1 /*-
2 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_scan_sta.c,v 1.16 2008/10/26 21:56:27 sam Exp $");
28
29 /*
30 * IEEE 802.11 station scanning support.
31 */
32 #include "opt_wlan.h"
33
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/kernel.h>
37 #include <sys/module.h>
38
39 #include <sys/socket.h>
40
41 #include <net/if.h>
42 #include <net/if_media.h>
43 #include <net/ethernet.h>
44
45 #include <net80211/ieee80211_var.h>
46 #include <net80211/ieee80211_input.h>
47 #include <net80211/ieee80211_regdomain.h>
48
49 #include <net/bpf.h>
50
51 /*
52 * Parameters for managing cache entries:
53 *
54 * o a station with STA_FAILS_MAX failures is not considered
55 * when picking a candidate
56 * o a station that hasn't had an update in STA_PURGE_SCANS
57 * (background) scans is discarded
58 * o after STA_FAILS_AGE seconds we clear the failure count
59 */
60 #define STA_FAILS_MAX 2 /* assoc failures before ignored */
61 #define STA_FAILS_AGE (2*60) /* time before clearing fails (secs) */
62 #define STA_PURGE_SCANS 2 /* age for purging entries (scans) */
63
64 /* XXX tunable */
65 #define STA_RSSI_MIN 8 /* min acceptable rssi */
66 #define STA_RSSI_MAX 40 /* max rssi for comparison */
67
68 struct sta_entry {
69 struct ieee80211_scan_entry base;
70 TAILQ_ENTRY(sta_entry) se_list;
71 LIST_ENTRY(sta_entry) se_hash;
72 uint8_t se_fails; /* failure to associate count */
73 uint8_t se_seen; /* seen during current scan */
74 uint8_t se_notseen; /* not seen in previous scans */
75 uint8_t se_flags;
76 #define STA_DEMOTE11B 0x01 /* match w/ demoted 11b chan */
77 uint32_t se_avgrssi; /* LPF rssi state */
78 unsigned long se_lastupdate; /* time of last update */
79 unsigned long se_lastfail; /* time of last failure */
80 unsigned long se_lastassoc; /* time of last association */
81 u_int se_scangen; /* iterator scan gen# */
82 u_int se_countrygen; /* gen# of last cc notify */
83 };
84
85 #define STA_HASHSIZE 32
86 /* simple hash is enough for variation of macaddr */
87 #define STA_HASH(addr) \
88 (((const uint8_t *)(addr))[IEEE80211_ADDR_LEN - 1] % STA_HASHSIZE)
89
90 struct sta_table {
91 struct mtx st_lock; /* on scan table */
92 TAILQ_HEAD(, sta_entry) st_entry; /* all entries */
93 LIST_HEAD(, sta_entry) st_hash[STA_HASHSIZE];
94 struct mtx st_scanlock; /* on st_scaniter */
95 u_int st_scaniter; /* gen# for iterator */
96 u_int st_scangen; /* scan generation # */
97 int st_newscan;
98 /* ap-related state */
99 int st_maxrssi[IEEE80211_CHAN_MAX];
100 };
101
102 static void sta_flush_table(struct sta_table *);
103 /*
104 * match_bss returns a bitmask describing if an entry is suitable
105 * for use. If non-zero the entry was deemed not suitable and it's
106 * contents explains why. The following flags are or'd to to this
107 * mask and can be used to figure out why the entry was rejected.
108 */
109 #define MATCH_CHANNEL 0x0001 /* channel mismatch */
110 #define MATCH_CAPINFO 0x0002 /* capabilities mismatch, e.g. no ess */
111 #define MATCH_PRIVACY 0x0004 /* privacy mismatch */
112 #define MATCH_RATE 0x0008 /* rate set mismatch */
113 #define MATCH_SSID 0x0010 /* ssid mismatch */
114 #define MATCH_BSSID 0x0020 /* bssid mismatch */
115 #define MATCH_FAILS 0x0040 /* too many failed auth attempts */
116 #define MATCH_NOTSEEN 0x0080 /* not seen in recent scans */
117 #define MATCH_RSSI 0x0100 /* rssi deemed too low to use */
118 #define MATCH_CC 0x0200 /* country code mismatch */
119 static int match_bss(struct ieee80211vap *,
120 const struct ieee80211_scan_state *, struct sta_entry *, int);
121 static void adhoc_age(struct ieee80211_scan_state *);
122
123 static __inline int
124 isocmp(const uint8_t cc1[], const uint8_t cc2[])
125 {
126 return (cc1[0] == cc2[0] && cc1[1] == cc2[1]);
127 }
128
129 /* number of references from net80211 layer */
130 static int nrefs = 0;
131
132 /*
133 * Attach prior to any scanning work.
