ieee80211_scan_sta.c revision 330446
1170530Ssam/*-
2186904Ssam * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
3170530Ssam * All rights reserved.
4170530Ssam *
5170530Ssam * Redistribution and use in source and binary forms, with or without
6170530Ssam * modification, are permitted provided that the following conditions
7170530Ssam * are met:
8170530Ssam * 1. Redistributions of source code must retain the above copyright
9170530Ssam *    notice, this list of conditions and the following disclaimer.
10170530Ssam * 2. Redistributions in binary form must reproduce the above copyright
11170530Ssam *    notice, this list of conditions and the following disclaimer in the
12170530Ssam *    documentation and/or other materials provided with the distribution.
13170530Ssam *
14170530Ssam * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15170530Ssam * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16170530Ssam * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17170530Ssam * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18170530Ssam * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19170530Ssam * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20170530Ssam * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21170530Ssam * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22170530Ssam * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23170530Ssam * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24170530Ssam */
25170530Ssam
26170530Ssam#include <sys/cdefs.h>
27170530Ssam__FBSDID("$FreeBSD: stable/11/sys/net80211/ieee80211_scan_sta.c 330446 2018-03-05 06:59:30Z eadler $");
28170530Ssam
29170530Ssam/*
30170530Ssam * IEEE 802.11 station scanning support.
31170530Ssam */
32178354Ssam#include "opt_wlan.h"
33178354Ssam
34170530Ssam#include <sys/param.h>
35191746Sthompsa#include <sys/systm.h>
36170530Ssam#include <sys/kernel.h>
37298359Savos#include <sys/endian.h>
38295126Sglebius#include <sys/malloc.h>
39170530Ssam#include <sys/module.h>
40191746Sthompsa
41170530Ssam#include <sys/socket.h>
42170530Ssam
43170530Ssam#include <net/if.h>
44257176Sglebius#include <net/if_var.h>
45170530Ssam#include <net/if_media.h>
46170530Ssam#include <net/ethernet.h>
47170530Ssam
48170530Ssam#include <net80211/ieee80211_var.h>
49178354Ssam#include <net80211/ieee80211_input.h>
50178354Ssam#include <net80211/ieee80211_regdomain.h>
51186904Ssam#ifdef IEEE80211_SUPPORT_TDMA
52186904Ssam#include <net80211/ieee80211_tdma.h>
53186904Ssam#endif
54195618Srpaulo#ifdef IEEE80211_SUPPORT_MESH
55195618Srpaulo#include <net80211/ieee80211_mesh.h>
56195618Srpaulo#endif
57245928Sadrian#include <net80211/ieee80211_ratectl.h>
58170530Ssam
59170530Ssam#include <net/bpf.h>
60170530Ssam
61170530Ssam/*
62170530Ssam * Parameters for managing cache entries:
63170530Ssam *
64170530Ssam * o a station with STA_FAILS_MAX failures is not considered
65170530Ssam *   when picking a candidate
66170530Ssam * o a station that hasn't had an update in STA_PURGE_SCANS
67170530Ssam *   (background) scans is discarded
68170530Ssam * o after STA_FAILS_AGE seconds we clear the failure count
69170530Ssam */
70170530Ssam#define	STA_FAILS_MAX	2		/* assoc failures before ignored */
71170530Ssam#define	STA_FAILS_AGE	(2*60)		/* time before clearing fails (secs) */
72170530Ssam#define	STA_PURGE_SCANS	2		/* age for purging entries (scans) */
73170530Ssam
74170530Ssam/* XXX tunable */
75170530Ssam#define	STA_RSSI_MIN	8		/* min acceptable rssi */
76170530Ssam#define	STA_RSSI_MAX	40		/* max rssi for comparison */
77170530Ssam
78170530Ssamstruct sta_entry {
79170530Ssam	struct ieee80211_scan_entry base;
80170530Ssam	TAILQ_ENTRY(sta_entry) se_list;
81170530Ssam	LIST_ENTRY(sta_entry) se_hash;
82170530Ssam	uint8_t		se_fails;		/* failure to associate count */
83170530Ssam	uint8_t		se_seen;		/* seen during current scan */
84170530Ssam	uint8_t		se_notseen;		/* not seen in previous scans */
85170530Ssam	uint8_t		se_flags;
86184302Ssam#define	STA_DEMOTE11B	0x01			/* match w/ demoted 11b chan */
87170530Ssam	uint32_t	se_avgrssi;		/* LPF rssi state */
88170530Ssam	unsigned long	se_lastupdate;		/* time of last update */
89170530Ssam	unsigned long	se_lastfail;		/* time of last failure */
90170530Ssam	unsigned long	se_lastassoc;		/* time of last association */
91170530Ssam	u_int		se_scangen;		/* iterator scan gen# */
92178354Ssam	u_int		se_countrygen;		/* gen# of last cc notify */
93170530Ssam};
94170530Ssam
95170530Ssam#define	STA_HASHSIZE	32
96170530Ssam/* simple hash is enough for variation of macaddr */
97170530Ssam#define	STA_HASH(addr)	\
98170530Ssam	(((const uint8_t *)(addr))[IEEE80211_ADDR_LEN - 1] % STA_HASHSIZE)
99170530Ssam
100186107Ssam#define	MAX_IEEE_CHAN	256			/* max acceptable IEEE chan # */
101186107SsamCTASSERT(MAX_IEEE_CHAN >= 256);
102186107Ssam
103170530Ssamstruct sta_table {
104206617Srpaulo	ieee80211_scan_table_lock_t st_lock;	/* on scan table */
105170530Ssam	TAILQ_HEAD(, sta_entry) st_entry;	/* all entries */
106170530Ssam	LIST_HEAD(, sta_entry) st_hash[STA_HASHSIZE];
107283556Sadrian	ieee80211_scan_iter_lock_t st_scanlock;		/* on st_scaniter */
108178354Ssam	u_int		st_scaniter;		/* gen# for iterator */
109178354Ssam	u_int		st_scangen;		/* scan generation # */
110170530Ssam	int		st_newscan;
111178354Ssam	/* ap-related state */
112186107Ssam	int		st_maxrssi[MAX_IEEE_CHAN];
113170530Ssam};
114170530Ssam
115170530Ssamstatic void sta_flush_table(struct sta_table *);
116171409Ssam/*
117171409Ssam * match_bss returns a bitmask describing if an entry is suitable
118171409Ssam * for use.  If non-zero the entry was deemed not suitable and it's
119330446Seadler * contents explains why.  The following flags are or'd to this
120171409Ssam * mask and can be used to figure out why the entry was rejected.
121171409Ssam */
122195618Srpaulo#define	MATCH_CHANNEL		0x00001	/* channel mismatch */
123195618Srpaulo#define	MATCH_CAPINFO		0x00002	/* capabilities mismatch, e.g. no ess */
124195618Srpaulo#define	MATCH_PRIVACY		0x00004	/* privacy mismatch */
125195618Srpaulo#define	MATCH_RATE		0x00008	/* rate set mismatch */
126195618Srpaulo#define	MATCH_SSID		0x00010	/* ssid mismatch */
127195618Srpaulo#define	MATCH_BSSID		0x00020	/* bssid mismatch */
128195618Srpaulo#define	MATCH_FAILS		0x00040	/* too many failed auth attempts */
129195618Srpaulo#define	MATCH_NOTSEEN		0x00080	/* not seen in recent scans */
130195618Srpaulo#define	MATCH_RSSI		0x00100	/* rssi deemed too low to use */
131195618Srpaulo#define	MATCH_CC		0x00200	/* country code mismatch */
132300232Savos#ifdef IEEE80211_SUPPORT_TDMA
133195618Srpaulo#define	MATCH_TDMA_NOIE		0x00400	/* no TDMA ie */
134195618Srpaulo#define	MATCH_TDMA_NOTMASTER	0x00800	/* not TDMA master */
135195618Srpaulo#define	MATCH_TDMA_NOSLOT	0x01000	/* all TDMA slots occupied */
136195618Srpaulo#define	MATCH_TDMA_LOCAL	0x02000	/* local address */
137195618Srpaulo#define	MATCH_TDMA_VERSION	0x04000	/* protocol version mismatch */
138300232Savos#endif
139195618Srpaulo#define	MATCH_MESH_NOID		0x10000	/* no MESHID ie */
140195618Srpaulo#define	MATCH_MESHID		0x20000	/* meshid mismatch */
141178354Ssamstatic int match_bss(struct ieee80211vap *,
142170530Ssam	const struct ieee80211_scan_state *, struct sta_entry *, int);
143178354Ssamstatic void adhoc_age(struct ieee80211_scan_state *);
144170530Ssam
145178354Ssamstatic __inline int
146178354Ssamisocmp(const uint8_t cc1[], const uint8_t cc2[])
147178354Ssam{
148178354Ssam     return (cc1[0] == cc2[0] && cc1[1] == cc2[1]);
149178354Ssam}
150178354Ssam
151170530Ssam/* number of references from net80211 layer */
152170530Ssamstatic	int nrefs = 0;
153195618Srpaulo/*
154195618Srpaulo * Module glue.
155195618Srpaulo */
156195618SrpauloIEEE80211_SCANNER_MODULE(sta, 1);
157170530Ssam
158170530Ssam/*
159170530Ssam * Attach prior to any scanning work.
160170530Ssam */
161170530Ssamstatic int
162170530Ssamsta_attach(struct ieee80211_scan_state *ss)
163170530Ssam{
164170530Ssam	struct sta_table *st;
165170530Ssam
166283538Sadrian	st = (struct sta_table *) IEEE80211_MALLOC(sizeof(struct sta_table),
167283538Sadrian		M_80211_SCAN,
168283538Sadrian		IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
169170530Ssam	if (st == NULL)
170170530Ssam		return 0;
171206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK_INIT(st, "scantable");
172283556Sadrian	IEEE80211_SCAN_ITER_LOCK_INIT(st, "scangen");
173170530Ssam	TAILQ_INIT(&st->st_entry);
174170530Ssam	ss->ss_priv = st;
175170530Ssam	nrefs++;			/* NB: we assume caller locking */
176170530Ssam	return 1;
177170530Ssam}
178170530Ssam
179170530Ssam/*
180170530Ssam * Cleanup any private state.
181170530Ssam */
182170530Ssamstatic int
183170530Ssamsta_detach(struct ieee80211_scan_state *ss)
184170530Ssam{
185170530Ssam	struct sta_table *st = ss->ss_priv;
186170530Ssam
187170530Ssam	if (st != NULL) {
188170530Ssam		sta_flush_table(st);
189206617Srpaulo		IEEE80211_SCAN_TABLE_LOCK_DESTROY(st);
190283556Sadrian		IEEE80211_SCAN_ITER_LOCK_DESTROY(st);
191283538Sadrian		IEEE80211_FREE(st, M_80211_SCAN);
192170530Ssam		KASSERT(nrefs > 0, ("imbalanced attach/detach"));
193170530Ssam		nrefs--;		/* NB: we assume caller locking */
194170530Ssam	}
195170530Ssam	return 1;
196170530Ssam}
197170530Ssam
198170530Ssam/*
199170530Ssam * Flush all per-scan state.
200170530Ssam */
201170530Ssamstatic int
202170530Ssamsta_flush(struct ieee80211_scan_state *ss)
203170530Ssam{
204170530Ssam	struct sta_table *st = ss->ss_priv;
205170530Ssam
206206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
207170530Ssam	sta_flush_table(st);
208206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
209170530Ssam	ss->ss_last = 0;
210170530Ssam	return 0;
211170530Ssam}
212170530Ssam
213170530Ssam/*
214170530Ssam * Flush all entries in the scan cache.
215170530Ssam */
216170530Ssamstatic void
217170530Ssamsta_flush_table(struct sta_table *st)
218170530Ssam{
219170530Ssam	struct sta_entry *se, *next;
220170530Ssam
221170530Ssam	TAILQ_FOREACH_SAFE(se, &st->st_entry, se_list, next) {
222170530Ssam		TAILQ_REMOVE(&st->st_entry, se, se_list);
223170530Ssam		LIST_REMOVE(se, se_hash);
224178354Ssam		ieee80211_ies_cleanup(&se->base.se_ies);
225283538Sadrian		IEEE80211_FREE(se, M_80211_SCAN);
226170530Ssam	}
227178354Ssam	memset(st->st_maxrssi, 0, sizeof(st->st_maxrssi));
228170530Ssam}
229170530Ssam
230170530Ssam/*
231170530Ssam * Process a beacon or probe response frame; create an
232170530Ssam * entry in the scan cache or update any previous entry.
