io/net80211/net80211_proto.c

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
 */

/*
 * Copyright (c) 2001 Atsushi Onoe
 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * Alternatively, this software may be distributed under the terms of the
 * GNU General Public License ("GPL") version 2 as published by the Free
 * Software Foundation.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * IEEE 802.11 protocol support
 */

#include "net80211_impl.h"

/* tunables */
#define AGGRESSIVE_MODE_SWITCH_HYSTERESIS   3   /* pkts / 100ms */
#define HIGH_PRI_SWITCH_THRESH          10  /* pkts / 100ms */

#define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)

const char *ieee80211_mgt_subtype_name[] = {
    "assoc_req",    "assoc_resp",   "reassoc_req",  "reassoc_resp",
    "probe_req",    "probe_resp",   "reserved#6",   "reserved#7",
    "beacon",   "atim",     "disassoc", "auth",
    "deauth",   "reserved#13",  "reserved#14",  "reserved#15"
};
const char *ieee80211_ctl_subtype_name[] = {
    "reserved#0",   "reserved#1",   "reserved#2",   "reserved#3",
    "reserved#3",   "reserved#5",   "reserved#6",   "reserved#7",
    "reserved#8",   "reserved#9",   "ps_poll",  "rts",
    "cts",      "ack",      "cf_end",   "cf_end_ack"
};
const char *ieee80211_state_name[IEEE80211_S_MAX] = {
    "INIT",     /* IEEE80211_S_INIT */
    "SCAN",     /* IEEE80211_S_SCAN */
    "AUTH",     /* IEEE80211_S_AUTH */
    "ASSOC",    /* IEEE80211_S_ASSOC */
    "RUN"       /* IEEE80211_S_RUN */
};
const char *ieee80211_wme_acnames[] = {
    "WME_AC_BE",
    "WME_AC_BK",
    "WME_AC_VI",
    "WME_AC_VO",
    "WME_UPSD",
};

static int ieee80211_newstate(ieee80211com_t *, enum ieee80211_state, int);

/*
 * Initialize the interface softc, ic, with protocol management
 * related data structures and functions.
 */
void
ieee80211_proto_attach(ieee80211com_t *ic)
{
    struct ieee80211_impl *im = ic->ic_private;

    ic->ic_rtsthreshold = IEEE80211_RTS_DEFAULT;
    ic->ic_fragthreshold = IEEE80211_FRAG_DEFAULT;
    ic->ic_fixed_rate = IEEE80211_FIXED_RATE_NONE;
    ic->ic_protmode = IEEE80211_PROT_CTSONLY;
    im->im_bmiss_max = IEEE80211_BMISS_MAX;

    ic->ic_wme.wme_hipri_switch_hysteresis =
        AGGRESSIVE_MODE_SWITCH_HYSTERESIS;

    /* protocol state change handler */
    ic->ic_newstate = ieee80211_newstate;

    /* initialize management frame handlers */
    ic->ic_recv_mgmt = ieee80211_recv_mgmt;
    ic->ic_send_mgmt = ieee80211_send_mgmt;
}

/*
 * Print a 802.11 frame header
 */
void
ieee80211_dump_pkt(const uint8_t *buf, int32_t len, int32_t rate, int32_t rssi)
{
    struct ieee80211_frame *wh;
    int8_t buf1[100];
    int8_t buf2[25];
    int i;

    bzero(buf1, sizeof (buf1));
    bzero(buf2, sizeof (buf2));
    wh = (struct ieee80211_frame *)buf;
    switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
    case IEEE80211_FC1_DIR_NODS:
        (void) snprintf(buf2, sizeof (buf2), "NODS %s",
            ieee80211_macaddr_sprintf(wh->i_addr2));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "->%s",
            ieee80211_macaddr_sprintf(wh->i_addr1));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "(%s)",
            ieee80211_macaddr_sprintf(wh->i_addr3));
        (void) strncat(buf1, buf2, sizeof (buf2));
        break;
    case IEEE80211_FC1_DIR_TODS:
        (void) snprintf(buf2, sizeof (buf2), "TODS %s",
            ieee80211_macaddr_sprintf(wh->i_addr2));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "->%s",
            ieee80211_macaddr_sprintf(wh->i_addr3));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "(%s)",
            ieee80211_macaddr_sprintf(wh->i_addr1));
        (void) strncat(buf1, buf2, sizeof (buf2));
        break;
    case IEEE80211_FC1_DIR_FROMDS:
        (void) snprintf(buf2, sizeof (buf2), "FRDS %s",
            ieee80211_macaddr_sprintf(wh->i_addr3));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "->%s",
            ieee80211_macaddr_sprintf(wh->i_addr1));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "(%s)",
            ieee80211_macaddr_sprintf(wh->i_addr2));
        (void) strncat(buf1, buf2, sizeof (buf2));
        break;
    case IEEE80211_FC1_DIR_DSTODS:
        (void) snprintf(buf2, sizeof (buf2), "DSDS %s",
            ieee80211_macaddr_sprintf((uint8_t *)&wh[1]));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "->%s  ",
            ieee80211_macaddr_sprintf(wh->i_addr3));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "%s",
            ieee80211_macaddr_sprintf(wh->i_addr2));
        (void) strncat(buf1, buf2, sizeof (buf2));
        (void) snprintf(buf2, sizeof (buf2), "->%s",
            ieee80211_macaddr_sprintf(wh->i_addr1));
        (void) strncat(buf1, buf2, sizeof (buf2));
        break;
    }
    ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_dump_pkt(): %s", buf1);
    bzero(buf1, sizeof (buf1));

    switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
    case IEEE80211_FC0_TYPE_DATA:
        (void) sprintf(buf2, "data");
        break;
    case IEEE80211_FC0_TYPE_MGT:
        (void) snprintf(buf2, sizeof (buf2), "%s",
            ieee80211_mgt_subtype_name[
            (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
            >> IEEE80211_FC0_SUBTYPE_SHIFT]);
        break;
    default:
        (void) snprintf(buf2, sizeof (buf2), "type#%d",
            wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
        break;
    }
    (void) strncat(buf1, buf2, sizeof (buf2));
    if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
        (void) sprintf(buf2, " WEP");
        (void) strcat(buf1, buf2);
    }
    if (rate >= 0) {
        (void) snprintf(buf2,  sizeof (buf2), " %dM", rate / 2);
        (void) strncat(buf1, buf2, sizeof (buf2));
    }
    if (rssi >= 0) {
        (void) snprintf(buf2,  sizeof (buf2), " +%d", rssi);
        (void) strncat(buf1, buf2, sizeof (buf2));
    }
    ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_dump_pkt(): %s", buf1);
    bzero(buf1, sizeof (buf1));

    if (len > 0) {
        for (i = 0; i < (len > 40 ? 40 : len); i++) {
            if ((i & 0x03) == 0)
                (void) strcat(buf1, " ");
            (void) snprintf(buf2, 3, "%02x", buf[i]);
            (void) strncat(buf1, buf2, 3);
        }
        ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_dump_pkt(): %s",
            buf1);
    }
}

/*
 * Adjust/Fix the specified node's rate table
 *
 * in   node
 * flag IEEE80211_F_DOSORT : sort the node's rate table
 *      IEEE80211_F_DONEGO : mark a rate as basic rate if it is
 *                           a device's basic rate
 *      IEEE80211_F_DODEL  : delete rates not supported by the device
 *      IEEE80211_F_DOFRATE: check if the fixed rate is supported by
 *                           the device
 *
 * The highest bit of returned rate value is set to 1 on failure.
 */
int
ieee80211_fix_rate(ieee80211_node_t *in,
    struct ieee80211_rateset *nrs, int flags)
{
    ieee80211com_t *ic = in->in_ic;
    struct ieee80211_rateset *srs;
    boolean_t ignore;
    int i;
    int okrate;
    int badrate;
    int fixedrate;
    uint8_t r;

    /*
     * If the fixed rate check was requested but no
     * fixed has been defined then just remove it.
     */
    if ((flags & IEEE80211_F_DOFRATE) &&
        (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)) {
        flags &= ~IEEE80211_F_DOFRATE;
    }
    if (in->in_chan == IEEE80211_CHAN_ANYC) {
        return (IEEE80211_RATE_BASIC);
    }
    okrate = badrate = fixedrate = 0;
    srs = &ic->ic_sup_rates[ieee80211_chan2mode(ic, in->in_chan)];
    for (i = 0; i < nrs->ir_nrates; ) {
        int j;

        ignore = B_FALSE;
        if (flags & IEEE80211_F_DOSORT) {
            /*
             * Sort rates.
             */
            for (j = i + 1; j < nrs->ir_nrates; j++) {
                if (IEEE80211_RV(nrs->ir_rates[i]) >
                    IEEE80211_RV(nrs->ir_rates[j])) {
                    r = nrs->ir_rates[i];
                    nrs->ir_rates[i] = nrs->ir_rates[j];
                    nrs->ir_rates[j] = r;
                }
            }
        }
        r = IEEE80211_RV(nrs->ir_rates[i]);
        badrate = r;

        /*
         * Check against supported rates.
         */
        for (j = 0; j < srs->ir_nrates; j++) {
            if (r == IEEE80211_RV(srs->ir_rates[j])) {
                /*
                 * Overwrite with the supported rate
                 * value so any basic rate bit is set.
                 * This insures that response we send
                 * to stations have the necessary basic
                 * rate bit set.
                 */
                if (flags & IEEE80211_F_DONEGO)
                    nrs->ir_rates[i] = srs->ir_rates[j];
                break;
            }
        }
        if (j == srs->ir_nrates) {
            /*
             * A rate in the node's rate set is not
             * supported. We just discard/ignore the rate.
             * Note that this is important for 11b stations
             * when they want to associate with an 11g AP.
             */
            ignore = B_TRUE;
        }

        if (flags & IEEE80211_F_DODEL) {
            /*
             * Delete unacceptable rates.
             */
            if (ignore) {
                nrs->ir_nrates--;
                for (j = i; j < nrs->ir_nrates; j++)
                    nrs->ir_rates[j] = nrs->ir_rates[j + 1];
                nrs->ir_rates[j] = 0;
                continue;
            }
        }
        if (flags & IEEE80211_F_DOFRATE) {
            /*
             * Check any fixed rate is included.
             */
            if (r == ic->ic_fixed_rate)
                fixedrate = r;
        }
        if (!ignore)
            okrate = nrs->ir_rates[i];
        i++;
    }
    if (okrate == 0 || ((flags & IEEE80211_F_DOFRATE) && fixedrate == 0))
        return (badrate | IEEE80211_RATE_BASIC);
    else
        return (IEEE80211_RV(okrate));
}

