The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_scan_sta.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   24  */
   25 
   26 #include <sys/cdefs.h>
   27 __FBSDID("$FreeBSD: releng/8.0/sys/net80211/ieee80211_scan_sta.c 196005 2009-07-31 19:13:16Z sam $");
   28 
   29 /*
   30  * IEEE 802.11 station scanning support.
   31  */
   32 #include "opt_wlan.h"
   33 
   34 #include <sys/param.h>
   35 #include <sys/systm.h>
   36 #include <sys/kernel.h>
   37 #include <sys/module.h>
   38 
   39 #include <sys/socket.h>
   40 
   41 #include <net/if.h>
   42 #include <net/if_media.h>
   43 #include <net/ethernet.h>
   44 
   45 #include <net80211/ieee80211_var.h>
   46 #include <net80211/ieee80211_input.h>
   47 #include <net80211/ieee80211_regdomain.h>
   48 #ifdef IEEE80211_SUPPORT_TDMA
   49 #include <net80211/ieee80211_tdma.h>
   50 #endif
   51 #ifdef IEEE80211_SUPPORT_MESH
   52 #include <net80211/ieee80211_mesh.h>
   53 #endif
   54 
   55 #include <net/bpf.h>
   56 
   57 /*
   58  * Parameters for managing cache entries:
   59  *
   60  * o a station with STA_FAILS_MAX failures is not considered
   61  *   when picking a candidate
   62  * o a station that hasn't had an update in STA_PURGE_SCANS
   63  *   (background) scans is discarded
   64  * o after STA_FAILS_AGE seconds we clear the failure count
   65  */
   66 #define STA_FAILS_MAX   2               /* assoc failures before ignored */
   67 #define STA_FAILS_AGE   (2*60)          /* time before clearing fails (secs) */
   68 #define STA_PURGE_SCANS 2               /* age for purging entries (scans) */
   69 
   70 /* XXX tunable */
   71 #define STA_RSSI_MIN    8               /* min acceptable rssi */
   72 #define STA_RSSI_MAX    40              /* max rssi for comparison */
   73 
   74 struct sta_entry {
   75         struct ieee80211_scan_entry base;
   76         TAILQ_ENTRY(sta_entry) se_list;
   77         LIST_ENTRY(sta_entry) se_hash;
   78         uint8_t         se_fails;               /* failure to associate count */
   79         uint8_t         se_seen;                /* seen during current scan */
   80         uint8_t         se_notseen;             /* not seen in previous scans */
   81         uint8_t         se_flags;
   82 #define STA_DEMOTE11B   0x01                    /* match w/ demoted 11b chan */
   83         uint32_t        se_avgrssi;             /* LPF rssi state */
   84         unsigned long   se_lastupdate;          /* time of last update */
   85         unsigned long   se_lastfail;            /* time of last failure */
   86         unsigned long   se_lastassoc;           /* time of last association */
   87         u_int           se_scangen;             /* iterator scan gen# */
   88         u_int           se_countrygen;          /* gen# of last cc notify */
   89 };
   90 
   91 #define STA_HASHSIZE    32
   92 /* simple hash is enough for variation of macaddr */
   93 #define STA_HASH(addr)  \
   94         (((const uint8_t *)(addr))[IEEE80211_ADDR_LEN - 1] % STA_HASHSIZE)
   95 
   96 #define MAX_IEEE_CHAN   256                     /* max acceptable IEEE chan # */
   97 CTASSERT(MAX_IEEE_CHAN >= 256);
   98 
   99 struct sta_table {
  100         struct mtx      st_lock;                /* on scan table */
  101         TAILQ_HEAD(, sta_entry) st_entry;       /* all entries */
  102         LIST_HEAD(, sta_entry) st_hash[STA_HASHSIZE];
  103         struct mtx      st_scanlock;            /* on st_scaniter */
  104         u_int           st_scaniter;            /* gen# for iterator */
  105         u_int           st_scangen;             /* scan generation # */
  106         int             st_newscan;
  107         /* ap-related state */
  108         int             st_maxrssi[MAX_IEEE_CHAN];
  109 };
  110 
  111 static void sta_flush_table(struct sta_table *);
  112 /*
  113  * match_bss returns a bitmask describing if an entry is suitable
  114  * for use.  If non-zero the entry was deemed not suitable and it's
  115  * contents explains why.  The following flags are or'd to to this
  116  * mask and can be used to figure out why the entry was rejected.
  117  */
  118 #define MATCH_CHANNEL           0x00001 /* channel mismatch */
  119 #define MATCH_CAPINFO           0x00002 /* capabilities mismatch, e.g. no ess */
  120 #define MATCH_PRIVACY           0x00004 /* privacy mismatch */
  121 #define MATCH_RATE              0x00008 /* rate set mismatch */
  122 #define MATCH_SSID              0x00010 /* ssid mismatch */
  123 #define MATCH_BSSID             0x00020 /* bssid mismatch */
  124 #define MATCH_FAILS             0x00040 /* too many failed auth attempts */
  125 #define MATCH_NOTSEEN           0x00080 /* not seen in recent scans */
  126 #define MATCH_RSSI              0x00100 /* rssi deemed too low to use */
  127 #define MATCH_CC                0x00200 /* country code mismatch */
  128 #define MATCH_TDMA_NOIE         0x00400 /* no TDMA ie */
  129 #define MATCH_TDMA_NOTMASTER    0x00800 /* not TDMA master */
  130 #define MATCH_TDMA_NOSLOT       0x01000 /* all TDMA slots occupied */
  131 #define MATCH_TDMA_LOCAL        0x02000 /* local address */
  132 #define MATCH_TDMA_VERSION      0x04000 /* protocol version mismatch */
  133 #define MATCH_MESH_NOID         0x10000 /* no MESHID ie */
  134 #define MATCH_MESHID            0x20000 /* meshid mismatch */
  135 static int match_bss(struct ieee80211vap *,
  136         const struct ieee80211_scan_state *, struct sta_entry *, int);
  137 static void adhoc_age(struct ieee80211_scan_state *);
  138 
  139 static __inline int
  140 isocmp(const uint8_t cc1[], const uint8_t cc2[])
  141 {
  142      return (cc1[0] == cc2[0] && cc1[1] == cc2[1]);
  143 }
  144 
  145 /* number of references from net80211 layer */
  146 static  int nrefs = 0;
  147 /*
  148  * Module glue.
  149  */
  150 IEEE80211_SCANNER_MODULE(sta, 1);
  151 
  152 /*
  153  * Attach prior to any scanning work.
  154  */
  155 static int
  156 sta_attach(struct ieee80211_scan_state *ss)
  157 {
  158         struct sta_table *st;
  159 
  160         st = (struct sta_table *) malloc(sizeof(struct sta_table),
  161                 M_80211_SCAN, M_NOWAIT | M_ZERO);
  162         if (st == NULL)
  163                 return 0;
  164         mtx_init(&st->st_lock, "scantable", "802.11 scan table", MTX_DEF);
  165         mtx_init(&st->st_scanlock, "scangen", "802.11 scangen", MTX_DEF);
  166         TAILQ_INIT(&st->st_entry);
  167         ss->ss_priv = st;
  168         nrefs++;                        /* NB: we assume caller locking */
  169         return 1;
  170 }
  171 
  172 /*
  173  * Cleanup any private state.
  174  */
  175 static int
  176 sta_detach(struct ieee80211_scan_state *ss)
  177 {
  178         struct sta_table *st = ss->ss_priv;
  179 
  180         if (st != NULL) {
  181                 sta_flush_table(st);
  182                 mtx_destroy(&st->st_lock);
  183                 mtx_destroy(&st->st_scanlock);
  184                 free(st, M_80211_SCAN);
  185                 KASSERT(nrefs > 0, ("imbalanced attach/detach"));
  186                 nrefs--;                /* NB: we assume caller locking */
  187         }
  188         return 1;
  189 }
  190 
  191 /*
  192  * Flush all per-scan state.
  193  */
  194 static int
  195 sta_flush(struct ieee80211_scan_state *ss)
  196 {
  197         struct sta_table *st = ss->ss_priv;
  198 
  199         mtx_lock(&st->st_lock);
  200         sta_flush_table(st);
  201         mtx_unlock(&st->st_lock);
  202         ss->ss_last = 0;
  203         return 0;
  204 }
  205 
  206 /*
  207  * Flush all entries in the scan cache.
  208  */
  209 static void
  210 sta_flush_table(struct sta_table *st)
  211 {
  212         struct sta_entry *se, *next;
  213 
  214         TAILQ_FOREACH_SAFE(se, &st->st_entry, se_list, next) {
  215                 TAILQ_REMOVE(&st->st_entry, se, se_list);
  216                 LIST_REMOVE(se, se_hash);
  217                 ieee80211_ies_cleanup(&se->base.se_ies);
  218                 free(se, M_80211_SCAN);
  219         }
  220         memset(st->st_maxrssi, 0, sizeof(st->st_maxrssi));
  221 }
  222 
  223 /*
  224  * Process a beacon or probe response frame; create an
  225  * entry in the scan cache or update any previous entry.
