
386170530Ssam		c = &ic->ic_channels[j];
387170530Ssam		if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
388170530Ssam			return c;
389170530Ssam	}
390170530Ssam	for (j = 0; j < i; j++) {
391170530Ssam		c = &ic->ic_channels[j];
392170530Ssam		if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
393170530Ssam			return c;
394170530Ssam	}
395170530Ssam	return NULL;
396170530Ssam}
397170530Ssamstatic const u_int chanflags[IEEE80211_MODE_MAX] = {
398170530Ssam	IEEE80211_CHAN_B,	/* IEEE80211_MODE_AUTO */
399170530Ssam	IEEE80211_CHAN_A,	/* IEEE80211_MODE_11A */
400170530Ssam	IEEE80211_CHAN_B,	/* IEEE80211_MODE_11B */
401170530Ssam	IEEE80211_CHAN_G,	/* IEEE80211_MODE_11G */
402170530Ssam	IEEE80211_CHAN_FHSS,	/* IEEE80211_MODE_FH */
403170530Ssam	IEEE80211_CHAN_A,	/* IEEE80211_MODE_TURBO_A (check base channel)*/
404170530Ssam	IEEE80211_CHAN_G,	/* IEEE80211_MODE_TURBO_G */
405170530Ssam	IEEE80211_CHAN_ST,	/* IEEE80211_MODE_STURBO_A */
406170530Ssam	IEEE80211_CHAN_A,	/* IEEE80211_MODE_11NA (check legacy) */
407170530Ssam	IEEE80211_CHAN_G,	/* IEEE80211_MODE_11NG (check legacy) */
408170530Ssam};
409170530Ssam
410170530Ssamstatic void
411178354Ssamadd_channels(struct ieee80211vap *vap,
412170530Ssam	struct ieee80211_scan_state *ss,
413170530Ssam	enum ieee80211_phymode mode, const uint16_t freq[], int nfreq)
414170530Ssam{
415170530Ssam#define	N(a)	(sizeof(a) / sizeof(a[0]))
416178354Ssam	struct ieee80211com *ic = vap->iv_ic;
417170530Ssam	struct ieee80211_channel *c, *cg;
418170530Ssam	u_int modeflags;
419170530Ssam	int i;
420170530Ssam
421170530Ssam	KASSERT(mode < N(chanflags), ("Unexpected mode %u", mode));
422170530Ssam	modeflags = chanflags[mode];
423170530Ssam	for (i = 0; i < nfreq; i++) {
424170530Ssam		if (ss->ss_last >= IEEE80211_SCAN_MAX)
425170530Ssam			break;
426170530Ssam
427170530Ssam		c = ieee80211_find_channel(ic, freq[i], modeflags);
428178354Ssam		if (c == NULL || isexcluded(vap, c))
429170530Ssam			continue;
430170530Ssam		if (mode == IEEE80211_MODE_AUTO) {
431170530Ssam			/*
432170530Ssam			 * XXX special-case 11b/g channels so we select
433178354Ssam			 *     the g channel if both are present.
434170530Ssam			 */
435178354Ssam			if (IEEE80211_IS_CHAN_B(c) &&
436178354Ssam			    (cg = find11gchannel(ic, i, c->ic_freq)) != NULL)
437178354Ssam				c = cg;
438170530Ssam		}
439170530Ssam		ss->ss_chans[ss->ss_last++] = c;
440170530Ssam	}
441170530Ssam#undef N
442170530Ssam}
443170530Ssam
444170530Ssamstruct scanlist {
445170530Ssam	uint16_t	mode;
446170530Ssam	uint16_t	count;
447170530Ssam	const uint16_t	*list;
448170530Ssam};
449170530Ssam
450170530Ssamstatic int
451170530Ssamchecktable(const struct scanlist *scan, const struct ieee80211_channel *c)
452170530Ssam{
453170530Ssam	int i;
454170530Ssam
455170530Ssam	for (; scan->list != NULL; scan++) {
456170530Ssam		for (i = 0; i < scan->count; i++)
457170530Ssam			if (scan->list[i] == c->ic_freq)
458170530Ssam				return 1;
459170530Ssam	}
460170530Ssam	return 0;
461170530Ssam}
462170530Ssam
463176653Ssamstatic void
464178354Ssamsweepchannels(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
465176653Ssam	const struct scanlist table[])
466176653Ssam{
467178354Ssam	struct ieee80211com *ic = vap->iv_ic;
468176653Ssam	struct ieee80211_channel *c;
469176653Ssam	int i;
470176653Ssam
471176653Ssam	for (i = 0; i < ic->ic_nchans; i++) {
472176653Ssam		if (ss->ss_last >= IEEE80211_SCAN_MAX)
473176653Ssam			break;
474176653Ssam
475176653Ssam		c = &ic->ic_channels[i];
476176653Ssam		/*
477176653Ssam		 * Ignore dynamic turbo channels; we scan them
478176653Ssam		 * in normal mode (i.e. not boosted).  Likewise
479176653Ssam		 * for HT channels, they get scanned using
480176653Ssam		 * legacy rates.
481176653Ssam		 */
482176653Ssam		if (IEEE80211_IS_CHAN_DTURBO(c) || IEEE80211_IS_CHAN_HT(c))
483176653Ssam			continue;
484176653Ssam
485176653Ssam		/*
486176653Ssam		 * If a desired mode was specified, scan only
487176653Ssam		 * channels that satisfy that constraint.
488176653Ssam		 */
489178354Ssam		if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
490178354Ssam		    vap->iv_des_mode != ieee80211_chan2mode(c))
491176653Ssam			continue;
492176653Ssam
493176653Ssam		/*
494176653Ssam		 * Skip channels excluded by user request.
495176653Ssam		 */
496178354Ssam		if (isexcluded(vap, c))
497176653Ssam			continue;
498176653Ssam
499176653Ssam		/*
500176653Ssam		 * Add the channel unless it is listed in the
501176653Ssam		 * fixed scan order tables.  This insures we
502176653Ssam		 * don't sweep back in channels we filtered out
503176653Ssam		 * above.
504176653Ssam		 */
505176653Ssam		if (checktable(table, c))
506176653Ssam			continue;
507176653Ssam
508176653Ssam		/* Add channel to scanning list. */
509176653Ssam		ss->ss_chans[ss->ss_last++] = c;
510176653Ssam	}
511176653Ssam}
512176653Ssam
513178354Ssamstatic void
514178354Ssammakescanlist(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
515178354Ssam	const struct scanlist table[])
516170530Ssam{
517170530Ssam	const struct scanlist *scan;
518170530Ssam	enum ieee80211_phymode mode;
519170530Ssam
520170530Ssam	ss->ss_last = 0;
521170530Ssam	/*
522170530Ssam	 * Use the table of ordered channels to construct the list
523170530Ssam	 * of channels for scanning.  Any channels in the ordered
524170530Ssam	 * list not in the master list will be discarded.
525170530Ssam	 */
526178354Ssam	for (scan = table; scan->list != NULL; scan++) {
527170530Ssam		mode = scan->mode;
528178354Ssam		if (vap->iv_des_mode != IEEE80211_MODE_AUTO) {
529170530Ssam			/*
530170530Ssam			 * If a desired mode was specified, scan only
531170530Ssam			 * channels that satisfy that constraint.
532170530Ssam			 */
533178354Ssam			if (vap->iv_des_mode != mode) {
534170530Ssam				/*
535170530Ssam				 * The scan table marks 2.4Ghz channels as b
536170530Ssam				 * so if the desired mode is 11g, then use
537170530Ssam				 * the 11b channel list but upgrade the mode.
538170530Ssam				 */
539178354Ssam				if (vap->iv_des_mode != IEEE80211_MODE_11G ||
540170530Ssam				    mode != IEEE80211_MODE_11B)
541170530Ssam					continue;
542170530Ssam				mode = IEEE80211_MODE_11G;	/* upgrade */
543170530Ssam			}
544170530Ssam		} else {
545170530Ssam			/*
546170530Ssam			 * This lets add_channels upgrade an 11b channel
547170530Ssam			 * to 11g if available.
548170530Ssam			 */
549170530Ssam			if (mode == IEEE80211_MODE_11B)
550170530Ssam				mode = IEEE80211_MODE_AUTO;
551170530Ssam		}
552170530Ssam#ifdef IEEE80211_F_XR
553170530Ssam		/* XR does not operate on turbo channels */
554178354Ssam		if ((vap->iv_flags & IEEE80211_F_XR) &&
555170530Ssam		    (mode == IEEE80211_MODE_TURBO_A ||
556170530Ssam		     mode == IEEE80211_MODE_TURBO_G ||
557170530Ssam		     mode == IEEE80211_MODE_STURBO_A))
558170530Ssam			continue;
559170530Ssam#endif
560170530Ssam		/*
561170530Ssam		 * Add the list of the channels; any that are not
562170530Ssam		 * in the master channel list will be discarded.