/*
 * Reset 11g-related state.
 */
void
ieee80211_reset_erp(ieee80211com_t *ic)
{
    ic->ic_flags &= ~IEEE80211_F_USEPROT;
    /*
     * Short slot time is enabled only when operating in 11g
     * and not in an IBSS.  We must also honor whether or not
     * the driver is capable of doing it.
     */
    ieee80211_set_shortslottime(ic,
        ic->ic_curmode == IEEE80211_MODE_11A);
    /*
     * Set short preamble and ERP barker-preamble flags.
     */
    if (ic->ic_curmode == IEEE80211_MODE_11A ||
        (ic->ic_caps & IEEE80211_C_SHPREAMBLE)) {
        ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
        ic->ic_flags &= ~IEEE80211_F_USEBARKER;
    } else {
        ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
        ic->ic_flags |= IEEE80211_F_USEBARKER;
    }
}

/*
 * Change current channel to be the next available channel
 */
void
ieee80211_reset_chan(ieee80211com_t *ic)
{
    struct ieee80211_channel *ch = ic->ic_curchan;

    IEEE80211_LOCK(ic);
    do {
        if (++ch > &ic->ic_sup_channels[IEEE80211_CHAN_MAX])
            ch = &ic->ic_sup_channels[0];
        if (ieee80211_isset(ic->ic_chan_active,
            ieee80211_chan2ieee(ic, ch))) {
            break;
        }
    } while (ch != ic->ic_curchan);
    ic->ic_curchan = ch;
    IEEE80211_UNLOCK(ic);
}

/*
 * Set the short slot time state and notify the driver.
 */
void
ieee80211_set_shortslottime(ieee80211com_t *ic, boolean_t on)
{
    if (on)
        ic->ic_flags |= IEEE80211_F_SHSLOT;
    else
        ic->ic_flags &= ~IEEE80211_F_SHSLOT;
    /* notify driver */
    if (ic->ic_set_shortslot != NULL)
        ic->ic_set_shortslot(ic, on);
}

/*
 * Mark the basic rates for the 11g rate table based on the
 * operating mode.  For real 11g we mark all the 11b rates
 * and 6, 12, and 24 OFDM.  For 11b compatibility we mark only
 * 11b rates.  There's also a pseudo 11a-mode used to mark only
 * the basic OFDM rates.
 */
void
ieee80211_setbasicrates(struct ieee80211_rateset *rs,
    enum ieee80211_phymode mode)
{
    static const struct ieee80211_rateset basic[] = {
        { 0 },          /* IEEE80211_MODE_AUTO */
        { 3, { 12, 24, 48 } },  /* IEEE80211_MODE_11A */
        { 2, { 2, 4} },     /* IEEE80211_MODE_11B */
        { 4, { 2, 4, 11, 22 } }, /* IEEE80211_MODE_11G mixed b/g */
        { 0 },          /* IEEE80211_MODE_FH */
        { 3, { 12, 24, 48 } },  /* IEEE80211_MODE_TURBO_A */
        { 4, { 2, 4, 11, 22 } },
                    /* IEEE80211_MODE_TURBO_G (mixed b/g) */
        { 0 },          /* IEEE80211_MODE_STURBO_A */
        { 3, { 12, 24, 48 } },  /* IEEE80211_MODE_11NA */
                    /* IEEE80211_MODE_11NG (mixed b/g) */
        { 7, { 2, 4, 11, 22, 12, 24, 48 } }
    };
    int i, j;

    ASSERT(mode < IEEE80211_MODE_MAX);
    for (i = 0; i < rs->ir_nrates; i++) {
        rs->ir_rates[i] &= IEEE80211_RATE_VAL;
        for (j = 0; j < basic[mode].ir_nrates; j++) {
            if (basic[mode].ir_rates[j] == rs->ir_rates[i]) {
                rs->ir_rates[i] |= IEEE80211_RATE_BASIC;
                break;
            }
        }
    }
}