  226  */
  227 static int
  228 sta_add(struct ieee80211_scan_state *ss, 
  229         const struct ieee80211_scanparams *sp,
  230         const struct ieee80211_frame *wh,
  231         int subtype, int rssi, int noise)
  232 {
  233 #define ISPROBE(_st)    ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
  234 #define PICK1ST(_ss) \
  235         ((ss->ss_flags & (IEEE80211_SCAN_PICK1ST | IEEE80211_SCAN_GOTPICK)) == \
  236         IEEE80211_SCAN_PICK1ST)
  237         struct sta_table *st = ss->ss_priv;
  238         const uint8_t *macaddr = wh->i_addr2;
  239         struct ieee80211vap *vap = ss->ss_vap;
  240         struct ieee80211com *ic = vap->iv_ic;
  241         struct sta_entry *se;
  242         struct ieee80211_scan_entry *ise;
  243         int hash;
  244 
  245         hash = STA_HASH(macaddr);
  246 
  247         mtx_lock(&st->st_lock);
  248         LIST_FOREACH(se, &st->st_hash[hash], se_hash)
  249                 if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr))
  250                         goto found;
  251         se = (struct sta_entry *) malloc(sizeof(struct sta_entry),
  252                 M_80211_SCAN, M_NOWAIT | M_ZERO);
  253         if (se == NULL) {
  254                 mtx_unlock(&st->st_lock);
  255                 return 0;
  256         }
  257         se->se_scangen = st->st_scaniter-1;
  258         se->se_avgrssi = IEEE80211_RSSI_DUMMY_MARKER;
  259         IEEE80211_ADDR_COPY(se->base.se_macaddr, macaddr);
  260         TAILQ_INSERT_TAIL(&st->st_entry, se, se_list);
  261         LIST_INSERT_HEAD(&st->st_hash[hash], se, se_hash);
  262 found:
  263         ise = &se->base;
  264         /* XXX ap beaconing multiple ssid w/ same bssid */
  265         if (sp->ssid[1] != 0 &&
  266             (ISPROBE(subtype) || ise->se_ssid[1] == 0))
  267                 memcpy(ise->se_ssid, sp->ssid, 2+sp->ssid[1]);
  268         KASSERT(sp->rates[1] <= IEEE80211_RATE_MAXSIZE,
  269                 ("rate set too large: %u", sp->rates[1]));
  270         memcpy(ise->se_rates, sp->rates, 2+sp->rates[1]);
  271         if (sp->xrates != NULL) {
  272                 /* XXX validate xrates[1] */
  273                 KASSERT(sp->xrates[1] <= IEEE80211_RATE_MAXSIZE,
  274                         ("xrate set too large: %u", sp->xrates[1]));
  275                 memcpy(ise->se_xrates, sp->xrates, 2+sp->xrates[1]);
  276         } else
  277                 ise->se_xrates[1] = 0;
  278         IEEE80211_ADDR_COPY(ise->se_bssid, wh->i_addr3);
  279         if ((sp->status & IEEE80211_BPARSE_OFFCHAN) == 0) {
  280                 /*
  281                  * Record rssi data using extended precision LPF filter.
  282                  *
  283                  * NB: use only on-channel data to insure we get a good
  284                  *     estimate of the signal we'll see when associated.
  285                  */
  286                 IEEE80211_RSSI_LPF(se->se_avgrssi, rssi);
  287                 ise->se_rssi = IEEE80211_RSSI_GET(se->se_avgrssi);
  288                 ise->se_noise = noise;
  289         }
  290         memcpy(ise->se_tstamp.data, sp->tstamp, sizeof(ise->se_tstamp));
  291         ise->se_intval = sp->bintval;
  292         ise->se_capinfo = sp->capinfo;
  293 #ifdef IEEE80211_SUPPORT_MESH
  294         if (sp->meshid != NULL && sp->meshid[1] != 0)
  295                 memcpy(ise->se_meshid, sp->meshid, 2+sp->meshid[1]);
  296 #endif
  297         /*
  298          * Beware of overriding se_chan for frames seen
  299          * off-channel; this can cause us to attempt an
  300          * association on the wrong channel.
  301          */
  302         if (sp->status & IEEE80211_BPARSE_OFFCHAN) {
  303                 struct ieee80211_channel *c;
  304                 /*
  305                  * Off-channel, locate the home/bss channel for the sta
  306                  * using the value broadcast in the DSPARMS ie.  We know
  307                  * sp->chan has this value because it's used to calculate
  308                  * IEEE80211_BPARSE_OFFCHAN.
  309                  */
  310                 c = ieee80211_find_channel_byieee(ic, sp->chan,
  311                     ic->ic_curchan->ic_flags);
  312                 if (c != NULL) {
  313                         ise->se_chan = c;
  314                 } else if (ise->se_chan == NULL) {
  315                         /* should not happen, pick something */
  316                         ise->se_chan = ic->ic_curchan;
  317                 }
  318         } else
  319                 ise->se_chan = ic->ic_curchan;
  320         ise->se_fhdwell = sp->fhdwell;
  321         ise->se_fhindex = sp->fhindex;
  322         ise->se_erp = sp->erp;
  323         ise->se_timoff = sp->timoff;
  324         if (sp->tim != NULL) {
  325                 const struct ieee80211_tim_ie *tim =
  326                     (const struct ieee80211_tim_ie *) sp->tim;
  327                 ise->se_dtimperiod = tim->tim_period;
  328         }
  329         if (sp->country != NULL) {
  330                 const struct ieee80211_country_ie *cie =
  331                     (const struct ieee80211_country_ie *) sp->country;
  332                 /*
  333                  * If 11d is enabled and we're attempting to join a bss
  334                  * that advertises it's country code then compare our
  335                  * current settings to what we fetched from the country ie.
  336                  * If our country code is unspecified or different then
  337                  * dispatch an event to user space that identifies the
  338                  * country code so our regdomain config can be changed.
  339                  */
  340                 /* XXX only for STA mode? */
  341                 if ((IEEE80211_IS_CHAN_11D(ise->se_chan) ||
  342                     (vap->iv_flags_ext & IEEE80211_FEXT_DOTD)) &&
  343                     (ic->ic_regdomain.country == CTRY_DEFAULT ||
  344                      !isocmp(cie->cc, ic->ic_regdomain.isocc))) {
  345                         /* only issue one notify event per scan */
  346                         if (se->se_countrygen != st->st_scangen) {
  347                                 ieee80211_notify_country(vap, ise->se_bssid,
  348                                     cie->cc);
  349                                 se->se_countrygen = st->st_scangen;
  350                         }
  351                 }
  352                 ise->se_cc[0] = cie->cc[0];
  353                 ise->se_cc[1] = cie->cc[1];
  354         }
  355         /* NB: no need to setup ie ptrs; they are not (currently) used */
  356         (void) ieee80211_ies_init(&ise->se_ies, sp->ies, sp->ies_len);
  357 
  358         /* clear failure count after STA_FAIL_AGE passes */
  359         if (se->se_fails && (ticks - se->se_lastfail) > STA_FAILS_AGE*hz) {
  360                 se->se_fails = 0;
  361                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_SCAN, macaddr,
  362                     "%s: fails %u", __func__, se->se_fails);
  363         }
  364 
  365         se->se_lastupdate = ticks;              /* update time */
  366         se->se_seen = 1;
  367         se->se_notseen = 0;
  368 
  369         KASSERT(sizeof(sp->bchan) == 1, ("bchan size"));
  370         if (rssi > st->st_maxrssi[sp->bchan])
  371                 st->st_maxrssi[sp->bchan] = rssi;
  372 
  373         mtx_unlock(&st->st_lock);
  374 
  375         /*
  376          * If looking for a quick choice and nothing's
  377          * been found check here.
  378          */
  379         if (PICK1ST(ss) && match_bss(vap, ss, se, IEEE80211_MSG_SCAN) == 0)
  380                 ss->ss_flags |= IEEE80211_SCAN_GOTPICK;
  381 
  382         return 1;
  383 #undef PICK1ST
  384 #undef ISPROBE
  385 }
  386 
  387 /*
  388  * Check if a channel is excluded by user request.
  389  */
  390 static int
  391 isexcluded(struct ieee80211vap *vap, const struct ieee80211_channel *c)
  392 {
  393         return (isclr(vap->iv_ic->ic_chan_active, c->ic_ieee) ||
  394             (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
  395              c->ic_freq != vap->iv_des_chan->ic_freq));
  396 }
  397 
  398 static struct ieee80211_channel *
  399 find11gchannel(struct ieee80211com *ic, int i, int freq)
  400 {
  401         struct ieee80211_channel *c;
  402         int j;
  403 
  404         /*
  405          * The normal ordering in the channel list is b channel
  406          * immediately followed by g so optimize the search for
  407          * this.  We'll still do a full search just in case.
  408          */
  409         for (j = i+1; j < ic->ic_nchans; j++) {
  410                 c = &ic->ic_channels[j];
  411                 if (c->ic_freq == freq && IEEE80211_IS_CHAN_G(c))
  412                         return c;
  413         }
  414         for (j = 0; j < i; j++) {
  415                 c = &ic->ic_channels[j];
  416                 if (c->ic_freq == freq && IEEE80211_IS_CHAN_G(c))
  417                         return c;
  418         }
  419         return NULL;
  420 }
  421 
  422 static const u_int chanflags[IEEE80211_MODE_MAX] = {
  423         [IEEE80211_MODE_AUTO]     = IEEE80211_CHAN_B,
  424         [IEEE80211_MODE_11A]      = IEEE80211_CHAN_A,
  425         [IEEE80211_MODE_11B]      = IEEE80211_CHAN_B,
  426         [IEEE80211_MODE_11G]      = IEEE80211_CHAN_G,
  427         [IEEE80211_MODE_FH]       = IEEE80211_CHAN_FHSS,
  428         /* check base channel */
  429         [IEEE80211_MODE_TURBO_A]  = IEEE80211_CHAN_A,
  430         [IEEE80211_MODE_TURBO_G]  = IEEE80211_CHAN_G,
  431         [IEEE80211_MODE_STURBO_A] = IEEE80211_CHAN_ST,
  432         [IEEE80211_MODE_HALF]     = IEEE80211_CHAN_HALF,
  433         [IEEE80211_MODE_QUARTER]  = IEEE80211_CHAN_QUARTER,
  434         /* check legacy */
  435         [IEEE80211_MODE_11NA]     = IEEE80211_CHAN_A,
  436         [IEEE80211_MODE_11NG]     = IEEE80211_CHAN_G,
  437 };
  438 
  439 static void
  440 add_channels(struct ieee80211vap *vap,
  441         struct ieee80211_scan_state *ss,
  442         enum ieee80211_phymode mode, const uint16_t freq[], int nfreq)
  443 {
  444 #define N(a)    (sizeof(a) / sizeof(a[0]))
  445         struct ieee80211com *ic = vap->iv_ic;
  446         struct ieee80211_channel *c, *cg;
  447         u_int modeflags;
  448         int i;
  449 
  450         KASSERT(mode < N(chanflags), ("Unexpected mode %u", mode));
  451         modeflags = chanflags[mode];
  452         for (i = 0; i < nfreq; i++) {
  453                 if (ss->ss_last >= IEEE80211_SCAN_MAX)
  454                         break;
  455 
  456                 c = ieee80211_find_channel(ic, freq[i], modeflags);
  457                 if (c == NULL || isexcluded(vap, c))
  458                         continue;
  459                 if (mode == IEEE80211_MODE_AUTO) {
  460                         /*
  461                          * XXX special-case 11b/g channels so we select
  462                          *     the g channel if both are present.