563170530Ssam		 */
564178354Ssam		add_channels(vap, ss, mode, scan->list, scan->count);
565170530Ssam	}
566170530Ssam
567170530Ssam	/*
568178354Ssam	 * Add the channels from the ic that are not present
569178354Ssam	 * in the table.
570170530Ssam	 */
571178354Ssam	sweepchannels(ss, vap, table);
572178354Ssam}
573170530Ssam
574178354Ssamstatic const uint16_t rcl1[] =		/* 8 FCC channel: 52, 56, 60, 64, 36, 40, 44, 48 */
575178354Ssam{ 5260, 5280, 5300, 5320, 5180, 5200, 5220, 5240 };
576178354Ssamstatic const uint16_t rcl2[] =		/* 4 MKK channels: 34, 38, 42, 46 */
577178354Ssam{ 5170, 5190, 5210, 5230 };
578178354Ssamstatic const uint16_t rcl3[] =		/* 2.4Ghz ch: 1,6,11,7,13 */
579178354Ssam{ 2412, 2437, 2462, 2442, 2472 };
580178354Ssamstatic const uint16_t rcl4[] =		/* 5 FCC channel: 149, 153, 161, 165 */
581178354Ssam{ 5745, 5765, 5785, 5805, 5825 };
582178354Ssamstatic const uint16_t rcl7[] =		/* 11 ETSI channel: 100,104,108,112,116,120,124,128,132,136,140 */
583178354Ssam{ 5500, 5520, 5540, 5560, 5580, 5600, 5620, 5640, 5660, 5680, 5700 };
584178354Ssamstatic const uint16_t rcl8[] =		/* 2.4Ghz ch: 2,3,4,5,8,9,10,12 */
585178354Ssam{ 2417, 2422, 2427, 2432, 2447, 2452, 2457, 2467 };
586178354Ssamstatic const uint16_t rcl9[] =		/* 2.4Ghz ch: 14 */
587178354Ssam{ 2484 };
588178354Ssamstatic const uint16_t rcl10[] =	/* Added Korean channels 2312-2372 */
589178354Ssam{ 2312, 2317, 2322, 2327, 2332, 2337, 2342, 2347, 2352, 2357, 2362, 2367, 2372 };
590178354Ssamstatic const uint16_t rcl11[] =	/* Added Japan channels in 4.9/5.0 spectrum */
591178354Ssam{ 5040, 5060, 5080, 4920, 4940, 4960, 4980 };
592178354Ssam#ifdef ATH_TURBO_SCAN
593178354Ssamstatic const uint16_t rcl5[] =		/* 3 static turbo channels */
594178354Ssam{ 5210, 5250, 5290 };
595178354Ssamstatic const uint16_t rcl6[] =		/* 2 static turbo channels */
596178354Ssam{ 5760, 5800 };
597178354Ssamstatic const uint16_t rcl6x[] =	/* 4 FCC3 turbo channels */
598178354Ssam{ 5540, 5580, 5620, 5660 };
599178354Ssamstatic const uint16_t rcl12[] =	/* 2.4Ghz Turbo channel 6 */
600178354Ssam{ 2437 };
601178354Ssamstatic const uint16_t rcl13[] =	/* dynamic Turbo channels */
602178354Ssam{ 5200, 5240, 5280, 5765, 5805 };
603178354Ssam#endif /* ATH_TURBO_SCAN */
604170530Ssam
605178354Ssam#define	X(a)	.count = sizeof(a)/sizeof(a[0]), .list = a
606170530Ssam
607178354Ssamstatic const struct scanlist staScanTable[] = {
608178354Ssam	{ IEEE80211_MODE_11B,   	X(rcl3) },
609178354Ssam	{ IEEE80211_MODE_11A,   	X(rcl1) },
610178354Ssam	{ IEEE80211_MODE_11A,   	X(rcl2) },
611178354Ssam	{ IEEE80211_MODE_11B,   	X(rcl8) },
612178354Ssam	{ IEEE80211_MODE_11B,   	X(rcl9) },
613178354Ssam	{ IEEE80211_MODE_11A,   	X(rcl4) },
614178354Ssam#ifdef ATH_TURBO_SCAN
615178354Ssam	{ IEEE80211_MODE_STURBO_A,	X(rcl5) },
616178354Ssam	{ IEEE80211_MODE_STURBO_A,	X(rcl6) },
617178354Ssam	{ IEEE80211_MODE_TURBO_A,	X(rcl6x) },
618178354Ssam	{ IEEE80211_MODE_TURBO_A,	X(rcl13) },
619178354Ssam#endif /* ATH_TURBO_SCAN */
620178354Ssam	{ IEEE80211_MODE_11A,		X(rcl7) },
621178354Ssam	{ IEEE80211_MODE_11B,		X(rcl10) },
622178354Ssam	{ IEEE80211_MODE_11A,		X(rcl11) },
623178354Ssam#ifdef ATH_TURBO_SCAN
624178354Ssam	{ IEEE80211_MODE_TURBO_G,	X(rcl12) },
625178354Ssam#endif /* ATH_TURBO_SCAN */
626178354Ssam	{ .list = NULL }
627178354Ssam};
628178354Ssam
629178354Ssam/*
630178354Ssam * Start a station-mode scan by populating the channel list.
631178354Ssam */
632178354Ssamstatic int
633178354Ssamsta_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
634178354Ssam{
635178354Ssam	struct sta_table *st = ss->ss_priv;
636178354Ssam
637178354Ssam	makescanlist(ss, vap, staScanTable);
638178354Ssam
639178354Ssam	if (ss->ss_mindwell == 0)
640178354Ssam		ss->ss_mindwell = msecs_to_ticks(20);	/* 20ms */
641178354Ssam	if (ss->ss_maxdwell == 0)
642178354Ssam		ss->ss_maxdwell = msecs_to_ticks(200);	/* 200ms */
643178354Ssam
644178354Ssam	st->st_scangen++;
645170530Ssam	st->st_newscan = 1;
646170530Ssam
647170530Ssam	return 0;
648170530Ssam}
649170530Ssam
650170530Ssam/*
651178354Ssam * Restart a scan, typically a bg scan but can
652178354Ssam * also be a fg scan that came up empty.
653170530Ssam */
654170530Ssamstatic int
655178354Ssamsta_restart(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
656170530Ssam{
657170530Ssam	struct sta_table *st = ss->ss_priv;
658170530Ssam
659170530Ssam	st->st_newscan = 1;
660170530Ssam	return 0;
661170530Ssam}
662170530Ssam
663170530Ssam/*
664170530Ssam * Cancel an ongoing scan.
665170530Ssam */
666170530Ssamstatic int
667178354Ssamsta_cancel(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
668170530Ssam{
669170530Ssam	return 0;
670170530Ssam}
671170530Ssam
672178354Ssam/* unalligned little endian access */
673178354Ssam#define LE_READ_2(p)					\
674178354Ssam	((uint16_t)					\
675178354Ssam	 ((((const uint8_t *)(p))[0]      ) |		\
676178354Ssam	  (((const uint8_t *)(p))[1] <<  8)))
677184302Ssam
678184302Ssam/*
679184302Ssam * Demote any supplied 11g channel to 11b.  There should
680184302Ssam * always be an 11b channel but we check anyway...
681184302Ssam */
682184302Ssamstatic struct ieee80211_channel *
683184302Ssamdemote11b(struct ieee80211vap *vap, struct ieee80211_channel *chan)
684184302Ssam{
685184302Ssam	struct ieee80211_channel *c;
686178354Ssam
687184302Ssam	if (IEEE80211_IS_CHAN_ANYG(chan) &&
688184302Ssam	    vap->iv_des_mode == IEEE80211_MODE_AUTO) {
689184302Ssam		c = ieee80211_find_channel(vap->iv_ic, chan->ic_freq,
690184302Ssam		    (chan->ic_flags &~ (IEEE80211_CHAN_PUREG | IEEE80211_CHAN_G)) |
691184302Ssam		    IEEE80211_CHAN_B);
692184302Ssam		if (c != NULL)
693184302Ssam			chan = c;
694184302Ssam	}
695184302Ssam	return chan;
696184302Ssam}
697184302Ssam
698178354Ssamstatic int
699170530Ssammaxrate(const struct ieee80211_scan_entry *se)
700170530Ssam{
701178354Ssam	const struct ieee80211_ie_htcap *htcap =
702178354Ssam	    (const struct ieee80211_ie_htcap *) se->se_ies.htcap_ie;
703178354Ssam	int rmax, r, i;
704178354Ssam	uint16_t caps;
705170530Ssam
706170530Ssam	rmax = 0;
707178354Ssam	if (htcap != NULL) {
708178354Ssam		/*
709178354Ssam		 * HT station; inspect supported MCS and then adjust
710178354Ssam		 * rate by channel width.  Could also include short GI
711178354Ssam		 * in this if we want to be extra accurate.
