ieee80211_proto.c revision 188782
1/*-
2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_proto.c 188782 2009-02-19 05:21:54Z sam $");
29
30/*
31 * IEEE 802.11 protocol support.
32 */
33
34#include "opt_inet.h"
35#include "opt_wlan.h"
36
37#include <sys/param.h>
38#include <sys/kernel.h>
39#include <sys/systm.h>
40#include <sys/taskqueue.h>
41
42#include <sys/socket.h>
43#include <sys/sockio.h>
44
45#include <net/if.h>
46#include <net/if_media.h>
47#include <net/ethernet.h>		/* XXX for ether_sprintf */
48
49#include <net80211/ieee80211_var.h>
50#include <net80211/ieee80211_adhoc.h>
51#include <net80211/ieee80211_sta.h>
52#include <net80211/ieee80211_hostap.h>
53#include <net80211/ieee80211_wds.h>
54#include <net80211/ieee80211_monitor.h>
55#include <net80211/ieee80211_input.h>
56
57/* XXX tunables */
58#define	AGGRESSIVE_MODE_SWITCH_HYSTERESIS	3	/* pkts / 100ms */
59#define	HIGH_PRI_SWITCH_THRESH			10	/* pkts / 100ms */
60
61const char *ieee80211_mgt_subtype_name[] = {
62	"assoc_req",	"assoc_resp",	"reassoc_req",	"reassoc_resp",
63	"probe_req",	"probe_resp",	"reserved#6",	"reserved#7",
64	"beacon",	"atim",		"disassoc",	"auth",
65	"deauth",	"action",	"reserved#14",	"reserved#15"
66};
67const char *ieee80211_ctl_subtype_name[] = {
68	"reserved#0",	"reserved#1",	"reserved#2",	"reserved#3",
69	"reserved#3",	"reserved#5",	"reserved#6",	"reserved#7",
70	"reserved#8",	"reserved#9",	"ps_poll",	"rts",
71	"cts",		"ack",		"cf_end",	"cf_end_ack"
72};
73const char *ieee80211_opmode_name[IEEE80211_OPMODE_MAX] = {
74	"IBSS",		/* IEEE80211_M_IBSS */
75	"STA",		/* IEEE80211_M_STA */
76	"WDS",		/* IEEE80211_M_WDS */
77	"AHDEMO",	/* IEEE80211_M_AHDEMO */
78	"HOSTAP",	/* IEEE80211_M_HOSTAP */
79	"MONITOR"	/* IEEE80211_M_MONITOR */
80};
81const char *ieee80211_state_name[IEEE80211_S_MAX] = {
82	"INIT",		/* IEEE80211_S_INIT */
83	"SCAN",		/* IEEE80211_S_SCAN */
84	"AUTH",		/* IEEE80211_S_AUTH */
85	"ASSOC",	/* IEEE80211_S_ASSOC */
86	"CAC",		/* IEEE80211_S_CAC */
87	"RUN",		/* IEEE80211_S_RUN */
88	"CSA",		/* IEEE80211_S_CSA */
89	"SLEEP",	/* IEEE80211_S_SLEEP */
90};
91const char *ieee80211_wme_acnames[] = {
92	"WME_AC_BE",
93	"WME_AC_BK",
94	"WME_AC_VI",
95	"WME_AC_VO",
96	"WME_UPSD",
97};
98
99static void parent_updown(void *, int);
100static int ieee80211_new_state_locked(struct ieee80211vap *,
101	enum ieee80211_state, int);
102
103static int
104null_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
105	const struct ieee80211_bpf_params *params)
106{
107	struct ifnet *ifp = ni->ni_ic->ic_ifp;
108
109	if_printf(ifp, "missing ic_raw_xmit callback, drop frame\n");
110	m_freem(m);
111	return ENETDOWN;
112}
113
114void
115ieee80211_proto_attach(struct ieee80211com *ic)
116{
117	struct ifnet *ifp = ic->ic_ifp;
118
119	/* override the 802.3 setting */
120	ifp->if_hdrlen = ic->ic_headroom
121		+ sizeof(struct ieee80211_qosframe_addr4)
122		+ IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN
123		+ IEEE80211_WEP_EXTIVLEN;
124	/* XXX no way to recalculate on ifdetach */
125	if (ALIGN(ifp->if_hdrlen) > max_linkhdr) {
126		/* XXX sanity check... */
127		max_linkhdr = ALIGN(ifp->if_hdrlen);
128		max_hdr = max_linkhdr + max_protohdr;
129		max_datalen = MHLEN - max_hdr;
130	}
131	ic->ic_protmode = IEEE80211_PROT_CTSONLY;
132
133	TASK_INIT(&ic->ic_parent_task, 0, parent_updown, ifp);
134
135	ic->ic_wme.wme_hipri_switch_hysteresis =
136		AGGRESSIVE_MODE_SWITCH_HYSTERESIS;
137
138	/* initialize management frame handlers */
139	ic->ic_send_mgmt = ieee80211_send_mgmt;
140	ic->ic_raw_xmit = null_raw_xmit;
141
142	ieee80211_adhoc_attach(ic);
143	ieee80211_sta_attach(ic);
144	ieee80211_wds_attach(ic);
145	ieee80211_hostap_attach(ic);
146	ieee80211_monitor_attach(ic);
147}
148
149void
150ieee80211_proto_detach(struct ieee80211com *ic)
151{
152	ieee80211_monitor_detach(ic);
153	ieee80211_hostap_detach(ic);
154	ieee80211_wds_detach(ic);
155	ieee80211_adhoc_detach(ic);
156	ieee80211_sta_detach(ic);
157}
158
159static void
160null_update_beacon(struct ieee80211vap *vap, int item)
161{
162}
163
164void
165ieee80211_proto_vattach(struct ieee80211vap *vap)
166{
167	struct ieee80211com *ic = vap->iv_ic;
168	struct ifnet *ifp = vap->iv_ifp;
169	int i;
170
171	/* override the 802.3 setting */
172	ifp->if_hdrlen = ic->ic_ifp->if_hdrlen;
173
174	vap->iv_rtsthreshold = IEEE80211_RTS_DEFAULT;
175	vap->iv_fragthreshold = IEEE80211_FRAG_DEFAULT;
176	vap->iv_bmiss_max = IEEE80211_BMISS_MAX;
177	callout_init(&vap->iv_swbmiss, CALLOUT_MPSAFE);
178	callout_init(&vap->iv_mgtsend, CALLOUT_MPSAFE);
179	/*
180	 * Install default tx rate handling: no fixed rate, lowest
181	 * supported rate for mgmt and multicast frames.  Default
182	 * max retry count.  These settings can be changed by the
183	 * driver and/or user applications.
184	 */
185	for (i = IEEE80211_MODE_11A; i < IEEE80211_MODE_MAX; i++) {
186		const struct ieee80211_rateset *rs = &ic->ic_sup_rates[i];
187
188		vap->iv_txparms[i].ucastrate = IEEE80211_FIXED_RATE_NONE;
189		if (i == IEEE80211_MODE_11NA || i == IEEE80211_MODE_11NG) {
190			vap->iv_txparms[i].mgmtrate = 0 | IEEE80211_RATE_MCS;
191			vap->iv_txparms[i].mcastrate = 0 | IEEE80211_RATE_MCS;
192		} else {
193			vap->iv_txparms[i].mgmtrate =
194			    rs->rs_rates[0] & IEEE80211_RATE_VAL;
195			vap->iv_txparms[i].mcastrate =
196			    rs->rs_rates[0] & IEEE80211_RATE_VAL;
197		}
198		vap->iv_txparms[i].maxretry = IEEE80211_TXMAX_DEFAULT;
199	}
200	vap->iv_roaming = IEEE80211_ROAMING_AUTO;
201
202	vap->iv_update_beacon = null_update_beacon;
203	vap->iv_deliver_data = ieee80211_deliver_data;
204
205	/* attach support for operating mode */
206	ic->ic_vattach[vap->iv_opmode](vap);
207}
208
209void
210ieee80211_proto_vdetach(struct ieee80211vap *vap)
211{
212#define	FREEAPPIE(ie) do { \
213	if (ie != NULL) \
214		free(ie, M_80211_NODE_IE); \
215} while (0)
216	/*
217	 * Detach operating mode module.
218	 */
219	if (vap->iv_opdetach != NULL)
220		vap->iv_opdetach(vap);
221	/*
222	 * This should not be needed as we detach when reseting
223	 * the state but be conservative here since the
224	 * authenticator may do things like spawn kernel threads.
225	 */
226	if (vap->iv_auth->ia_detach != NULL)
227		vap->iv_auth->ia_detach(vap);
228	/*
229	 * Detach any ACL'ator.
230	 */
231	if (vap->iv_acl != NULL)
232		vap->iv_acl->iac_detach(vap);
233
234	FREEAPPIE(vap->iv_appie_beacon);
235	FREEAPPIE(vap->iv_appie_probereq);
236	FREEAPPIE(vap->iv_appie_proberesp);
237	FREEAPPIE(vap->iv_appie_assocreq);
238	FREEAPPIE(vap->iv_appie_assocresp);
239	FREEAPPIE(vap->iv_appie_wpa);
240#undef FREEAPPIE
241}
242
243/*
244 * Simple-minded authenticator module support.
