ieee80211_proto.c revision 178354
1/*-
2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_proto.c 178354 2008-04-20 20:35:46Z sam $");
29
30/*
31 * IEEE 802.11 protocol support.
32 */
33
34#include "opt_inet.h"
35#include "opt_wlan.h"
36
37#include <sys/param.h>
38#include <sys/kernel.h>
39#include <sys/systm.h>
40#include <sys/taskqueue.h>
41
42#include <sys/socket.h>
43#include <sys/sockio.h>
44
45#include <net/if.h>
46#include <net/if_media.h>
47#include <net/ethernet.h>		/* XXX for ether_sprintf */
48
49#include <net80211/ieee80211_var.h>
50#include <net80211/ieee80211_adhoc.h>
51#include <net80211/ieee80211_sta.h>
52#include <net80211/ieee80211_hostap.h>
53#include <net80211/ieee80211_wds.h>
54#include <net80211/ieee80211_monitor.h>
55#include <net80211/ieee80211_input.h>
56
57/* XXX tunables */
58#define	AGGRESSIVE_MODE_SWITCH_HYSTERESIS	3	/* pkts / 100ms */
59#define	HIGH_PRI_SWITCH_THRESH			10	/* pkts / 100ms */
60
61const char *ieee80211_mgt_subtype_name[] = {
62	"assoc_req",	"assoc_resp",	"reassoc_req",	"reassoc_resp",
63	"probe_req",	"probe_resp",	"reserved#6",	"reserved#7",
64	"beacon",	"atim",		"disassoc",	"auth",
65	"deauth",	"action",	"reserved#14",	"reserved#15"
66};
67const char *ieee80211_ctl_subtype_name[] = {
68	"reserved#0",	"reserved#1",	"reserved#2",	"reserved#3",
69	"reserved#3",	"reserved#5",	"reserved#6",	"reserved#7",
70	"reserved#8",	"reserved#9",	"ps_poll",	"rts",
71	"cts",		"ack",		"cf_end",	"cf_end_ack"
72};
73const char *ieee80211_opmode_name[IEEE80211_OPMODE_MAX] = {
74	"IBSS",		/* IEEE80211_M_IBSS */
75	"STA",		/* IEEE80211_M_STA */
76	"WDS",		/* IEEE80211_M_WDS */
77	"AHDEMO",	/* IEEE80211_M_AHDEMO */
78	"HOSTAP",	/* IEEE80211_M_HOSTAP */
79	"MONITOR"	/* IEEE80211_M_MONITOR */
80};
81const char *ieee80211_state_name[IEEE80211_S_MAX] = {
82	"INIT",		/* IEEE80211_S_INIT */
83	"SCAN",		/* IEEE80211_S_SCAN */
84	"AUTH",		/* IEEE80211_S_AUTH */
85	"ASSOC",	/* IEEE80211_S_ASSOC */
86	"CAC",		/* IEEE80211_S_CAC */
87	"RUN",		/* IEEE80211_S_RUN */
88	"CSA",		/* IEEE80211_S_CSA */
89	"SLEEP",	/* IEEE80211_S_SLEEP */
90};
91const char *ieee80211_wme_acnames[] = {
92	"WME_AC_BE",
93	"WME_AC_BK",
94	"WME_AC_VI",
95	"WME_AC_VO",
96	"WME_UPSD",
97};
98
99static void parent_updown(void *, int);
100static int ieee80211_new_state_locked(struct ieee80211vap *,
101	enum ieee80211_state, int);
102
103static int
104null_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
105	const struct ieee80211_bpf_params *params)
106{
107	struct ifnet *ifp = ni->ni_ic->ic_ifp;
108
109	if_printf(ifp, "missing ic_raw_xmit callback, drop frame\n");
110	m_freem(m);
111	return ENETDOWN;
112}
113
114void
115ieee80211_proto_attach(struct ieee80211com *ic)
116{
117	struct ifnet *ifp = ic->ic_ifp;
118
119	/* override the 802.3 setting */
120	ifp->if_hdrlen = ic->ic_headroom
121		+ sizeof(struct ieee80211_qosframe_addr4)
122		+ IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN
123		+ IEEE80211_WEP_EXTIVLEN;
124	/* XXX no way to recalculate on ifdetach */
125	if (ALIGN(ifp->if_hdrlen) > max_linkhdr) {
126		/* XXX sanity check... */
127		max_linkhdr = ALIGN(ifp->if_hdrlen);
128		max_hdr = max_linkhdr + max_protohdr;
129		max_datalen = MHLEN - max_hdr;
130	}
131	ic->ic_protmode = IEEE80211_PROT_CTSONLY;
132
133	TASK_INIT(&ic->ic_parent_task, 0, parent_updown, ifp);
134
135	ic->ic_wme.wme_hipri_switch_hysteresis =
136		AGGRESSIVE_MODE_SWITCH_HYSTERESIS;
137
138	/* initialize management frame handlers */
139	ic->ic_send_mgmt = ieee80211_send_mgmt;
140	ic->ic_raw_xmit = null_raw_xmit;
141
142	ieee80211_adhoc_attach(ic);
143	ieee80211_sta_attach(ic);
144	ieee80211_wds_attach(ic);
145	ieee80211_hostap_attach(ic);
146	ieee80211_monitor_attach(ic);
147}
148
149void
150ieee80211_proto_detach(struct ieee80211com *ic)
151{
152	ieee80211_monitor_detach(ic);
153	ieee80211_hostap_detach(ic);
154	ieee80211_wds_detach(ic);
155	ieee80211_adhoc_detach(ic);
156	ieee80211_sta_detach(ic);
157}
158
159static void
160null_update_beacon(struct ieee80211vap *vap, int item)
161{
162}
163
164void
165ieee80211_proto_vattach(struct ieee80211vap *vap)
166{
167	struct ieee80211com *ic = vap->iv_ic;
168	struct ifnet *ifp = vap->iv_ifp;
169	int i;
170
171	/* override the 802.3 setting */
172	ifp->if_hdrlen = ic->ic_ifp->if_hdrlen;
173
174	vap->iv_rtsthreshold = IEEE80211_RTS_DEFAULT;
175	vap->iv_fragthreshold = IEEE80211_FRAG_DEFAULT;
176	vap->iv_bmiss_max = IEEE80211_BMISS_MAX;
177	callout_init(&vap->iv_swbmiss, CALLOUT_MPSAFE);
178	callout_init(&vap->iv_mgtsend, CALLOUT_MPSAFE);
179	/*
180	 * Install default tx rate handling: no fixed rate, lowest
181	 * supported rate for mgmt and multicast frames.  Default
182	 * max retry count.  These settings can be changed by the
183	 * driver and/or user applications.
184	 */
185	for (i = IEEE80211_MODE_11A; i < IEEE80211_MODE_11NA; i++) {
186		const struct ieee80211_rateset *rs = &ic->ic_sup_rates[i];
187
188		vap->iv_txparms[i].ucastrate = IEEE80211_FIXED_RATE_NONE;
189		/* NB: we default to min supported rate for channel */
190		vap->iv_txparms[i].mgmtrate =
191		    rs->rs_rates[0] & IEEE80211_RATE_VAL;
192		vap->iv_txparms[i].mcastrate =
193		    rs->rs_rates[0] & IEEE80211_RATE_VAL;
194		vap->iv_txparms[i].maxretry = IEEE80211_TXMAX_DEFAULT;
195	}
196	for (; i < IEEE80211_MODE_MAX; i++) {
197		vap->iv_txparms[i].ucastrate = IEEE80211_FIXED_RATE_NONE;
198		/* NB: default to MCS 0 */
199		vap->iv_txparms[i].mgmtrate = 0 | 0x80;
200		vap->iv_txparms[i].mcastrate = 0 | 0x80;
201		vap->iv_txparms[i].maxretry = IEEE80211_TXMAX_DEFAULT;
202	}
203	vap->iv_roaming = IEEE80211_ROAMING_AUTO;
204
205	vap->iv_update_beacon = null_update_beacon;
206	vap->iv_deliver_data = ieee80211_deliver_data;
207
208	/* attach support for operating mode */
209	ic->ic_vattach[vap->iv_opmode](vap);
210}
211
212void
213ieee80211_proto_vdetach(struct ieee80211vap *vap)
214{
215#define	FREEAPPIE(ie) do { \
216	if (ie != NULL) \
217		FREE(ie, M_80211_NODE_IE); \
218} while (0)
219	/*
220	 * Detach operating mode module.