712178354Ssam		 */
713178354Ssam		/* XXX assumes MCS15 is max */
714178354Ssam		for (i = 15; i >= 0 && isclr(htcap->hc_mcsset, i); i--)
715178354Ssam			;
716178354Ssam		if (i >= 0) {
717178354Ssam			caps = LE_READ_2(&htcap->hc_cap);
718178354Ssam			/* XXX short/long GI */
719178354Ssam			if (caps & IEEE80211_HTCAP_CHWIDTH40)
720178354Ssam				rmax = ieee80211_htrates[i].ht40_rate_400ns;
721178354Ssam			else
722178354Ssam				rmax = ieee80211_htrates[i].ht40_rate_800ns;
723178354Ssam		}
724178354Ssam	}
725170530Ssam	for (i = 0; i < se->se_rates[1]; i++) {
726170530Ssam		r = se->se_rates[2+i] & IEEE80211_RATE_VAL;
727170530Ssam		if (r > rmax)
728170530Ssam			rmax = r;
729170530Ssam	}
730170530Ssam	for (i = 0; i < se->se_xrates[1]; i++) {
731170530Ssam		r = se->se_xrates[2+i] & IEEE80211_RATE_VAL;
732170530Ssam		if (r > rmax)
733170530Ssam			rmax = r;
734170530Ssam	}
735170530Ssam	return rmax;
736170530Ssam}
737170530Ssam
738170530Ssam/*
739170530Ssam * Compare the capabilities of two entries and decide which is
740170530Ssam * more desirable (return >0 if a is considered better).  Note
741170530Ssam * that we assume compatibility/usability has already been checked
742170530Ssam * so we don't need to (e.g. validate whether privacy is supported).
743170530Ssam * Used to select the best scan candidate for association in a BSS.
744170530Ssam */
745170530Ssamstatic int
746170530Ssamsta_compare(const struct sta_entry *a, const struct sta_entry *b)
747170530Ssam{
748170530Ssam#define	PREFER(_a,_b,_what) do {			\
749170530Ssam	if (((_a) ^ (_b)) & (_what))			\
750170530Ssam		return ((_a) & (_what)) ? 1 : -1;	\
751170530Ssam} while (0)
752178354Ssam	int maxa, maxb;
753170530Ssam	int8_t rssia, rssib;
754170530Ssam	int weight;
755170530Ssam
756170530Ssam	/* privacy support */
757170530Ssam	PREFER(a->base.se_capinfo, b->base.se_capinfo,
758170530Ssam		IEEE80211_CAPINFO_PRIVACY);
759170530Ssam
760170530Ssam	/* compare count of previous failures */
761170530Ssam	weight = b->se_fails - a->se_fails;
762170530Ssam	if (abs(weight) > 1)
763170530Ssam		return weight;
764170530Ssam
765170530Ssam	/*
766170530Ssam	 * Compare rssi.  If the two are considered equivalent
767170530Ssam	 * then fallback to other criteria.  We threshold the
768170530Ssam	 * comparisons to avoid selecting an ap purely by rssi
769170530Ssam	 * when both values may be good but one ap is otherwise
770170530Ssam	 * more desirable (e.g. an 11b-only ap with stronger
771170530Ssam	 * signal than an 11g ap).
772170530Ssam	 */
773170530Ssam	rssia = MIN(a->base.se_rssi, STA_RSSI_MAX);
774170530Ssam	rssib = MIN(b->base.se_rssi, STA_RSSI_MAX);
775170530Ssam	if (abs(rssib - rssia) < 5) {
776170530Ssam		/* best/max rate preferred if signal level close enough XXX */
777170530Ssam		maxa = maxrate(&a->base);
778170530Ssam		maxb = maxrate(&b->base);
779170530Ssam		if (maxa != maxb)
780170530Ssam			return maxa - maxb;
781170530Ssam		/* XXX use freq for channel preference */
782170530Ssam		/* for now just prefer 5Ghz band to all other bands */
783178354Ssam		PREFER(IEEE80211_IS_CHAN_5GHZ(a->base.se_chan),
784178354Ssam		       IEEE80211_IS_CHAN_5GHZ(b->base.se_chan), 1);
785170530Ssam	}
786170530Ssam	/* all things being equal, use signal level */
787170530Ssam	return a->base.se_rssi - b->base.se_rssi;
788170530Ssam#undef PREFER
789170530Ssam}
790170530Ssam
791170530Ssam/*
792170530Ssam * Check rate set suitability and return the best supported rate.
793178354Ssam * XXX inspect MCS for HT
794170530Ssam */
795170530Ssamstatic int
796184302Ssamcheck_rate(struct ieee80211vap *vap, const struct ieee80211_channel *chan,
797184302Ssam    const struct ieee80211_scan_entry *se)
798170530Ssam{
799170530Ssam#define	RV(v)	((v) & IEEE80211_RATE_VAL)
800170530Ssam	const struct ieee80211_rateset *srs;
801178354Ssam	int i, j, nrs, r, okrate, badrate, fixedrate, ucastrate;
802170530Ssam	const uint8_t *rs;
803170530Ssam
804178354Ssam	okrate = badrate = 0;
805170530Ssam
806184302Ssam	srs = ieee80211_get_suprates(vap->iv_ic, chan);
807170530Ssam	nrs = se->se_rates[1];
808170530Ssam	rs = se->se_rates+2;
809178354Ssam	/* XXX MCS */
810184302Ssam	ucastrate = vap->iv_txparms[ieee80211_chan2mode(chan)].ucastrate;
811170530Ssam	fixedrate = IEEE80211_FIXED_RATE_NONE;
812170530Ssamagain:
813170530Ssam	for (i = 0; i < nrs; i++) {
814170530Ssam		r = RV(rs[i]);
815170530Ssam		badrate = r;
816170530Ssam		/*
817170530Ssam		 * Check any fixed rate is included.
818170530Ssam		 */
819178354Ssam		if (r == ucastrate)
820170530Ssam			fixedrate = r;
821170530Ssam		/*
822170530Ssam		 * Check against our supported rates.
823170530Ssam		 */
824170530Ssam		for (j = 0; j < srs->rs_nrates; j++)
825170530Ssam			if (r == RV(srs->rs_rates[j])) {
826170530Ssam				if (r > okrate)		/* NB: track max */
827170530Ssam					okrate = r;
828170530Ssam				break;
829170530Ssam			}
830170530Ssam
831170530Ssam		if (j == srs->rs_nrates && (rs[i] & IEEE80211_RATE_BASIC)) {
832170530Ssam			/*
833170530Ssam			 * Don't try joining a BSS, if we don't support
834170530Ssam			 * one of its basic rates.
835170530Ssam			 */
836170530Ssam			okrate = 0;
837170530Ssam			goto back;
838170530Ssam		}
839170530Ssam	}
840170530Ssam	if (rs == se->se_rates+2) {
841170530Ssam		/* scan xrates too; sort of an algol68-style for loop */
842170530Ssam		nrs = se->se_xrates[1];
843170530Ssam		rs = se->se_xrates+2;
844170530Ssam		goto again;
845170530Ssam	}
846170530Ssam
847170530Ssamback:
848178354Ssam	if (okrate == 0 || ucastrate != fixedrate)
849170530Ssam		return badrate | IEEE80211_RATE_BASIC;
850170530Ssam	else
851170530Ssam		return RV(okrate);
852170530Ssam#undef RV
853170530Ssam}
854170530Ssam
855170530Ssamstatic int
856170530Ssammatch_ssid(const uint8_t *ie,
857170530Ssam	int nssid, const struct ieee80211_scan_ssid ssids[])
858170530Ssam{
859170530Ssam	int i;
860170530Ssam
861170530Ssam	for (i = 0; i < nssid; i++) {
862170530Ssam		if (ie[1] == ssids[i].len &&
863170530Ssam		     memcmp(ie+2, ssids[i].ssid, ie[1]) == 0)
864170530Ssam			return 1;
865170530Ssam	}
866170530Ssam	return 0;
867170530Ssam}
868170530Ssam
869170530Ssam/*
870170530Ssam * Test a scan candidate for suitability/compatibility.
