xref: /openbsd/sys/net80211/ieee80211.c (revision 771fbea0)
1 /*	$OpenBSD: ieee80211.c,v 1.84 2020/06/08 09:09:58 stsp Exp $	*/
2 /*	$NetBSD: ieee80211.c,v 1.19 2004/06/06 05:45:29 dyoung Exp $	*/
3 
4 /*-
5  * Copyright (c) 2001 Atsushi Onoe
6  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. The name of the author may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * IEEE 802.11 generic handler
34  */
35 
36 #include "bpfilter.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/kernel.h>
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 #include <sys/endian.h>
45 #include <sys/errno.h>
46 #include <sys/sysctl.h>
47 
48 #include <net/if.h>
49 #include <net/if_dl.h>
50 #include <net/if_media.h>
51 
52 #if NBPFILTER > 0
53 #include <net/bpf.h>
54 #endif
55 
56 #include <netinet/in.h>
57 #include <netinet/if_ether.h>
58 
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_priv.h>
61 
62 #ifdef IEEE80211_DEBUG
63 int	ieee80211_debug = 0;
64 #endif
65 
66 int ieee80211_cache_size = IEEE80211_CACHE_SIZE;
67 
68 void ieee80211_setbasicrates(struct ieee80211com *);
69 int ieee80211_findrate(struct ieee80211com *, enum ieee80211_phymode, int);
70 void ieee80211_configure_ampdu_tx(struct ieee80211com *, int);
71 
72 void
73 ieee80211_begin_bgscan(struct ifnet *ifp)
74 {
75 	struct ieee80211com *ic = (void *)ifp;
76 
77 	if ((ic->ic_flags & IEEE80211_F_BGSCAN) ||
78 	    ic->ic_state != IEEE80211_S_RUN || ic->ic_mgt_timer != 0)
79 		return;
80 
81 	if ((ic->ic_flags & IEEE80211_F_RSNON) && !ic->ic_bss->ni_port_valid)
82 		return;
83 
84 	if (ic->ic_bgscan_start != NULL && ic->ic_bgscan_start(ic) == 0) {
85 		/*
86 		 * Free the nodes table to ensure we get an up-to-date view
87 		 * of APs around us. In particular, we need to kick out the
88 		 * AP we are associated to. Otherwise, our current AP might
89 		 * stay cached if it is turned off while we are scanning, and
90 		 * we could end up picking a now non-existent AP over and over.
91 		 */
92 		ieee80211_free_allnodes(ic, 0 /* keep ic->ic_bss */);
93 
94 		ic->ic_flags |= IEEE80211_F_BGSCAN;
95 		if (ifp->if_flags & IFF_DEBUG)
96 			printf("%s: begin background scan\n", ifp->if_xname);
97 
98 		/* Driver calls ieee80211_end_scan() when done. */
99 	}
100 }
101 
102 void
103 ieee80211_bgscan_timeout(void *arg)
104 {
105 	struct ifnet *ifp = arg;
106 
107 	ieee80211_begin_bgscan(ifp);
108 }
109 
110 void
111 ieee80211_channel_init(struct ifnet *ifp)
112 {
113 	struct ieee80211com *ic = (void *)ifp;
114 	struct ieee80211_channel *c;
115 	int i;
116 
117 	/*
118 	 * Fill in 802.11 available channel set, mark
119 	 * all available channels as active, and pick
120 	 * a default channel if not already specified.
121 	 */
122 	memset(ic->ic_chan_avail, 0, sizeof(ic->ic_chan_avail));
123 	ic->ic_modecaps |= 1<<IEEE80211_MODE_AUTO;
124 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
125 		c = &ic->ic_channels[i];
126 		if (c->ic_flags) {
127 			/*
128 			 * Verify driver passed us valid data.
129 			 */
130 			if (i != ieee80211_chan2ieee(ic, c)) {
131 				printf("%s: bad channel ignored; "
132 					"freq %u flags %x number %u\n",
133 					ifp->if_xname, c->ic_freq, c->ic_flags,
134 					i);
135 				c->ic_flags = 0;	/* NB: remove */
136 				continue;
137 			}
138 			setbit(ic->ic_chan_avail, i);
139 			/*
140 			 * Identify mode capabilities.
141 			 */
142 			if (IEEE80211_IS_CHAN_A(c))
143 				ic->ic_modecaps |= 1<<IEEE80211_MODE_11A;
144 			if (IEEE80211_IS_CHAN_B(c))
145 				ic->ic_modecaps |= 1<<IEEE80211_MODE_11B;
146 			if (IEEE80211_IS_CHAN_PUREG(c))
147 				ic->ic_modecaps |= 1<<IEEE80211_MODE_11G;
148 			if (IEEE80211_IS_CHAN_N(c))
149 				ic->ic_modecaps |= 1<<IEEE80211_MODE_11N;
150 			if (IEEE80211_IS_CHAN_AC(c))
151 				ic->ic_modecaps |= 1<<IEEE80211_MODE_11AC;
152 		}
153 	}
154 	/* validate ic->ic_curmode */
155 	if ((ic->ic_modecaps & (1<<ic->ic_curmode)) == 0)
156 		ic->ic_curmode = IEEE80211_MODE_AUTO;
157 	ic->ic_des_chan = IEEE80211_CHAN_ANYC;	/* any channel is ok */
158 }
159 
160 void
161 ieee80211_ifattach(struct ifnet *ifp)
162 {
163 	struct ieee80211com *ic = (void *)ifp;
164 
165 	memcpy(((struct arpcom *)ifp)->ac_enaddr, ic->ic_myaddr,
166 		ETHER_ADDR_LEN);
167 	ether_ifattach(ifp);
168 
169 	ifp->if_output = ieee80211_output;
170 
171 #if NBPFILTER > 0
172 	bpfattach(&ic->ic_rawbpf, ifp, DLT_IEEE802_11,
173 	    sizeof(struct ieee80211_frame_addr4));
174 #endif
175 	ieee80211_crypto_attach(ifp);
176 
177 	ieee80211_channel_init(ifp);
178 
179 	/* IEEE 802.11 defines a MTU >= 2290 */
180 	ifp->if_capabilities |= IFCAP_VLAN_MTU;
181 
182 	ieee80211_setbasicrates(ic);
183 	(void)ieee80211_setmode(ic, ic->ic_curmode);
184 
185 	if (ic->ic_lintval == 0)
186 		ic->ic_lintval = 100;		/* default sleep */
187 	ic->ic_bmissthres = IEEE80211_BEACON_MISS_THRES;
188 	ic->ic_dtim_period = 1;	/* all TIMs are DTIMs */
189 
190 	ieee80211_node_attach(ifp);
191 	ieee80211_proto_attach(ifp);
192 
193 	if_addgroup(ifp, "wlan");
194 	ifp->if_priority = IF_WIRELESS_DEFAULT_PRIORITY;
195 
196 	ieee80211_set_link_state(ic, LINK_STATE_DOWN);
197 
198 	timeout_set(&ic->ic_bgscan_timeout, ieee80211_bgscan_timeout, ifp);
199 }
200 
201 void
202 ieee80211_ifdetach(struct ifnet *ifp)
203 {
204 	struct ieee80211com *ic = (void *)ifp;
205 
206 	timeout_del(&ic->ic_bgscan_timeout);
207 
208 	/*
209 	 * Undo pseudo-driver changes. Pseudo-driver detach hooks could
210 	 * call back into the driver, e.g. via ioctl. So deactivate the
211 	 * interface before freeing net80211-specific data structures.