245 */
246
247#define	IEEE80211_AUTH_MAX	(IEEE80211_AUTH_WPA+1)
248/* XXX well-known names */
249static const char *auth_modnames[IEEE80211_AUTH_MAX] = {
250	"wlan_internal",	/* IEEE80211_AUTH_NONE */
251	"wlan_internal",	/* IEEE80211_AUTH_OPEN */
252	"wlan_internal",	/* IEEE80211_AUTH_SHARED */
253	"wlan_xauth",		/* IEEE80211_AUTH_8021X	 */
254	"wlan_internal",	/* IEEE80211_AUTH_AUTO */
255	"wlan_xauth",		/* IEEE80211_AUTH_WPA */
256};
257static const struct ieee80211_authenticator *authenticators[IEEE80211_AUTH_MAX];
258
259static const struct ieee80211_authenticator auth_internal = {
260	.ia_name		= "wlan_internal",
261	.ia_attach		= NULL,
262	.ia_detach		= NULL,
263	.ia_node_join		= NULL,
264	.ia_node_leave		= NULL,
265};
266
267/*
268 * Setup internal authenticators once; they are never unregistered.
269 */
270static void
271ieee80211_auth_setup(void)
272{
273	ieee80211_authenticator_register(IEEE80211_AUTH_OPEN, &auth_internal);
274	ieee80211_authenticator_register(IEEE80211_AUTH_SHARED, &auth_internal);
275	ieee80211_authenticator_register(IEEE80211_AUTH_AUTO, &auth_internal);
276}
277SYSINIT(wlan_auth, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_auth_setup, NULL);
278
279const struct ieee80211_authenticator *
280ieee80211_authenticator_get(int auth)
281{
282	if (auth >= IEEE80211_AUTH_MAX)
283		return NULL;
284	if (authenticators[auth] == NULL)
285		ieee80211_load_module(auth_modnames[auth]);
286	return authenticators[auth];
287}
288
289void
290ieee80211_authenticator_register(int type,
291	const struct ieee80211_authenticator *auth)
292{
293	if (type >= IEEE80211_AUTH_MAX)
294		return;
295	authenticators[type] = auth;
296}
297
298void
299ieee80211_authenticator_unregister(int type)
300{
301
302	if (type >= IEEE80211_AUTH_MAX)
303		return;
304	authenticators[type] = NULL;
305}
306
307/*
308 * Very simple-minded ACL module support.
309 */
310/* XXX just one for now */
311static	const struct ieee80211_aclator *acl = NULL;
312
313void
314ieee80211_aclator_register(const struct ieee80211_aclator *iac)
315{
316	printf("wlan: %s acl policy registered\n", iac->iac_name);
317	acl = iac;
318}
319
320void
321ieee80211_aclator_unregister(const struct ieee80211_aclator *iac)
322{
323	if (acl == iac)
324		acl = NULL;
325	printf("wlan: %s acl policy unregistered\n", iac->iac_name);
326}
327
328const struct ieee80211_aclator *
329ieee80211_aclator_get(const char *name)
330{
331	if (acl == NULL)
332		ieee80211_load_module("wlan_acl");
333	return acl != NULL && strcmp(acl->iac_name, name) == 0 ? acl : NULL;
334}
335
336void
337ieee80211_print_essid(const uint8_t *essid, int len)
338{
339	const uint8_t *p;
340	int i;
341
342	if (len > IEEE80211_NWID_LEN)
343		len = IEEE80211_NWID_LEN;
344	/* determine printable or not */
345	for (i = 0, p = essid; i < len; i++, p++) {
346		if (*p < ' ' || *p > 0x7e)
347			break;
348	}
349	if (i == len) {
350		printf("\"");
351		for (i = 0, p = essid; i < len; i++, p++)
352			printf("%c", *p);
353		printf("\"");
354	} else {
355		printf("0x");
356		for (i = 0, p = essid; i < len; i++, p++)
357			printf("%02x", *p);
358	}
359}
360
361void
362ieee80211_dump_pkt(struct ieee80211com *ic,
363	const uint8_t *buf, int len, int rate, int rssi)
364{
365	const struct ieee80211_frame *wh;
366	int i;
367
368	wh = (const struct ieee80211_frame *)buf;
369	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
370	case IEEE80211_FC1_DIR_NODS:
371		printf("NODS %s", ether_sprintf(wh->i_addr2));
372		printf("->%s", ether_sprintf(wh->i_addr1));
373		printf("(%s)", ether_sprintf(wh->i_addr3));
374		break;
375	case IEEE80211_FC1_DIR_TODS:
376		printf("TODS %s", ether_sprintf(wh->i_addr2));
377		printf("->%s", ether_sprintf(wh->i_addr3));
378		printf("(%s)", ether_sprintf(wh->i_addr1));
379		break;
380	case IEEE80211_FC1_DIR_FROMDS:
381		printf("FRDS %s", ether_sprintf(wh->i_addr3));
382		printf("->%s", ether_sprintf(wh->i_addr1));
383		printf("(%s)", ether_sprintf(wh->i_addr2));
384		break;
385	case IEEE80211_FC1_DIR_DSTODS:
386		printf("DSDS %s", ether_sprintf((const uint8_t *)&wh[1]));
387		printf("->%s", ether_sprintf(wh->i_addr3));
388		printf("(%s", ether_sprintf(wh->i_addr2));
389		printf("->%s)", ether_sprintf(wh->i_addr1));
390		break;
391	}
392	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
393	case IEEE80211_FC0_TYPE_DATA:
394		printf(" data");
395		break;
396	case IEEE80211_FC0_TYPE_MGT:
397		printf(" %s", ieee80211_mgt_subtype_name[
398		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
399		    >> IEEE80211_FC0_SUBTYPE_SHIFT]);
400		break;
401	default:
402		printf(" type#%d", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
403		break;
404	}
405	if (IEEE80211_QOS_HAS_SEQ(wh)) {
406		const struct ieee80211_qosframe *qwh =
407			(const struct ieee80211_qosframe *)buf;
408		printf(" QoS [TID %u%s]", qwh->i_qos[0] & IEEE80211_QOS_TID,
409			qwh->i_qos[0] & IEEE80211_QOS_ACKPOLICY ? " ACM" : "");
410	}
411	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
412		int off;
413
414		off = ieee80211_anyhdrspace(ic, wh);
415		printf(" WEP [IV %.02x %.02x %.02x",
416			buf[off+0], buf[off+1], buf[off+2]);
417		if (buf[off+IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV)
418			printf(" %.02x %.02x %.02x",
419				buf[off+4], buf[off+5], buf[off+6]);
420		printf(" KID %u]", buf[off+IEEE80211_WEP_IVLEN] >> 6);
421	}
422	if (rate >= 0)
423		printf(" %dM", rate / 2);
424	if (rssi >= 0)
425		printf(" +%d", rssi);
426	printf("\n");
427	if (len > 0) {
428		for (i = 0; i < len; i++) {
429			if ((i & 1) == 0)
430				printf(" ");
431			printf("%02x", buf[i]);
432		}
433		printf("\n");
434	}
435}
436
437static __inline int
438findrix(const struct ieee80211_rateset *rs, int r)
439{
440	int i;
441
442	for (i = 0; i < rs->rs_nrates; i++)
443		if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == r)
444			return i;
445	return -1;
446}
447
448int
449ieee80211_fix_rate(struct ieee80211_node *ni,
450	struct ieee80211_rateset *nrs, int flags)
451{
452#define	RV(v)	((v) & IEEE80211_RATE_VAL)
453	struct ieee80211vap *vap = ni->ni_vap;
454	struct ieee80211com *ic = ni->ni_ic;
455	int i, j, rix, error;
456	int okrate, badrate, fixedrate, ucastrate;
457	const struct ieee80211_rateset *srs;
458	uint8_t r;
459
460	error = 0;
461	okrate = badrate = 0;
462	ucastrate = vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)].ucastrate;
463	if (ucastrate != IEEE80211_FIXED_RATE_NONE) {
464		/*
465		 * Workaround awkwardness with fixed rate.  We are called
466		 * to check both the legacy rate set and the HT rate set
467		 * but we must apply any legacy fixed rate check only to the
468		 * legacy rate set and vice versa.  We cannot tell what type
469		 * of rate set we've been given (legacy or HT) but we can
470		 * distinguish the fixed rate type (MCS have 0x80 set).
471		 * So to deal with this the caller communicates whether to
472		 * check MCS or legacy rate using the flags and we use the
473		 * type of any fixed rate to avoid applying an MCS to a
474		 * legacy rate and vice versa.
475		 */
476		if (ucastrate & 0x80) {
477			if (flags & IEEE80211_F_DOFRATE)
478				flags &= ~IEEE80211_F_DOFRATE;
479		} else if ((ucastrate & 0x80) == 0) {
480			if (flags & IEEE80211_F_DOFMCS)
481				flags &= ~IEEE80211_F_DOFMCS;
482		}
483		/* NB: required to make MCS match below work */
484		ucastrate &= IEEE80211_RATE_VAL;
485	}
486	fixedrate = IEEE80211_FIXED_RATE_NONE;
487	/*
488	 * XXX we are called to process both MCS and legacy rates;
489	 * we must use the appropriate basic rate set or chaos will
490	 * ensue; for now callers that want MCS must supply
491	 * IEEE80211_F_DOBRS; at some point we'll need to split this
492	 * function so there are two variants, one for MCS and one
493	 * for legacy rates.