871170530Ssam */
872170530Ssamstatic int
873178354Ssammatch_bss(struct ieee80211vap *vap,
874170530Ssam	const struct ieee80211_scan_state *ss, struct sta_entry *se0,
875170530Ssam	int debug)
876170530Ssam{
877178354Ssam	struct ieee80211com *ic = vap->iv_ic;
878170530Ssam	struct ieee80211_scan_entry *se = &se0->base;
879178354Ssam        uint8_t rate;
880178354Ssam        int fail;
881170530Ssam
882170530Ssam	fail = 0;
883170530Ssam	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, se->se_chan)))
884171409Ssam		fail |= MATCH_CHANNEL;
885170530Ssam	/*
886170530Ssam	 * NB: normally the desired mode is used to construct
887170530Ssam	 * the channel list, but it's possible for the scan
888170530Ssam	 * cache to include entries for stations outside this
889170530Ssam	 * list so we check the desired mode here to weed them
890170530Ssam	 * out.
891170530Ssam	 */
892178354Ssam	if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
893170530Ssam	    (se->se_chan->ic_flags & IEEE80211_CHAN_ALLTURBO) !=
894178354Ssam	    chanflags[vap->iv_des_mode])
895171409Ssam		fail |= MATCH_CHANNEL;
896178354Ssam	if (vap->iv_opmode == IEEE80211_M_IBSS) {
897170530Ssam		if ((se->se_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
898171409Ssam			fail |= MATCH_CAPINFO;
899170530Ssam	} else {
900170530Ssam		if ((se->se_capinfo & IEEE80211_CAPINFO_ESS) == 0)
901171409Ssam			fail |= MATCH_CAPINFO;
902178354Ssam		/*
903178354Ssam		 * If 11d is enabled and we're attempting to join a bss
904178354Ssam		 * that advertises it's country code then compare our
905178354Ssam		 * current settings to what we fetched from the country ie.
906178354Ssam		 * If our country code is unspecified or different then do
907178354Ssam		 * not attempt to join the bss.  We should have already
908178354Ssam		 * dispatched an event to user space that identifies the
909178354Ssam		 * new country code so our regdomain config should match.
910178354Ssam		 */
911178354Ssam		if ((IEEE80211_IS_CHAN_11D(se->se_chan) ||
912178354Ssam		    (vap->iv_flags_ext & IEEE80211_FEXT_DOTD)) &&
913178354Ssam		    se->se_cc[0] != 0 &&
914178354Ssam		    (ic->ic_regdomain.country == CTRY_DEFAULT ||
915178354Ssam		     !isocmp(se->se_cc, ic->ic_regdomain.isocc)))
916178354Ssam			fail |= MATCH_CC;
917170530Ssam	}
918178354Ssam	if (vap->iv_flags & IEEE80211_F_PRIVACY) {
919170530Ssam		if ((se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
920171409Ssam			fail |= MATCH_PRIVACY;
921170530Ssam	} else {
922170530Ssam		/* XXX does this mean privacy is supported or required? */
923170530Ssam		if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY)
924171409Ssam			fail |= MATCH_PRIVACY;
925170530Ssam	}
926184302Ssam	se0->se_flags &= ~STA_DEMOTE11B;
927184302Ssam	rate = check_rate(vap, se->se_chan, se);
928184302Ssam	if (rate & IEEE80211_RATE_BASIC) {
929171409Ssam		fail |= MATCH_RATE;
930184302Ssam		/*
931184302Ssam		 * An 11b-only ap will give a rate mismatch if there is an
932184302Ssam		 * OFDM fixed tx rate for 11g.  Try downgrading the channel
933184302Ssam		 * in the scan list to 11b and retry the rate check.
934184302Ssam		 */
935184302Ssam		if (IEEE80211_IS_CHAN_ANYG(se->se_chan)) {
936184302Ssam			rate = check_rate(vap, demote11b(vap, se->se_chan), se);
937184302Ssam			if ((rate & IEEE80211_RATE_BASIC) == 0) {
938184302Ssam				fail &= ~MATCH_RATE;
939184302Ssam				se0->se_flags |= STA_DEMOTE11B;
940184302Ssam			}
941184302Ssam		}
942184302Ssam	} else if (rate < 2*24) {
943184302Ssam		/*
944184302Ssam		 * This is an 11b-only ap.  Check the desired mode in
945184302Ssam		 * case that needs to be honored (mode 11g filters out
946184302Ssam		 * 11b-only ap's).  Otherwise force any 11g channel used
947184302Ssam		 * in scanning to be demoted.
948184302Ssam		 *
949184302Ssam		 * NB: we cheat a bit here by looking at the max rate;
950184302Ssam		 *     we could/should check the rates.
951184302Ssam		 */
952184302Ssam		if (!(vap->iv_des_mode == IEEE80211_MODE_AUTO ||
953184302Ssam		      vap->iv_des_mode == IEEE80211_MODE_11B))
954184302Ssam			fail |= MATCH_RATE;
955184302Ssam		else
956184302Ssam			se0->se_flags |= STA_DEMOTE11B;
957184302Ssam	}
958170530Ssam	if (ss->ss_nssid != 0 &&
959171409Ssam	    !match_ssid(se->se_ssid, ss->ss_nssid, ss->ss_ssid))
960171409Ssam		fail |= MATCH_SSID;
961178354Ssam	if ((vap->iv_flags & IEEE80211_F_DESBSSID) &&
962178354Ssam	    !IEEE80211_ADDR_EQ(vap->iv_des_bssid, se->se_bssid))
963178354Ssam		fail |= MATCH_BSSID;
964170530Ssam	if (se0->se_fails >= STA_FAILS_MAX)
965171409Ssam		fail |= MATCH_FAILS;
966170530Ssam	if (se0->se_notseen >= STA_PURGE_SCANS)
967171409Ssam		fail |= MATCH_NOTSEEN;
968170530Ssam	if (se->se_rssi < STA_RSSI_MIN)
969171409Ssam		fail |= MATCH_RSSI;
970170530Ssam#ifdef IEEE80211_DEBUG
971178354Ssam	if (ieee80211_msg(vap, debug)) {
972170530Ssam		printf(" %c %s",
973171409Ssam		    fail & MATCH_FAILS ? '=' :
974171409Ssam		    fail & MATCH_NOTSEEN ? '^' :
975178354Ssam		    fail & MATCH_CC ? '$' :
976171409Ssam		    fail ? '-' : '+', ether_sprintf(se->se_macaddr));
977170530Ssam		printf(" %s%c", ether_sprintf(se->se_bssid),
978171409Ssam		    fail & MATCH_BSSID ? '!' : ' ');
979170530Ssam		printf(" %3d%c", ieee80211_chan2ieee(ic, se->se_chan),
980171409Ssam			fail & MATCH_CHANNEL ? '!' : ' ');
981171409Ssam		printf(" %+4d%c", se->se_rssi, fail & MATCH_RSSI ? '!' : ' ');
982170530Ssam		printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
983171409Ssam		    fail & MATCH_RATE ? '!' : ' ');
984170530Ssam		printf(" %4s%c",
985170530Ssam		    (se->se_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
986170530Ssam		    (se->se_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
987170530Ssam		    "????",
988171409Ssam		    fail & MATCH_CAPINFO ? '!' : ' ');
989170530Ssam		printf(" %3s%c ",
990170530Ssam		    (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) ?
991170530Ssam		    "wep" : "no",
992171409Ssam		    fail & MATCH_PRIVACY ? '!' : ' ');
993170530Ssam		ieee80211_print_essid(se->se_ssid+2, se->se_ssid[1]);
994171409Ssam		printf("%s\n", fail & MATCH_SSID ? "!" : "");
995170530Ssam	}
996170530Ssam#endif
997170530Ssam	return fail;
998170530Ssam}
999170530Ssam
1000170530Ssamstatic void
1001170530Ssamsta_update_notseen(struct sta_table *st)
1002170530Ssam{
1003170530Ssam	struct sta_entry *se;
1004170530Ssam
1005170530Ssam	mtx_lock(&st->st_lock);
1006170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list) {
1007170530Ssam		/*
1008170530Ssam		 * If seen the reset and don't bump the count;
1009170530Ssam		 * otherwise bump the ``not seen'' count.  Note
1010170530Ssam		 * that this insures that stations for which we
1011170530Ssam		 * see frames while not scanning but not during
1012170530Ssam		 * this scan will not be penalized.