/*
 * WME protocol support.  The following parameters come from the spec.
 */
typedef struct phyParamType {
    uint8_t aifsn;
    uint8_t logcwmin;
    uint8_t logcwmax;
    uint16_t txopLimit;
    uint8_t acm;
} paramType;

static const paramType phyParamForAC_BE[IEEE80211_MODE_MAX] = {
    { 3, 4,  6,  0, 0 },    /* IEEE80211_MODE_AUTO */
    { 3, 4,  6,  0, 0 },    /* IEEE80211_MODE_11A */
    { 3, 4,  6,  0, 0 },    /* IEEE80211_MODE_11B */
    { 3, 4,  6,  0, 0 },    /* IEEE80211_MODE_11G */
    { 3, 4,  6,  0, 0 },    /* IEEE80211_MODE_FH */
    { 2, 3,  5,  0, 0 },    /* IEEE80211_MODE_TURBO_A */
    { 2, 3,  5,  0, 0 },    /* IEEE80211_MODE_TURBO_G */
    { 2, 3,  5,  0, 0 },    /* IEEE80211_MODE_STURBO_A */
    { 3, 4,  6,  0, 0 },    /* IEEE80211_MODE_11NA */
    { 3, 4,  6,  0, 0 } /* IEEE80211_MODE_11NG */
};
static const struct phyParamType phyParamForAC_BK[IEEE80211_MODE_MAX] = {
    { 7, 4, 10,  0, 0 },    /* IEEE80211_MODE_AUTO */
    { 7, 4, 10,  0, 0 },    /* IEEE80211_MODE_11A */
    { 7, 4, 10,  0, 0 },    /* IEEE80211_MODE_11B */
    { 7, 4, 10,  0, 0 },    /* IEEE80211_MODE_11G */
    { 7, 4, 10,  0, 0 },    /* IEEE80211_MODE_FH */
    { 7, 3, 10,  0, 0 },    /* IEEE80211_MODE_TURBO_A */
    { 7, 3, 10,  0, 0 },    /* IEEE80211_MODE_TURBO_G */
    { 7, 3, 10,  0, 0 },    /* IEEE80211_MODE_STURBO_A */
    { 7, 4, 10,  0, 0 },    /* IEEE80211_MODE_11NA */
    { 7, 4, 10,  0, 0 },    /* IEEE80211_MODE_11NG */
};
static const struct phyParamType phyParamForAC_VI[IEEE80211_MODE_MAX] = {
    { 1, 3, 4,  94, 0 },    /* IEEE80211_MODE_AUTO */
    { 1, 3, 4,  94, 0 },    /* IEEE80211_MODE_11A */
    { 1, 3, 4, 188, 0 },    /* IEEE80211_MODE_11B */
    { 1, 3, 4,  94, 0 },    /* IEEE80211_MODE_11G */
    { 1, 3, 4, 188, 0 },    /* IEEE80211_MODE_FH */
    { 1, 2, 3,  94, 0 },    /* IEEE80211_MODE_TURBO_A */
    { 1, 2, 3,  94, 0 },    /* IEEE80211_MODE_TURBO_G */
    { 1, 2, 3,  94, 0 },    /* IEEE80211_MODE_STURBO_A */
    { 1, 3, 4,  94, 0 },    /* IEEE80211_MODE_11NA */
    { 1, 3, 4,  94, 0 },    /* IEEE80211_MODE_11NG */
};
static const struct phyParamType phyParamForAC_VO[IEEE80211_MODE_MAX] = {
    { 1, 2, 3,  47, 0 },    /* IEEE80211_MODE_AUTO */
    { 1, 2, 3,  47, 0 },    /* IEEE80211_MODE_11A */
    { 1, 2, 3, 102, 0 },    /* IEEE80211_MODE_11B */
    { 1, 2, 3,  47, 0 },    /* IEEE80211_MODE_11G */
    { 1, 2, 3, 102, 0 },    /* IEEE80211_MODE_FH */
    { 1, 2, 2,  47, 0 },    /* IEEE80211_MODE_TURBO_A */
    { 1, 2, 2,  47, 0 },    /* IEEE80211_MODE_TURBO_G */
    { 1, 2, 2,  47, 0 },    /* IEEE80211_MODE_STURBO_A */
    { 1, 2, 3,  47, 0 },    /* IEEE80211_MODE_11NA */
    { 1, 2, 3,  47, 0 },    /* IEEE80211_MODE_11NG */
};

