xref: /freebsd/sys/net80211/ieee80211_ht.c (revision ae2d96ab3a7a4582bff7d420017c05777d3ef4cd)
1 /*-
2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 #ifdef __FreeBSD__
28 __FBSDID("$FreeBSD$");
29 #endif
30 
31 /*
32  * IEEE 802.11n protocol support.
33  */
34 
35 #include "opt_inet.h"
36 #include "opt_wlan.h"
37 
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/systm.h>
41 #include <sys/endian.h>
42 
43 #include <sys/socket.h>
44 
45 #include <net/if.h>
46 #include <net/if_var.h>
47 #include <net/if_media.h>
48 #include <net/ethernet.h>
49 
50 #include <net80211/ieee80211_var.h>
51 #include <net80211/ieee80211_action.h>
52 #include <net80211/ieee80211_input.h>
53 
54 /* define here, used throughout file */
55 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
56 #define	SM(_v, _f)	(((_v) << _f##_S) & _f)
57 
58 const struct ieee80211_mcs_rates ieee80211_htrates[IEEE80211_HTRATE_MAXSIZE] = {
59 	{  13,  14,   27,   30 },	/* MCS 0 */
60 	{  26,  29,   54,   60 },	/* MCS 1 */
61 	{  39,  43,   81,   90 },	/* MCS 2 */
62 	{  52,  58,  108,  120 },	/* MCS 3 */
63 	{  78,  87,  162,  180 },	/* MCS 4 */
64 	{ 104, 116,  216,  240 },	/* MCS 5 */
65 	{ 117, 130,  243,  270 },	/* MCS 6 */
66 	{ 130, 144,  270,  300 },	/* MCS 7 */
67 	{  26,  29,   54,   60 },	/* MCS 8 */
68 	{  52,  58,  108,  120 },	/* MCS 9 */
69 	{  78,  87,  162,  180 },	/* MCS 10 */
70 	{ 104, 116,  216,  240 },	/* MCS 11 */
71 	{ 156, 173,  324,  360 },	/* MCS 12 */
72 	{ 208, 231,  432,  480 },	/* MCS 13 */
73 	{ 234, 260,  486,  540 },	/* MCS 14 */
74 	{ 260, 289,  540,  600 },	/* MCS 15 */
75 	{  39,  43,   81,   90 },	/* MCS 16 */
76 	{  78,  87,  162,  180 },	/* MCS 17 */
77 	{ 117, 130,  243,  270 },	/* MCS 18 */
78 	{ 156, 173,  324,  360 },	/* MCS 19 */
79 	{ 234, 260,  486,  540 },	/* MCS 20 */
80 	{ 312, 347,  648,  720 },	/* MCS 21 */
81 	{ 351, 390,  729,  810 },	/* MCS 22 */
82 	{ 390, 433,  810,  900 },	/* MCS 23 */
83 	{  52,  58,  108,  120 },	/* MCS 24 */
84 	{ 104, 116,  216,  240 },	/* MCS 25 */
85 	{ 156, 173,  324,  360 },	/* MCS 26 */
86 	{ 208, 231,  432,  480 },	/* MCS 27 */
87 	{ 312, 347,  648,  720 },	/* MCS 28 */
88 	{ 416, 462,  864,  960 },	/* MCS 29 */
89 	{ 468, 520,  972, 1080 },	/* MCS 30 */
90 	{ 520, 578, 1080, 1200 },	/* MCS 31 */
91 	{   0,   0,   12,   13 },	/* MCS 32 */
92 	{  78,  87,  162,  180 },	/* MCS 33 */
93 	{ 104, 116,  216,  240 },	/* MCS 34 */
94 	{ 130, 144,  270,  300 },	/* MCS 35 */
95 	{ 117, 130,  243,  270 },	/* MCS 36 */