1013170530Ssam		 */
1014170530Ssam		if (se->se_seen)
1015170530Ssam			se->se_seen = 0;
1016170530Ssam		else
1017170530Ssam			se->se_notseen++;
1018170530Ssam	}
1019170530Ssam	mtx_unlock(&st->st_lock);
1020170530Ssam}
1021170530Ssam
1022170530Ssamstatic void
1023170530Ssamsta_dec_fails(struct sta_table *st)
1024170530Ssam{
1025170530Ssam	struct sta_entry *se;
1026170530Ssam
1027170530Ssam	mtx_lock(&st->st_lock);
1028170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list)
1029170530Ssam		if (se->se_fails)
1030170530Ssam			se->se_fails--;
1031170530Ssam	mtx_unlock(&st->st_lock);
1032170530Ssam}
1033170530Ssam
1034170530Ssamstatic struct sta_entry *
1035178354Ssamselect_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap, int debug)
1036170530Ssam{
1037170530Ssam	struct sta_table *st = ss->ss_priv;
1038170530Ssam	struct sta_entry *se, *selbs = NULL;
1039170530Ssam
1040178354Ssam	IEEE80211_DPRINTF(vap, debug, " %s\n",
1041170530Ssam	    "macaddr          bssid         chan  rssi  rate flag  wep  essid");
1042170530Ssam	mtx_lock(&st->st_lock);
1043170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list) {
1044184275Ssam		ieee80211_ies_expand(&se->base.se_ies);
1045178354Ssam		if (match_bss(vap, ss, se, debug) == 0) {
1046170530Ssam			if (selbs == NULL)
1047170530Ssam				selbs = se;
1048170530Ssam			else if (sta_compare(se, selbs) > 0)
1049170530Ssam				selbs = se;
1050170530Ssam		}
1051170530Ssam	}
1052170530Ssam	mtx_unlock(&st->st_lock);
1053170530Ssam
1054170530Ssam	return selbs;
1055170530Ssam}
1056170530Ssam
1057170530Ssam/*
1058170530Ssam * Pick an ap or ibss network to join or find a channel
1059170530Ssam * to use to start an ibss network.
1060170530Ssam */
1061170530Ssamstatic int
1062178354Ssamsta_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1063170530Ssam{
1064170530Ssam	struct sta_table *st = ss->ss_priv;
1065170530Ssam	struct sta_entry *selbs;
1066184274Ssam	struct ieee80211_channel *chan;
1067170530Ssam
1068178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_STA,
1069178354Ssam		("wrong mode %u", vap->iv_opmode));
1070170530Ssam
1071170530Ssam	if (st->st_newscan) {
1072170530Ssam		sta_update_notseen(st);
1073170530Ssam		st->st_newscan = 0;
1074170530Ssam	}
1075170530Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
1076170530Ssam		/*
1077170530Ssam		 * Manual/background scan, don't select+join the
1078170530Ssam		 * bss, just return.  The scanning framework will
1079170530Ssam		 * handle notification that this has completed.
1080170530Ssam		 */
1081170530Ssam		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
1082170530Ssam		return 1;
1083170530Ssam	}
1084170530Ssam	/*
1085170530Ssam	 * Automatic sequencing; look for a candidate and
1086170530Ssam	 * if found join the network.
1087170530Ssam	 */
1088170530Ssam	/* NB: unlocked read should be ok */
1089170530Ssam	if (TAILQ_FIRST(&st->st_entry) == NULL) {
1090178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
1091170530Ssam			"%s: no scan candidate\n", __func__);
1092178354Ssam		if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1093178354Ssam			return 0;
1094170530Ssamnotfound:
1095170530Ssam		/*
1096170530Ssam		 * If nothing suitable was found decrement
1097170530Ssam		 * the failure counts so entries will be
1098170530Ssam		 * reconsidered the next time around.  We
1099170530Ssam		 * really want to do this only for sta's
1100170530Ssam		 * where we've previously had some success.
1101170530Ssam		 */
1102170530Ssam		sta_dec_fails(st);
1103170530Ssam		st->st_newscan = 1;
1104170530Ssam		return 0;			/* restart scan */
1105170530Ssam	}
1106178354Ssam	selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
1107178354Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1108178354Ssam		return (selbs != NULL);
1109184274Ssam	if (selbs == NULL)
1110170530Ssam		goto notfound;
1111184274Ssam	chan = selbs->base.se_chan;
1112184302Ssam	if (selbs->se_flags & STA_DEMOTE11B)
1113184302Ssam		chan = demote11b(vap, chan);
1114184274Ssam	if (!ieee80211_sta_join(vap, chan, &selbs->base))
1115184274Ssam		goto notfound;
1116170530Ssam	return 1;				/* terminate scan */
1117170530Ssam}
1118170530Ssam
1119170530Ssam/*
1120170530Ssam * Lookup an entry in the scan cache.  We assume we're
1121170530Ssam * called from the bottom half or such that we don't need
1122170530Ssam * to block the bottom half so that it's safe to return
1123170530Ssam * a reference to an entry w/o holding the lock on the table.
1124170530Ssam */
1125170530Ssamstatic struct sta_entry *
1126170530Ssamsta_lookup(struct sta_table *st, const uint8_t macaddr[IEEE80211_ADDR_LEN])
1127170530Ssam{
1128170530Ssam	struct sta_entry *se;
1129170530Ssam	int hash = STA_HASH(macaddr);
1130170530Ssam
1131170530Ssam	mtx_lock(&st->st_lock);
1132170530Ssam	LIST_FOREACH(se, &st->st_hash[hash], se_hash)
1133170530Ssam		if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr))
1134170530Ssam			break;
1135170530Ssam	mtx_unlock(&st->st_lock);
1136170530Ssam
1137170530Ssam	return se;		/* NB: unlocked */
1138170530Ssam}
1139170530Ssam
1140170530Ssamstatic void
1141178354Ssamsta_roam_check(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1142170530Ssam{
1143178354Ssam	struct ieee80211com *ic = vap->iv_ic;
1144178354Ssam	struct ieee80211_node *ni = vap->iv_bss;
1145170530Ssam	struct sta_table *st = ss->ss_priv;
1146178354Ssam	enum ieee80211_phymode mode;
1147170530Ssam	struct sta_entry *se, *selbs;
1148178354Ssam	uint8_t roamRate, curRate, ucastRate;
1149170530Ssam	int8_t roamRssi, curRssi;
1150170530Ssam
1151170530Ssam	se = sta_lookup(st, ni->ni_macaddr);
1152170530Ssam	if (se == NULL) {
1153170530Ssam		/* XXX something is wrong */
1154170530Ssam		return;
1155170530Ssam	}
1156170530Ssam
1157178354Ssam	mode = ieee80211_chan2mode(ic->ic_bsschan);
1158178354Ssam	roamRate = vap->iv_roamparms[mode].rate;
1159178354Ssam	roamRssi = vap->iv_roamparms[mode].rssi;
1160178354Ssam	ucastRate = vap->iv_txparms[mode].ucastrate;
1161170530Ssam	/* NB: the most up to date rssi is in the node, not the scan cache */
1162170530Ssam	curRssi = ic->ic_node_getrssi(ni);
1163178354Ssam	if (ucastRate == IEEE80211_FIXED_RATE_NONE) {
1164178354Ssam		curRate = ni->ni_txrate;
1165178354Ssam		roamRate &= IEEE80211_RATE_VAL;
1166178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ROAM,
1167170530Ssam		    "%s: currssi %d currate %u roamrssi %d roamrate %u\n",
1168170530Ssam		    __func__, curRssi, curRate, roamRssi, roamRate);
1169170530Ssam	} else {
1170170530Ssam		curRate = roamRate;	/* NB: insure compare below fails */
1171178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ROAM,
1172170530Ssam		    "%s: currssi %d roamrssi %d\n", __func__, curRssi, roamRssi);
1173170530Ssam	}
1174170530Ssam	/*
1175170530Ssam	 * Check if a new ap should be used and switch.
1176170530Ssam	 * XXX deauth current ap
1177170530Ssam	 */
1178170530Ssam	if (curRate < roamRate || curRssi < roamRssi) {
1179178354Ssam		if (time_after(ticks, ic->ic_lastscan + vap->iv_scanvalid)) {
1180170530Ssam			/*
1181170530Ssam			 * Scan cache contents are too old; force a scan now
1182170530Ssam			 * if possible so we have current state to make a
1183170530Ssam			 * decision with.  We don't kick off a bg scan if
1184170530Ssam			 * we're using dynamic turbo and boosted or if the
1185170530Ssam			 * channel is busy.