134 */
135 static int
136 sta_attach(struct ieee80211_scan_state *ss)
137 {
138 struct sta_table *st;
139
140 MALLOC(st, struct sta_table *, sizeof(struct sta_table),
141 M_80211_SCAN, M_NOWAIT | M_ZERO);
142 if (st == NULL)
143 return 0;
144 mtx_init(&st->st_lock, "scantable", "802.11 scan table", MTX_DEF);
145 mtx_init(&st->st_scanlock, "scangen", "802.11 scangen", MTX_DEF);
146 TAILQ_INIT(&st->st_entry);
147 ss->ss_priv = st;
148 nrefs++; /* NB: we assume caller locking */
149 return 1;
150 }
151
152 /*
153 * Cleanup any private state.
154 */
155 static int
156 sta_detach(struct ieee80211_scan_state *ss)
157 {
158 struct sta_table *st = ss->ss_priv;
159
160 if (st != NULL) {
161 sta_flush_table(st);
162 mtx_destroy(&st->st_lock);
163 mtx_destroy(&st->st_scanlock);
164 FREE(st, M_80211_SCAN);
165 KASSERT(nrefs > 0, ("imbalanced attach/detach"));
166 nrefs--; /* NB: we assume caller locking */
167 }
168 return 1;
169 }
170
171 /*
172 * Flush all per-scan state.
173 */
174 static int
175 sta_flush(struct ieee80211_scan_state *ss)
176 {
177 struct sta_table *st = ss->ss_priv;
178
179 mtx_lock(&st->st_lock);
180 sta_flush_table(st);
181 mtx_unlock(&st->st_lock);
182 ss->ss_last = 0;
183 return 0;
184 }
185
186 /*
187 * Flush all entries in the scan cache.
188 */
189 static void
190 sta_flush_table(struct sta_table *st)
191 {
192 struct sta_entry *se, *next;
193
194 TAILQ_FOREACH_SAFE(se, &st->st_entry, se_list, next) {
195 TAILQ_REMOVE(&st->st_entry, se, se_list);
196 LIST_REMOVE(se, se_hash);
197 ieee80211_ies_cleanup(&se->base.se_ies);
198 FREE(se, M_80211_SCAN);
199 }
200 memset(st->st_maxrssi, 0, sizeof(st->st_maxrssi));
201 }
202
203 /*
204 * Process a beacon or probe response frame; create an
205 * entry in the scan cache or update any previous entry.
206 */
207 static int
208 sta_add(struct ieee80211_scan_state *ss,
209 const struct ieee80211_scanparams *sp,
210 const struct ieee80211_frame *wh,
211 int subtype, int rssi, int noise, int rstamp)
212 {
213 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
214 #define PICK1ST(_ss) \
215 ((ss->ss_flags & (IEEE80211_SCAN_PICK1ST | IEEE80211_SCAN_GOTPICK)) == \
216 IEEE80211_SCAN_PICK1ST)
217 struct sta_table *st = ss->ss_priv;
218 const uint8_t *macaddr = wh->i_addr2;
219 struct ieee80211vap *vap = ss->ss_vap;
220 struct ieee80211com *ic = vap->iv_ic;
221 struct sta_entry *se;
222 struct ieee80211_scan_entry *ise;
223 int hash;
224
225 hash = STA_HASH(macaddr);
226
227 mtx_lock(&st->st_lock);
228 LIST_FOREACH(se, &st->st_hash[hash], se_hash)
229 if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr))
230 goto found;
231 MALLOC(se, struct sta_entry *, sizeof(struct sta_entry),
232 M_80211_SCAN, M_NOWAIT | M_ZERO);
233 if (se == NULL) {
234 mtx_unlock(&st->st_lock);
235 return 0;
236 }
237 se->se_scangen = st->st_scaniter-1;
238 se->se_avgrssi = IEEE80211_RSSI_DUMMY_MARKER;
239 IEEE80211_ADDR_COPY(se->base.se_macaddr, macaddr);
240 TAILQ_INSERT_TAIL(&st->st_entry, se, se_list);
241 LIST_INSERT_HEAD(&st->st_hash[hash], se, se_hash);
242 found:
243 ise = &se->base;
244 /* XXX ap beaconing multiple ssid w/ same bssid */
245 if (sp->ssid[1] != 0 &&
246 (ISPROBE(subtype) || ise->se_ssid[1] == 0))
247 memcpy(ise->se_ssid, sp->ssid, 2+sp->ssid[1]);
248 KASSERT(sp->rates[1] <= IEEE80211_RATE_MAXSIZE,
249 ("rate set too large: %u", sp->rates[1]));
250 memcpy(ise->se_rates, sp->rates, 2+sp->rates[1]);
251 if (sp->xrates != NULL) {
252 /* XXX validate xrates[1] */
253 KASSERT(sp->xrates[1] <= IEEE80211_RATE_MAXSIZE,
254 ("xrate set too large: %u", sp->xrates[1]));
255 memcpy(ise->se_xrates, sp->xrates, 2+sp->xrates[1]);
256 } else
257 ise->se_xrates[1] = 0;
258 IEEE80211_ADDR_COPY(ise->se_bssid, wh->i_addr3);
259 if ((sp->status & IEEE80211_BPARSE_OFFCHAN) == 0) {
260 /*
261 * Record rssi data using extended precision LPF filter.