  463                          */
  464                         if (IEEE80211_IS_CHAN_B(c) &&
  465                             (cg = find11gchannel(ic, i, c->ic_freq)) != NULL)
  466                                 c = cg;
  467                 }
  468                 ss->ss_chans[ss->ss_last++] = c;
  469         }
  470 #undef N
  471 }
  472 
  473 struct scanlist {
  474         uint16_t        mode;
  475         uint16_t        count;
  476         const uint16_t  *list;
  477 };
  478 
  479 static int
  480 checktable(const struct scanlist *scan, const struct ieee80211_channel *c)
  481 {
  482         int i;
  483 
  484         for (; scan->list != NULL; scan++) {
  485                 for (i = 0; i < scan->count; i++)
  486                         if (scan->list[i] == c->ic_freq) 
  487                                 return 1;
  488         }
  489         return 0;
  490 }
  491 
  492 static int
  493 onscanlist(const struct ieee80211_scan_state *ss,
  494         const struct ieee80211_channel *c)
  495 {
  496         int i;
  497 
  498         for (i = 0; i < ss->ss_last; i++)
  499                 if (ss->ss_chans[i] == c)
  500                         return 1;
  501         return 0;
  502 }
  503 
  504 static void
  505 sweepchannels(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
  506         const struct scanlist table[])
  507 {
  508         struct ieee80211com *ic = vap->iv_ic;
  509         struct ieee80211_channel *c;
  510         int i;
  511 
  512         for (i = 0; i < ic->ic_nchans; i++) {
  513                 if (ss->ss_last >= IEEE80211_SCAN_MAX)
  514                         break;
  515 
  516                 c = &ic->ic_channels[i];
  517                 /*
  518                  * Ignore dynamic turbo channels; we scan them
  519                  * in normal mode (i.e. not boosted).  Likewise
  520                  * for HT channels, they get scanned using
  521                  * legacy rates.
  522                  */
  523                 if (IEEE80211_IS_CHAN_DTURBO(c) || IEEE80211_IS_CHAN_HT(c))
  524                         continue;
  525 
  526                 /*
  527                  * If a desired mode was specified, scan only 
  528                  * channels that satisfy that constraint.
  529                  */
  530                 if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
  531                     vap->iv_des_mode != ieee80211_chan2mode(c))
  532                         continue;
  533 
  534                 /*
  535                  * Skip channels excluded by user request.
  536                  */
  537                 if (isexcluded(vap, c))
  538                         continue;
  539 
  540                 /*
  541                  * Add the channel unless it is listed in the
  542                  * fixed scan order tables.  This insures we
  543                  * don't sweep back in channels we filtered out
  544                  * above.
  545                  */
  546                 if (checktable(table, c))
  547                         continue;
  548 
  549                 /* Add channel to scanning list. */
  550                 ss->ss_chans[ss->ss_last++] = c;
  551         }
  552         /*
  553          * Explicitly add any desired channel if:
  554          * - not already on the scan list
  555          * - allowed by any desired mode constraint
  556          * - there is space in the scan list
  557          * This allows the channel to be used when the filtering
  558          * mechanisms would otherwise elide it (e.g HT, turbo).
  559          */
  560         c = vap->iv_des_chan;
  561         if (c != IEEE80211_CHAN_ANYC &&
  562             !onscanlist(ss, c) &&
  563             (vap->iv_des_mode == IEEE80211_MODE_AUTO ||
  564              vap->iv_des_mode == ieee80211_chan2mode(c)) &&
  565             ss->ss_last < IEEE80211_SCAN_MAX)
  566                 ss->ss_chans[ss->ss_last++] = c;
  567 }
  568 
  569 static void
  570 makescanlist(struct ieee80211_scan_state *ss, struct ieee80211vap *vap,
  571         const struct scanlist table[])
  572 {
  573         const struct scanlist *scan;
  574         enum ieee80211_phymode mode;
  575 
  576         ss->ss_last = 0;
  577         /*
  578          * Use the table of ordered channels to construct the list
  579          * of channels for scanning.  Any channels in the ordered
  580          * list not in the master list will be discarded.
  581          */
  582         for (scan = table; scan->list != NULL; scan++) {
  583                 mode = scan->mode;
  584                 if (vap->iv_des_mode != IEEE80211_MODE_AUTO) {
  585                         /*
  586                          * If a desired mode was specified, scan only 
  587                          * channels that satisfy that constraint.
  588                          */
  589                         if (vap->iv_des_mode != mode) {
  590                                 /*
  591                                  * The scan table marks 2.4Ghz channels as b
  592                                  * so if the desired mode is 11g, then use
  593                                  * the 11b channel list but upgrade the mode.
  594                                  */
  595                                 if (vap->iv_des_mode != IEEE80211_MODE_11G ||
  596                                     mode != IEEE80211_MODE_11B)
  597                                         continue;
  598                                 mode = IEEE80211_MODE_11G;      /* upgrade */
  599                         }
  600                 } else {
  601                         /*
  602                          * This lets add_channels upgrade an 11b channel
  603                          * to 11g if available.
  604                          */
  605                         if (mode == IEEE80211_MODE_11B)
  606                                 mode = IEEE80211_MODE_AUTO;
  607                 }
  608 #ifdef IEEE80211_F_XR
  609                 /* XR does not operate on turbo channels */
  610                 if ((vap->iv_flags & IEEE80211_F_XR) &&
  611                     (mode == IEEE80211_MODE_TURBO_A ||
  612                      mode == IEEE80211_MODE_TURBO_G ||
  613                      mode == IEEE80211_MODE_STURBO_A))
  614                         continue;
  615 #endif
  616                 /*
  617                  * Add the list of the channels; any that are not
  618                  * in the master channel list will be discarded.
  619                  */
  620                 add_channels(vap, ss, mode, scan->list, scan->count);
  621         }
  622 
  623         /*
  624          * Add the channels from the ic that are not present
  625          * in the table.
  626          */
  627         sweepchannels(ss, vap, table);
  628 }
  629 
  630 static const uint16_t rcl1[] =          /* 8 FCC channel: 52, 56, 60, 64, 36, 40, 44, 48 */
  631 { 5260, 5280, 5300, 5320, 5180, 5200, 5220, 5240 };
  632 static const uint16_t rcl2[] =          /* 4 MKK channels: 34, 38, 42, 46 */
  633 { 5170, 5190, 5210, 5230 };
  634 static const uint16_t rcl3[] =          /* 2.4Ghz ch: 1,6,11,7,13 */
  635 { 2412, 2437, 2462, 2442, 2472 };
  636 static const uint16_t rcl4[] =          /* 5 FCC channel: 149, 153, 161, 165 */
  637 { 5745, 5765, 5785, 5805, 5825 };
  638 static const uint16_t rcl7[] =          /* 11 ETSI channel: 100,104,108,112,116,120,124,128,132,136,140 */
  639 { 5500, 5520, 5540, 5560, 5580, 5600, 5620, 5640, 5660, 5680, 5700 };
  640 static const uint16_t rcl8[] =          /* 2.4Ghz ch: 2,3,4,5,8,9,10,12 */
  641 { 2417, 2422, 2427, 2432, 2447, 2452, 2457, 2467 };
  642 static const uint16_t rcl9[] =          /* 2.4Ghz ch: 14 */
  643 { 2484 };
  644 static const uint16_t rcl10[] = /* Added Korean channels 2312-2372 */
  645 { 2312, 2317, 2322, 2327, 2332, 2337, 2342, 2347, 2352, 2357, 2362, 2367, 2372 };
  646 static const uint16_t rcl11[] = /* Added Japan channels in 4.9/5.0 spectrum */
  647 { 5040, 5060, 5080, 4920, 4940, 4960, 4980 };
  648 #ifdef ATH_TURBO_SCAN
  649 static const uint16_t rcl5[] =          /* 3 static turbo channels */
  650 { 5210, 5250, 5290 };
  651 static const uint16_t rcl6[] =          /* 2 static turbo channels */
  652 { 5760, 5800 };
  653 static const uint16_t rcl6x[] = /* 4 FCC3 turbo channels */
  654 { 5540, 5580, 5620, 5660 };
  655 static const uint16_t rcl12[] = /* 2.4Ghz Turbo channel 6 */
  656 { 2437 };
  657 static const uint16_t rcl13[] = /* dynamic Turbo channels */
  658 { 5200, 5240, 5280, 5765, 5805 };
  659 #endif /* ATH_TURBO_SCAN */
  660 
  661 #define X(a)    .count = sizeof(a)/sizeof(a[0]), .list = a
  662 
  663 static const struct scanlist staScanTable[] = {
  664         { IEEE80211_MODE_11B,           X(rcl3) },
  665         { IEEE80211_MODE_11A,           X(rcl1) },
  666         { IEEE80211_MODE_11A,           X(rcl2) },
  667         { IEEE80211_MODE_11B,           X(rcl8) },
  668         { IEEE80211_MODE_11B,           X(rcl9) },
  669         { IEEE80211_MODE_11A,           X(rcl4) },
  670 #ifdef ATH_TURBO_SCAN
  671         { IEEE80211_MODE_STURBO_A,      X(rcl5) },
  672         { IEEE80211_MODE_STURBO_A,      X(rcl6) },
  673         { IEEE80211_MODE_TURBO_A,       X(rcl6x) },
  674         { IEEE80211_MODE_TURBO_A,       X(rcl13) },
  675 #endif /* ATH_TURBO_SCAN */
  676         { IEEE80211_MODE_11A,           X(rcl7) },
  677         { IEEE80211_MODE_11B,           X(rcl10) },
  678         { IEEE80211_MODE_11A,           X(rcl11) },
  679 #ifdef ATH_TURBO_SCAN
  680         { IEEE80211_MODE_TURBO_G,       X(rcl12) },
  681 #endif /* ATH_TURBO_SCAN */
  682         { .list = NULL }
  683 };
  684 
  685 /*
  686  * Start a station-mode scan by populating the channel list.
  687  */
  688 static int
  689 sta_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
  690 {
  691         struct sta_table *st = ss->ss_priv;
  692 
  693         makescanlist(ss, vap, staScanTable);
  694 
  695         if (ss->ss_mindwell == 0)
  696                 ss->ss_mindwell = msecs_to_ticks(20);   /* 20ms */
  697         if (ss->ss_maxdwell == 0)
  698                 ss->ss_maxdwell = msecs_to_ticks(200);  /* 200ms */
  699 
  700         st->st_scangen++;
  701         st->st_newscan = 1;
  702 
  703         return 0;
  704 }
  705 
  706 /*
  707  * Restart a scan, typically a bg scan but can
  708  * also be a fg scan that came up empty.