1186170530Ssam			 * XXX force immediate switch on scan complete
1187170530Ssam			 */
1188170530Ssam			if (!IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1189178354Ssam			    time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle))
1190178354Ssam				ieee80211_bg_scan(vap, 0);
1191170530Ssam			return;
1192170530Ssam		}
1193170530Ssam		se->base.se_rssi = curRssi;
1194178354Ssam		selbs = select_bss(ss, vap, IEEE80211_MSG_ROAM);
1195170530Ssam		if (selbs != NULL && selbs != se) {
1196184274Ssam			struct ieee80211_channel *chan;
1197184274Ssam
1198178354Ssam			IEEE80211_DPRINTF(vap,
1199170530Ssam			    IEEE80211_MSG_ROAM | IEEE80211_MSG_DEBUG,
1200170530Ssam			    "%s: ROAM: curRate %u, roamRate %u, "
1201170530Ssam			    "curRssi %d, roamRssi %d\n", __func__,
1202170530Ssam			    curRate, roamRate, curRssi, roamRssi);
1203184274Ssam
1204184274Ssam			chan = selbs->base.se_chan;
1205184302Ssam			if (selbs->se_flags & STA_DEMOTE11B)
1206184302Ssam				chan = demote11b(vap, chan);
1207184274Ssam			(void) ieee80211_sta_join(vap, chan, &selbs->base);
1208170530Ssam		}
1209170530Ssam	}
1210170530Ssam}
1211170530Ssam
1212170530Ssam/*
1213170530Ssam * Age entries in the scan cache.
1214170530Ssam * XXX also do roaming since it's convenient
1215170530Ssam */
1216170530Ssamstatic void
1217170530Ssamsta_age(struct ieee80211_scan_state *ss)
1218170530Ssam{
1219178354Ssam	struct ieee80211vap *vap = ss->ss_vap;
1220170530Ssam
1221178354Ssam	adhoc_age(ss);
1222170530Ssam	/*
1223170530Ssam	 * If rate control is enabled check periodically to see if
1224170530Ssam	 * we should roam from our current connection to one that
1225170530Ssam	 * might be better.  This only applies when we're operating
1226170530Ssam	 * in sta mode and automatic roaming is set.
1227170530Ssam	 * XXX defer if busy
1228170530Ssam	 * XXX repeater station
1229170530Ssam	 * XXX do when !bgscan?
1230170530Ssam	 */
1231178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_STA,
1232178354Ssam		("wrong mode %u", vap->iv_opmode));
1233178354Ssam	if (vap->iv_roaming == IEEE80211_ROAMING_AUTO &&
1234178354Ssam	    (vap->iv_ic->ic_flags & IEEE80211_F_BGSCAN) &&
1235178354Ssam	    vap->iv_state >= IEEE80211_S_RUN)
1236170530Ssam		/* XXX vap is implicit */
1237178354Ssam		sta_roam_check(ss, vap);
1238170530Ssam}
1239170530Ssam
1240170530Ssam/*
1241170530Ssam * Iterate over the entries in the scan cache, invoking
1242170530Ssam * the callback function on each one.
1243170530Ssam */
1244170530Ssamstatic void
1245170530Ssamsta_iterate(struct ieee80211_scan_state *ss,
1246170530Ssam	ieee80211_scan_iter_func *f, void *arg)
1247170530Ssam{
1248170530Ssam	struct sta_table *st = ss->ss_priv;
1249170530Ssam	struct sta_entry *se;
1250170530Ssam	u_int gen;
1251170530Ssam
1252170530Ssam	mtx_lock(&st->st_scanlock);
1253178354Ssam	gen = st->st_scaniter++;
1254170530Ssamrestart:
1255170530Ssam	mtx_lock(&st->st_lock);
1256170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list) {
1257170530Ssam		if (se->se_scangen != gen) {
1258170530Ssam			se->se_scangen = gen;
1259170530Ssam			/* update public state */
1260170530Ssam			se->base.se_age = ticks - se->se_lastupdate;
1261170530Ssam			mtx_unlock(&st->st_lock);
1262170530Ssam			(*f)(arg, &se->base);
1263170530Ssam			goto restart;
1264170530Ssam		}
1265170530Ssam	}
1266170530Ssam	mtx_unlock(&st->st_lock);
1267170530Ssam
1268170530Ssam	mtx_unlock(&st->st_scanlock);
1269170530Ssam}
1270170530Ssam
1271170530Ssamstatic void
1272170530Ssamsta_assoc_fail(struct ieee80211_scan_state *ss,
1273170530Ssam	const uint8_t macaddr[IEEE80211_ADDR_LEN], int reason)
1274170530Ssam{
1275170530Ssam	struct sta_table *st = ss->ss_priv;
1276170530Ssam	struct sta_entry *se;
1277170530Ssam
1278170530Ssam	se = sta_lookup(st, macaddr);
1279170530Ssam	if (se != NULL) {
1280170530Ssam		se->se_fails++;
1281170530Ssam		se->se_lastfail = ticks;
1282178354Ssam		IEEE80211_NOTE_MAC(ss->ss_vap, IEEE80211_MSG_SCAN,
1283170530Ssam		    macaddr, "%s: reason %u fails %u",
1284170530Ssam		    __func__, reason, se->se_fails);
1285170530Ssam	}
1286170530Ssam}
1287170530Ssam
1288170530Ssamstatic void
1289170530Ssamsta_assoc_success(struct ieee80211_scan_state *ss,
1290170530Ssam	const uint8_t macaddr[IEEE80211_ADDR_LEN])
1291170530Ssam{
1292170530Ssam	struct sta_table *st = ss->ss_priv;
1293170530Ssam	struct sta_entry *se;
1294170530Ssam
1295170530Ssam	se = sta_lookup(st, macaddr);
1296170530Ssam	if (se != NULL) {
1297170530Ssam#if 0
1298170530Ssam		se->se_fails = 0;
1299178354Ssam		IEEE80211_NOTE_MAC(ss->ss_vap, IEEE80211_MSG_SCAN,
1300170530Ssam		    macaddr, "%s: fails %u",
1301170530Ssam		    __func__, se->se_fails);
1302170530Ssam#endif
1303170530Ssam		se->se_lastassoc = ticks;
1304170530Ssam	}
1305170530Ssam}
1306170530Ssam
1307170530Ssamstatic const struct ieee80211_scanner sta_default = {
1308170530Ssam	.scan_name		= "default",
1309170530Ssam	.scan_attach		= sta_attach,
1310170530Ssam	.scan_detach		= sta_detach,
1311170530Ssam	.scan_start		= sta_start,
1312170530Ssam	.scan_restart		= sta_restart,
1313170530Ssam	.scan_cancel		= sta_cancel,
1314170530Ssam	.scan_end		= sta_pick_bss,
1315170530Ssam	.scan_flush		= sta_flush,
1316170530Ssam	.scan_add		= sta_add,
1317170530Ssam	.scan_age		= sta_age,
1318170530Ssam	.scan_iterate		= sta_iterate,
1319170530Ssam	.scan_assoc_fail	= sta_assoc_fail,
1320170530Ssam	.scan_assoc_success	= sta_assoc_success,
1321170530Ssam};
1322170530Ssam
1323170530Ssam/*
1324170530Ssam * Adhoc mode-specific support.
1325170530Ssam */
1326170530Ssam
1327170530Ssamstatic const uint16_t adhocWorld[] =		/* 36, 40, 44, 48 */
1328170530Ssam{ 5180, 5200, 5220, 5240 };
1329170530Ssamstatic const uint16_t adhocFcc3[] =		/* 36, 40, 44, 48 145, 149, 153, 157, 161, 165 */
1330170530Ssam{ 5180, 5200, 5220, 5240, 5725, 5745, 5765, 5785, 5805, 5825 };
1331170530Ssamstatic const uint16_t adhocMkk[] =		/* 34, 38, 42, 46 */
1332170530Ssam{ 5170, 5190, 5210, 5230 };
1333170530Ssamstatic const uint16_t adhoc11b[] =		/* 10, 11 */
1334170530Ssam{ 2457, 2462 };
1335170530Ssam
1336170530Ssamstatic const struct scanlist adhocScanTable[] = {
1337170530Ssam	{ IEEE80211_MODE_11B,   	X(adhoc11b) },
1338170530Ssam	{ IEEE80211_MODE_11A,   	X(adhocWorld) },
1339170530Ssam	{ IEEE80211_MODE_11A,   	X(adhocFcc3) },
1340170530Ssam	{ IEEE80211_MODE_11B,   	X(adhocMkk) },
1341170530Ssam	{ .list = NULL }
1342170530Ssam};
1343170530Ssam#undef X
1344170530Ssam
1345170530Ssam/*
1346170530Ssam * Start an adhoc-mode scan by populating the channel list.
