xref: /freebsd/sys/net80211/ieee80211_proto.c (revision db612abe8df3355d1eb23bb3b50fdd97bc21e979)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 /*
31  * IEEE 802.11 protocol support.
32  */
33 
34 #include "opt_inet.h"
35 #include "opt_wlan.h"
36 
37 #include <sys/param.h>
38 #include <sys/kernel.h>
39 #include <sys/systm.h>
40 #include <sys/taskqueue.h>
41 
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 
45 #include <net/if.h>
46 #include <net/if_media.h>
47 #include <net/ethernet.h>		/* XXX for ether_sprintf */
48 
49 #include <net80211/ieee80211_var.h>
50 #include <net80211/ieee80211_adhoc.h>
51 #include <net80211/ieee80211_sta.h>
52 #include <net80211/ieee80211_hostap.h>
53 #include <net80211/ieee80211_wds.h>
54 #include <net80211/ieee80211_monitor.h>
55 #include <net80211/ieee80211_input.h>
56 
57 /* XXX tunables */
58 #define	AGGRESSIVE_MODE_SWITCH_HYSTERESIS	3	/* pkts / 100ms */
59 #define	HIGH_PRI_SWITCH_THRESH			10	/* pkts / 100ms */
60 
61 const char *ieee80211_mgt_subtype_name[] = {
62 	"assoc_req",	"assoc_resp",	"reassoc_req",	"reassoc_resp",
63 	"probe_req",	"probe_resp",	"reserved#6",	"reserved#7",
64 	"beacon",	"atim",		"disassoc",	"auth",
65 	"deauth",	"action",	"reserved#14",	"reserved#15"
66 };
67 const char *ieee80211_ctl_subtype_name[] = {
68 	"reserved#0",	"reserved#1",	"reserved#2",	"reserved#3",
69 	"reserved#3",	"reserved#5",	"reserved#6",	"reserved#7",
70 	"reserved#8",	"reserved#9",	"ps_poll",	"rts",
71 	"cts",		"ack",		"cf_end",	"cf_end_ack"
72 };
73 const char *ieee80211_opmode_name[IEEE80211_OPMODE_MAX] = {
74 	"IBSS",		/* IEEE80211_M_IBSS */
75 	"STA",		/* IEEE80211_M_STA */
76 	"WDS",		/* IEEE80211_M_WDS */
77 	"AHDEMO",	/* IEEE80211_M_AHDEMO */
78 	"HOSTAP",	/* IEEE80211_M_HOSTAP */
79 	"MONITOR"	/* IEEE80211_M_MONITOR */
80 };
81 const char *ieee80211_state_name[IEEE80211_S_MAX] = {
82 	"INIT",		/* IEEE80211_S_INIT */
83 	"SCAN",		/* IEEE80211_S_SCAN */
84 	"AUTH",		/* IEEE80211_S_AUTH */
85 	"ASSOC",	/* IEEE80211_S_ASSOC */
86 	"CAC",		/* IEEE80211_S_CAC */
87 	"RUN",		/* IEEE80211_S_RUN */
88 	"CSA",		/* IEEE80211_S_CSA */
89 	"SLEEP",	/* IEEE80211_S_SLEEP */
90 };
91 const char *ieee80211_wme_acnames[] = {
92 	"WME_AC_BE",
93 	"WME_AC_BK",
94 	"WME_AC_VI",
95 	"WME_AC_VO",
96 	"WME_UPSD",
97 };
98 
99 static void parent_updown(void *, int);
100 static int ieee80211_new_state_locked(struct ieee80211vap *,
101 	enum ieee80211_state, int);
102 
103 static int
104 null_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
105 	const struct ieee80211_bpf_params *params)
106 {
107 	struct ifnet *ifp = ni->ni_ic->ic_ifp;
108 
109 	if_printf(ifp, "missing ic_raw_xmit callback, drop frame\n");
110 	m_freem(m);
111 	return ENETDOWN;
112 }
113 
114 void
115 ieee80211_proto_attach(struct ieee80211com *ic)
116 {
117 	struct ifnet *ifp = ic->ic_ifp;
118 
119 	/* override the 802.3 setting */
120 	ifp->if_hdrlen = ic->ic_headroom
121 		+ sizeof(struct ieee80211_qosframe_addr4)
122 		+ IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN
123 		+ IEEE80211_WEP_EXTIVLEN;
124 	/* XXX no way to recalculate on ifdetach */
125 	if (ALIGN(ifp->if_hdrlen) > max_linkhdr) {
126 		/* XXX sanity check... */
127 		max_linkhdr = ALIGN(ifp->if_hdrlen);
128 		max_hdr = max_linkhdr + max_protohdr;
129 		max_datalen = MHLEN - max_hdr;
130 	}
131 	ic->ic_protmode = IEEE80211_PROT_CTSONLY;
132 
133 	TASK_INIT(&ic->ic_parent_task, 0, parent_updown, ifp);
134 
135 	ic->ic_wme.wme_hipri_switch_hysteresis =
136 		AGGRESSIVE_MODE_SWITCH_HYSTERESIS;
137 
138 	/* initialize management frame handlers */
139 	ic->ic_send_mgmt = ieee80211_send_mgmt;
140 	ic->ic_raw_xmit = null_raw_xmit;
141 
142 	ieee80211_adhoc_attach(ic);
143 	ieee80211_sta_attach(ic);
144 	ieee80211_wds_attach(ic);
145 	ieee80211_hostap_attach(ic);
146 	ieee80211_monitor_attach(ic);
147 }
148 
149 void
150 ieee80211_proto_detach(struct ieee80211com *ic)
151 {
152 	ieee80211_monitor_detach(ic);
153 	ieee80211_hostap_detach(ic);
154 	ieee80211_wds_detach(ic);
155 	ieee80211_adhoc_detach(ic);
156 	ieee80211_sta_detach(ic);
157 }
158 
159 static void
160 null_update_beacon(struct ieee80211vap *vap, int item)
161 {
162 }
163 
164 void
165 ieee80211_proto_vattach(struct ieee80211vap *vap)
166 {
167 	struct ieee80211com *ic = vap->iv_ic;
168 	struct ifnet *ifp = vap->iv_ifp;
169 	int i;
170 
171 	/* override the 802.3 setting */
172 	ifp->if_hdrlen = ic->ic_ifp->if_hdrlen;
173 
174 	vap->iv_rtsthreshold = IEEE80211_RTS_DEFAULT;
175 	vap->iv_fragthreshold = IEEE80211_FRAG_DEFAULT;
176 	vap->iv_bmiss_max = IEEE80211_BMISS_MAX;
177 	callout_init(&vap->iv_swbmiss, CALLOUT_MPSAFE);
178 	callout_init(&vap->iv_mgtsend, CALLOUT_MPSAFE);
179 	/*
180 	 * Install default tx rate handling: no fixed rate, lowest
181 	 * supported rate for mgmt and multicast frames.  Default
182 	 * max retry count.  These settings can be changed by the
183 	 * driver and/or user applications.
184 	 */
185 	for (i = IEEE80211_MODE_11A; i < IEEE80211_MODE_11NA; i++) {
186 		const struct ieee80211_rateset *rs = &ic->ic_sup_rates[i];
187 
188 		vap->iv_txparms[i].ucastrate = IEEE80211_FIXED_RATE_NONE;
189 		/* NB: we default to min supported rate for channel */
190 		vap->iv_txparms[i].mgmtrate =
191 		    rs->rs_rates[0] & IEEE80211_RATE_VAL;
192 		vap->iv_txparms[i].mcastrate =
193 		    rs->rs_rates[0] & IEEE80211_RATE_VAL;
194 		vap->iv_txparms[i].maxretry = IEEE80211_TXMAX_DEFAULT;
195 	}
196 	for (; i < IEEE80211_MODE_MAX; i++) {
197 		vap->iv_txparms[i].ucastrate = IEEE80211_FIXED_RATE_NONE;
198 		/* NB: default to MCS 0 */
199 		vap->iv_txparms[i].mgmtrate = 0 | 0x80;
200 		vap->iv_txparms[i].mcastrate = 0 | 0x80;
201 		vap->iv_txparms[i].maxretry = IEEE80211_TXMAX_DEFAULT;
202 	}
203 	vap->iv_roaming = IEEE80211_ROAMING_AUTO;
204 
205 	vap->iv_update_beacon = null_update_beacon;
206 	vap->iv_deliver_data = ieee80211_deliver_data;
207 
208 	/* attach support for operating mode */
209 	ic->ic_vattach[vap->iv_opmode](vap);
210 }
211 
212 void
213 ieee80211_proto_vdetach(struct ieee80211vap *vap)
214 {
215 #define	FREEAPPIE(ie) do { \
216 	if (ie != NULL) \
217 		FREE(ie, M_80211_NODE_IE); \
218 } while (0)
219 	/*
220 	 * Detach operating mode module.