233170530Ssam */
234170530Ssamstatic int
235170530Ssamsta_add(struct ieee80211_scan_state *ss,
236282742Sadrian	struct ieee80211_channel *curchan,
237170530Ssam	const struct ieee80211_scanparams *sp,
238170530Ssam	const struct ieee80211_frame *wh,
239192468Ssam	int subtype, int rssi, int noise)
240170530Ssam{
241170530Ssam#define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
242170530Ssam#define	PICK1ST(_ss) \
243170530Ssam	((ss->ss_flags & (IEEE80211_SCAN_PICK1ST | IEEE80211_SCAN_GOTPICK)) == \
244170530Ssam	IEEE80211_SCAN_PICK1ST)
245170530Ssam	struct sta_table *st = ss->ss_priv;
246170530Ssam	const uint8_t *macaddr = wh->i_addr2;
247178354Ssam	struct ieee80211vap *vap = ss->ss_vap;
248178354Ssam	struct ieee80211com *ic = vap->iv_ic;
249224717Sbschmidt	struct ieee80211_channel *c;
250170530Ssam	struct sta_entry *se;
251170530Ssam	struct ieee80211_scan_entry *ise;
252178354Ssam	int hash;
253170530Ssam
254170530Ssam	hash = STA_HASH(macaddr);
255170530Ssam
256206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
257170530Ssam	LIST_FOREACH(se, &st->st_hash[hash], se_hash)
258170530Ssam		if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr))
259170530Ssam			goto found;
260283538Sadrian	se = (struct sta_entry *) IEEE80211_MALLOC(sizeof(struct sta_entry),
261283538Sadrian		M_80211_SCAN, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
262170530Ssam	if (se == NULL) {
263206617Srpaulo		IEEE80211_SCAN_TABLE_UNLOCK(st);
264170530Ssam		return 0;
265170530Ssam	}
266178354Ssam	se->se_scangen = st->st_scaniter-1;
267178354Ssam	se->se_avgrssi = IEEE80211_RSSI_DUMMY_MARKER;
268170530Ssam	IEEE80211_ADDR_COPY(se->base.se_macaddr, macaddr);
269170530Ssam	TAILQ_INSERT_TAIL(&st->st_entry, se, se_list);
270170530Ssam	LIST_INSERT_HEAD(&st->st_hash[hash], se, se_hash);
271170530Ssamfound:
272170530Ssam	ise = &se->base;
273170530Ssam	/* XXX ap beaconing multiple ssid w/ same bssid */
274170530Ssam	if (sp->ssid[1] != 0 &&
275170530Ssam	    (ISPROBE(subtype) || ise->se_ssid[1] == 0))
276170530Ssam		memcpy(ise->se_ssid, sp->ssid, 2+sp->ssid[1]);
277170530Ssam	KASSERT(sp->rates[1] <= IEEE80211_RATE_MAXSIZE,
278170530Ssam		("rate set too large: %u", sp->rates[1]));
279170530Ssam	memcpy(ise->se_rates, sp->rates, 2+sp->rates[1]);
280170530Ssam	if (sp->xrates != NULL) {
281170530Ssam		/* XXX validate xrates[1] */
282178354Ssam		KASSERT(sp->xrates[1] <= IEEE80211_RATE_MAXSIZE,
283170530Ssam			("xrate set too large: %u", sp->xrates[1]));
284170530Ssam		memcpy(ise->se_xrates, sp->xrates, 2+sp->xrates[1]);
285170530Ssam	} else
286170530Ssam		ise->se_xrates[1] = 0;
287170530Ssam	IEEE80211_ADDR_COPY(ise->se_bssid, wh->i_addr3);
288178354Ssam	if ((sp->status & IEEE80211_BPARSE_OFFCHAN) == 0) {
289173368Ssam		/*
290173368Ssam		 * Record rssi data using extended precision LPF filter.
291173368Ssam		 *
292173368Ssam		 * NB: use only on-channel data to insure we get a good
293173368Ssam		 *     estimate of the signal we'll see when associated.
294173368Ssam		 */
295178354Ssam		IEEE80211_RSSI_LPF(se->se_avgrssi, rssi);
296178354Ssam		ise->se_rssi = IEEE80211_RSSI_GET(se->se_avgrssi);
297173368Ssam		ise->se_noise = noise;
298173368Ssam	}
299170530Ssam	memcpy(ise->se_tstamp.data, sp->tstamp, sizeof(ise->se_tstamp));
300170530Ssam	ise->se_intval = sp->bintval;
301170530Ssam	ise->se_capinfo = sp->capinfo;
302195618Srpaulo#ifdef IEEE80211_SUPPORT_MESH
303195618Srpaulo	if (sp->meshid != NULL && sp->meshid[1] != 0)
304195618Srpaulo		memcpy(ise->se_meshid, sp->meshid, 2+sp->meshid[1]);
305195618Srpaulo#endif
306173368Ssam	/*
307173368Ssam	 * Beware of overriding se_chan for frames seen
308173368Ssam	 * off-channel; this can cause us to attempt an
309178354Ssam	 * association on the wrong channel.
310173368Ssam	 */
311178354Ssam	if (sp->status & IEEE80211_BPARSE_OFFCHAN) {
312173368Ssam		/*
313173862Ssam		 * Off-channel, locate the home/bss channel for the sta
314178354Ssam		 * using the value broadcast in the DSPARMS ie.  We know
315178354Ssam		 * sp->chan has this value because it's used to calculate
316178354Ssam		 * IEEE80211_BPARSE_OFFCHAN.
317173368Ssam		 */
318178354Ssam		c = ieee80211_find_channel_byieee(ic, sp->chan,
319282742Sadrian		    curchan->ic_flags);
320173956Ssam		if (c != NULL) {
321173956Ssam			ise->se_chan = c;
322173956Ssam		} else if (ise->se_chan == NULL) {
323173862Ssam			/* should not happen, pick something */
324282742Sadrian			ise->se_chan = curchan;
325173862Ssam		}
326173862Ssam	} else
327282742Sadrian		ise->se_chan = curchan;
328224717Sbschmidt	if (IEEE80211_IS_CHAN_HT(ise->se_chan) && sp->htcap == NULL) {
329224717Sbschmidt		/* Demote legacy networks to a non-HT channel. */
330224717Sbschmidt		c = ieee80211_find_channel(ic, ise->se_chan->ic_freq,
331224717Sbschmidt		    ise->se_chan->ic_flags & ~IEEE80211_CHAN_HT);
332224717Sbschmidt		KASSERT(c != NULL,
333224717Sbschmidt		    ("no legacy channel %u", ise->se_chan->ic_ieee));
334224717Sbschmidt		ise->se_chan = c;
335224717Sbschmidt	}
336170530Ssam	ise->se_fhdwell = sp->fhdwell;
337170530Ssam	ise->se_fhindex = sp->fhindex;
338170530Ssam	ise->se_erp = sp->erp;
339170530Ssam	ise->se_timoff = sp->timoff;
340170530Ssam	if (sp->tim != NULL) {
341170530Ssam		const struct ieee80211_tim_ie *tim =
342170530Ssam		    (const struct ieee80211_tim_ie *) sp->tim;
343170530Ssam		ise->se_dtimperiod = tim->tim_period;
344170530Ssam	}
345178354Ssam	if (sp->country != NULL) {
346178354Ssam		const struct ieee80211_country_ie *cie =
347178354Ssam		    (const struct ieee80211_country_ie *) sp->country;
348178354Ssam		/*
349178354Ssam		 * If 11d is enabled and we're attempting to join a bss
350178354Ssam		 * that advertises it's country code then compare our
351178354Ssam		 * current settings to what we fetched from the country ie.
352178354Ssam		 * If our country code is unspecified or different then
353178354Ssam		 * dispatch an event to user space that identifies the
354178354Ssam		 * country code so our regdomain config can be changed.
355178354Ssam		 */
356178354Ssam		/* XXX only for STA mode? */
357178354Ssam		if ((IEEE80211_IS_CHAN_11D(ise->se_chan) ||
358178354Ssam		    (vap->iv_flags_ext & IEEE80211_FEXT_DOTD)) &&
359178354Ssam		    (ic->ic_regdomain.country == CTRY_DEFAULT ||
360178354Ssam		     !isocmp(cie->cc, ic->ic_regdomain.isocc))) {
361178354Ssam			/* only issue one notify event per scan */
362178354Ssam			if (se->se_countrygen != st->st_scangen) {
363178354Ssam				ieee80211_notify_country(vap, ise->se_bssid,
364178354Ssam				    cie->cc);
365178354Ssam				se->se_countrygen = st->st_scangen;
366178354Ssam			}
367178354Ssam		}
368178354Ssam		ise->se_cc[0] = cie->cc[0];
369178354Ssam		ise->se_cc[1] = cie->cc[1];
370178354Ssam	}
371178354Ssam	/* NB: no need to setup ie ptrs; they are not (currently) used */
372178354Ssam	(void) ieee80211_ies_init(&ise->se_ies, sp->ies, sp->ies_len);
373170530Ssam
374170530Ssam	/* clear failure count after STA_FAIL_AGE passes */
375170530Ssam	if (se->se_fails && (ticks - se->se_lastfail) > STA_FAILS_AGE*hz) {
376170530Ssam		se->se_fails = 0;
377178354Ssam		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_SCAN, macaddr,
378170530Ssam		    "%s: fails %u", __func__, se->se_fails);
379170530Ssam	}
380170530Ssam
381170530Ssam	se->se_lastupdate = ticks;		/* update time */
382170530Ssam	se->se_seen = 1;
383170530Ssam	se->se_notseen = 0;
384170530Ssam
385186107Ssam	KASSERT(sizeof(sp->bchan) == 1, ("bchan size"));
386178354Ssam	if (rssi > st->st_maxrssi[sp->bchan])
387178354Ssam		st->st_maxrssi[sp->bchan] = rssi;
388178354Ssam
389206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
390170530Ssam
391170530Ssam	/*
392170530Ssam	 * If looking for a quick choice and nothing's
393170530Ssam	 * been found check here.
394170530Ssam	 */
395178354Ssam	if (PICK1ST(ss) && match_bss(vap, ss, se, IEEE80211_MSG_SCAN) == 0)
396170530Ssam		ss->ss_flags |= IEEE80211_SCAN_GOTPICK;
397170530Ssam
398170530Ssam	return 1;
399170530Ssam#undef PICK1ST
400170530Ssam#undef ISPROBE
401170530Ssam}
402170530Ssam
403170530Ssam/*
404170530Ssam * Check if a channel is excluded by user request.
405170530Ssam */
406170530Ssamstatic int
407178354Ssamisexcluded(struct ieee80211vap *vap, const struct ieee80211_channel *c)
408170530Ssam{
409178354Ssam	return (isclr(vap->iv_ic->ic_chan_active, c->ic_ieee) ||
410178354Ssam	    (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
411178354Ssam	     c->ic_freq != vap->iv_des_chan->ic_freq));
412170530Ssam}
413170530Ssam
414170530Ssamstatic struct ieee80211_channel *
415170530Ssamfind11gchannel(struct ieee80211com *ic, int i, int freq)
416170530Ssam{
417170530Ssam	struct ieee80211_channel *c;
418170530Ssam	int j;
419170530Ssam
420170530Ssam	/*
421170530Ssam	 * The normal ordering in the channel list is b channel
422170530Ssam	 * immediately followed by g so optimize the search for
423170530Ssam	 * this.  We'll still do a full search just in case.
424170530Ssam	 */
425170530Ssam	for (j = i+1; j < ic->ic_nchans; j++) {
426170530Ssam		c = &ic->ic_channels[j];
427187991Ssam		if (c->ic_freq == freq && IEEE80211_IS_CHAN_G(c))
428170530Ssam			return c;
429170530Ssam	}
430170530Ssam	for (j = 0; j < i; j++) {
431170530Ssam		c = &ic->ic_channels[j];
432187991Ssam		if (c->ic_freq == freq && IEEE80211_IS_CHAN_G(c))
433170530Ssam			return c;
434170530Ssam	}
435170530Ssam	return NULL;
436170530Ssam}
437188777Ssam
438170530Ssamstatic const u_int chanflags[IEEE80211_MODE_MAX] = {
439188777Ssam	[IEEE80211_MODE_AUTO]	  = IEEE80211_CHAN_B,
440188777Ssam	[IEEE80211_MODE_11A]	  = IEEE80211_CHAN_A,
441188777Ssam	[IEEE80211_MODE_11B]	  = IEEE80211_CHAN_B,
442188777Ssam	[IEEE80211_MODE_11G]	  = IEEE80211_CHAN_G,
443188777Ssam	[IEEE80211_MODE_FH]	  = IEEE80211_CHAN_FHSS,
444188777Ssam	/* check base channel */
445188777Ssam	[IEEE80211_MODE_TURBO_A]  = IEEE80211_CHAN_A,
446188777Ssam	[IEEE80211_MODE_TURBO_G]  = IEEE80211_CHAN_G,
447188777Ssam	[IEEE80211_MODE_STURBO_A] = IEEE80211_CHAN_ST,
448188782Ssam	[IEEE80211_MODE_HALF]	  = IEEE80211_CHAN_HALF,
449188782Ssam	[IEEE80211_MODE_QUARTER]  = IEEE80211_CHAN_QUARTER,
450188777Ssam	/* check legacy */
451188777Ssam	[IEEE80211_MODE_11NA]	  = IEEE80211_CHAN_A,
452188777Ssam	[IEEE80211_MODE_11NG]	  = IEEE80211_CHAN_G,
453170530Ssam};
454170530Ssam
455170530Ssamstatic void
456178354Ssamadd_channels(struct ieee80211vap *vap,
457170530Ssam	struct ieee80211_scan_state *ss,
458170530Ssam	enum ieee80211_phymode mode, const uint16_t freq[], int nfreq)
459170530Ssam{
460178354Ssam	struct ieee80211com *ic = vap->iv_ic;
461170530Ssam	struct ieee80211_channel *c, *cg;
462170530Ssam	u_int modeflags;
463170530Ssam	int i;
464170530Ssam
465254315Srpaulo	KASSERT(mode < nitems(chanflags), ("Unexpected mode %u", mode));
466170530Ssam	modeflags = chanflags[mode];
467170530Ssam	for (i = 0; i < nfreq; i++) {
468170530Ssam		if (ss->ss_last >= IEEE80211_SCAN_MAX)
469170530Ssam			break;
470170530Ssam
471170530Ssam		c = ieee80211_find_channel(ic, freq[i], modeflags);
472178354Ssam		if (c == NULL || isexcluded(vap, c))
473170530Ssam			continue;
474170530Ssam		if (mode == IEEE80211_MODE_AUTO) {
475170530Ssam			/*
476170530Ssam			 * XXX special-case 11b/g channels so we select
477178354Ssam			 *     the g channel if both are present.