static const struct phyParamType bssPhyParamForAC_BE[IEEE80211_MODE_MAX] = {
    { 3, 4, 10,  0, 0 },    /* IEEE80211_MODE_AUTO */
    { 3, 4, 10,  0, 0 },    /* IEEE80211_MODE_11A */
    { 3, 4, 10,  0, 0 },    /* IEEE80211_MODE_11B */
    { 3, 4, 10,  0, 0 },    /* IEEE80211_MODE_11G */
    { 3, 4, 10,  0, 0 },    /* IEEE80211_MODE_FH */
    { 2, 3, 10,  0, 0 },    /* IEEE80211_MODE_TURBO_A */
    { 2, 3, 10,  0, 0 },    /* IEEE80211_MODE_TURBO_G */
    { 2, 3, 10,  0, 0 },    /* IEEE80211_MODE_STURBO_A */
    { 3, 4, 10,  0, 0 },    /* IEEE80211_MODE_11NA */
    { 3, 4, 10,  0, 0 },    /* IEEE80211_MODE_11NG */
};
static const struct phyParamType bssPhyParamForAC_VI[IEEE80211_MODE_MAX] = {
    { 2, 3, 4,  94, 0 },    /* IEEE80211_MODE_AUTO */
    { 2, 3, 4,  94, 0 },    /* IEEE80211_MODE_11A */
    { 2, 3, 4, 188, 0 },    /* IEEE80211_MODE_11B */
    { 2, 3, 4,  94, 0 },    /* IEEE80211_MODE_11G */
    { 2, 3, 4, 188, 0 },    /* IEEE80211_MODE_FH */
    { 2, 2, 3,  94, 0 },    /* IEEE80211_MODE_TURBO_A */
    { 2, 2, 3,  94, 0 },    /* IEEE80211_MODE_TURBO_G */
    { 2, 2, 3,  94, 0 },    /* IEEE80211_MODE_STURBO_A */
    { 2, 3, 4,  94, 0 },    /* IEEE80211_MODE_11NA */
    { 2, 3, 4,  94, 0 },    /* IEEE80211_MODE_11NG */
};
static const struct phyParamType bssPhyParamForAC_VO[IEEE80211_MODE_MAX] = {
    { 2, 2, 3,  47, 0 },    /* IEEE80211_MODE_AUTO */
    { 2, 2, 3,  47, 0 },    /* IEEE80211_MODE_11A */
    { 2, 2, 3, 102, 0 },    /* IEEE80211_MODE_11B */
    { 2, 2, 3,  47, 0 },    /* IEEE80211_MODE_11G */
    { 2, 2, 3, 102, 0 },    /* IEEE80211_MODE_FH */
    { 1, 2, 2,  47, 0 },    /* IEEE80211_MODE_TURBO_A */
    { 1, 2, 2,  47, 0 },    /* IEEE80211_MODE_TURBO_G */
    { 1, 2, 2,  47, 0 },    /* IEEE80211_MODE_STURBO_A */
    { 2, 2, 3,  47, 0 },    /* IEEE80211_MODE_11NA */
    { 2, 2, 3,  47, 0 },    /* IEEE80211_MODE_11NG */
};

void
ieee80211_wme_initparams(struct ieee80211com *ic)
{
    struct ieee80211_wme_state *wme = &ic->ic_wme;
    const paramType *pPhyParam, *pBssPhyParam;
    struct wmeParams *wmep;
    enum ieee80211_phymode mode;
    int i;

    if ((ic->ic_caps & IEEE80211_C_WME) == 0)
        return;

    /*
     * Select mode; we can be called early in which case we
     * always use auto mode.  We know we'll be called when
     * entering the RUN state with bsschan setup properly
     * so state will eventually get set correctly
     */
    if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
        mode = ieee80211_chan2mode(ic, ic->ic_curchan);
    else
        mode = IEEE80211_MODE_AUTO;
    for (i = 0; i < WME_NUM_AC; i++) {
        switch (i) {
        case WME_AC_BK:
            pPhyParam = &phyParamForAC_BK[mode];
            pBssPhyParam = &phyParamForAC_BK[mode];
            break;
        case WME_AC_VI:
            pPhyParam = &phyParamForAC_VI[mode];
            pBssPhyParam = &bssPhyParamForAC_VI[mode];
            break;
        case WME_AC_VO:
            pPhyParam = &phyParamForAC_VO[mode];
            pBssPhyParam = &bssPhyParamForAC_VO[mode];
            break;
        case WME_AC_BE:
        default:
            pPhyParam = &phyParamForAC_BE[mode];
            pBssPhyParam = &bssPhyParamForAC_BE[mode];
            break;
        }

        wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
        if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
            wmep->wmep_acm = pPhyParam->acm;
            wmep->wmep_aifsn = pPhyParam->aifsn;
            wmep->wmep_logcwmin = pPhyParam->logcwmin;
            wmep->wmep_logcwmax = pPhyParam->logcwmax;
            wmep->wmep_txopLimit = pPhyParam->txopLimit;
        } else {
            wmep->wmep_acm = pBssPhyParam->acm;
            wmep->wmep_aifsn = pBssPhyParam->aifsn;
            wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
            wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
            wmep->wmep_txopLimit = pBssPhyParam->txopLimit;

        }
        ieee80211_dbg(IEEE80211_MSG_WME, "ieee80211_wme_initparams: "
            "%s chan [acm %u aifsn %u log2(cwmin) %u "
            "log2(cwmax) %u txpoLimit %u]\n",
            ieee80211_wme_acnames[i],
            wmep->wmep_acm,
            wmep->wmep_aifsn,
            wmep->wmep_logcwmin,
            wmep->wmep_logcwmax,
            wmep->wmep_txopLimit);

        wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
        wmep->wmep_acm = pBssPhyParam->acm;
        wmep->wmep_aifsn = pBssPhyParam->aifsn;
        wmep->wmep_logcwmin = pBssPhyParam->logcwmin;
        wmep->wmep_logcwmax = pBssPhyParam->logcwmax;
        wmep->wmep_txopLimit = pBssPhyParam->txopLimit;
        ieee80211_dbg(IEEE80211_MSG_WME, "ieee80211_wme_initparams: "
            "%s  bss [acm %u aifsn %u log2(cwmin) %u "
            "log2(cwmax) %u txpoLimit %u]\n",
            ieee80211_wme_acnames[i],
            wmep->wmep_acm,
            wmep->wmep_aifsn,
            wmep->wmep_logcwmin,
            wmep->wmep_logcwmax,
            wmep->wmep_txopLimit);
    }
    /* NB: check ic_bss to avoid NULL deref on initial attach */
    if (ic->ic_bss != NULL) {
        /*
         * Calculate agressive mode switching threshold based
         * on beacon interval.  This doesn't need locking since
         * we're only called before entering the RUN state at
         * which point we start sending beacon frames.
         */
        wme->wme_hipri_switch_thresh =
            (HIGH_PRI_SWITCH_THRESH * ic->ic_bss->in_intval) / 100;
        ieee80211_wme_updateparams(ic);
    }
}