221	 */
222	if (vap->iv_opdetach != NULL)
223		vap->iv_opdetach(vap);
224	/*
225	 * This should not be needed as we detach when reseting
226	 * the state but be conservative here since the
227	 * authenticator may do things like spawn kernel threads.
228	 */
229	if (vap->iv_auth->ia_detach != NULL)
230		vap->iv_auth->ia_detach(vap);
231	/*
232	 * Detach any ACL'ator.
233	 */
234	if (vap->iv_acl != NULL)
235		vap->iv_acl->iac_detach(vap);
236
237	FREEAPPIE(vap->iv_appie_beacon);
238	FREEAPPIE(vap->iv_appie_probereq);
239	FREEAPPIE(vap->iv_appie_proberesp);
240	FREEAPPIE(vap->iv_appie_assocreq);
241	FREEAPPIE(vap->iv_appie_assocresp);
242	FREEAPPIE(vap->iv_appie_wpa);
243#undef FREEAPPIE
244}
245
246/*
247 * Simple-minded authenticator module support.
248 */
249
250#define	IEEE80211_AUTH_MAX	(IEEE80211_AUTH_WPA+1)
251/* XXX well-known names */
252static const char *auth_modnames[IEEE80211_AUTH_MAX] = {
253	"wlan_internal",	/* IEEE80211_AUTH_NONE */
254	"wlan_internal",	/* IEEE80211_AUTH_OPEN */
255	"wlan_internal",	/* IEEE80211_AUTH_SHARED */
256	"wlan_xauth",		/* IEEE80211_AUTH_8021X	 */
257	"wlan_internal",	/* IEEE80211_AUTH_AUTO */
258	"wlan_xauth",		/* IEEE80211_AUTH_WPA */
259};
260static const struct ieee80211_authenticator *authenticators[IEEE80211_AUTH_MAX];
261
262static const struct ieee80211_authenticator auth_internal = {
263	.ia_name		= "wlan_internal",
264	.ia_attach		= NULL,
265	.ia_detach		= NULL,
266	.ia_node_join		= NULL,
267	.ia_node_leave		= NULL,
268};
269
270/*
271 * Setup internal authenticators once; they are never unregistered.
272 */
273static void
274ieee80211_auth_setup(void)
275{
276	ieee80211_authenticator_register(IEEE80211_AUTH_OPEN, &auth_internal);
277	ieee80211_authenticator_register(IEEE80211_AUTH_SHARED, &auth_internal);
278	ieee80211_authenticator_register(IEEE80211_AUTH_AUTO, &auth_internal);
279}
280SYSINIT(wlan_auth, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_auth_setup, NULL);
281
282const struct ieee80211_authenticator *
283ieee80211_authenticator_get(int auth)
284{
285	if (auth >= IEEE80211_AUTH_MAX)
286		return NULL;
287	if (authenticators[auth] == NULL)
288		ieee80211_load_module(auth_modnames[auth]);
289	return authenticators[auth];
290}
291
292void
293ieee80211_authenticator_register(int type,
294	const struct ieee80211_authenticator *auth)
295{
296	if (type >= IEEE80211_AUTH_MAX)
297		return;
298	authenticators[type] = auth;
299}
300
301void
302ieee80211_authenticator_unregister(int type)
303{
304
305	if (type >= IEEE80211_AUTH_MAX)
306		return;
307	authenticators[type] = NULL;
308}
309
310/*
311 * Very simple-minded ACL module support.
312 */
313/* XXX just one for now */
314static	const struct ieee80211_aclator *acl = NULL;
315
316void
317ieee80211_aclator_register(const struct ieee80211_aclator *iac)
318{
319	printf("wlan: %s acl policy registered\n", iac->iac_name);
320	acl = iac;
321}
322
323void
324ieee80211_aclator_unregister(const struct ieee80211_aclator *iac)
325{
326	if (acl == iac)
327		acl = NULL;
328	printf("wlan: %s acl policy unregistered\n", iac->iac_name);
329}
330
331const struct ieee80211_aclator *
332ieee80211_aclator_get(const char *name)
333{
334	if (acl == NULL)
335		ieee80211_load_module("wlan_acl");
336	return acl != NULL && strcmp(acl->iac_name, name) == 0 ? acl : NULL;
337}
338
339void
340ieee80211_print_essid(const uint8_t *essid, int len)
341{
342	const uint8_t *p;
343	int i;
344
345	if (len > IEEE80211_NWID_LEN)
346		len = IEEE80211_NWID_LEN;
347	/* determine printable or not */
348	for (i = 0, p = essid; i < len; i++, p++) {
349		if (*p < ' ' || *p > 0x7e)
350			break;
351	}
352	if (i == len) {
353		printf("\"");
354		for (i = 0, p = essid; i < len; i++, p++)
355			printf("%c", *p);
356		printf("\"");
357	} else {
358		printf("0x");
359		for (i = 0, p = essid; i < len; i++, p++)
360			printf("%02x", *p);
361	}
362}
363
364void
365ieee80211_dump_pkt(struct ieee80211com *ic,
366	const uint8_t *buf, int len, int rate, int rssi)
367{
368	const struct ieee80211_frame *wh;
369	int i;
370
371	wh = (const struct ieee80211_frame *)buf;
372	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
373	case IEEE80211_FC1_DIR_NODS:
374		printf("NODS %s", ether_sprintf(wh->i_addr2));
375		printf("->%s", ether_sprintf(wh->i_addr1));
376		printf("(%s)", ether_sprintf(wh->i_addr3));
377		break;
378	case IEEE80211_FC1_DIR_TODS:
379		printf("TODS %s", ether_sprintf(wh->i_addr2));
380		printf("->%s", ether_sprintf(wh->i_addr3));
381		printf("(%s)", ether_sprintf(wh->i_addr1));
382		break;
383	case IEEE80211_FC1_DIR_FROMDS:
384		printf("FRDS %s", ether_sprintf(wh->i_addr3));
385		printf("->%s", ether_sprintf(wh->i_addr1));
386		printf("(%s)", ether_sprintf(wh->i_addr2));
387		break;
388	case IEEE80211_FC1_DIR_DSTODS:
389		printf("DSDS %s", ether_sprintf((const uint8_t *)&wh[1]));
390		printf("->%s", ether_sprintf(wh->i_addr3));
391		printf("(%s", ether_sprintf(wh->i_addr2));
392		printf("->%s)", ether_sprintf(wh->i_addr1));
393		break;
394	}
395	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
396	case IEEE80211_FC0_TYPE_DATA:
397		printf(" data");
398		break;
399	case IEEE80211_FC0_TYPE_MGT:
400		printf(" %s", ieee80211_mgt_subtype_name[
401		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
402		    >> IEEE80211_FC0_SUBTYPE_SHIFT]);
403		break;
404	default:
405		printf(" type#%d", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
406		break;
407	}
408	if (IEEE80211_QOS_HAS_SEQ(wh)) {
409		const struct ieee80211_qosframe *qwh =
410			(const struct ieee80211_qosframe *)buf;
411		printf(" QoS [TID %u%s]", qwh->i_qos[0] & IEEE80211_QOS_TID,
412			qwh->i_qos[0] & IEEE80211_QOS_ACKPOLICY ? " ACM" : "");
413	}
414	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
415		int off;
416
417		off = ieee80211_anyhdrspace(ic, wh);
418		printf(" WEP [IV %.02x %.02x %.02x",
419			buf[off+0], buf[off+1], buf[off+2]);
420		if (buf[off+IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV)
421			printf(" %.02x %.02x %.02x",
422				buf[off+4], buf[off+5], buf[off+6]);
423		printf(" KID %u]", buf[off+IEEE80211_WEP_IVLEN] >> 6);
424	}
425	if (rate >= 0)
426		printf(" %dM", rate / 2);
427	if (rssi >= 0)
428		printf(" +%d", rssi);
429	printf("\n");
430	if (len > 0) {
431		for (i = 0; i < len; i++) {
432			if ((i & 1) == 0)
433				printf(" ");
434			printf("%02x", buf[i]);
435		}
436		printf("\n");
437	}
438}
439
440static __inline int
441findrix(const struct ieee80211_rateset *rs, int r)
442{
443	int i;
444
445	for (i = 0; i < rs->rs_nrates; i++)
446		if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == r)
447			return i;
448	return -1;
449}
450
451int
452ieee80211_fix_rate(struct ieee80211_node *ni,
453	struct ieee80211_rateset *nrs, int flags)
454{
455#define	RV(v)	((v) & IEEE80211_RATE_VAL)
456	struct ieee80211vap *vap = ni->ni_vap;
457	struct ieee80211com *ic = ni->ni_ic;
458	int i, j, rix, error;
459	int okrate, badrate, fixedrate, ucastrate;
460	const struct ieee80211_rateset *srs;
461	uint8_t r;
462
463	error = 0;
464	okrate = badrate = 0;
465	ucastrate = vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)].ucastrate;
466	if (ucastrate != IEEE80211_FIXED_RATE_NONE) {
467		/*
468		 * Workaround awkwardness with fixed rate.  We are called
469		 * to check both the legacy rate set and the HT rate set
470		 * but we must apply any legacy fixed rate check only to the
471		 * legacy rate set and vice versa.  We cannot tell what type
472		 * of rate set we've been given (legacy or HT) but we can
473		 * distinguish the fixed rate type (MCS have 0x80 set).