478170530Ssam			 */
479178354Ssam			if (IEEE80211_IS_CHAN_B(c) &&
480178354Ssam			    (cg = find11gchannel(ic, i, c->ic_freq)) != NULL)
481178354Ssam				c = cg;
482170530Ssam		}
483170530Ssam		ss->ss_chans[ss->ss_last++] = c;
484170530Ssam	}
485170530Ssam}
486170530Ssam
487170530Ssamstruct scanlist {
488170530Ssam	uint16_t	mode;
489170530Ssam	uint16_t	count;
490170530Ssam	const uint16_t	*list;
491170530Ssam};
492170530Ssam
493170530Ssamstatic int
494170530Ssamchecktable(const struct scanlist *scan, const struct ieee80211_channel *c)
495170530Ssam{
496170530Ssam	int i;
497170530Ssam
498170530Ssam	for (; scan->list != NULL; scan++) {
499170530Ssam		for (i = 0; i < scan->count; i++)
500170530Ssam			if (scan->list[i] == c->ic_freq)
501170530Ssam				return 1;
502170530Ssam	}
503170530Ssam	return 0;
504170530Ssam}
505170530Ssam
506189377Ssamstatic int
507189377Ssamonscanlist(const struct ieee80211_scan_state *ss,
508189377Ssam	const struct ieee80211_channel *c)
509189377Ssam{
510189377Ssam	int i;
511189377Ssam
512189377Ssam	for (i = 0; i < ss->ss_last; i++)
513189377Ssam		if (ss->ss_chans[i] == c)
514189377Ssam			return 1;
515189377Ssam	return 0;
516189377Ssam}
517189377Ssam
518176653Ssamstatic void
519178354Ssamsweepchannels(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
520176653Ssam	const struct scanlist table[])
521176653Ssam{
522178354Ssam	struct ieee80211com *ic = vap->iv_ic;
523176653Ssam	struct ieee80211_channel *c;
524176653Ssam	int i;
525176653Ssam
526176653Ssam	for (i = 0; i < ic->ic_nchans; i++) {
527176653Ssam		if (ss->ss_last >= IEEE80211_SCAN_MAX)
528176653Ssam			break;
529176653Ssam
530176653Ssam		c = &ic->ic_channels[i];
531176653Ssam		/*
532176653Ssam		 * Ignore dynamic turbo channels; we scan them
533176653Ssam		 * in normal mode (i.e. not boosted).  Likewise
534176653Ssam		 * for HT channels, they get scanned using
535176653Ssam		 * legacy rates.
536176653Ssam		 */
537176653Ssam		if (IEEE80211_IS_CHAN_DTURBO(c) || IEEE80211_IS_CHAN_HT(c))
538176653Ssam			continue;
539176653Ssam
540176653Ssam		/*
541176653Ssam		 * If a desired mode was specified, scan only
542176653Ssam		 * channels that satisfy that constraint.
543176653Ssam		 */
544178354Ssam		if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
545178354Ssam		    vap->iv_des_mode != ieee80211_chan2mode(c))
546176653Ssam			continue;
547176653Ssam
548176653Ssam		/*
549176653Ssam		 * Skip channels excluded by user request.
550176653Ssam		 */
551178354Ssam		if (isexcluded(vap, c))
552176653Ssam			continue;
553176653Ssam
554176653Ssam		/*
555176653Ssam		 * Add the channel unless it is listed in the
556176653Ssam		 * fixed scan order tables.  This insures we
557176653Ssam		 * don't sweep back in channels we filtered out
558176653Ssam		 * above.
559176653Ssam		 */
560176653Ssam		if (checktable(table, c))
561176653Ssam			continue;
562176653Ssam
563176653Ssam		/* Add channel to scanning list. */
564176653Ssam		ss->ss_chans[ss->ss_last++] = c;
565176653Ssam	}
566189377Ssam	/*
567189377Ssam	 * Explicitly add any desired channel if:
568189377Ssam	 * - not already on the scan list
569189377Ssam	 * - allowed by any desired mode constraint
570189377Ssam	 * - there is space in the scan list
571189377Ssam	 * This allows the channel to be used when the filtering
572189377Ssam	 * mechanisms would otherwise elide it (e.g HT, turbo).
573189377Ssam	 */
574189377Ssam	c = vap->iv_des_chan;
575189377Ssam	if (c != IEEE80211_CHAN_ANYC &&
576189377Ssam	    !onscanlist(ss, c) &&
577189377Ssam	    (vap->iv_des_mode == IEEE80211_MODE_AUTO ||
578189377Ssam	     vap->iv_des_mode == ieee80211_chan2mode(c)) &&
579189377Ssam	    ss->ss_last < IEEE80211_SCAN_MAX)
580189377Ssam		ss->ss_chans[ss->ss_last++] = c;
581176653Ssam}
582176653Ssam
583178354Ssamstatic void
584178354Ssammakescanlist(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
585178354Ssam	const struct scanlist table[])
586170530Ssam{
587170530Ssam	const struct scanlist *scan;
588170530Ssam	enum ieee80211_phymode mode;
589170530Ssam
590170530Ssam	ss->ss_last = 0;
591170530Ssam	/*
592170530Ssam	 * Use the table of ordered channels to construct the list
593170530Ssam	 * of channels for scanning.  Any channels in the ordered
594170530Ssam	 * list not in the master list will be discarded.
595170530Ssam	 */
596178354Ssam	for (scan = table; scan->list != NULL; scan++) {
597170530Ssam		mode = scan->mode;
598178354Ssam		if (vap->iv_des_mode != IEEE80211_MODE_AUTO) {
599170530Ssam			/*
600170530Ssam			 * If a desired mode was specified, scan only
601170530Ssam			 * channels that satisfy that constraint.
602170530Ssam			 */
603178354Ssam			if (vap->iv_des_mode != mode) {
604170530Ssam				/*
605170530Ssam				 * The scan table marks 2.4Ghz channels as b
606170530Ssam				 * so if the desired mode is 11g, then use
607170530Ssam				 * the 11b channel list but upgrade the mode.
608170530Ssam				 */
609275875Sadrian				if (vap->iv_des_mode == IEEE80211_MODE_11G) {
610275875Sadrian					if (mode == IEEE80211_MODE_11G) /* Skip the G check */
611275875Sadrian						continue;
612275875Sadrian					else if (mode == IEEE80211_MODE_11B)
613275875Sadrian						mode = IEEE80211_MODE_11G;	/* upgrade */
614275875Sadrian				}
615170530Ssam			}
616170530Ssam		} else {
617170530Ssam			/*
618170530Ssam			 * This lets add_channels upgrade an 11b channel
619170530Ssam			 * to 11g if available.
620170530Ssam			 */
621170530Ssam			if (mode == IEEE80211_MODE_11B)
622170530Ssam				mode = IEEE80211_MODE_AUTO;
623170530Ssam		}
624170530Ssam#ifdef IEEE80211_F_XR
625170530Ssam		/* XR does not operate on turbo channels */
626178354Ssam		if ((vap->iv_flags & IEEE80211_F_XR) &&
627170530Ssam		    (mode == IEEE80211_MODE_TURBO_A ||
628170530Ssam		     mode == IEEE80211_MODE_TURBO_G ||
629170530Ssam		     mode == IEEE80211_MODE_STURBO_A))
630170530Ssam			continue;
631170530Ssam#endif
632170530Ssam		/*
633170530Ssam		 * Add the list of the channels; any that are not
634170530Ssam		 * in the master channel list will be discarded.
635170530Ssam		 */
636178354Ssam		add_channels(vap, ss, mode, scan->list, scan->count);
637170530Ssam	}
638170530Ssam
639170530Ssam	/*
640178354Ssam	 * Add the channels from the ic that are not present
641178354Ssam	 * in the table.
642170530Ssam	 */
643178354Ssam	sweepchannels(ss, vap, table);
644178354Ssam}
645170530Ssam
646178354Ssamstatic const uint16_t rcl1[] =		/* 8 FCC channel: 52, 56, 60, 64, 36, 40, 44, 48 */
647178354Ssam{ 5260, 5280, 5300, 5320, 5180, 5200, 5220, 5240 };
648178354Ssamstatic const uint16_t rcl2[] =		/* 4 MKK channels: 34, 38, 42, 46 */
649178354Ssam{ 5170, 5190, 5210, 5230 };
650178354Ssamstatic const uint16_t rcl3[] =		/* 2.4Ghz ch: 1,6,11,7,13 */
651178354Ssam{ 2412, 2437, 2462, 2442, 2472 };
652178354Ssamstatic const uint16_t rcl4[] =		/* 5 FCC channel: 149, 153, 161, 165 */
653178354Ssam{ 5745, 5765, 5785, 5805, 5825 };
654178354Ssamstatic const uint16_t rcl7[] =		/* 11 ETSI channel: 100,104,108,112,116,120,124,128,132,136,140 */
655178354Ssam{ 5500, 5520, 5540, 5560, 5580, 5600, 5620, 5640, 5660, 5680, 5700 };
656178354Ssamstatic const uint16_t rcl8[] =		/* 2.4Ghz ch: 2,3,4,5,8,9,10,12 */
657178354Ssam{ 2417, 2422, 2427, 2432, 2447, 2452, 2457, 2467 };
658178354Ssamstatic const uint16_t rcl9[] =		/* 2.4Ghz ch: 14 */
659178354Ssam{ 2484 };
660178354Ssamstatic const uint16_t rcl10[] =	/* Added Korean channels 2312-2372 */
661178354Ssam{ 2312, 2317, 2322, 2327, 2332, 2337, 2342, 2347, 2352, 2357, 2362, 2367, 2372 };
662178354Ssamstatic const uint16_t rcl11[] =	/* Added Japan channels in 4.9/5.0 spectrum */
663178354Ssam{ 5040, 5060, 5080, 4920, 4940, 4960, 4980 };
664178354Ssam#ifdef ATH_TURBO_SCAN
665178354Ssamstatic const uint16_t rcl5[] =		/* 3 static turbo channels */
666178354Ssam{ 5210, 5250, 5290 };
667178354Ssamstatic const uint16_t rcl6[] =		/* 2 static turbo channels */
668178354Ssam{ 5760, 5800 };
669178354Ssamstatic const uint16_t rcl6x[] =	/* 4 FCC3 turbo channels */
670178354Ssam{ 5540, 5580, 5620, 5660 };
671178354Ssamstatic const uint16_t rcl12[] =	/* 2.4Ghz Turbo channel 6 */
672178354Ssam{ 2437 };
673178354Ssamstatic const uint16_t rcl13[] =	/* dynamic Turbo channels */
674178354Ssam{ 5200, 5240, 5280, 5765, 5805 };
675178354Ssam#endif /* ATH_TURBO_SCAN */
676170530Ssam
677178354Ssam#define	X(a)	.count = sizeof(a)/sizeof(a[0]), .list = a
678170530Ssam
679178354Ssamstatic const struct scanlist staScanTable[] = {
680178354Ssam	{ IEEE80211_MODE_11B,   	X(rcl3) },
681178354Ssam	{ IEEE80211_MODE_11A,   	X(rcl1) },
682178354Ssam	{ IEEE80211_MODE_11A,   	X(rcl2) },
683178354Ssam	{ IEEE80211_MODE_11B,   	X(rcl8) },
684178354Ssam	{ IEEE80211_MODE_11B,   	X(rcl9) },
685178354Ssam	{ IEEE80211_MODE_11A,   	X(rcl4) },
686178354Ssam#ifdef ATH_TURBO_SCAN
687178354Ssam	{ IEEE80211_MODE_STURBO_A,	X(rcl5) },
688178354Ssam	{ IEEE80211_MODE_STURBO_A,	X(rcl6) },
689178354Ssam	{ IEEE80211_MODE_TURBO_A,	X(rcl6x) },
690178354Ssam	{ IEEE80211_MODE_TURBO_A,	X(rcl13) },
691178354Ssam#endif /* ATH_TURBO_SCAN */
692178354Ssam	{ IEEE80211_MODE_11A,		X(rcl7) },
693178354Ssam	{ IEEE80211_MODE_11B,		X(rcl10) },
694178354Ssam	{ IEEE80211_MODE_11A,		X(rcl11) },
695178354Ssam#ifdef ATH_TURBO_SCAN
696178354Ssam	{ IEEE80211_MODE_TURBO_G,	X(rcl12) },
697178354Ssam#endif /* ATH_TURBO_SCAN */
698178354Ssam	{ .list = NULL }
699178354Ssam};
700178354Ssam
701178354Ssam/*
702178354Ssam * Start a station-mode scan by populating the channel list.