262 *
263 * NB: use only on-channel data to insure we get a good
264 * estimate of the signal we'll see when associated.
265 */
266 IEEE80211_RSSI_LPF(se->se_avgrssi, rssi);
267 ise->se_rssi = IEEE80211_RSSI_GET(se->se_avgrssi);
268 ise->se_noise = noise;
269 }
270 ise->se_rstamp = rstamp;
271 memcpy(ise->se_tstamp.data, sp->tstamp, sizeof(ise->se_tstamp));
272 ise->se_intval = sp->bintval;
273 ise->se_capinfo = sp->capinfo;
274 /*
275 * Beware of overriding se_chan for frames seen
276 * off-channel; this can cause us to attempt an
277 * association on the wrong channel.
278 */
279 if (sp->status & IEEE80211_BPARSE_OFFCHAN) {
280 struct ieee80211_channel *c;
281 /*
282 * Off-channel, locate the home/bss channel for the sta
283 * using the value broadcast in the DSPARMS ie. We know
284 * sp->chan has this value because it's used to calculate
285 * IEEE80211_BPARSE_OFFCHAN.
286 */
287 c = ieee80211_find_channel_byieee(ic, sp->chan,
288 ic->ic_curchan->ic_flags);
289 if (c != NULL) {
290 ise->se_chan = c;
291 } else if (ise->se_chan == NULL) {
292 /* should not happen, pick something */
293 ise->se_chan = ic->ic_curchan;
294 }
295 } else
296 ise->se_chan = ic->ic_curchan;
297 ise->se_fhdwell = sp->fhdwell;
298 ise->se_fhindex = sp->fhindex;
299 ise->se_erp = sp->erp;
300 ise->se_timoff = sp->timoff;
301 if (sp->tim != NULL) {
302 const struct ieee80211_tim_ie *tim =
303 (const struct ieee80211_tim_ie *) sp->tim;
304 ise->se_dtimperiod = tim->tim_period;
305 }
306 if (sp->country != NULL) {
307 const struct ieee80211_country_ie *cie =
308 (const struct ieee80211_country_ie *) sp->country;
309 /*
310 * If 11d is enabled and we're attempting to join a bss
311 * that advertises it's country code then compare our
312 * current settings to what we fetched from the country ie.
313 * If our country code is unspecified or different then
314 * dispatch an event to user space that identifies the
315 * country code so our regdomain config can be changed.