494	 */
495	if (flags & IEEE80211_F_DOBRS)
496		srs = (const struct ieee80211_rateset *)
497		    ieee80211_get_suphtrates(ic, ni->ni_chan);
498	else
499		srs = ieee80211_get_suprates(ic, ni->ni_chan);
500	for (i = 0; i < nrs->rs_nrates; ) {
501		if (flags & IEEE80211_F_DOSORT) {
502			/*
503			 * Sort rates.
504			 */
505			for (j = i + 1; j < nrs->rs_nrates; j++) {
506				if (RV(nrs->rs_rates[i]) > RV(nrs->rs_rates[j])) {
507					r = nrs->rs_rates[i];
508					nrs->rs_rates[i] = nrs->rs_rates[j];
509					nrs->rs_rates[j] = r;
510				}
511			}
512		}
513		r = nrs->rs_rates[i] & IEEE80211_RATE_VAL;
514		badrate = r;
515		/*
516		 * Check for fixed rate.
517		 */
518		if (r == ucastrate)
519			fixedrate = r;
520		/*
521		 * Check against supported rates.
522		 */
523		rix = findrix(srs, r);
524		if (flags & IEEE80211_F_DONEGO) {
525			if (rix < 0) {
526				/*
527				 * A rate in the node's rate set is not
528				 * supported.  If this is a basic rate and we
529				 * are operating as a STA then this is an error.
530				 * Otherwise we just discard/ignore the rate.
531				 */
532				if ((flags & IEEE80211_F_JOIN) &&
533				    (nrs->rs_rates[i] & IEEE80211_RATE_BASIC))
534					error++;
535			} else if ((flags & IEEE80211_F_JOIN) == 0) {
536				/*
537				 * Overwrite with the supported rate
538				 * value so any basic rate bit is set.
539				 */
540				nrs->rs_rates[i] = srs->rs_rates[rix];
541			}
542		}
543		if ((flags & IEEE80211_F_DODEL) && rix < 0) {
544			/*
545			 * Delete unacceptable rates.
546			 */
547			nrs->rs_nrates--;
548			for (j = i; j < nrs->rs_nrates; j++)
549				nrs->rs_rates[j] = nrs->rs_rates[j + 1];
550			nrs->rs_rates[j] = 0;
551			continue;
552		}
553		if (rix >= 0)
554			okrate = nrs->rs_rates[i];
555		i++;
556	}
557	if (okrate == 0 || error != 0 ||
558	    ((flags & (IEEE80211_F_DOFRATE|IEEE80211_F_DOFMCS)) &&
559	     fixedrate != ucastrate)) {
560		IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE | IEEE80211_MSG_11N, ni,
561		    "%s: flags 0x%x okrate %d error %d fixedrate 0x%x "
562		    "ucastrate %x\n", __func__, fixedrate, ucastrate, flags);
563		return badrate | IEEE80211_RATE_BASIC;
564	} else
565		return RV(okrate);
566#undef RV
567}
568
569/*
570 * Reset 11g-related state.
571 */
572void
573ieee80211_reset_erp(struct ieee80211com *ic)
574{
575	ic->ic_flags &= ~IEEE80211_F_USEPROT;
576	ic->ic_nonerpsta = 0;
577	ic->ic_longslotsta = 0;
578	/*
579	 * Short slot time is enabled only when operating in 11g
580	 * and not in an IBSS.  We must also honor whether or not
581	 * the driver is capable of doing it.
582	 */
583	ieee80211_set_shortslottime(ic,
584		IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
585		IEEE80211_IS_CHAN_HT(ic->ic_curchan) ||
586		(IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
587		ic->ic_opmode == IEEE80211_M_HOSTAP &&
588		(ic->ic_caps & IEEE80211_C_SHSLOT)));
589	/*
590	 * Set short preamble and ERP barker-preamble flags.
591	 */
592	if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
593	    (ic->ic_caps & IEEE80211_C_SHPREAMBLE)) {
594		ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
595		ic->ic_flags &= ~IEEE80211_F_USEBARKER;
596	} else {
597		ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
598		ic->ic_flags |= IEEE80211_F_USEBARKER;
599	}
600}
601
602/*
603 * Set the short slot time state and notify the driver.
604 */
605void
606ieee80211_set_shortslottime(struct ieee80211com *ic, int onoff)
607{
608	if (onoff)
609		ic->ic_flags |= IEEE80211_F_SHSLOT;
610	else
611		ic->ic_flags &= ~IEEE80211_F_SHSLOT;
612	/* notify driver */
613	if (ic->ic_updateslot != NULL)
614		ic->ic_updateslot(ic->ic_ifp);
615}
616
617/*
618 * Check if the specified rate set supports ERP.
619 * NB: the rate set is assumed to be sorted.
620 */
621int
622ieee80211_iserp_rateset(const struct ieee80211_rateset *rs)
623{
624#define N(a)	(sizeof(a) / sizeof(a[0]))
625	static const int rates[] = { 2, 4, 11, 22, 12, 24, 48 };
626	int i, j;
627
628	if (rs->rs_nrates < N(rates))
629		return 0;
630	for (i = 0; i < N(rates); i++) {
631		for (j = 0; j < rs->rs_nrates; j++) {
632			int r = rs->rs_rates[j] & IEEE80211_RATE_VAL;
633			if (rates[i] == r)
634				goto next;
635			if (r > rates[i])
636				return 0;
637		}
638		return 0;
639	next:
640		;
641	}
642	return 1;
643#undef N
644}
645
646/*
647 * Mark the basic rates for the rate table based on the
648 * operating mode.  For real 11g we mark all the 11b rates
649 * and 6, 12, and 24 OFDM.  For 11b compatibility we mark only
650 * 11b rates.  There's also a pseudo 11a-mode used to mark only
651 * the basic OFDM rates.
652 */
653static void
654setbasicrates(struct ieee80211_rateset *rs,
655    enum ieee80211_phymode mode, int add)
656{
657	static const struct ieee80211_rateset basic[IEEE80211_MODE_MAX] = {
658	    [IEEE80211_MODE_11A]	= { 3, { 12, 24, 48 } },
659	    [IEEE80211_MODE_11B]	= { 2, { 2, 4 } },
660					    /* NB: mixed b/g */
661	    [IEEE80211_MODE_11G]	= { 4, { 2, 4, 11, 22 } },
662	    [IEEE80211_MODE_TURBO_A]	= { 3, { 12, 24, 48 } },
663	    [IEEE80211_MODE_TURBO_G]	= { 4, { 2, 4, 11, 22 } },
664	    [IEEE80211_MODE_STURBO_A]	= { 3, { 12, 24, 48 } },
665	    [IEEE80211_MODE_HALF]	= { 3, { 6, 12, 24 } },
666	    [IEEE80211_MODE_QUARTER]	= { 3, { 3, 6, 12 } },
667	    [IEEE80211_MODE_11NA]	= { 3, { 12, 24, 48 } },
668					    /* NB: mixed b/g */
669	    [IEEE80211_MODE_11NG]	= { 4, { 2, 4, 11, 22 } },
670	};
671	int i, j;
672
673	for (i = 0; i < rs->rs_nrates; i++) {
674		if (!add)
675			rs->rs_rates[i] &= IEEE80211_RATE_VAL;
676		for (j = 0; j < basic[mode].rs_nrates; j++)
677			if (basic[mode].rs_rates[j] == rs->rs_rates[i]) {
678				rs->rs_rates[i] |= IEEE80211_RATE_BASIC;
679				break;
680			}
681	}
682}
683
684/*
685 * Set the basic rates in a rate set.
686 */
687void
688ieee80211_setbasicrates(struct ieee80211_rateset *rs,
689    enum ieee80211_phymode mode)
690{
691	setbasicrates(rs, mode, 0);
692}
693
694/*
695 * Add basic rates to a rate set.
696 */
697void
698ieee80211_addbasicrates(struct ieee80211_rateset *rs,
699    enum ieee80211_phymode mode)
700{
701	setbasicrates(rs, mode, 1);
702}
703
704/*
705 * WME protocol support.
706 *
707 * The default 11a/b/g/n parameters come from the WiFi Alliance WMM
708 * System Interopability Test Plan (v1.4, Appendix F) and the 802.11n
709 * Draft 2.0 Test Plan (Appendix D).
710 *
711 * Static/Dynamic Turbo mode settings come from Atheros.