  709  */
  710 static int
  711 sta_restart(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
  712 {
  713         struct sta_table *st = ss->ss_priv;
  714 
  715         st->st_newscan = 1;
  716         return 0;
  717 }
  718 
  719 /*
  720  * Cancel an ongoing scan.
  721  */
  722 static int
  723 sta_cancel(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
  724 {
  725         return 0;
  726 }
  727 
  728 /* unalligned little endian access */     
  729 #define LE_READ_2(p)                                    \
  730         ((uint16_t)                                     \
  731          ((((const uint8_t *)(p))[0]      ) |           \
  732           (((const uint8_t *)(p))[1] <<  8)))
  733  
  734 /*
  735  * Demote any supplied 11g channel to 11b.  There should
  736  * always be an 11b channel but we check anyway...
  737  */
  738 static struct ieee80211_channel *
  739 demote11b(struct ieee80211vap *vap, struct ieee80211_channel *chan)
  740 {
  741         struct ieee80211_channel *c;
  742 
  743         if (IEEE80211_IS_CHAN_ANYG(chan) &&
  744             vap->iv_des_mode == IEEE80211_MODE_AUTO) {
  745                 c = ieee80211_find_channel(vap->iv_ic, chan->ic_freq,
  746                     (chan->ic_flags &~ (IEEE80211_CHAN_PUREG | IEEE80211_CHAN_G)) |
  747                     IEEE80211_CHAN_B);
  748                 if (c != NULL)
  749                         chan = c;
  750         }
  751         return chan;
  752 }
  753 
  754 static int
  755 maxrate(const struct ieee80211_scan_entry *se)
  756 {
  757         const struct ieee80211_ie_htcap *htcap =
  758             (const struct ieee80211_ie_htcap *) se->se_ies.htcap_ie;
  759         int rmax, r, i;
  760         uint16_t caps;
  761 
  762         rmax = 0;
  763         if (htcap != NULL) {
  764                 /*
  765                  * HT station; inspect supported MCS and then adjust
  766                  * rate by channel width.  Could also include short GI
  767                  * in this if we want to be extra accurate.
  768                  */
  769                 /* XXX assumes MCS15 is max */
  770                 for (i = 15; i >= 0 && isclr(htcap->hc_mcsset, i); i--)
  771                         ;
  772                 if (i >= 0) {
  773                         caps = LE_READ_2(&htcap->hc_cap);
  774                         /* XXX short/long GI */
  775                         if (caps & IEEE80211_HTCAP_CHWIDTH40)
  776                                 rmax = ieee80211_htrates[i].ht40_rate_400ns;
  777                         else
  778                                 rmax = ieee80211_htrates[i].ht40_rate_800ns;
  779                 }
  780         }
  781         for (i = 0; i < se->se_rates[1]; i++) {
  782                 r = se->se_rates[2+i] & IEEE80211_RATE_VAL;
  783                 if (r > rmax)
  784                         rmax = r;
  785         }
  786         for (i = 0; i < se->se_xrates[1]; i++) {
  787                 r = se->se_xrates[2+i] & IEEE80211_RATE_VAL;
  788                 if (r > rmax)
  789                         rmax = r;
  790         }
  791         return rmax;
  792 }
  793 
  794 /*
  795  * Compare the capabilities of two entries and decide which is
  796  * more desirable (return >0 if a is considered better).  Note
  797  * that we assume compatibility/usability has already been checked
  798  * so we don't need to (e.g. validate whether privacy is supported).
  799  * Used to select the best scan candidate for association in a BSS.
  800  */
  801 static int
  802 sta_compare(const struct sta_entry *a, const struct sta_entry *b)
  803 {
  804 #define PREFER(_a,_b,_what) do {                        \
  805         if (((_a) ^ (_b)) & (_what))                    \
  806                 return ((_a) & (_what)) ? 1 : -1;       \
  807 } while (0)
  808         int maxa, maxb;
  809         int8_t rssia, rssib;
  810         int weight;
  811 
  812         /* privacy support */
  813         PREFER(a->base.se_capinfo, b->base.se_capinfo,
  814                 IEEE80211_CAPINFO_PRIVACY);
  815 
  816         /* compare count of previous failures */
  817         weight = b->se_fails - a->se_fails;
  818         if (abs(weight) > 1)
  819                 return weight;
  820 
  821         /*
  822          * Compare rssi.  If the two are considered equivalent
  823          * then fallback to other criteria.  We threshold the
  824          * comparisons to avoid selecting an ap purely by rssi
  825          * when both values may be good but one ap is otherwise
  826          * more desirable (e.g. an 11b-only ap with stronger
  827          * signal than an 11g ap).
  828          */
  829         rssia = MIN(a->base.se_rssi, STA_RSSI_MAX);
  830         rssib = MIN(b->base.se_rssi, STA_RSSI_MAX);
  831         if (abs(rssib - rssia) < 5) {
  832                 /* best/max rate preferred if signal level close enough XXX */
  833                 maxa = maxrate(&a->base);
  834                 maxb = maxrate(&b->base);
  835                 if (maxa != maxb)
  836                         return maxa - maxb;
  837                 /* XXX use freq for channel preference */
  838                 /* for now just prefer 5Ghz band to all other bands */
  839                 PREFER(IEEE80211_IS_CHAN_5GHZ(a->base.se_chan),
  840                        IEEE80211_IS_CHAN_5GHZ(b->base.se_chan), 1);
  841         }
  842         /* all things being equal, use signal level */
  843         return a->base.se_rssi - b->base.se_rssi;
  844 #undef PREFER
  845 }
  846 
  847 /*
  848  * Check rate set suitability and return the best supported rate.
  849  * XXX inspect MCS for HT
  850  */
  851 static int
  852 check_rate(struct ieee80211vap *vap, const struct ieee80211_channel *chan,
  853     const struct ieee80211_scan_entry *se)
  854 {
  855 #define RV(v)   ((v) & IEEE80211_RATE_VAL)
  856         const struct ieee80211_rateset *srs;
  857         int i, j, nrs, r, okrate, badrate, fixedrate, ucastrate;
  858         const uint8_t *rs;
  859 
  860         okrate = badrate = 0;
  861 
  862         srs = ieee80211_get_suprates(vap->iv_ic, chan);
  863         nrs = se->se_rates[1];
  864         rs = se->se_rates+2;
  865         /* XXX MCS */
  866         ucastrate = vap->iv_txparms[ieee80211_chan2mode(chan)].ucastrate;
  867         fixedrate = IEEE80211_FIXED_RATE_NONE;
  868 again:
  869         for (i = 0; i < nrs; i++) {
  870                 r = RV(rs[i]);
  871                 badrate = r;
  872                 /*
  873                  * Check any fixed rate is included. 
  874                  */
  875                 if (r == ucastrate)
  876                         fixedrate = r;
  877                 /*
  878                  * Check against our supported rates.
  879                  */
  880                 for (j = 0; j < srs->rs_nrates; j++)
  881                         if (r == RV(srs->rs_rates[j])) {
  882                                 if (r > okrate)         /* NB: track max */
  883                                         okrate = r;
  884                                 break;
  885                         }
  886 
  887                 if (j == srs->rs_nrates && (rs[i] & IEEE80211_RATE_BASIC)) {
  888                         /*
  889                          * Don't try joining a BSS, if we don't support
  890                          * one of its basic rates.
  891                          */
  892                         okrate = 0;
  893                         goto back;
  894                 }
  895         }
  896         if (rs == se->se_rates+2) {
  897                 /* scan xrates too; sort of an algol68-style for loop */
  898                 nrs = se->se_xrates[1];
  899                 rs = se->se_xrates+2;
  900                 goto again;
  901         }
  902 
  903 back:
  904         if (okrate == 0 || ucastrate != fixedrate)
  905                 return badrate | IEEE80211_RATE_BASIC;
  906         else
  907                 return RV(okrate);
  908 #undef RV
  909 }
  910 
  911 static __inline int
  912 match_id(const uint8_t *ie, const uint8_t *val, int len)
  913 {
  914         return (ie[1] == len && memcmp(ie+2, val, len) == 0);
  915 }
  916 
  917 static int
  918 match_ssid(const uint8_t *ie,
  919         int nssid, const struct ieee80211_scan_ssid ssids[])
  920 {
  921         int i;
  922 
  923         for (i = 0; i < nssid; i++) {
  924                 if (match_id(ie, ssids[i].ssid, ssids[i].len))
  925                         return 1;
  926         }
  927         return 0;
  928 }
  929 
  930 #ifdef IEEE80211_SUPPORT_TDMA
  931 static int
  932 tdma_isfull(const struct ieee80211_tdma_param *tdma)
  933 {
  934         int slot, slotcnt;
  935 
  936         slotcnt = tdma->tdma_slotcnt;
  937         for (slot = slotcnt-1; slot >= 0; slot--)
  938                 if (isclr(tdma->tdma_inuse, slot))
  939                         return 0;
  940         return 1;
  941 }
  942 #endif /* IEEE80211_SUPPORT_TDMA */
  943 
  944 /*
  945  * Test a scan candidate for suitability/compatibility.
  946  */
  947 static int
  948 match_bss(struct ieee80211vap *vap,
  949         const struct ieee80211_scan_state *ss, struct sta_entry *se0,
  950         int debug)
  951 {
  952         struct ieee80211com *ic = vap->iv_ic;
  953         struct ieee80211_scan_entry *se = &se0->base;
  954         uint8_t rate;
  955         int fail;
  956 
  957         fail = 0;
  958         if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, se->se_chan)))
  959                 fail |= MATCH_CHANNEL;
  960         /*
  961          * NB: normally the desired mode is used to construct
  962          * the channel list, but it's possible for the scan
  963          * cache to include entries for stations outside this
  964          * list so we check the desired mode here to weed them
  965          * out.
  966          */
  967         if (vap->iv_des_mode != IEEE80211_MODE_AUTO &&
  968             (se->se_chan->ic_flags & IEEE80211_CHAN_ALLTURBO) !=
  969             chanflags[vap->iv_des_mode])
  970                 fail |= MATCH_CHANNEL;
  971         if (vap->iv_opmode == IEEE80211_M_IBSS) {
  972                 if ((se->se_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
  973                         fail |= MATCH_CAPINFO;
  974 #ifdef IEEE80211_SUPPORT_TDMA
  975         } else if (vap->iv_opmode == IEEE80211_M_AHDEMO) {
  976                 /*
  977                  * Adhoc demo network setup shouldn't really be scanning
  978                  * but just in case skip stations operating in IBSS or
  979                  * BSS mode.
