xref: /freebsd/sys/net80211/ieee80211_proto.c (revision b3aaa0cc21c63d388230c7ef2a80abd631ff20d5)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 /*
31  * IEEE 802.11 protocol support.
32  */
33 
34 #include "opt_inet.h"
35 #include "opt_wlan.h"
36 
37 #include <sys/param.h>
38 #include <sys/kernel.h>
39 #include <sys/systm.h>
40 #include <sys/taskqueue.h>
41 
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 
45 #include <net/if.h>
46 #include <net/if_media.h>
47 #include <net/ethernet.h>		/* XXX for ether_sprintf */
48 
49 #include <net80211/ieee80211_var.h>
50 #include <net80211/ieee80211_adhoc.h>
51 #include <net80211/ieee80211_sta.h>
52 #include <net80211/ieee80211_hostap.h>
53 #include <net80211/ieee80211_wds.h>
54 #include <net80211/ieee80211_monitor.h>
55 #include <net80211/ieee80211_input.h>
56 
57 /* XXX tunables */
58 #define	AGGRESSIVE_MODE_SWITCH_HYSTERESIS	3	/* pkts / 100ms */
59 #define	HIGH_PRI_SWITCH_THRESH			10	/* pkts / 100ms */
60 
61 const char *ieee80211_mgt_subtype_name[] = {
62 	"assoc_req",	"assoc_resp",	"reassoc_req",	"reassoc_resp",
63 	"probe_req",	"probe_resp",	"reserved#6",	"reserved#7",
64 	"beacon",	"atim",		"disassoc",	"auth",
65 	"deauth",	"action",	"reserved#14",	"reserved#15"
66 };
67 const char *ieee80211_ctl_subtype_name[] = {
68 	"reserved#0",	"reserved#1",	"reserved#2",	"reserved#3",
69 	"reserved#3",	"reserved#5",	"reserved#6",	"reserved#7",
70 	"reserved#8",	"reserved#9",	"ps_poll",	"rts",
71 	"cts",		"ack",		"cf_end",	"cf_end_ack"
72 };
73 const char *ieee80211_opmode_name[IEEE80211_OPMODE_MAX] = {
74 	"IBSS",		/* IEEE80211_M_IBSS */
75 	"STA",		/* IEEE80211_M_STA */
76 	"WDS",		/* IEEE80211_M_WDS */
77 	"AHDEMO",	/* IEEE80211_M_AHDEMO */
78 	"HOSTAP",	/* IEEE80211_M_HOSTAP */
79 	"MONITOR"	/* IEEE80211_M_MONITOR */
80 };
81 const char *ieee80211_state_name[IEEE80211_S_MAX] = {
82 	"INIT",		/* IEEE80211_S_INIT */
83 	"SCAN",		/* IEEE80211_S_SCAN */
84 	"AUTH",		/* IEEE80211_S_AUTH */
85 	"ASSOC",	/* IEEE80211_S_ASSOC */
86 	"CAC",		/* IEEE80211_S_CAC */
87 	"RUN",		/* IEEE80211_S_RUN */
88 	"CSA",		/* IEEE80211_S_CSA */
89 	"SLEEP",	/* IEEE80211_S_SLEEP */
90 };
91 const char *ieee80211_wme_acnames[] = {
92 	"WME_AC_BE",
93 	"WME_AC_BK",
94 	"WME_AC_VI",
95 	"WME_AC_VO",
96 	"WME_UPSD",
97 };
98 
99 static void parent_updown(void *, int);
100 static int ieee80211_new_state_locked(struct ieee80211vap *,
101 	enum ieee80211_state, int);
102 
103 static int
104 null_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
105 	const struct ieee80211_bpf_params *params)
106 {
107 	struct ifnet *ifp = ni->ni_ic->ic_ifp;
108 
109 	if_printf(ifp, "missing ic_raw_xmit callback, drop frame\n");
110 	m_freem(m);
111 	return ENETDOWN;
112 }
113 
114 void
115 ieee80211_proto_attach(struct ieee80211com *ic)
116 {
117 	struct ifnet *ifp = ic->ic_ifp;
118 
119 	/* override the 802.3 setting */
120 	ifp->if_hdrlen = ic->ic_headroom
121 		+ sizeof(struct ieee80211_qosframe_addr4)
122 		+ IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN
123 		+ IEEE80211_WEP_EXTIVLEN;
124 	/* XXX no way to recalculate on ifdetach */
125 	if (ALIGN(ifp->if_hdrlen) > max_linkhdr) {
126 		/* XXX sanity check... */
127 		max_linkhdr = ALIGN(ifp->if_hdrlen);
128 		max_hdr = max_linkhdr + max_protohdr;
129 		max_datalen = MHLEN - max_hdr;
130 	}
131 	ic->ic_protmode = IEEE80211_PROT_CTSONLY;
132 
133 	TASK_INIT(&ic->ic_parent_task, 0, parent_updown, ifp);
134 
135 	ic->ic_wme.wme_hipri_switch_hysteresis =
136 		AGGRESSIVE_MODE_SWITCH_HYSTERESIS;
137 
138 	/* initialize management frame handlers */
139 	ic->ic_send_mgmt = ieee80211_send_mgmt;
140 	ic->ic_raw_xmit = null_raw_xmit;
141 
142 	ieee80211_adhoc_attach(ic);
143 	ieee80211_sta_attach(ic);
144 	ieee80211_wds_attach(ic);
145 	ieee80211_hostap_attach(ic);
146 	ieee80211_monitor_attach(ic);
147 }
148 
149 void
150 ieee80211_proto_detach(struct ieee80211com *ic)
151 {
152 	ieee80211_monitor_detach(ic);
153 	ieee80211_hostap_detach(ic);
154 	ieee80211_wds_detach(ic);
155 	ieee80211_adhoc_detach(ic);
156 	ieee80211_sta_detach(ic);
157 }
158 
159 static void
160 null_update_beacon(struct ieee80211vap *vap, int item)
161 {
162 }
163 
164 void
165 ieee80211_proto_vattach(struct ieee80211vap *vap)
166 {
167 	struct ieee80211com *ic = vap->iv_ic;
168 	struct ifnet *ifp = vap->iv_ifp;
169 	int i;
170 
171 	/* override the 802.3 setting */
172 	ifp->if_hdrlen = ic->ic_ifp->if_hdrlen;
173 
174 	vap->iv_rtsthreshold = IEEE80211_RTS_DEFAULT;
175 	vap->iv_fragthreshold = IEEE80211_FRAG_DEFAULT;
176 	vap->iv_bmiss_max = IEEE80211_BMISS_MAX;
177 	callout_init(&vap->iv_swbmiss, CALLOUT_MPSAFE);
178 	callout_init(&vap->iv_mgtsend, CALLOUT_MPSAFE);
179 	/*
180 	 * Install default tx rate handling: no fixed rate, lowest
181 	 * supported rate for mgmt and multicast frames.  Default
182 	 * max retry count.  These settings can be changed by the
183 	 * driver and/or user applications.
184 	 */
185 	for (i = IEEE80211_MODE_11A; i < IEEE80211_MODE_MAX; i++) {
186 		const struct ieee80211_rateset *rs = &ic->ic_sup_rates[i];
187 
188 		vap->iv_txparms[i].ucastrate = IEEE80211_FIXED_RATE_NONE;
189 		if (i == IEEE80211_MODE_11NA || i == IEEE80211_MODE_11NG) {
190 			vap->iv_txparms[i].mgmtrate = 0 | IEEE80211_RATE_MCS;
191 			vap->iv_txparms[i].mcastrate = 0 | IEEE80211_RATE_MCS;
192 		} else {
193 			vap->iv_txparms[i].mgmtrate =
194 			    rs->rs_rates[0] & IEEE80211_RATE_VAL;
195 			vap->iv_txparms[i].mcastrate =
196 			    rs->rs_rates[0] & IEEE80211_RATE_VAL;
197 		}
198 		vap->iv_txparms[i].maxretry = IEEE80211_TXMAX_DEFAULT;
199 	}
200 	vap->iv_roaming = IEEE80211_ROAMING_AUTO;
201 
202 	vap->iv_update_beacon = null_update_beacon;
203 	vap->iv_deliver_data = ieee80211_deliver_data;
204 
205 	/* attach support for operating mode */
206 	ic->ic_vattach[vap->iv_opmode](vap);
207 }
208 
209 void
210 ieee80211_proto_vdetach(struct ieee80211vap *vap)
211 {
212 #define	FREEAPPIE(ie) do { \
213 	if (ie != NULL) \
214 		free(ie, M_80211_NODE_IE); \
215 } while (0)
216 	/*
217 	 * Detach operating mode module.
218 	 */
219 	if (vap->iv_opdetach != NULL)
220 		vap->iv_opdetach(vap);
221 	/*
222 	 * This should not be needed as we detach when reseting
223 	 * the state but be conservative here since the
224 	 * authenticator may do things like spawn kernel threads.
225 	 */
226 	if (vap->iv_auth->ia_detach != NULL)
227 		vap->iv_auth->ia_detach(vap);
228 	/*
229 	 * Detach any ACL'ator.
230 	 */
231 	if (vap->iv_acl != NULL)
232 		vap->iv_acl->iac_detach(vap);
233 
234 	FREEAPPIE(vap->iv_appie_beacon);
235 	FREEAPPIE(vap->iv_appie_probereq);
236 	FREEAPPIE(vap->iv_appie_proberesp);
237 	FREEAPPIE(vap->iv_appie_assocreq);
238 	FREEAPPIE(vap->iv_appie_assocresp);
239 	FREEAPPIE(vap->iv_appie_wpa);
240 #undef FREEAPPIE
241 }
242 
243 /*
244  * Simple-minded authenticator module support.