221 	 */
222 	if (vap->iv_opdetach != NULL)
223 		vap->iv_opdetach(vap);
224 	/*
225 	 * This should not be needed as we detach when reseting
226 	 * the state but be conservative here since the
227 	 * authenticator may do things like spawn kernel threads.
228 	 */
229 	if (vap->iv_auth->ia_detach != NULL)
230 		vap->iv_auth->ia_detach(vap);
231 	/*
232 	 * Detach any ACL'ator.
233 	 */
234 	if (vap->iv_acl != NULL)
235 		vap->iv_acl->iac_detach(vap);
236 
237 	FREEAPPIE(vap->iv_appie_beacon);
238 	FREEAPPIE(vap->iv_appie_probereq);
239 	FREEAPPIE(vap->iv_appie_proberesp);
240 	FREEAPPIE(vap->iv_appie_assocreq);
241 	FREEAPPIE(vap->iv_appie_assocresp);
242 	FREEAPPIE(vap->iv_appie_wpa);
243 #undef FREEAPPIE
244 }
245 
246 /*
247  * Simple-minded authenticator module support.
248  */
249 
250 #define	IEEE80211_AUTH_MAX	(IEEE80211_AUTH_WPA+1)
251 /* XXX well-known names */
252 static const char *auth_modnames[IEEE80211_AUTH_MAX] = {
253 	"wlan_internal",	/* IEEE80211_AUTH_NONE */
254 	"wlan_internal",	/* IEEE80211_AUTH_OPEN */
255 	"wlan_internal",	/* IEEE80211_AUTH_SHARED */
256 	"wlan_xauth",		/* IEEE80211_AUTH_8021X	 */
257 	"wlan_internal",	/* IEEE80211_AUTH_AUTO */
258 	"wlan_xauth",		/* IEEE80211_AUTH_WPA */
259 };
260 static const struct ieee80211_authenticator *authenticators[IEEE80211_AUTH_MAX];
261 
262 static const struct ieee80211_authenticator auth_internal = {
263 	.ia_name		= "wlan_internal",
264 	.ia_attach		= NULL,
265 	.ia_detach		= NULL,
266 	.ia_node_join		= NULL,
267 	.ia_node_leave		= NULL,
268 };
269 
270 /*
271  * Setup internal authenticators once; they are never unregistered.
272  */
273 static void
274 ieee80211_auth_setup(void)
275 {
276 	ieee80211_authenticator_register(IEEE80211_AUTH_OPEN, &auth_internal);
277 	ieee80211_authenticator_register(IEEE80211_AUTH_SHARED, &auth_internal);
278 	ieee80211_authenticator_register(IEEE80211_AUTH_AUTO, &auth_internal);
279 }
280 SYSINIT(wlan_auth, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_auth_setup, NULL);
281 
282 const struct ieee80211_authenticator *
283 ieee80211_authenticator_get(int auth)
284 {
285 	if (auth >= IEEE80211_AUTH_MAX)
286 		return NULL;
287 	if (authenticators[auth] == NULL)
288 		ieee80211_load_module(auth_modnames[auth]);
289 	return authenticators[auth];
290 }
291 
292 void
293 ieee80211_authenticator_register(int type,
294 	const struct ieee80211_authenticator *auth)
295 {
296 	if (type >= IEEE80211_AUTH_MAX)
297 		return;
298 	authenticators[type] = auth;
299 }
300 
301 void
302 ieee80211_authenticator_unregister(int type)
303 {
304 
305 	if (type >= IEEE80211_AUTH_MAX)
306 		return;
307 	authenticators[type] = NULL;
308 }
309 
310 /*
311  * Very simple-minded ACL module support.
312  */
313 /* XXX just one for now */
314 static	const struct ieee80211_aclator *acl = NULL;
315 
316 void
317 ieee80211_aclator_register(const struct ieee80211_aclator *iac)
318 {
319 	printf("wlan: %s acl policy registered\n", iac->iac_name);
320 	acl = iac;
321 }
322 
323 void
324 ieee80211_aclator_unregister(const struct ieee80211_aclator *iac)
325 {
326 	if (acl == iac)
327 		acl = NULL;
328 	printf("wlan: %s acl policy unregistered\n", iac->iac_name);
329 }
330 
331 const struct ieee80211_aclator *
332 ieee80211_aclator_get(const char *name)
333 {
334 	if (acl == NULL)
335 		ieee80211_load_module("wlan_acl");
336 	return acl != NULL && strcmp(acl->iac_name, name) == 0 ? acl : NULL;
337 }
338 
339 void
340 ieee80211_print_essid(const uint8_t *essid, int len)
341 {
342 	const uint8_t *p;
343 	int i;
344 
345 	if (len > IEEE80211_NWID_LEN)
346 		len = IEEE80211_NWID_LEN;
347 	/* determine printable or not */
348 	for (i = 0, p = essid; i < len; i++, p++) {
349 		if (*p < ' ' || *p > 0x7e)
350 			break;
351 	}
352 	if (i == len) {
353 		printf("\"");
354 		for (i = 0, p = essid; i < len; i++, p++)
355 			printf("%c", *p);
356 		printf("\"");
357 	} else {
358 		printf("0x");
359 		for (i = 0, p = essid; i < len; i++, p++)
360 			printf("%02x", *p);
361 	}
362 }
363 
364 void
365 ieee80211_dump_pkt(struct ieee80211com *ic,
366 	const uint8_t *buf, int len, int rate, int rssi)
367 {
368 	const struct ieee80211_frame *wh;
369 	int i;
370 
371 	wh = (const struct ieee80211_frame *)buf;
372 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
373 	case IEEE80211_FC1_DIR_NODS:
374 		printf("NODS %s", ether_sprintf(wh->i_addr2));
375 		printf("->%s", ether_sprintf(wh->i_addr1));
376 		printf("(%s)", ether_sprintf(wh->i_addr3));
377 		break;
378 	case IEEE80211_FC1_DIR_TODS:
379 		printf("TODS %s", ether_sprintf(wh->i_addr2));
380 		printf("->%s", ether_sprintf(wh->i_addr3));
381 		printf("(%s)", ether_sprintf(wh->i_addr1));
382 		break;
383 	case IEEE80211_FC1_DIR_FROMDS:
384 		printf("FRDS %s", ether_sprintf(wh->i_addr3));
385 		printf("->%s", ether_sprintf(wh->i_addr1));
386 		printf("(%s)", ether_sprintf(wh->i_addr2));
387 		break;
388 	case IEEE80211_FC1_DIR_DSTODS:
389 		printf("DSDS %s", ether_sprintf((const uint8_t *)&wh[1]));
390 		printf("->%s", ether_sprintf(wh->i_addr3));
391 		printf("(%s", ether_sprintf(wh->i_addr2));
392 		printf("->%s)", ether_sprintf(wh->i_addr1));
393 		break;
394 	}
395 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
396 	case IEEE80211_FC0_TYPE_DATA:
397 		printf(" data");
398 		break;
399 	case IEEE80211_FC0_TYPE_MGT:
400 		printf(" %s", ieee80211_mgt_subtype_name[
401 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
402 		    >> IEEE80211_FC0_SUBTYPE_SHIFT]);
403 		break;
404 	default:
405 		printf(" type#%d", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
406 		break;
407 	}
408 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
409 		const struct ieee80211_qosframe *qwh =
410 			(const struct ieee80211_qosframe *)buf;
411 		printf(" QoS [TID %u%s]", qwh->i_qos[0] & IEEE80211_QOS_TID,
412 			qwh->i_qos[0] & IEEE80211_QOS_ACKPOLICY ? " ACM" : "");
413 	}
414 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
415 		int off;
416 
417 		off = ieee80211_anyhdrspace(ic, wh);
418 		printf(" WEP [IV %.02x %.02x %.02x",
419 			buf[off+0], buf[off+1], buf[off+2]);
420 		if (buf[off+IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV)
421 			printf(" %.02x %.02x %.02x",
422 				buf[off+4], buf[off+5], buf[off+6]);
423 		printf(" KID %u]", buf[off+IEEE80211_WEP_IVLEN] >> 6);
424 	}
425 	if (rate >= 0)
426 		printf(" %dM", rate / 2);
427 	if (rssi >= 0)
428 		printf(" +%d", rssi);
429 	printf("\n");
430 	if (len > 0) {
431 		for (i = 0; i < len; i++) {
432 			if ((i & 1) == 0)
433 				printf(" ");
434 			printf("%02x", buf[i]);
435 		}
436 		printf("\n");
437 	}
438 }
439 
440 static __inline int
441 findrix(const struct ieee80211_rateset *rs, int r)
442 {
443 	int i;
444 
445 	for (i = 0; i < rs->rs_nrates; i++)
446 		if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == r)
447 			return i;
448 	return -1;
449 }
450 
451 int
452 ieee80211_fix_rate(struct ieee80211_node *ni,
453 	struct ieee80211_rateset *nrs, int flags)
454 {
455 #define	RV(v)	((v) & IEEE80211_RATE_VAL)
456 	struct ieee80211vap *vap = ni->ni_vap;
457 	struct ieee80211com *ic = ni->ni_ic;
458 	int i, j, rix, error;
459 	int okrate, badrate, fixedrate, ucastrate;
460 	const struct ieee80211_rateset *srs;
461 	uint8_t r;
462 
463 	error = 0;
464 	okrate = badrate = 0;
465 	ucastrate = vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)].ucastrate;
466 	if (ucastrate != IEEE80211_FIXED_RATE_NONE) {
467 		/*
468 		 * Workaround awkwardness with fixed rate.  We are called
469 		 * to check both the legacy rate set and the HT rate set
470 		 * but we must apply any legacy fixed rate check only to the
471 		 * legacy rate set and vice versa.  We cannot tell what type
472 		 * of rate set we've been given (legacy or HT) but we can
473 		 * distinguish the fixed rate type (MCS have 0x80 set).