712 */
713typedef struct phyParamType {
714	uint8_t		aifsn;
715	uint8_t		logcwmin;
716	uint8_t		logcwmax;
717	uint16_t	txopLimit;
718	uint8_t 	acm;
719} paramType;
720
721static const struct phyParamType phyParamForAC_BE[IEEE80211_MODE_MAX] = {
722	[IEEE80211_MODE_AUTO]	= { 3, 4,  6,  0, 0 },
723	[IEEE80211_MODE_11A]	= { 3, 4,  6,  0, 0 },
724	[IEEE80211_MODE_11B]	= { 3, 4,  6,  0, 0 },
725	[IEEE80211_MODE_11G]	= { 3, 4,  6,  0, 0 },
726	[IEEE80211_MODE_FH]	= { 3, 4,  6,  0, 0 },
727	[IEEE80211_MODE_TURBO_A]= { 2, 3,  5,  0, 0 },
728	[IEEE80211_MODE_TURBO_G]= { 2, 3,  5,  0, 0 },
729	[IEEE80211_MODE_STURBO_A]={ 2, 3,  5,  0, 0 },
730	[IEEE80211_MODE_HALF]	= { 3, 4,  6,  0, 0 },
731	[IEEE80211_MODE_QUARTER]= { 3, 4,  6,  0, 0 },
732	[IEEE80211_MODE_11NA]	= { 3, 4,  6,  0, 0 },
733	[IEEE80211_MODE_11NG]	= { 3, 4,  6,  0, 0 },
734};
735static const struct phyParamType phyParamForAC_BK[IEEE80211_MODE_MAX] = {
736	[IEEE80211_MODE_AUTO]	= { 7, 4, 10,  0, 0 },
737	[IEEE80211_MODE_11A]	= { 7, 4, 10,  0, 0 },
738	[IEEE80211_MODE_11B]	= { 7, 4, 10,  0, 0 },
739	[IEEE80211_MODE_11G]	= { 7, 4, 10,  0, 0 },
740	[IEEE80211_MODE_FH]	= { 7, 4, 10,  0, 0 },
741	[IEEE80211_MODE_TURBO_A]= { 7, 3, 10,  0, 0 },
742	[IEEE80211_MODE_TURBO_G]= { 7, 3, 10,  0, 0 },
743	[IEEE80211_MODE_STURBO_A]={ 7, 3, 10,  0, 0 },
744	[IEEE80211_MODE_HALF]	= { 7, 4, 10,  0, 0 },
745	[IEEE80211_MODE_QUARTER]= { 7, 4, 10,  0, 0 },
746	[IEEE80211_MODE_11NA]	= { 7, 4, 10,  0, 0 },
747	[IEEE80211_MODE_11NG]	= { 7, 4, 10,  0, 0 },
748};
749static const struct phyParamType phyParamForAC_VI[IEEE80211_MODE_MAX] = {
750	[IEEE80211_MODE_AUTO]	= { 1, 3, 4,  94, 0 },
751	[IEEE80211_MODE_11A]	= { 1, 3, 4,  94, 0 },
752	[IEEE80211_MODE_11B]	= { 1, 3, 4, 188, 0 },
753	[IEEE80211_MODE_11G]	= { 1, 3, 4,  94, 0 },
754	[IEEE80211_MODE_FH]	= { 1, 3, 4, 188, 0 },
755	[IEEE80211_MODE_TURBO_A]= { 1, 2, 3,  94, 0 },
756	[IEEE80211_MODE_TURBO_G]= { 1, 2, 3,  94, 0 },
757	[IEEE80211_MODE_STURBO_A]={ 1, 2, 3,  94, 0 },
758	[IEEE80211_MODE_HALF]	= { 1, 3, 4,  94, 0 },
759	[IEEE80211_MODE_QUARTER]= { 1, 3, 4,  94, 0 },
760	[IEEE80211_MODE_11NA]	= { 1, 3, 4,  94, 0 },
761	[IEEE80211_MODE_11NG]	= { 1, 3, 4,  94, 0 },
762};
763static const struct phyParamType phyParamForAC_VO[IEEE80211_MODE_MAX] = {
764	[IEEE80211_MODE_AUTO]	= { 1, 2, 3,  47, 0 },
765	[IEEE80211_MODE_11A]	= { 1, 2, 3,  47, 0 },
766	[IEEE80211_MODE_11B]	= { 1, 2, 3, 102, 0 },
767	[IEEE80211_MODE_11G]	= { 1, 2, 3,  47, 0 },
768	[IEEE80211_MODE_FH]	= { 1, 2, 3, 102, 0 },
769	[IEEE80211_MODE_TURBO_A]= { 1, 2, 2,  47, 0 },
770	[IEEE80211_MODE_TURBO_G]= { 1, 2, 2,  47, 0 },
771	[IEEE80211_MODE_STURBO_A]={ 1, 2, 2,  47, 0 },
772	[IEEE80211_MODE_HALF]	= { 1, 2, 3,  47, 0 },
773	[IEEE80211_MODE_QUARTER]= { 1, 2, 3,  47, 0 },
774	[IEEE80211_MODE_11NA]	= { 1, 2, 3,  47, 0 },
775	[IEEE80211_MODE_11NG]	= { 1, 2, 3,  47, 0 },
776};
777
778static const struct phyParamType bssPhyParamForAC_BE[IEEE80211_MODE_MAX] = {
779	[IEEE80211_MODE_AUTO]	= { 3, 4, 10,  0, 0 },
780	[IEEE80211_MODE_11A]	= { 3, 4, 10,  0, 0 },
781	[IEEE80211_MODE_11B]	= { 3, 4, 10,  0, 0 },
782	[IEEE80211_MODE_11G]	= { 3, 4, 10,  0, 0 },
783	[IEEE80211_MODE_FH]	= { 3, 4, 10,  0, 0 },
784	[IEEE80211_MODE_TURBO_A]= { 2, 3, 10,  0, 0 },
785	[IEEE80211_MODE_TURBO_G]= { 2, 3, 10,  0, 0 },
786	[IEEE80211_MODE_STURBO_A]={ 2, 3, 10,  0, 0 },
787	[IEEE80211_MODE_HALF]	= { 3, 4, 10,  0, 0 },
788	[IEEE80211_MODE_QUARTER]= { 3, 4, 10,  0, 0 },
789	[IEEE80211_MODE_11NA]	= { 3, 4, 10,  0, 0 },
790	[IEEE80211_MODE_11NG]	= { 3, 4, 10,  0, 0 },
791};
792static const struct phyParamType bssPhyParamForAC_VI[IEEE80211_MODE_MAX] = {
793	[IEEE80211_MODE_AUTO]	= { 2, 3, 4,  94, 0 },
794	[IEEE80211_MODE_11A]	= { 2, 3, 4,  94, 0 },
795	[IEEE80211_MODE_11B]	= { 2, 3, 4, 188, 0 },
796	[IEEE80211_MODE_11G]	= { 2, 3, 4,  94, 0 },
797	[IEEE80211_MODE_FH]	= { 2, 3, 4, 188, 0 },
798	[IEEE80211_MODE_TURBO_A]= { 2, 2, 3,  94, 0 },
799	[IEEE80211_MODE_TURBO_G]= { 2, 2, 3,  94, 0 },
800	[IEEE80211_MODE_STURBO_A]={ 2, 2, 3,  94, 0 },
801	[IEEE80211_MODE_HALF]	= { 2, 3, 4,  94, 0 },
802	[IEEE80211_MODE_QUARTER]= { 2, 3, 4,  94, 0 },
803	[IEEE80211_MODE_11NA]	= { 2, 3, 4,  94, 0 },
804	[IEEE80211_MODE_11NG]	= { 2, 3, 4,  94, 0 },
805};
806static const struct phyParamType bssPhyParamForAC_VO[IEEE80211_MODE_MAX] = {
807	[IEEE80211_MODE_AUTO]	= { 2, 2, 3,  47, 0 },
808	[IEEE80211_MODE_11A]	= { 2, 2, 3,  47, 0 },
809	[IEEE80211_MODE_11B]	= { 2, 2, 3, 102, 0 },
810	[IEEE80211_MODE_11G]	= { 2, 2, 3,  47, 0 },
811	[IEEE80211_MODE_FH]	= { 2, 2, 3, 102, 0 },
812	[IEEE80211_MODE_TURBO_A]= { 1, 2, 2,  47, 0 },
813	[IEEE80211_MODE_TURBO_G]= { 1, 2, 2,  47, 0 },
814	[IEEE80211_MODE_STURBO_A]={ 1, 2, 2,  47, 0 },
815	[IEEE80211_MODE_HALF]	= { 2, 2, 3,  47, 0 },
816	[IEEE80211_MODE_QUARTER]= { 2, 2, 3,  47, 0 },
817	[IEEE80211_MODE_11NA]	= { 2, 2, 3,  47, 0 },
818	[IEEE80211_MODE_11NG]	= { 2, 2, 3,  47, 0 },
819};
820
821static void
822ieee80211_wme_initparams_locked(struct ieee80211vap *vap)
823{
824	struct ieee80211com *ic = vap->iv_ic;
825	struct ieee80211_wme_state *wme = &ic->ic_wme;
826	const paramType *pPhyParam, *pBssPhyParam;
827	struct wmeParams *wmep;
828	enum ieee80211_phymode mode;
829	int i;
830
831	IEEE80211_LOCK_ASSERT(ic);
832
833	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
834		return;
835
836	/*
837	 * Select mode; we can be called early in which case we
838	 * always use auto mode.  We know we'll be called when
839	 * entering the RUN state with bsschan setup properly
840	 * so state will eventually get set correctly
841	 */
842	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
843		mode = ieee80211_chan2mode(ic->ic_bsschan);
844	else
845		mode = IEEE80211_MODE_AUTO;
846	for (i = 0; i < WME_NUM_AC; i++) {
847		switch (i) {
848		case WME_AC_BK:
849			pPhyParam = &phyParamForAC_BK[mode];
850			pBssPhyParam = &phyParamForAC_BK[mode];
851			break;
852		case WME_AC_VI:
853			pPhyParam = &phyParamForAC_VI[mode];
854			pBssPhyParam = &bssPhyParamForAC_VI[mode];
855			break;
856		case WME_AC_VO:
857			pPhyParam = &phyParamForAC_VO[mode];
858			pBssPhyParam = &bssPhyParamForAC_VO[mode];
859			break;
860		case WME_AC_BE:
861		default:
862			pPhyParam = &phyParamForAC_BE[mode];
863			pBssPhyParam = &bssPhyParamForAC_BE[mode];
864			break;
865		}
866
867		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
868		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
869			wmep->wmep_acm = pPhyParam->acm;
870			wmep->wmep_aifsn = pPhyParam->aifsn;
871			wmep->wmep_logcwmin = pPhyParam->logcwmin;
872			wmep->wmep_logcwmax = pPhyParam->logcwmax;
873			wmep->wmep_txopLimit = pPhyParam->txopLimit;
874		} else {
875			wmep->wmep_acm = pBssPhyParam->acm;
876			wmep->wmep_aifsn = pBssPhyParam->aifsn;
877			wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