245  */
246 
247 #define	IEEE80211_AUTH_MAX	(IEEE80211_AUTH_WPA+1)
248 /* XXX well-known names */
249 static const char *auth_modnames[IEEE80211_AUTH_MAX] = {
250 	"wlan_internal",	/* IEEE80211_AUTH_NONE */
251 	"wlan_internal",	/* IEEE80211_AUTH_OPEN */
252 	"wlan_internal",	/* IEEE80211_AUTH_SHARED */
253 	"wlan_xauth",		/* IEEE80211_AUTH_8021X	 */
254 	"wlan_internal",	/* IEEE80211_AUTH_AUTO */
255 	"wlan_xauth",		/* IEEE80211_AUTH_WPA */
256 };
257 static const struct ieee80211_authenticator *authenticators[IEEE80211_AUTH_MAX];
258 
259 static const struct ieee80211_authenticator auth_internal = {
260 	.ia_name		= "wlan_internal",
261 	.ia_attach		= NULL,
262 	.ia_detach		= NULL,
263 	.ia_node_join		= NULL,
264 	.ia_node_leave		= NULL,
265 };
266 
267 /*
268  * Setup internal authenticators once; they are never unregistered.
269  */
270 static void
271 ieee80211_auth_setup(void)
272 {
273 	ieee80211_authenticator_register(IEEE80211_AUTH_OPEN, &auth_internal);
274 	ieee80211_authenticator_register(IEEE80211_AUTH_SHARED, &auth_internal);
275 	ieee80211_authenticator_register(IEEE80211_AUTH_AUTO, &auth_internal);
276 }
277 SYSINIT(wlan_auth, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_auth_setup, NULL);
278 
279 const struct ieee80211_authenticator *
280 ieee80211_authenticator_get(int auth)
281 {
282 	if (auth >= IEEE80211_AUTH_MAX)
283 		return NULL;
284 	if (authenticators[auth] == NULL)
285 		ieee80211_load_module(auth_modnames[auth]);
286 	return authenticators[auth];
287 }
288 
289 void
290 ieee80211_authenticator_register(int type,
291 	const struct ieee80211_authenticator *auth)
292 {
293 	if (type >= IEEE80211_AUTH_MAX)
294 		return;
295 	authenticators[type] = auth;
296 }
297 
298 void
299 ieee80211_authenticator_unregister(int type)
300 {
301 
302 	if (type >= IEEE80211_AUTH_MAX)
303 		return;
304 	authenticators[type] = NULL;
305 }
306 
307 /*
308  * Very simple-minded ACL module support.
309  */
310 /* XXX just one for now */
311 static	const struct ieee80211_aclator *acl = NULL;
312 
313 void
314 ieee80211_aclator_register(const struct ieee80211_aclator *iac)
315 {
316 	printf("wlan: %s acl policy registered\n", iac->iac_name);
317 	acl = iac;
318 }
319 
320 void
321 ieee80211_aclator_unregister(const struct ieee80211_aclator *iac)
322 {
323 	if (acl == iac)
324 		acl = NULL;
325 	printf("wlan: %s acl policy unregistered\n", iac->iac_name);
326 }
327 
328 const struct ieee80211_aclator *
329 ieee80211_aclator_get(const char *name)
330 {
331 	if (acl == NULL)
332 		ieee80211_load_module("wlan_acl");
333 	return acl != NULL && strcmp(acl->iac_name, name) == 0 ? acl : NULL;
334 }
335 
336 void
337 ieee80211_print_essid(const uint8_t *essid, int len)
338 {
339 	const uint8_t *p;
340 	int i;
341 
342 	if (len > IEEE80211_NWID_LEN)
343 		len = IEEE80211_NWID_LEN;
344 	/* determine printable or not */
345 	for (i = 0, p = essid; i < len; i++, p++) {
346 		if (*p < ' ' || *p > 0x7e)
347 			break;
348 	}
349 	if (i == len) {
350 		printf("\"");
351 		for (i = 0, p = essid; i < len; i++, p++)
352 			printf("%c", *p);
353 		printf("\"");
354 	} else {
355 		printf("0x");
356 		for (i = 0, p = essid; i < len; i++, p++)
357 			printf("%02x", *p);
358 	}
359 }
360 
361 void
362 ieee80211_dump_pkt(struct ieee80211com *ic,
363 	const uint8_t *buf, int len, int rate, int rssi)
364 {
365 	const struct ieee80211_frame *wh;
366 	int i;
367 
368 	wh = (const struct ieee80211_frame *)buf;
369 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
370 	case IEEE80211_FC1_DIR_NODS:
371 		printf("NODS %s", ether_sprintf(wh->i_addr2));
372 		printf("->%s", ether_sprintf(wh->i_addr1));
373 		printf("(%s)", ether_sprintf(wh->i_addr3));
374 		break;
375 	case IEEE80211_FC1_DIR_TODS:
376 		printf("TODS %s", ether_sprintf(wh->i_addr2));
377 		printf("->%s", ether_sprintf(wh->i_addr3));
378 		printf("(%s)", ether_sprintf(wh->i_addr1));
379 		break;
380 	case IEEE80211_FC1_DIR_FROMDS:
381 		printf("FRDS %s", ether_sprintf(wh->i_addr3));
382 		printf("->%s", ether_sprintf(wh->i_addr1));
383 		printf("(%s)", ether_sprintf(wh->i_addr2));
384 		break;
385 	case IEEE80211_FC1_DIR_DSTODS:
386 		printf("DSDS %s", ether_sprintf((const uint8_t *)&wh[1]));
387 		printf("->%s", ether_sprintf(wh->i_addr3));
388 		printf("(%s", ether_sprintf(wh->i_addr2));
389 		printf("->%s)", ether_sprintf(wh->i_addr1));
390 		break;
391 	}
392 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
393 	case IEEE80211_FC0_TYPE_DATA:
394 		printf(" data");
395 		break;
396 	case IEEE80211_FC0_TYPE_MGT:
397 		printf(" %s", ieee80211_mgt_subtype_name[
398 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
399 		    >> IEEE80211_FC0_SUBTYPE_SHIFT]);
400 		break;
401 	default:
402 		printf(" type#%d", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
403 		break;
404 	}
405 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
406 		const struct ieee80211_qosframe *qwh =
407 			(const struct ieee80211_qosframe *)buf;
408 		printf(" QoS [TID %u%s]", qwh->i_qos[0] & IEEE80211_QOS_TID,
409 			qwh->i_qos[0] & IEEE80211_QOS_ACKPOLICY ? " ACM" : "");
410 	}
411 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
412 		int off;
413 
414 		off = ieee80211_anyhdrspace(ic, wh);
415 		printf(" WEP [IV %.02x %.02x %.02x",
416 			buf[off+0], buf[off+1], buf[off+2]);
417 		if (buf[off+IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV)
418 			printf(" %.02x %.02x %.02x",
419 				buf[off+4], buf[off+5], buf[off+6]);
420 		printf(" KID %u]", buf[off+IEEE80211_WEP_IVLEN] >> 6);
421 	}
422 	if (rate >= 0)
423 		printf(" %dM", rate / 2);
424 	if (rssi >= 0)
425 		printf(" +%d", rssi);
426 	printf("\n");
427 	if (len > 0) {
428 		for (i = 0; i < len; i++) {
429 			if ((i & 1) == 0)
430 				printf(" ");
431 			printf("%02x", buf[i]);
432 		}
433 		printf("\n");
434 	}
435 }
436 
437 static __inline int
438 findrix(const struct ieee80211_rateset *rs, int r)
439 {
440 	int i;
441 
442 	for (i = 0; i < rs->rs_nrates; i++)
443 		if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == r)
444 			return i;
445 	return -1;
446 }
447 
448 int
449 ieee80211_fix_rate(struct ieee80211_node *ni,
450 	struct ieee80211_rateset *nrs, int flags)
451 {
452 #define	RV(v)	((v) & IEEE80211_RATE_VAL)
453 	struct ieee80211vap *vap = ni->ni_vap;
454 	struct ieee80211com *ic = ni->ni_ic;
455 	int i, j, rix, error;
456 	int okrate, badrate, fixedrate, ucastrate;
457 	const struct ieee80211_rateset *srs;
458 	uint8_t r;
459 
460 	error = 0;
461 	okrate = badrate = 0;
462 	ucastrate = vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)].ucastrate;
463 	if (ucastrate != IEEE80211_FIXED_RATE_NONE) {
464 		/*
465 		 * Workaround awkwardness with fixed rate.  We are called
466 		 * to check both the legacy rate set and the HT rate set
467 		 * but we must apply any legacy fixed rate check only to the
468 		 * legacy rate set and vice versa.  We cannot tell what type
469 		 * of rate set we've been given (legacy or HT) but we can
470 		 * distinguish the fixed rate type (MCS have 0x80 set).
471 		 * So to deal with this the caller communicates whether to
472 		 * check MCS or legacy rate using the flags and we use the
473 		 * type of any fixed rate to avoid applying an MCS to a
474 		 * legacy rate and vice versa.
475 		 */
476 		if (ucastrate & 0x80) {
477 			if (flags & IEEE80211_F_DOFRATE)
478 				flags &= ~IEEE80211_F_DOFRATE;
479 		} else if ((ucastrate & 0x80) == 0) {
480 			if (flags & IEEE80211_F_DOFMCS)
481 				flags &= ~IEEE80211_F_DOFMCS;
482 		}
483 		/* NB: required to make MCS match below work */
484 		ucastrate &= IEEE80211_RATE_VAL;
485 	}
486 	fixedrate = IEEE80211_FIXED_RATE_NONE;
487 	/*
488 	 * XXX we are called to process both MCS and legacy rates;
489 	 * we must use the appropriate basic rate set or chaos will
490 	 * ensue; for now callers that want MCS must supply
491 	 * IEEE80211_F_DOBRS; at some point we'll need to split this
492 	 * function so there are two variants, one for MCS and one
493 	 * for legacy rates.