703178354Ssam */
704178354Ssamstatic int
705178354Ssamsta_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
706178354Ssam{
707178354Ssam	struct sta_table *st = ss->ss_priv;
708178354Ssam
709178354Ssam	makescanlist(ss, vap, staScanTable);
710178354Ssam
711178354Ssam	if (ss->ss_mindwell == 0)
712178354Ssam		ss->ss_mindwell = msecs_to_ticks(20);	/* 20ms */
713178354Ssam	if (ss->ss_maxdwell == 0)
714178354Ssam		ss->ss_maxdwell = msecs_to_ticks(200);	/* 200ms */
715178354Ssam
716178354Ssam	st->st_scangen++;
717170530Ssam	st->st_newscan = 1;
718170530Ssam
719170530Ssam	return 0;
720170530Ssam}
721170530Ssam
722170530Ssam/*
723178354Ssam * Restart a scan, typically a bg scan but can
724178354Ssam * also be a fg scan that came up empty.
725170530Ssam */
726170530Ssamstatic int
727178354Ssamsta_restart(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
728170530Ssam{
729170530Ssam	struct sta_table *st = ss->ss_priv;
730170530Ssam
731170530Ssam	st->st_newscan = 1;
732170530Ssam	return 0;
733170530Ssam}
734170530Ssam
735170530Ssam/*
736170530Ssam * Cancel an ongoing scan.
737170530Ssam */
738170530Ssamstatic int
739178354Ssamsta_cancel(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
740170530Ssam{
741170530Ssam	return 0;
742170530Ssam}
743170530Ssam
744184302Ssam/*
745184302Ssam * Demote any supplied 11g channel to 11b.  There should
746184302Ssam * always be an 11b channel but we check anyway...
747184302Ssam */
748184302Ssamstatic struct ieee80211_channel *
749184302Ssamdemote11b(struct ieee80211vap *vap, struct ieee80211_channel *chan)
750184302Ssam{
751184302Ssam	struct ieee80211_channel *c;
752178354Ssam
753184302Ssam	if (IEEE80211_IS_CHAN_ANYG(chan) &&
754184302Ssam	    vap->iv_des_mode == IEEE80211_MODE_AUTO) {
755184302Ssam		c = ieee80211_find_channel(vap->iv_ic, chan->ic_freq,
756184302Ssam		    (chan->ic_flags &~ (IEEE80211_CHAN_PUREG | IEEE80211_CHAN_G)) |
757184302Ssam		    IEEE80211_CHAN_B);
758184302Ssam		if (c != NULL)
759184302Ssam			chan = c;
760184302Ssam	}
761184302Ssam	return chan;
762184302Ssam}
763184302Ssam
764178354Ssamstatic int
765170530Ssammaxrate(const struct ieee80211_scan_entry *se)
766170530Ssam{
767178354Ssam	const struct ieee80211_ie_htcap *htcap =
768178354Ssam	    (const struct ieee80211_ie_htcap *) se->se_ies.htcap_ie;
769219601Sbschmidt	int rmax, r, i, txstream;
770178354Ssam	uint16_t caps;
771219601Sbschmidt	uint8_t txparams;
772170530Ssam
773170530Ssam	rmax = 0;
774178354Ssam	if (htcap != NULL) {
775178354Ssam		/*
776178354Ssam		 * HT station; inspect supported MCS and then adjust
777219601Sbschmidt		 * rate by channel width.
778178354Ssam		 */
779219601Sbschmidt		txparams = htcap->hc_mcsset[12];
780219601Sbschmidt		if (txparams & 0x3) {
781219601Sbschmidt			/*
782219601Sbschmidt			 * TX MCS parameters defined and not equal to RX,
783219601Sbschmidt			 * extract the number of spartial streams and
784219601Sbschmidt			 * map it to the highest MCS rate.
785219601Sbschmidt			 */
786219601Sbschmidt			txstream = ((txparams & 0xc) >> 2) + 1;
787219601Sbschmidt			i = txstream * 8 - 1;
788219601Sbschmidt		} else
789219601Sbschmidt			for (i = 31; i >= 0 && isclr(htcap->hc_mcsset, i); i--);
790178354Ssam		if (i >= 0) {
791298359Savos			caps = le16dec(&htcap->hc_cap);
792219601Sbschmidt			if ((caps & IEEE80211_HTCAP_CHWIDTH40) &&
793219601Sbschmidt			    (caps & IEEE80211_HTCAP_SHORTGI40))
794178354Ssam				rmax = ieee80211_htrates[i].ht40_rate_400ns;
795219601Sbschmidt			else if (caps & IEEE80211_HTCAP_CHWIDTH40)
796219601Sbschmidt				rmax = ieee80211_htrates[i].ht40_rate_800ns;
797219601Sbschmidt			else if (caps & IEEE80211_HTCAP_SHORTGI20)
798219601Sbschmidt				rmax = ieee80211_htrates[i].ht20_rate_400ns;
799178354Ssam			else
800219601Sbschmidt				rmax = ieee80211_htrates[i].ht20_rate_800ns;
801178354Ssam		}
802178354Ssam	}
803170530Ssam	for (i = 0; i < se->se_rates[1]; i++) {
804170530Ssam		r = se->se_rates[2+i] & IEEE80211_RATE_VAL;
805170530Ssam		if (r > rmax)
806170530Ssam			rmax = r;
807170530Ssam	}
808170530Ssam	for (i = 0; i < se->se_xrates[1]; i++) {
809170530Ssam		r = se->se_xrates[2+i] & IEEE80211_RATE_VAL;
810170530Ssam		if (r > rmax)
811170530Ssam			rmax = r;
812170530Ssam	}
813170530Ssam	return rmax;
814170530Ssam}
815170530Ssam
816170530Ssam/*
817170530Ssam * Compare the capabilities of two entries and decide which is
818170530Ssam * more desirable (return >0 if a is considered better).  Note
819170530Ssam * that we assume compatibility/usability has already been checked
820170530Ssam * so we don't need to (e.g. validate whether privacy is supported).
821170530Ssam * Used to select the best scan candidate for association in a BSS.
822170530Ssam */
823170530Ssamstatic int
824170530Ssamsta_compare(const struct sta_entry *a, const struct sta_entry *b)
825170530Ssam{
826170530Ssam#define	PREFER(_a,_b,_what) do {			\
827170530Ssam	if (((_a) ^ (_b)) & (_what))			\
828170530Ssam		return ((_a) & (_what)) ? 1 : -1;	\
829170530Ssam} while (0)
830178354Ssam	int maxa, maxb;
831170530Ssam	int8_t rssia, rssib;
832170530Ssam	int weight;
833170530Ssam
834170530Ssam	/* privacy support */
835170530Ssam	PREFER(a->base.se_capinfo, b->base.se_capinfo,
836170530Ssam		IEEE80211_CAPINFO_PRIVACY);
837170530Ssam
838170530Ssam	/* compare count of previous failures */
839170530Ssam	weight = b->se_fails - a->se_fails;
840170530Ssam	if (abs(weight) > 1)
841170530Ssam		return weight;
842170530Ssam
843170530Ssam	/*
844170530Ssam	 * Compare rssi.  If the two are considered equivalent
845170530Ssam	 * then fallback to other criteria.  We threshold the
846170530Ssam	 * comparisons to avoid selecting an ap purely by rssi
847170530Ssam	 * when both values may be good but one ap is otherwise
848170530Ssam	 * more desirable (e.g. an 11b-only ap with stronger
849170530Ssam	 * signal than an 11g ap).
850170530Ssam	 */
851170530Ssam	rssia = MIN(a->base.se_rssi, STA_RSSI_MAX);
852170530Ssam	rssib = MIN(b->base.se_rssi, STA_RSSI_MAX);
853170530Ssam	if (abs(rssib - rssia) < 5) {
854170530Ssam		/* best/max rate preferred if signal level close enough XXX */
855170530Ssam		maxa = maxrate(&a->base);
856170530Ssam		maxb = maxrate(&b->base);
857170530Ssam		if (maxa != maxb)
858170530Ssam			return maxa - maxb;
859170530Ssam		/* XXX use freq for channel preference */
860170530Ssam		/* for now just prefer 5Ghz band to all other bands */
861178354Ssam		PREFER(IEEE80211_IS_CHAN_5GHZ(a->base.se_chan),
862178354Ssam		       IEEE80211_IS_CHAN_5GHZ(b->base.se_chan), 1);
863170530Ssam	}
864170530Ssam	/* all things being equal, use signal level */
865170530Ssam	return a->base.se_rssi - b->base.se_rssi;
866170530Ssam#undef PREFER
867170530Ssam}
868170530Ssam
869170530Ssam/*
870170530Ssam * Check rate set suitability and return the best supported rate.
871178354Ssam * XXX inspect MCS for HT
872170530Ssam */
873170530Ssamstatic int
874184302Ssamcheck_rate(struct ieee80211vap *vap, const struct ieee80211_channel *chan,
875184302Ssam    const struct ieee80211_scan_entry *se)
876170530Ssam{
877170530Ssam	const struct ieee80211_rateset *srs;
878178354Ssam	int i, j, nrs, r, okrate, badrate, fixedrate, ucastrate;
879170530Ssam	const uint8_t *rs;
880170530Ssam
881178354Ssam	okrate = badrate = 0;
882170530Ssam
883184302Ssam	srs = ieee80211_get_suprates(vap->iv_ic, chan);
884170530Ssam	nrs = se->se_rates[1];
885170530Ssam	rs = se->se_rates+2;
886178354Ssam	/* XXX MCS */
887184302Ssam	ucastrate = vap->iv_txparms[ieee80211_chan2mode(chan)].ucastrate;
888170530Ssam	fixedrate = IEEE80211_FIXED_RATE_NONE;
889170530Ssamagain:
890170530Ssam	for (i = 0; i < nrs; i++) {
891288086Sadrian		r = IEEE80211_RV(rs[i]);
892170530Ssam		badrate = r;
893170530Ssam		/*
894170530Ssam		 * Check any fixed rate is included.
895170530Ssam		 */
896178354Ssam		if (r == ucastrate)
897170530Ssam			fixedrate = r;
898170530Ssam		/*
899170530Ssam		 * Check against our supported rates.
900170530Ssam		 */
901170530Ssam		for (j = 0; j < srs->rs_nrates; j++)
902288086Sadrian			if (r == IEEE80211_RV(srs->rs_rates[j])) {
903170530Ssam				if (r > okrate)		/* NB: track max */
904170530Ssam					okrate = r;
905170530Ssam				break;
906170530Ssam			}
907170530Ssam
908170530Ssam		if (j == srs->rs_nrates && (rs[i] & IEEE80211_RATE_BASIC)) {
909170530Ssam			/*
910170530Ssam			 * Don't try joining a BSS, if we don't support
911170530Ssam			 * one of its basic rates.
912170530Ssam			 */
913170530Ssam			okrate = 0;
914170530Ssam			goto back;
915170530Ssam		}
916170530Ssam	}
917170530Ssam	if (rs == se->se_rates+2) {
918170530Ssam		/* scan xrates too; sort of an algol68-style for loop */
919170530Ssam		nrs = se->se_xrates[1];
920170530Ssam		rs = se->se_xrates+2;
921170530Ssam		goto again;
922170530Ssam	}
923170530Ssam
924170530Ssamback:
925178354Ssam	if (okrate == 0 || ucastrate != fixedrate)
926170530Ssam		return badrate | IEEE80211_RATE_BASIC;
927170530Ssam	else
928288086Sadrian		return IEEE80211_RV(okrate);
929170530Ssam}
930170530Ssam
931195618Srpaulostatic __inline int
932195618Srpaulomatch_id(const uint8_t *ie, const uint8_t *val, int len)
933195618Srpaulo{
934195618Srpaulo	return (ie[1] == len && memcmp(ie+2, val, len) == 0);
935195618Srpaulo}
936195618Srpaulo
937170530Ssamstatic int
938170530Ssammatch_ssid(const uint8_t *ie,
939170530Ssam	int nssid, const struct ieee80211_scan_ssid ssids[])
940170530Ssam{
941170530Ssam	int i;
942170530Ssam
943170530Ssam	for (i = 0; i < nssid; i++) {
944195618Srpaulo		if (match_id(ie, ssids[i].ssid, ssids[i].len))
945170530Ssam			return 1;
946170530Ssam	}
947170530Ssam	return 0;
948170530Ssam}
949170530Ssam
950186904Ssam#ifdef IEEE80211_SUPPORT_TDMA
951186904Ssamstatic int
952186904Ssamtdma_isfull(const struct ieee80211_tdma_param *tdma)
953186904Ssam{
954186904Ssam	int slot, slotcnt;
955186904Ssam
956186904Ssam	slotcnt = tdma->tdma_slotcnt;
957186904Ssam	for (slot = slotcnt-1; slot >= 0; slot--)
958186904Ssam		if (isclr(tdma->tdma_inuse, slot))
959186904Ssam			return 0;
960186904Ssam	return 1;
961186904Ssam}
962186904Ssam#endif /* IEEE80211_SUPPORT_TDMA */
963186904Ssam
964170530Ssam/*
965170530Ssam * Test a scan candidate for suitability/compatibility.