212 	 */
213 	if_deactivate(ifp);
214 
215 	ieee80211_proto_detach(ifp);
216 	ieee80211_crypto_detach(ifp);
217 	ieee80211_node_detach(ifp);
218 	ifmedia_delete_instance(&ic->ic_media, IFM_INST_ANY);
219 	ether_ifdetach(ifp);
220 }
221 
222 /*
223  * Convert MHz frequency to IEEE channel number.
224  */
225 u_int
226 ieee80211_mhz2ieee(u_int freq, u_int flags)
227 {
228 	if (flags & IEEE80211_CHAN_2GHZ) {	/* 2GHz band */
229 		if (freq == 2484)
230 			return 14;
231 		if (freq < 2484)
232 			return (freq - 2407) / 5;
233 		else
234 			return 15 + ((freq - 2512) / 20);
235 	} else if (flags & IEEE80211_CHAN_5GHZ) {	/* 5GHz band */
236 		return (freq - 5000) / 5;
237 	} else {				/* either, guess */
238 		if (freq == 2484)
239 			return 14;
240 		if (freq < 2484)
241 			return (freq - 2407) / 5;
242 		if (freq < 5000)
243 			return 15 + ((freq - 2512) / 20);
244 		return (freq - 5000) / 5;
245 	}
246 }
247 
248 /*
249  * Convert channel to IEEE channel number.
250  */
251 u_int
252 ieee80211_chan2ieee(struct ieee80211com *ic, const struct ieee80211_channel *c)
253 {
254 	struct ifnet *ifp = &ic->ic_if;
255 	if (ic->ic_channels <= c && c <= &ic->ic_channels[IEEE80211_CHAN_MAX])
256 		return c - ic->ic_channels;
257 	else if (c == IEEE80211_CHAN_ANYC)
258 		return IEEE80211_CHAN_ANY;
259 
260 	panic("%s: bogus channel pointer", ifp->if_xname);
261 }
262 
263 /*
264  * Convert IEEE channel number to MHz frequency.
265  */
266 u_int
267 ieee80211_ieee2mhz(u_int chan, u_int flags)
268 {
269 	if (flags & IEEE80211_CHAN_2GHZ) {	/* 2GHz band */
270 		if (chan == 14)
271 			return 2484;
272 		if (chan < 14)
273 			return 2407 + chan*5;
274 		else
275 			return 2512 + ((chan-15)*20);
276 	} else if (flags & IEEE80211_CHAN_5GHZ) {/* 5GHz band */
277 		return 5000 + (chan*5);
278 	} else {				/* either, guess */
279 		if (chan == 14)
280 			return 2484;
281 		if (chan < 14)			/* 0-13 */
282 			return 2407 + chan*5;
283 		if (chan < 27)			/* 15-26 */
284 			return 2512 + ((chan-15)*20);
285 		return 5000 + (chan*5);
286 	}
287 }
288 
289 void
290 ieee80211_configure_ampdu_tx(struct ieee80211com *ic, int enable)
291 {
292 	if ((ic->ic_caps & IEEE80211_C_TX_AMPDU) == 0)
293 		return;
294 
295 	/* Sending AMPDUs requires QoS support. */
296 	if ((ic->ic_caps & IEEE80211_C_QOS) == 0)
297 		return;
298 
299 	if (enable)
300 		ic->ic_flags |= IEEE80211_F_QOS;
301 	else
302 		ic->ic_flags &= ~IEEE80211_F_QOS;
303 }
304 
305 /*
306  * Setup the media data structures according to the channel and
307  * rate tables.  This must be called by the driver after
308  * ieee80211_attach and before most anything else.
309  */
310 void
311 ieee80211_media_init(struct ifnet *ifp,
312 	ifm_change_cb_t media_change, ifm_stat_cb_t media_stat)
313 {
314 #define	ADD(_ic, _s, _o) \
315 	ifmedia_add(&(_ic)->ic_media, \
316 		IFM_MAKEWORD(IFM_IEEE80211, (_s), (_o), 0), 0, NULL)
317 	struct ieee80211com *ic = (void *)ifp;
318 	struct ifmediareq imr;
319 	int i, j, mode, rate, maxrate, r;
320 	uint64_t mword, mopt;
321 	const struct ieee80211_rateset *rs;
322 	struct ieee80211_rateset allrates;
323 
324 	/*
325 	 * Do late attach work that must wait for any subclass
326 	 * (i.e. driver) work such as overriding methods.
327 	 */
328 	ieee80211_node_lateattach(ifp);
329 
330 	/*
331 	 * Fill in media characteristics.
332 	 */
333 	ifmedia_init(&ic->ic_media, 0, media_change, media_stat);
334 	maxrate = 0;
335 	memset(&allrates, 0, sizeof(allrates));
336 	for (mode = IEEE80211_MODE_AUTO; mode <= IEEE80211_MODE_11G; mode++) {
337 		static const uint64_t mopts[] = {
338 			IFM_AUTO,
339 			IFM_IEEE80211_11A,
340 			IFM_IEEE80211_11B,
341 			IFM_IEEE80211_11G,
342 		};
343 		if ((ic->ic_modecaps & (1<<mode)) == 0)
344 			continue;
345 		mopt = mopts[mode];
346 		ADD(ic, IFM_AUTO, mopt);	/* e.g. 11a auto */
347 #ifndef IEEE80211_STA_ONLY
348 		if (ic->ic_caps & IEEE80211_C_IBSS)
349 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_IBSS);
350 		if (ic->ic_caps & IEEE80211_C_HOSTAP)
351 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_HOSTAP);
352 		if (ic->ic_caps & IEEE80211_C_AHDEMO)
353 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_ADHOC);
354 #endif
355 		if (ic->ic_caps & IEEE80211_C_MONITOR)
356 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_MONITOR);
357 		if (mode == IEEE80211_MODE_AUTO)
358 			continue;
359 		rs = &ic->ic_sup_rates[mode];
360 		for (i = 0; i < rs->rs_nrates; i++) {
361 			rate = rs->rs_rates[i];
362 			mword = ieee80211_rate2media(ic, rate, mode);
363 			if (mword == 0)
364 				continue;
365 			ADD(ic, mword, mopt);
366 #ifndef IEEE80211_STA_ONLY
367 			if (ic->ic_caps & IEEE80211_C_IBSS)
368 				ADD(ic, mword, mopt | IFM_IEEE80211_IBSS);
369 			if (ic->ic_caps & IEEE80211_C_HOSTAP)
370 				ADD(ic, mword, mopt | IFM_IEEE80211_HOSTAP);
371 			if (ic->ic_caps & IEEE80211_C_AHDEMO)
372 				ADD(ic, mword, mopt | IFM_IEEE80211_ADHOC);
373 #endif
374 			if (ic->ic_caps & IEEE80211_C_MONITOR)
375 				ADD(ic, mword, mopt | IFM_IEEE80211_MONITOR);
376 			/*
377 			 * Add rate to the collection of all rates.