494 	 */
495 	if (flags & IEEE80211_F_DOBRS)
496 		srs = (const struct ieee80211_rateset *)
497 		    ieee80211_get_suphtrates(ic, ni->ni_chan);
498 	else
499 		srs = ieee80211_get_suprates(ic, ni->ni_chan);
500 	for (i = 0; i < nrs->rs_nrates; ) {
501 		if (flags & IEEE80211_F_DOSORT) {
502 			/*
503 			 * Sort rates.
504 			 */
505 			for (j = i + 1; j < nrs->rs_nrates; j++) {
506 				if (RV(nrs->rs_rates[i]) > RV(nrs->rs_rates[j])) {
507 					r = nrs->rs_rates[i];
508 					nrs->rs_rates[i] = nrs->rs_rates[j];
509 					nrs->rs_rates[j] = r;
510 				}
511 			}
512 		}
513 		r = nrs->rs_rates[i] & IEEE80211_RATE_VAL;
514 		badrate = r;
515 		/*
516 		 * Check for fixed rate.
517 		 */
518 		if (r == ucastrate)
519 			fixedrate = r;
520 		/*
521 		 * Check against supported rates.
522 		 */
523 		rix = findrix(srs, r);
524 		if (flags & IEEE80211_F_DONEGO) {
525 			if (rix < 0) {
526 				/*
527 				 * A rate in the node's rate set is not
528 				 * supported.  If this is a basic rate and we
529 				 * are operating as a STA then this is an error.
530 				 * Otherwise we just discard/ignore the rate.
531 				 */
532 				if ((flags & IEEE80211_F_JOIN) &&
533 				    (nrs->rs_rates[i] & IEEE80211_RATE_BASIC))
534 					error++;
535 			} else if ((flags & IEEE80211_F_JOIN) == 0) {
536 				/*
537 				 * Overwrite with the supported rate
538 				 * value so any basic rate bit is set.
539 				 */
540 				nrs->rs_rates[i] = srs->rs_rates[rix];
541 			}
542 		}
543 		if ((flags & IEEE80211_F_DODEL) && rix < 0) {
544 			/*
545 			 * Delete unacceptable rates.
546 			 */
547 			nrs->rs_nrates--;
548 			for (j = i; j < nrs->rs_nrates; j++)
549 				nrs->rs_rates[j] = nrs->rs_rates[j + 1];
550 			nrs->rs_rates[j] = 0;
551 			continue;
552 		}
553 		if (rix >= 0)
554 			okrate = nrs->rs_rates[i];
555 		i++;
556 	}
557 	if (okrate == 0 || error != 0 ||
558 	    ((flags & (IEEE80211_F_DOFRATE|IEEE80211_F_DOFMCS)) &&
559 	     fixedrate != ucastrate)) {
560 		IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE | IEEE80211_MSG_11N, ni,
561 		    "%s: flags 0x%x okrate %d error %d fixedrate 0x%x "
562 		    "ucastrate %x\n", __func__, fixedrate, ucastrate, flags);
563 		return badrate | IEEE80211_RATE_BASIC;
564 	} else
565 		return RV(okrate);
566 #undef RV
567 }
568 
569 /*
570  * Reset 11g-related state.
571  */
572 void
573 ieee80211_reset_erp(struct ieee80211com *ic)
574 {
575 	ic->ic_flags &= ~IEEE80211_F_USEPROT;
576 	ic->ic_nonerpsta = 0;
577 	ic->ic_longslotsta = 0;
578 	/*
579 	 * Short slot time is enabled only when operating in 11g
580 	 * and not in an IBSS.  We must also honor whether or not
581 	 * the driver is capable of doing it.
582 	 */
583 	ieee80211_set_shortslottime(ic,
584 		IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
585 		IEEE80211_IS_CHAN_HT(ic->ic_curchan) ||
586 		(IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
587 		ic->ic_opmode == IEEE80211_M_HOSTAP &&
588 		(ic->ic_caps & IEEE80211_C_SHSLOT)));
589 	/*
590 	 * Set short preamble and ERP barker-preamble flags.
591 	 */
592 	if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
593 	    (ic->ic_caps & IEEE80211_C_SHPREAMBLE)) {
594 		ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
595 		ic->ic_flags &= ~IEEE80211_F_USEBARKER;
596 	} else {
597 		ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
598 		ic->ic_flags |= IEEE80211_F_USEBARKER;
599 	}
600 }
601 
602 /*
603  * Set the short slot time state and notify the driver.
604  */
605 void
606 ieee80211_set_shortslottime(struct ieee80211com *ic, int onoff)
607 {
608 	if (onoff)
609 		ic->ic_flags |= IEEE80211_F_SHSLOT;
610 	else
611 		ic->ic_flags &= ~IEEE80211_F_SHSLOT;
612 	/* notify driver */
613 	if (ic->ic_updateslot != NULL)
614 		ic->ic_updateslot(ic->ic_ifp);
615 }
616 
617 /*
618  * Check if the specified rate set supports ERP.
619  * NB: the rate set is assumed to be sorted.
620  */
621 int
622 ieee80211_iserp_rateset(const struct ieee80211_rateset *rs)
623 {
624 #define N(a)	(sizeof(a) / sizeof(a[0]))
625 	static const int rates[] = { 2, 4, 11, 22, 12, 24, 48 };
626 	int i, j;
627 
628 	if (rs->rs_nrates < N(rates))
629 		return 0;
630 	for (i = 0; i < N(rates); i++) {
631 		for (j = 0; j < rs->rs_nrates; j++) {
632 			int r = rs->rs_rates[j] & IEEE80211_RATE_VAL;
633 			if (rates[i] == r)
634 				goto next;
635 			if (r > rates[i])
636 				return 0;
637 		}
638 		return 0;
639 	next:
640 		;
641 	}
642 	return 1;
643 #undef N
644 }
645 
646 /*
647  * Mark the basic rates for the rate table based on the
648  * operating mode.  For real 11g we mark all the 11b rates
649  * and 6, 12, and 24 OFDM.  For 11b compatibility we mark only
650  * 11b rates.  There's also a pseudo 11a-mode used to mark only
651  * the basic OFDM rates.
652  */
653 static void
654 setbasicrates(struct ieee80211_rateset *rs,
655     enum ieee80211_phymode mode, int add)
656 {
657 	static const struct ieee80211_rateset basic[IEEE80211_MODE_MAX] = {
658 	    [IEEE80211_MODE_11A]	= { 3, { 12, 24, 48 } },
659 	    [IEEE80211_MODE_11B]	= { 2, { 2, 4 } },
660 					    /* NB: mixed b/g */
661 	    [IEEE80211_MODE_11G]	= { 4, { 2, 4, 11, 22 } },
662 	    [IEEE80211_MODE_TURBO_A]	= { 3, { 12, 24, 48 } },
663 	    [IEEE80211_MODE_TURBO_G]	= { 4, { 2, 4, 11, 22 } },
664 	    [IEEE80211_MODE_STURBO_A]	= { 3, { 12, 24, 48 } },
665 	    [IEEE80211_MODE_HALF]	= { 3, { 6, 12, 24 } },
666 	    [IEEE80211_MODE_QUARTER]	= { 3, { 3, 6, 12 } },
667 	    [IEEE80211_MODE_11NA]	= { 3, { 12, 24, 48 } },
668 					    /* NB: mixed b/g */
669 	    [IEEE80211_MODE_11NG]	= { 4, { 2, 4, 11, 22 } },
670 	};
671 	int i, j;
672 
673 	for (i = 0; i < rs->rs_nrates; i++) {
674 		if (!add)
675 			rs->rs_rates[i] &= IEEE80211_RATE_VAL;
676 		for (j = 0; j < basic[mode].rs_nrates; j++)
677 			if (basic[mode].rs_rates[j] == rs->rs_rates[i]) {
678 				rs->rs_rates[i] |= IEEE80211_RATE_BASIC;
679 				break;
680 			}
681 	}
682 }
683 
684 /*
685  * Set the basic rates in a rate set.
686  */
687 void
688 ieee80211_setbasicrates(struct ieee80211_rateset *rs,
689     enum ieee80211_phymode mode)
690 {
691 	setbasicrates(rs, mode, 0);
692 }
693 
694 /*
695  * Add basic rates to a rate set.
696  */
697 void
698 ieee80211_addbasicrates(struct ieee80211_rateset *rs,
699     enum ieee80211_phymode mode)
700 {
701 	setbasicrates(rs, mode, 1);
702 }
703 
704 /*
705  * WME protocol support.
706  *
707  * The default 11a/b/g/n parameters come from the WiFi Alliance WMM
708  * System Interopability Test Plan (v1.4, Appendix F) and the 802.11n
709  * Draft 2.0 Test Plan (Appendix D).
710  *
711  * Static/Dynamic Turbo mode settings come from Atheros.