474 		 * So to deal with this the caller communicates whether to
475 		 * check MCS or legacy rate using the flags and we use the
476 		 * type of any fixed rate to avoid applying an MCS to a
477 		 * legacy rate and vice versa.
478 		 */
479 		if (ucastrate & 0x80) {
480 			if (flags & IEEE80211_F_DOFRATE)
481 				flags &= ~IEEE80211_F_DOFRATE;
482 		} else if ((ucastrate & 0x80) == 0) {
483 			if (flags & IEEE80211_F_DOFMCS)
484 				flags &= ~IEEE80211_F_DOFMCS;
485 		}
486 		/* NB: required to make MCS match below work */
487 		ucastrate &= IEEE80211_RATE_VAL;
488 	}
489 	fixedrate = IEEE80211_FIXED_RATE_NONE;
490 	/*
491 	 * XXX we are called to process both MCS and legacy rates;
492 	 * we must use the appropriate basic rate set or chaos will
493 	 * ensue; for now callers that want MCS must supply
494 	 * IEEE80211_F_DOBRS; at some point we'll need to split this
495 	 * function so there are two variants, one for MCS and one
496 	 * for legacy rates.
497 	 */
498 	if (flags & IEEE80211_F_DOBRS)
499 		srs = (const struct ieee80211_rateset *)
500 		    ieee80211_get_suphtrates(ic, ni->ni_chan);
501 	else
502 		srs = ieee80211_get_suprates(ic, ni->ni_chan);
503 	for (i = 0; i < nrs->rs_nrates; ) {
504 		if (flags & IEEE80211_F_DOSORT) {
505 			/*
506 			 * Sort rates.
507 			 */
508 			for (j = i + 1; j < nrs->rs_nrates; j++) {
509 				if (RV(nrs->rs_rates[i]) > RV(nrs->rs_rates[j])) {
510 					r = nrs->rs_rates[i];
511 					nrs->rs_rates[i] = nrs->rs_rates[j];
512 					nrs->rs_rates[j] = r;
513 				}
514 			}
515 		}
516 		r = nrs->rs_rates[i] & IEEE80211_RATE_VAL;
517 		badrate = r;
518 		/*
519 		 * Check for fixed rate.
520 		 */
521 		if (r == ucastrate)
522 			fixedrate = r;
523 		/*
524 		 * Check against supported rates.
525 		 */
526 		rix = findrix(srs, r);
527 		if (flags & IEEE80211_F_DONEGO) {
528 			if (rix < 0) {
529 				/*
530 				 * A rate in the node's rate set is not
531 				 * supported.  If this is a basic rate and we
532 				 * are operating as a STA then this is an error.
533 				 * Otherwise we just discard/ignore the rate.
534 				 */
535 				if ((flags & IEEE80211_F_JOIN) &&
536 				    (nrs->rs_rates[i] & IEEE80211_RATE_BASIC))
537 					error++;
538 			} else if ((flags & IEEE80211_F_JOIN) == 0) {
539 				/*
540 				 * Overwrite with the supported rate
541 				 * value so any basic rate bit is set.
542 				 */
543 				nrs->rs_rates[i] = srs->rs_rates[rix];
544 			}
545 		}
546 		if ((flags & IEEE80211_F_DODEL) && rix < 0) {
547 			/*
548 			 * Delete unacceptable rates.
549 			 */
550 			nrs->rs_nrates--;
551 			for (j = i; j < nrs->rs_nrates; j++)
552 				nrs->rs_rates[j] = nrs->rs_rates[j + 1];
553 			nrs->rs_rates[j] = 0;
554 			continue;
555 		}
556 		if (rix >= 0)
557 			okrate = nrs->rs_rates[i];
558 		i++;
559 	}
560 	if (okrate == 0 || error != 0 ||
561 	    ((flags & (IEEE80211_F_DOFRATE|IEEE80211_F_DOFMCS)) &&
562 	     fixedrate != ucastrate)) {
563 		IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE | IEEE80211_MSG_11N, ni,
564 		    "%s: flags 0x%x okrate %d error %d fixedrate 0x%x "
565 		    "ucastrate %x\n", __func__, fixedrate, ucastrate, flags);
566 		return badrate | IEEE80211_RATE_BASIC;
567 	} else
568 		return RV(okrate);
569 #undef RV
570 }
571 
572 /*
573  * Reset 11g-related state.
574  */
575 void
576 ieee80211_reset_erp(struct ieee80211com *ic)
577 {
578 	ic->ic_flags &= ~IEEE80211_F_USEPROT;
579 	ic->ic_nonerpsta = 0;
580 	ic->ic_longslotsta = 0;
581 	/*
582 	 * Short slot time is enabled only when operating in 11g
583 	 * and not in an IBSS.  We must also honor whether or not
584 	 * the driver is capable of doing it.
585 	 */
586 	ieee80211_set_shortslottime(ic,
587 		IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
588 		IEEE80211_IS_CHAN_HT(ic->ic_curchan) ||
589 		(IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
590 		ic->ic_opmode == IEEE80211_M_HOSTAP &&
591 		(ic->ic_caps & IEEE80211_C_SHSLOT)));
592 	/*
593 	 * Set short preamble and ERP barker-preamble flags.
594 	 */
595 	if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
596 	    (ic->ic_caps & IEEE80211_C_SHPREAMBLE)) {
597 		ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
598 		ic->ic_flags &= ~IEEE80211_F_USEBARKER;
599 	} else {
600 		ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
601 		ic->ic_flags |= IEEE80211_F_USEBARKER;
602 	}
603 }
604 
605 /*
606  * Set the short slot time state and notify the driver.
607  */
608 void
609 ieee80211_set_shortslottime(struct ieee80211com *ic, int onoff)
610 {
611 	if (onoff)
612 		ic->ic_flags |= IEEE80211_F_SHSLOT;
613 	else
614 		ic->ic_flags &= ~IEEE80211_F_SHSLOT;
615 	/* notify driver */
616 	if (ic->ic_updateslot != NULL)
617 		ic->ic_updateslot(ic->ic_ifp);
618 }
619 
620 /*
621  * Check if the specified rate set supports ERP.
622  * NB: the rate set is assumed to be sorted.
623  */
624 int
625 ieee80211_iserp_rateset(const struct ieee80211_rateset *rs)
626 {
627 #define N(a)	(sizeof(a) / sizeof(a[0]))
628 	static const int rates[] = { 2, 4, 11, 22, 12, 24, 48 };
629 	int i, j;
630 
631 	if (rs->rs_nrates < N(rates))
632 		return 0;
633 	for (i = 0; i < N(rates); i++) {
634 		for (j = 0; j < rs->rs_nrates; j++) {
635 			int r = rs->rs_rates[j] & IEEE80211_RATE_VAL;
636 			if (rates[i] == r)
637 				goto next;
638 			if (r > rates[i])
639 				return 0;
640 		}
641 		return 0;
642 	next:
643 		;
644 	}
645 	return 1;
646 #undef N
647 }
648 
649 /*
650  * Mark the basic rates for the rate table based on the
651  * operating mode.  For real 11g we mark all the 11b rates
652  * and 6, 12, and 24 OFDM.  For 11b compatibility we mark only
653  * 11b rates.  There's also a pseudo 11a-mode used to mark only
654  * the basic OFDM rates.