/*
 * Update WME parameters for ourself and the BSS.
 */
void
ieee80211_wme_updateparams(struct ieee80211com *ic)
{
    static const paramType phyParam[IEEE80211_MODE_MAX] = {
        { 2, 4, 10, 64, 0 },    /* IEEE80211_MODE_AUTO */
        { 2, 4, 10, 64, 0 },    /* IEEE80211_MODE_11A */
        { 2, 5, 10, 64, 0 },    /* IEEE80211_MODE_11B */
        { 2, 4, 10, 64, 0 },    /* IEEE80211_MODE_11G */
        { 2, 5, 10, 64, 0 },    /* IEEE80211_MODE_FH */
        { 1, 3, 10, 64, 0 },    /* IEEE80211_MODE_TURBO_A */
        { 1, 3, 10, 64, 0 },    /* IEEE80211_MODE_TURBO_G */
        { 1, 3, 10, 64, 0 },    /* IEEE80211_MODE_STURBO_A */
        { 2, 4, 10, 64, 0 },    /* IEEE80211_MODE_11NA */
        { 2, 4, 10, 64, 0 },    /* IEEE80211_MODE_11NG */
    };
    struct ieee80211_wme_state *wme = &ic->ic_wme;
    const struct wmeParams *wmep;
    struct wmeParams *chanp, *bssp;
    enum ieee80211_phymode mode;
    int i;

    if ((ic->ic_caps & IEEE80211_C_WME) == 0)
        return;

    /* set up the channel access parameters for the physical device */
    for (i = 0; i < WME_NUM_AC; i++) {
        chanp = &wme->wme_chanParams.cap_wmeParams[i];
        wmep = &wme->wme_wmeChanParams.cap_wmeParams[i];
        chanp->wmep_aifsn = wmep->wmep_aifsn;
        chanp->wmep_logcwmin = wmep->wmep_logcwmin;
        chanp->wmep_logcwmax = wmep->wmep_logcwmax;
        chanp->wmep_txopLimit = wmep->wmep_txopLimit;

        chanp = &wme->wme_bssChanParams.cap_wmeParams[i];
        wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[i];
        chanp->wmep_aifsn = wmep->wmep_aifsn;
        chanp->wmep_logcwmin = wmep->wmep_logcwmin;
        chanp->wmep_logcwmax = wmep->wmep_logcwmax;
        chanp->wmep_txopLimit = wmep->wmep_txopLimit;
    }

    /*
     * Select mode; we can be called early in which case we
     * always use auto mode.  We know we'll be called when
     * entering the RUN state with bsschan setup properly
     * so state will eventually get set correctly
     */
    if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
        mode = ieee80211_chan2mode(ic, ic->ic_curchan);
    else
        mode = IEEE80211_MODE_AUTO;

    /*
     * This implements agressive mode as found in certain
     * vendors' AP's.  When there is significant high
     * priority (VI/VO) traffic in the BSS throttle back BE
     * traffic by using conservative parameters.  Otherwise
     * BE uses agressive params to optimize performance of
     * legacy/non-QoS traffic.
     */
    if ((ic->ic_opmode == IEEE80211_M_HOSTAP &&
        (wme->wme_flags & WME_F_AGGRMODE) != 0) ||
        (ic->ic_opmode == IEEE80211_M_STA &&
        (ic->ic_bss->in_flags & IEEE80211_NODE_QOS) == 0) ||
        (ic->ic_flags & IEEE80211_F_WME) == 0) {
        chanp = &wme->wme_chanParams.cap_wmeParams[WME_AC_BE];
        bssp = &wme->wme_bssChanParams.cap_wmeParams[WME_AC_BE];

        chanp->wmep_aifsn = bssp->wmep_aifsn = phyParam[mode].aifsn;
        chanp->wmep_logcwmin = bssp->wmep_logcwmin =
            phyParam[mode].logcwmin;
        chanp->wmep_logcwmax = bssp->wmep_logcwmax =
            phyParam[mode].logcwmax;
        chanp->wmep_txopLimit = bssp->wmep_txopLimit =
            (ic->ic_flags & IEEE80211_F_BURST) ?
            phyParam[mode].txopLimit : 0;
        ieee80211_dbg(IEEE80211_MSG_WME,
            "ieee80211_wme_updateparams_locked: "
            "%s [acm %u aifsn %u log2(cwmin) %u "
            "log2(cwmax) %u txpoLimit %u]\n",
            ieee80211_wme_acnames[WME_AC_BE],
            chanp->wmep_acm,
            chanp->wmep_aifsn,
            chanp->wmep_logcwmin,
            chanp->wmep_logcwmax,
            chanp->wmep_txopLimit);
    }

    wme->wme_update(ic);

    ieee80211_dbg(IEEE80211_MSG_WME, "ieee80211_wme_updateparams(): "
        "WME params updated, cap_info 0x%x\n",
        ic->ic_opmode == IEEE80211_M_STA ?
        wme->wme_wmeChanParams.cap_info :
        wme->wme_bssChanParams.cap_info);
}