474		 * So to deal with this the caller communicates whether to
475		 * check MCS or legacy rate using the flags and we use the
476		 * type of any fixed rate to avoid applying an MCS to a
477		 * legacy rate and vice versa.
478		 */
479		if (ucastrate & 0x80) {
480			if (flags & IEEE80211_F_DOFRATE)
481				flags &= ~IEEE80211_F_DOFRATE;
482		} else if ((ucastrate & 0x80) == 0) {
483			if (flags & IEEE80211_F_DOFMCS)
484				flags &= ~IEEE80211_F_DOFMCS;
485		}
486		/* NB: required to make MCS match below work */
487		ucastrate &= IEEE80211_RATE_VAL;
488	}
489	fixedrate = IEEE80211_FIXED_RATE_NONE;
490	/*
491	 * XXX we are called to process both MCS and legacy rates;
492	 * we must use the appropriate basic rate set or chaos will
493	 * ensue; for now callers that want MCS must supply
494	 * IEEE80211_F_DOBRS; at some point we'll need to split this
495	 * function so there are two variants, one for MCS and one
496	 * for legacy rates.
497	 */
498	if (flags & IEEE80211_F_DOBRS)
499		srs = (const struct ieee80211_rateset *)
500		    ieee80211_get_suphtrates(ic, ni->ni_chan);
501	else
502		srs = ieee80211_get_suprates(ic, ni->ni_chan);
503	for (i = 0; i < nrs->rs_nrates; ) {
504		if (flags & IEEE80211_F_DOSORT) {
505			/*
506			 * Sort rates.
507			 */
508			for (j = i + 1; j < nrs->rs_nrates; j++) {
509				if (RV(nrs->rs_rates[i]) > RV(nrs->rs_rates[j])) {
510					r = nrs->rs_rates[i];
511					nrs->rs_rates[i] = nrs->rs_rates[j];
512					nrs->rs_rates[j] = r;
513				}
514			}
515		}
516		r = nrs->rs_rates[i] & IEEE80211_RATE_VAL;
517		badrate = r;
518		/*
519		 * Check for fixed rate.
520		 */
521		if (r == ucastrate)
522			fixedrate = r;
523		/*
524		 * Check against supported rates.
525		 */
526		rix = findrix(srs, r);
527		if (flags & IEEE80211_F_DONEGO) {
528			if (rix < 0) {
529				/*
530				 * A rate in the node's rate set is not
531				 * supported.  If this is a basic rate and we
532				 * are operating as a STA then this is an error.
533				 * Otherwise we just discard/ignore the rate.
534				 */
535				if ((flags & IEEE80211_F_JOIN) &&
536				    (nrs->rs_rates[i] & IEEE80211_RATE_BASIC))
537					error++;
538			} else if ((flags & IEEE80211_F_JOIN) == 0) {
539				/*
540				 * Overwrite with the supported rate
541				 * value so any basic rate bit is set.
542				 */
543				nrs->rs_rates[i] = srs->rs_rates[rix];
544			}
545		}
546		if ((flags & IEEE80211_F_DODEL) && rix < 0) {
547			/*
548			 * Delete unacceptable rates.
549			 */
550			nrs->rs_nrates--;
551			for (j = i; j < nrs->rs_nrates; j++)
552				nrs->rs_rates[j] = nrs->rs_rates[j + 1];
553			nrs->rs_rates[j] = 0;
554			continue;
555		}
556		if (rix >= 0)
557			okrate = nrs->rs_rates[i];
558		i++;
559	}
560	if (okrate == 0 || error != 0 ||
561	    ((flags & (IEEE80211_F_DOFRATE|IEEE80211_F_DOFMCS)) &&
562	     fixedrate != ucastrate)) {
563		IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE | IEEE80211_MSG_11N, ni,
564		    "%s: flags 0x%x okrate %d error %d fixedrate 0x%x "
565		    "ucastrate %x\n", __func__, fixedrate, ucastrate, flags);
566		return badrate | IEEE80211_RATE_BASIC;
567	} else
568		return RV(okrate);
569#undef RV
570}
571
572/*
573 * Reset 11g-related state.
574 */
575void
576ieee80211_reset_erp(struct ieee80211com *ic)
577{
578	ic->ic_flags &= ~IEEE80211_F_USEPROT;
579	ic->ic_nonerpsta = 0;
580	ic->ic_longslotsta = 0;
581	/*
582	 * Short slot time is enabled only when operating in 11g
583	 * and not in an IBSS.  We must also honor whether or not
584	 * the driver is capable of doing it.
585	 */
586	ieee80211_set_shortslottime(ic,
587		IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
588		IEEE80211_IS_CHAN_HT(ic->ic_curchan) ||
589		(IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
590		ic->ic_opmode == IEEE80211_M_HOSTAP &&
591		(ic->ic_caps & IEEE80211_C_SHSLOT)));
592	/*
593	 * Set short preamble and ERP barker-preamble flags.
594	 */
595	if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
596	    (ic->ic_caps & IEEE80211_C_SHPREAMBLE)) {
597		ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
598		ic->ic_flags &= ~IEEE80211_F_USEBARKER;
599	} else {
600		ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
601		ic->ic_flags |= IEEE80211_F_USEBARKER;
602	}
603}
604
605/*
606 * Set the short slot time state and notify the driver.
607 */
608void
609ieee80211_set_shortslottime(struct ieee80211com *ic, int onoff)
610{
611	if (onoff)
612		ic->ic_flags |= IEEE80211_F_SHSLOT;
613	else
614		ic->ic_flags &= ~IEEE80211_F_SHSLOT;
615	/* notify driver */
616	if (ic->ic_updateslot != NULL)
617		ic->ic_updateslot(ic->ic_ifp);
618}
619
620/*
621 * Check if the specified rate set supports ERP.
622 * NB: the rate set is assumed to be sorted.
623 */
624int
625ieee80211_iserp_rateset(const struct ieee80211_rateset *rs)
626{
627#define N(a)	(sizeof(a) / sizeof(a[0]))
628	static const int rates[] = { 2, 4, 11, 22, 12, 24, 48 };
629	int i, j;
630
631	if (rs->rs_nrates < N(rates))
632		return 0;
633	for (i = 0; i < N(rates); i++) {
634		for (j = 0; j < rs->rs_nrates; j++) {
635			int r = rs->rs_rates[j] & IEEE80211_RATE_VAL;
636			if (rates[i] == r)
637				goto next;
638			if (r > rates[i])
639				return 0;
640		}
641		return 0;
642	next:
643		;
644	}
645	return 1;
646#undef N
647}
648
649/*
650 * Mark the basic rates for the rate table based on the
651 * operating mode.  For real 11g we mark all the 11b rates
652 * and 6, 12, and 24 OFDM.  For 11b compatibility we mark only
653 * 11b rates.  There's also a pseudo 11a-mode used to mark only
654 * the basic OFDM rates.