  980                  */
  981                 if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS))
  982                         fail |= MATCH_CAPINFO;
  983                 /*
  984                  * TDMA operation cannot coexist with a normal 802.11 network;
  985                  * skip if IBSS or ESS capabilities are marked and require
  986                  * the beacon have a TDMA ie present.
  987                  */
  988                 if (vap->iv_caps & IEEE80211_C_TDMA) {
  989                         const struct ieee80211_tdma_param *tdma =
  990                             (const struct ieee80211_tdma_param *)se->se_ies.tdma_ie;
  991                         const struct ieee80211_tdma_state *ts = vap->iv_tdma;
  992 
  993                         if (tdma == NULL)
  994                                 fail |= MATCH_TDMA_NOIE;
  995                         else if (tdma->tdma_version != ts->tdma_version)
  996                                 fail |= MATCH_TDMA_VERSION;
  997                         else if (tdma->tdma_slot != 0)
  998                                 fail |= MATCH_TDMA_NOTMASTER;
  999                         else if (tdma_isfull(tdma))
 1000                                 fail |= MATCH_TDMA_NOSLOT;
 1001 #if 0
 1002                         else if (ieee80211_local_address(se->se_macaddr))
 1003                                 fail |= MATCH_TDMA_LOCAL;
 1004 #endif
 1005                 }
 1006 #endif /* IEEE80211_SUPPORT_TDMA */
 1007 #ifdef IEEE80211_SUPPORT_MESH
 1008         } else if (vap->iv_opmode == IEEE80211_M_MBSS) {
 1009                 const struct ieee80211_mesh_state *ms = vap->iv_mesh;
 1010                 /*
 1011                  * Mesh nodes have IBSS & ESS bits in capinfo turned off
 1012                  * and two special ie's that must be present.
 1013                  */
 1014                 if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS))
 1015                         fail |= MATCH_CAPINFO;
 1016                 else if (se->se_meshid == NULL)
 1017                         fail |= MATCH_MESH_NOID;
 1018                 else if (ms->ms_idlen != 0 &&
 1019                     match_id(se->se_meshid, ms->ms_id, ms->ms_idlen))
 1020                         fail |= MATCH_MESHID;
 1021 #endif
 1022         } else {
 1023                 if ((se->se_capinfo & IEEE80211_CAPINFO_ESS) == 0)
 1024                         fail |= MATCH_CAPINFO;
 1025                 /*
 1026                  * If 11d is enabled and we're attempting to join a bss
 1027                  * that advertises it's country code then compare our
 1028                  * current settings to what we fetched from the country ie.
 1029                  * If our country code is unspecified or different then do
 1030                  * not attempt to join the bss.  We should have already
 1031                  * dispatched an event to user space that identifies the
 1032                  * new country code so our regdomain config should match.
 1033                  */
 1034                 if ((IEEE80211_IS_CHAN_11D(se->se_chan) ||
 1035                     (vap->iv_flags_ext & IEEE80211_FEXT_DOTD)) &&
 1036                     se->se_cc[0] != 0 &&
 1037                     (ic->ic_regdomain.country == CTRY_DEFAULT ||
 1038                      !isocmp(se->se_cc, ic->ic_regdomain.isocc)))
 1039                         fail |= MATCH_CC;
 1040         }
 1041         if (vap->iv_flags & IEEE80211_F_PRIVACY) {
 1042                 if ((se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
 1043                         fail |= MATCH_PRIVACY;
 1044         } else {
 1045                 /* XXX does this mean privacy is supported or required? */
 1046                 if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY)
 1047                         fail |= MATCH_PRIVACY;
 1048         }
 1049         se0->se_flags &= ~STA_DEMOTE11B;
 1050         rate = check_rate(vap, se->se_chan, se);
 1051         if (rate & IEEE80211_RATE_BASIC) {
 1052                 fail |= MATCH_RATE;
 1053                 /*
 1054                  * An 11b-only ap will give a rate mismatch if there is an
 1055                  * OFDM fixed tx rate for 11g.  Try downgrading the channel
 1056                  * in the scan list to 11b and retry the rate check.
 1057                  */
 1058                 if (IEEE80211_IS_CHAN_ANYG(se->se_chan)) {
 1059                         rate = check_rate(vap, demote11b(vap, se->se_chan), se);
 1060                         if ((rate & IEEE80211_RATE_BASIC) == 0) {
 1061                                 fail &= ~MATCH_RATE;
 1062                                 se0->se_flags |= STA_DEMOTE11B;
 1063                         }
 1064                 }
 1065         } else if (rate < 2*24) {
 1066                 /*
 1067                  * This is an 11b-only ap.  Check the desired mode in
 1068                  * case that needs to be honored (mode 11g filters out
 1069                  * 11b-only ap's).  Otherwise force any 11g channel used
 1070                  * in scanning to be demoted.
 1071                  *
 1072                  * NB: we cheat a bit here by looking at the max rate;
 1073                  *     we could/should check the rates.
 1074                  */
 1075                 if (!(vap->iv_des_mode == IEEE80211_MODE_AUTO ||
 1076                       vap->iv_des_mode == IEEE80211_MODE_11B))
 1077                         fail |= MATCH_RATE;
 1078                 else
 1079                         se0->se_flags |= STA_DEMOTE11B;
 1080         }
 1081         if (ss->ss_nssid != 0 &&
 1082             !match_ssid(se->se_ssid, ss->ss_nssid, ss->ss_ssid))
 1083                 fail |= MATCH_SSID;
 1084         if ((vap->iv_flags & IEEE80211_F_DESBSSID) &&
 1085             !IEEE80211_ADDR_EQ(vap->iv_des_bssid, se->se_bssid))
 1086                 fail |= MATCH_BSSID;
 1087         if (se0->se_fails >= STA_FAILS_MAX)
 1088                 fail |= MATCH_FAILS;
 1089         if (se0->se_notseen >= STA_PURGE_SCANS)
 1090                 fail |= MATCH_NOTSEEN;
 1091         if (se->se_rssi < STA_RSSI_MIN)
 1092                 fail |= MATCH_RSSI;
 1093 #ifdef IEEE80211_DEBUG
 1094         if (ieee80211_msg(vap, debug)) {
 1095                 printf(" %c %s",
 1096                     fail & MATCH_FAILS ? '=' :
 1097                     fail & MATCH_NOTSEEN ? '^' :
 1098                     fail & MATCH_CC ? '$' :
 1099 #ifdef IEEE80211_SUPPORT_TDMA
 1100                     fail & MATCH_TDMA_NOIE ? '&' :
 1101                     fail & MATCH_TDMA_VERSION ? 'v' :
 1102                     fail & MATCH_TDMA_NOTMASTER ? 's' :
 1103                     fail & MATCH_TDMA_NOSLOT ? 'f' :
 1104                     fail & MATCH_TDMA_LOCAL ? 'l' :
 1105 #endif
 1106                     fail & MATCH_MESH_NOID ? 'm' :
 1107                     fail ? '-' : '+', ether_sprintf(se->se_macaddr));
 1108                 printf(" %s%c", ether_sprintf(se->se_bssid),
 1109                     fail & MATCH_BSSID ? '!' : ' ');
 1110                 printf(" %3d%c", ieee80211_chan2ieee(ic, se->se_chan),
 1111                         fail & MATCH_CHANNEL ? '!' : ' ');
 1112                 printf(" %+4d%c", se->se_rssi, fail & MATCH_RSSI ? '!' : ' ');
 1113                 printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
 1114                     fail & MATCH_RATE ? '!' : ' ');
 1115                 printf(" %4s%c",
 1116                     (se->se_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
 1117                     (se->se_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" : "",
 1118                     fail & MATCH_CAPINFO ? '!' : ' ');
 1119                 printf(" %3s%c ",
 1120                     (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) ?
 1121                     "wep" : "no",
 1122                     fail & MATCH_PRIVACY ? '!' : ' ');
 1123                 ieee80211_print_essid(se->se_ssid+2, se->se_ssid[1]);
 1124                 printf("%s\n", fail & (MATCH_SSID | MATCH_MESHID) ? "!" : "");
 1125         }
 1126 #endif
 1127         return fail;
 1128 }
 1129 
 1130 static void
 1131 sta_update_notseen(struct sta_table *st)
 1132 {
 1133         struct sta_entry *se;
 1134 
 1135         mtx_lock(&st->st_lock);
 1136         TAILQ_FOREACH(se, &st->st_entry, se_list) {
 1137                 /*
 1138                  * If seen the reset and don't bump the count;
 1139                  * otherwise bump the ``not seen'' count.  Note
 1140                  * that this insures that stations for which we
 1141                  * see frames while not scanning but not during
 1142                  * this scan will not be penalized.
 1143                  */
 1144                 if (se->se_seen)
 1145                         se->se_seen = 0;
 1146                 else
 1147                         se->se_notseen++;
 1148         }
 1149         mtx_unlock(&st->st_lock);
 1150 }
 1151 
 1152 static void
 1153 sta_dec_fails(struct sta_table *st)
 1154 {
 1155         struct sta_entry *se;
 1156 
 1157         mtx_lock(&st->st_lock);
 1158         TAILQ_FOREACH(se, &st->st_entry, se_list)
 1159                 if (se->se_fails)
 1160                         se->se_fails--;
 1161         mtx_unlock(&st->st_lock);
 1162 }
 1163 
 1164 static struct sta_entry *
 1165 select_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap, int debug)
 1166 {
 1167         struct sta_table *st = ss->ss_priv;
 1168         struct sta_entry *se, *selbs = NULL;
 1169 
 1170         IEEE80211_DPRINTF(vap, debug, " %s\n",
 1171             "macaddr          bssid         chan  rssi  rate flag  wep  essid");
 1172         mtx_lock(&st->st_lock);
 1173         TAILQ_FOREACH(se, &st->st_entry, se_list) {
 1174                 ieee80211_ies_expand(&se->base.se_ies);
 1175                 if (match_bss(vap, ss, se, debug) == 0) {
 1176                         if (selbs == NULL)
 1177                                 selbs = se;
 1178                         else if (sta_compare(se, selbs) > 0)
 1179                                 selbs = se;
 1180                 }
 1181         }
 1182         mtx_unlock(&st->st_lock);
 1183 
 1184         return selbs;
 1185 }
 1186 
 1187 /*
 1188  * Pick an ap or ibss network to join or find a channel
 1189  * to use to start an ibss network.