878			wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
879			wmep->wmep_txopLimit = pBssPhyParam->txopLimit;
880
881		}
882		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
883			"%s: %s chan [acm %u aifsn %u log2(cwmin) %u "
884			"log2(cwmax) %u txpoLimit %u]\n", __func__
885			, ieee80211_wme_acnames[i]
886			, wmep->wmep_acm
887			, wmep->wmep_aifsn
888			, wmep->wmep_logcwmin
889			, wmep->wmep_logcwmax
890			, wmep->wmep_txopLimit
891		);
892
893		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
894		wmep->wmep_acm = pBssPhyParam->acm;
895		wmep->wmep_aifsn = pBssPhyParam->aifsn;
896		wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
897		wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
898		wmep->wmep_txopLimit = pBssPhyParam->txopLimit;
899		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
900			"%s: %s  bss [acm %u aifsn %u log2(cwmin) %u "
901			"log2(cwmax) %u txpoLimit %u]\n", __func__
902			, ieee80211_wme_acnames[i]
903			, wmep->wmep_acm
904			, wmep->wmep_aifsn
905			, wmep->wmep_logcwmin
906			, wmep->wmep_logcwmax
907			, wmep->wmep_txopLimit
908		);
909	}
910	/* NB: check ic_bss to avoid NULL deref on initial attach */
911	if (vap->iv_bss != NULL) {
912		/*
913		 * Calculate agressive mode switching threshold based
914		 * on beacon interval.  This doesn't need locking since
915		 * we're only called before entering the RUN state at
916		 * which point we start sending beacon frames.
917		 */
918		wme->wme_hipri_switch_thresh =
919			(HIGH_PRI_SWITCH_THRESH * vap->iv_bss->ni_intval) / 100;
920		ieee80211_wme_updateparams(vap);
921	}
922}
923
924void
925ieee80211_wme_initparams(struct ieee80211vap *vap)
926{
927	struct ieee80211com *ic = vap->iv_ic;
928
929	IEEE80211_LOCK(ic);
930	ieee80211_wme_initparams_locked(vap);
931	IEEE80211_UNLOCK(ic);
932}
933
934/*
935 * Update WME parameters for ourself and the BSS.
936 */
937void
938ieee80211_wme_updateparams_locked(struct ieee80211vap *vap)
939{
940	static const paramType phyParam[IEEE80211_MODE_MAX] = {
941	    [IEEE80211_MODE_AUTO]	= { 2, 4, 10, 64, 0 },
942	    [IEEE80211_MODE_11A]	= { 2, 4, 10, 64, 0 },
943	    [IEEE80211_MODE_11B]	= { 2, 5, 10, 64, 0 },
944	    [IEEE80211_MODE_11G]	= { 2, 4, 10, 64, 0 },
945	    [IEEE80211_MODE_FH]		= { 2, 5, 10, 64, 0 },
946	    [IEEE80211_MODE_TURBO_A]	= { 1, 3, 10, 64, 0 },
947	    [IEEE80211_MODE_TURBO_G]	= { 1, 3, 10, 64, 0 },
948	    [IEEE80211_MODE_STURBO_A]	= { 1, 3, 10, 64, 0 },
949	    [IEEE80211_MODE_HALF]	= { 2, 4, 10, 64, 0 },
950	    [IEEE80211_MODE_QUARTER]	= { 2, 4, 10, 64, 0 },
951	    [IEEE80211_MODE_11NA]	= { 2, 4, 10, 64, 0 },	/* XXXcheck*/
952	    [IEEE80211_MODE_11NG]	= { 2, 4, 10, 64, 0 },	/* XXXcheck*/
953	};
954	struct ieee80211com *ic = vap->iv_ic;
955	struct ieee80211_wme_state *wme = &ic->ic_wme;
956	const struct wmeParams *wmep;
957	struct wmeParams *chanp, *bssp;
958	enum ieee80211_phymode mode;
959	int i;
960
961       	/* set up the channel access parameters for the physical device */
962	for (i = 0; i < WME_NUM_AC; i++) {
963		chanp = &wme->wme_chanParams.cap_wmeParams[i];
964		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
965		chanp->wmep_aifsn = wmep->wmep_aifsn;
966		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
967		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
968		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
969
970		chanp = &wme->wme_bssChanParams.cap_wmeParams[i];
971		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
972		chanp->wmep_aifsn = wmep->wmep_aifsn;
973		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
974		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
975		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
976	}
977
978	/*
979	 * Select mode; we can be called early in which case we
980	 * always use auto mode.  We know we'll be called when
981	 * entering the RUN state with bsschan setup properly
982	 * so state will eventually get set correctly
983	 */
984	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
985		mode = ieee80211_chan2mode(ic->ic_bsschan);
986	else
987		mode = IEEE80211_MODE_AUTO;
988
989	/*
990	 * This implements agressive mode as found in certain
991	 * vendors' AP's.  When there is significant high
992	 * priority (VI/VO) traffic in the BSS throttle back BE
993	 * traffic by using conservative parameters.  Otherwise
994	 * BE uses agressive params to optimize performance of
995	 * legacy/non-QoS traffic.
996	 */
997        if ((vap->iv_opmode == IEEE80211_M_HOSTAP &&
998	     (wme->wme_flags & WME_F_AGGRMODE) != 0) ||
999	    (vap->iv_opmode == IEEE80211_M_STA &&
1000	     (vap->iv_bss->ni_flags & IEEE80211_NODE_QOS) == 0) ||
1001	    (vap->iv_flags & IEEE80211_F_WME) == 0) {
1002		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
1003		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
1004
1005		chanp->wmep_aifsn = bssp->wmep_aifsn = phyParam[mode].aifsn;
1006		chanp->wmep_logcwmin = bssp->wmep_logcwmin =
1007			phyParam[mode].logcwmin;
1008		chanp->wmep_logcwmax = bssp->wmep_logcwmax =
1009			phyParam[mode].logcwmax;
1010		chanp->wmep_txopLimit = bssp->wmep_txopLimit =
1011			(vap->iv_flags & IEEE80211_F_BURST) ?
1012				phyParam[mode].txopLimit : 0;
1013		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1014			"%s: %s [acm %u aifsn %u log2(cwmin) %u "
1015			"log2(cwmax) %u txpoLimit %u]\n", __func__
1016			, ieee80211_wme_acnames[WME_AC_BE]
1017			, chanp->wmep_acm
1018			, chanp->wmep_aifsn
1019			, chanp->wmep_logcwmin
1020			, chanp->wmep_logcwmax
1021			, chanp->wmep_txopLimit
1022		);
1023	}
1024
1025	/* XXX multi-bss */
1026	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1027	    ic->ic_sta_assoc < 2 && (wme->wme_flags & WME_F_AGGRMODE) != 0) {
1028		static const uint8_t logCwMin[IEEE80211_MODE_MAX] = {
1029		    [IEEE80211_MODE_AUTO]	= 3,
1030		    [IEEE80211_MODE_11A]	= 3,
1031		    [IEEE80211_MODE_11B]	= 4,
1032		    [IEEE80211_MODE_11G]	= 3,
1033		    [IEEE80211_MODE_FH]		= 4,
1034		    [IEEE80211_MODE_TURBO_A]	= 3,
1035		    [IEEE80211_MODE_TURBO_G]	= 3,
1036		    [IEEE80211_MODE_STURBO_A]	= 3,
1037		    [IEEE80211_MODE_HALF]	= 3,
1038		    [IEEE80211_MODE_QUARTER]	= 3,
1039		    [IEEE80211_MODE_11NA]	= 3,
1040		    [IEEE80211_MODE_11NG]	= 3,
1041		};
1042		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
1043		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
1044
1045		chanp->wmep_logcwmin = bssp->wmep_logcwmin = logCwMin[mode];
1046		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1047			"%s: %s log2(cwmin) %u\n", __func__
1048			, ieee80211_wme_acnames[WME_AC_BE]
1049			, chanp->wmep_logcwmin
1050		);
1051    	}
1052	if (vap->iv_opmode == IEEE80211_M_HOSTAP) {	/* XXX ibss? */
1053		/*
1054		 * Arrange for a beacon update and bump the parameter
1055		 * set number so associated stations load the new values.