/*
 * Process STA mode beacon miss events. Send a direct probe request
 * frame to the current ap bmiss_max times (w/o answer) before
 * scanning for a new ap.
 */
void
ieee80211_beacon_miss(ieee80211com_t *ic)
{
    ieee80211_impl_t *im = ic->ic_private;

    if (ic->ic_flags & IEEE80211_F_SCAN)
        return;
    ieee80211_dbg(IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
        "%s\n", "beacon miss");

    /*
     * Our handling is only meaningful for stations that are
     * associated; any other conditions else will be handled
     * through different means (e.g. the tx timeout on mgt frames).
     */
    if (ic->ic_opmode != IEEE80211_M_STA ||
        ic->ic_state != IEEE80211_S_RUN) {
        return;
    }

    IEEE80211_LOCK(ic);
    if (++im->im_bmiss_count < im->im_bmiss_max) {
        /*
         * Send a directed probe req before falling back to a scan;
         * if we receive a response ic_bmiss_count will be reset.
         * Some cards mistakenly report beacon miss so this avoids
         * the expensive scan if the ap is still there.
         */
        IEEE80211_UNLOCK(ic);
        (void) ieee80211_send_probereq(ic->ic_bss, ic->ic_macaddr,
            ic->ic_bss->in_bssid, ic->ic_bss->in_bssid,
            ic->ic_bss->in_essid, ic->ic_bss->in_esslen,
            ic->ic_opt_ie, ic->ic_opt_ie_len);
        return;
    }
    im->im_bmiss_count = 0;
    IEEE80211_UNLOCK(ic);
    ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
}

/*
 * Manage state transition between INIT | AUTH | ASSOC | RUN.
 */
static int
ieee80211_newstate(ieee80211com_t *ic, enum ieee80211_state nstate, int arg)
{
    struct ieee80211_impl *im = ic->ic_private;
    ieee80211_node_t *in;
    enum ieee80211_state ostate;
    wifi_data_t wd = { 0 };

    IEEE80211_LOCK(ic);
    ostate = ic->ic_state;
    ieee80211_dbg(IEEE80211_MSG_STATE, "ieee80211_newstate(): "
        "%s -> %s\n",
        ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
    ic->ic_state = nstate;
    in = ic->ic_bss;
    im->im_swbmiss_period = 0;  /* Reset software beacon miss period */