712  */
713 typedef struct phyParamType {
714 	uint8_t		aifsn;
715 	uint8_t		logcwmin;
716 	uint8_t		logcwmax;
717 	uint16_t	txopLimit;
718 	uint8_t 	acm;
719 } paramType;
720 
721 static const struct phyParamType phyParamForAC_BE[IEEE80211_MODE_MAX] = {
722 	[IEEE80211_MODE_AUTO]	= { 3, 4,  6,  0, 0 },
723 	[IEEE80211_MODE_11A]	= { 3, 4,  6,  0, 0 },
724 	[IEEE80211_MODE_11B]	= { 3, 4,  6,  0, 0 },
725 	[IEEE80211_MODE_11G]	= { 3, 4,  6,  0, 0 },
726 	[IEEE80211_MODE_FH]	= { 3, 4,  6,  0, 0 },
727 	[IEEE80211_MODE_TURBO_A]= { 2, 3,  5,  0, 0 },
728 	[IEEE80211_MODE_TURBO_G]= { 2, 3,  5,  0, 0 },
729 	[IEEE80211_MODE_STURBO_A]={ 2, 3,  5,  0, 0 },
730 	[IEEE80211_MODE_HALF]	= { 3, 4,  6,  0, 0 },
731 	[IEEE80211_MODE_QUARTER]= { 3, 4,  6,  0, 0 },
732 	[IEEE80211_MODE_11NA]	= { 3, 4,  6,  0, 0 },
733 	[IEEE80211_MODE_11NG]	= { 3, 4,  6,  0, 0 },
734 };
735 static const struct phyParamType phyParamForAC_BK[IEEE80211_MODE_MAX] = {
736 	[IEEE80211_MODE_AUTO]	= { 7, 4, 10,  0, 0 },
737 	[IEEE80211_MODE_11A]	= { 7, 4, 10,  0, 0 },
738 	[IEEE80211_MODE_11B]	= { 7, 4, 10,  0, 0 },
739 	[IEEE80211_MODE_11G]	= { 7, 4, 10,  0, 0 },
740 	[IEEE80211_MODE_FH]	= { 7, 4, 10,  0, 0 },
741 	[IEEE80211_MODE_TURBO_A]= { 7, 3, 10,  0, 0 },
742 	[IEEE80211_MODE_TURBO_G]= { 7, 3, 10,  0, 0 },
743 	[IEEE80211_MODE_STURBO_A]={ 7, 3, 10,  0, 0 },
744 	[IEEE80211_MODE_HALF]	= { 7, 4, 10,  0, 0 },
745 	[IEEE80211_MODE_QUARTER]= { 7, 4, 10,  0, 0 },
746 	[IEEE80211_MODE_11NA]	= { 7, 4, 10,  0, 0 },
747 	[IEEE80211_MODE_11NG]	= { 7, 4, 10,  0, 0 },
748 };
749 static const struct phyParamType phyParamForAC_VI[IEEE80211_MODE_MAX] = {
750 	[IEEE80211_MODE_AUTO]	= { 1, 3, 4,  94, 0 },
751 	[IEEE80211_MODE_11A]	= { 1, 3, 4,  94, 0 },
752 	[IEEE80211_MODE_11B]	= { 1, 3, 4, 188, 0 },
753 	[IEEE80211_MODE_11G]	= { 1, 3, 4,  94, 0 },
754 	[IEEE80211_MODE_FH]	= { 1, 3, 4, 188, 0 },
755 	[IEEE80211_MODE_TURBO_A]= { 1, 2, 3,  94, 0 },
756 	[IEEE80211_MODE_TURBO_G]= { 1, 2, 3,  94, 0 },
757 	[IEEE80211_MODE_STURBO_A]={ 1, 2, 3,  94, 0 },
758 	[IEEE80211_MODE_HALF]	= { 1, 3, 4,  94, 0 },
759 	[IEEE80211_MODE_QUARTER]= { 1, 3, 4,  94, 0 },
760 	[IEEE80211_MODE_11NA]	= { 1, 3, 4,  94, 0 },
761 	[IEEE80211_MODE_11NG]	= { 1, 3, 4,  94, 0 },
762 };
763 static const struct phyParamType phyParamForAC_VO[IEEE80211_MODE_MAX] = {
764 	[IEEE80211_MODE_AUTO]	= { 1, 2, 3,  47, 0 },
765 	[IEEE80211_MODE_11A]	= { 1, 2, 3,  47, 0 },
766 	[IEEE80211_MODE_11B]	= { 1, 2, 3, 102, 0 },
767 	[IEEE80211_MODE_11G]	= { 1, 2, 3,  47, 0 },
768 	[IEEE80211_MODE_FH]	= { 1, 2, 3, 102, 0 },
769 	[IEEE80211_MODE_TURBO_A]= { 1, 2, 2,  47, 0 },
770 	[IEEE80211_MODE_TURBO_G]= { 1, 2, 2,  47, 0 },
771 	[IEEE80211_MODE_STURBO_A]={ 1, 2, 2,  47, 0 },
772 	[IEEE80211_MODE_HALF]	= { 1, 2, 3,  47, 0 },
773 	[IEEE80211_MODE_QUARTER]= { 1, 2, 3,  47, 0 },
774 	[IEEE80211_MODE_11NA]	= { 1, 2, 3,  47, 0 },
775 	[IEEE80211_MODE_11NG]	= { 1, 2, 3,  47, 0 },
776 };
777 
778 static const struct phyParamType bssPhyParamForAC_BE[IEEE80211_MODE_MAX] = {
779 	[IEEE80211_MODE_AUTO]	= { 3, 4, 10,  0, 0 },
780 	[IEEE80211_MODE_11A]	= { 3, 4, 10,  0, 0 },
781 	[IEEE80211_MODE_11B]	= { 3, 4, 10,  0, 0 },
782 	[IEEE80211_MODE_11G]	= { 3, 4, 10,  0, 0 },
783 	[IEEE80211_MODE_FH]	= { 3, 4, 10,  0, 0 },
784 	[IEEE80211_MODE_TURBO_A]= { 2, 3, 10,  0, 0 },
785 	[IEEE80211_MODE_TURBO_G]= { 2, 3, 10,  0, 0 },
786 	[IEEE80211_MODE_STURBO_A]={ 2, 3, 10,  0, 0 },
787 	[IEEE80211_MODE_HALF]	= { 3, 4, 10,  0, 0 },
788 	[IEEE80211_MODE_QUARTER]= { 3, 4, 10,  0, 0 },
789 	[IEEE80211_MODE_11NA]	= { 3, 4, 10,  0, 0 },
790 	[IEEE80211_MODE_11NG]	= { 3, 4, 10,  0, 0 },
791 };
792 static const struct phyParamType bssPhyParamForAC_VI[IEEE80211_MODE_MAX] = {
793 	[IEEE80211_MODE_AUTO]	= { 2, 3, 4,  94, 0 },
794 	[IEEE80211_MODE_11A]	= { 2, 3, 4,  94, 0 },
795 	[IEEE80211_MODE_11B]	= { 2, 3, 4, 188, 0 },
796 	[IEEE80211_MODE_11G]	= { 2, 3, 4,  94, 0 },
797 	[IEEE80211_MODE_FH]	= { 2, 3, 4, 188, 0 },
798 	[IEEE80211_MODE_TURBO_A]= { 2, 2, 3,  94, 0 },
799 	[IEEE80211_MODE_TURBO_G]= { 2, 2, 3,  94, 0 },
800 	[IEEE80211_MODE_STURBO_A]={ 2, 2, 3,  94, 0 },
801 	[IEEE80211_MODE_HALF]	= { 2, 3, 4,  94, 0 },
802 	[IEEE80211_MODE_QUARTER]= { 2, 3, 4,  94, 0 },
803 	[IEEE80211_MODE_11NA]	= { 2, 3, 4,  94, 0 },
804 	[IEEE80211_MODE_11NG]	= { 2, 3, 4,  94, 0 },
805 };
806 static const struct phyParamType bssPhyParamForAC_VO[IEEE80211_MODE_MAX] = {
807 	[IEEE80211_MODE_AUTO]	= { 2, 2, 3,  47, 0 },
808 	[IEEE80211_MODE_11A]	= { 2, 2, 3,  47, 0 },
809 	[IEEE80211_MODE_11B]	= { 2, 2, 3, 102, 0 },
810 	[IEEE80211_MODE_11G]	= { 2, 2, 3,  47, 0 },
811 	[IEEE80211_MODE_FH]	= { 2, 2, 3, 102, 0 },
812 	[IEEE80211_MODE_TURBO_A]= { 1, 2, 2,  47, 0 },
813 	[IEEE80211_MODE_TURBO_G]= { 1, 2, 2,  47, 0 },
814 	[IEEE80211_MODE_STURBO_A]={ 1, 2, 2,  47, 0 },
815 	[IEEE80211_MODE_HALF]	= { 2, 2, 3,  47, 0 },
816 	[IEEE80211_MODE_QUARTER]= { 2, 2, 3,  47, 0 },
817 	[IEEE80211_MODE_11NA]	= { 2, 2, 3,  47, 0 },
818 	[IEEE80211_MODE_11NG]	= { 2, 2, 3,  47, 0 },
819 };
820 
821 static void
822 _setifsparams(struct wmeParams *wmep, const paramType *phy)
823 {
824 	wmep->wmep_aifsn = phy->aifsn;
825 	wmep->wmep_logcwmin = phy->logcwmin;
826 	wmep->wmep_logcwmax = phy->logcwmax;
827 	wmep->wmep_txopLimit = phy->txopLimit;
828 }
829 
830 static void
831 setwmeparams(struct ieee80211vap *vap, const char *type, int ac,
832 	struct wmeParams *wmep, const paramType *phy)
833 {
834 	wmep->wmep_acm = phy->acm;
835 	_setifsparams(wmep, phy);
836 
837 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
838 	    "set %s (%s) [acm %u aifsn %u logcwmin %u logcwmax %u txop %u]\n",
839 	    ieee80211_wme_acnames[ac], type,
840 	    wmep->wmep_acm, wmep->wmep_aifsn, wmep->wmep_logcwmin,
841 	    wmep->wmep_logcwmax, wmep->wmep_txopLimit);
842 }
843 
844 static void
845 ieee80211_wme_initparams_locked(struct ieee80211vap *vap)
846 {
847 	struct ieee80211com *ic = vap->iv_ic;
848 	struct ieee80211_wme_state *wme = &ic->ic_wme;
849 	const paramType *pPhyParam, *pBssPhyParam;
850 	struct wmeParams *wmep;
851 	enum ieee80211_phymode mode;
852 	int i;
853 
854 	IEEE80211_LOCK_ASSERT(ic);
855 
856 	if ((ic->ic_caps & IEEE80211_C_WME) == 0 || ic->ic_nrunning > 1)
857 		return;
858 
859 	/*
860 	 * Select mode; we can be called early in which case we
861 	 * always use auto mode.  We know we'll be called when
862 	 * entering the RUN state with bsschan setup properly
863 	 * so state will eventually get set correctly
864 	 */
865 	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
866 		mode = ieee80211_chan2mode(ic->ic_bsschan);
867 	else
868 		mode = IEEE80211_MODE_AUTO;
869 	for (i = 0; i < WME_NUM_AC; i++) {
870 		switch (i) {
871 		case WME_AC_BK:
872 			pPhyParam = &phyParamForAC_BK[mode];
873 			pBssPhyParam = &phyParamForAC_BK[mode];
874 			break;
875 		case WME_AC_VI:
876 			pPhyParam = &phyParamForAC_VI[mode];
877 			pBssPhyParam = &bssPhyParamForAC_VI[mode];
878 			break;
879 		case WME_AC_VO:
880 			pPhyParam = &phyParamForAC_VO[mode];
881 			pBssPhyParam = &bssPhyParamForAC_VO[mode];
882 			break;
883 		case WME_AC_BE:
884 		default:
885 			pPhyParam = &phyParamForAC_BE[mode];
886 			pBssPhyParam = &bssPhyParamForAC_BE[mode];
887 			break;
888 		}
889 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
890 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
891 			setwmeparams(vap, "chan", i, wmep, pPhyParam);
892 		} else {
893 			setwmeparams(vap, "chan", i, wmep, pBssPhyParam);
894 		}
895 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
896 		setwmeparams(vap, "bss ", i, wmep, pBssPhyParam);
897 	}
898 	/* NB: check ic_bss to avoid NULL deref on initial attach */
899 	if (vap->iv_bss != NULL) {
900 		/*
901 		 * Calculate agressive mode switching threshold based
902 		 * on beacon interval.  This doesn't need locking since
903 		 * we're only called before entering the RUN state at
904 		 * which point we start sending beacon frames.