1056		 */
1057		wme->wme_bssChanParams.cap_info =
1058			(wme->wme_bssChanParams.cap_info+1) & WME_QOSINFO_COUNT;
1059		ieee80211_beacon_notify(vap, IEEE80211_BEACON_WME);
1060	}
1061
1062	wme->wme_update(ic);
1063
1064	IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1065		"%s: WME params updated, cap_info 0x%x\n", __func__,
1066		vap->iv_opmode == IEEE80211_M_STA ?
1067			wme->wme_wmeChanParams.cap_info :
1068			wme->wme_bssChanParams.cap_info);
1069}
1070
1071void
1072ieee80211_wme_updateparams(struct ieee80211vap *vap)
1073{
1074	struct ieee80211com *ic = vap->iv_ic;
1075
1076	if (ic->ic_caps & IEEE80211_C_WME) {
1077		IEEE80211_LOCK(ic);
1078		ieee80211_wme_updateparams_locked(vap);
1079		IEEE80211_UNLOCK(ic);
1080	}
1081}
1082
1083static void
1084parent_updown(void *arg, int npending)
1085{
1086	struct ifnet *parent = arg;
1087
1088	parent->if_ioctl(parent, SIOCSIFFLAGS, NULL);
1089}
1090
1091/*
1092 * Block until the parent is in a known state.  This is
1093 * used after any operations that dispatch a task (e.g.
1094 * to auto-configure the parent device up/down).
1095 */
1096void
1097ieee80211_waitfor_parent(struct ieee80211com *ic)
1098{
1099	taskqueue_drain(taskqueue_thread, &ic->ic_parent_task);
1100}
1101
1102/*
1103 * Start a vap running.  If this is the first vap to be
1104 * set running on the underlying device then we
1105 * automatically bring the device up.
1106 */
1107void
1108ieee80211_start_locked(struct ieee80211vap *vap)
1109{
1110	struct ifnet *ifp = vap->iv_ifp;
1111	struct ieee80211com *ic = vap->iv_ic;
1112	struct ifnet *parent = ic->ic_ifp;
1113
1114	IEEE80211_LOCK_ASSERT(ic);
1115
1116	IEEE80211_DPRINTF(vap,
1117		IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1118		"start running, %d vaps running\n", ic->ic_nrunning);
1119
1120	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1121		/*
1122		 * Mark us running.  Note that it's ok to do this first;
1123		 * if we need to bring the parent device up we defer that
1124		 * to avoid dropping the com lock.  We expect the device
1125		 * to respond to being marked up by calling back into us
1126		 * through ieee80211_start_all at which point we'll come
1127		 * back in here and complete the work.
1128		 */
1129		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1130		/*
1131		 * We are not running; if this we are the first vap
1132		 * to be brought up auto-up the parent if necessary.
1133		 */
1134		if (ic->ic_nrunning++ == 0 &&
1135		    (parent->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1136			IEEE80211_DPRINTF(vap,
1137			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1138			    "%s: up parent %s\n", __func__, parent->if_xname);
1139			parent->if_flags |= IFF_UP;
1140			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1141			return;
1142		}
1143	}
1144	/*
1145	 * If the parent is up and running, then kick the
1146	 * 802.11 state machine as appropriate.
1147	 */
1148	if ((parent->if_drv_flags & IFF_DRV_RUNNING) &&
1149	    vap->iv_roaming != IEEE80211_ROAMING_MANUAL) {
1150		if (vap->iv_opmode == IEEE80211_M_STA) {
1151#if 0
1152			/* XXX bypasses scan too easily; disable for now */
1153			/*
1154			 * Try to be intelligent about clocking the state
1155			 * machine.  If we're currently in RUN state then
1156			 * we should be able to apply any new state/parameters
1157			 * simply by re-associating.  Otherwise we need to
1158			 * re-scan to select an appropriate ap.
1159			 */
1160			if (vap->iv_state >= IEEE80211_S_RUN)
1161				ieee80211_new_state_locked(vap,
1162				    IEEE80211_S_ASSOC, 1);
1163			else
1164#endif
1165				ieee80211_new_state_locked(vap,
1166				    IEEE80211_S_SCAN, 0);
1167		} else {
1168			/*
1169			 * For monitor+wds mode there's nothing to do but
1170			 * start running.  Otherwise if this is the first
1171			 * vap to be brought up, start a scan which may be
1172			 * preempted if the station is locked to a particular
1173			 * channel.
1174			 */
1175			/* XXX needed? */
1176			ieee80211_new_state_locked(vap, IEEE80211_S_INIT, 0);
1177			if (vap->iv_opmode == IEEE80211_M_MONITOR ||
1178			    vap->iv_opmode == IEEE80211_M_WDS)
1179				ieee80211_new_state_locked(vap,
1180				    IEEE80211_S_RUN, -1);
1181			else
1182				ieee80211_new_state_locked(vap,
1183				    IEEE80211_S_SCAN, 0);
1184		}
1185	}
1186}
1187
1188/*
1189 * Start a single vap.
1190 */
1191void
1192ieee80211_init(void *arg)
1193{
1194	struct ieee80211vap *vap = arg;
1195
1196	/*
1197	 * This routine is publicly accessible through the vap's
1198	 * if_init method so guard against calls during detach.
1199	 * ieee80211_vap_detach null's the backpointer before
1200	 * tearing down state to signal any callback should be
1201	 * rejected/ignored.
1202	 */
1203	if (vap != NULL) {
1204		IEEE80211_DPRINTF(vap,
1205		    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1206		    "%s\n", __func__);
1207
1208		IEEE80211_LOCK(vap->iv_ic);
1209		ieee80211_start_locked(vap);
1210		IEEE80211_UNLOCK(vap->iv_ic);
1211	}
1212}
1213
1214/*
1215 * Start all runnable vap's on a device.
1216 */
1217void
1218ieee80211_start_all(struct ieee80211com *ic)
1219{
1220	struct ieee80211vap *vap;
1221
1222	IEEE80211_LOCK(ic);
1223	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1224		struct ifnet *ifp = vap->iv_ifp;
1225		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1226			ieee80211_start_locked(vap);
1227	}
1228	IEEE80211_UNLOCK(ic);
1229}
1230
1231/*
1232 * Stop a vap.  We force it down using the state machine
1233 * then mark it's ifnet not running.  If this is the last
1234 * vap running on the underlying device then we close it
1235 * too to insure it will be properly initialized when the
1236 * next vap is brought up.
1237 */
1238void
1239ieee80211_stop_locked(struct ieee80211vap *vap)
1240{
1241	struct ieee80211com *ic = vap->iv_ic;
1242	struct ifnet *ifp = vap->iv_ifp;
1243	struct ifnet *parent = ic->ic_ifp;
1244
1245	IEEE80211_LOCK_ASSERT(ic);
1246
1247	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1248	    "stop running, %d vaps running\n", ic->ic_nrunning);
1249
1250	ieee80211_new_state_locked(vap, IEEE80211_S_INIT, -1);
1251	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1252		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;	/* mark us stopped */
1253		if (--ic->ic_nrunning == 0 &&
1254		    (parent->if_drv_flags & IFF_DRV_RUNNING)) {
1255			IEEE80211_DPRINTF(vap,
1256			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1257			    "down parent %s\n", parent->if_xname);
1258			parent->if_flags &= ~IFF_UP;
1259			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1260		}
1261	}
1262}
1263
1264void
1265ieee80211_stop(struct ieee80211vap *vap)
1266{
1267	struct ieee80211com *ic = vap->iv_ic;
1268
1269	IEEE80211_LOCK(ic);
1270	ieee80211_stop_locked(vap);
1271	IEEE80211_UNLOCK(ic);
1272}
1273
1274/*
1275 * Stop all vap's running on a device.
1276 */
1277void
1278ieee80211_stop_all(struct ieee80211com *ic)
1279{
1280	struct ieee80211vap *vap;
1281
1282	IEEE80211_LOCK(ic);
1283	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1284		struct ifnet *ifp = vap->iv_ifp;
1285		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1286			ieee80211_stop_locked(vap);
1287	}
1288	IEEE80211_UNLOCK(ic);
1289
1290	ieee80211_waitfor_parent(ic);
1291}
1292
1293/*
1294 * Stop all vap's running on a device and arrange
1295 * for those that were running to be resumed.
1296 */
1297void
1298ieee80211_suspend_all(struct ieee80211com *ic)
1299{
1300	struct ieee80211vap *vap;
1301
1302	IEEE80211_LOCK(ic);
1303	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1304		struct ifnet *ifp = vap->iv_ifp;
1305		if (IFNET_IS_UP_RUNNING(ifp)) {	/* NB: avoid recursion */
1306			vap->iv_flags_ext |= IEEE80211_FEXT_RESUME;
1307			ieee80211_stop_locked(vap);
1308		}
1309	}
1310	IEEE80211_UNLOCK(ic);
1311
1312	ieee80211_waitfor_parent(ic);
1313}
1314
1315/*
1316 * Start all vap's marked for resume.