655  */
656 static void
657 setbasicrates(struct ieee80211_rateset *rs,
658     enum ieee80211_phymode mode, int add)
659 {
660 	static const struct ieee80211_rateset basic[IEEE80211_MODE_MAX] = {
661 	    { .rs_nrates = 0 },		/* IEEE80211_MODE_AUTO */
662 	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_11A */
663 	    { 2, { 2, 4 } },		/* IEEE80211_MODE_11B */
664 	    { 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_11G (mixed b/g) */
665 	    { .rs_nrates = 0 },		/* IEEE80211_MODE_FH */
666 	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_TURBO_A */
667 	    { 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_TURBO_G (mixed b/g) */
668 	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_STURBO_A */
669 	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_11NA */
670 	    { 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_11NG (mixed b/g) */
671 	};
672 	int i, j;
673 
674 	for (i = 0; i < rs->rs_nrates; i++) {
675 		if (!add)
676 			rs->rs_rates[i] &= IEEE80211_RATE_VAL;
677 		for (j = 0; j < basic[mode].rs_nrates; j++)
678 			if (basic[mode].rs_rates[j] == rs->rs_rates[i]) {
679 				rs->rs_rates[i] |= IEEE80211_RATE_BASIC;
680 				break;
681 			}
682 	}
683 }
684 
685 /*
686  * Set the basic rates in a rate set.
687  */
688 void
689 ieee80211_setbasicrates(struct ieee80211_rateset *rs,
690     enum ieee80211_phymode mode)
691 {
692 	setbasicrates(rs, mode, 0);
693 }
694 
695 /*
696  * Add basic rates to a rate set.
697  */
698 void
699 ieee80211_addbasicrates(struct ieee80211_rateset *rs,
700     enum ieee80211_phymode mode)
701 {
702 	setbasicrates(rs, mode, 1);
703 }
704 
705 /*
706  * WME protocol support.
707  *
708  * The default 11a/b/g/n parameters come from the WiFi Alliance WMM
709  * System Interopability Test Plan (v1.4, Appendix F) and the 802.11n
710  * Draft 2.0 Test Plan (Appendix D).
711  *
712  * Static/Dynamic Turbo mode settings come from Atheros.
713  */
714 typedef struct phyParamType {
715 	uint8_t		aifsn;
716 	uint8_t		logcwmin;
717 	uint8_t		logcwmax;
718 	uint16_t	txopLimit;
719 	uint8_t 	acm;
720 } paramType;
721 
722 static const struct phyParamType phyParamForAC_BE[IEEE80211_MODE_MAX] = {
723 	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_AUTO */
724 	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11A */
725 	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11B */
726 	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11G */
727 	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_FH */
728 	{ 2, 3,  5,  0, 0 },	/* IEEE80211_MODE_TURBO_A */
729 	{ 2, 3,  5,  0, 0 },	/* IEEE80211_MODE_TURBO_G */
730 	{ 2, 3,  5,  0, 0 },	/* IEEE80211_MODE_STURBO_A */
731 	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11NA */
732 	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11NG */
733 };
734 static const struct phyParamType phyParamForAC_BK[IEEE80211_MODE_MAX] = {
735 	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_AUTO */
736 	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11A */
737 	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11B */
738 	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11G */
739 	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_FH */
740 	{ 7, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_A */
741 	{ 7, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_G */
742 	{ 7, 3, 10,  0, 0 },	/* IEEE80211_MODE_STURBO_A */
743 	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NA */
744 	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NG */
745 };
746 static const struct phyParamType phyParamForAC_VI[IEEE80211_MODE_MAX] = {
747 	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_AUTO */
748 	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11A */
749 	{ 1, 3, 4, 188, 0 },	/* IEEE80211_MODE_11B */
750 	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11G */
751 	{ 1, 3, 4, 188, 0 },	/* IEEE80211_MODE_FH */
752 	{ 1, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_A */
753 	{ 1, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_G */
754 	{ 1, 2, 3,  94, 0 },	/* IEEE80211_MODE_STURBO_A */
755 	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NA */
756 	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NG */
757 };
758 static const struct phyParamType phyParamForAC_VO[IEEE80211_MODE_MAX] = {
759 	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_AUTO */
760 	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11A */
761 	{ 1, 2, 3, 102, 0 },	/* IEEE80211_MODE_11B */
762 	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11G */
763 	{ 1, 2, 3, 102, 0 },	/* IEEE80211_MODE_FH */
764 	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_A */
765 	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_G */
766 	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_STURBO_A */
767 	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NA */
768 	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NG */
769 };
770 
771 static const struct phyParamType bssPhyParamForAC_BE[IEEE80211_MODE_MAX] = {
772 	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_AUTO */
773 	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11A */
774 	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11B */
775 	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11G */
776 	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_FH */
777 	{ 2, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_A */
778 	{ 2, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_G */
779 	{ 2, 3, 10,  0, 0 },	/* IEEE80211_MODE_STURBO_A */
780 	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NA */
781 	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NG */
782 };
783 static const struct phyParamType bssPhyParamForAC_VI[IEEE80211_MODE_MAX] = {
784 	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_AUTO */
785 	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11A */
786 	{ 2, 3, 4, 188, 0 },	/* IEEE80211_MODE_11B */
787 	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11G */
788 	{ 2, 3, 4, 188, 0 },	/* IEEE80211_MODE_FH */
789 	{ 2, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_A */
790 	{ 2, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_G */
791 	{ 2, 2, 3,  94, 0 },	/* IEEE80211_MODE_STURBO_A */
792 	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NA */
793 	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NG */
794 };
795 static const struct phyParamType bssPhyParamForAC_VO[IEEE80211_MODE_MAX] = {
796 	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_AUTO */
797 	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11A */
798 	{ 2, 2, 3, 102, 0 },	/* IEEE80211_MODE_11B */
799 	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11G */
800 	{ 2, 2, 3, 102, 0 },	/* IEEE80211_MODE_FH */
801 	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_A */
802 	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_G */
803 	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_STURBO_A */
804 	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NA */
805 	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NG */
806 };
807 
808 static void
809 ieee80211_wme_initparams_locked(struct ieee80211vap *vap)
810 {
811 	struct ieee80211com *ic = vap->iv_ic;
812 	struct ieee80211_wme_state *wme = &ic->ic_wme;
813 	const paramType *pPhyParam, *pBssPhyParam;
814 	struct wmeParams *wmep;
815 	enum ieee80211_phymode mode;
816 	int i;
817 
818 	IEEE80211_LOCK_ASSERT(ic);
819 
820 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
821 		return;
822 
823 	/*
824 	 * Select mode; we can be called early in which case we
825 	 * always use auto mode.  We know we'll be called when
826 	 * entering the RUN state with bsschan setup properly
827 	 * so state will eventually get set correctly
828 	 */
829 	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
830 		mode = ieee80211_chan2mode(ic->ic_bsschan);
831 	else
832 		mode = IEEE80211_MODE_AUTO;
833 	for (i = 0; i < WME_NUM_AC; i++) {
834 		switch (i) {
835 		case WME_AC_BK:
836 			pPhyParam = &phyParamForAC_BK[mode];
837 			pBssPhyParam = &phyParamForAC_BK[mode];
838 			break;
839 		case WME_AC_VI:
840 			pPhyParam = &phyParamForAC_VI[mode];
841 			pBssPhyParam = &bssPhyParamForAC_VI[mode];
842 			break;
843 		case WME_AC_VO:
844 			pPhyParam = &phyParamForAC_VO[mode];
845 			pBssPhyParam = &bssPhyParamForAC_VO[mode];
846 			break;
847 		case WME_AC_BE:
848 		default:
849 			pPhyParam = &phyParamForAC_BE[mode];
850 			pBssPhyParam = &bssPhyParamForAC_BE[mode];
851 			break;
852 		}
853 
854 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
855 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
856 			wmep->wmep_acm = pPhyParam->acm;
857 			wmep->wmep_aifsn = pPhyParam->aifsn;
858 			wmep->wmep_logcwmin = pPhyParam->logcwmin;
859 			wmep->wmep_logcwmax = pPhyParam->logcwmax;
860 			wmep->wmep_txopLimit = pPhyParam->txopLimit;
861 		} else {
862 			wmep->wmep_acm = pBssPhyParam->acm;
863 			wmep->wmep_aifsn = pBssPhyParam->aifsn;
864 			wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
865 			wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
866 			wmep->wmep_txopLimit = pBssPhyParam->txopLimit;
867 
868 		}
869 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
870 			"%s: %s chan [acm %u aifsn %u log2(cwmin) %u "
871 			"log2(cwmax) %u txpoLimit %u]\n", __func__
872 			, ieee80211_wme_acnames[i]
873 			, wmep->wmep_acm
874 			, wmep->wmep_aifsn
875 			, wmep->wmep_logcwmin
876 			, wmep->wmep_logcwmax
877 			, wmep->wmep_txopLimit
878 		);
879 
880 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
881 		wmep->wmep_acm = pBssPhyParam->acm;
882 		wmep->wmep_aifsn = pBssPhyParam->aifsn;
883 		wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
884 		wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
885 		wmep->wmep_txopLimit = pBssPhyParam->txopLimit;
886 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
887 			"%s: %s  bss [acm %u aifsn %u log2(cwmin) %u "
888 			"log2(cwmax) %u txpoLimit %u]\n", __func__
889 			, ieee80211_wme_acnames[i]
890 			, wmep->wmep_acm
891 			, wmep->wmep_aifsn
892 			, wmep->wmep_logcwmin
893 			, wmep->wmep_logcwmax
894 			, wmep->wmep_txopLimit
895 		);
896 	}
897 	/* NB: check ic_bss to avoid NULL deref on initial attach */
898 	if (vap->iv_bss != NULL) {
899 		/*
900 		 * Calculate agressive mode switching threshold based
901 		 * on beacon interval.  This doesn't need locking since
902 		 * we're only called before entering the RUN state at
903 		 * which point we start sending beacon frames.