316 */
317 /* XXX only for STA mode? */
318 if ((IEEE80211_IS_CHAN_11D(ise->se_chan) ||
319 (vap->iv_flags_ext & IEEE80211_FEXT_DOTD)) &&
320 (ic->ic_regdomain.country == CTRY_DEFAULT ||
321 !isocmp(cie->cc, ic->ic_regdomain.isocc))) {
322 /* only issue one notify event per scan */
323 if (se->se_countrygen != st->st_scangen) {
324 ieee80211_notify_country(vap, ise->se_bssid,
325 cie->cc);
326 se->se_countrygen = st->st_scangen;
327 }
328 }
329 ise->se_cc[0] = cie->cc[0];
330 ise->se_cc[1] = cie->cc[1];
331 }
332 /* NB: no need to setup ie ptrs; they are not (currently) used */
333 (void) ieee80211_ies_init(&ise->se_ies, sp->ies, sp->ies_len);
334
335 /* clear failure count after STA_FAIL_AGE passes */
336 if (se->se_fails && (ticks - se->se_lastfail) > STA_FAILS_AGE*hz) {
337 se->se_fails = 0;
338 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_SCAN, macaddr,
339 "%s: fails %u", __func__, se->se_fails);
340 }
341
342 se->se_lastupdate = ticks; /* update time */
343 se->se_seen = 1;
344 se->se_notseen = 0;
345
346 if (rssi > st->st_maxrssi[sp->bchan])
347 st->st_maxrssi[sp->bchan] = rssi;
348
349 mtx_unlock(&st->st_lock);
350
351 /*
352 * If looking for a quick choice and nothing's
353 * been found check here.
354 */
355 if (PICK1ST(ss) && match_bss(vap, ss, se, IEEE80211_MSG_SCAN) == 0)
356 ss->ss_flags |= IEEE80211_SCAN_GOTPICK;
357
358 return 1;
359 #undef PICK1ST
360 #undef ISPROBE
361 }
362
363 /*
364 * Check if a channel is excluded by user request.
365 */
366 static int
367 isexcluded(struct ieee80211vap *vap, const struct ieee80211_channel *c)
368 {
369 return (isclr(vap->iv_ic->ic_chan_active, c->ic_ieee) ||
370 (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
371 c->ic_freq != vap->iv_des_chan->ic_freq));
372 }
373
374 static struct ieee80211_channel *
375 find11gchannel(struct ieee80211com *ic, int i, int freq)
376 {
377 struct ieee80211_channel *c;
378 int j;
379
380 /*
381 * The normal ordering in the channel list is b channel
382 * immediately followed by g so optimize the search for
383 * this. We'll still do a full search just in case.
384 */
385 for (j = i+1; j < ic->ic_nchans; j++) {
386 c = &ic->ic_channels[j];
387 if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
388 return c;
389 }
390 for (j = 0; j < i; j++) {
391 c = &ic->ic_channels[j];
392 if (c->ic_freq == freq && IEEE80211_IS_CHAN_ANYG(c))
393 return c;
394 }
395 return NULL;
396 }
397 static const u_int chanflags[IEEE80211_MODE_MAX] = {
398 IEEE80211_CHAN_B, /* IEEE80211_MODE_AUTO */
399 IEEE80211_CHAN_A, /* IEEE80211_MODE_11A */
400 IEEE80211_CHAN_B, /* IEEE80211_MODE_11B */
401 IEEE80211_CHAN_G, /* IEEE80211_MODE_11G */
402 IEEE80211_CHAN_FHSS, /* IEEE80211_MODE_FH */
403 IEEE80211_CHAN_A, /* IEEE80211_MODE_TURBO_A (check base channel)*/
404 IEEE80211_CHAN_G, /* IEEE80211_MODE_TURBO_G */
405 IEEE80211_CHAN_ST, /* IEEE80211_MODE_STURBO_A */
406 IEEE80211_CHAN_A, /* IEEE80211_MODE_11NA (check legacy) */
407 IEEE80211_CHAN_G, /* IEEE80211_MODE_11NG (check legacy) */
408 };
409
410 static void
411 add_channels(struct ieee80211vap *vap,
412 struct ieee80211_scan_state *ss,
413 enum ieee80211_phymode mode, const uint16_t freq[], int nfreq)
414 {
415 #define N(a) (sizeof(a) / sizeof(a[0]))
416 struct ieee80211com *ic = vap->iv_ic;
417 struct ieee80211_channel *c, *cg;
418 u_int modeflags;
419 int i;
420
421 KASSERT(mode < N(chanflags), ("Unexpected mode %u", mode));
422 modeflags = chanflags[mode];
423 for (i = 0; i < nfreq; i++) {
424 if (ss->ss_last >= IEEE80211_SCAN_MAX)
425 break;
426
427 c = ieee80211_find_channel(ic, freq[i], modeflags);
428 if (c == NULL || isexcluded(vap, c))
429 continue;
430 if (mode == IEEE80211_MODE_AUTO) {
431 /*
432 * XXX special-case 11b/g channels so we select
433 * the g channel if both are present.