966170530Ssam */
967170530Ssamstatic int
968178354Ssammatch_bss(struct ieee80211vap *vap,
969170530Ssam	const struct ieee80211_scan_state *ss, struct sta_entry *se0,
970170530Ssam	int debug)
971170530Ssam{
972178354Ssam	struct ieee80211com *ic = vap->iv_ic;
973170530Ssam	struct ieee80211_scan_entry *se = &se0->base;
974178354Ssam        uint8_t rate;
975178354Ssam        int fail;
976170530Ssam
977170530Ssam	fail = 0;
978170530Ssam	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, se->se_chan)))
979171409Ssam		fail |= MATCH_CHANNEL;
980170530Ssam	/*
981170530Ssam	 * NB: normally the desired mode is used to construct
982170530Ssam	 * the channel list, but it's possible for the scan
983170530Ssam	 * cache to include entries for stations outside this
984170530Ssam	 * list so we check the desired mode here to weed them
985170530Ssam	 * out.
986170530Ssam	 */
987178354Ssam	if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
988170530Ssam	    (se->se_chan->ic_flags & IEEE80211_CHAN_ALLTURBO) !=
989178354Ssam	    chanflags[vap->iv_des_mode])
990171409Ssam		fail |= MATCH_CHANNEL;
991178354Ssam	if (vap->iv_opmode == IEEE80211_M_IBSS) {
992170530Ssam		if ((se->se_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
993171409Ssam			fail |= MATCH_CAPINFO;
994186904Ssam#ifdef IEEE80211_SUPPORT_TDMA
995186904Ssam	} else if (vap->iv_opmode == IEEE80211_M_AHDEMO) {
996186904Ssam		/*
997186904Ssam		 * Adhoc demo network setup shouldn't really be scanning
998186904Ssam		 * but just in case skip stations operating in IBSS or
999186904Ssam		 * BSS mode.
1000186904Ssam		 */
1001186904Ssam		if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS))
1002186904Ssam			fail |= MATCH_CAPINFO;
1003186904Ssam		/*
1004186904Ssam		 * TDMA operation cannot coexist with a normal 802.11 network;
1005186904Ssam		 * skip if IBSS or ESS capabilities are marked and require
1006186904Ssam		 * the beacon have a TDMA ie present.
1007186904Ssam		 */
1008186904Ssam		if (vap->iv_caps & IEEE80211_C_TDMA) {
1009186904Ssam			const struct ieee80211_tdma_param *tdma =
1010186904Ssam			    (const struct ieee80211_tdma_param *)se->se_ies.tdma_ie;
1011189980Ssam			const struct ieee80211_tdma_state *ts = vap->iv_tdma;
1012186904Ssam
1013186904Ssam			if (tdma == NULL)
1014186904Ssam				fail |= MATCH_TDMA_NOIE;
1015189980Ssam			else if (tdma->tdma_version != ts->tdma_version)
1016189980Ssam				fail |= MATCH_TDMA_VERSION;
1017186904Ssam			else if (tdma->tdma_slot != 0)
1018186904Ssam				fail |= MATCH_TDMA_NOTMASTER;
1019186904Ssam			else if (tdma_isfull(tdma))
1020186904Ssam				fail |= MATCH_TDMA_NOSLOT;
1021186904Ssam#if 0
1022186904Ssam			else if (ieee80211_local_address(se->se_macaddr))
1023186904Ssam				fail |= MATCH_TDMA_LOCAL;
1024186904Ssam#endif
1025186904Ssam		}
1026186904Ssam#endif /* IEEE80211_SUPPORT_TDMA */
1027195618Srpaulo#ifdef IEEE80211_SUPPORT_MESH
1028195618Srpaulo	} else if (vap->iv_opmode == IEEE80211_M_MBSS) {
1029195618Srpaulo		const struct ieee80211_mesh_state *ms = vap->iv_mesh;
1030195618Srpaulo		/*
1031195618Srpaulo		 * Mesh nodes have IBSS & ESS bits in capinfo turned off
1032195618Srpaulo		 * and two special ie's that must be present.
1033195618Srpaulo		 */
1034195618Srpaulo		if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS))
1035195618Srpaulo			fail |= MATCH_CAPINFO;
1036215699Sbschmidt		else if (se->se_meshid[0] != IEEE80211_ELEMID_MESHID)
1037195618Srpaulo			fail |= MATCH_MESH_NOID;
1038195618Srpaulo		else if (ms->ms_idlen != 0 &&
1039195618Srpaulo		    match_id(se->se_meshid, ms->ms_id, ms->ms_idlen))
1040195618Srpaulo			fail |= MATCH_MESHID;
1041196005Ssam#endif
1042170530Ssam	} else {
1043170530Ssam		if ((se->se_capinfo & IEEE80211_CAPINFO_ESS) == 0)
1044171409Ssam			fail |= MATCH_CAPINFO;
1045178354Ssam		/*
1046178354Ssam		 * If 11d is enabled and we're attempting to join a bss
1047178354Ssam		 * that advertises it's country code then compare our
1048178354Ssam		 * current settings to what we fetched from the country ie.
1049178354Ssam		 * If our country code is unspecified or different then do
1050178354Ssam		 * not attempt to join the bss.  We should have already
1051178354Ssam		 * dispatched an event to user space that identifies the
1052178354Ssam		 * new country code so our regdomain config should match.
1053178354Ssam		 */
1054178354Ssam		if ((IEEE80211_IS_CHAN_11D(se->se_chan) ||
1055178354Ssam		    (vap->iv_flags_ext & IEEE80211_FEXT_DOTD)) &&
1056178354Ssam		    se->se_cc[0] != 0 &&
1057178354Ssam		    (ic->ic_regdomain.country == CTRY_DEFAULT ||
1058178354Ssam		     !isocmp(se->se_cc, ic->ic_regdomain.isocc)))
1059178354Ssam			fail |= MATCH_CC;
1060170530Ssam	}
1061178354Ssam	if (vap->iv_flags & IEEE80211_F_PRIVACY) {
1062170530Ssam		if ((se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
1063171409Ssam			fail |= MATCH_PRIVACY;
1064170530Ssam	} else {
1065170530Ssam		/* XXX does this mean privacy is supported or required? */
1066170530Ssam		if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY)
1067171409Ssam			fail |= MATCH_PRIVACY;
1068170530Ssam	}
1069184302Ssam	se0->se_flags &= ~STA_DEMOTE11B;
1070184302Ssam	rate = check_rate(vap, se->se_chan, se);
1071184302Ssam	if (rate & IEEE80211_RATE_BASIC) {
1072171409Ssam		fail |= MATCH_RATE;
1073184302Ssam		/*
1074184302Ssam		 * An 11b-only ap will give a rate mismatch if there is an
1075184302Ssam		 * OFDM fixed tx rate for 11g.  Try downgrading the channel
1076184302Ssam		 * in the scan list to 11b and retry the rate check.
1077184302Ssam		 */
1078184302Ssam		if (IEEE80211_IS_CHAN_ANYG(se->se_chan)) {
1079184302Ssam			rate = check_rate(vap, demote11b(vap, se->se_chan), se);
1080184302Ssam			if ((rate & IEEE80211_RATE_BASIC) == 0) {
1081184302Ssam				fail &= ~MATCH_RATE;
1082184302Ssam				se0->se_flags |= STA_DEMOTE11B;
1083184302Ssam			}
1084184302Ssam		}
1085184302Ssam	} else if (rate < 2*24) {
1086184302Ssam		/*
1087184302Ssam		 * This is an 11b-only ap.  Check the desired mode in
1088184302Ssam		 * case that needs to be honored (mode 11g filters out
1089184302Ssam		 * 11b-only ap's).  Otherwise force any 11g channel used
1090184302Ssam		 * in scanning to be demoted.
1091184302Ssam		 *
1092184302Ssam		 * NB: we cheat a bit here by looking at the max rate;
1093184302Ssam		 *     we could/should check the rates.
1094184302Ssam		 */
1095184302Ssam		if (!(vap->iv_des_mode == IEEE80211_MODE_AUTO ||
1096184302Ssam		      vap->iv_des_mode == IEEE80211_MODE_11B))
1097184302Ssam			fail |= MATCH_RATE;
1098184302Ssam		else
1099184302Ssam			se0->se_flags |= STA_DEMOTE11B;
1100184302Ssam	}
1101170530Ssam	if (ss->ss_nssid != 0 &&
1102171409Ssam	    !match_ssid(se->se_ssid, ss->ss_nssid, ss->ss_ssid))
1103171409Ssam		fail |= MATCH_SSID;
1104178354Ssam	if ((vap->iv_flags & IEEE80211_F_DESBSSID) &&
1105178354Ssam	    !IEEE80211_ADDR_EQ(vap->iv_des_bssid, se->se_bssid))
1106178354Ssam		fail |= MATCH_BSSID;
1107170530Ssam	if (se0->se_fails >= STA_FAILS_MAX)
1108171409Ssam		fail |= MATCH_FAILS;
1109170530Ssam	if (se0->se_notseen >= STA_PURGE_SCANS)
1110171409Ssam		fail |= MATCH_NOTSEEN;
1111170530Ssam	if (se->se_rssi < STA_RSSI_MIN)
1112171409Ssam		fail |= MATCH_RSSI;
1113170530Ssam#ifdef IEEE80211_DEBUG
1114178354Ssam	if (ieee80211_msg(vap, debug)) {
1115170530Ssam		printf(" %c %s",
1116171409Ssam		    fail & MATCH_FAILS ? '=' :
1117171409Ssam		    fail & MATCH_NOTSEEN ? '^' :
1118178354Ssam		    fail & MATCH_CC ? '$' :
1119186904Ssam#ifdef IEEE80211_SUPPORT_TDMA
1120186904Ssam		    fail & MATCH_TDMA_NOIE ? '&' :
1121189980Ssam		    fail & MATCH_TDMA_VERSION ? 'v' :
1122189980Ssam		    fail & MATCH_TDMA_NOTMASTER ? 's' :
1123189980Ssam		    fail & MATCH_TDMA_NOSLOT ? 'f' :
1124189980Ssam		    fail & MATCH_TDMA_LOCAL ? 'l' :
1125186904Ssam#endif
1126195618Srpaulo		    fail & MATCH_MESH_NOID ? 'm' :
1127171409Ssam		    fail ? '-' : '+', ether_sprintf(se->se_macaddr));
1128170530Ssam		printf(" %s%c", ether_sprintf(se->se_bssid),
1129171409Ssam		    fail & MATCH_BSSID ? '!' : ' ');
1130170530Ssam		printf(" %3d%c", ieee80211_chan2ieee(ic, se->se_chan),
1131171409Ssam			fail & MATCH_CHANNEL ? '!' : ' ');
1132171409Ssam		printf(" %+4d%c", se->se_rssi, fail & MATCH_RSSI ? '!' : ' ');
1133170530Ssam		printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
1134171409Ssam		    fail & MATCH_RATE ? '!' : ' ');
1135170530Ssam		printf(" %4s%c",
1136170530Ssam		    (se->se_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
1137189980Ssam		    (se->se_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" : "",
1138171409Ssam		    fail & MATCH_CAPINFO ? '!' : ' ');
1139170530Ssam		printf(" %3s%c ",
1140170530Ssam		    (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) ?
1141170530Ssam		    "wep" : "no",
1142171409Ssam		    fail & MATCH_PRIVACY ? '!' : ' ');
1143170530Ssam		ieee80211_print_essid(se->se_ssid+2, se->se_ssid[1]);
1144195618Srpaulo		printf("%s\n", fail & (MATCH_SSID | MATCH_MESHID) ? "!" : "");
1145170530Ssam	}
1146170530Ssam#endif
1147170530Ssam	return fail;
1148170530Ssam}
1149170530Ssam
1150170530Ssamstatic void
1151170530Ssamsta_update_notseen(struct sta_table *st)
1152170530Ssam{
1153170530Ssam	struct sta_entry *se;
1154170530Ssam
1155206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
1156170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list) {
1157170530Ssam		/*
1158170530Ssam		 * If seen the reset and don't bump the count;
1159170530Ssam		 * otherwise bump the ``not seen'' count.  Note
1160170530Ssam		 * that this insures that stations for which we
1161170530Ssam		 * see frames while not scanning but not during
1162170530Ssam		 * this scan will not be penalized.