904 		 */
905 		wme->wme_hipri_switch_thresh =
906 			(HIGH_PRI_SWITCH_THRESH * vap->iv_bss->ni_intval) / 100;
907 		ieee80211_wme_updateparams(vap);
908 	}
909 }
910 
911 void
912 ieee80211_wme_initparams(struct ieee80211vap *vap)
913 {
914 	struct ieee80211com *ic = vap->iv_ic;
915 
916 	IEEE80211_LOCK(ic);
917 	ieee80211_wme_initparams_locked(vap);
918 	IEEE80211_UNLOCK(ic);
919 }
920 
921 /*
922  * Update WME parameters for ourself and the BSS.
923  */
924 void
925 ieee80211_wme_updateparams_locked(struct ieee80211vap *vap)
926 {
927 	static const paramType phyParam[IEEE80211_MODE_MAX] = {
928 		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_AUTO */
929 		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11A */
930 		{ 2, 5, 10, 64, 0 },	/* IEEE80211_MODE_11B */
931 		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11G */
932 		{ 2, 5, 10, 64, 0 },	/* IEEE80211_MODE_FH */
933 		{ 1, 3, 10, 64, 0 },	/* IEEE80211_MODE_TURBO_A */
934 		{ 1, 3, 10, 64, 0 },	/* IEEE80211_MODE_TURBO_G */
935 		{ 1, 3, 10, 64, 0 },	/* IEEE80211_MODE_STURBO_A */
936 		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11NA */ /*XXXcheck*/
937 		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11NG */ /*XXXcheck*/
938 	};
939 	struct ieee80211com *ic = vap->iv_ic;
940 	struct ieee80211_wme_state *wme = &ic->ic_wme;
941 	const struct wmeParams *wmep;
942 	struct wmeParams *chanp, *bssp;
943 	enum ieee80211_phymode mode;
944 	int i;
945 
946        	/* set up the channel access parameters for the physical device */
947 	for (i = 0; i < WME_NUM_AC; i++) {
948 		chanp = &wme->wme_chanParams.cap_wmeParams[i];
949 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
950 		chanp->wmep_aifsn = wmep->wmep_aifsn;
951 		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
952 		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
953 		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
954 
955 		chanp = &wme->wme_bssChanParams.cap_wmeParams[i];
956 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
957 		chanp->wmep_aifsn = wmep->wmep_aifsn;
958 		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
959 		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
960 		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
961 	}
962 
963 	/*
964 	 * Select mode; we can be called early in which case we
965 	 * always use auto mode.  We know we'll be called when
966 	 * entering the RUN state with bsschan setup properly
967 	 * so state will eventually get set correctly
968 	 */
969 	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
970 		mode = ieee80211_chan2mode(ic->ic_bsschan);
971 	else
972 		mode = IEEE80211_MODE_AUTO;
973 
974 	/*
975 	 * This implements agressive mode as found in certain
976 	 * vendors' AP's.  When there is significant high
977 	 * priority (VI/VO) traffic in the BSS throttle back BE
978 	 * traffic by using conservative parameters.  Otherwise
979 	 * BE uses agressive params to optimize performance of
980 	 * legacy/non-QoS traffic.
981 	 */
982         if ((vap->iv_opmode == IEEE80211_M_HOSTAP &&
983 	     (wme->wme_flags & WME_F_AGGRMODE) != 0) ||
984 	    (vap->iv_opmode == IEEE80211_M_STA &&
985 	     (vap->iv_bss->ni_flags & IEEE80211_NODE_QOS) == 0) ||
986 	    (vap->iv_flags & IEEE80211_F_WME) == 0) {
987 		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
988 		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
989 
990 		chanp->wmep_aifsn = bssp->wmep_aifsn = phyParam[mode].aifsn;
991 		chanp->wmep_logcwmin = bssp->wmep_logcwmin =
992 			phyParam[mode].logcwmin;
993 		chanp->wmep_logcwmax = bssp->wmep_logcwmax =
994 			phyParam[mode].logcwmax;
995 		chanp->wmep_txopLimit = bssp->wmep_txopLimit =
996 			(vap->iv_flags & IEEE80211_F_BURST) ?
997 				phyParam[mode].txopLimit : 0;
998 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
999 			"%s: %s [acm %u aifsn %u log2(cwmin) %u "
1000 			"log2(cwmax) %u txpoLimit %u]\n", __func__
1001 			, ieee80211_wme_acnames[WME_AC_BE]
1002 			, chanp->wmep_acm
1003 			, chanp->wmep_aifsn
1004 			, chanp->wmep_logcwmin
1005 			, chanp->wmep_logcwmax
1006 			, chanp->wmep_txopLimit
1007 		);
1008 	}
1009 
1010 	/* XXX multi-bss */
1011 	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1012 	    ic->ic_sta_assoc < 2 && (wme->wme_flags & WME_F_AGGRMODE) != 0) {
1013         	static const uint8_t logCwMin[IEEE80211_MODE_MAX] = {
1014               		3,	/* IEEE80211_MODE_AUTO */
1015               		3,	/* IEEE80211_MODE_11A */
1016               		4,	/* IEEE80211_MODE_11B */
1017               		3,	/* IEEE80211_MODE_11G */
1018               		4,	/* IEEE80211_MODE_FH */
1019               		3,	/* IEEE80211_MODE_TURBO_A */
1020               		3,	/* IEEE80211_MODE_TURBO_G */
1021               		3,	/* IEEE80211_MODE_STURBO_A */
1022               		3,	/* IEEE80211_MODE_11NA */
1023               		3,	/* IEEE80211_MODE_11NG */
1024 		};
1025 		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
1026 		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
1027 
1028 		chanp->wmep_logcwmin = bssp->wmep_logcwmin = logCwMin[mode];
1029 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1030 			"%s: %s log2(cwmin) %u\n", __func__
1031 			, ieee80211_wme_acnames[WME_AC_BE]
1032 			, chanp->wmep_logcwmin
1033 		);
1034     	}
1035 	if (vap->iv_opmode == IEEE80211_M_HOSTAP) {	/* XXX ibss? */
1036 		/*
1037 		 * Arrange for a beacon update and bump the parameter
1038 		 * set number so associated stations load the new values.
1039 		 */
1040 		wme->wme_bssChanParams.cap_info =
1041 			(wme->wme_bssChanParams.cap_info+1) & WME_QOSINFO_COUNT;
1042 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_WME);
1043 	}
1044 
1045 	wme->wme_update(ic);
1046 
1047 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1048 		"%s: WME params updated, cap_info 0x%x\n", __func__,
1049 		vap->iv_opmode == IEEE80211_M_STA ?