 1190  */
 1191 static int
 1192 sta_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1193 {
 1194         struct sta_table *st = ss->ss_priv;
 1195         struct sta_entry *selbs;
 1196         struct ieee80211_channel *chan;
 1197 
 1198         KASSERT(vap->iv_opmode == IEEE80211_M_STA,
 1199                 ("wrong mode %u", vap->iv_opmode));
 1200 
 1201         if (st->st_newscan) {
 1202                 sta_update_notseen(st);
 1203                 st->st_newscan = 0;
 1204         }
 1205         if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
 1206                 /*
 1207                  * Manual/background scan, don't select+join the
 1208                  * bss, just return.  The scanning framework will
 1209                  * handle notification that this has completed.
 1210                  */
 1211                 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
 1212                 return 1;
 1213         }
 1214         /*
 1215          * Automatic sequencing; look for a candidate and
 1216          * if found join the network.
 1217          */
 1218         /* NB: unlocked read should be ok */
 1219         if (TAILQ_FIRST(&st->st_entry) == NULL) {
 1220                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 1221                         "%s: no scan candidate\n", __func__);
 1222                 if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
 1223                         return 0;
 1224 notfound:
 1225                 /*
 1226                  * If nothing suitable was found decrement
 1227                  * the failure counts so entries will be
 1228                  * reconsidered the next time around.  We
 1229                  * really want to do this only for sta's
 1230                  * where we've previously had some success.
 1231                  */
 1232                 sta_dec_fails(st);
 1233                 st->st_newscan = 1;
 1234                 return 0;                       /* restart scan */
 1235         }
 1236         selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
 1237         if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
 1238                 return (selbs != NULL);
 1239         if (selbs == NULL)
 1240                 goto notfound;
 1241         chan = selbs->base.se_chan;
 1242         if (selbs->se_flags & STA_DEMOTE11B)
 1243                 chan = demote11b(vap, chan);
 1244         if (!ieee80211_sta_join(vap, chan, &selbs->base))
 1245                 goto notfound;
 1246         return 1;                               /* terminate scan */
 1247 }
 1248 
 1249 /*
 1250  * Lookup an entry in the scan cache.  We assume we're
 1251  * called from the bottom half or such that we don't need
 1252  * to block the bottom half so that it's safe to return
 1253  * a reference to an entry w/o holding the lock on the table.
 1254  */
 1255 static struct sta_entry *
 1256 sta_lookup(struct sta_table *st, const uint8_t macaddr[IEEE80211_ADDR_LEN])
 1257 {
 1258         struct sta_entry *se;
 1259         int hash = STA_HASH(macaddr);
 1260 
 1261         mtx_lock(&st->st_lock);
 1262         LIST_FOREACH(se, &st->st_hash[hash], se_hash)
 1263                 if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr))
 1264                         break;
 1265         mtx_unlock(&st->st_lock);
 1266 
 1267         return se;              /* NB: unlocked */
 1268 }
 1269 
 1270 static void
 1271 sta_roam_check(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1272 {
 1273         struct ieee80211com *ic = vap->iv_ic;
 1274         struct ieee80211_node *ni = vap->iv_bss;
 1275         struct sta_table *st = ss->ss_priv;
 1276         enum ieee80211_phymode mode;
 1277         struct sta_entry *se, *selbs;
 1278         uint8_t roamRate, curRate, ucastRate;
 1279         int8_t roamRssi, curRssi;
 1280 
 1281         se = sta_lookup(st, ni->ni_macaddr);
 1282         if (se == NULL) {
 1283                 /* XXX something is wrong */
 1284                 return;
 1285         }
 1286 
 1287         mode = ieee80211_chan2mode(ic->ic_bsschan);
 1288         roamRate = vap->iv_roamparms[mode].rate;
 1289         roamRssi = vap->iv_roamparms[mode].rssi;
 1290         ucastRate = vap->iv_txparms[mode].ucastrate;
 1291         /* NB: the most up to date rssi is in the node, not the scan cache */
 1292         curRssi = ic->ic_node_getrssi(ni);
 1293         if (ucastRate == IEEE80211_FIXED_RATE_NONE) {
 1294                 curRate = ni->ni_txrate;
 1295                 roamRate &= IEEE80211_RATE_VAL;
 1296                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ROAM,
 1297                     "%s: currssi %d currate %u roamrssi %d roamrate %u\n",
 1298                     __func__, curRssi, curRate, roamRssi, roamRate);
 1299         } else {
 1300                 curRate = roamRate;     /* NB: insure compare below fails */
 1301                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ROAM,
 1302                     "%s: currssi %d roamrssi %d\n", __func__, curRssi, roamRssi);
 1303         }
 1304         /*
 1305          * Check if a new ap should be used and switch.
 1306          * XXX deauth current ap
 1307          */
 1308         if (curRate < roamRate || curRssi < roamRssi) {
 1309                 if (time_after(ticks, ic->ic_lastscan + vap->iv_scanvalid)) {
 1310                         /*
 1311                          * Scan cache contents are too old; force a scan now
 1312                          * if possible so we have current state to make a
 1313                          * decision with.  We don't kick off a bg scan if
 1314                          * we're using dynamic turbo and boosted or if the
 1315                          * channel is busy.
 1316                          * XXX force immediate switch on scan complete
 1317                          */
 1318                         if (!IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
 1319                             time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle))
 1320                                 ieee80211_bg_scan(vap, 0);
 1321                         return;
 1322                 }
 1323                 se->base.se_rssi = curRssi;
 1324                 selbs = select_bss(ss, vap, IEEE80211_MSG_ROAM);
 1325                 if (selbs != NULL && selbs != se) {
 1326                         struct ieee80211_channel *chan;
 1327 
 1328                         IEEE80211_DPRINTF(vap,
 1329                             IEEE80211_MSG_ROAM | IEEE80211_MSG_DEBUG,
 1330                             "%s: ROAM: curRate %u, roamRate %u, "
 1331                             "curRssi %d, roamRssi %d\n", __func__,
 1332                             curRate, roamRate, curRssi, roamRssi);
 1333 
 1334                         chan = selbs->base.se_chan;
 1335                         if (selbs->se_flags & STA_DEMOTE11B)
 1336                                 chan = demote11b(vap, chan);
 1337                         (void) ieee80211_sta_join(vap, chan, &selbs->base);
 1338                 }
 1339         }
 1340 }
 1341 
 1342 /*
 1343  * Age entries in the scan cache.
 1344  * XXX also do roaming since it's convenient
 1345  */
 1346 static void
 1347 sta_age(struct ieee80211_scan_state *ss)
 1348 {
 1349         struct ieee80211vap *vap = ss->ss_vap;
 1350 
 1351         adhoc_age(ss);
 1352         /*
 1353          * If rate control is enabled check periodically to see if
 1354          * we should roam from our current connection to one that
 1355          * might be better.  This only applies when we're operating
 1356          * in sta mode and automatic roaming is set.
 1357          * XXX defer if busy
 1358          * XXX repeater station
 1359          * XXX do when !bgscan?
 1360          */
 1361         KASSERT(vap->iv_opmode == IEEE80211_M_STA,
 1362                 ("wrong mode %u", vap->iv_opmode));
 1363         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO &&
 1364             (vap->iv_ic->ic_flags & IEEE80211_F_BGSCAN) &&
 1365             vap->iv_state >= IEEE80211_S_RUN)
 1366                 /* XXX vap is implicit */
 1367                 sta_roam_check(ss, vap);
 1368 }
 1369 
 1370 /*
 1371  * Iterate over the entries in the scan cache, invoking
 1372  * the callback function on each one.
 1373  */
 1374 static void
 1375 sta_iterate(struct ieee80211_scan_state *ss, 
 1376         ieee80211_scan_iter_func *f, void *arg)
 1377 {
 1378         struct sta_table *st = ss->ss_priv;
 1379         struct sta_entry *se;
 1380         u_int gen;
 1381 
 1382         mtx_lock(&st->st_scanlock);
 1383         gen = st->st_scaniter++;
 1384 restart:
 1385         mtx_lock(&st->st_lock);
 1386         TAILQ_FOREACH(se, &st->st_entry, se_list) {
 1387                 if (se->se_scangen != gen) {
 1388                         se->se_scangen = gen;
 1389                         /* update public state */
 1390                         se->base.se_age = ticks - se->se_lastupdate;
 1391                         mtx_unlock(&st->st_lock);
 1392                         (*f)(arg, &se->base);
 1393                         goto restart;
 1394                 }
 1395         }
 1396         mtx_unlock(&st->st_lock);
 1397 
 1398         mtx_unlock(&st->st_scanlock);
 1399 }
 1400 
 1401 static void
 1402 sta_assoc_fail(struct ieee80211_scan_state *ss,
 1403         const uint8_t macaddr[IEEE80211_ADDR_LEN], int reason)
 1404 {
 1405         struct sta_table *st = ss->ss_priv;
 1406         struct sta_entry *se;
 1407 
 1408         se = sta_lookup(st, macaddr);
 1409         if (se != NULL) {
 1410                 se->se_fails++;
 1411                 se->se_lastfail = ticks;
 1412                 IEEE80211_NOTE_MAC(ss->ss_vap, IEEE80211_MSG_SCAN,
 1413                     macaddr, "%s: reason %u fails %u",
 1414                     __func__, reason, se->se_fails);
 1415         }
 1416 }
 1417 
 1418 static void
 1419 sta_assoc_success(struct ieee80211_scan_state *ss,
 1420         const uint8_t macaddr[IEEE80211_ADDR_LEN])
 1421 {
 1422         struct sta_table *st = ss->ss_priv;
 1423         struct sta_entry *se;
 1424 
 1425         se = sta_lookup(st, macaddr);
 1426         if (se != NULL) {
 1427 #if 0
 1428                 se->se_fails = 0;
 1429                 IEEE80211_NOTE_MAC(ss->ss_vap, IEEE80211_MSG_SCAN,
 1430                     macaddr, "%s: fails %u",
 1431                     __func__, se->se_fails);
 1432 #endif
 1433                 se->se_lastassoc = ticks;
 1434         }
 1435 }
 1436 
 1437 static const struct ieee80211_scanner sta_default = {
 1438         .scan_name              = "default",
 1439         .scan_attach            = sta_attach,
 1440         .scan_detach            = sta_detach,
 1441         .scan_start             = sta_start,
 1442         .scan_restart           = sta_restart,
 1443         .scan_cancel            = sta_cancel,
 1444         .scan_end               = sta_pick_bss,
 1445         .scan_flush             = sta_flush,
 1446         .scan_add               = sta_add,
 1447         .scan_age               = sta_age,
 1448         .scan_iterate           = sta_iterate,
 1449         .scan_assoc_fail        = sta_assoc_fail,
 1450         .scan_assoc_success     = sta_assoc_success,
 1451 };
 1452 IEEE80211_SCANNER_ALG(sta, IEEE80211_M_STA, sta_default);
 1453 
 1454 /*
 1455  * Adhoc mode-specific support.