378 			 */
379 			r = rate & IEEE80211_RATE_VAL;
380 			for (j = 0; j < allrates.rs_nrates; j++)
381 				if (allrates.rs_rates[j] == r)
382 					break;
383 			if (j == allrates.rs_nrates) {
384 				/* unique, add to the set */
385 				allrates.rs_rates[j] = r;
386 				allrates.rs_nrates++;
387 			}
388 			rate = (rate & IEEE80211_RATE_VAL) / 2;
389 			if (rate > maxrate)
390 				maxrate = rate;
391 		}
392 	}
393 	for (i = 0; i < allrates.rs_nrates; i++) {
394 		mword = ieee80211_rate2media(ic, allrates.rs_rates[i],
395 				IEEE80211_MODE_AUTO);
396 		if (mword == 0)
397 			continue;
398 		mword = IFM_SUBTYPE(mword);	/* remove media options */
399 		ADD(ic, mword, 0);
400 #ifndef IEEE80211_STA_ONLY
401 		if (ic->ic_caps & IEEE80211_C_IBSS)
402 			ADD(ic, mword, IFM_IEEE80211_IBSS);
403 		if (ic->ic_caps & IEEE80211_C_HOSTAP)
404 			ADD(ic, mword, IFM_IEEE80211_HOSTAP);
405 		if (ic->ic_caps & IEEE80211_C_AHDEMO)
406 			ADD(ic, mword, IFM_IEEE80211_ADHOC);
407 #endif
408 		if (ic->ic_caps & IEEE80211_C_MONITOR)
409 			ADD(ic, mword, IFM_IEEE80211_MONITOR);
410 	}
411 
412 	if (ic->ic_modecaps & (1 << IEEE80211_MODE_11N)) {
413 		mopt = IFM_IEEE80211_11N;
414 		ADD(ic, IFM_AUTO, mopt);
415 #ifndef IEEE80211_STA_ONLY
416 		if (ic->ic_caps & IEEE80211_C_IBSS)
417 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_IBSS);
418 		if (ic->ic_caps & IEEE80211_C_HOSTAP)
419 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_HOSTAP);
420 #endif
421 		if (ic->ic_caps & IEEE80211_C_MONITOR)
422 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_MONITOR);
423 		for (i = 0; i < IEEE80211_HT_NUM_MCS; i++) {
424 			if (!isset(ic->ic_sup_mcs, i))
425 				continue;
426 			ADD(ic, IFM_IEEE80211_HT_MCS0 + i, mopt);
427 #ifndef IEEE80211_STA_ONLY
428 			if (ic->ic_caps & IEEE80211_C_IBSS)
429 				ADD(ic, IFM_IEEE80211_HT_MCS0 + i,
430 				     mopt | IFM_IEEE80211_IBSS);
431 			if (ic->ic_caps & IEEE80211_C_HOSTAP)
432 				ADD(ic, IFM_IEEE80211_HT_MCS0 + i,
433 				    mopt | IFM_IEEE80211_HOSTAP);
434 #endif
435 			if (ic->ic_caps & IEEE80211_C_MONITOR)
436 				ADD(ic, IFM_IEEE80211_HT_MCS0 + i,
437 				    mopt | IFM_IEEE80211_MONITOR);
438 		}
439 		ic->ic_flags |= IEEE80211_F_HTON; /* enable 11n by default */
440 		ieee80211_configure_ampdu_tx(ic, 1);
441 	}
442 
443 	if (ic->ic_modecaps & (1 << IEEE80211_MODE_11AC)) {
444 		mopt = IFM_IEEE80211_11AC;
445 		ADD(ic, IFM_AUTO, mopt);
446 #ifndef IEEE80211_STA_ONLY
447 		if (ic->ic_caps & IEEE80211_C_IBSS)
448 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_IBSS);
449 		if (ic->ic_caps & IEEE80211_C_HOSTAP)
450 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_HOSTAP);
451 #endif
452 		if (ic->ic_caps & IEEE80211_C_MONITOR)
453 			ADD(ic, IFM_AUTO, mopt | IFM_IEEE80211_MONITOR);
454 		for (i = 0; i < IEEE80211_VHT_NUM_MCS; i++) {
455 #if 0
456 			/* TODO: Obtain VHT MCS information from VHT CAP IE. */
457 			if (!vht_mcs_supported)
458 				continue;
459 #endif
460 			ADD(ic, IFM_IEEE80211_VHT_MCS0 + i, mopt);
461 #ifndef IEEE80211_STA_ONLY
462 			if (ic->ic_caps & IEEE80211_C_IBSS)
463 				ADD(ic, IFM_IEEE80211_VHT_MCS0 + i,
464 				     mopt | IFM_IEEE80211_IBSS);
465 			if (ic->ic_caps & IEEE80211_C_HOSTAP)
466 				ADD(ic, IFM_IEEE80211_VHT_MCS0 + i,
467 				    mopt | IFM_IEEE80211_HOSTAP);
468 #endif
469 			if (ic->ic_caps & IEEE80211_C_MONITOR)
470 				ADD(ic, IFM_IEEE80211_VHT_MCS0 + i,
471 				    mopt | IFM_IEEE80211_MONITOR);
472 		}
473 #if 0
474 		ic->ic_flags |= IEEE80211_F_VHTON; /* enable 11ac by default */
475 		if (ic->ic_caps & IEEE80211_C_QOS)
476 			ic->ic_flags |= IEEE80211_F_QOS;
477 #endif
478 	}
479 
480 	ieee80211_media_status(ifp, &imr);
481 	ifmedia_set(&ic->ic_media, imr.ifm_active);
482 
483 	if (maxrate)
484 		ifp->if_baudrate = IF_Mbps(maxrate);
485 
486 #undef ADD
487 }
488 
489 int
490 ieee80211_findrate(struct ieee80211com *ic, enum ieee80211_phymode mode,
491     int rate)
492 {
493 #define	IEEERATE(_ic,_m,_i) \
494 	((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
495 	int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
496 	for (i = 0; i < nrates; i++)
497 		if (IEEERATE(ic, mode, i) == rate)
498 			return i;
499 	return -1;
500 #undef IEEERATE
501 }
502 
503 /*
504  * Handle a media change request.
505  */
506 int
507 ieee80211_media_change(struct ifnet *ifp)
508 {
509 	struct ieee80211com *ic = (void *)ifp;
510 	struct ifmedia_entry *ime;
511 	enum ieee80211_opmode newopmode;
512 	enum ieee80211_phymode newphymode;
513 	int i, j, newrate, error = 0;
514 
515 	ime = ic->ic_media.ifm_cur;
516 	/*
517 	 * First, identify the phy mode.
518 	 */
519 	switch (IFM_MODE(ime->ifm_media)) {
520 	case IFM_IEEE80211_11A:
521 		newphymode = IEEE80211_MODE_11A;
522 		break;
523 	case IFM_IEEE80211_11B:
524 		newphymode = IEEE80211_MODE_11B;
525 		break;
526 	case IFM_IEEE80211_11G:
527 		newphymode = IEEE80211_MODE_11G;
528 		break;
529 	case IFM_IEEE80211_11N:
530 		newphymode = IEEE80211_MODE_11N;
531 		break;
532 	case IFM_IEEE80211_11AC:
533 		newphymode = IEEE80211_MODE_11AC;
534 		break;
535 	case IFM_AUTO:
536 		newphymode = IEEE80211_MODE_AUTO;
537 		break;
538 	default:
539 		return EINVAL;
540 	}
541 
542 	/*
543 	 * Validate requested mode is available.
544 	 */
545 	if ((ic->ic_modecaps & (1<<newphymode)) == 0)
546 		return EINVAL;
547 
548 	/*
549 	 * Next, the fixed/variable rate.
550 	 */
551 	i = -1;
552 	if (IFM_SUBTYPE(ime->ifm_media) >= IFM_IEEE80211_VHT_MCS0 &&
553 	    IFM_SUBTYPE(ime->ifm_media) <= IFM_IEEE80211_VHT_MCS9) {
554 		if ((ic->ic_modecaps & (1 << IEEE80211_MODE_11AC)) == 0)
555 			return EINVAL;
556 		if (newphymode != IEEE80211_MODE_AUTO &&
557 		    newphymode != IEEE80211_MODE_11AC)
558 			return EINVAL;
559 		i = ieee80211_media2mcs(ime->ifm_media);
560 		/* TODO: Obtain VHT MCS information from VHT CAP IE. */
561 		if (i == -1 /* || !vht_mcs_supported */)
562 			return EINVAL;
563 	} else if (IFM_SUBTYPE(ime->ifm_media) >= IFM_IEEE80211_HT_MCS0 &&
564 	    IFM_SUBTYPE(ime->ifm_media) <= IFM_IEEE80211_HT_MCS76) {
565 		if ((ic->ic_modecaps & (1 << IEEE80211_MODE_11N)) == 0)
566 			return EINVAL;
567 		if (newphymode != IEEE80211_MODE_AUTO &&
568 		    newphymode != IEEE80211_MODE_11N)
569 			return EINVAL;
570 		i = ieee80211_media2mcs(ime->ifm_media);
571 		if (i == -1 || isclr(ic->ic_sup_mcs, i))
572 			return EINVAL;
573 	} else if (IFM_SUBTYPE(ime->ifm_media) != IFM_AUTO) {
574 		/*
575 		 * Convert media subtype to rate.