1050 			wme->wme_wmeChanParams.cap_info :
1051 			wme->wme_bssChanParams.cap_info);
1052 }
1053 
1054 void
1055 ieee80211_wme_updateparams(struct ieee80211vap *vap)
1056 {
1057 	struct ieee80211com *ic = vap->iv_ic;
1058 
1059 	if (ic->ic_caps & IEEE80211_C_WME) {
1060 		IEEE80211_LOCK(ic);
1061 		ieee80211_wme_updateparams_locked(vap);
1062 		IEEE80211_UNLOCK(ic);
1063 	}
1064 }
1065 
1066 static void
1067 parent_updown(void *arg, int npending)
1068 {
1069 	struct ifnet *parent = arg;
1070 
1071 	parent->if_ioctl(parent, SIOCSIFFLAGS, NULL);
1072 }
1073 
1074 /*
1075  * Start a vap running.  If this is the first vap to be
1076  * set running on the underlying device then we
1077  * automatically bring the device up.
1078  */
1079 void
1080 ieee80211_start_locked(struct ieee80211vap *vap)
1081 {
1082 	struct ifnet *ifp = vap->iv_ifp;
1083 	struct ieee80211com *ic = vap->iv_ic;
1084 	struct ifnet *parent = ic->ic_ifp;
1085 
1086 	IEEE80211_LOCK_ASSERT(ic);
1087 
1088 	IEEE80211_DPRINTF(vap,
1089 		IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1090 		"start running, %d vaps running\n", ic->ic_nrunning);
1091 
1092 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1093 		/*
1094 		 * Mark us running.  Note that it's ok to do this first;
1095 		 * if we need to bring the parent device up we defer that
1096 		 * to avoid dropping the com lock.  We expect the device
1097 		 * to respond to being marked up by calling back into us
1098 		 * through ieee80211_start_all at which point we'll come
1099 		 * back in here and complete the work.
1100 		 */
1101 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1102 		/*
1103 		 * We are not running; if this we are the first vap
1104 		 * to be brought up auto-up the parent if necessary.
1105 		 */
1106 		if (ic->ic_nrunning++ == 0 &&
1107 		    (parent->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1108 			IEEE80211_DPRINTF(vap,
1109 			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1110 			    "%s: up parent %s\n", __func__, parent->if_xname);
1111 			parent->if_flags |= IFF_UP;
1112 			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1113 			return;
1114 		}
1115 	}
1116 	/*
1117 	 * If the parent is up and running, then kick the
1118 	 * 802.11 state machine as appropriate.
1119 	 */
1120 	if ((parent->if_drv_flags & IFF_DRV_RUNNING) &&
1121 	    vap->iv_roaming != IEEE80211_ROAMING_MANUAL) {
1122 		if (vap->iv_opmode == IEEE80211_M_STA) {
1123 #if 0
1124 			/* XXX bypasses scan too easily; disable for now */
1125 			/*
1126 			 * Try to be intelligent about clocking the state
1127 			 * machine.  If we're currently in RUN state then
1128 			 * we should be able to apply any new state/parameters
1129 			 * simply by re-associating.  Otherwise we need to
1130 			 * re-scan to select an appropriate ap.
1131 			 */
1132 			if (vap->iv_state >= IEEE80211_S_RUN)
1133 				ieee80211_new_state_locked(vap,
1134 				    IEEE80211_S_ASSOC, 1);
1135 			else
1136 #endif
1137 				ieee80211_new_state_locked(vap,
1138 				    IEEE80211_S_SCAN, 0);
1139 		} else {
1140 			/*
1141 			 * For monitor+wds mode there's nothing to do but
1142 			 * start running.  Otherwise if this is the first
1143 			 * vap to be brought up, start a scan which may be
1144 			 * preempted if the station is locked to a particular
1145 			 * channel.
1146 			 */
1147 			/* XXX needed? */
1148 			ieee80211_new_state_locked(vap, IEEE80211_S_INIT, 0);
1149 			if (vap->iv_opmode == IEEE80211_M_MONITOR ||
1150 			    vap->iv_opmode == IEEE80211_M_WDS)
1151 				ieee80211_new_state_locked(vap,
1152 				    IEEE80211_S_RUN, -1);
1153 			else
1154 				ieee80211_new_state_locked(vap,
1155 				    IEEE80211_S_SCAN, 0);
1156 		}
1157 	}
1158 }
1159 
1160 /*
1161  * Start a single vap.
1162  */
1163 void
1164 ieee80211_init(void *arg)
1165 {
1166 	struct ieee80211vap *vap = arg;
1167 
1168 	/*
1169 	 * This routine is publicly accessible through the vap's
1170 	 * if_init method so guard against calls during detach.
1171 	 * ieee80211_vap_detach null's the backpointer before
1172 	 * tearing down state to signal any callback should be
1173 	 * rejected/ignored.
1174 	 */
1175 	if (vap != NULL) {
1176 		IEEE80211_DPRINTF(vap,
1177 		    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1178 		    "%s\n", __func__);
1179 
1180 		IEEE80211_LOCK(vap->iv_ic);
1181 		ieee80211_start_locked(vap);
1182 		IEEE80211_UNLOCK(vap->iv_ic);
1183 	}
1184 }
1185 
1186 /*
1187  * Start all runnable vap's on a device.
1188  */
1189 void
1190 ieee80211_start_all(struct ieee80211com *ic)
1191 {
1192 	struct ieee80211vap *vap;
1193 
1194 	IEEE80211_LOCK(ic);
1195 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1196 		struct ifnet *ifp = vap->iv_ifp;
1197 		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1198 			ieee80211_start_locked(vap);
1199 	}
1200 	IEEE80211_UNLOCK(ic);
1201 }
1202 
1203 /*
1204  * Stop a vap.  We force it down using the state machine
1205  * then mark it's ifnet not running.  If this is the last
1206  * vap running on the underlying device then we close it
1207  * too to insure it will be properly initialized when the
1208  * next vap is brought up.
1209  */
1210 void
1211 ieee80211_stop_locked(struct ieee80211vap *vap)
1212 {
1213 	struct ieee80211com *ic = vap->iv_ic;
1214 	struct ifnet *ifp = vap->iv_ifp;
1215 	struct ifnet *parent = ic->ic_ifp;
1216 
1217 	IEEE80211_LOCK_ASSERT(ic);
1218 
1219 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1220 	    "stop running, %d vaps running\n", ic->ic_nrunning);
1221 
1222 	ieee80211_new_state_locked(vap, IEEE80211_S_INIT, -1);
1223 	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1224 		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;	/* mark us stopped */
1225 		if (--ic->ic_nrunning == 0 &&
1226 		    (parent->if_drv_flags & IFF_DRV_RUNNING)) {
1227 			IEEE80211_DPRINTF(vap,
1228 			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1229 			    "down parent %s\n", parent->if_xname);
1230 			parent->if_flags &= ~IFF_UP;
1231 			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1232 		}
1233 	}
1234 }
1235 
1236 void
1237 ieee80211_stop(struct ieee80211vap *vap)
1238 {
1239 	struct ieee80211com *ic = vap->iv_ic;
1240 
1241 	IEEE80211_LOCK(ic);
1242 	ieee80211_stop_locked(vap);
1243 	IEEE80211_UNLOCK(ic);
1244 }
1245 
1246 /*
1247  * Stop all vap's running on a device.
1248  */
1249 void
1250 ieee80211_stop_all(struct ieee80211com *ic)
1251 {
1252 	struct ieee80211vap *vap;
1253 
1254 	IEEE80211_LOCK(ic);
1255 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1256 		struct ifnet *ifp = vap->iv_ifp;
1257 		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1258 			ieee80211_stop_locked(vap);
1259 	}
1260 	IEEE80211_UNLOCK(ic);
1261 }
1262 
1263 /*
1264  * Switch between turbo and non-turbo operating modes.
1265  * Use the specified channel flags to locate the new
1266  * channel, update 802.11 state, and then call back into
1267  * the driver to effect the change.