 1456  */
 1457 
 1458 static const uint16_t adhocWorld[] =            /* 36, 40, 44, 48 */
 1459 { 5180, 5200, 5220, 5240 };
 1460 static const uint16_t adhocFcc3[] =             /* 36, 40, 44, 48 145, 149, 153, 157, 161, 165 */
 1461 { 5180, 5200, 5220, 5240, 5725, 5745, 5765, 5785, 5805, 5825 };
 1462 static const uint16_t adhocMkk[] =              /* 34, 38, 42, 46 */
 1463 { 5170, 5190, 5210, 5230 };
 1464 static const uint16_t adhoc11b[] =              /* 10, 11 */
 1465 { 2457, 2462 };
 1466 
 1467 static const struct scanlist adhocScanTable[] = {
 1468         { IEEE80211_MODE_11B,           X(adhoc11b) },
 1469         { IEEE80211_MODE_11A,           X(adhocWorld) },
 1470         { IEEE80211_MODE_11A,           X(adhocFcc3) },
 1471         { IEEE80211_MODE_11B,           X(adhocMkk) },
 1472         { .list = NULL }
 1473 };
 1474 #undef X
 1475 
 1476 /*
 1477  * Start an adhoc-mode scan by populating the channel list.
 1478  */
 1479 static int
 1480 adhoc_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1481 {
 1482         struct sta_table *st = ss->ss_priv;
 1483         
 1484         makescanlist(ss, vap, adhocScanTable);
 1485 
 1486         if (ss->ss_mindwell == 0)
 1487                 ss->ss_mindwell = msecs_to_ticks(200);  /* 200ms */
 1488         if (ss->ss_maxdwell == 0)
 1489                 ss->ss_maxdwell = msecs_to_ticks(200);  /* 200ms */
 1490 
 1491         st->st_scangen++;
 1492         st->st_newscan = 1;
 1493 
 1494         return 0;
 1495 }
 1496 
 1497 /*
 1498  * Select a channel to start an adhoc network on.
 1499  * The channel list was populated with appropriate
 1500  * channels so select one that looks least occupied.
 1501  */
 1502 static struct ieee80211_channel *
 1503 adhoc_pick_channel(struct ieee80211_scan_state *ss, int flags)
 1504 {
 1505         struct sta_table *st = ss->ss_priv;
 1506         struct sta_entry *se;
 1507         struct ieee80211_channel *c, *bestchan;
 1508         int i, bestrssi, maxrssi;
 1509 
 1510         bestchan = NULL;
 1511         bestrssi = -1;
 1512 
 1513         mtx_lock(&st->st_lock);
 1514         for (i = 0; i < ss->ss_last; i++) {
 1515                 c = ss->ss_chans[i];
 1516                 /* never consider a channel with radar */
 1517                 if (IEEE80211_IS_CHAN_RADAR(c))
 1518                         continue;
 1519                 /* skip channels disallowed by regulatory settings */
 1520                 if (IEEE80211_IS_CHAN_NOADHOC(c))
 1521                         continue;
 1522                 /* check channel attributes for band compatibility */
 1523                 if (flags != 0 && (c->ic_flags & flags) != flags)
 1524                         continue;
 1525                 maxrssi = 0;
 1526                 TAILQ_FOREACH(se, &st->st_entry, se_list) {
 1527                         if (se->base.se_chan != c)
 1528                                 continue;
 1529                         if (se->base.se_rssi > maxrssi)
 1530                                 maxrssi = se->base.se_rssi;
 1531                 }
 1532                 if (bestchan == NULL || maxrssi < bestrssi)
 1533                         bestchan = c;
 1534         }
 1535         mtx_unlock(&st->st_lock);
 1536 
 1537         return bestchan;
 1538 }
 1539 
 1540 /*
 1541  * Pick an ibss network to join or find a channel
 1542  * to use to start an ibss network.
 1543  */
 1544 static int
 1545 adhoc_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1546 {
 1547         struct sta_table *st = ss->ss_priv;
 1548         struct sta_entry *selbs;
 1549         struct ieee80211_channel *chan;
 1550 
 1551         KASSERT(vap->iv_opmode == IEEE80211_M_IBSS ||
 1552                 vap->iv_opmode == IEEE80211_M_AHDEMO ||
 1553                 vap->iv_opmode == IEEE80211_M_MBSS,
 1554                 ("wrong opmode %u", vap->iv_opmode));
 1555 
 1556         if (st->st_newscan) {
 1557                 sta_update_notseen(st);
 1558                 st->st_newscan = 0;
 1559         }
 1560         if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
 1561                 /*
 1562                  * Manual/background scan, don't select+join the
 1563                  * bss, just return.  The scanning framework will
 1564                  * handle notification that this has completed.
 1565                  */
 1566                 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
 1567                 return 1;
 1568         }
 1569         /*
 1570          * Automatic sequencing; look for a candidate and
 1571          * if found join the network.
 1572          */
 1573         /* NB: unlocked read should be ok */
 1574         if (TAILQ_FIRST(&st->st_entry) == NULL) {
 1575                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 1576                         "%s: no scan candidate\n", __func__);
 1577                 if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
 1578                         return 0;
 1579 notfound:
 1580                 /* NB: never auto-start a tdma network for slot !0 */
 1581 #ifdef IEEE80211_SUPPORT_TDMA
 1582                 if (vap->iv_des_nssid &&
 1583                     ((vap->iv_caps & IEEE80211_C_TDMA) == 0 ||
 1584                      ieee80211_tdma_getslot(vap) == 0)) {
 1585 #else
 1586                 if (vap->iv_des_nssid) {
 1587 #endif
 1588                         /*
 1589                          * No existing adhoc network to join and we have
 1590                          * an ssid; start one up.  If no channel was
 1591                          * specified, try to select a channel.
 1592                          */
 1593                         if (vap->iv_des_chan == IEEE80211_CHAN_ANYC ||
 1594                             IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
 1595                                 struct ieee80211com *ic = vap->iv_ic;
 1596 
 1597                                 chan = adhoc_pick_channel(ss, 0);
 1598                                 if (chan != NULL)
 1599                                         chan = ieee80211_ht_adjust_channel(ic,
 1600                                             chan, vap->iv_flags_ht);
 1601                         } else
 1602                                 chan = vap->iv_des_chan;
 1603                         if (chan != NULL) {
 1604                                 ieee80211_create_ibss(vap, chan);
 1605                                 return 1;
 1606                         }
 1607                 }
 1608                 /*
 1609                  * If nothing suitable was found decrement
 1610                  * the failure counts so entries will be
 1611                  * reconsidered the next time around.  We
 1612                  * really want to do this only for sta's
 1613                  * where we've previously had some success.
 1614                  */
 1615                 sta_dec_fails(st);
 1616                 st->st_newscan = 1;
 1617                 return 0;                       /* restart scan */
 1618         }
 1619         selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
 1620         if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
 1621                 return (selbs != NULL);
 1622         if (selbs == NULL)
 1623                 goto notfound;
 1624         chan = selbs->base.se_chan;
 1625         if (selbs->se_flags & STA_DEMOTE11B)
 1626                 chan = demote11b(vap, chan);
 1627         if (!ieee80211_sta_join(vap, chan, &selbs->base))
 1628                 goto notfound;
 1629         return 1;                               /* terminate scan */
 1630 }
 1631 
 1632 /*
 1633  * Age entries in the scan cache.
 1634  */
 1635 static void
 1636 adhoc_age(struct ieee80211_scan_state *ss)
 1637 {
 1638         struct sta_table *st = ss->ss_priv;
 1639         struct sta_entry *se, *next;
 1640 
 1641         mtx_lock(&st->st_lock);
 1642         TAILQ_FOREACH_SAFE(se, &st->st_entry, se_list, next) {
 1643                 if (se->se_notseen > STA_PURGE_SCANS) {
 1644                         TAILQ_REMOVE(&st->st_entry, se, se_list);
 1645                         LIST_REMOVE(se, se_hash);
 1646                         ieee80211_ies_cleanup(&se->base.se_ies);
 1647                         free(se, M_80211_SCAN);
 1648                 }
 1649         }
 1650         mtx_unlock(&st->st_lock);
 1651 }
 1652 
 1653 static const struct ieee80211_scanner adhoc_default = {
 1654         .scan_name              = "default",
 1655         .scan_attach            = sta_attach,
 1656         .scan_detach            = sta_detach,
 1657         .scan_start             = adhoc_start,
 1658         .scan_restart           = sta_restart,
 1659         .scan_cancel            = sta_cancel,
 1660         .scan_end               = adhoc_pick_bss,
 1661         .scan_flush             = sta_flush,
 1662         .scan_pickchan          = adhoc_pick_channel,
 1663         .scan_add               = sta_add,
 1664         .scan_age               = adhoc_age,
 1665         .scan_iterate           = sta_iterate,
 1666         .scan_assoc_fail        = sta_assoc_fail,
 1667         .scan_assoc_success     = sta_assoc_success,
 1668 };
 1669 IEEE80211_SCANNER_ALG(ibss, IEEE80211_M_IBSS, adhoc_default);
 1670 IEEE80211_SCANNER_ALG(ahdemo, IEEE80211_M_AHDEMO, adhoc_default);
 1671 
 1672 static void
 1673 ap_force_promisc(struct ieee80211com *ic)
 1674 {
 1675         struct ifnet *ifp = ic->ic_ifp;
 1676 
 1677         IEEE80211_LOCK(ic);
 1678         /* set interface into promiscuous mode */
 1679         ifp->if_flags |= IFF_PROMISC;
 1680         ieee80211_runtask(ic, &ic->ic_promisc_task);
 1681         IEEE80211_UNLOCK(ic);
 1682 }
 1683 
 1684 static void
 1685 ap_reset_promisc(struct ieee80211com *ic)
 1686 {
 1687         IEEE80211_LOCK(ic);
 1688         ieee80211_syncifflag_locked(ic, IFF_PROMISC);
 1689         IEEE80211_UNLOCK(ic);
 1690 }
 1691 
 1692 static int
 1693 ap_start(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1694 {
 1695         struct sta_table *st = ss->ss_priv;
 1696 
 1697         makescanlist(ss, vap, staScanTable);
 1698 
 1699         if (ss->ss_mindwell == 0)
 1700                 ss->ss_mindwell = msecs_to_ticks(200);  /* 200ms */
 1701         if (ss->ss_maxdwell == 0)
 1702                 ss->ss_maxdwell = msecs_to_ticks(200);  /* 200ms */
 1703 
 1704         st->st_scangen++;
 1705         st->st_newscan = 1;
 1706 
 1707         ap_force_promisc(vap->iv_ic);
 1708         return 0;
 1709 }
 1710 
 1711 /*
 1712  * Cancel an ongoing scan.