905 		 */
906 		wme->wme_hipri_switch_thresh =
907 			(HIGH_PRI_SWITCH_THRESH * vap->iv_bss->ni_intval) / 100;
908 		wme->wme_flags &= ~WME_F_AGGRMODE;
909 		ieee80211_wme_updateparams(vap);
910 	}
911 }
912 
913 void
914 ieee80211_wme_initparams(struct ieee80211vap *vap)
915 {
916 	struct ieee80211com *ic = vap->iv_ic;
917 
918 	IEEE80211_LOCK(ic);
919 	ieee80211_wme_initparams_locked(vap);
920 	IEEE80211_UNLOCK(ic);
921 }
922 
923 /*
924  * Update WME parameters for ourself and the BSS.
925  */
926 void
927 ieee80211_wme_updateparams_locked(struct ieee80211vap *vap)
928 {
929 	static const paramType aggrParam[IEEE80211_MODE_MAX] = {
930 	    [IEEE80211_MODE_AUTO]	= { 2, 4, 10, 64, 0 },
931 	    [IEEE80211_MODE_11A]	= { 2, 4, 10, 64, 0 },
932 	    [IEEE80211_MODE_11B]	= { 2, 5, 10, 64, 0 },
933 	    [IEEE80211_MODE_11G]	= { 2, 4, 10, 64, 0 },
934 	    [IEEE80211_MODE_FH]		= { 2, 5, 10, 64, 0 },
935 	    [IEEE80211_MODE_TURBO_A]	= { 1, 3, 10, 64, 0 },
936 	    [IEEE80211_MODE_TURBO_G]	= { 1, 3, 10, 64, 0 },
937 	    [IEEE80211_MODE_STURBO_A]	= { 1, 3, 10, 64, 0 },
938 	    [IEEE80211_MODE_HALF]	= { 2, 4, 10, 64, 0 },
939 	    [IEEE80211_MODE_QUARTER]	= { 2, 4, 10, 64, 0 },
940 	    [IEEE80211_MODE_11NA]	= { 2, 4, 10, 64, 0 },	/* XXXcheck*/
941 	    [IEEE80211_MODE_11NG]	= { 2, 4, 10, 64, 0 },	/* XXXcheck*/
942 	};
943 	struct ieee80211com *ic = vap->iv_ic;
944 	struct ieee80211_wme_state *wme = &ic->ic_wme;
945 	const struct wmeParams *wmep;
946 	struct wmeParams *chanp, *bssp;
947 	enum ieee80211_phymode mode;
948 	int i;
949 
950        	/*
951 	 * Set up the channel access parameters for the physical
952 	 * device.  First populate the configured settings.
953 	 */
954 	for (i = 0; i < WME_NUM_AC; i++) {
955 		chanp = &wme->wme_chanParams.cap_wmeParams[i];
956 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
957 		chanp->wmep_aifsn = wmep->wmep_aifsn;
958 		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
959 		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
960 		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
961 
962 		chanp = &wme->wme_bssChanParams.cap_wmeParams[i];
963 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
964 		chanp->wmep_aifsn = wmep->wmep_aifsn;
965 		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
966 		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
967 		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
968 	}
969 
970 	/*
971 	 * Select mode; we can be called early in which case we
972 	 * always use auto mode.  We know we'll be called when
973 	 * entering the RUN state with bsschan setup properly
974 	 * so state will eventually get set correctly
975 	 */
976 	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
977 		mode = ieee80211_chan2mode(ic->ic_bsschan);
978 	else
979 		mode = IEEE80211_MODE_AUTO;
980 
981 	/*
982 	 * This implements agressive mode as found in certain
983 	 * vendors' AP's.  When there is significant high
984 	 * priority (VI/VO) traffic in the BSS throttle back BE
985 	 * traffic by using conservative parameters.  Otherwise
986 	 * BE uses agressive params to optimize performance of
987 	 * legacy/non-QoS traffic.
988 	 */
989         if ((vap->iv_opmode == IEEE80211_M_HOSTAP &&
990 	     (wme->wme_flags & WME_F_AGGRMODE) != 0) ||
991 	    (vap->iv_opmode == IEEE80211_M_STA &&
992 	     (vap->iv_bss->ni_flags & IEEE80211_NODE_QOS) == 0) ||
993 	    (vap->iv_flags & IEEE80211_F_WME) == 0) {
994 		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
995 		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
996 
997 		chanp->wmep_aifsn = bssp->wmep_aifsn = aggrParam[mode].aifsn;
998 		chanp->wmep_logcwmin = bssp->wmep_logcwmin =
999 		    aggrParam[mode].logcwmin;
1000 		chanp->wmep_logcwmax = bssp->wmep_logcwmax =
1001 		    aggrParam[mode].logcwmax;
1002 		chanp->wmep_txopLimit = bssp->wmep_txopLimit =
1003 		    (vap->iv_flags & IEEE80211_F_BURST) ?
1004 			aggrParam[mode].txopLimit : 0;
1005 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1006 		    "update %s (chan+bss) [acm %u aifsn %u logcwmin %u "
1007 		    "logcwmax %u txop %u]\n", ieee80211_wme_acnames[WME_AC_BE],
1008 		    chanp->wmep_acm, chanp->wmep_aifsn, chanp->wmep_logcwmin,
1009 		    chanp->wmep_logcwmax, chanp->wmep_txopLimit);
1010 	}
1011 
1012 	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1013 	    ic->ic_sta_assoc < 2 && (wme->wme_flags & WME_F_AGGRMODE) != 0) {
1014 		static const uint8_t logCwMin[IEEE80211_MODE_MAX] = {
1015 		    [IEEE80211_MODE_AUTO]	= 3,
1016 		    [IEEE80211_MODE_11A]	= 3,
1017 		    [IEEE80211_MODE_11B]	= 4,
1018 		    [IEEE80211_MODE_11G]	= 3,
1019 		    [IEEE80211_MODE_FH]		= 4,
1020 		    [IEEE80211_MODE_TURBO_A]	= 3,
1021 		    [IEEE80211_MODE_TURBO_G]	= 3,
1022 		    [IEEE80211_MODE_STURBO_A]	= 3,
1023 		    [IEEE80211_MODE_HALF]	= 3,
1024 		    [IEEE80211_MODE_QUARTER]	= 3,
1025 		    [IEEE80211_MODE_11NA]	= 3,
1026 		    [IEEE80211_MODE_11NG]	= 3,
1027 		};
1028 		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
1029 		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
1030 
1031 		chanp->wmep_logcwmin = bssp->wmep_logcwmin = logCwMin[mode];
1032 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1033 		    "update %s (chan+bss) logcwmin %u\n",
1034 		    ieee80211_wme_acnames[WME_AC_BE], chanp->wmep_logcwmin);
1035     	}
1036 	if (vap->iv_opmode == IEEE80211_M_HOSTAP) {	/* XXX ibss? */
1037 		/*
1038 		 * Arrange for a beacon update and bump the parameter
1039 		 * set number so associated stations load the new values.