576 		 */
577 		newrate = ieee80211_media2rate(ime->ifm_media);
578 		if (newrate == 0)
579 			return EINVAL;
580 		/*
581 		 * Check the rate table for the specified/current phy.
582 		 */
583 		if (newphymode == IEEE80211_MODE_AUTO) {
584 			/*
585 			 * In autoselect mode search for the rate.
586 			 */
587 			for (j = IEEE80211_MODE_11A;
588 			     j < IEEE80211_MODE_MAX; j++) {
589 				if ((ic->ic_modecaps & (1<<j)) == 0)
590 					continue;
591 				i = ieee80211_findrate(ic, j, newrate);
592 				if (i != -1) {
593 					/* lock mode too */
594 					newphymode = j;
595 					break;
596 				}
597 			}
598 		} else {
599 			i = ieee80211_findrate(ic, newphymode, newrate);
600 		}
601 		if (i == -1)			/* mode/rate mismatch */
602 			return EINVAL;
603 	}
604 	/* NB: defer rate setting to later */
605 
606 	/*
607 	 * Deduce new operating mode but don't install it just yet.
608 	 */
609 #ifndef IEEE80211_STA_ONLY
610 	if (ime->ifm_media & IFM_IEEE80211_ADHOC)
611 		newopmode = IEEE80211_M_AHDEMO;
612 	else if (ime->ifm_media & IFM_IEEE80211_HOSTAP)
613 		newopmode = IEEE80211_M_HOSTAP;
614 	else if (ime->ifm_media & IFM_IEEE80211_IBSS)
615 		newopmode = IEEE80211_M_IBSS;
616 	else
617 #endif
618 	if (ime->ifm_media & IFM_IEEE80211_MONITOR)
619 		newopmode = IEEE80211_M_MONITOR;
620 	else
621 		newopmode = IEEE80211_M_STA;
622 
623 #ifndef IEEE80211_STA_ONLY
624 	/*
625 	 * Autoselect doesn't make sense when operating as an AP.
626 	 * If no phy mode has been selected, pick one and lock it
627 	 * down so rate tables can be used in forming beacon frames
628 	 * and the like.
629 	 */
630 	if (newopmode == IEEE80211_M_HOSTAP &&
631 	    newphymode == IEEE80211_MODE_AUTO) {
632 		if (ic->ic_modecaps & (1 << IEEE80211_MODE_11AC))
633 			newphymode = IEEE80211_MODE_11AC;
634 		else if (ic->ic_modecaps & (1 << IEEE80211_MODE_11N))
635 			newphymode = IEEE80211_MODE_11N;
636 		else if (ic->ic_modecaps & (1 << IEEE80211_MODE_11A))
637 			newphymode = IEEE80211_MODE_11A;
638 		else if (ic->ic_modecaps & (1 << IEEE80211_MODE_11G))
639 			newphymode = IEEE80211_MODE_11G;
640 		else
641 			newphymode = IEEE80211_MODE_11B;
642 	}
643 #endif
644 
645 	/*
646 	 * Handle phy mode change.
647 	 */
648 	if (ic->ic_curmode != newphymode) {		/* change phy mode */
649 		error = ieee80211_setmode(ic, newphymode);
650 		if (error != 0)
651 			return error;
652 		error = ENETRESET;
653 	}
654 
655 	/*
656 	 * Committed to changes, install the MCS/rate setting.
657 	 */
658 	ic->ic_flags &= ~(IEEE80211_F_HTON | IEEE80211_F_VHTON);
659 	ieee80211_configure_ampdu_tx(ic, 0);
660 	if ((ic->ic_modecaps & (1 << IEEE80211_MODE_11AC)) &&
661 	    (newphymode == IEEE80211_MODE_AUTO ||
662 	    newphymode == IEEE80211_MODE_11AC)) {
663 		ic->ic_flags |= IEEE80211_F_VHTON;
664 		ieee80211_configure_ampdu_tx(ic, 1);
665 	} else if ((ic->ic_modecaps & (1 << IEEE80211_MODE_11N)) &&
666 	    (newphymode == IEEE80211_MODE_AUTO ||
667 	    newphymode == IEEE80211_MODE_11N)) {
668 		ic->ic_flags |= IEEE80211_F_HTON;
669 		ieee80211_configure_ampdu_tx(ic, 1);
670 	}
671 	if ((ic->ic_flags & (IEEE80211_F_HTON | IEEE80211_F_VHTON)) == 0) {
672 		ic->ic_fixed_mcs = -1;
673 	    	if (ic->ic_fixed_rate != i) {
674 			ic->ic_fixed_rate = i;		/* set fixed tx rate */
675 			error = ENETRESET;
676 		}
677 	} else {
678 		ic->ic_fixed_rate = -1;
679 		if (ic->ic_fixed_mcs != i) {
680 			ic->ic_fixed_mcs = i;		/* set fixed mcs */
681 			error = ENETRESET;
682 		}
683 	}
684 
685 	/*
686 	 * Handle operating mode change.
687 	 */
688 	if (ic->ic_opmode != newopmode) {
689 		ic->ic_opmode = newopmode;
690 #ifndef IEEE80211_STA_ONLY
691 		switch (newopmode) {
692 		case IEEE80211_M_AHDEMO:
693 		case IEEE80211_M_HOSTAP:
694 		case IEEE80211_M_STA:
695 		case IEEE80211_M_MONITOR:
696 			ic->ic_flags &= ~IEEE80211_F_IBSSON;
697 			break;
698 		case IEEE80211_M_IBSS:
699 			ic->ic_flags |= IEEE80211_F_IBSSON;
700 			break;
701 		}
702 #endif
703 		/*
704 		 * Yech, slot time may change depending on the
705 		 * operating mode so reset it to be sure everything
706 		 * is setup appropriately.