1347170530Ssam */
1348170530Ssamstatic int
1349178354Ssamadhoc_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1350170530Ssam{
1351170530Ssam	struct sta_table *st = ss->ss_priv;
1352170530Ssam
1353178354Ssam	makescanlist(ss, vap, adhocScanTable);
1354176653Ssam
1355178354Ssam	if (ss->ss_mindwell == 0)
1356178354Ssam		ss->ss_mindwell = msecs_to_ticks(200);	/* 200ms */
1357178354Ssam	if (ss->ss_maxdwell == 0)
1358178354Ssam		ss->ss_maxdwell = msecs_to_ticks(200);	/* 200ms */
1359176653Ssam
1360178354Ssam	st->st_scangen++;
1361170530Ssam	st->st_newscan = 1;
1362170530Ssam
1363170530Ssam	return 0;
1364170530Ssam}
1365170530Ssam
1366170530Ssam/*
1367170530Ssam * Select a channel to start an adhoc network on.
1368170530Ssam * The channel list was populated with appropriate
1369170530Ssam * channels so select one that looks least occupied.
1370170530Ssam */
1371170530Ssamstatic struct ieee80211_channel *
1372178354Ssamadhoc_pick_channel(struct ieee80211_scan_state *ss, int flags)
1373170530Ssam{
1374170530Ssam	struct sta_table *st = ss->ss_priv;
1375170530Ssam	struct sta_entry *se;
1376170530Ssam	struct ieee80211_channel *c, *bestchan;
1377170530Ssam	int i, bestrssi, maxrssi;
1378170530Ssam
1379170530Ssam	bestchan = NULL;
1380170530Ssam	bestrssi = -1;
1381170530Ssam
1382170530Ssam	mtx_lock(&st->st_lock);
1383170530Ssam	for (i = 0; i < ss->ss_last; i++) {
1384170530Ssam		c = ss->ss_chans[i];
1385178354Ssam		/* never consider a channel with radar */
1386178354Ssam		if (IEEE80211_IS_CHAN_RADAR(c))
1387176653Ssam			continue;
1388178354Ssam		/* skip channels disallowed by regulatory settings */
1389178354Ssam		if (IEEE80211_IS_CHAN_NOADHOC(c))
1390178354Ssam			continue;
1391178354Ssam		/* check channel attributes for band compatibility */
1392178354Ssam		if (flags != 0 && (c->ic_flags & flags) != flags)
1393178354Ssam			continue;
1394170530Ssam		maxrssi = 0;
1395170530Ssam		TAILQ_FOREACH(se, &st->st_entry, se_list) {
1396170530Ssam			if (se->base.se_chan != c)
1397170530Ssam				continue;
1398170530Ssam			if (se->base.se_rssi > maxrssi)
1399170530Ssam				maxrssi = se->base.se_rssi;
1400170530Ssam		}
1401170530Ssam		if (bestchan == NULL || maxrssi < bestrssi)
1402170530Ssam			bestchan = c;
1403170530Ssam	}
1404170530Ssam	mtx_unlock(&st->st_lock);
1405170530Ssam
1406170530Ssam	return bestchan;
1407170530Ssam}
1408170530Ssam
1409170530Ssam/*
1410170530Ssam * Pick an ibss network to join or find a channel
1411170530Ssam * to use to start an ibss network.
1412170530Ssam */
1413170530Ssamstatic int
1414178354Ssamadhoc_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1415170530Ssam{
1416170530Ssam	struct sta_table *st = ss->ss_priv;
1417170530Ssam	struct sta_entry *selbs;
1418170530Ssam	struct ieee80211_channel *chan;
1419170530Ssam
1420178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_IBSS ||
1421178354Ssam		vap->iv_opmode == IEEE80211_M_AHDEMO,
1422178354Ssam		("wrong opmode %u", vap->iv_opmode));
1423170530Ssam
1424170530Ssam	if (st->st_newscan) {
1425170530Ssam		sta_update_notseen(st);
1426170530Ssam		st->st_newscan = 0;
1427170530Ssam	}
1428170530Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
1429170530Ssam		/*
1430170530Ssam		 * Manual/background scan, don't select+join the
1431170530Ssam		 * bss, just return.  The scanning framework will
1432170530Ssam		 * handle notification that this has completed.
1433170530Ssam		 */
1434170530Ssam		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
1435170530Ssam		return 1;
1436170530Ssam	}
1437170530Ssam	/*
1438170530Ssam	 * Automatic sequencing; look for a candidate and
1439170530Ssam	 * if found join the network.
1440170530Ssam	 */
1441170530Ssam	/* NB: unlocked read should be ok */
1442170530Ssam	if (TAILQ_FIRST(&st->st_entry) == NULL) {
1443178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
1444170530Ssam			"%s: no scan candidate\n", __func__);
1445178354Ssam		if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1446178354Ssam			return 0;
1447170530Ssamnotfound:
1448178354Ssam		if (vap->iv_des_nssid) {
1449170530Ssam			/*
1450170530Ssam			 * No existing adhoc network to join and we have
1451170530Ssam			 * an ssid; start one up.  If no channel was
1452170530Ssam			 * specified, try to select a channel.
1453170530Ssam			 */
1454178354Ssam			if (vap->iv_des_chan == IEEE80211_CHAN_ANYC ||
1455178354Ssam			    IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
1456183421Ssam				struct ieee80211com *ic = vap->iv_ic;
1457183421Ssam
1458183421Ssam				chan = adhoc_pick_channel(ss, 0);
1459183421Ssam				if (chan != NULL)
1460183421Ssam					chan = ieee80211_ht_adjust_channel(ic,
1461183421Ssam					    chan, vap->iv_flags_ext);
1462178354Ssam			} else
1463178354Ssam				chan = vap->iv_des_chan;
1464170530Ssam			if (chan != NULL) {
1465178354Ssam				ieee80211_create_ibss(vap, chan);
1466170530Ssam				return 1;
1467170530Ssam			}
1468170530Ssam		}
1469170530Ssam		/*
1470170530Ssam		 * If nothing suitable was found decrement
1471170530Ssam		 * the failure counts so entries will be
1472170530Ssam		 * reconsidered the next time around.  We
1473170530Ssam		 * really want to do this only for sta's
1474170530Ssam		 * where we've previously had some success.
1475170530Ssam		 */
1476170530Ssam		sta_dec_fails(st);
1477170530Ssam		st->st_newscan = 1;
1478170530Ssam		return 0;			/* restart scan */
1479170530Ssam	}
1480178354Ssam	selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
1481178354Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1482178354Ssam		return (selbs != NULL);
1483184274Ssam	if (selbs == NULL)
1484170530Ssam		goto notfound;
1485184274Ssam	chan = selbs->base.se_chan;
1486184302Ssam	if (selbs->se_flags & STA_DEMOTE11B)
1487184302Ssam		chan = demote11b(vap, chan);
1488184274Ssam	if (!ieee80211_sta_join(vap, chan, &selbs->base))
1489184274Ssam		goto notfound;
1490170530Ssam	return 1;				/* terminate scan */
1491170530Ssam}
1492170530Ssam
1493170530Ssam/*
1494170530Ssam * Age entries in the scan cache.