1317 */
1318void
1319ieee80211_resume_all(struct ieee80211com *ic)
1320{
1321	struct ieee80211vap *vap;
1322
1323	IEEE80211_LOCK(ic);
1324	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1325		struct ifnet *ifp = vap->iv_ifp;
1326		if (!IFNET_IS_UP_RUNNING(ifp) &&
1327		    (vap->iv_flags_ext & IEEE80211_FEXT_RESUME)) {
1328			vap->iv_flags_ext &= ~IEEE80211_FEXT_RESUME;
1329			ieee80211_start_locked(vap);
1330		}
1331	}
1332	IEEE80211_UNLOCK(ic);
1333}
1334
1335/*
1336 * Switch between turbo and non-turbo operating modes.
1337 * Use the specified channel flags to locate the new
1338 * channel, update 802.11 state, and then call back into
1339 * the driver to effect the change.
1340 */
1341void
1342ieee80211_dturbo_switch(struct ieee80211vap *vap, int newflags)
1343{
1344	struct ieee80211com *ic = vap->iv_ic;
1345	struct ieee80211_channel *chan;
1346
1347	chan = ieee80211_find_channel(ic, ic->ic_bsschan->ic_freq, newflags);
1348	if (chan == NULL) {		/* XXX should not happen */
1349		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1350		    "%s: no channel with freq %u flags 0x%x\n",
1351		    __func__, ic->ic_bsschan->ic_freq, newflags);
1352		return;
1353	}
1354
1355	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1356	    "%s: %s -> %s (freq %u flags 0x%x)\n", __func__,
1357	    ieee80211_phymode_name[ieee80211_chan2mode(ic->ic_bsschan)],
1358	    ieee80211_phymode_name[ieee80211_chan2mode(chan)],
1359	    chan->ic_freq, chan->ic_flags);
1360
1361	ic->ic_bsschan = chan;
1362	ic->ic_prevchan = ic->ic_curchan;
1363	ic->ic_curchan = chan;
1364	ic->ic_set_channel(ic);
1365	/* NB: do not need to reset ERP state 'cuz we're in sta mode */
1366}
1367
1368void
1369ieee80211_beacon_miss(struct ieee80211com *ic)
1370{
1371	struct ieee80211vap *vap;
1372
1373	if (ic->ic_flags & IEEE80211_F_SCAN)
1374		return;
1375	/* XXX locking */
1376	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1377		/*
1378		 * We only pass events through for sta vap's in RUN state;
1379		 * may be too restrictive but for now this saves all the
1380		 * handlers duplicating these checks.
1381		 */
1382		if (vap->iv_opmode == IEEE80211_M_STA &&
1383		    vap->iv_state == IEEE80211_S_RUN &&
1384		    vap->iv_bmiss != NULL)
1385			vap->iv_bmiss(vap);
1386	}
1387}
1388
1389/*
1390 * Software beacon miss handling.  Check if any beacons
1391 * were received in the last period.  If not post a
1392 * beacon miss; otherwise reset the counter.
1393 */
1394void
1395ieee80211_swbmiss(void *arg)
1396{
1397	struct ieee80211vap *vap = arg;
1398	struct ieee80211com *ic = vap->iv_ic;
1399
1400	/* XXX sleep state? */
1401	KASSERT(vap->iv_state == IEEE80211_S_RUN,
1402	    ("wrong state %d", vap->iv_state));
1403
1404	if (ic->ic_flags & IEEE80211_F_SCAN) {
1405		/*
1406		 * If scanning just ignore and reset state.  If we get a
1407		 * bmiss after coming out of scan because we haven't had
1408		 * time to receive a beacon then we should probe the AP
1409		 * before posting a real bmiss (unless iv_bmiss_max has
1410		 * been artifiically lowered).  A cleaner solution might
1411		 * be to disable the timer on scan start/end but to handle
1412		 * case of multiple sta vap's we'd need to disable the
1413		 * timers of all affected vap's.
1414		 */
1415		vap->iv_swbmiss_count = 0;
1416	} else if (vap->iv_swbmiss_count == 0) {
1417		if (vap->iv_bmiss != NULL)
1418			vap->iv_bmiss(vap);
1419		if (vap->iv_bmiss_count == 0)	/* don't re-arm timer */
1420			return;
1421	} else
1422		vap->iv_swbmiss_count = 0;
1423	callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
1424		ieee80211_swbmiss, vap);
1425}
1426
1427/*
1428 * Start an 802.11h channel switch.  We record the parameters,
1429 * mark the operation pending, notify each vap through the
1430 * beacon update mechanism so it can update the beacon frame
1431 * contents, and then switch vap's to CSA state to block outbound
1432 * traffic.  Devices that handle CSA directly can use the state
1433 * switch to do the right thing so long as they call
1434 * ieee80211_csa_completeswitch when it's time to complete the
1435 * channel change.  Devices that depend on the net80211 layer can
1436 * use ieee80211_beacon_update to handle the countdown and the
1437 * channel switch.
1438 */
1439void
1440ieee80211_csa_startswitch(struct ieee80211com *ic,
1441	struct ieee80211_channel *c, int mode, int count)
1442{
1443	struct ieee80211vap *vap;
1444
1445	IEEE80211_LOCK_ASSERT(ic);
1446
1447	ic->ic_csa_newchan = c;
1448	ic->ic_csa_count = count;
1449	/* XXX record mode? */
1450	ic->ic_flags |= IEEE80211_F_CSAPENDING;
1451	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1452		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1453		    vap->iv_opmode == IEEE80211_M_IBSS)
1454			ieee80211_beacon_notify(vap, IEEE80211_BEACON_CSA);
1455		/* switch to CSA state to block outbound traffic */
1456		if (vap->iv_state == IEEE80211_S_RUN)
1457			ieee80211_new_state_locked(vap, IEEE80211_S_CSA, 0);
1458	}
1459	ieee80211_notify_csa(ic, c, mode, count);
1460}
1461
1462/*
1463 * Complete an 802.11h channel switch started by ieee80211_csa_startswitch.
1464 * We clear state and move all vap's in CSA state to RUN state
1465 * so they can again transmit.
1466 */
1467void
1468ieee80211_csa_completeswitch(struct ieee80211com *ic)
1469{
1470	struct ieee80211vap *vap;
1471
1472	IEEE80211_LOCK_ASSERT(ic);
1473
1474	KASSERT(ic->ic_flags & IEEE80211_F_CSAPENDING, ("csa not pending"));
1475
1476	ieee80211_setcurchan(ic, ic->ic_csa_newchan);
1477	ic->ic_csa_newchan = NULL;
1478	ic->ic_flags &= ~IEEE80211_F_CSAPENDING;
1479
1480	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1481		if (vap->iv_state == IEEE80211_S_CSA)
1482			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1483}
1484
1485/*
1486 * Complete a DFS CAC started by ieee80211_dfs_cac_start.
1487 * We clear state and move all vap's in CAC state to RUN state.
1488 */
1489void
1490ieee80211_cac_completeswitch(struct ieee80211vap *vap0)
1491{
1492	struct ieee80211com *ic = vap0->iv_ic;
1493	struct ieee80211vap *vap;
1494
1495	IEEE80211_LOCK(ic);
1496	/*
1497	 * Complete CAC state change for lead vap first; then
1498	 * clock all the other vap's waiting.
1499	 */
1500	KASSERT(vap0->iv_state == IEEE80211_S_CAC,
1501	    ("wrong state %d", vap0->iv_state));
1502	ieee80211_new_state_locked(vap0, IEEE80211_S_RUN, 0);
1503
1504	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1505		if (vap->iv_state == IEEE80211_S_CAC)
1506			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1507	IEEE80211_UNLOCK(ic);
1508}
1509
1510/*
1511 * Force all vap's other than the specified vap to the INIT state
1512 * and mark them as waiting for a scan to complete.  These vaps
1513 * will be brought up when the scan completes and the scanning vap
1514 * reaches RUN state by wakeupwaiting.
1515 * XXX if we do this in threads we can use sleep/wakeup.
1516 */
1517static void
1518markwaiting(struct ieee80211vap *vap0)
1519{
1520	struct ieee80211com *ic = vap0->iv_ic;
1521	struct ieee80211vap *vap;
1522
1523	IEEE80211_LOCK_ASSERT(ic);
1524
1525	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1526		if (vap == vap0)
1527			continue;
1528		if (vap->iv_state != IEEE80211_S_INIT) {
1529			vap->iv_newstate(vap, IEEE80211_S_INIT, 0);
1530			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1531		}
1532	}
1533}
1534
1535/*
1536 * Wakeup all vap's waiting for a scan to complete.  This is the
1537 * companion to markwaiting (above) and is used to coordinate
1538 * multiple vaps scanning.
1539 */
1540static void
1541wakeupwaiting(struct ieee80211vap *vap0)
1542{
1543	struct ieee80211com *ic = vap0->iv_ic;
1544	struct ieee80211vap *vap;
1545
1546	IEEE80211_LOCK_ASSERT(ic);
1547
1548	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1549		if (vap == vap0)
1550			continue;
1551		if (vap->iv_flags_ext & IEEE80211_FEXT_SCANWAIT) {
1552			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1553			/* NB: sta's cannot go INIT->RUN */
1554			vap->iv_newstate(vap,
1555			    vap->iv_opmode == IEEE80211_M_STA ?