707 		 */
708 		ieee80211_reset_erp(ic);
709 		error = ENETRESET;
710 	}
711 #ifdef notdef
712 	if (error == 0)
713 		ifp->if_baudrate = ifmedia_baudrate(ime->ifm_media);
714 #endif
715 	return error;
716 }
717 
718 void
719 ieee80211_media_status(struct ifnet *ifp, struct ifmediareq *imr)
720 {
721 	struct ieee80211com *ic = (void *)ifp;
722 	const struct ieee80211_node *ni = NULL;
723 
724 	imr->ifm_status = IFM_AVALID;
725 	imr->ifm_active = IFM_IEEE80211;
726 	if (ic->ic_state == IEEE80211_S_RUN &&
727 	    (ic->ic_opmode != IEEE80211_M_STA ||
728 	     !(ic->ic_flags & IEEE80211_F_RSNON) ||
729 	     ic->ic_bss->ni_port_valid))
730 		imr->ifm_status |= IFM_ACTIVE;
731 	imr->ifm_active |= IFM_AUTO;
732 	switch (ic->ic_opmode) {
733 	case IEEE80211_M_STA:
734 		ni = ic->ic_bss;
735 		if (ic->ic_curmode == IEEE80211_MODE_11N ||
736 		    ic->ic_curmode == IEEE80211_MODE_11AC)
737 			imr->ifm_active |= ieee80211_mcs2media(ic,
738 				ni->ni_txmcs, ic->ic_curmode);
739 		else if (ni->ni_flags & IEEE80211_NODE_VHT) /* in MODE_AUTO */
740 			imr->ifm_active |= ieee80211_mcs2media(ic,
741 				ni->ni_txmcs, IEEE80211_MODE_11AC);
742 		else if (ni->ni_flags & IEEE80211_NODE_HT) /* in MODE_AUTO */
743 			imr->ifm_active |= ieee80211_mcs2media(ic,
744 				ni->ni_txmcs, IEEE80211_MODE_11N);
745 		else
746 			/* calculate rate subtype */
747 			imr->ifm_active |= ieee80211_rate2media(ic,
748 				ni->ni_rates.rs_rates[ni->ni_txrate],
749 				ic->ic_curmode);
750 		break;
751 #ifndef IEEE80211_STA_ONLY
752 	case IEEE80211_M_IBSS:
753 		imr->ifm_active |= IFM_IEEE80211_IBSS;
754 		break;
755 	case IEEE80211_M_AHDEMO:
756 		imr->ifm_active |= IFM_IEEE80211_ADHOC;
757 		break;
758 	case IEEE80211_M_HOSTAP:
759 		imr->ifm_active |= IFM_IEEE80211_HOSTAP;
760 		break;
761 #endif
762 	case IEEE80211_M_MONITOR:
763 		imr->ifm_active |= IFM_IEEE80211_MONITOR;
764 		break;
765 	default:
766 		break;
767 	}
768 	switch (ic->ic_curmode) {
769 	case IEEE80211_MODE_11A:
770 		imr->ifm_active |= IFM_IEEE80211_11A;
771 		break;
772 	case IEEE80211_MODE_11B:
773 		imr->ifm_active |= IFM_IEEE80211_11B;
774 		break;
775 	case IEEE80211_MODE_11G:
776 		imr->ifm_active |= IFM_IEEE80211_11G;
777 		break;
778 	case IEEE80211_MODE_11N:
779 		imr->ifm_active |= IFM_IEEE80211_11N;
780 		break;
781 	case IEEE80211_MODE_11AC:
782 		imr->ifm_active |= IFM_IEEE80211_11AC;
783 		break;
784 	}
785 }
786 
787 void
788 ieee80211_watchdog(struct ifnet *ifp)
789 {
790 	struct ieee80211com *ic = (void *)ifp;
791 
792 	if (ic->ic_mgt_timer && --ic->ic_mgt_timer == 0) {
793 		if (ic->ic_opmode == IEEE80211_M_STA &&
794 		    (ic->ic_state == IEEE80211_S_AUTH ||
795 		    ic->ic_state == IEEE80211_S_ASSOC)) {
796 			struct ieee80211_node *ni;
797 			if (ifp->if_flags & IFF_DEBUG)
798 				printf("%s: %s timed out for %s\n",
799 				    ifp->if_xname,
800 				    ic->ic_state == IEEE80211_S_ASSOC ?
801 				    "association" : "authentication",
802 				    ether_sprintf(ic->ic_bss->ni_macaddr));
803 			ni = ieee80211_find_node(ic, ic->ic_bss->ni_macaddr);
804 			if (ni)
805 				ni->ni_fails++;
806 			if (ISSET(ic->ic_flags, IEEE80211_F_AUTO_JOIN))
807 				ieee80211_deselect_ess(ic);
808 		}
809 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
810 	}
811 
812 	if (ic->ic_mgt_timer != 0)
813 		ifp->if_timer = 1;
814 }
815 
816 const struct ieee80211_rateset ieee80211_std_rateset_11a =
817 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
818 
819 const struct ieee80211_rateset ieee80211_std_rateset_11b =
820 	{ 4, { 2, 4, 11, 22 } };
821 
822 const struct ieee80211_rateset ieee80211_std_rateset_11g =
823 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
824 
825 const struct ieee80211_ht_rateset ieee80211_std_ratesets_11n[] = {
826 	/* MCS 0-7, 20MHz channel, no SGI */
827 	{ 8, { 13, 26, 39, 52, 78, 104, 117, 130 }, 0x000000ff, 0, 7, 0},
828 
829 	/* MCS 0-7, 20MHz channel, SGI */
830 	{ 8, { 14, 29, 43, 58, 87, 116, 130, 144 }, 0x000000ff, 0, 7, 1 },
831 
832 	/* MCS 8-15, 20MHz channel, no SGI */
833 	{ 8, { 26, 52, 78, 104, 156, 208, 234, 260 }, 0x0000ff00, 8, 15, 0 },
834 
835 	/* MCS 8-15, 20MHz channel, SGI */
836 	{ 8, { 29, 58, 87, 116, 173, 231, 261, 289 }, 0x0000ff00, 8, 15, 1 },
837 
838 	/* MCS 16-23, 20MHz channel, no SGI */
839 	{ 8, { 39, 78, 117, 156, 234, 312, 351, 390 }, 0x00ff0000, 16, 23, 0 },
840 
841 	/* MCS 16-23, 20MHz channel, SGI */
842 	{ 8, { 43, 87, 130, 173, 260, 347, 390, 433 }, 0x00ff0000, 16, 23, 1 },
843 
844 	/* MCS 24-31, 20MHz channel, no SGI */
845 	{ 8, { 52, 104, 156, 208, 312, 416, 468, 520 }, 0xff000000, 24, 31, 0 },
846 
847 	/* MCS 24-31, 20MHz channel, SGI */
848 	{ 8, { 58, 116, 173, 231, 347, 462, 520, 578 }, 0xff000000, 24, 31, 1 },
849 };
850 
851 const struct ieee80211_vht_rateset ieee80211_std_ratesets_11ac[] = {
852 	/* MCS 0-8 (MCS 9 N/A), 1 SS, 20MHz channel, no SGI */
853 	{ 9, { 13, 26, 39, 52, 78, 104, 117, 130, 156 }, 1, 0 },
854 
855 	/* MCS 0-8 (MCS 9 N/A), 1 SS, 20MHz channel, SGI */
856 	{ 9, { 14, 29, 43, 58, 87, 116, 130, 144, 174 }, 1, 1 },
857 
858 	/* MCS 0-8 (MCS 9 N/A), 2 SS, 20MHz channel, no SGI */
859 	{ 9, { 26, 52, 78, 104, 156, 208, 234, 260, 312 }, 2, 0 },
860 
861 	/* MCS 0-8 (MCS 9 N/A), 2 SS, 20MHz channel, SGI */
862 	{ 9, { 29, 58, 87, 116, 173, 231, 261, 289, 347 }, 2, 1 },
863 
864 	/* MCS 0-9, 1 SS, 40MHz channel, no SGI */
865 	{ 10, { 27, 54, 81, 108, 162, 216, 243, 270, 324, 360 }, 1, 0 },
866 
867 	/* MCS 0-9, 1 SS, 40MHz channel, SGI */
868 	{ 10, { 30, 60, 90, 120, 180, 240, 270, 300, 360, 400 }, 1, 1 },
869 
870 	/* MCS 0-9, 2 SS, 40MHz channel, no SGI */
871 	{ 10, { 54, 108, 162, 216, 324, 432, 486, 540, 648, 720 }, 2, 0 },
872 
873 	/* MCS 0-9, 2 SS, 40MHz channel, SGI */
874 	{ 10, { 60, 120, 180, 240, 360, 480, 540, 600, 720, 800 }, 2, 1 },
875 
876 	/* MCS 0-9, 1 SS, 80MHz channel, no SGI */
877 	{ 10, { 59, 117, 176, 234, 351, 468, 527, 585, 702, 780 }, 1, 0 },
878 
879 	/* MCS 0-9, 1 SS, 80MHz channel, SGI */
880 	{ 10, { 65, 130, 195, 260, 390, 520, 585, 650, 780, 867 }, 1, 1 },
881 
882 	/* MCS 0-9, 2 SS, 80MHz channel, no SGI */
883 	{ 10, { 117, 234, 351, 468, 702, 936, 1053, 1404, 1560 }, 2, 0 },
884 
885 	/* MCS 0-9, 2 SS, 80MHz channel, SGI */
886 	{ 10, { 130, 260, 390, 520, 780, 1040, 1170, 1300, 1560, 1734 }, 2, 1 },
887 };
888 
889 /*
890  * Mark the basic rates for the 11g rate table based on the
891  * operating mode.  For real 11g we mark all the 11b rates
892  * and 6, 12, and 24 OFDM.  For 11b compatibility we mark only
893  * 11b rates.  There's also a pseudo 11a-mode used to mark only
894  * the basic OFDM rates.