434 */
435 if (IEEE80211_IS_CHAN_B(c) &&
436 (cg = find11gchannel(ic, i, c->ic_freq)) != NULL)
437 c = cg;
438 }
439 ss->ss_chans[ss->ss_last++] = c;
440 }
441 #undef N
442 }
443
444 struct scanlist {
445 uint16_t mode;
446 uint16_t count;
447 const uint16_t *list;
448 };
449
450 static int
451 checktable(const struct scanlist *scan, const struct ieee80211_channel *c)
452 {
453 int i;
454
455 for (; scan->list != NULL; scan++) {
456 for (i = 0; i < scan->count; i++)
457 if (scan->list[i] == c->ic_freq)
458 return 1;
459 }
460 return 0;
461 }
462
463 static void
464 sweepchannels(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
465 const struct scanlist table[])
466 {
467 struct ieee80211com *ic = vap->iv_ic;
468 struct ieee80211_channel *c;
469 int i;
470
471 for (i = 0; i < ic->ic_nchans; i++) {
472 if (ss->ss_last >= IEEE80211_SCAN_MAX)
473 break;
474
475 c = &ic->ic_channels[i];
476 /*
477 * Ignore dynamic turbo channels; we scan them
478 * in normal mode (i.e. not boosted). Likewise
479 * for HT channels, they get scanned using
480 * legacy rates.
481 */
482 if (IEEE80211_IS_CHAN_DTURBO(c) || IEEE80211_IS_CHAN_HT(c))
483 continue;
484
485 /*
486 * If a desired mode was specified, scan only
487 * channels that satisfy that constraint.
488 */
489 if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
490 vap->iv_des_mode != ieee80211_chan2mode(c))
491 continue;
492
493 /*
494 * Skip channels excluded by user request.
495 */
496 if (isexcluded(vap, c))
497 continue;
498
499 /*
500 * Add the channel unless it is listed in the
501 * fixed scan order tables. This insures we
502 * don't sweep back in channels we filtered out
503 * above.
504 */
505 if (checktable(table, c))
506 continue;
507
508 /* Add channel to scanning list. */
509 ss->ss_chans[ss->ss_last++] = c;
510 }
511 }
512
513 static void
514 makescanlist(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
515 const struct scanlist table[])
516 {
517 const struct scanlist *scan;
518 enum ieee80211_phymode mode;
519
520 ss->ss_last = 0;
521 /*
522 * Use the table of ordered channels to construct the list
523 * of channels for scanning. Any channels in the ordered
524 * list not in the master list will be discarded.
525 */
526 for (scan = table; scan->list != NULL; scan++) {
527 mode = scan->mode;
528 if (vap->iv_des_mode != IEEE80211_MODE_AUTO) {
529 /*
530 * If a desired mode was specified, scan only
531 * channels that satisfy that constraint.
532 */
533 if (vap->iv_des_mode != mode) {
534 /*
535 * The scan table marks 2.4Ghz channels as b
536 * so if the desired mode is 11g, then use
537 * the 11b channel list but upgrade the mode.
538 */
539 if (vap->iv_des_mode != IEEE80211_MODE_11G ||
540 mode != IEEE80211_MODE_11B)
541 continue;
542 mode = IEEE80211_MODE_11G; /* upgrade */
543 }
544 } else {
545 /*
546 * This lets add_channels upgrade an 11b channel
547 * to 11g if available.
548 */
549 if (mode == IEEE80211_MODE_11B)
550 mode = IEEE80211_MODE_AUTO;
551 }
552 #ifdef IEEE80211_F_XR
553 /* XR does not operate on turbo channels */
554 if ((vap->iv_flags & IEEE80211_F_XR) &&
555 (mode == IEEE80211_MODE_TURBO_A ||
556 mode == IEEE80211_MODE_TURBO_G ||
557 mode == IEEE80211_MODE_STURBO_A))
558 continue;
559 #endif
560 /*
561 * Add the list of the channels; any that are not
562 * in the master channel list will be discarded.
563 */
564 add_channels(vap, ss, mode, scan->list, scan->count);
565 }
566
567 /*
568 * Add the channels from the ic that are not present
569 * in the table.