1556			        IEEE80211_S_SCAN : IEEE80211_S_RUN, 0);
1557		}
1558	}
1559}
1560
1561/*
1562 * Handle post state change work common to all operating modes.
1563 */
1564static void
1565ieee80211_newstate_cb(struct ieee80211vap *vap,
1566	enum ieee80211_state nstate, int arg)
1567{
1568	struct ieee80211com *ic = vap->iv_ic;
1569
1570	IEEE80211_LOCK_ASSERT(ic);
1571
1572	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1573	    "%s: %s arg %d\n", __func__, ieee80211_state_name[nstate], arg);
1574
1575	if (nstate == IEEE80211_S_RUN) {
1576		/*
1577		 * OACTIVE may be set on the vap if the upper layer
1578		 * tried to transmit (e.g. IPv6 NDP) before we reach
1579		 * RUN state.  Clear it and restart xmit.
1580		 *
1581		 * Note this can also happen as a result of SLEEP->RUN
1582		 * (i.e. coming out of power save mode).
1583		 */
1584		vap->iv_ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1585		if_start(vap->iv_ifp);
1586
1587		/* bring up any vaps waiting on us */
1588		wakeupwaiting(vap);
1589	} else if (nstate == IEEE80211_S_INIT) {
1590		/*
1591		 * Flush the scan cache if we did the last scan (XXX?)
1592		 * and flush any frames on send queues from this vap.
1593		 * Note the mgt q is used only for legacy drivers and
1594		 * will go away shortly.
1595		 */
1596		ieee80211_scan_flush(vap);
1597
1598		/* XXX NB: cast for altq */
1599		ieee80211_flush_ifq((struct ifqueue *)&ic->ic_ifp->if_snd, vap);
1600	}
1601	vap->iv_newstate_cb = NULL;
1602}
1603
1604/*
1605 * Public interface for initiating a state machine change.
1606 * This routine single-threads the request and coordinates
1607 * the scheduling of multiple vaps for the purpose of selecting
1608 * an operating channel.  Specifically the following scenarios
1609 * are handled:
1610 * o only one vap can be selecting a channel so on transition to
1611 *   SCAN state if another vap is already scanning then
1612 *   mark the caller for later processing and return without
1613 *   doing anything (XXX? expectations by caller of synchronous operation)
1614 * o only one vap can be doing CAC of a channel so on transition to
1615 *   CAC state if another vap is already scanning for radar then
1616 *   mark the caller for later processing and return without
1617 *   doing anything (XXX? expectations by caller of synchronous operation)
1618 * o if another vap is already running when a request is made
1619 *   to SCAN then an operating channel has been chosen; bypass
1620 *   the scan and just join the channel
1621 *
1622 * Note that the state change call is done through the iv_newstate
1623 * method pointer so any driver routine gets invoked.  The driver
1624 * will normally call back into operating mode-specific
1625 * ieee80211_newstate routines (below) unless it needs to completely
1626 * bypass the state machine (e.g. because the firmware has it's
1627 * own idea how things should work).  Bypassing the net80211 layer
1628 * is usually a mistake and indicates lack of proper integration
1629 * with the net80211 layer.
1630 */
1631static int
1632ieee80211_new_state_locked(struct ieee80211vap *vap,
1633	enum ieee80211_state nstate, int arg)
1634{
1635	struct ieee80211com *ic = vap->iv_ic;
1636	struct ieee80211vap *vp;
1637	enum ieee80211_state ostate;
1638	int nrunning, nscanning, rc;
1639
1640	IEEE80211_LOCK_ASSERT(ic);
1641
1642	nrunning = nscanning = 0;
1643	/* XXX can track this state instead of calculating */
1644	TAILQ_FOREACH(vp, &ic->ic_vaps, iv_next) {
1645		if (vp != vap) {
1646			if (vp->iv_state >= IEEE80211_S_RUN)
1647				nrunning++;
1648			/* XXX doesn't handle bg scan */
1649			/* NB: CAC+AUTH+ASSOC treated like SCAN */
1650			else if (vp->iv_state > IEEE80211_S_INIT)
1651				nscanning++;
1652		}
1653	}
1654	ostate = vap->iv_state;
1655	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1656	    "%s: %s -> %s (nrunning %d nscanning %d)\n", __func__,
1657	    ieee80211_state_name[ostate], ieee80211_state_name[nstate],
1658	    nrunning, nscanning);
1659	switch (nstate) {
1660	case IEEE80211_S_SCAN:
1661		if (ostate == IEEE80211_S_INIT) {
1662			/*
1663			 * INIT -> SCAN happens on initial bringup.
1664			 */
1665			KASSERT(!(nscanning && nrunning),
1666			    ("%d scanning and %d running", nscanning, nrunning));
1667			if (nscanning) {
1668				/*
1669				 * Someone is scanning, defer our state
1670				 * change until the work has completed.
1671				 */
1672				IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1673				    "%s: defer %s -> %s\n",
1674				    __func__, ieee80211_state_name[ostate],
1675				    ieee80211_state_name[nstate]);
1676				vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1677				rc = 0;
1678				goto done;
1679			}
1680			if (nrunning) {
1681				/*
1682				 * Someone is operating; just join the channel
1683				 * they have chosen.
1684				 */
1685				/* XXX kill arg? */
1686				/* XXX check each opmode, adhoc? */
1687				if (vap->iv_opmode == IEEE80211_M_STA)
1688					nstate = IEEE80211_S_SCAN;
1689				else
1690					nstate = IEEE80211_S_RUN;
1691#ifdef IEEE80211_DEBUG
1692				if (nstate != IEEE80211_S_SCAN) {
1693					IEEE80211_DPRINTF(vap,
1694					    IEEE80211_MSG_STATE,
1695					    "%s: override, now %s -> %s\n",
1696					    __func__,
1697					    ieee80211_state_name[ostate],
1698					    ieee80211_state_name[nstate]);
1699				}
1700#endif
1701			}
1702		} else {
1703			/*
1704			 * SCAN was forced; e.g. on beacon miss.  Force
1705			 * other running vap's to INIT state and mark
1706			 * them as waiting for the scan to complete.  This
1707			 * insures they don't interfere with our scanning.
1708			 *
1709			 * XXX not always right, assumes ap follows sta
1710			 */
1711			markwaiting(vap);
1712		}
1713		break;
1714	case IEEE80211_S_RUN:
1715		if (vap->iv_opmode == IEEE80211_M_WDS &&
1716		    (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY) &&
1717		    nscanning) {
1718			/*
1719			 * Legacy WDS with someone else scanning; don't
1720			 * go online until that completes as we should
1721			 * follow the other vap to the channel they choose.
1722			 */
1723			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1724			     "%s: defer %s -> %s (legacy WDS)\n", __func__,
1725			     ieee80211_state_name[ostate],
1726			     ieee80211_state_name[nstate]);
1727			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1728			rc = 0;
1729			goto done;
1730		}
1731		if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1732		    IEEE80211_IS_CHAN_DFS(ic->ic_bsschan) &&
1733		    (vap->iv_flags_ext & IEEE80211_FEXT_DFS) &&
1734		    !IEEE80211_IS_CHAN_CACDONE(ic->ic_bsschan)) {
1735			/*
1736			 * This is a DFS channel, transition to CAC state
1737			 * instead of RUN.  This allows us to initiate
1738			 * Channel Availability Check (CAC) as specified
1739			 * by 11h/DFS.
1740			 */
1741			nstate = IEEE80211_S_CAC;
1742			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1743			     "%s: override %s -> %s (DFS)\n", __func__,
1744			     ieee80211_state_name[ostate],
1745			     ieee80211_state_name[nstate]);
1746		}
1747		break;
1748	case IEEE80211_S_INIT:
1749		if (ostate == IEEE80211_S_INIT ) {
1750			/* XXX don't believe this */
1751			/* INIT -> INIT. nothing to do */
1752			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1753		}
1754		/* fall thru... */
1755	default:
1756		break;
1757	}
1758	/* XXX on transition RUN->CAC do we need to set nstate = iv_state? */
1759	if (ostate != nstate) {
1760		/*
1761		 * Arrange for work to happen after state change completes.
1762		 * If this happens asynchronously the caller must arrange
1763		 * for the com lock to be held.
1764		 */
1765		vap->iv_newstate_cb = ieee80211_newstate_cb;
1766	}
1767	rc = vap->iv_newstate(vap, nstate, arg);
1768	if (rc == 0 && vap->iv_newstate_cb != NULL)
1769		vap->iv_newstate_cb(vap, nstate, arg);
1770done:
1771	return rc;
1772}
1773
1774int
1775ieee80211_new_state(struct ieee80211vap *vap,
1776	enum ieee80211_state nstate, int arg)
1777{
1778	struct ieee80211com *ic = vap->iv_ic;
1779	int rc;
1780
1781	IEEE80211_LOCK(ic);
1782	rc = ieee80211_new_state_locked(vap, nstate, arg);
1783	IEEE80211_UNLOCK(ic);
1784	return rc;
1785}
1786