655 */
656static void
657setbasicrates(struct ieee80211_rateset *rs,
658    enum ieee80211_phymode mode, int add)
659{
660	static const struct ieee80211_rateset basic[IEEE80211_MODE_MAX] = {
661	    { .rs_nrates = 0 },		/* IEEE80211_MODE_AUTO */
662	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_11A */
663	    { 2, { 2, 4 } },		/* IEEE80211_MODE_11B */
664	    { 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_11G (mixed b/g) */
665	    { .rs_nrates = 0 },		/* IEEE80211_MODE_FH */
666	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_TURBO_A */
667	    { 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_TURBO_G (mixed b/g) */
668	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_STURBO_A */
669	    { 3, { 12, 24, 48 } },	/* IEEE80211_MODE_11NA */
670	    { 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_11NG (mixed b/g) */
671	};
672	int i, j;
673
674	for (i = 0; i < rs->rs_nrates; i++) {
675		if (!add)
676			rs->rs_rates[i] &= IEEE80211_RATE_VAL;
677		for (j = 0; j < basic[mode].rs_nrates; j++)
678			if (basic[mode].rs_rates[j] == rs->rs_rates[i]) {
679				rs->rs_rates[i] |= IEEE80211_RATE_BASIC;
680				break;
681			}
682	}
683}
684
685/*
686 * Set the basic rates in a rate set.
687 */
688void
689ieee80211_setbasicrates(struct ieee80211_rateset *rs,
690    enum ieee80211_phymode mode)
691{
692	setbasicrates(rs, mode, 0);
693}
694
695/*
696 * Add basic rates to a rate set.
697 */
698void
699ieee80211_addbasicrates(struct ieee80211_rateset *rs,
700    enum ieee80211_phymode mode)
701{
702	setbasicrates(rs, mode, 1);
703}
704
705/*
706 * WME protocol support.
707 *
708 * The default 11a/b/g/n parameters come from the WiFi Alliance WMM
709 * System Interopability Test Plan (v1.4, Appendix F) and the 802.11n
710 * Draft 2.0 Test Plan (Appendix D).
711 *
712 * Static/Dynamic Turbo mode settings come from Atheros.
713 */
714typedef struct phyParamType {
715	uint8_t		aifsn;
716	uint8_t		logcwmin;
717	uint8_t		logcwmax;
718	uint16_t	txopLimit;
719	uint8_t 	acm;
720} paramType;
721
722static const struct phyParamType phyParamForAC_BE[IEEE80211_MODE_MAX] = {
723	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_AUTO */
724	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11A */
725	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11B */
726	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11G */
727	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_FH */
728	{ 2, 3,  5,  0, 0 },	/* IEEE80211_MODE_TURBO_A */
729	{ 2, 3,  5,  0, 0 },	/* IEEE80211_MODE_TURBO_G */
730	{ 2, 3,  5,  0, 0 },	/* IEEE80211_MODE_STURBO_A */
731	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11NA */
732	{ 3, 4,  6,  0, 0 },	/* IEEE80211_MODE_11NG */
733};
734static const struct phyParamType phyParamForAC_BK[IEEE80211_MODE_MAX] = {
735	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_AUTO */
736	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11A */
737	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11B */
738	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11G */
739	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_FH */
740	{ 7, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_A */
741	{ 7, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_G */
742	{ 7, 3, 10,  0, 0 },	/* IEEE80211_MODE_STURBO_A */
743	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NA */
744	{ 7, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NG */
745};
746static const struct phyParamType phyParamForAC_VI[IEEE80211_MODE_MAX] = {
747	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_AUTO */
748	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11A */
749	{ 1, 3, 4, 188, 0 },	/* IEEE80211_MODE_11B */
750	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11G */
751	{ 1, 3, 4, 188, 0 },	/* IEEE80211_MODE_FH */
752	{ 1, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_A */
753	{ 1, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_G */
754	{ 1, 2, 3,  94, 0 },	/* IEEE80211_MODE_STURBO_A */
755	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NA */
756	{ 1, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NG */
757};
758static const struct phyParamType phyParamForAC_VO[IEEE80211_MODE_MAX] = {
759	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_AUTO */
760	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11A */
761	{ 1, 2, 3, 102, 0 },	/* IEEE80211_MODE_11B */
762	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11G */
763	{ 1, 2, 3, 102, 0 },	/* IEEE80211_MODE_FH */
764	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_A */
765	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_G */
766	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_STURBO_A */
767	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NA */
768	{ 1, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NG */
769};
770
771static const struct phyParamType bssPhyParamForAC_BE[IEEE80211_MODE_MAX] = {
772	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_AUTO */
773	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11A */
774	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11B */
775	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11G */
776	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_FH */
777	{ 2, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_A */
778	{ 2, 3, 10,  0, 0 },	/* IEEE80211_MODE_TURBO_G */
779	{ 2, 3, 10,  0, 0 },	/* IEEE80211_MODE_STURBO_A */
780	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NA */
781	{ 3, 4, 10,  0, 0 },	/* IEEE80211_MODE_11NG */
782};
783static const struct phyParamType bssPhyParamForAC_VI[IEEE80211_MODE_MAX] = {
784	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_AUTO */
785	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11A */
786	{ 2, 3, 4, 188, 0 },	/* IEEE80211_MODE_11B */
787	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11G */
788	{ 2, 3, 4, 188, 0 },	/* IEEE80211_MODE_FH */
789	{ 2, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_A */
790	{ 2, 2, 3,  94, 0 },	/* IEEE80211_MODE_TURBO_G */
791	{ 2, 2, 3,  94, 0 },	/* IEEE80211_MODE_STURBO_A */
792	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NA */
793	{ 2, 3, 4,  94, 0 },	/* IEEE80211_MODE_11NG */
794};
795static const struct phyParamType bssPhyParamForAC_VO[IEEE80211_MODE_MAX] = {
796	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_AUTO */
797	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11A */
798	{ 2, 2, 3, 102, 0 },	/* IEEE80211_MODE_11B */
799	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11G */
800	{ 2, 2, 3, 102, 0 },	/* IEEE80211_MODE_FH */
801	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_A */
802	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_TURBO_G */
803	{ 1, 2, 2,  47, 0 },	/* IEEE80211_MODE_STURBO_A */
804	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NA */
805	{ 2, 2, 3,  47, 0 },	/* IEEE80211_MODE_11NG */
806};
807
808static void
809ieee80211_wme_initparams_locked(struct ieee80211vap *vap)
810{
811	struct ieee80211com *ic = vap->iv_ic;
812	struct ieee80211_wme_state *wme = &ic->ic_wme;
813	const paramType *pPhyParam, *pBssPhyParam;
814	struct wmeParams *wmep;
815	enum ieee80211_phymode mode;
816	int i;
817
818	IEEE80211_LOCK_ASSERT(ic);
819
820	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
821		return;
822
823	/*
824	 * Select mode; we can be called early in which case we
825	 * always use auto mode.  We know we'll be called when
826	 * entering the RUN state with bsschan setup properly
827	 * so state will eventually get set correctly
828	 */
829	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
830		mode = ieee80211_chan2mode(ic->ic_bsschan);
831	else
832		mode = IEEE80211_MODE_AUTO;
833	for (i = 0; i < WME_NUM_AC; i++) {
834		switch (i) {
835		case WME_AC_BK:
836			pPhyParam = &phyParamForAC_BK[mode];
837			pBssPhyParam = &phyParamForAC_BK[mode];
838			break;
839		case WME_AC_VI:
840			pPhyParam = &phyParamForAC_VI[mode];
841			pBssPhyParam = &bssPhyParamForAC_VI[mode];
842			break;
843		case WME_AC_VO:
844			pPhyParam = &phyParamForAC_VO[mode];
845			pBssPhyParam = &bssPhyParamForAC_VO[mode];
846			break;
847		case WME_AC_BE:
848		default:
849			pPhyParam = &phyParamForAC_BE[mode];
850			pBssPhyParam = &bssPhyParamForAC_BE[mode];
851			break;
852		}
853
854		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
855		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
856			wmep->wmep_acm = pPhyParam->acm;
857			wmep->wmep_aifsn = pPhyParam->aifsn;
858			wmep->wmep_logcwmin = pPhyParam->logcwmin;
859			wmep->wmep_logcwmax = pPhyParam->logcwmax;
860			wmep->wmep_txopLimit = pPhyParam->txopLimit;
861		} else {
862			wmep->wmep_acm = pBssPhyParam->acm;
863			wmep->wmep_aifsn = pBssPhyParam->aifsn;
864			wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
865			wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
866			wmep->wmep_txopLimit = pBssPhyParam->txopLimit;
867
868		}
869		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
870			"%s: %s chan [acm %u aifsn %u log2(cwmin) %u "
871			"log2(cwmax) %u txpoLimit %u]\n", __func__
872			, ieee80211_wme_acnames[i]
873			, wmep->wmep_acm
874			, wmep->wmep_aifsn
875			, wmep->wmep_logcwmin
876			, wmep->wmep_logcwmax
877			, wmep->wmep_txopLimit
878		);
879
880		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
881		wmep->wmep_acm = pBssPhyParam->acm;
882		wmep->wmep_aifsn = pBssPhyParam->aifsn;
883		wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
884		wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
885		wmep->wmep_txopLimit = pBssPhyParam->txopLimit;
886		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
887			"%s: %s  bss [acm %u aifsn %u log2(cwmin) %u "
888			"log2(cwmax) %u txpoLimit %u]\n", __func__
889			, ieee80211_wme_acnames[i]
890			, wmep->wmep_acm
891			, wmep->wmep_aifsn
892			, wmep->wmep_logcwmin
893			, wmep->wmep_logcwmax
894			, wmep->wmep_txopLimit
895		);
896	}
897	/* NB: check ic_bss to avoid NULL deref on initial attach */
898	if (vap->iv_bss != NULL) {
899		/*
900		 * Calculate agressive mode switching threshold based
901		 * on beacon interval.  This doesn't need locking since
902		 * we're only called before entering the RUN state at
903		 * which point we start sending beacon frames.