895  */
896 void
897 ieee80211_setbasicrates(struct ieee80211com *ic)
898 {
899 	static const struct ieee80211_rateset basic[] = {
900 	    { 0 },				/* IEEE80211_MODE_AUTO */
901 	    { 3, { 12, 24, 48 } },		/* IEEE80211_MODE_11A */
902 	    { 2, { 2, 4 } },			/* IEEE80211_MODE_11B */
903 	    { 4, { 2, 4, 11, 22 } },		/* IEEE80211_MODE_11G */
904 	    { 0 },				/* IEEE80211_MODE_11N	*/
905 	    { 0 },				/* IEEE80211_MODE_11AC	*/
906 	};
907 	enum ieee80211_phymode mode;
908 	struct ieee80211_rateset *rs;
909 	int i, j;
910 
911 	for (mode = 0; mode < IEEE80211_MODE_MAX; mode++) {
912 		rs = &ic->ic_sup_rates[mode];
913 		for (i = 0; i < rs->rs_nrates; i++) {
914 			rs->rs_rates[i] &= IEEE80211_RATE_VAL;
915 			for (j = 0; j < basic[mode].rs_nrates; j++) {
916 				if (basic[mode].rs_rates[j] ==
917 				    rs->rs_rates[i]) {
918 					rs->rs_rates[i] |=
919 					    IEEE80211_RATE_BASIC;
920 					break;
921 				}
922 			}
923 		}
924 	}
925 }
926 
927 int
928 ieee80211_min_basic_rate(struct ieee80211com *ic)
929 {
930 	struct ieee80211_rateset *rs = &ic->ic_bss->ni_rates;
931 	int i, min, rval;
932 
933 	min = -1;
934 
935 	for (i = 0; i < rs->rs_nrates; i++) {
936 		if ((rs->rs_rates[i] & IEEE80211_RATE_BASIC) == 0)
937 			continue;
938 		rval = (rs->rs_rates[i] & IEEE80211_RATE_VAL);
939 		if (min == -1)
940 			min = rval;
941 		else if (rval < min)
942 			min = rval;
943 	}
944 
945 	/* Default to 1 Mbit/s on 2GHz and 6 Mbit/s on 5GHz. */
946 	if (min == -1)
947 		min = IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan) ? 2 : 12;
948 
949 	return min;
950 }
951 
952 int
953 ieee80211_max_basic_rate(struct ieee80211com *ic)
954 {
955 	struct ieee80211_rateset *rs = &ic->ic_bss->ni_rates;
956 	int i, max, rval;
957 
958 	/* Default to 1 Mbit/s on 2GHz and 6 Mbit/s on 5GHz. */
959 	max = IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan) ? 2 : 12;
960 
961 	for (i = 0; i < rs->rs_nrates; i++) {
962 		if ((rs->rs_rates[i] & IEEE80211_RATE_BASIC) == 0)
963 			continue;
964 		rval = (rs->rs_rates[i] & IEEE80211_RATE_VAL);
965 		if (rval > max)
966 			max = rval;
967 	}
968 
969 	return max;
970 }
971 
972 /*
973  * Set the current phy mode and recalculate the active channel
974  * set based on the available channels for this mode.  Also
975  * select a new default/current channel if the current one is
976  * inappropriate for this mode.
977  */
978 int
979 ieee80211_setmode(struct ieee80211com *ic, enum ieee80211_phymode mode)
980 {
981 	struct ifnet *ifp = &ic->ic_if;
982 	static const u_int chanflags[] = {
983 		0,			/* IEEE80211_MODE_AUTO */
984 		IEEE80211_CHAN_A,	/* IEEE80211_MODE_11A */
985 		IEEE80211_CHAN_B,	/* IEEE80211_MODE_11B */
986 		IEEE80211_CHAN_PUREG,	/* IEEE80211_MODE_11G */
987 		IEEE80211_CHAN_HT,	/* IEEE80211_MODE_11N */
988 		IEEE80211_CHAN_VHT,	/* IEEE80211_MODE_11AC */
989 	};
990 	const struct ieee80211_channel *c;
991 	u_int modeflags;
992 	int i;
993 
994 	/* validate new mode */
995 	if ((ic->ic_modecaps & (1<<mode)) == 0) {
996 		DPRINTF(("mode %u not supported (caps 0x%x)\n",
997 		    mode, ic->ic_modecaps));
998 		return EINVAL;
999 	}
1000 
1001 	/*
1002 	 * Verify at least one channel is present in the available
1003 	 * channel list before committing to the new mode.
1004 	 */
1005 	if (mode >= nitems(chanflags))
1006 		panic("%s: unexpected mode %u", __func__, mode);
1007 	modeflags = chanflags[mode];
1008 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1009 		c = &ic->ic_channels[i];
1010 		if (mode == IEEE80211_MODE_AUTO) {
1011 			if (c->ic_flags != 0)
1012 				break;
1013 		} else if ((c->ic_flags & modeflags) == modeflags)
1014 			break;
1015 	}
1016 	if (i > IEEE80211_CHAN_MAX) {
1017 		DPRINTF(("no channels found for mode %u\n", mode));
1018 		return EINVAL;
1019 	}
1020 
1021 	/*
1022 	 * Calculate the active channel set.
1023 	 */
1024 	memset(ic->ic_chan_active, 0, sizeof(ic->ic_chan_active));
1025 	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
1026 		c = &ic->ic_channels[i];
1027 		if (mode == IEEE80211_MODE_AUTO) {
1028 			if (c->ic_flags != 0)
1029 				setbit(ic->ic_chan_active, i);
1030 		} else if ((c->ic_flags & modeflags) == modeflags)
1031 			setbit(ic->ic_chan_active, i);
1032 	}
1033 	/*
1034 	 * If no current/default channel is setup or the current
1035 	 * channel is wrong for the mode then pick the first
1036 	 * available channel from the active list.  This is likely
1037 	 * not the right one.
1038 	 */
1039 	if (ic->ic_ibss_chan == NULL || isclr(ic->ic_chan_active,
1040 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
1041 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
1042 			if (isset(ic->ic_chan_active, i)) {
1043 				ic->ic_ibss_chan = &ic->ic_channels[i];
1044 				break;
1045 			}
1046 		if ((ic->ic_ibss_chan == NULL) || isclr(ic->ic_chan_active,
1047 		    ieee80211_chan2ieee(ic, ic->ic_ibss_chan)))
1048 			panic("Bad IBSS channel %u",
1049 			    ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
1050 	}
1051 
1052 	/*
1053 	 * Reset the scan state for the new mode. This avoids scanning
1054 	 * of invalid channels, ie. 5GHz channels in 11b mode.