1268  */
1269 void
1270 ieee80211_dturbo_switch(struct ieee80211vap *vap, int newflags)
1271 {
1272 	struct ieee80211com *ic = vap->iv_ic;
1273 	struct ieee80211_channel *chan;
1274 
1275 	chan = ieee80211_find_channel(ic, ic->ic_bsschan->ic_freq, newflags);
1276 	if (chan == NULL) {		/* XXX should not happen */
1277 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1278 		    "%s: no channel with freq %u flags 0x%x\n",
1279 		    __func__, ic->ic_bsschan->ic_freq, newflags);
1280 		return;
1281 	}
1282 
1283 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1284 	    "%s: %s -> %s (freq %u flags 0x%x)\n", __func__,
1285 	    ieee80211_phymode_name[ieee80211_chan2mode(ic->ic_bsschan)],
1286 	    ieee80211_phymode_name[ieee80211_chan2mode(chan)],
1287 	    chan->ic_freq, chan->ic_flags);
1288 
1289 	ic->ic_bsschan = chan;
1290 	ic->ic_prevchan = ic->ic_curchan;
1291 	ic->ic_curchan = chan;
1292 	ic->ic_set_channel(ic);
1293 	/* NB: do not need to reset ERP state 'cuz we're in sta mode */
1294 }
1295 
1296 void
1297 ieee80211_beacon_miss(struct ieee80211com *ic)
1298 {
1299 	struct ieee80211vap *vap;
1300 
1301 	if (ic->ic_flags & IEEE80211_F_SCAN)
1302 		return;
1303 	/* XXX locking */
1304 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1305 		/*
1306 		 * We only pass events through for sta vap's in RUN state;
1307 		 * may be too restrictive but for now this saves all the
1308 		 * handlers duplicating these checks.
1309 		 */
1310 		if (vap->iv_opmode == IEEE80211_M_STA &&
1311 		    vap->iv_state == IEEE80211_S_RUN &&
1312 		    vap->iv_bmiss != NULL)
1313 			vap->iv_bmiss(vap);
1314 	}
1315 }
1316 
1317 /*
1318  * Software beacon miss handling.  Check if any beacons
1319  * were received in the last period.  If not post a
1320  * beacon miss; otherwise reset the counter.
1321  */
1322 void
1323 ieee80211_swbmiss(void *arg)
1324 {
1325 	struct ieee80211vap *vap = arg;
1326 
1327 	if (vap->iv_swbmiss_count == 0) {
1328 		if (vap->iv_bmiss != NULL)
1329 			vap->iv_bmiss(vap);
1330 		if (vap->iv_bmiss_count == 0)	/* don't re-arm timer */
1331 			return;
1332 	} else
1333 		vap->iv_swbmiss_count = 0;
1334 	callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
1335 		ieee80211_swbmiss, vap);
1336 }
1337 
1338 /*
1339  * Start an 802.11h channel switch.  We record the parameters,
1340  * mark the operation pending, notify each vap through the
1341  * beacon update mechanism so it can update the beacon frame
1342  * contents, and then switch vap's to CSA state to block outbound
1343  * traffic.  Devices that handle CSA directly can use the state
1344  * switch to do the right thing so long as they call
1345  * ieee80211_csa_completeswitch when it's time to complete the
1346  * channel change.  Devices that depend on the net80211 layer can
1347  * use ieee80211_beacon_update to handle the countdown and the
1348  * channel switch.
1349  */
1350 void
1351 ieee80211_csa_startswitch(struct ieee80211com *ic,
1352 	struct ieee80211_channel *c, int mode, int count)
1353 {
1354 	struct ieee80211vap *vap;
1355 
1356 	IEEE80211_LOCK_ASSERT(ic);
1357 
1358 	ic->ic_csa_newchan = c;
1359 	ic->ic_csa_count = count;
1360 	/* XXX record mode? */
1361 	ic->ic_flags |= IEEE80211_F_CSAPENDING;
1362 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1363 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1364 		    vap->iv_opmode == IEEE80211_M_IBSS)
1365 			ieee80211_beacon_notify(vap, IEEE80211_BEACON_CSA);
1366 		/* switch to CSA state to block outbound traffic */
1367 		if (vap->iv_state == IEEE80211_S_RUN)
1368 			ieee80211_new_state_locked(vap, IEEE80211_S_CSA, 0);
1369 	}
1370 	ieee80211_notify_csa(ic, c, mode, count);
1371 }
1372 
1373 /*
1374  * Complete an 802.11h channel switch started by ieee80211_csa_startswitch.
1375  * We clear state and move all vap's in CSA state to RUN state
1376  * so they can again transmit.
1377  */
1378 void
1379 ieee80211_csa_completeswitch(struct ieee80211com *ic)
1380 {
1381 	struct ieee80211vap *vap;
1382 
1383 	IEEE80211_LOCK_ASSERT(ic);
1384 
1385 	KASSERT(ic->ic_flags & IEEE80211_F_CSAPENDING, ("csa not pending"));
1386 
1387 	ieee80211_setcurchan(ic, ic->ic_csa_newchan);
1388 	ic->ic_csa_newchan = NULL;
1389 	ic->ic_flags &= ~IEEE80211_F_CSAPENDING;
1390 
1391 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1392 		if (vap->iv_state == IEEE80211_S_CSA)
1393 			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1394 }
1395 
1396 /*
1397  * Complete a DFS CAC started by ieee80211_dfs_cac_start.
1398  * We clear state and move all vap's in CAC state to RUN state.
1399  */
1400 void
1401 ieee80211_cac_completeswitch(struct ieee80211vap *vap0)
1402 {
1403 	struct ieee80211com *ic = vap0->iv_ic;
1404 	struct ieee80211vap *vap;
1405 
1406 	IEEE80211_LOCK(ic);
1407 	/*
1408 	 * Complete CAC state change for lead vap first; then
1409 	 * clock all the other vap's waiting.
1410 	 */
1411 	KASSERT(vap0->iv_state == IEEE80211_S_CAC,
1412 	    ("wrong state %d", vap0->iv_state));
1413 	ieee80211_new_state_locked(vap0, IEEE80211_S_RUN, 0);
1414 
1415 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1416 		if (vap->iv_state == IEEE80211_S_CAC)
1417 			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1418 	IEEE80211_UNLOCK(ic);
1419 }
1420 
1421 /*
1422  * Force all vap's other than the specified vap to the INIT state
1423  * and mark them as waiting for a scan to complete.  These vaps
1424  * will be brought up when the scan completes and the scanning vap
1425  * reaches RUN state by wakeupwaiting.
1426  * XXX if we do this in threads we can use sleep/wakeup.
1427  */
1428 static void
1429 markwaiting(struct ieee80211vap *vap0)
1430 {
1431 	struct ieee80211com *ic = vap0->iv_ic;
1432 	struct ieee80211vap *vap;
1433 
1434 	IEEE80211_LOCK_ASSERT(ic);
1435 
1436 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1437 		if (vap == vap0)
1438 			continue;
1439 		if (vap->iv_state != IEEE80211_S_INIT) {
1440 			vap->iv_newstate(vap, IEEE80211_S_INIT, 0);
1441 			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1442 		}
1443 	}
1444 }
1445 
1446 /*
1447  * Wakeup all vap's waiting for a scan to complete.  This is the
1448  * companion to markwaiting (above) and is used to coordinate
1449  * multiple vaps scanning.
1450  */
1451 static void
1452 wakeupwaiting(struct ieee80211vap *vap0)
1453 {
1454 	struct ieee80211com *ic = vap0->iv_ic;
1455 	struct ieee80211vap *vap;
1456 
1457 	IEEE80211_LOCK_ASSERT(ic);
1458 
1459 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1460 		if (vap == vap0)
1461 			continue;
1462 		if (vap->iv_flags_ext & IEEE80211_FEXT_SCANWAIT) {
1463 			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1464 			/* NB: sta's cannot go INIT->RUN */
1465 			vap->iv_newstate(vap,
1466 			    vap->iv_opmode == IEEE80211_M_STA ?
1467 			        IEEE80211_S_SCAN : IEEE80211_S_RUN, 0);
1468 		}
1469 	}
1470 }
1471 
1472 /*
1473  * Handle post state change work common to all operating modes.
1474  */
1475 static void
1476 ieee80211_newstate_cb(struct ieee80211vap *vap,
1477 	enum ieee80211_state nstate, int arg)
1478 {
1479 	struct ieee80211com *ic = vap->iv_ic;
1480 
1481 	IEEE80211_LOCK_ASSERT(ic);
1482 
1483 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1484 	    "%s: %s arg %d\n", __func__, ieee80211_state_name[nstate], arg);
1485 
1486 	if (nstate == IEEE80211_S_RUN) {
1487 		/*
1488 		 * OACTIVE may be set on the vap if the upper layer
1489 		 * tried to transmit (e.g. IPv6 NDP) before we reach
1490 		 * RUN state.  Clear it and restart xmit.
1491 		 *
1492 		 * Note this can also happen as a result of SLEEP->RUN
1493 		 * (i.e. coming out of power save mode).