904		 */
905		wme->wme_hipri_switch_thresh =
906			(HIGH_PRI_SWITCH_THRESH * vap->iv_bss->ni_intval) / 100;
907		ieee80211_wme_updateparams(vap);
908	}
909}
910
911void
912ieee80211_wme_initparams(struct ieee80211vap *vap)
913{
914	struct ieee80211com *ic = vap->iv_ic;
915
916	IEEE80211_LOCK(ic);
917	ieee80211_wme_initparams_locked(vap);
918	IEEE80211_UNLOCK(ic);
919}
920
921/*
922 * Update WME parameters for ourself and the BSS.
923 */
924void
925ieee80211_wme_updateparams_locked(struct ieee80211vap *vap)
926{
927	static const paramType phyParam[IEEE80211_MODE_MAX] = {
928		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_AUTO */
929		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11A */
930		{ 2, 5, 10, 64, 0 },	/* IEEE80211_MODE_11B */
931		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11G */
932		{ 2, 5, 10, 64, 0 },	/* IEEE80211_MODE_FH */
933		{ 1, 3, 10, 64, 0 },	/* IEEE80211_MODE_TURBO_A */
934		{ 1, 3, 10, 64, 0 },	/* IEEE80211_MODE_TURBO_G */
935		{ 1, 3, 10, 64, 0 },	/* IEEE80211_MODE_STURBO_A */
936		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11NA */ /*XXXcheck*/
937		{ 2, 4, 10, 64, 0 },	/* IEEE80211_MODE_11NG */ /*XXXcheck*/
938	};
939	struct ieee80211com *ic = vap->iv_ic;
940	struct ieee80211_wme_state *wme = &ic->ic_wme;
941	const struct wmeParams *wmep;
942	struct wmeParams *chanp, *bssp;
943	enum ieee80211_phymode mode;
944	int i;
945
946       	/* set up the channel access parameters for the physical device */
947	for (i = 0; i < WME_NUM_AC; i++) {
948		chanp = &wme->wme_chanParams.cap_wmeParams[i];
949		wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
950		chanp->wmep_aifsn = wmep->wmep_aifsn;
951		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
952		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
953		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
954
955		chanp = &wme->wme_bssChanParams.cap_wmeParams[i];
956		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
957		chanp->wmep_aifsn = wmep->wmep_aifsn;
958		chanp->wmep_logcwmin = wmep->wmep_logcwmin;
959		chanp->wmep_logcwmax = wmep->wmep_logcwmax;
960		chanp->wmep_txopLimit = wmep->wmep_txopLimit;
961	}
962
963	/*
964	 * Select mode; we can be called early in which case we
965	 * always use auto mode.  We know we'll be called when
966	 * entering the RUN state with bsschan setup properly
967	 * so state will eventually get set correctly
968	 */
969	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
970		mode = ieee80211_chan2mode(ic->ic_bsschan);
971	else
972		mode = IEEE80211_MODE_AUTO;
973
974	/*
975	 * This implements agressive mode as found in certain
976	 * vendors' AP's.  When there is significant high
977	 * priority (VI/VO) traffic in the BSS throttle back BE
978	 * traffic by using conservative parameters.  Otherwise
979	 * BE uses agressive params to optimize performance of
980	 * legacy/non-QoS traffic.
981	 */
982        if ((vap->iv_opmode == IEEE80211_M_HOSTAP &&
983	     (wme->wme_flags & WME_F_AGGRMODE) != 0) ||
984	    (vap->iv_opmode == IEEE80211_M_STA &&
985	     (vap->iv_bss->ni_flags & IEEE80211_NODE_QOS) == 0) ||
986	    (vap->iv_flags & IEEE80211_F_WME) == 0) {
987		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
988		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
989
990		chanp->wmep_aifsn = bssp->wmep_aifsn = phyParam[mode].aifsn;
991		chanp->wmep_logcwmin = bssp->wmep_logcwmin =
992			phyParam[mode].logcwmin;
993		chanp->wmep_logcwmax = bssp->wmep_logcwmax =
994			phyParam[mode].logcwmax;
995		chanp->wmep_txopLimit = bssp->wmep_txopLimit =
996			(vap->iv_flags & IEEE80211_F_BURST) ?
997				phyParam[mode].txopLimit : 0;
998		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
999			"%s: %s [acm %u aifsn %u log2(cwmin) %u "
1000			"log2(cwmax) %u txpoLimit %u]\n", __func__
1001			, ieee80211_wme_acnames[WME_AC_BE]
1002			, chanp->wmep_acm
1003			, chanp->wmep_aifsn
1004			, chanp->wmep_logcwmin
1005			, chanp->wmep_logcwmax
1006			, chanp->wmep_txopLimit
1007		);
1008	}
1009
1010	/* XXX multi-bss */
1011	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1012	    ic->ic_sta_assoc < 2 && (wme->wme_flags & WME_F_AGGRMODE) != 0) {
1013        	static const uint8_t logCwMin[IEEE80211_MODE_MAX] = {
1014              		3,	/* IEEE80211_MODE_AUTO */
1015              		3,	/* IEEE80211_MODE_11A */
1016              		4,	/* IEEE80211_MODE_11B */
1017              		3,	/* IEEE80211_MODE_11G */
1018              		4,	/* IEEE80211_MODE_FH */
1019              		3,	/* IEEE80211_MODE_TURBO_A */
1020              		3,	/* IEEE80211_MODE_TURBO_G */
1021              		3,	/* IEEE80211_MODE_STURBO_A */
1022              		3,	/* IEEE80211_MODE_11NA */
1023              		3,	/* IEEE80211_MODE_11NG */
1024		};
1025		chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
1026		bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];
1027
1028		chanp->wmep_logcwmin = bssp->wmep_logcwmin = logCwMin[mode];
1029		IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1030			"%s: %s log2(cwmin) %u\n", __func__
1031			, ieee80211_wme_acnames[WME_AC_BE]
1032			, chanp->wmep_logcwmin
1033		);
1034    	}
1035	if (vap->iv_opmode == IEEE80211_M_HOSTAP) {	/* XXX ibss? */
1036		/*
1037		 * Arrange for a beacon update and bump the parameter
1038		 * set number so associated stations load the new values.
1039		 */
1040		wme->wme_bssChanParams.cap_info =
1041			(wme->wme_bssChanParams.cap_info+1) & WME_QOSINFO_COUNT;
1042		ieee80211_beacon_notify(vap, IEEE80211_BEACON_WME);
1043	}
1044
1045	wme->wme_update(ic);
1046
1047	IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1048		"%s: WME params updated, cap_info 0x%x\n", __func__,
1049		vap->iv_opmode == IEEE80211_M_STA ?