1055 	 */
1056 	ieee80211_reset_scan(ifp);
1057 
1058 	ic->ic_curmode = mode;
1059 	ieee80211_reset_erp(ic);	/* reset ERP state */
1060 
1061 	return 0;
1062 }
1063 
1064 enum ieee80211_phymode
1065 ieee80211_next_mode(struct ifnet *ifp)
1066 {
1067 	struct ieee80211com *ic = (void *)ifp;
1068 	uint16_t mode;
1069 
1070 	/*
1071 	 * Indicate a wrap-around if we're running in a fixed, user-specified
1072 	 * phy mode.
1073 	 */
1074 	if (IFM_MODE(ic->ic_media.ifm_cur->ifm_media) != IFM_AUTO)
1075 		return (IEEE80211_MODE_AUTO);
1076 
1077 	/*
1078 	 * Always scan in AUTO mode if the driver scans all bands.
1079 	 * The current mode might have changed during association
1080 	 * so we must reset it here.
1081 	 */
1082 	if (ic->ic_caps & IEEE80211_C_SCANALLBAND) {
1083 		ieee80211_setmode(ic, IEEE80211_MODE_AUTO);
1084 		return (ic->ic_curmode);
1085 	}
1086 
1087 	/*
1088 	 * Get the next supported mode; effectively, this alternates between
1089 	 * the 11a (5GHz) and 11b/g (2GHz) modes. What matters is that each
1090 	 * supported channel gets scanned.
1091 	 */
1092 	for (mode = ic->ic_curmode + 1; mode <= IEEE80211_MODE_MAX; mode++) {
1093 		/*
1094 		 * Skip over 11n mode. Its set of channels is the superset
1095 		 * of all channels supported by the other modes.
1096 		 */
1097 		if (mode == IEEE80211_MODE_11N)
1098 			continue;
1099 		/*
1100 		 * Skip over 11ac mode. Its set of channels is the set
1101 		 * of all channels supported by 11a.
1102 		 */
1103 		if (mode == IEEE80211_MODE_11AC)
1104 			continue;
1105 
1106 		/* Start over if we have already tried all modes. */
1107 		if (mode == IEEE80211_MODE_MAX) {
1108 			mode = IEEE80211_MODE_AUTO;
1109 			break;
1110 		}
1111 
1112 		if (ic->ic_modecaps & (1 << mode))
1113 			break;
1114 	}
1115 
1116 	if (mode != ic->ic_curmode)
1117 		ieee80211_setmode(ic, mode);
1118 
1119 	return (ic->ic_curmode);
1120 }
1121 
1122 /*
1123  * Return the phy mode for with the specified channel so the
1124  * caller can select a rate set.  This is problematic and the
1125  * work here assumes how things work elsewhere in this code.
1126  *
1127  * Because the result of this function is ultimately used to select a
1128  * rate from the rate set of the returned mode, it must return one of the
1129  * legacy 11a/b/g modes; 11n and 11ac modes use MCS instead of rate sets.
1130  */
1131 enum ieee80211_phymode
1132 ieee80211_chan2mode(struct ieee80211com *ic,
1133     const struct ieee80211_channel *chan)
1134 {
1135 	/*
1136 	 * Are we fixed in 11a/b/g mode?
1137 	 * NB: this assumes the channel would not be supplied to us
1138 	 *     unless it was already compatible with the current mode.
1139 	 */
1140 	if (ic->ic_curmode == IEEE80211_MODE_11A ||
1141 	    ic->ic_curmode == IEEE80211_MODE_11B ||
1142 	    ic->ic_curmode == IEEE80211_MODE_11G)
1143 		return ic->ic_curmode;
1144 
1145 	/* If no channel was provided, return the most suitable legacy mode. */
1146 	if (chan == IEEE80211_CHAN_ANYC) {
1147 		switch (ic->ic_curmode) {
1148 		case IEEE80211_MODE_AUTO:
1149 		case IEEE80211_MODE_11N:
1150 			if (ic->ic_modecaps & (1 << IEEE80211_MODE_11A))
1151 				return IEEE80211_MODE_11A;
1152 			if (ic->ic_modecaps & (1 << IEEE80211_MODE_11G))
1153 				return IEEE80211_MODE_11G;
1154 			return IEEE80211_MODE_11B;
1155 		case IEEE80211_MODE_11AC:
1156 			return IEEE80211_MODE_11A;
1157 		default:
1158 			return ic->ic_curmode;
1159 		}
1160 	}
1161 
1162 	/* Deduce a legacy mode based on the channel characteristics. */
1163 	if (IEEE80211_IS_CHAN_5GHZ(chan))
1164 		return IEEE80211_MODE_11A;
1165 	else if (chan->ic_flags & (IEEE80211_CHAN_OFDM|IEEE80211_CHAN_DYN))
1166 		return IEEE80211_MODE_11G;
1167 	else
1168 		return IEEE80211_MODE_11B;
1169 }
1170 
1171 /*
1172  * Convert IEEE80211 MCS index to ifmedia subtype.
1173  */
1174 uint64_t
1175 ieee80211_mcs2media(struct ieee80211com *ic, int mcs,
1176     enum ieee80211_phymode mode)
1177 {
1178 	switch (mode) {
1179 	case IEEE80211_MODE_11A:
1180 	case IEEE80211_MODE_11B:
1181 	case IEEE80211_MODE_11G:
1182 		/* these modes use rates, not MCS */
1183 		panic("%s: unexpected mode %d", __func__, mode);
1184 		break;
1185 	case IEEE80211_MODE_11N:
1186 		if (mcs >= 0 && mcs < IEEE80211_HT_NUM_MCS)
1187 			return (IFM_IEEE80211_11N |
1188 			    (IFM_IEEE80211_HT_MCS0 + mcs));
1189 		break;
1190 	case IEEE80211_MODE_11AC:
1191 		if (mcs >= 0 && mcs < IEEE80211_VHT_NUM_MCS)
1192 			return (IFM_IEEE80211_11AC |
1193 			    (IFM_IEEE80211_VHT_MCS0 + mcs));
1194 		break;
1195 	case IEEE80211_MODE_AUTO:
1196 		break;
1197 	}
1198 
1199 	return IFM_AUTO;
1200 }
1201 
1202 /*
1203  * Convert ifmedia subtype to IEEE80211 MCS index.
1204  */
1205 int
1206 ieee80211_media2mcs(uint64_t mword)
1207 {
1208 	uint64_t subtype;
1209 
1210 	subtype = IFM_SUBTYPE(mword);
1211 
1212 	if (subtype == IFM_AUTO)
1213 		return -1;
1214 	else if (subtype == IFM_MANUAL || subtype == IFM_NONE)
1215 		return 0;
1216 
1217 	if (subtype >= IFM_IEEE80211_HT_MCS0 &&
1218 	    subtype <= IFM_IEEE80211_HT_MCS76)
1219 		return (int)(subtype - IFM_IEEE80211_HT_MCS0);
1220 
1221 	if (subtype >= IFM_IEEE80211_VHT_MCS0 &&
1222 	    subtype <= IFM_IEEE80211_VHT_MCS9)
1223 		return (int)(subtype - IFM_IEEE80211_VHT_MCS0);
1224 
1225 	return -1;
1226 }
1227 
1228 /*
1229  * convert IEEE80211 rate value to ifmedia subtype.
1230  * ieee80211 rate is in unit of 0.5Mbps.