1040 		 */
1041 		wme->wme_bssChanParams.cap_info =
1042 			(wme->wme_bssChanParams.cap_info+1) & WME_QOSINFO_COUNT;
1043 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_WME);
1044 	}
1045 
1046 	wme->wme_update(ic);
1047 
1048 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1049 	    "%s: WME params updated, cap_info 0x%x\n", __func__,
1050 	    vap->iv_opmode == IEEE80211_M_STA ?
1051 		wme->wme_wmeChanParams.cap_info :
1052 		wme->wme_bssChanParams.cap_info);
1053 }
1054 
1055 void
1056 ieee80211_wme_updateparams(struct ieee80211vap *vap)
1057 {
1058 	struct ieee80211com *ic = vap->iv_ic;
1059 
1060 	if (ic->ic_caps & IEEE80211_C_WME) {
1061 		IEEE80211_LOCK(ic);
1062 		ieee80211_wme_updateparams_locked(vap);
1063 		IEEE80211_UNLOCK(ic);
1064 	}
1065 }
1066 
1067 static void
1068 parent_updown(void *arg, int npending)
1069 {
1070 	struct ifnet *parent = arg;
1071 
1072 	parent->if_ioctl(parent, SIOCSIFFLAGS, NULL);
1073 }
1074 
1075 /*
1076  * Block until the parent is in a known state.  This is
1077  * used after any operations that dispatch a task (e.g.
1078  * to auto-configure the parent device up/down).
1079  */
1080 void
1081 ieee80211_waitfor_parent(struct ieee80211com *ic)
1082 {
1083 	taskqueue_drain(taskqueue_thread, &ic->ic_parent_task);
1084 }
1085 
1086 /*
1087  * Start a vap running.  If this is the first vap to be
1088  * set running on the underlying device then we
1089  * automatically bring the device up.
1090  */
1091 void
1092 ieee80211_start_locked(struct ieee80211vap *vap)
1093 {
1094 	struct ifnet *ifp = vap->iv_ifp;
1095 	struct ieee80211com *ic = vap->iv_ic;
1096 	struct ifnet *parent = ic->ic_ifp;
1097 
1098 	IEEE80211_LOCK_ASSERT(ic);
1099 
1100 	IEEE80211_DPRINTF(vap,
1101 		IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1102 		"start running, %d vaps running\n", ic->ic_nrunning);
1103 
1104 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1105 		/*
1106 		 * Mark us running.  Note that it's ok to do this first;
1107 		 * if we need to bring the parent device up we defer that
1108 		 * to avoid dropping the com lock.  We expect the device
1109 		 * to respond to being marked up by calling back into us
1110 		 * through ieee80211_start_all at which point we'll come
1111 		 * back in here and complete the work.
1112 		 */
1113 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1114 		/*
1115 		 * We are not running; if this we are the first vap
1116 		 * to be brought up auto-up the parent if necessary.
1117 		 */
1118 		if (ic->ic_nrunning++ == 0 &&
1119 		    (parent->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1120 			IEEE80211_DPRINTF(vap,
1121 			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1122 			    "%s: up parent %s\n", __func__, parent->if_xname);
1123 			parent->if_flags |= IFF_UP;
1124 			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1125 			return;
1126 		}
1127 	}
1128 	/*
1129 	 * If the parent is up and running, then kick the
1130 	 * 802.11 state machine as appropriate.
1131 	 */
1132 	if ((parent->if_drv_flags & IFF_DRV_RUNNING) &&
1133 	    vap->iv_roaming != IEEE80211_ROAMING_MANUAL) {
1134 		if (vap->iv_opmode == IEEE80211_M_STA) {
1135 #if 0
1136 			/* XXX bypasses scan too easily; disable for now */
1137 			/*
1138 			 * Try to be intelligent about clocking the state
1139 			 * machine.  If we're currently in RUN state then
1140 			 * we should be able to apply any new state/parameters
1141 			 * simply by re-associating.  Otherwise we need to
1142 			 * re-scan to select an appropriate ap.
1143 			 */
1144 			if (vap->iv_state >= IEEE80211_S_RUN)
1145 				ieee80211_new_state_locked(vap,
1146 				    IEEE80211_S_ASSOC, 1);
1147 			else
1148 #endif
1149 				ieee80211_new_state_locked(vap,
1150 				    IEEE80211_S_SCAN, 0);
1151 		} else {
1152 			/*
1153 			 * For monitor+wds mode there's nothing to do but
1154 			 * start running.  Otherwise if this is the first
1155 			 * vap to be brought up, start a scan which may be
1156 			 * preempted if the station is locked to a particular
1157 			 * channel.
1158 			 */
1159 			/* XXX needed? */
1160 			ieee80211_new_state_locked(vap, IEEE80211_S_INIT, 0);
1161 			if (vap->iv_opmode == IEEE80211_M_MONITOR ||
1162 			    vap->iv_opmode == IEEE80211_M_WDS)
1163 				ieee80211_new_state_locked(vap,
1164 				    IEEE80211_S_RUN, -1);
1165 			else
1166 				ieee80211_new_state_locked(vap,
1167 				    IEEE80211_S_SCAN, 0);
1168 		}
1169 	}
1170 }
1171 
1172 /*
1173  * Start a single vap.
1174  */
1175 void
1176 ieee80211_init(void *arg)
1177 {
1178 	struct ieee80211vap *vap = arg;
1179 
1180 	/*
1181 	 * This routine is publicly accessible through the vap's
1182 	 * if_init method so guard against calls during detach.
1183 	 * ieee80211_vap_detach null's the backpointer before
1184 	 * tearing down state to signal any callback should be
1185 	 * rejected/ignored.
1186 	 */
1187 	if (vap != NULL) {
1188 		IEEE80211_DPRINTF(vap,
1189 		    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1190 		    "%s\n", __func__);
1191 
1192 		IEEE80211_LOCK(vap->iv_ic);
1193 		ieee80211_start_locked(vap);
1194 		IEEE80211_UNLOCK(vap->iv_ic);
1195 	}
1196 }
1197 
1198 /*
1199  * Start all runnable vap's on a device.
1200  */
1201 void
1202 ieee80211_start_all(struct ieee80211com *ic)
1203 {
1204 	struct ieee80211vap *vap;
1205 
1206 	IEEE80211_LOCK(ic);
1207 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1208 		struct ifnet *ifp = vap->iv_ifp;
1209 		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1210 			ieee80211_start_locked(vap);
1211 	}
1212 	IEEE80211_UNLOCK(ic);
1213 }
1214 
1215 /*
1216  * Stop a vap.  We force it down using the state machine
1217  * then mark it's ifnet not running.  If this is the last
1218  * vap running on the underlying device then we close it
1219  * too to insure it will be properly initialized when the
1220  * next vap is brought up.
1221  */
1222 void
1223 ieee80211_stop_locked(struct ieee80211vap *vap)
1224 {
1225 	struct ieee80211com *ic = vap->iv_ic;
1226 	struct ifnet *ifp = vap->iv_ifp;
1227 	struct ifnet *parent = ic->ic_ifp;
1228 
1229 	IEEE80211_LOCK_ASSERT(ic);
1230 
1231 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1232 	    "stop running, %d vaps running\n", ic->ic_nrunning);
1233 
1234 	ieee80211_new_state_locked(vap, IEEE80211_S_INIT, -1);
1235 	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1236 		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;	/* mark us stopped */
1237 		if (--ic->ic_nrunning == 0 &&
1238 		    (parent->if_drv_flags & IFF_DRV_RUNNING)) {
1239 			IEEE80211_DPRINTF(vap,
1240 			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1241 			    "down parent %s\n", parent->if_xname);
1242 			parent->if_flags &= ~IFF_UP;
1243 			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1244 		}
1245 	}
1246 }
1247 
1248 void
1249 ieee80211_stop(struct ieee80211vap *vap)
1250 {
1251 	struct ieee80211com *ic = vap->iv_ic;
1252 
1253 	IEEE80211_LOCK(ic);
1254 	ieee80211_stop_locked(vap);
1255 	IEEE80211_UNLOCK(ic);
1256 }
1257 
1258 /*
1259  * Stop all vap's running on a device.
1260  */
1261 void
1262 ieee80211_stop_all(struct ieee80211com *ic)
1263 {
1264 	struct ieee80211vap *vap;
1265 
1266 	IEEE80211_LOCK(ic);
1267 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1268 		struct ifnet *ifp = vap->iv_ifp;
1269 		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1270 			ieee80211_stop_locked(vap);
1271 	}
1272 	IEEE80211_UNLOCK(ic);
1273 
1274 	ieee80211_waitfor_parent(ic);
1275 }
1276 
1277 /*
1278  * Stop all vap's running on a device and arrange
1279  * for those that were running to be resumed.
1280  */
1281 void
1282 ieee80211_suspend_all(struct ieee80211com *ic)
1283 {
1284 	struct ieee80211vap *vap;
1285 
1286 	IEEE80211_LOCK(ic);
1287 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1288 		struct ifnet *ifp = vap->iv_ifp;
1289 		if (IFNET_IS_UP_RUNNING(ifp)) {	/* NB: avoid recursion */
1290 			vap->iv_flags_ext |= IEEE80211_FEXT_RESUME;
1291 			ieee80211_stop_locked(vap);
1292 		}
1293 	}
1294 	IEEE80211_UNLOCK(ic);
1295 
1296 	ieee80211_waitfor_parent(ic);
1297 }
1298 
1299 /*
1300  * Start all vap's marked for resume.