570 */
571 sweepchannels(ss, vap, table);
572 }
573
574 static const uint16_t rcl1[] = /* 8 FCC channel: 52, 56, 60, 64, 36, 40, 44, 48 */
575 { 5260, 5280, 5300, 5320, 5180, 5200, 5220, 5240 };
576 static const uint16_t rcl2[] = /* 4 MKK channels: 34, 38, 42, 46 */
577 { 5170, 5190, 5210, 5230 };
578 static const uint16_t rcl3[] = /* 2.4Ghz ch: 1,6,11,7,13 */
579 { 2412, 2437, 2462, 2442, 2472 };
580 static const uint16_t rcl4[] = /* 5 FCC channel: 149, 153, 161, 165 */
581 { 5745, 5765, 5785, 5805, 5825 };
582 static const uint16_t rcl7[] = /* 11 ETSI channel: 100,104,108,112,116,120,124,128,132,136,140 */
583 { 5500, 5520, 5540, 5560, 5580, 5600, 5620, 5640, 5660, 5680, 5700 };
584 static const uint16_t rcl8[] = /* 2.4Ghz ch: 2,3,4,5,8,9,10,12 */
585 { 2417, 2422, 2427, 2432, 2447, 2452, 2457, 2467 };
586 static const uint16_t rcl9[] = /* 2.4Ghz ch: 14 */
587 { 2484 };
588 static const uint16_t rcl10[] = /* Added Korean channels 2312-2372 */
589 { 2312, 2317, 2322, 2327, 2332, 2337, 2342, 2347, 2352, 2357, 2362, 2367, 2372 };
590 static const uint16_t rcl11[] = /* Added Japan channels in 4.9/5.0 spectrum */
591 { 5040, 5060, 5080, 4920, 4940, 4960, 4980 };
592 #ifdef ATH_TURBO_SCAN
593 static const uint16_t rcl5[] = /* 3 static turbo channels */
594 { 5210, 5250, 5290 };
595 static const uint16_t rcl6[] = /* 2 static turbo channels */
596 { 5760, 5800 };
597 static const uint16_t rcl6x[] = /* 4 FCC3 turbo channels */
598 { 5540, 5580, 5620, 5660 };
599 static const uint16_t rcl12[] = /* 2.4Ghz Turbo channel 6 */
600 { 2437 };
601 static const uint16_t rcl13[] = /* dynamic Turbo channels */
602 { 5200, 5240, 5280, 5765, 5805 };
603 #endif /* ATH_TURBO_SCAN */
604
605 #define X(a) .count = sizeof(a)/sizeof(a[0]), .list = a
606
607 static const struct scanlist staScanTable[] = {
608 { IEEE80211_MODE_11B, X(rcl3) },
609 { IEEE80211_MODE_11A, X(rcl1) },
610 { IEEE80211_MODE_11A, X(rcl2) },
611 { IEEE80211_MODE_11B, X(rcl8) },
612 { IEEE80211_MODE_11B, X(rcl9) },
613 { IEEE80211_MODE_11A, X(rcl4) },
614 #ifdef ATH_TURBO_SCAN
615 { IEEE80211_MODE_STURBO_A, X(rcl5) },
616 { IEEE80211_MODE_STURBO_A, X(rcl6) },
617 { IEEE80211_MODE_TURBO_A, X(rcl6x) },
618 { IEEE80211_MODE_TURBO_A, X(rcl13) },
619 #endif /* ATH_TURBO_SCAN */
620 { IEEE80211_MODE_11A, X(rcl7) },
621 { IEEE80211_MODE_11B, X(rcl10) },
622 { IEEE80211_MODE_11A, X(rcl11) },
623 #ifdef ATH_TURBO_SCAN
624 { IEEE80211_MODE_TURBO_G, X(rcl12) },
625 #endif /* ATH_TURBO_SCAN */
626 { .list = NULL }
627 };
628
629 /*
630 * Start a station-mode scan by populating the channel list.
631 */
632 static int
633 sta_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
634 {
635 struct sta_table *st = ss->ss_priv;
636
637 makescanlist(ss, vap, staScanTable);
638
639 if (ss->ss_mindwell == 0)
640 ss->ss_mindwell = msecs_to_ticks(20); /* 20ms */
641 if (ss->ss_maxdwell == 0)
642 ss->ss_maxdwell = msecs_to_ticks(200); /* 200ms */
643
644 st->st_scangen++;
645 st->st_newscan = 1;
646
647 return 0;
648 }
649
650 /*
651 * Restart a scan, typically a bg scan but can
652 * also be a fg scan that came up empty.