1163170530Ssam		 */
1164170530Ssam		if (se->se_seen)
1165170530Ssam			se->se_seen = 0;
1166170530Ssam		else
1167170530Ssam			se->se_notseen++;
1168170530Ssam	}
1169206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
1170170530Ssam}
1171170530Ssam
1172170530Ssamstatic void
1173170530Ssamsta_dec_fails(struct sta_table *st)
1174170530Ssam{
1175170530Ssam	struct sta_entry *se;
1176170530Ssam
1177206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
1178170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list)
1179170530Ssam		if (se->se_fails)
1180170530Ssam			se->se_fails--;
1181206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
1182170530Ssam}
1183170530Ssam
1184170530Ssamstatic struct sta_entry *
1185178354Ssamselect_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap, int debug)
1186170530Ssam{
1187170530Ssam	struct sta_table *st = ss->ss_priv;
1188170530Ssam	struct sta_entry *se, *selbs = NULL;
1189170530Ssam
1190178354Ssam	IEEE80211_DPRINTF(vap, debug, " %s\n",
1191170530Ssam	    "macaddr          bssid         chan  rssi  rate flag  wep  essid");
1192206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
1193170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list) {
1194184275Ssam		ieee80211_ies_expand(&se->base.se_ies);
1195178354Ssam		if (match_bss(vap, ss, se, debug) == 0) {
1196170530Ssam			if (selbs == NULL)
1197170530Ssam				selbs = se;
1198170530Ssam			else if (sta_compare(se, selbs) > 0)
1199170530Ssam				selbs = se;
1200170530Ssam		}
1201170530Ssam	}
1202206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
1203170530Ssam
1204170530Ssam	return selbs;
1205170530Ssam}
1206170530Ssam
1207170530Ssam/*
1208170530Ssam * Pick an ap or ibss network to join or find a channel
1209170530Ssam * to use to start an ibss network.
1210170530Ssam */
1211170530Ssamstatic int
1212178354Ssamsta_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1213170530Ssam{
1214170530Ssam	struct sta_table *st = ss->ss_priv;
1215170530Ssam	struct sta_entry *selbs;
1216184274Ssam	struct ieee80211_channel *chan;
1217170530Ssam
1218178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_STA,
1219178354Ssam		("wrong mode %u", vap->iv_opmode));
1220170530Ssam
1221170530Ssam	if (st->st_newscan) {
1222170530Ssam		sta_update_notseen(st);
1223170530Ssam		st->st_newscan = 0;
1224170530Ssam	}
1225170530Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
1226170530Ssam		/*
1227170530Ssam		 * Manual/background scan, don't select+join the
1228170530Ssam		 * bss, just return.  The scanning framework will
1229170530Ssam		 * handle notification that this has completed.
1230170530Ssam		 */
1231170530Ssam		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
1232170530Ssam		return 1;
1233170530Ssam	}
1234170530Ssam	/*
1235170530Ssam	 * Automatic sequencing; look for a candidate and
1236170530Ssam	 * if found join the network.
1237170530Ssam	 */
1238170530Ssam	/* NB: unlocked read should be ok */
1239170530Ssam	if (TAILQ_FIRST(&st->st_entry) == NULL) {
1240178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
1241170530Ssam			"%s: no scan candidate\n", __func__);
1242178354Ssam		if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1243178354Ssam			return 0;
1244170530Ssamnotfound:
1245170530Ssam		/*
1246170530Ssam		 * If nothing suitable was found decrement
1247170530Ssam		 * the failure counts so entries will be
1248170530Ssam		 * reconsidered the next time around.  We
1249170530Ssam		 * really want to do this only for sta's
1250170530Ssam		 * where we've previously had some success.
1251170530Ssam		 */
1252170530Ssam		sta_dec_fails(st);
1253170530Ssam		st->st_newscan = 1;
1254170530Ssam		return 0;			/* restart scan */
1255170530Ssam	}
1256178354Ssam	selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
1257178354Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1258178354Ssam		return (selbs != NULL);
1259184274Ssam	if (selbs == NULL)
1260170530Ssam		goto notfound;
1261184274Ssam	chan = selbs->base.se_chan;
1262184302Ssam	if (selbs->se_flags & STA_DEMOTE11B)
1263184302Ssam		chan = demote11b(vap, chan);
1264184274Ssam	if (!ieee80211_sta_join(vap, chan, &selbs->base))
1265184274Ssam		goto notfound;
1266170530Ssam	return 1;				/* terminate scan */
1267170530Ssam}
1268170530Ssam
1269170530Ssam/*
1270170530Ssam * Lookup an entry in the scan cache.  We assume we're
1271170530Ssam * called from the bottom half or such that we don't need
1272170530Ssam * to block the bottom half so that it's safe to return
1273170530Ssam * a reference to an entry w/o holding the lock on the table.
1274170530Ssam */
1275170530Ssamstatic struct sta_entry *
1276170530Ssamsta_lookup(struct sta_table *st, const uint8_t macaddr[IEEE80211_ADDR_LEN])
1277170530Ssam{
1278170530Ssam	struct sta_entry *se;
1279170530Ssam	int hash = STA_HASH(macaddr);
1280170530Ssam
1281206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
1282170530Ssam	LIST_FOREACH(se, &st->st_hash[hash], se_hash)
1283170530Ssam		if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr))
1284170530Ssam			break;
1285206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
1286170530Ssam
1287170530Ssam	return se;		/* NB: unlocked */
1288170530Ssam}
1289170530Ssam
1290170530Ssamstatic void
1291178354Ssamsta_roam_check(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1292170530Ssam{
1293178354Ssam	struct ieee80211com *ic = vap->iv_ic;
1294178354Ssam	struct ieee80211_node *ni = vap->iv_bss;
1295170530Ssam	struct sta_table *st = ss->ss_priv;
1296178354Ssam	enum ieee80211_phymode mode;
1297170530Ssam	struct sta_entry *se, *selbs;
1298178354Ssam	uint8_t roamRate, curRate, ucastRate;
1299170530Ssam	int8_t roamRssi, curRssi;
1300170530Ssam
1301170530Ssam	se = sta_lookup(st, ni->ni_macaddr);
1302170530Ssam	if (se == NULL) {
1303170530Ssam		/* XXX something is wrong */
1304170530Ssam		return;
1305170530Ssam	}
1306170530Ssam
1307178354Ssam	mode = ieee80211_chan2mode(ic->ic_bsschan);
1308178354Ssam	roamRate = vap->iv_roamparms[mode].rate;
1309178354Ssam	roamRssi = vap->iv_roamparms[mode].rssi;
1310178354Ssam	ucastRate = vap->iv_txparms[mode].ucastrate;
1311170530Ssam	/* NB: the most up to date rssi is in the node, not the scan cache */
1312170530Ssam	curRssi = ic->ic_node_getrssi(ni);
1313178354Ssam	if (ucastRate == IEEE80211_FIXED_RATE_NONE) {
1314178354Ssam		curRate = ni->ni_txrate;
1315178354Ssam		roamRate &= IEEE80211_RATE_VAL;
1316178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ROAM,
1317170530Ssam		    "%s: currssi %d currate %u roamrssi %d roamrate %u\n",
1318170530Ssam		    __func__, curRssi, curRate, roamRssi, roamRate);
1319170530Ssam	} else {
1320170530Ssam		curRate = roamRate;	/* NB: insure compare below fails */
1321178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ROAM,
1322170530Ssam		    "%s: currssi %d roamrssi %d\n", __func__, curRssi, roamRssi);
1323170530Ssam	}
1324170530Ssam	/*
1325170530Ssam	 * Check if a new ap should be used and switch.
1326170530Ssam	 * XXX deauth current ap
1327170530Ssam	 */
1328170530Ssam	if (curRate < roamRate || curRssi < roamRssi) {
1329297405Sadrian		if (ieee80211_time_after(ticks, ic->ic_lastscan + vap->iv_scanvalid)) {
1330170530Ssam			/*
1331170530Ssam			 * Scan cache contents are too old; force a scan now
1332170530Ssam			 * if possible so we have current state to make a
1333170530Ssam			 * decision with.  We don't kick off a bg scan if
1334170530Ssam			 * we're using dynamic turbo and boosted or if the
1335170530Ssam			 * channel is busy.
1336170530Ssam			 * XXX force immediate switch on scan complete
1337170530Ssam			 */
1338170530Ssam			if (!IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1339297405Sadrian			    ieee80211_time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle))
1340178354Ssam				ieee80211_bg_scan(vap, 0);
1341170530Ssam			return;
1342170530Ssam		}
1343170530Ssam		se->base.se_rssi = curRssi;
1344178354Ssam		selbs = select_bss(ss, vap, IEEE80211_MSG_ROAM);
1345170530Ssam		if (selbs != NULL && selbs != se) {
1346184274Ssam			struct ieee80211_channel *chan;
1347184274Ssam
1348178354Ssam			IEEE80211_DPRINTF(vap,
1349170530Ssam			    IEEE80211_MSG_ROAM | IEEE80211_MSG_DEBUG,
1350170530Ssam			    "%s: ROAM: curRate %u, roamRate %u, "
1351170530Ssam			    "curRssi %d, roamRssi %d\n", __func__,
1352170530Ssam			    curRate, roamRate, curRssi, roamRssi);
1353184274Ssam
1354184274Ssam			chan = selbs->base.se_chan;
1355184302Ssam			if (selbs->se_flags & STA_DEMOTE11B)
1356184302Ssam				chan = demote11b(vap, chan);
1357184274Ssam			(void) ieee80211_sta_join(vap, chan, &selbs->base);
1358170530Ssam		}
1359170530Ssam	}
1360170530Ssam}
1361170530Ssam
1362170530Ssam/*
1363170530Ssam * Age entries in the scan cache.
1364170530Ssam * XXX also do roaming since it's convenient
1365170530Ssam */
1366170530Ssamstatic void
1367170530Ssamsta_age(struct ieee80211_scan_state *ss)
1368170530Ssam{
1369178354Ssam	struct ieee80211vap *vap = ss->ss_vap;
1370170530Ssam
1371178354Ssam	adhoc_age(ss);
1372170530Ssam	/*
1373170530Ssam	 * If rate control is enabled check periodically to see if
1374170530Ssam	 * we should roam from our current connection to one that
1375170530Ssam	 * might be better.  This only applies when we're operating
1376170530Ssam	 * in sta mode and automatic roaming is set.
1377170530Ssam	 * XXX defer if busy
1378170530Ssam	 * XXX repeater station
1379170530Ssam	 * XXX do when !bgscan?
1380170530Ssam	 */
1381178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_STA,
1382178354Ssam		("wrong mode %u", vap->iv_opmode));
1383178354Ssam	if (vap->iv_roaming == IEEE80211_ROAMING_AUTO &&
1384213321Sadrian	    (vap->iv_flags & IEEE80211_F_BGSCAN) &&
1385178354Ssam	    vap->iv_state >= IEEE80211_S_RUN)
1386170530Ssam		/* XXX vap is implicit */
1387178354Ssam		sta_roam_check(ss, vap);
1388170530Ssam}
1389170530Ssam
1390170530Ssam/*
1391170530Ssam * Iterate over the entries in the scan cache, invoking
1392170530Ssam * the callback function on each one.
1393170530Ssam */
1394170530Ssamstatic void
1395170530Ssamsta_iterate(struct ieee80211_scan_state *ss,
1396170530Ssam	ieee80211_scan_iter_func *f, void *arg)
1397170530Ssam{
1398170530Ssam	struct sta_table *st = ss->ss_priv;
1399170530Ssam	struct sta_entry *se;
1400170530Ssam	u_int gen;
1401170530Ssam
1402283556Sadrian	IEEE80211_SCAN_ITER_LOCK(st);
1403178354Ssam	gen = st->st_scaniter++;
1404170530Ssamrestart:
1405206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
1406170530Ssam	TAILQ_FOREACH(se, &st->st_entry, se_list) {
1407170530Ssam		if (se->se_scangen != gen) {
1408170530Ssam			se->se_scangen = gen;
1409170530Ssam			/* update public state */
1410170530Ssam			se->base.se_age = ticks - se->se_lastupdate;
1411206617Srpaulo			IEEE80211_SCAN_TABLE_UNLOCK(st);
1412170530Ssam			(*f)(arg, &se->base);
1413170530Ssam			goto restart;
1414170530Ssam		}
1415170530Ssam	}
1416206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
1417170530Ssam
1418283556Sadrian	IEEE80211_SCAN_ITER_UNLOCK(st);
1419170530Ssam}
1420170530Ssam
1421170530Ssamstatic void
1422170530Ssamsta_assoc_fail(struct ieee80211_scan_state *ss,
1423170530Ssam	const uint8_t macaddr[IEEE80211_ADDR_LEN], int reason)
1424170530Ssam{
1425170530Ssam	struct sta_table *st = ss->ss_priv;
1426170530Ssam	struct sta_entry *se;
1427170530Ssam
1428170530Ssam	se = sta_lookup(st, macaddr);
1429170530Ssam	if (se != NULL) {
1430170530Ssam		se->se_fails++;
1431170530Ssam		se->se_lastfail = ticks;
1432178354Ssam		IEEE80211_NOTE_MAC(ss->ss_vap, IEEE80211_MSG_SCAN,
1433170530Ssam		    macaddr, "%s: reason %u fails %u",
1434170530Ssam		    __func__, reason, se->se_fails);
1435170530Ssam	}
1436170530Ssam}
1437170530Ssam
1438170530Ssamstatic void
1439170530Ssamsta_assoc_success(struct ieee80211_scan_state *ss,
1440170530Ssam	const uint8_t macaddr[IEEE80211_ADDR_LEN])
1441170530Ssam{
1442170530Ssam	struct sta_table *st = ss->ss_priv;
1443170530Ssam	struct sta_entry *se;
1444170530Ssam
1445170530Ssam	se = sta_lookup(st, macaddr);
1446170530Ssam	if (se != NULL) {
1447170530Ssam#if 0
1448170530Ssam		se->se_fails = 0;
1449178354Ssam		IEEE80211_NOTE_MAC(ss->ss_vap, IEEE80211_MSG_SCAN,
1450170530Ssam		    macaddr, "%s: fails %u",
1451170530Ssam		    __func__, se->se_fails);
1452170530Ssam#endif
1453170530Ssam		se->se_lastassoc = ticks;
1454170530Ssam	}
1455170530Ssam}
1456170530Ssam
1457170530Ssamstatic const struct ieee80211_scanner sta_default = {
1458170530Ssam	.scan_name		= "default",
1459170530Ssam	.scan_attach		= sta_attach,
1460170530Ssam	.scan_detach		= sta_detach,
1461170530Ssam	.scan_start		= sta_start,
1462170530Ssam	.scan_restart		= sta_restart,
1463170530Ssam	.scan_cancel		= sta_cancel,
1464170530Ssam	.scan_end		= sta_pick_bss,
1465170530Ssam	.scan_flush		= sta_flush,
1466170530Ssam	.scan_add		= sta_add,
1467170530Ssam	.scan_age		= sta_age,
1468170530Ssam	.scan_iterate		= sta_iterate,
1469170530Ssam	.scan_assoc_fail	= sta_assoc_fail,
1470170530Ssam	.scan_assoc_success	= sta_assoc_success,
1471170530Ssam};
1472195618SrpauloIEEE80211_SCANNER_ALG(sta, IEEE80211_M_STA, sta_default);
1473170530Ssam
1474170530Ssam/*
1475170530Ssam * Adhoc mode-specific support.