1050			wme->wme_wmeChanParams.cap_info :
1051			wme->wme_bssChanParams.cap_info);
1052}
1053
1054void
1055ieee80211_wme_updateparams(struct ieee80211vap *vap)
1056{
1057	struct ieee80211com *ic = vap->iv_ic;
1058
1059	if (ic->ic_caps & IEEE80211_C_WME) {
1060		IEEE80211_LOCK(ic);
1061		ieee80211_wme_updateparams_locked(vap);
1062		IEEE80211_UNLOCK(ic);
1063	}
1064}
1065
1066static void
1067parent_updown(void *arg, int npending)
1068{
1069	struct ifnet *parent = arg;
1070
1071	parent->if_ioctl(parent, SIOCSIFFLAGS, NULL);
1072}
1073
1074/*
1075 * Start a vap running.  If this is the first vap to be
1076 * set running on the underlying device then we
1077 * automatically bring the device up.
1078 */
1079void
1080ieee80211_start_locked(struct ieee80211vap *vap)
1081{
1082	struct ifnet *ifp = vap->iv_ifp;
1083	struct ieee80211com *ic = vap->iv_ic;
1084	struct ifnet *parent = ic->ic_ifp;
1085
1086	IEEE80211_LOCK_ASSERT(ic);
1087
1088	IEEE80211_DPRINTF(vap,
1089		IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1090		"start running, %d vaps running\n", ic->ic_nrunning);
1091
1092	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1093		/*
1094		 * Mark us running.  Note that it's ok to do this first;
1095		 * if we need to bring the parent device up we defer that
1096		 * to avoid dropping the com lock.  We expect the device
1097		 * to respond to being marked up by calling back into us
1098		 * through ieee80211_start_all at which point we'll come
1099		 * back in here and complete the work.
1100		 */
1101		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1102		/*
1103		 * We are not running; if this we are the first vap
1104		 * to be brought up auto-up the parent if necessary.
1105		 */
1106		if (ic->ic_nrunning++ == 0 &&
1107		    (parent->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1108			IEEE80211_DPRINTF(vap,
1109			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1110			    "%s: up parent %s\n", __func__, parent->if_xname);
1111			parent->if_flags |= IFF_UP;
1112			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1113			return;
1114		}
1115	}
1116	/*
1117	 * If the parent is up and running, then kick the
1118	 * 802.11 state machine as appropriate.
1119	 */
1120	if ((parent->if_drv_flags & IFF_DRV_RUNNING) &&
1121	    vap->iv_roaming != IEEE80211_ROAMING_MANUAL) {
1122		if (vap->iv_opmode == IEEE80211_M_STA) {
1123#if 0
1124			/* XXX bypasses scan too easily; disable for now */
1125			/*
1126			 * Try to be intelligent about clocking the state
1127			 * machine.  If we're currently in RUN state then
1128			 * we should be able to apply any new state/parameters
1129			 * simply by re-associating.  Otherwise we need to
1130			 * re-scan to select an appropriate ap.
1131			 */
1132			if (vap->iv_state >= IEEE80211_S_RUN)
1133				ieee80211_new_state_locked(vap,
1134				    IEEE80211_S_ASSOC, 1);
1135			else
1136#endif
1137				ieee80211_new_state_locked(vap,
1138				    IEEE80211_S_SCAN, 0);
1139		} else {
1140			/*
1141			 * For monitor+wds mode there's nothing to do but
1142			 * start running.  Otherwise if this is the first
1143			 * vap to be brought up, start a scan which may be
1144			 * preempted if the station is locked to a particular
1145			 * channel.
1146			 */
1147			/* XXX needed? */
1148			ieee80211_new_state_locked(vap, IEEE80211_S_INIT, 0);
1149			if (vap->iv_opmode == IEEE80211_M_MONITOR ||
1150			    vap->iv_opmode == IEEE80211_M_WDS)
1151				ieee80211_new_state_locked(vap,
1152				    IEEE80211_S_RUN, -1);
1153			else
1154				ieee80211_new_state_locked(vap,
1155				    IEEE80211_S_SCAN, 0);
1156		}
1157	}
1158}
1159
1160/*
1161 * Start a single vap.
1162 */
1163void
1164ieee80211_init(void *arg)
1165{
1166	struct ieee80211vap *vap = arg;
1167
1168	/*
1169	 * This routine is publicly accessible through the vap's
1170	 * if_init method so guard against calls during detach.
1171	 * ieee80211_vap_detach null's the backpointer before
1172	 * tearing down state to signal any callback should be
1173	 * rejected/ignored.
1174	 */
1175	if (vap != NULL) {
1176		IEEE80211_DPRINTF(vap,
1177		    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1178		    "%s\n", __func__);
1179
1180		IEEE80211_LOCK(vap->iv_ic);
1181		ieee80211_start_locked(vap);
1182		IEEE80211_UNLOCK(vap->iv_ic);
1183	}
1184}
1185
1186/*
1187 * Start all runnable vap's on a device.
1188 */
1189void
1190ieee80211_start_all(struct ieee80211com *ic)
1191{
1192	struct ieee80211vap *vap;
1193
1194	IEEE80211_LOCK(ic);
1195	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1196		struct ifnet *ifp = vap->iv_ifp;
1197		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1198			ieee80211_start_locked(vap);
1199	}
1200	IEEE80211_UNLOCK(ic);
1201}
1202
1203/*
1204 * Stop a vap.  We force it down using the state machine
1205 * then mark it's ifnet not running.  If this is the last
1206 * vap running on the underlying device then we close it
1207 * too to insure it will be properly initialized when the
1208 * next vap is brought up.
1209 */
1210void
1211ieee80211_stop_locked(struct ieee80211vap *vap)
1212{
1213	struct ieee80211com *ic = vap->iv_ic;
1214	struct ifnet *ifp = vap->iv_ifp;
1215	struct ifnet *parent = ic->ic_ifp;
1216
1217	IEEE80211_LOCK_ASSERT(ic);
1218
1219	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1220	    "stop running, %d vaps running\n", ic->ic_nrunning);
1221
1222	ieee80211_new_state_locked(vap, IEEE80211_S_INIT, -1);
1223	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1224		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;	/* mark us stopped */
1225		if (--ic->ic_nrunning == 0 &&
1226		    (parent->if_drv_flags & IFF_DRV_RUNNING)) {
1227			IEEE80211_DPRINTF(vap,
1228			    IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
1229			    "down parent %s\n", parent->if_xname);
1230			parent->if_flags &= ~IFF_UP;
1231			taskqueue_enqueue(taskqueue_thread, &ic->ic_parent_task);
1232		}
1233	}
1234}
1235
1236void
1237ieee80211_stop(struct ieee80211vap *vap)
1238{
1239	struct ieee80211com *ic = vap->iv_ic;
1240
1241	IEEE80211_LOCK(ic);
1242	ieee80211_stop_locked(vap);
1243	IEEE80211_UNLOCK(ic);
1244}
1245
1246/*
1247 * Stop all vap's running on a device.
1248 */
1249void
1250ieee80211_stop_all(struct ieee80211com *ic)
1251{
1252	struct ieee80211vap *vap;
1253
1254	IEEE80211_LOCK(ic);
1255	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1256		struct ifnet *ifp = vap->iv_ifp;
1257		if (IFNET_IS_UP_RUNNING(ifp))	/* NB: avoid recursion */
1258			ieee80211_stop_locked(vap);
1259	}
1260	IEEE80211_UNLOCK(ic);
1261}
1262
1263/*
1264 * Switch between turbo and non-turbo operating modes.
1265 * Use the specified channel flags to locate the new
1266 * channel, update 802.11 state, and then call back into
1267 * the driver to effect the change.