1301  */
1302 void
1303 ieee80211_resume_all(struct ieee80211com *ic)
1304 {
1305 	struct ieee80211vap *vap;
1306 
1307 	IEEE80211_LOCK(ic);
1308 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1309 		struct ifnet *ifp = vap->iv_ifp;
1310 		if (!IFNET_IS_UP_RUNNING(ifp) &&
1311 		    (vap->iv_flags_ext & IEEE80211_FEXT_RESUME)) {
1312 			vap->iv_flags_ext &= ~IEEE80211_FEXT_RESUME;
1313 			ieee80211_start_locked(vap);
1314 		}
1315 	}
1316 	IEEE80211_UNLOCK(ic);
1317 }
1318 
1319 /*
1320  * Switch between turbo and non-turbo operating modes.
1321  * Use the specified channel flags to locate the new
1322  * channel, update 802.11 state, and then call back into
1323  * the driver to effect the change.
1324  */
1325 void
1326 ieee80211_dturbo_switch(struct ieee80211vap *vap, int newflags)
1327 {
1328 	struct ieee80211com *ic = vap->iv_ic;
1329 	struct ieee80211_channel *chan;
1330 
1331 	chan = ieee80211_find_channel(ic, ic->ic_bsschan->ic_freq, newflags);
1332 	if (chan == NULL) {		/* XXX should not happen */
1333 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1334 		    "%s: no channel with freq %u flags 0x%x\n",
1335 		    __func__, ic->ic_bsschan->ic_freq, newflags);
1336 		return;
1337 	}
1338 
1339 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1340 	    "%s: %s -> %s (freq %u flags 0x%x)\n", __func__,
1341 	    ieee80211_phymode_name[ieee80211_chan2mode(ic->ic_bsschan)],
1342 	    ieee80211_phymode_name[ieee80211_chan2mode(chan)],
1343 	    chan->ic_freq, chan->ic_flags);
1344 
1345 	ic->ic_bsschan = chan;
1346 	ic->ic_prevchan = ic->ic_curchan;
1347 	ic->ic_curchan = chan;
1348 	ic->ic_set_channel(ic);
1349 	/* NB: do not need to reset ERP state 'cuz we're in sta mode */
1350 }
1351 
1352 void
1353 ieee80211_beacon_miss(struct ieee80211com *ic)
1354 {
1355 	struct ieee80211vap *vap;
1356 
1357 	if (ic->ic_flags & IEEE80211_F_SCAN)
1358 		return;
1359 	/* XXX locking */
1360 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1361 		/*
1362 		 * We only pass events through for sta vap's in RUN state;
1363 		 * may be too restrictive but for now this saves all the
1364 		 * handlers duplicating these checks.
1365 		 */
1366 		if (vap->iv_opmode == IEEE80211_M_STA &&
1367 		    vap->iv_state == IEEE80211_S_RUN &&
1368 		    vap->iv_bmiss != NULL)
1369 			vap->iv_bmiss(vap);
1370 	}
1371 }
1372 
1373 /*
1374  * Software beacon miss handling.  Check if any beacons
1375  * were received in the last period.  If not post a
1376  * beacon miss; otherwise reset the counter.
1377  */
1378 void
1379 ieee80211_swbmiss(void *arg)
1380 {
1381 	struct ieee80211vap *vap = arg;
1382 	struct ieee80211com *ic = vap->iv_ic;
1383 
1384 	/* XXX sleep state? */
1385 	KASSERT(vap->iv_state == IEEE80211_S_RUN,
1386 	    ("wrong state %d", vap->iv_state));
1387 
1388 	if (ic->ic_flags & IEEE80211_F_SCAN) {
1389 		/*
1390 		 * If scanning just ignore and reset state.  If we get a
1391 		 * bmiss after coming out of scan because we haven't had
1392 		 * time to receive a beacon then we should probe the AP
1393 		 * before posting a real bmiss (unless iv_bmiss_max has
1394 		 * been artifiically lowered).  A cleaner solution might
1395 		 * be to disable the timer on scan start/end but to handle
1396 		 * case of multiple sta vap's we'd need to disable the
1397 		 * timers of all affected vap's.
1398 		 */
1399 		vap->iv_swbmiss_count = 0;
1400 	} else if (vap->iv_swbmiss_count == 0) {
1401 		if (vap->iv_bmiss != NULL)
1402 			vap->iv_bmiss(vap);
1403 		if (vap->iv_bmiss_count == 0)	/* don't re-arm timer */
1404 			return;
1405 	} else
1406 		vap->iv_swbmiss_count = 0;
1407 	callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
1408 		ieee80211_swbmiss, vap);
1409 }
1410 
1411 /*
1412  * Start an 802.11h channel switch.  We record the parameters,
1413  * mark the operation pending, notify each vap through the
1414  * beacon update mechanism so it can update the beacon frame
1415  * contents, and then switch vap's to CSA state to block outbound
1416  * traffic.  Devices that handle CSA directly can use the state
1417  * switch to do the right thing so long as they call
1418  * ieee80211_csa_completeswitch when it's time to complete the
1419  * channel change.  Devices that depend on the net80211 layer can
1420  * use ieee80211_beacon_update to handle the countdown and the
1421  * channel switch.
1422  */
1423 void
1424 ieee80211_csa_startswitch(struct ieee80211com *ic,
1425 	struct ieee80211_channel *c, int mode, int count)
1426 {
1427 	struct ieee80211vap *vap;
1428 
1429 	IEEE80211_LOCK_ASSERT(ic);
1430 
1431 	ic->ic_csa_newchan = c;
1432 	ic->ic_csa_count = count;
1433 	/* XXX record mode? */
1434 	ic->ic_flags |= IEEE80211_F_CSAPENDING;
1435 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1436 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1437 		    vap->iv_opmode == IEEE80211_M_IBSS)
1438 			ieee80211_beacon_notify(vap, IEEE80211_BEACON_CSA);
1439 		/* switch to CSA state to block outbound traffic */
1440 		if (vap->iv_state == IEEE80211_S_RUN)
1441 			ieee80211_new_state_locked(vap, IEEE80211_S_CSA, 0);
1442 	}
1443 	ieee80211_notify_csa(ic, c, mode, count);
1444 }
1445 
1446 /*
1447  * Complete an 802.11h channel switch started by ieee80211_csa_startswitch.
1448  * We clear state and move all vap's in CSA state to RUN state
1449  * so they can again transmit.
1450  */
1451 void
1452 ieee80211_csa_completeswitch(struct ieee80211com *ic)
1453 {
1454 	struct ieee80211vap *vap;
1455 
1456 	IEEE80211_LOCK_ASSERT(ic);
1457 
1458 	KASSERT(ic->ic_flags & IEEE80211_F_CSAPENDING, ("csa not pending"));
1459 
1460 	ieee80211_setcurchan(ic, ic->ic_csa_newchan);
1461 	ic->ic_csa_newchan = NULL;
1462 	ic->ic_flags &= ~IEEE80211_F_CSAPENDING;
1463 
1464 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1465 		if (vap->iv_state == IEEE80211_S_CSA)
1466 			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1467 }
1468 
1469 /*
1470  * Complete a DFS CAC started by ieee80211_dfs_cac_start.
1471  * We clear state and move all vap's in CAC state to RUN state.
1472  */
1473 void
1474 ieee80211_cac_completeswitch(struct ieee80211vap *vap0)
1475 {
1476 	struct ieee80211com *ic = vap0->iv_ic;
1477 	struct ieee80211vap *vap;
1478 
1479 	IEEE80211_LOCK(ic);
1480 	/*
1481 	 * Complete CAC state change for lead vap first; then
1482 	 * clock all the other vap's waiting.
1483 	 */
1484 	KASSERT(vap0->iv_state == IEEE80211_S_CAC,
1485 	    ("wrong state %d", vap0->iv_state));
1486 	ieee80211_new_state_locked(vap0, IEEE80211_S_RUN, 0);
1487 
1488 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1489 		if (vap->iv_state == IEEE80211_S_CAC)
1490 			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1491 	IEEE80211_UNLOCK(ic);
1492 }
1493 
1494 /*
1495  * Force all vap's other than the specified vap to the INIT state
1496  * and mark them as waiting for a scan to complete.  These vaps
1497  * will be brought up when the scan completes and the scanning vap
1498  * reaches RUN state by wakeupwaiting.
1499  * XXX if we do this in threads we can use sleep/wakeup.
1500  */
1501 static void
1502 markwaiting(struct ieee80211vap *vap0)
1503 {
1504 	struct ieee80211com *ic = vap0->iv_ic;
1505 	struct ieee80211vap *vap;
1506 
1507 	IEEE80211_LOCK_ASSERT(ic);
1508 
1509 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1510 		if (vap == vap0)
1511 			continue;
1512 		if (vap->iv_state != IEEE80211_S_INIT) {
1513 			vap->iv_newstate(vap, IEEE80211_S_INIT, 0);
1514 			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1515 		}
1516 	}
1517 }
1518 
1519 /*
1520  * Wakeup all vap's waiting for a scan to complete.  This is the
1521  * companion to markwaiting (above) and is used to coordinate
1522  * multiple vaps scanning.
1523  */
1524 static void
1525 wakeupwaiting(struct ieee80211vap *vap0)
1526 {
1527 	struct ieee80211com *ic = vap0->iv_ic;
1528 	struct ieee80211vap *vap;
1529 
1530 	IEEE80211_LOCK_ASSERT(ic);
1531 
1532 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1533 		if (vap == vap0)
1534 			continue;
1535 		if (vap->iv_flags_ext & IEEE80211_FEXT_SCANWAIT) {
1536 			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1537 			/* NB: sta's cannot go INIT->RUN */
1538 			vap->iv_newstate(vap,
1539 			    vap->iv_opmode == IEEE80211_M_STA ?