1476170530Ssam */
1477170530Ssam
1478170530Ssamstatic const uint16_t adhocWorld[] =		/* 36, 40, 44, 48 */
1479170530Ssam{ 5180, 5200, 5220, 5240 };
1480170530Ssamstatic const uint16_t adhocFcc3[] =		/* 36, 40, 44, 48 145, 149, 153, 157, 161, 165 */
1481170530Ssam{ 5180, 5200, 5220, 5240, 5725, 5745, 5765, 5785, 5805, 5825 };
1482170530Ssamstatic const uint16_t adhocMkk[] =		/* 34, 38, 42, 46 */
1483170530Ssam{ 5170, 5190, 5210, 5230 };
1484170530Ssamstatic const uint16_t adhoc11b[] =		/* 10, 11 */
1485170530Ssam{ 2457, 2462 };
1486170530Ssam
1487170530Ssamstatic const struct scanlist adhocScanTable[] = {
1488170530Ssam	{ IEEE80211_MODE_11B,   	X(adhoc11b) },
1489170530Ssam	{ IEEE80211_MODE_11A,   	X(adhocWorld) },
1490170530Ssam	{ IEEE80211_MODE_11A,   	X(adhocFcc3) },
1491170530Ssam	{ IEEE80211_MODE_11B,   	X(adhocMkk) },
1492170530Ssam	{ .list = NULL }
1493170530Ssam};
1494170530Ssam#undef X
1495170530Ssam
1496170530Ssam/*
1497170530Ssam * Start an adhoc-mode scan by populating the channel list.
1498170530Ssam */
1499170530Ssamstatic int
1500178354Ssamadhoc_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1501170530Ssam{
1502170530Ssam	struct sta_table *st = ss->ss_priv;
1503170530Ssam
1504178354Ssam	makescanlist(ss, vap, adhocScanTable);
1505176653Ssam
1506178354Ssam	if (ss->ss_mindwell == 0)
1507178354Ssam		ss->ss_mindwell = msecs_to_ticks(200);	/* 200ms */
1508178354Ssam	if (ss->ss_maxdwell == 0)
1509178354Ssam		ss->ss_maxdwell = msecs_to_ticks(200);	/* 200ms */
1510176653Ssam
1511178354Ssam	st->st_scangen++;
1512170530Ssam	st->st_newscan = 1;
1513170530Ssam
1514170530Ssam	return 0;
1515170530Ssam}
1516170530Ssam
1517170530Ssam/*
1518170530Ssam * Select a channel to start an adhoc network on.
1519170530Ssam * The channel list was populated with appropriate
1520170530Ssam * channels so select one that looks least occupied.
1521170530Ssam */
1522170530Ssamstatic struct ieee80211_channel *
1523178354Ssamadhoc_pick_channel(struct ieee80211_scan_state *ss, int flags)
1524170530Ssam{
1525170530Ssam	struct sta_table *st = ss->ss_priv;
1526170530Ssam	struct sta_entry *se;
1527170530Ssam	struct ieee80211_channel *c, *bestchan;
1528170530Ssam	int i, bestrssi, maxrssi;
1529170530Ssam
1530170530Ssam	bestchan = NULL;
1531170530Ssam	bestrssi = -1;
1532170530Ssam
1533206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
1534170530Ssam	for (i = 0; i < ss->ss_last; i++) {
1535170530Ssam		c = ss->ss_chans[i];
1536178354Ssam		/* never consider a channel with radar */
1537178354Ssam		if (IEEE80211_IS_CHAN_RADAR(c))
1538176653Ssam			continue;
1539178354Ssam		/* skip channels disallowed by regulatory settings */
1540178354Ssam		if (IEEE80211_IS_CHAN_NOADHOC(c))
1541178354Ssam			continue;
1542178354Ssam		/* check channel attributes for band compatibility */
1543178354Ssam		if (flags != 0 && (c->ic_flags & flags) != flags)
1544178354Ssam			continue;
1545170530Ssam		maxrssi = 0;
1546170530Ssam		TAILQ_FOREACH(se, &st->st_entry, se_list) {
1547170530Ssam			if (se->base.se_chan != c)
1548170530Ssam				continue;
1549170530Ssam			if (se->base.se_rssi > maxrssi)
1550170530Ssam				maxrssi = se->base.se_rssi;
1551170530Ssam		}
1552170530Ssam		if (bestchan == NULL || maxrssi < bestrssi)
1553170530Ssam			bestchan = c;
1554170530Ssam	}
1555206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
1556170530Ssam
1557170530Ssam	return bestchan;
1558170530Ssam}
1559170530Ssam
1560170530Ssam/*
1561170530Ssam * Pick an ibss network to join or find a channel
1562170530Ssam * to use to start an ibss network.
1563170530Ssam */
1564170530Ssamstatic int
1565178354Ssamadhoc_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1566170530Ssam{
1567170530Ssam	struct sta_table *st = ss->ss_priv;
1568170530Ssam	struct sta_entry *selbs;
1569170530Ssam	struct ieee80211_channel *chan;
1570245928Sadrian	struct ieee80211com *ic = vap->iv_ic;
1571170530Ssam
1572178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_IBSS ||
1573195618Srpaulo		vap->iv_opmode == IEEE80211_M_AHDEMO ||
1574195618Srpaulo		vap->iv_opmode == IEEE80211_M_MBSS,
1575178354Ssam		("wrong opmode %u", vap->iv_opmode));
1576170530Ssam
1577170530Ssam	if (st->st_newscan) {
1578170530Ssam		sta_update_notseen(st);
1579170530Ssam		st->st_newscan = 0;
1580170530Ssam	}
1581170530Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
1582170530Ssam		/*
1583170530Ssam		 * Manual/background scan, don't select+join the
1584170530Ssam		 * bss, just return.  The scanning framework will
1585170530Ssam		 * handle notification that this has completed.
1586170530Ssam		 */
1587170530Ssam		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
1588170530Ssam		return 1;
1589170530Ssam	}
1590170530Ssam	/*
1591170530Ssam	 * Automatic sequencing; look for a candidate and
1592170530Ssam	 * if found join the network.
1593170530Ssam	 */
1594170530Ssam	/* NB: unlocked read should be ok */
1595170530Ssam	if (TAILQ_FIRST(&st->st_entry) == NULL) {
1596178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
1597170530Ssam			"%s: no scan candidate\n", __func__);
1598178354Ssam		if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1599178354Ssam			return 0;
1600170530Ssamnotfound:
1601186904Ssam		/* NB: never auto-start a tdma network for slot !0 */
1602186904Ssam#ifdef IEEE80211_SUPPORT_TDMA
1603186904Ssam		if (vap->iv_des_nssid &&
1604186904Ssam		    ((vap->iv_caps & IEEE80211_C_TDMA) == 0 ||
1605186904Ssam		     ieee80211_tdma_getslot(vap) == 0)) {
1606186904Ssam#else
1607178354Ssam		if (vap->iv_des_nssid) {
1608186904Ssam#endif
1609170530Ssam			/*
1610170530Ssam			 * No existing adhoc network to join and we have
1611170530Ssam			 * an ssid; start one up.  If no channel was
1612170530Ssam			 * specified, try to select a channel.
1613170530Ssam			 */
1614178354Ssam			if (vap->iv_des_chan == IEEE80211_CHAN_ANYC ||
1615178354Ssam			    IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
1616183421Ssam				chan = adhoc_pick_channel(ss, 0);
1617178354Ssam			} else
1618178354Ssam				chan = vap->iv_des_chan;
1619170530Ssam			if (chan != NULL) {
1620245928Sadrian				/*
1621245928Sadrian				 * Create a HT capable IBSS; the per-node
1622245928Sadrian				 * probe request/response will result in
1623245928Sadrian				 * "correct" rate control capabilities being
1624245928Sadrian				 * negotiated.
1625245928Sadrian				 */
1626245928Sadrian				chan = ieee80211_ht_adjust_channel(ic,
1627245928Sadrian				    chan, vap->iv_flags_ht);
1628178354Ssam				ieee80211_create_ibss(vap, chan);
1629170530Ssam				return 1;
1630170530Ssam			}
1631170530Ssam		}
1632170530Ssam		/*
1633170530Ssam		 * If nothing suitable was found decrement
1634170530Ssam		 * the failure counts so entries will be
1635170530Ssam		 * reconsidered the next time around.  We
1636170530Ssam		 * really want to do this only for sta's
1637170530Ssam		 * where we've previously had some success.
1638170530Ssam		 */
1639170530Ssam		sta_dec_fails(st);
1640170530Ssam		st->st_newscan = 1;
1641170530Ssam		return 0;			/* restart scan */
1642170530Ssam	}
1643178354Ssam	selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
1644178354Ssam	if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1645178354Ssam		return (selbs != NULL);
1646184274Ssam	if (selbs == NULL)
1647170530Ssam		goto notfound;
1648184274Ssam	chan = selbs->base.se_chan;
1649184302Ssam	if (selbs->se_flags & STA_DEMOTE11B)
1650184302Ssam		chan = demote11b(vap, chan);
1651245928Sadrian	/*
1652245928Sadrian	 * If HT is available, make it a possibility here.
1653245928Sadrian	 * The intent is to enable HT20/HT40 when joining a non-HT
1654245928Sadrian	 * IBSS node; we can then advertise HT IEs and speak HT
1655245928Sadrian	 * to any subsequent nodes that support it.
1656245928Sadrian	 */
1657245928Sadrian	chan = ieee80211_ht_adjust_channel(ic,
1658245928Sadrian	    chan, vap->iv_flags_ht);
1659184274Ssam	if (!ieee80211_sta_join(vap, chan, &selbs->base))
1660184274Ssam		goto notfound;
1661170530Ssam	return 1;				/* terminate scan */
1662170530Ssam}
1663170530Ssam
1664170530Ssam/*
1665170530Ssam * Age entries in the scan cache.