 1713  */
 1714 static int
 1715 ap_cancel(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1716 {
 1717         ap_reset_promisc(vap->iv_ic);
 1718         return 0;
 1719 }
 1720 
 1721 /*
 1722  * Pick a quiet channel to use for ap operation.
 1723  */
 1724 static struct ieee80211_channel *
 1725 ap_pick_channel(struct ieee80211_scan_state *ss, int flags)
 1726 {
 1727         struct sta_table *st = ss->ss_priv;
 1728         struct ieee80211_channel *bestchan = NULL;
 1729         int i;
 1730 
 1731         /* XXX select channel more intelligently, e.g. channel spread, power */
 1732         /* NB: use scan list order to preserve channel preference */
 1733         for (i = 0; i < ss->ss_last; i++) {
 1734                 struct ieee80211_channel *chan = ss->ss_chans[i];
 1735                 /*
 1736                  * If the channel is unoccupied the max rssi
 1737                  * should be zero; just take it.  Otherwise
 1738                  * track the channel with the lowest rssi and
 1739                  * use that when all channels appear occupied.
 1740                  */
 1741                 if (IEEE80211_IS_CHAN_RADAR(chan))
 1742                         continue;
 1743                 if (IEEE80211_IS_CHAN_NOHOSTAP(chan))
 1744                         continue;
 1745                 /* check channel attributes for band compatibility */
 1746                 if (flags != 0 && (chan->ic_flags & flags) != flags)
 1747                         continue;
 1748                 KASSERT(sizeof(chan->ic_ieee) == 1, ("ic_chan size"));
 1749                 /* XXX channel have interference */
 1750                 if (st->st_maxrssi[chan->ic_ieee] == 0) {
 1751                         /* XXX use other considerations */
 1752                         return chan;
 1753                 }
 1754                 if (bestchan == NULL ||
 1755                     st->st_maxrssi[chan->ic_ieee] < st->st_maxrssi[bestchan->ic_ieee])
 1756                         bestchan = chan;
 1757         }
 1758         return bestchan;
 1759 }
 1760 
 1761 /*
 1762  * Pick a quiet channel to use for ap operation.
 1763  */
 1764 static int
 1765 ap_end(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1766 {
 1767         struct ieee80211com *ic = vap->iv_ic;
 1768         struct ieee80211_channel *bestchan;
 1769 
 1770         KASSERT(vap->iv_opmode == IEEE80211_M_HOSTAP,
 1771                 ("wrong opmode %u", vap->iv_opmode));
 1772         bestchan = ap_pick_channel(ss, 0);
 1773         if (bestchan == NULL) {
 1774                 /* no suitable channel, should not happen */
 1775                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 1776                     "%s: no suitable channel! (should not happen)\n", __func__);
 1777                 /* XXX print something? */
 1778                 return 0;                       /* restart scan */
 1779         }
 1780         /*
 1781          * If this is a dynamic turbo channel, start with the unboosted one.
 1782          */
 1783         if (IEEE80211_IS_CHAN_TURBO(bestchan)) {
 1784                 bestchan = ieee80211_find_channel(ic, bestchan->ic_freq,
 1785                         bestchan->ic_flags & ~IEEE80211_CHAN_TURBO);
 1786                 if (bestchan == NULL) {
 1787                         /* should never happen ?? */
 1788                         return 0;
 1789                 }
 1790         }
 1791         ap_reset_promisc(ic);
 1792         if (ss->ss_flags & (IEEE80211_SCAN_NOPICK | IEEE80211_SCAN_NOJOIN)) {
 1793                 /*
 1794                  * Manual/background scan, don't select+join the
 1795                  * bss, just return.  The scanning framework will
 1796                  * handle notification that this has completed.
 1797                  */
 1798                 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
 1799                 return 1;
 1800         }
 1801         ieee80211_create_ibss(vap,
 1802             ieee80211_ht_adjust_channel(ic, bestchan, vap->iv_flags_ht));
 1803         return 1;
 1804 }
 1805 
 1806 static const struct ieee80211_scanner ap_default = {
 1807         .scan_name              = "default",
 1808         .scan_attach            = sta_attach,
 1809         .scan_detach            = sta_detach,
 1810         .scan_start             = ap_start,
 1811         .scan_restart           = sta_restart,
 1812         .scan_cancel            = ap_cancel,
 1813         .scan_end               = ap_end,
 1814         .scan_flush             = sta_flush,
 1815         .scan_pickchan          = ap_pick_channel,
 1816         .scan_add               = sta_add,
 1817         .scan_age               = adhoc_age,
 1818         .scan_iterate           = sta_iterate,
 1819         .scan_assoc_success     = sta_assoc_success,
 1820         .scan_assoc_fail        = sta_assoc_fail,
 1821 };
 1822 IEEE80211_SCANNER_ALG(ap, IEEE80211_M_HOSTAP, ap_default);
 1823 
 1824 #ifdef IEEE80211_SUPPORT_MESH
 1825 /*
 1826  * Pick an mbss network to join or find a channel
 1827  * to use to start an mbss network.
 1828  */
 1829 static int
 1830 mesh_pick_bss(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 1831 {
 1832         struct sta_table *st = ss->ss_priv;
 1833         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 1834         struct sta_entry *selbs;
 1835         struct ieee80211_channel *chan;
 1836 
 1837         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS,
 1838                 ("wrong opmode %u", vap->iv_opmode));
 1839 
 1840         if (st->st_newscan) {
 1841                 sta_update_notseen(st);
 1842                 st->st_newscan = 0;
 1843         }
 1844         if (ss->ss_flags & IEEE80211_SCAN_NOPICK) {
 1845                 /*
 1846                  * Manual/background scan, don't select+join the
 1847                  * bss, just return.  The scanning framework will
 1848                  * handle notification that this has completed.
 1849                  */
 1850                 ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
 1851                 return 1;
 1852         }
 1853         /*
 1854          * Automatic sequencing; look for a candidate and
 1855          * if found join the network.
 1856          */
 1857         /* NB: unlocked read should be ok */
 1858         if (TAILQ_FIRST(&st->st_entry) == NULL) {
 1859                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 1860                         "%s: no scan candidate\n", __func__);
 1861                 if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
 1862                         return 0;
 1863 notfound:
 1864                 if (ms->ms_idlen != 0) {
 1865                         /*
 1866                          * No existing mbss network to join and we have
 1867                          * a meshid; start one up.  If no channel was
 1868                          * specified, try to select a channel.
 1869                          */
 1870                         if (vap->iv_des_chan == IEEE80211_CHAN_ANYC ||
 1871                             IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
 1872                                 struct ieee80211com *ic = vap->iv_ic;
 1873 
 1874                                 chan = adhoc_pick_channel(ss, 0);
 1875                                 if (chan != NULL)
 1876                                         chan = ieee80211_ht_adjust_channel(ic,
 1877                                             chan, vap->iv_flags_ht);
 1878                         } else
 1879                                 chan = vap->iv_des_chan;
 1880                         if (chan != NULL) {
 1881                                 ieee80211_create_ibss(vap, chan);
 1882                                 return 1;
 1883                         }
 1884                 }
 1885                 /*
 1886                  * If nothing suitable was found decrement
 1887                  * the failure counts so entries will be
 1888                  * reconsidered the next time around.  We
 1889                  * really want to do this only for sta's
 1890                  * where we've previously had some success.
 1891                  */
 1892                 sta_dec_fails(st);
 1893                 st->st_newscan = 1;
 1894                 return 0;                       /* restart scan */
 1895         }
 1896         selbs = select_bss(ss, vap, IEEE80211_MSG_SCAN);
 1897         if (ss->ss_flags & IEEE80211_SCAN_NOJOIN)
 1898                 return (selbs != NULL);
 1899         if (selbs == NULL)
 1900                 goto notfound;
 1901         chan = selbs->base.se_chan;
 1902         if (selbs->se_flags & STA_DEMOTE11B)
 1903                 chan = demote11b(vap, chan);
 1904         if (!ieee80211_sta_join(vap, chan, &selbs->base))
 1905                 goto notfound;
 1906         return 1;                               /* terminate scan */
 1907 }
 1908 
 1909 static const struct ieee80211_scanner mesh_default = {
 1910         .scan_name              = "default",
 1911         .scan_attach            = sta_attach,
 1912         .scan_detach            = sta_detach,
 1913         .scan_start             = adhoc_start,
 1914         .scan_restart           = sta_restart,
 1915         .scan_cancel            = sta_cancel,
 1916         .scan_end               = mesh_pick_bss,
 1917         .scan_flush             = sta_flush,
 1918         .scan_pickchan          = adhoc_pick_channel,
 1919         .scan_add               = sta_add,
 1920         .scan_age               = adhoc_age,
 1921         .scan_iterate           = sta_iterate,
 1922         .scan_assoc_fail        = sta_assoc_fail,
 1923         .scan_assoc_success     = sta_assoc_success,
 1924 };
 1925 IEEE80211_SCANNER_ALG(mesh, IEEE80211_M_MBSS, mesh_default);
 1926 #endif /* IEEE80211_SUPPORT_MESH */

Cache object: 517e1928642d9880cc9f3adf13173355


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.