1231  */
1232 uint64_t
1233 ieee80211_rate2media(struct ieee80211com *ic, int rate,
1234     enum ieee80211_phymode mode)
1235 {
1236 	static const struct {
1237 		uint64_t	m;	/* rate + mode */
1238 		uint64_t	r;	/* if_media rate */
1239 	} rates[] = {
1240 		{   2 | IFM_IEEE80211_11B, IFM_IEEE80211_DS1 },
1241 		{   4 | IFM_IEEE80211_11B, IFM_IEEE80211_DS2 },
1242 		{  11 | IFM_IEEE80211_11B, IFM_IEEE80211_DS5 },
1243 		{  22 | IFM_IEEE80211_11B, IFM_IEEE80211_DS11 },
1244 		{  44 | IFM_IEEE80211_11B, IFM_IEEE80211_DS22 },
1245 		{  12 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM6 },
1246 		{  18 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM9 },
1247 		{  24 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM12 },
1248 		{  36 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM18 },
1249 		{  48 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM24 },
1250 		{  72 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM36 },
1251 		{  96 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM48 },
1252 		{ 108 | IFM_IEEE80211_11A, IFM_IEEE80211_OFDM54 },
1253 		{   2 | IFM_IEEE80211_11G, IFM_IEEE80211_DS1 },
1254 		{   4 | IFM_IEEE80211_11G, IFM_IEEE80211_DS2 },
1255 		{  11 | IFM_IEEE80211_11G, IFM_IEEE80211_DS5 },
1256 		{  22 | IFM_IEEE80211_11G, IFM_IEEE80211_DS11 },
1257 		{  12 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM6 },
1258 		{  18 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM9 },
1259 		{  24 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM12 },
1260 		{  36 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM18 },
1261 		{  48 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM24 },
1262 		{  72 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM36 },
1263 		{  96 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM48 },
1264 		{ 108 | IFM_IEEE80211_11G, IFM_IEEE80211_OFDM54 },
1265 		/* NB: OFDM72 doesn't really exist so we don't handle it */
1266 	};
1267 	uint64_t mask;
1268 	int i;
1269 
1270 	mask = rate & IEEE80211_RATE_VAL;
1271 	switch (mode) {
1272 	case IEEE80211_MODE_11A:
1273 		mask |= IFM_IEEE80211_11A;
1274 		break;
1275 	case IEEE80211_MODE_11B:
1276 		mask |= IFM_IEEE80211_11B;
1277 		break;
1278 	case IEEE80211_MODE_AUTO:
1279 		/* NB: hack, 11g matches both 11b+11a rates */
1280 		/* FALLTHROUGH */
1281 	case IEEE80211_MODE_11G:
1282 		mask |= IFM_IEEE80211_11G;
1283 		break;
1284 	case IEEE80211_MODE_11N:
1285 	case IEEE80211_MODE_11AC:
1286 		/* 11n/11ac uses MCS, not rates. */
1287 		panic("%s: unexpected mode %d", __func__, mode);
1288 		break;
1289 	}
1290 	for (i = 0; i < nitems(rates); i++)
1291 		if (rates[i].m == mask)
1292 			return rates[i].r;
1293 	return IFM_AUTO;
1294 }
1295 
1296 int
1297 ieee80211_media2rate(uint64_t mword)
1298 {
1299 	int i;
1300 	static const struct {
1301 		uint64_t subtype;
1302 		int rate;
1303 	} ieeerates[] = {
1304 		{ IFM_AUTO,		-1	},
1305 		{ IFM_MANUAL,		0	},
1306 		{ IFM_NONE,		0	},
1307 		{ IFM_IEEE80211_DS1,	2	},
1308 		{ IFM_IEEE80211_DS2,	4	},
1309 		{ IFM_IEEE80211_DS5,	11	},
1310 		{ IFM_IEEE80211_DS11,	22	},
1311 		{ IFM_IEEE80211_DS22,	44	},
1312 		{ IFM_IEEE80211_OFDM6,	12	},
1313 		{ IFM_IEEE80211_OFDM9,	18	},
1314 		{ IFM_IEEE80211_OFDM12,	24	},
1315 		{ IFM_IEEE80211_OFDM18,	36	},
1316 		{ IFM_IEEE80211_OFDM24,	48	},
1317 		{ IFM_IEEE80211_OFDM36,	72	},
1318 		{ IFM_IEEE80211_OFDM48,	96	},
1319 		{ IFM_IEEE80211_OFDM54,	108	},
1320 		{ IFM_IEEE80211_OFDM72,	144	},
1321 	};
1322 	for (i = 0; i < nitems(ieeerates); i++) {
1323 		if (ieeerates[i].subtype == IFM_SUBTYPE(mword))
1324 			return ieeerates[i].rate;
1325 	}
1326 	return 0;
1327 }
1328 
1329 /*
1330  * Convert bit rate (in 0.5Mbps units) to PLCP signal (R4-R1) and vice versa.
1331  */
1332 u_int8_t
1333 ieee80211_rate2plcp(u_int8_t rate, enum ieee80211_phymode mode)
1334 {
1335 	rate &= IEEE80211_RATE_VAL;
1336 
1337 	if (mode == IEEE80211_MODE_11B) {
1338 		/* IEEE Std 802.11b-1999 page 15, subclause 18.2.3.3 */
1339 		switch (rate) {
1340 		case 2:		return 10;
1341 		case 4:		return 20;
1342 		case 11:	return 55;
1343 		case 22:	return 110;
1344 		/* IEEE Std 802.11g-2003 page 19, subclause 19.3.2.1 */
1345 		case 44:	return 220;
1346 		}
1347 	} else if (mode == IEEE80211_MODE_11G || mode == IEEE80211_MODE_11A) {
1348 		/* IEEE Std 802.11a-1999 page 14, subclause 17.3.4.1 */
1349 		switch (rate) {
1350 		case 12:	return 0x0b;
1351 		case 18:	return 0x0f;
1352 		case 24:	return 0x0a;
1353 		case 36:	return 0x0e;
1354 		case 48:	return 0x09;
1355 		case 72:	return 0x0d;
1356 		case 96:	return 0x08;
1357 		case 108:	return 0x0c;
1358 		}
1359         } else
1360 		panic("%s: unexpected mode %u", __func__, mode);
1361 
1362 	DPRINTF(("unsupported rate %u\n", rate));
1363 
1364 	return 0;
1365 }
1366 
1367 u_int8_t
1368 ieee80211_plcp2rate(u_int8_t plcp, enum ieee80211_phymode mode)
1369 {
1370 	if (mode == IEEE80211_MODE_11B) {
1371 		/* IEEE Std 802.11g-2003 page 19, subclause 19.3.2.1 */
1372 		switch (plcp) {
1373 		case 10:	return 2;
1374 		case 20:	return 4;
1375 		case 55:	return 11;
1376 		case 110:	return 22;
1377 		/* IEEE Std 802.11g-2003 page 19, subclause 19.3.2.1 */
1378 		case 220:	return 44;
1379 		}
1380 	} else if (mode == IEEE80211_MODE_11G || mode == IEEE80211_MODE_11A) {
1381 		/* IEEE Std 802.11a-1999 page 14, subclause 17.3.4.1 */
1382 		switch (plcp) {
1383 		case 0x0b:	return 12;
1384 		case 0x0f:	return 18;
1385 		case 0x0a:	return 24;
1386 		case 0x0e:	return 36;
1387 		case 0x09:	return 48;
1388 		case 0x0d:	return 72;
1389 		case 0x08:	return 96;
1390 		case 0x0c:	return 108;
1391 		}
1392 	} else
1393 		panic("%s: unexpected mode %u", __func__, mode);
1394 
1395 	DPRINTF(("unsupported plcp %u\n", plcp));
1396 
1397 	return 0;
1398 }
1399