1666170530Ssam */
1667170530Ssamstatic void
1668170530Ssamadhoc_age(struct ieee80211_scan_state *ss)
1669170530Ssam{
1670170530Ssam	struct sta_table *st = ss->ss_priv;
1671170530Ssam	struct sta_entry *se, *next;
1672170530Ssam
1673206617Srpaulo	IEEE80211_SCAN_TABLE_LOCK(st);
1674170530Ssam	TAILQ_FOREACH_SAFE(se, &st->st_entry, se_list, next) {
1675170530Ssam		if (se->se_notseen > STA_PURGE_SCANS) {
1676170530Ssam			TAILQ_REMOVE(&st->st_entry, se, se_list);
1677170530Ssam			LIST_REMOVE(se, se_hash);
1678178354Ssam			ieee80211_ies_cleanup(&se->base.se_ies);
1679283538Sadrian			IEEE80211_FREE(se, M_80211_SCAN);
1680170530Ssam		}
1681170530Ssam	}
1682206617Srpaulo	IEEE80211_SCAN_TABLE_UNLOCK(st);
1683170530Ssam}
1684170530Ssam
1685170530Ssamstatic const struct ieee80211_scanner adhoc_default = {
1686170530Ssam	.scan_name		= "default",
1687170530Ssam	.scan_attach		= sta_attach,
1688170530Ssam	.scan_detach		= sta_detach,
1689170530Ssam	.scan_start		= adhoc_start,
1690170530Ssam	.scan_restart		= sta_restart,
1691170530Ssam	.scan_cancel		= sta_cancel,
1692170530Ssam	.scan_end		= adhoc_pick_bss,
1693170530Ssam	.scan_flush		= sta_flush,
1694178354Ssam	.scan_pickchan		= adhoc_pick_channel,
1695170530Ssam	.scan_add		= sta_add,
1696170530Ssam	.scan_age		= adhoc_age,
1697170530Ssam	.scan_iterate		= sta_iterate,
1698170530Ssam	.scan_assoc_fail	= sta_assoc_fail,
1699170530Ssam	.scan_assoc_success	= sta_assoc_success,
1700170530Ssam};
1701195618SrpauloIEEE80211_SCANNER_ALG(ibss, IEEE80211_M_IBSS, adhoc_default);
1702195618SrpauloIEEE80211_SCANNER_ALG(ahdemo, IEEE80211_M_AHDEMO, adhoc_default);
1703170530Ssam
1704178354Ssamstatic int
1705178354Ssamap_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1706178354Ssam{
1707178354Ssam	struct sta_table *st = ss->ss_priv;
1708178354Ssam
1709178354Ssam	makescanlist(ss, vap, staScanTable);
1710178354Ssam
1711178354Ssam	if (ss->ss_mindwell == 0)
1712178354Ssam		ss->ss_mindwell = msecs_to_ticks(200);	/* 200ms */
1713178354Ssam	if (ss->ss_maxdwell == 0)
1714178354Ssam		ss->ss_maxdwell = msecs_to_ticks(200);	/* 200ms */
1715178354Ssam
1716178354Ssam	st->st_scangen++;
1717178354Ssam	st->st_newscan = 1;
1718178354Ssam
1719178354Ssam	return 0;
1720178354Ssam}
1721178354Ssam
1722170530Ssam/*
1723178354Ssam * Cancel an ongoing scan.
1724170530Ssam */
1725170530Ssamstatic int
1726178354Ssamap_cancel(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1727170530Ssam{
1728178354Ssam	return 0;
1729178354Ssam}
1730178354Ssam
1731178354Ssam/*
1732178354Ssam * Pick a quiet channel to use for ap operation.
1733178354Ssam */
1734178354Ssamstatic struct ieee80211_channel *
1735178354Ssamap_pick_channel(struct ieee80211_scan_state *ss, int flags)
1736178354Ssam{
1737178354Ssam	struct sta_table *st = ss->ss_priv;
1738178354Ssam	struct ieee80211_channel *bestchan = NULL;
1739178354Ssam	int i;
1740178354Ssam
1741178354Ssam	/* XXX select channel more intelligently, e.g. channel spread, power */
1742178354Ssam	/* NB: use scan list order to preserve channel preference */
1743178354Ssam	for (i = 0; i < ss->ss_last; i++) {
1744178354Ssam		struct ieee80211_channel *chan = ss->ss_chans[i];
1745178354Ssam		/*
1746178354Ssam		 * If the channel is unoccupied the max rssi
1747178354Ssam		 * should be zero; just take it.  Otherwise
1748178354Ssam		 * track the channel with the lowest rssi and
1749178354Ssam		 * use that when all channels appear occupied.
1750178354Ssam		 */
1751178354Ssam		if (IEEE80211_IS_CHAN_RADAR(chan))
1752178354Ssam			continue;
1753178354Ssam		if (IEEE80211_IS_CHAN_NOHOSTAP(chan))
1754178354Ssam			continue;
1755178354Ssam		/* check channel attributes for band compatibility */
1756178354Ssam		if (flags != 0 && (chan->ic_flags & flags) != flags)
1757178354Ssam			continue;
1758186107Ssam		KASSERT(sizeof(chan->ic_ieee) == 1, ("ic_chan size"));
1759178354Ssam		/* XXX channel have interference */
1760178354Ssam		if (st->st_maxrssi[chan->ic_ieee] == 0) {
1761178354Ssam			/* XXX use other considerations */
1762178354Ssam			return chan;
1763170530Ssam		}
1764178354Ssam		if (bestchan == NULL ||
1765178354Ssam		    st->st_maxrssi[chan->ic_ieee] < st->st_maxrssi[bestchan->ic_ieee])
1766178354Ssam			bestchan = chan;
1767178354Ssam	}
1768178354Ssam	return bestchan;
1769178354Ssam}
1770178354Ssam
1771178354Ssam/*
1772178354Ssam * Pick a quiet channel to use for ap operation.
1773178354Ssam */
1774178354Ssamstatic int
1775178354Ssamap_end(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1776178354Ssam{
1777178354Ssam	struct ieee80211com *ic = vap->iv_ic;
1778178354Ssam	struct ieee80211_channel *bestchan;
1779178354Ssam
1780178354Ssam	KASSERT(vap->iv_opmode == IEEE80211_M_HOSTAP,
1781178354Ssam		("wrong opmode %u", vap->iv_opmode));
1782178354Ssam	bestchan = ap_pick_channel(ss, 0);
1783178354Ssam	if (bestchan == NULL) {
1784178354Ssam		/* no suitable channel, should not happen */
1785178354Ssam		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
1786178354Ssam		    "%s: no suitable channel! (should not happen)\n", __func__);
1787178354Ssam		/* XXX print something? */
1788178354Ssam		return 0;			/* restart scan */
1789178354Ssam	}
1790178354Ssam	/*
1791178354Ssam	 * If this is a dynamic turbo channel, start with the unboosted one.
1792178354Ssam	 */
1793178354Ssam	if (IEEE80211_IS_CHAN_TURBO(bestchan)) {
1794178354Ssam		bestchan = ieee80211_find_channel(ic, bestchan->ic_freq,
1795178354Ssam			bestchan->ic_flags & ~IEEE80211_CHAN_TURBO);
1796178354Ssam		if (bestchan == NULL) {
1797178354Ssam			/* should never happen ?? */
1798178354Ssam			return 0;
1799170530Ssam		}
1800170530Ssam	}
1801178354Ssam	if (ss->ss_flags & (IEEE80211_SCAN_NOPICK | IEEE80211_SCAN_NOJOIN)) {
1802178354Ssam		/*
1803178354Ssam		 * Manual/background scan, don't select+join the
1804178354Ssam		 * bss, just return.  The scanning framework will
1805178354Ssam		 * handle notification that this has completed.
1806178354Ssam		 */
1807178354Ssam		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
1808178354Ssam		return 1;
1809178354Ssam	}
1810178354Ssam	ieee80211_create_ibss(vap,
1811193655Ssam	    ieee80211_ht_adjust_channel(ic, bestchan, vap->iv_flags_ht));
1812178354Ssam	return 1;
1813170530Ssam}
1814170530Ssam
1815178354Ssamstatic const struct ieee80211_scanner ap_default = {
1816178354Ssam	.scan_name		= "default",
1817178354Ssam	.scan_attach		= sta_attach,
1818178354Ssam	.scan_detach		= sta_detach,
1819178354Ssam	.scan_start		= ap_start,
1820178354Ssam	.scan_restart		= sta_restart,
1821178354Ssam	.scan_cancel		= ap_cancel,
1822178354Ssam	.scan_end		= ap_end,
1823178354Ssam	.scan_flush		= sta_flush,
1824178354Ssam	.scan_pickchan		= ap_pick_channel,
1825178354Ssam	.scan_add		= sta_add,
1826178354Ssam	.scan_age		= adhoc_age,
1827178354Ssam	.scan_iterate		= sta_iterate,
1828178354Ssam	.scan_assoc_success	= sta_assoc_success,
1829178354Ssam	.scan_assoc_fail	= sta_assoc_fail,
1830170530Ssam};
1831195618SrpauloIEEE80211_SCANNER_ALG(ap, IEEE80211_M_HOSTAP, ap_default);
1832178354Ssam
1833195618Srpaulo#ifdef IEEE80211_SUPPORT_MESH
1834178354Ssam/*
1835195618Srpaulo * Pick an mbss network to join or find a channel
1836195618Srpaulo * to use to start an mbss network.
1837178354Ssam */
1838195618Srpaulostatic int
1839195618Srpaulomesh_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
1840195618Srpaulo{
1841195618Srpaulo	struct sta_table *st = ss->ss_priv;
1842195618Srpaulo	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1843195618Srpaulo	struct sta_entry *selbs;
1844195618Srpaulo	struct ieee80211_channel *chan;
1845195618Srpaulo
1846195618Srpaulo	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS,
1847195618Srpaulo		("wrong opmode %u", vap->iv_opmode));
1848195618Srpaulo
1849195618Srpaulo	if (st->st_newscan) {
1850195618Srpaulo		sta_update_notseen(st);
1851195618Srpaulo		st->st_newscan = 0;
1852195618Srpaulo	}
1853195618Srpaulo	if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
1854195618Srpaulo		/*
1855195618Srpaulo		 * Manual/background scan, don't select+join the
1856195618Srpaulo		 * bss, just return.  The scanning framework will
1857195618Srpaulo		 * handle notification that this has completed.
1858195618Srpaulo		 */
1859195618Srpaulo		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
1860195618Srpaulo		return 1;
1861195618Srpaulo	}
1862195618Srpaulo	/*
1863195618Srpaulo	 * Automatic sequencing; look for a candidate and
1864195618Srpaulo	 * if found join the network.
1865195618Srpaulo	 */
1866195618Srpaulo	/* NB: unlocked read should be ok */
1867195618Srpaulo	if (TAILQ_FIRST(&st->st_entry) == NULL) {
1868195618Srpaulo		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
1869195618Srpaulo			"%s: no scan candidate\n", __func__);
1870195618Srpaulo		if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1871195618Srpaulo			return 0;
1872195618Srpaulonotfound:
1873195618Srpaulo		if (ms->ms_idlen != 0) {
1874195618Srpaulo			/*
1875195618Srpaulo			 * No existing mbss network to join and we have
1876195618Srpaulo			 * a meshid; start one up.  If no channel was
1877195618Srpaulo			 * specified, try to select a channel.
1878195618Srpaulo			 */
1879195618Srpaulo			if (vap->iv_des_chan == IEEE80211_CHAN_ANYC ||
1880195618Srpaulo			    IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
1881195618Srpaulo				struct ieee80211com *ic = vap->iv_ic;
1882195618Srpaulo
1883195618Srpaulo				chan = adhoc_pick_channel(ss, 0);
1884195618Srpaulo				if (chan != NULL)
1885195618Srpaulo					chan = ieee80211_ht_adjust_channel(ic,
1886195618Srpaulo					    chan, vap->iv_flags_ht);
1887195618Srpaulo			} else
1888195618Srpaulo				chan = vap->iv_des_chan;
1889195618Srpaulo			if (chan != NULL) {
1890195618Srpaulo				ieee80211_create_ibss(vap, chan);
1891195618Srpaulo				return 1;
1892195618Srpaulo			}
1893195618Srpaulo		}
1894195618Srpaulo		/*
1895195618Srpaulo		 * If nothing suitable was found decrement
1896195618Srpaulo		 * the failure counts so entries will be
1897195618Srpaulo		 * reconsidered the next time around.  We
1898195618Srpaulo		 * really want to do this only for sta's
1899195618Srpaulo		 * where we've previously had some success.
1900195618Srpaulo		 */
1901195618Srpaulo		sta_dec_fails(st);
1902195618Srpaulo		st->st_newscan = 1;
1903195618Srpaulo		return 0;			/* restart scan */
1904195618Srpaulo	}
1905195618Srpaulo	selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
1906195618Srpaulo	if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
1907195618Srpaulo		return (selbs != NULL);
1908195618Srpaulo	if (selbs == NULL)
1909195618Srpaulo		goto notfound;
1910195618Srpaulo	chan = selbs->base.se_chan;
1911195618Srpaulo	if (selbs->se_flags & STA_DEMOTE11B)
1912195618Srpaulo		chan = demote11b(vap, chan);
1913195618Srpaulo	if (!ieee80211_sta_join(vap, chan, &selbs->base))
1914195618Srpaulo		goto notfound;
1915195618Srpaulo	return 1;				/* terminate scan */
1916195618Srpaulo}
1917195618Srpaulo
1918195618Srpaulostatic const struct ieee80211_scanner mesh_default = {
1919195618Srpaulo	.scan_name		= "default",
1920195618Srpaulo	.scan_attach		= sta_attach,
1921195618Srpaulo	.scan_detach		= sta_detach,
1922195618Srpaulo	.scan_start		= adhoc_start,
1923195618Srpaulo	.scan_restart		= sta_restart,
1924195618Srpaulo	.scan_cancel		= sta_cancel,
1925195618Srpaulo	.scan_end		= mesh_pick_bss,
1926195618Srpaulo	.scan_flush		= sta_flush,
1927195618Srpaulo	.scan_pickchan		= adhoc_pick_channel,
1928195618Srpaulo	.scan_add		= sta_add,
1929195618Srpaulo	.scan_age		= adhoc_age,
1930195618Srpaulo	.scan_iterate		= sta_iterate,
1931195618Srpaulo	.scan_assoc_fail	= sta_assoc_fail,
1932195618Srpaulo	.scan_assoc_success	= sta_assoc_success,
1933195618Srpaulo};
1934195618SrpauloIEEE80211_SCANNER_ALG(mesh, IEEE80211_M_MBSS, mesh_default);
1935195618Srpaulo#endif /* IEEE80211_SUPPORT_MESH */
1936