1495170530Ssam */
1496170530Ssamstatic void
1497170530Ssamadhoc_age(struct ieee80211_scan_state *ss)
1498170530Ssam{
1499170530Ssam	struct sta_table *st = ss->ss_priv;
1500170530Ssam	struct sta_entry *se, *next;
1501170530Ssam
1502170530Ssam	mtx_lock(&st->st_lock);
1503170530Ssam	TAILQ_FOREACH_SAFE(se, &st->st_entry, se_list, next) {
1504170530Ssam		if (se->se_notseen > STA_PURGE_SCANS) {
1505170530Ssam			TAILQ_REMOVE(&st->st_entry, se, se_list);
1506170530Ssam			LIST_REMOVE(se, se_hash);
1507178354Ssam			ieee80211_ies_cleanup(&se->base.se_ies);
1508184210Sdes			FREE(se, M_80211_SCAN);
1509170530Ssam		}
1510170530Ssam	}
1511170530Ssam	mtx_unlock(&st->st_lock);
1512170530Ssam}
1513170530Ssam
1514170530Ssamstatic const struct ieee80211_scanner adhoc_default = {
1515170530Ssam	.scan_name		= "default",
1516170530Ssam	.scan_attach		= sta_attach,
1517170530Ssam	.scan_detach		= sta_detach,
1518170530Ssam	.scan_start		= adhoc_start,
1519170530Ssam	.scan_restart		= sta_restart,
1520170530Ssam	.scan_cancel		= sta_cancel,
1521170530Ssam	.scan_end		= adhoc_pick_bss,
1522170530Ssam	.scan_flush		= sta_flush,
1523178354Ssam	.scan_pickchan		= adhoc_pick_channel,
1524170530Ssam	.scan_add		= sta_add,
1525170530Ssam	.scan_age		= adhoc_age,
1526170530Ssam	.scan_iterate		= sta_iterate,
1527170530Ssam	.scan_assoc_fail	= sta_assoc_fail,
1528170530Ssam	.scan_assoc_success	= sta_assoc_success,
1529170530Ssam};
1530170530Ssam
1531178354Ssamstatic void
1532178354Ssamap_force_promisc(struct ieee80211com *ic)
1533178354Ssam{
1534178354Ssam	struct ifnet *ifp = ic->ic_ifp;
1535178354Ssam
1536178354Ssam	IEEE80211_LOCK(ic);
1537178354Ssam	/* set interface into promiscuous mode */
1538178354Ssam	ifp->if_flags |= IFF_PROMISC;
1539178354Ssam	ic->ic_update_promisc(ifp);
1540178354Ssam	IEEE80211_UNLOCK(ic);
1541178354Ssam}
1542178354Ssam
1543178354Ssamstatic void
1544178354Ssamap_reset_promisc(struct ieee80211com *ic)
1545178354Ssam{
1546178354Ssam	IEEE80211_LOCK(ic);
1547178354Ssam	ieee80211_syncifflag_locked(ic, IFF_PROMISC);
1548178354Ssam	IEEE80211_UNLOCK(ic);
1549178354Ssam}
1550178354Ssam
1551178354Ssamstatic int
1552178354Ssamap_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1553178354Ssam{
1554178354Ssam	struct sta_table *st = ss->ss_priv;
1555178354Ssam
1556178354Ssam	makescanlist(ss, vap, staScanTable);
1557178354Ssam
1558178354Ssam	if (ss->ss_mindwell == 0)
1559178354Ssam		ss->ss_mindwell = msecs_to_ticks(200);	/* 200ms */
1560178354Ssam	if (ss->ss_maxdwell == 0)
1561178354Ssam		ss->ss_maxdwell = msecs_to_ticks(200);	/* 200ms */
1562178354Ssam
1563178354Ssam	st->st_scangen++;
1564178354Ssam	st->st_newscan = 1;
1565178354Ssam
1566178354Ssam	ap_force_promisc(vap->iv_ic);
1567178354Ssam	return 0;
1568178354Ssam}
1569178354Ssam
1570170530Ssam/*
1571178354Ssam * Cancel an ongoing scan.
1572170530Ssam */
1573170530Ssamstatic int
1574178354Ssamap_cancel(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1575170530Ssam{
1576178354Ssam	ap_reset_promisc(vap->iv_ic);
1577178354Ssam	return 0;
1578178354Ssam}
1579178354Ssam
1580178354Ssam/*
1581178354Ssam * Pick a quiet channel to use for ap operation.
1582178354Ssam */
1583178354Ssamstatic struct ieee80211_channel *
1584178354Ssamap_pick_channel(struct ieee80211_scan_state *ss, int flags)
1585178354Ssam{
1586178354Ssam	struct sta_table *st = ss->ss_priv;
1587178354Ssam	struct ieee80211_channel *bestchan = NULL;
1588178354Ssam	int i;
1589178354Ssam
1590178354Ssam	/* XXX select channel more intelligently, e.g. channel spread, power */
1591178354Ssam	/* NB: use scan list order to preserve channel preference */
1592178354Ssam	for (i = 0; i < ss->ss_last; i++) {
1593178354Ssam		struct ieee80211_channel *chan = ss->ss_chans[i];
1594178354Ssam		/*
1595178354Ssam		 * If the channel is unoccupied the max rssi
1596178354Ssam		 * should be zero; just take it.  Otherwise
1597178354Ssam		 * track the channel with the lowest rssi and
1598178354Ssam		 * use that when all channels appear occupied.
1599178354Ssam		 */
1600178354Ssam		if (IEEE80211_IS_CHAN_RADAR(chan))
1601178354Ssam			continue;
1602178354Ssam		if (IEEE80211_IS_CHAN_NOHOSTAP(chan))
1603178354Ssam			continue;
1604178354Ssam		/* check channel attributes for band compatibility */
1605178354Ssam		if (flags != 0 && (chan->ic_flags & flags) != flags)
1606178354Ssam			continue;
1607178354Ssam		/* XXX channel have interference */
1608178354Ssam		if (st->st_maxrssi[chan->ic_ieee] == 0) {
1609178354Ssam			/* XXX use other considerations */
1610178354Ssam			return chan;
1611170530Ssam		}
1612178354Ssam		if (bestchan == NULL ||
1613178354Ssam		    st->st_maxrssi[chan->ic_ieee] < st->st_maxrssi[bestchan->ic_ieee])
1614178354Ssam			bestchan = chan;
1615178354Ssam	}
1616178354Ssam	return bestchan;
1617178354Ssam}
1618178354Ssam
1619178354Ssam/*
1620178354Ssam * Pick a quiet channel to use for ap operation.
1621178354Ssam */
1622178354Ssamstatic int
1623178354Ssamap_end(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1624178354Ssam{
1625178354Ssam	struct ieee80211com *ic = vap->iv_ic;
1626178354Ssam	struct ieee80211_channel *bestchan;
1627178354Ssam
1628178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_HOSTAP,
1629178354Ssam		("wrong opmode %u", vap->iv_opmode));
1630178354Ssam	bestchan = ap_pick_channel(ss, 0);
1631178354Ssam	if (bestchan == NULL) {
1632178354Ssam		/* no suitable channel, should not happen */
1633178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
1634178354Ssam		    "%s: no suitable channel! (should not happen)\n", __func__);
1635178354Ssam		/* XXX print something? */
1636178354Ssam		return 0;			/* restart scan */
1637178354Ssam	}
1638178354Ssam	/*
1639178354Ssam	 * If this is a dynamic turbo channel, start with the unboosted one.
1640178354Ssam	 */
1641178354Ssam	if (IEEE80211_IS_CHAN_TURBO(bestchan)) {
1642178354Ssam		bestchan = ieee80211_find_channel(ic, bestchan->ic_freq,
1643178354Ssam			bestchan->ic_flags & ~IEEE80211_CHAN_TURBO);
1644178354Ssam		if (bestchan == NULL) {
1645178354Ssam			/* should never happen ?? */
1646178354Ssam			return 0;
1647170530Ssam		}
1648170530Ssam	}
1649178354Ssam	ap_reset_promisc(ic);
1650178354Ssam	if (ss->ss_flags & (IEEE80211_SCAN_NOPICK | IEEE80211_SCAN_NOJOIN)) {
1651178354Ssam		/*
1652178354Ssam		 * Manual/background scan, don't select+join the
1653178354Ssam		 * bss, just return.  The scanning framework will
1654178354Ssam		 * handle notification that this has completed.
1655178354Ssam		 */
1656178354Ssam		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
1657178354Ssam		return 1;
1658178354Ssam	}
1659178354Ssam	ieee80211_create_ibss(vap,
1660178354Ssam	    ieee80211_ht_adjust_channel(ic, bestchan, vap->iv_flags_ext));
1661178354Ssam	return 1;
1662170530Ssam}
1663170530Ssam
1664178354Ssamstatic const struct ieee80211_scanner ap_default = {
1665178354Ssam	.scan_name		= "default",
1666178354Ssam	.scan_attach		= sta_attach,
1667178354Ssam	.scan_detach		= sta_detach,
1668178354Ssam	.scan_start		= ap_start,
1669178354Ssam	.scan_restart		= sta_restart,
1670178354Ssam	.scan_cancel		= ap_cancel,
1671178354Ssam	.scan_end		= ap_end,
1672178354Ssam	.scan_flush		= sta_flush,
1673178354Ssam	.scan_pickchan		= ap_pick_channel,
1674178354Ssam	.scan_add		= sta_add,
1675178354Ssam	.scan_age		= adhoc_age,
1676178354Ssam	.scan_iterate		= sta_iterate,
1677178354Ssam	.scan_assoc_success	= sta_assoc_success,
1678178354Ssam	.scan_assoc_fail	= sta_assoc_fail,
1679170530Ssam};
1680178354Ssam
1681178354Ssam/*
1682178354Ssam * Module glue.
1683178354Ssam */
1684178354SsamIEEE80211_SCANNER_MODULE(sta, 1);
1685178354SsamIEEE80211_SCANNER_ALG(sta, IEEE80211_M_STA, sta_default);
1686178354SsamIEEE80211_SCANNER_ALG(ibss, IEEE80211_M_IBSS, adhoc_default);
1687178354SsamIEEE80211_SCANNER_ALG(ahdemo, IEEE80211_M_AHDEMO, adhoc_default);
1688178354SsamIEEE80211_SCANNER_ALG(ap, IEEE80211_M_HOSTAP, ap_default);
1689