1268 */
1269void
1270ieee80211_dturbo_switch(struct ieee80211vap *vap, int newflags)
1271{
1272	struct ieee80211com *ic = vap->iv_ic;
1273	struct ieee80211_channel *chan;
1274
1275	chan = ieee80211_find_channel(ic, ic->ic_bsschan->ic_freq, newflags);
1276	if (chan == NULL) {		/* XXX should not happen */
1277		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1278		    "%s: no channel with freq %u flags 0x%x\n",
1279		    __func__, ic->ic_bsschan->ic_freq, newflags);
1280		return;
1281	}
1282
1283	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1284	    "%s: %s -> %s (freq %u flags 0x%x)\n", __func__,
1285	    ieee80211_phymode_name[ieee80211_chan2mode(ic->ic_bsschan)],
1286	    ieee80211_phymode_name[ieee80211_chan2mode(chan)],
1287	    chan->ic_freq, chan->ic_flags);
1288
1289	ic->ic_bsschan = chan;
1290	ic->ic_prevchan = ic->ic_curchan;
1291	ic->ic_curchan = chan;
1292	ic->ic_set_channel(ic);
1293	/* NB: do not need to reset ERP state 'cuz we're in sta mode */
1294}
1295
1296void
1297ieee80211_beacon_miss(struct ieee80211com *ic)
1298{
1299	struct ieee80211vap *vap;
1300
1301	if (ic->ic_flags & IEEE80211_F_SCAN)
1302		return;
1303	/* XXX locking */
1304	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1305		/*
1306		 * We only pass events through for sta vap's in RUN state;
1307		 * may be too restrictive but for now this saves all the
1308		 * handlers duplicating these checks.
1309		 */
1310		if (vap->iv_opmode == IEEE80211_M_STA &&
1311		    vap->iv_state == IEEE80211_S_RUN &&
1312		    vap->iv_bmiss != NULL)
1313			vap->iv_bmiss(vap);
1314	}
1315}
1316
1317/*
1318 * Software beacon miss handling.  Check if any beacons
1319 * were received in the last period.  If not post a
1320 * beacon miss; otherwise reset the counter.
1321 */
1322void
1323ieee80211_swbmiss(void *arg)
1324{
1325	struct ieee80211vap *vap = arg;
1326
1327	if (vap->iv_swbmiss_count == 0) {
1328		if (vap->iv_bmiss != NULL)
1329			vap->iv_bmiss(vap);
1330		if (vap->iv_bmiss_count == 0)	/* don't re-arm timer */
1331			return;
1332	} else
1333		vap->iv_swbmiss_count = 0;
1334	callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
1335		ieee80211_swbmiss, vap);
1336}
1337
1338/*
1339 * Start an 802.11h channel switch.  We record the parameters,
1340 * mark the operation pending, notify each vap through the
1341 * beacon update mechanism so it can update the beacon frame
1342 * contents, and then switch vap's to CSA state to block outbound
1343 * traffic.  Devices that handle CSA directly can use the state
1344 * switch to do the right thing so long as they call
1345 * ieee80211_csa_completeswitch when it's time to complete the
1346 * channel change.  Devices that depend on the net80211 layer can
1347 * use ieee80211_beacon_update to handle the countdown and the
1348 * channel switch.
1349 */
1350void
1351ieee80211_csa_startswitch(struct ieee80211com *ic,
1352	struct ieee80211_channel *c, int mode, int count)
1353{
1354	struct ieee80211vap *vap;
1355
1356	IEEE80211_LOCK_ASSERT(ic);
1357
1358	ic->ic_csa_newchan = c;
1359	ic->ic_csa_count = count;
1360	/* XXX record mode? */
1361	ic->ic_flags |= IEEE80211_F_CSAPENDING;
1362	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1363		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1364		    vap->iv_opmode == IEEE80211_M_IBSS)
1365			ieee80211_beacon_notify(vap, IEEE80211_BEACON_CSA);
1366		/* switch to CSA state to block outbound traffic */
1367		if (vap->iv_state == IEEE80211_S_RUN)
1368			ieee80211_new_state_locked(vap, IEEE80211_S_CSA, 0);
1369	}
1370	ieee80211_notify_csa(ic, c, mode, count);
1371}
1372
1373/*
1374 * Complete an 802.11h channel switch started by ieee80211_csa_startswitch.
1375 * We clear state and move all vap's in CSA state to RUN state
1376 * so they can again transmit.
1377 */
1378void
1379ieee80211_csa_completeswitch(struct ieee80211com *ic)
1380{
1381	struct ieee80211vap *vap;
1382
1383	IEEE80211_LOCK_ASSERT(ic);
1384
1385	KASSERT(ic->ic_flags & IEEE80211_F_CSAPENDING, ("csa not pending"));
1386
1387	ieee80211_setcurchan(ic, ic->ic_csa_newchan);
1388	ic->ic_csa_newchan = NULL;
1389	ic->ic_flags &= ~IEEE80211_F_CSAPENDING;
1390
1391	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1392		if (vap->iv_state == IEEE80211_S_CSA)
1393			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1394}
1395
1396/*
1397 * Complete a DFS CAC started by ieee80211_dfs_cac_start.
1398 * We clear state and move all vap's in CAC state to RUN state.
1399 */
1400void
1401ieee80211_cac_completeswitch(struct ieee80211vap *vap0)
1402{
1403	struct ieee80211com *ic = vap0->iv_ic;
1404	struct ieee80211vap *vap;
1405
1406	IEEE80211_LOCK(ic);
1407	/*
1408	 * Complete CAC state change for lead vap first; then
1409	 * clock all the other vap's waiting.
1410	 */
1411	KASSERT(vap0->iv_state == IEEE80211_S_CAC,
1412	    ("wrong state %d", vap0->iv_state));
1413	ieee80211_new_state_locked(vap0, IEEE80211_S_RUN, 0);
1414
1415	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1416		if (vap->iv_state == IEEE80211_S_CAC)
1417			ieee80211_new_state_locked(vap, IEEE80211_S_RUN, 0);
1418	IEEE80211_UNLOCK(ic);
1419}
1420
1421/*
1422 * Force all vap's other than the specified vap to the INIT state
1423 * and mark them as waiting for a scan to complete.  These vaps
1424 * will be brought up when the scan completes and the scanning vap
1425 * reaches RUN state by wakeupwaiting.
1426 * XXX if we do this in threads we can use sleep/wakeup.
1427 */
1428static void
1429markwaiting(struct ieee80211vap *vap0)
1430{
1431	struct ieee80211com *ic = vap0->iv_ic;
1432	struct ieee80211vap *vap;
1433
1434	IEEE80211_LOCK_ASSERT(ic);
1435
1436	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1437		if (vap == vap0)
1438			continue;
1439		if (vap->iv_state != IEEE80211_S_INIT) {
1440			vap->iv_newstate(vap, IEEE80211_S_INIT, 0);
1441			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1442		}
1443	}
1444}
1445
1446/*
1447 * Wakeup all vap's waiting for a scan to complete.  This is the
1448 * companion to markwaiting (above) and is used to coordinate
1449 * multiple vaps scanning.
1450 */
1451static void
1452wakeupwaiting(struct ieee80211vap *vap0)
1453{
1454	struct ieee80211com *ic = vap0->iv_ic;
1455	struct ieee80211vap *vap;
1456
1457	IEEE80211_LOCK_ASSERT(ic);
1458
1459	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1460		if (vap == vap0)
1461			continue;
1462		if (vap->iv_flags_ext & IEEE80211_FEXT_SCANWAIT) {
1463			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1464			/* NB: sta's cannot go INIT->RUN */
1465			vap->iv_newstate(vap,
1466			    vap->iv_opmode == IEEE80211_M_STA ?
1467			        IEEE80211_S_SCAN : IEEE80211_S_RUN, 0);
1468		}
1469	}
1470}
1471
1472/*
1473 * Handle post state change work common to all operating modes.
1474 */
1475static void
1476ieee80211_newstate_cb(struct ieee80211vap *vap,
1477	enum ieee80211_state nstate, int arg)
1478{
1479	struct ieee80211com *ic = vap->iv_ic;
1480
1481	IEEE80211_LOCK_ASSERT(ic);
1482
1483	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1484	    "%s: %s arg %d\n", __func__, ieee80211_state_name[nstate], arg);
1485
1486	if (nstate == IEEE80211_S_RUN) {
1487		/*
1488		 * OACTIVE may be set on the vap if the upper layer
1489		 * tried to transmit (e.g. IPv6 NDP) before we reach
1490		 * RUN state.  Clear it and restart xmit.