653 */
654 static int
655 sta_restart(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
656 {
657 struct sta_table *st = ss->ss_priv;
658
659 st->st_newscan = 1;
660 return 0;
661 }
662
663 /*
664 * Cancel an ongoing scan.
665 */
666 static int
667 sta_cancel(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
668 {
669 return 0;
670 }
671
672 /* unalligned little endian access */
673 #define LE_READ_2(p) \
674 ((uint16_t) \
675 ((((const uint8_t *)(p))[0] ) | \
676 (((const uint8_t *)(p))[1] << 8)))
677
678 /*
679 * Demote any supplied 11g channel to 11b. There should
680 * always be an 11b channel but we check anyway...
681 */
682 static struct ieee80211_channel *
683 demote11b(struct ieee80211vap *vap, struct ieee80211_channel *chan)
684 {
685 struct ieee80211_channel *c;
686
687 if (IEEE80211_IS_CHAN_ANYG(chan) &&
688 vap->iv_des_mode == IEEE80211_MODE_AUTO) {
689 c = ieee80211_find_channel(vap->iv_ic, chan->ic_freq,
690 (chan->ic_flags &~ (IEEE80211_CHAN_PUREG | IEEE80211_CHAN_G)) |
691 IEEE80211_CHAN_B);
692 if (c != NULL)
693 chan = c;
694 }
695 return chan;
696 }
697
698 static int
699 maxrate(const struct ieee80211_scan_entry *se)
700 {
701 const struct ieee80211_ie_htcap *htcap =
702 (const struct ieee80211_ie_htcap *) se->se_ies.htcap_ie;
703 int rmax, r, i;
704 uint16_t caps;
705
706 rmax = 0;
707 if (htcap != NULL) {
708 /*
709 * HT station; inspect supported MCS and then adjust
710 * rate by channel width. Could also include short GI
711 * in this if we want to be extra accurate.
712 */
713 /* XXX assumes MCS15 is max */
714 for (i = 15; i >= 0 && isclr(htcap->hc_mcsset, i); i--)
715 ;
716 if (i >= 0) {
717 caps = LE_READ_2(&htcap->hc_cap);
718 /* XXX short/long GI */
719 if (caps & IEEE80211_HTCAP_CHWIDTH40)
720 rmax = ieee80211_htrates[i].ht40_rate_400ns;
721 else
722 rmax = ieee80211_htrates[i].ht40_rate_800ns;
723 }
724 }
725 for (i = 0; i < se->se_rates[1]; i++) {
726 r = se->se_rates[2+i] & IEEE80211_RATE_VAL;
727 if (r > rmax)
728 rmax = r;
729 }
730 for (i = 0; i < se->se_xrates[1]; i++) {
731 r = se->se_xrates[2+i] & IEEE80211_RATE_VAL;
732 if (r > rmax)
733 rmax = r;
734 }
735 return rmax;
736 }
737
738 /*
739 * Compare the capabilities of two entries and decide which is
740 * more desirable (return >0 if a is considered better). Note
741 * that we assume compatibility/usability has already been checked
742 * so we don't need to (e.g. validate whether privacy is supported).
743 * Used to select the best scan candidate for association in a BSS.
744 */
745 static int
746 sta_compare(const struct sta_entry *a, const struct sta_entry *b)
747 {
748 #define PREFER(_a,_b,_what) do { \
749 if (((_a) ^ (_b)) & (_what)) \
750 return ((_a) & (_what)) ? 1 : -1; \
751 } while (0)
752 int maxa, maxb;
753 int8_t rssia, rssib;
754 int weight;
755
756 /* privacy support */
757 PREFER(a->base.se_capinfo, b->base.se_capinfo,
758 IEEE80211_CAPINFO_PRIVACY);
759
760 /* compare count of previous failures */
761 weight = b->se_fails - a->se_fails;
762 if (abs(weight) > 1)
763 return weight;
764
765 /*
766 * Compare rssi. If the two are considered equivalent
767 * then fallback to other criteria. We threshold the
768 * comparisons to avoid selecting an ap purely by rssi
769 * when both values may be good but one ap is otherwise
770 * more desirable (e.g. an 11b-only ap with stronger
771 * signal than an 11g ap).