1540 			        IEEE80211_S_SCAN : IEEE80211_S_RUN, 0);
1541 		}
1542 	}
1543 }
1544 
1545 /*
1546  * Handle post state change work common to all operating modes.
1547  */
1548 static void
1549 ieee80211_newstate_cb(struct ieee80211vap *vap,
1550 	enum ieee80211_state nstate, int arg)
1551 {
1552 	struct ieee80211com *ic = vap->iv_ic;
1553 
1554 	IEEE80211_LOCK_ASSERT(ic);
1555 
1556 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1557 	    "%s: %s arg %d\n", __func__, ieee80211_state_name[nstate], arg);
1558 
1559 	if (nstate == IEEE80211_S_RUN) {
1560 		/*
1561 		 * OACTIVE may be set on the vap if the upper layer
1562 		 * tried to transmit (e.g. IPv6 NDP) before we reach
1563 		 * RUN state.  Clear it and restart xmit.
1564 		 *
1565 		 * Note this can also happen as a result of SLEEP->RUN
1566 		 * (i.e. coming out of power save mode).
1567 		 */
1568 		vap->iv_ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1569 		if_start(vap->iv_ifp);
1570 
1571 		/* bring up any vaps waiting on us */
1572 		wakeupwaiting(vap);
1573 	} else if (nstate == IEEE80211_S_INIT) {
1574 		/*
1575 		 * Flush the scan cache if we did the last scan (XXX?)
1576 		 * and flush any frames on send queues from this vap.
1577 		 * Note the mgt q is used only for legacy drivers and
1578 		 * will go away shortly.
1579 		 */
1580 		ieee80211_scan_flush(vap);
1581 
1582 		/* XXX NB: cast for altq */
1583 		ieee80211_flush_ifq((struct ifqueue *)&ic->ic_ifp->if_snd, vap);
1584 	}
1585 	vap->iv_newstate_cb = NULL;
1586 }
1587 
1588 /*
1589  * Public interface for initiating a state machine change.
1590  * This routine single-threads the request and coordinates
1591  * the scheduling of multiple vaps for the purpose of selecting
1592  * an operating channel.  Specifically the following scenarios
1593  * are handled:
1594  * o only one vap can be selecting a channel so on transition to
1595  *   SCAN state if another vap is already scanning then
1596  *   mark the caller for later processing and return without
1597  *   doing anything (XXX? expectations by caller of synchronous operation)
1598  * o only one vap can be doing CAC of a channel so on transition to
1599  *   CAC state if another vap is already scanning for radar then
1600  *   mark the caller for later processing and return without
1601  *   doing anything (XXX? expectations by caller of synchronous operation)
1602  * o if another vap is already running when a request is made
1603  *   to SCAN then an operating channel has been chosen; bypass
1604  *   the scan and just join the channel
1605  *
1606  * Note that the state change call is done through the iv_newstate
1607  * method pointer so any driver routine gets invoked.  The driver
1608  * will normally call back into operating mode-specific
1609  * ieee80211_newstate routines (below) unless it needs to completely
1610  * bypass the state machine (e.g. because the firmware has it's
1611  * own idea how things should work).  Bypassing the net80211 layer
1612  * is usually a mistake and indicates lack of proper integration
1613  * with the net80211 layer.
1614  */
1615 static int
1616 ieee80211_new_state_locked(struct ieee80211vap *vap,
1617 	enum ieee80211_state nstate, int arg)
1618 {
1619 	struct ieee80211com *ic = vap->iv_ic;
1620 	struct ieee80211vap *vp;
1621 	enum ieee80211_state ostate;
1622 	int nrunning, nscanning, rc;
1623 
1624 	IEEE80211_LOCK_ASSERT(ic);
1625 
1626 	nrunning = nscanning = 0;
1627 	/* XXX can track this state instead of calculating */
1628 	TAILQ_FOREACH(vp, &ic->ic_vaps, iv_next) {
1629 		if (vp != vap) {
1630 			if (vp->iv_state >= IEEE80211_S_RUN)
1631 				nrunning++;
1632 			/* XXX doesn't handle bg scan */
1633 			/* NB: CAC+AUTH+ASSOC treated like SCAN */
1634 			else if (vp->iv_state > IEEE80211_S_INIT)
1635 				nscanning++;
1636 		}
1637 	}
1638 	ostate = vap->iv_state;
1639 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1640 	    "%s: %s -> %s (nrunning %d nscanning %d)\n", __func__,
1641 	    ieee80211_state_name[ostate], ieee80211_state_name[nstate],
1642 	    nrunning, nscanning);
1643 	switch (nstate) {
1644 	case IEEE80211_S_SCAN:
1645 		if (ostate == IEEE80211_S_INIT) {
1646 			/*
1647 			 * INIT -> SCAN happens on initial bringup.
1648 			 */
1649 			KASSERT(!(nscanning && nrunning),
1650 			    ("%d scanning and %d running", nscanning, nrunning));
1651 			if (nscanning) {
1652 				/*
1653 				 * Someone is scanning, defer our state
1654 				 * change until the work has completed.
1655 				 */
1656 				IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1657 				    "%s: defer %s -> %s\n",
1658 				    __func__, ieee80211_state_name[ostate],
1659 				    ieee80211_state_name[nstate]);
1660 				vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1661 				rc = 0;
1662 				goto done;
1663 			}
1664 			if (nrunning) {
1665 				/*
1666 				 * Someone is operating; just join the channel
1667 				 * they have chosen.
1668 				 */
1669 				/* XXX kill arg? */
1670 				/* XXX check each opmode, adhoc? */
1671 				if (vap->iv_opmode == IEEE80211_M_STA)
1672 					nstate = IEEE80211_S_SCAN;
1673 				else
1674 					nstate = IEEE80211_S_RUN;
1675 #ifdef IEEE80211_DEBUG
1676 				if (nstate != IEEE80211_S_SCAN) {
1677 					IEEE80211_DPRINTF(vap,
1678 					    IEEE80211_MSG_STATE,
1679 					    "%s: override, now %s -> %s\n",
1680 					    __func__,
1681 					    ieee80211_state_name[ostate],
1682 					    ieee80211_state_name[nstate]);
1683 				}
1684 #endif
1685 			}
1686 		} else {
1687 			/*
1688 			 * SCAN was forced; e.g. on beacon miss.  Force
1689 			 * other running vap's to INIT state and mark
1690 			 * them as waiting for the scan to complete.  This
1691 			 * insures they don't interfere with our scanning.
1692 			 *
1693 			 * XXX not always right, assumes ap follows sta
1694 			 */
1695 			markwaiting(vap);
1696 		}
1697 		break;
1698 	case IEEE80211_S_RUN:
1699 		if (vap->iv_opmode == IEEE80211_M_WDS &&
1700 		    (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY) &&
1701 		    nscanning) {
1702 			/*
1703 			 * Legacy WDS with someone else scanning; don't
1704 			 * go online until that completes as we should
1705 			 * follow the other vap to the channel they choose.
1706 			 */
1707 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1708 			     "%s: defer %s -> %s (legacy WDS)\n", __func__,
1709 			     ieee80211_state_name[ostate],
1710 			     ieee80211_state_name[nstate]);
1711 			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1712 			rc = 0;
1713 			goto done;
1714 		}
1715 		if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1716 		    IEEE80211_IS_CHAN_DFS(ic->ic_bsschan) &&
1717 		    (vap->iv_flags_ext & IEEE80211_FEXT_DFS) &&
1718 		    !IEEE80211_IS_CHAN_CACDONE(ic->ic_bsschan)) {
1719 			/*
1720 			 * This is a DFS channel, transition to CAC state
1721 			 * instead of RUN.  This allows us to initiate
1722 			 * Channel Availability Check (CAC) as specified
1723 			 * by 11h/DFS.
1724 			 */
1725 			nstate = IEEE80211_S_CAC;
1726 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1727 			     "%s: override %s -> %s (DFS)\n", __func__,
1728 			     ieee80211_state_name[ostate],
1729 			     ieee80211_state_name[nstate]);
1730 		}
1731 		break;
1732 	case IEEE80211_S_INIT:
1733 		if (ostate == IEEE80211_S_INIT ) {
1734 			/* XXX don't believe this */
1735 			/* INIT -> INIT. nothing to do */
1736 			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1737 		}
1738 		/* fall thru... */
1739 	default:
1740 		break;
1741 	}
1742 	/* XXX on transition RUN->CAC do we need to set nstate = iv_state? */
1743 	if (ostate != nstate) {
1744 		/*
1745 		 * Arrange for work to happen after state change completes.
1746 		 * If this happens asynchronously the caller must arrange
1747 		 * for the com lock to be held.
1748 		 */
1749 		vap->iv_newstate_cb = ieee80211_newstate_cb;
1750 	}
1751 	rc = vap->iv_newstate(vap, nstate, arg);
1752 	if (rc == 0 && vap->iv_newstate_cb != NULL)
1753 		vap->iv_newstate_cb(vap, nstate, arg);
1754 done:
1755 	return rc;
1756 }
1757 
1758 int
1759 ieee80211_new_state(struct ieee80211vap *vap,
1760 	enum ieee80211_state nstate, int arg)
1761 {
1762 	struct ieee80211com *ic = vap->iv_ic;
1763 	int rc;
1764 
1765 	IEEE80211_LOCK(ic);
1766 	rc = ieee80211_new_state_locked(vap, nstate, arg);
1767 	IEEE80211_UNLOCK(ic);
1768 	return rc;
1769 }
1770