1491		 *
1492		 * Note this can also happen as a result of SLEEP->RUN
1493		 * (i.e. coming out of power save mode).
1494		 */
1495		vap->iv_ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1496		if_start(vap->iv_ifp);
1497
1498		/* bring up any vaps waiting on us */
1499		wakeupwaiting(vap);
1500	} else if (nstate == IEEE80211_S_INIT) {
1501		/*
1502		 * Flush the scan cache if we did the last scan (XXX?)
1503		 * and flush any frames on send queues from this vap.
1504		 * Note the mgt q is used only for legacy drivers and
1505		 * will go away shortly.
1506		 */
1507		ieee80211_scan_flush(vap);
1508
1509		/* XXX NB: cast for altq */
1510		ieee80211_flush_ifq((struct ifqueue *)&ic->ic_ifp->if_snd, vap);
1511	}
1512	vap->iv_newstate_cb = NULL;
1513}
1514
1515/*
1516 * Public interface for initiating a state machine change.
1517 * This routine single-threads the request and coordinates
1518 * the scheduling of multiple vaps for the purpose of selecting
1519 * an operating channel.  Specifically the following scenarios
1520 * are handled:
1521 * o only one vap can be selecting a channel so on transition to
1522 *   SCAN state if another vap is already scanning then
1523 *   mark the caller for later processing and return without
1524 *   doing anything (XXX? expectations by caller of synchronous operation)
1525 * o only one vap can be doing CAC of a channel so on transition to
1526 *   CAC state if another vap is already scanning for radar then
1527 *   mark the caller for later processing and return without
1528 *   doing anything (XXX? expectations by caller of synchronous operation)
1529 * o if another vap is already running when a request is made
1530 *   to SCAN then an operating channel has been chosen; bypass
1531 *   the scan and just join the channel
1532 *
1533 * Note that the state change call is done through the iv_newstate
1534 * method pointer so any driver routine gets invoked.  The driver
1535 * will normally call back into operating mode-specific
1536 * ieee80211_newstate routines (below) unless it needs to completely
1537 * bypass the state machine (e.g. because the firmware has it's
1538 * own idea how things should work).  Bypassing the net80211 layer
1539 * is usually a mistake and indicates lack of proper integration
1540 * with the net80211 layer.
1541 */
1542static int
1543ieee80211_new_state_locked(struct ieee80211vap *vap,
1544	enum ieee80211_state nstate, int arg)
1545{
1546	struct ieee80211com *ic = vap->iv_ic;
1547	struct ieee80211vap *vp;
1548	enum ieee80211_state ostate;
1549	int nrunning, nscanning, rc;
1550
1551	IEEE80211_LOCK_ASSERT(ic);
1552
1553	nrunning = nscanning = 0;
1554	/* XXX can track this state instead of calculating */
1555	TAILQ_FOREACH(vp, &ic->ic_vaps, iv_next) {
1556		if (vp != vap) {
1557			if (vp->iv_state >= IEEE80211_S_RUN)
1558				nrunning++;
1559			/* XXX doesn't handle bg scan */
1560			/* NB: CAC+AUTH+ASSOC treated like SCAN */
1561			else if (vp->iv_state > IEEE80211_S_INIT)
1562				nscanning++;
1563		}
1564	}
1565	ostate = vap->iv_state;
1566	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1567	    "%s: %s -> %s (nrunning %d nscanning %d)\n", __func__,
1568	    ieee80211_state_name[ostate], ieee80211_state_name[nstate],
1569	    nrunning, nscanning);
1570	switch (nstate) {
1571	case IEEE80211_S_SCAN:
1572		if (ostate == IEEE80211_S_INIT) {
1573			/*
1574			 * INIT -> SCAN happens on initial bringup.
1575			 */
1576			KASSERT(!(nscanning && nrunning),
1577			    ("%d scanning and %d running", nscanning, nrunning));
1578			if (nscanning) {
1579				/*
1580				 * Someone is scanning, defer our state
1581				 * change until the work has completed.
1582				 */
1583				IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1584				    "%s: defer %s -> %s\n",
1585				    __func__, ieee80211_state_name[ostate],
1586				    ieee80211_state_name[nstate]);
1587				vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1588				rc = 0;
1589				goto done;
1590			}
1591			if (nrunning) {
1592				/*
1593				 * Someone is operating; just join the channel
1594				 * they have chosen.
1595				 */
1596				/* XXX kill arg? */
1597				/* XXX check each opmode, adhoc? */
1598				if (vap->iv_opmode == IEEE80211_M_STA)
1599					nstate = IEEE80211_S_SCAN;
1600				else
1601					nstate = IEEE80211_S_RUN;
1602#ifdef IEEE80211_DEBUG
1603				if (nstate != IEEE80211_S_SCAN) {
1604					IEEE80211_DPRINTF(vap,
1605					    IEEE80211_MSG_STATE,
1606					    "%s: override, now %s -> %s\n",
1607					    __func__,
1608					    ieee80211_state_name[ostate],
1609					    ieee80211_state_name[nstate]);
1610				}
1611#endif
1612			}
1613		} else {
1614			/*
1615			 * SCAN was forced; e.g. on beacon miss.  Force
1616			 * other running vap's to INIT state and mark
1617			 * them as waiting for the scan to complete.  This
1618			 * insures they don't interfere with our scanning.
1619			 *
1620			 * XXX not always right, assumes ap follows sta
1621			 */
1622			markwaiting(vap);
1623		}
1624		break;
1625	case IEEE80211_S_RUN:
1626		if (vap->iv_opmode == IEEE80211_M_WDS &&
1627		    (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY) &&
1628		    nscanning) {
1629			/*
1630			 * Legacy WDS with someone else scanning; don't
1631			 * go online until that completes as we should
1632			 * follow the other vap to the channel they choose.
1633			 */
1634			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1635			     "%s: defer %s -> %s (legacy WDS)\n", __func__,
1636			     ieee80211_state_name[ostate],
1637			     ieee80211_state_name[nstate]);
1638			vap->iv_flags_ext |= IEEE80211_FEXT_SCANWAIT;
1639			rc = 0;
1640			goto done;
1641		}
1642		if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1643		    IEEE80211_IS_CHAN_DFS(ic->ic_bsschan) &&
1644		    (vap->iv_flags_ext & IEEE80211_FEXT_DFS) &&
1645		    !IEEE80211_IS_CHAN_CACDONE(ic->ic_bsschan)) {
1646			/*
1647			 * This is a DFS channel, transition to CAC state
1648			 * instead of RUN.  This allows us to initiate
1649			 * Channel Availability Check (CAC) as specified
1650			 * by 11h/DFS.
1651			 */
1652			nstate = IEEE80211_S_CAC;
1653			IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
1654			     "%s: override %s -> %s (DFS)\n", __func__,
1655			     ieee80211_state_name[ostate],
1656			     ieee80211_state_name[nstate]);
1657		}
1658		break;
1659	case IEEE80211_S_INIT:
1660		if (ostate == IEEE80211_S_INIT ) {
1661			/* XXX don't believe this */
1662			/* INIT -> INIT. nothing to do */
1663			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANWAIT;
1664		}
1665		/* fall thru... */
1666	default:
1667		break;
1668	}
1669	/* XXX on transition RUN->CAC do we need to set nstate = iv_state? */
1670	if (ostate != nstate) {
1671		/*
1672		 * Arrange for work to happen after state change completes.
1673		 * If this happens asynchronously the caller must arrange
1674		 * for the com lock to be held.
1675		 */
1676		vap->iv_newstate_cb = ieee80211_newstate_cb;
1677	}
1678	rc = vap->iv_newstate(vap, nstate, arg);
1679	if (rc == 0 && vap->iv_newstate_cb != NULL)
1680		vap->iv_newstate_cb(vap, nstate, arg);
1681done:
1682	return rc;
1683}
1684
1685int
1686ieee80211_new_state(struct ieee80211vap *vap,
1687	enum ieee80211_state nstate, int arg)
1688{
1689	struct ieee80211com *ic = vap->iv_ic;
1690	int rc;
1691
1692	IEEE80211_LOCK(ic);
1693	rc = ieee80211_new_state_locked(vap, nstate, arg);
1694	IEEE80211_UNLOCK(ic);
1695	return rc;
1696}
1697