772 */
773 rssia = MIN(a->base.se_rssi, STA_RSSI_MAX);
774 rssib = MIN(b->base.se_rssi, STA_RSSI_MAX);
775 if (abs(rssib - rssia) < 5) {
776 /* best/max rate preferred if signal level close enough XXX */
777 maxa = maxrate(&a->base);
778 maxb = maxrate(&b->base);
779 if (maxa != maxb)
780 return maxa - maxb;
781 /* XXX use freq for channel preference */
782 /* for now just prefer 5Ghz band to all other bands */
783 PREFER(IEEE80211_IS_CHAN_5GHZ(a->base.se_chan),
784 IEEE80211_IS_CHAN_5GHZ(b->base.se_chan), 1);
785 }
786 /* all things being equal, use signal level */
787 return a->base.se_rssi - b->base.se_rssi;
788 #undef PREFER
789 }
790
791 /*
792 * Check rate set suitability and return the best supported rate.
793 * XXX inspect MCS for HT
794 */
795 static int
796 check_rate(struct ieee80211vap *vap, const struct ieee80211_channel *chan,
797 const struct ieee80211_scan_entry *se)
798 {
799 #define RV(v) ((v) & IEEE80211_RATE_VAL)
800 const struct ieee80211_rateset *srs;
801 int i, j, nrs, r, okrate, badrate, fixedrate, ucastrate;
802 const uint8_t *rs;
803
804 okrate = badrate = 0;
805
806 srs = ieee80211_get_suprates(vap->iv_ic, chan);
807 nrs = se->se_rates[1];
808 rs = se->se_rates+2;
809 /* XXX MCS */
810 ucastrate = vap->iv_txparms[ieee80211_chan2mode(chan)].ucastrate;
811 fixedrate = IEEE80211_FIXED_RATE_NONE;
812 again:
813 for (i = 0; i < nrs; i++) {
814 r = RV(rs[i]);
815 badrate = r;
816 /*
817 * Check any fixed rate is included.
818 */
819 if (r == ucastrate)
820 fixedrate = r;
821 /*
822 * Check against our supported rates.
823 */
824 for (j = 0; j < srs->rs_nrates; j++)
825 if (r == RV(srs->rs_rates[j])) {
826 if (r > okrate) /* NB: track max */
827 okrate = r;
828 break;
829 }
830
831 if (j == srs->rs_nrates && (rs[i] & IEEE80211_RATE_BASIC)) {
832 /*
833 * Don't try joining a BSS, if we don't support
834 * one of its basic rates.
835 */
836 okrate = 0;
837 goto back;
838 }
839 }
840 if (rs == se->se_rates+2) {
841 /* scan xrates too; sort of an algol68-style for loop */
842 nrs = se->se_xrates[1];
843 rs = se->se_xrates+2;
844 goto again;
845 }
846
847 back:
848 if (okrate == 0 || ucastrate != fixedrate)
849 return badrate | IEEE80211_RATE_BASIC;
850 else
851 return RV(okrate);
852 #undef RV
853 }
854
855 static int
856 match_ssid(const uint8_t *ie,
857 int nssid, const struct ieee80211_scan_ssid ssids[])
858 {
859 int i;
860
861 for (i = 0; i < nssid; i++) {
862 if (ie[1] == ssids[i].len &&
863 memcmp(ie+2, ssids[i].ssid, ie[1]) == 0)
864 return 1;
865 }
866 return 0;
867 }
868
869 /*
870 * Test a scan candidate for suitability/compatibility.
871 */
872 static int
873 match_bss(struct ieee80211vap *vap,
874 const struct ieee80211_scan_state *ss, struct sta_entry *se0,
875 int debug)
876 {
877 struct ieee80211com *ic = vap->iv_ic;
878 struct ieee80211_scan_entry *se = &se0->base;
879 uint8_t rate;
880 int fail;
881
882 fail = 0;
883 if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, se->se_chan)))
884 fail |= MATCH_CHANNEL;
885 /*
886 * NB: normally the desired mode is used to construct
887 * the channel list, but it's possible for the scan
888 * cache to include entries for stations outside this
889 * list so we check the desired mode here to weed them
890 * out.
891 */
892 if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
893 (se->se_chan->ic_flags & IEEE80211_CHAN_ALLTURBO) !=
894 chanflags[vap->iv_des_mode])
895 fail |= MATCH_CHANNEL;
896 if (vap->iv_opmode == IEEE80211_M_IBSS) {
897 if ((se->se_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
898 fail |= MATCH_CAPINFO;
899 } else {
900 if ((se->se_capinfo & IEEE80211_CAPINFO_ESS) == 0)
901 fail |= MATCH_CAPINFO;
|