    switch (nstate) {
    case IEEE80211_S_INIT:
        IEEE80211_UNLOCK(ic);
        switch (ostate) {
        case IEEE80211_S_INIT:
            return (0);
        case IEEE80211_S_SCAN:
            ieee80211_cancel_scan(ic);
            break;
        case IEEE80211_S_AUTH:
            break;
        case IEEE80211_S_ASSOC:
            if (ic->ic_opmode == IEEE80211_M_STA) {
                IEEE80211_SEND_MGMT(ic, in,
                    IEEE80211_FC0_SUBTYPE_DEAUTH,
                    IEEE80211_REASON_AUTH_LEAVE);
            }
            break;
        case IEEE80211_S_RUN:
            switch (ic->ic_opmode) {
            case IEEE80211_M_STA:
                IEEE80211_SEND_MGMT(ic, in,
                    IEEE80211_FC0_SUBTYPE_DEAUTH,
                    IEEE80211_REASON_AUTH_LEAVE);
                ieee80211_sta_leave(ic, in);
                break;
            case IEEE80211_M_IBSS:
                ieee80211_notify_node_leave(ic, in);
                break;
            default:
                break;
            }
            break;
        }
        IEEE80211_LOCK(ic);
        im->im_mgt_timer = 0;
        ieee80211_reset_bss(ic);
        break;
    case IEEE80211_S_SCAN:
        switch (ostate) {
        case IEEE80211_S_INIT:
            IEEE80211_UNLOCK(ic);
            ieee80211_begin_scan(ic, (arg == 0) ? B_FALSE : B_TRUE);
            return (0);
        case IEEE80211_S_SCAN:
            /*
             * Scan next. If doing an active scan and the
             * channel is not marked passive-only then send
             * a probe request.  Otherwise just listen for
             * beacons on the channel.
             */
            if ((ic->ic_flags & IEEE80211_F_ASCAN) &&
                !IEEE80211_IS_CHAN_PASSIVE(ic->ic_curchan)) {
                IEEE80211_UNLOCK(ic);
                (void) ieee80211_send_probereq(in,
                    ic->ic_macaddr, wifi_bcastaddr,
                    wifi_bcastaddr,
                    ic->ic_des_essid, ic->ic_des_esslen,
                    ic->ic_opt_ie, ic->ic_opt_ie_len);
                return (0);
            }
            break;
        case IEEE80211_S_RUN:
            /* beacon miss */
            ieee80211_dbg(IEEE80211_MSG_STATE,
                "no recent beacons from %s, rescanning\n",
                ieee80211_macaddr_sprintf(in->in_macaddr));
            IEEE80211_UNLOCK(ic);
            ieee80211_sta_leave(ic, in);
            IEEE80211_LOCK(ic);
            ic->ic_flags &= ~IEEE80211_F_SIBSS;
            /* FALLTHRU */
        case IEEE80211_S_AUTH:
        case IEEE80211_S_ASSOC:
            /* timeout restart scan */
            in = ieee80211_find_node(&ic->ic_scan,
                ic->ic_bss->in_macaddr);
            if (in != NULL) {
                in->in_fails++;
                ieee80211_unref_node(&in);
            }
            break;
        }
        break;
    case IEEE80211_S_AUTH:
        ASSERT(ic->ic_opmode == IEEE80211_M_STA);
        switch (ostate) {
        case IEEE80211_S_INIT:
        case IEEE80211_S_SCAN:
            IEEE80211_UNLOCK(ic);
            IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
                1);
            return (0);
        case IEEE80211_S_AUTH:
        case IEEE80211_S_ASSOC:
            switch (arg) {
            case IEEE80211_FC0_SUBTYPE_AUTH:
                IEEE80211_UNLOCK(ic);
                IEEE80211_SEND_MGMT(ic, in,
                    IEEE80211_FC0_SUBTYPE_AUTH, 2);
                return (0);
            case IEEE80211_FC0_SUBTYPE_DEAUTH:
                /* ignore and retry scan on timeout */
                break;
            }
            break;
        case IEEE80211_S_RUN:
            switch (arg) {
            case IEEE80211_FC0_SUBTYPE_AUTH:
                ic->ic_state = ostate;  /* stay RUN */
                IEEE80211_UNLOCK(ic);
                IEEE80211_SEND_MGMT(ic, in,
                    IEEE80211_FC0_SUBTYPE_AUTH, 2);
                return (0);
            case IEEE80211_FC0_SUBTYPE_DEAUTH:
                IEEE80211_UNLOCK(ic);
                ieee80211_sta_leave(ic, in);
                /* try to re-auth */
                IEEE80211_SEND_MGMT(ic, in,
                    IEEE80211_FC0_SUBTYPE_AUTH, 1);
                return (0);
            }
            break;
        }
        break;
    case IEEE80211_S_ASSOC:
        ASSERT(ic->ic_opmode == IEEE80211_M_STA ||
            ic->ic_opmode == IEEE80211_M_IBSS);
        switch (ostate) {
        case IEEE80211_S_INIT:
        case IEEE80211_S_SCAN:
        case IEEE80211_S_ASSOC:
            ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_newstate: "
                "invalid transition\n");
            break;
        case IEEE80211_S_AUTH:
            IEEE80211_UNLOCK(ic);
            IEEE80211_SEND_MGMT(ic, in,
                IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
            return (0);
        case IEEE80211_S_RUN:
            IEEE80211_UNLOCK(ic);
            ieee80211_sta_leave(ic, in);
            IEEE80211_SEND_MGMT(ic, in,
                IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 1);
            return (0);
        }
        break;
    case IEEE80211_S_RUN:
        switch (ostate) {
        case IEEE80211_S_INIT:
            ieee80211_err("ieee80211_newstate: "
                "invalid transition\n");
            break;
        case IEEE80211_S_AUTH:
            ieee80211_err("ieee80211_newstate: "
                "invalid transition\n");
            break;
        case IEEE80211_S_SCAN:      /* adhoc/hostap mode */
        case IEEE80211_S_ASSOC:     /* infra mode */
            ASSERT(in->in_txrate < in->in_rates.ir_nrates);
            im->im_mgt_timer = 0;
            ieee80211_notify_node_join(ic, in);

            /*
             * We can send data now; update the fastpath with our
             * current associated BSSID and other relevant settings.
             */
            wd.wd_secalloc = ieee80211_crypto_getciphertype(ic);
            wd.wd_opmode = ic->ic_opmode;
            IEEE80211_ADDR_COPY(wd.wd_bssid, in->in_bssid);
            wd.wd_qospad = 0;
            if (in->in_flags &
                (IEEE80211_NODE_QOS|IEEE80211_NODE_HT)) {
                wd.wd_qospad = 2;
                if (ic->ic_flags & IEEE80211_F_DATAPAD) {
                    wd.wd_qospad = roundup(wd.wd_qospad,
                        sizeof (uint32_t));
                }
            }
            (void) mac_pdata_update(ic->ic_mach, &wd, sizeof (wd));
            break;
        }

        /*
         * When 802.1x is not in use mark the port authorized
         * at this point so traffic can flow.
         */
        if (in->in_authmode != IEEE80211_AUTH_8021X)
            ieee80211_node_authorize(in);
        /*
         * Enable inactivity processing.
         */
        ic->ic_scan.nt_inact_timer = IEEE80211_INACT_WAIT;
        ic->ic_sta.nt_inact_timer = IEEE80211_INACT_WAIT;
        break;  /* IEEE80211_S_RUN */
    } /* switch nstate */
    IEEE80211_UNLOCK(ic);

    return (0);
}