1494 		 */
1495 		vap->iv_ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1496 		if_start(vap->iv_ifp);
1497 
1498 		/* bring up any vaps waiting on us */
1499 		wakeupwaiting(vap);
1500 	} else if (nstate == IEEE80211_S_INIT) {
1501 		/*
1502 		 * Flush the scan cache if we did the last scan (XXX?)
1503 		 * and flush any frames on send queues from this vap.
1504 		 * Note the mgt q is used only for legacy drivers and
1505 		 * will go away shortly.
1506 		 */
1507 		ieee80211_scan_flush(vap);
1508 
1509 		/* XXX NB: cast for altq */
1510 		ieee80211_flush_ifq((struct ifqueue *)&ic->ic_ifp->if_snd, vap);
1511 	}
1512 	vap->iv_newstate_cb = NULL;
1513 }
1514 
1515 /*
1516  * Public interface for initiating a state machine change.
1517  * This routine single-threads the request and coordinates
1518  * the scheduling of multiple vaps for the purpose of selecting
1519  * an operating channel.  Specifically the following scenarios
1520  * are handled:
1521  * o only one vap can be selecting a channel so on transition to
1522  *   SCAN state if another vap is already scanning then
1523  *   mark the caller for later processing and return without
1524  *   doing anything (XXX? expectations by caller of synchronous operation)
1525  * o only one vap can be doing CAC of a channel so on transition to
1526  *   CAC state if another vap is already scanning for radar then
1527  *   mark the caller for later processing and return without
1528  *   doing anything (XXX? expectations by caller of synchronous operation)
1529  * o if another vap is already running when a request is made
1530  *   to SCAN then an operating channel has been chosen; bypass
1531  *   the scan and just join the channel
1532  *
1533  * Note that the state change call is done through the iv_newstate
1534  * method pointer so any driver routine gets invoked.  The driver
1535  * will normally call back into operating mode-specific
1536  * ieee80211_newstate routines (below) unless it needs to completely
1537  * bypass the state machine (e.g. because the firmware has it's
1538  * own idea how things should work).  Bypassing the net80211 layer
1539  * is usually a mistake and indicates lack of proper integration
1540  * with the net80211 layer.
1541  */
1542 static int
1543 ieee80211_new_state_locked(struct ieee80211vap *vap,
1544 	enum ieee80211_state nstate, int arg)
1545 {
1546 	struct ieee80211com *ic = vap->iv_ic;
1547 	struct ieee80211vap *vp;
1548 	enum ieee80211_state ostate;
1549 	int nrunning, nscanning, rc;
1550 
1551 	IEEE80211_LOCK_ASSERT(ic);
1552 
1553 	nrunning = nscanning = 0;
1554 	/* XXX can track this state instead of calculating */
1555 	TAILQ_FOREACH(vp, &ic->ic_vaps, iv_next) {
1556 		if (vp != vap) {
1557 			if (vp->iv_state >= IEEE80211_S_RUN)
1558 				nrunning++;
1559 			/* XXX doesn't handle bg scan */
1560 			/* NB: CAC+AUTH+ASSOC treated like SCAN */
1561 			else if (vp->iv_state > IEEE80211_S_INIT)
1562 				nscanning++;
1563 		}
1564 	}
1565 	ostate = vap->iv_state;
1566 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1567 	    "%s: %s -> %s (nrunning %d nscanning %d)\n", __func__,
1568 	    ieee80211_state_name[ostate], ieee80211_state_name[nstate],
1569 	    nrunning, nscanning);
1570 	switch (nstate) {
1571 	case IEEE80211_S_SCAN:
1572 		if (ostate == IEEE80211_S_INIT) {
1573 			/*
1574 			 * INIT -> SCAN happens on initial bringup.
1575 			 */
1576 			KASSERT(!(nscanning && nrunning),
1577 			    ("%d scanning and %d running", nscanning, nrunning));
1578 			if (nscanning) {
1579 				/*
1580 				 * Someone is scanning, defer our state
1581 				 * change until the work has completed.
1582 				 */
1583 				IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1584 				    "%s: defer %s -> %s\n",
1585 				    __func__, ieee80211_state_name[ostate],
1586 				    ieee80211_state_name[nstate]);
1587 				vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1588 				rc = 0;
1589 				goto done;
1590 			}
1591 			if (nrunning) {
1592 				/*
1593 				 * Someone is operating; just join the channel
1594 				 * they have chosen.
1595 				 */
1596 				/* XXX kill arg? */
1597 				/* XXX check each opmode, adhoc? */
1598 				if (vap->iv_opmode == IEEE80211_M_STA)
1599 					nstate = IEEE80211_S_SCAN;
1600 				else
1601 					nstate = IEEE80211_S_RUN;
1602 #ifdef IEEE80211_DEBUG
1603 				if (nstate != IEEE80211_S_SCAN) {
1604 					IEEE80211_DPRINTF(vap,
1605 					    IEEE80211_MSG_STATE,
1606 					    "%s: override, now %s -> %s\n",
1607 					    __func__,
1608 					    ieee80211_state_name[ostate],
1609 					    ieee80211_state_name[nstate]);
1610 				}
1611 #endif
1612 			}
1613 		} else {
1614 			/*
1615 			 * SCAN was forced; e.g. on beacon miss.  Force
1616 			 * other running vap's to INIT state and mark
1617 			 * them as waiting for the scan to complete.  This
1618 			 * insures they don't interfere with our scanning.
1619 			 *
1620 			 * XXX not always right, assumes ap follows sta
1621 			 */
1622 			markwaiting(vap);
1623 		}
1624 		break;
1625 	case IEEE80211_S_RUN:
1626 		if (vap->iv_opmode == IEEE80211_M_WDS &&
1627 		    (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY) &&
1628 		    nscanning) {
1629 			/*
1630 			 * Legacy WDS with someone else scanning; don't
1631 			 * go online until that completes as we should
1632 			 * follow the other vap to the channel they choose.
1633 			 */
1634 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1635 			     "%s: defer %s -> %s (legacy WDS)\n", __func__,
1636 			     ieee80211_state_name[ostate],
1637 			     ieee80211_state_name[nstate]);
1638 			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1639 			rc = 0;
1640 			goto done;
1641 		}
1642 		if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1643 		    IEEE80211_IS_CHAN_DFS(ic->ic_bsschan) &&
1644 		    (vap->iv_flags_ext & IEEE80211_FEXT_DFS) &&
1645 		    !IEEE80211_IS_CHAN_CACDONE(ic->ic_bsschan)) {
1646 			/*
1647 			 * This is a DFS channel, transition to CAC state
1648 			 * instead of RUN.  This allows us to initiate
1649 			 * Channel Availability Check (CAC) as specified
1650 			 * by 11h/DFS.
1651 			 */
1652 			nstate = IEEE80211_S_CAC;
1653 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1654 			     "%s: override %s -> %s (DFS)\n", __func__,
1655 			     ieee80211_state_name[ostate],
1656 			     ieee80211_state_name[nstate]);
1657 		}
1658 		break;
1659 	case IEEE80211_S_INIT:
1660 		if (ostate == IEEE80211_S_INIT ) {
1661 			/* XXX don't believe this */
1662 			/* INIT -> INIT. nothing to do */
1663 			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1664 		}
1665 		/* fall thru... */
1666 	default:
1667 		break;
1668 	}
1669 	/* XXX on transition RUN->CAC do we need to set nstate = iv_state? */
1670 	if (ostate != nstate) {
1671 		/*
1672 		 * Arrange for work to happen after state change completes.
1673 		 * If this happens asynchronously the caller must arrange
1674 		 * for the com lock to be held.
1675 		 */
1676 		vap->iv_newstate_cb = ieee80211_newstate_cb;
1677 	}
1678 	rc = vap->iv_newstate(vap, nstate, arg);
1679 	if (rc == 0 && vap->iv_newstate_cb != NULL)
1680 		vap->iv_newstate_cb(vap, nstate, arg);
1681 done:
1682 	return rc;
1683 }
1684 
1685 int
1686 ieee80211_new_state(struct ieee80211vap *vap,
1687 	enum ieee80211_state nstate, int arg)
1688 {
1689 	struct ieee80211com *ic = vap->iv_ic;
1690 	int rc;
1691 
1692 	IEEE80211_LOCK(ic);
1693 	rc = ieee80211_new_state_locked(vap, nstate, arg);
1694 	IEEE80211_UNLOCK(ic);
1695 	return rc;
1696 }
1697