96 	{ 156, 173,  324,  360 },	/* MCS 37 */
97 	{ 195, 217,  405,  450 },	/* MCS 38 */
98 	{ 104, 116,  216,  240 },	/* MCS 39 */
99 	{ 130, 144,  270,  300 },	/* MCS 40 */
100 	{ 130, 144,  270,  300 },	/* MCS 41 */
101 	{ 156, 173,  324,  360 },	/* MCS 42 */
102 	{ 182, 202,  378,  420 },	/* MCS 43 */
103 	{ 182, 202,  378,  420 },	/* MCS 44 */
104 	{ 208, 231,  432,  480 },	/* MCS 45 */
105 	{ 156, 173,  324,  360 },	/* MCS 46 */
106 	{ 195, 217,  405,  450 },	/* MCS 47 */
107 	{ 195, 217,  405,  450 },	/* MCS 48 */
108 	{ 234, 260,  486,  540 },	/* MCS 49 */
109 	{ 273, 303,  567,  630 },	/* MCS 50 */
110 	{ 273, 303,  567,  630 },	/* MCS 51 */
111 	{ 312, 347,  648,  720 },	/* MCS 52 */
112 	{ 130, 144,  270,  300 },	/* MCS 53 */
113 	{ 156, 173,  324,  360 },	/* MCS 54 */
114 	{ 182, 202,  378,  420 },	/* MCS 55 */
115 	{ 156, 173,  324,  360 },	/* MCS 56 */
116 	{ 182, 202,  378,  420 },	/* MCS 57 */
117 	{ 208, 231,  432,  480 },	/* MCS 58 */
118 	{ 234, 260,  486,  540 },	/* MCS 59 */
119 	{ 208, 231,  432,  480 },	/* MCS 60 */
120 	{ 234, 260,  486,  540 },	/* MCS 61 */
121 	{ 260, 289,  540,  600 },	/* MCS 62 */
122 	{ 260, 289,  540,  600 },	/* MCS 63 */
123 	{ 286, 318,  594,  660 },	/* MCS 64 */
124 	{ 195, 217,  405,  450 },	/* MCS 65 */
125 	{ 234, 260,  486,  540 },	/* MCS 66 */
126 	{ 273, 303,  567,  630 },	/* MCS 67 */
127 	{ 234, 260,  486,  540 },	/* MCS 68 */
128 	{ 273, 303,  567,  630 },	/* MCS 69 */
129 	{ 312, 347,  648,  720 },	/* MCS 70 */
130 	{ 351, 390,  729,  810 },	/* MCS 71 */
131 	{ 312, 347,  648,  720 },	/* MCS 72 */
132 	{ 351, 390,  729,  810 },	/* MCS 73 */
133 	{ 390, 433,  810,  900 },	/* MCS 74 */
134 	{ 390, 433,  810,  900 },	/* MCS 75 */
135 	{ 429, 477,  891,  990 },	/* MCS 76 */
136 };
137 
138 #ifdef IEEE80211_AMPDU_AGE
139 static	int ieee80211_ampdu_age = -1;	/* threshold for ampdu reorder q (ms) */
140 SYSCTL_PROC(_net_wlan, OID_AUTO, ampdu_age, CTLTYPE_INT | CTLFLAG_RW,
141 	&ieee80211_ampdu_age, 0, ieee80211_sysctl_msecs_ticks, "I",
142 	"AMPDU max reorder age (ms)");
143 #endif
144 
145 static	int ieee80211_recv_bar_ena = 1;
146 SYSCTL_INT(_net_wlan, OID_AUTO, recv_bar, CTLFLAG_RW, &ieee80211_recv_bar_ena,
147 	    0, "BAR frame processing (ena/dis)");
148 
149 static	int ieee80211_addba_timeout = -1;/* timeout for ADDBA response */
150 SYSCTL_PROC(_net_wlan, OID_AUTO, addba_timeout, CTLTYPE_INT | CTLFLAG_RW,
151 	&ieee80211_addba_timeout, 0, ieee80211_sysctl_msecs_ticks, "I",
152 	"ADDBA request timeout (ms)");
153 static	int ieee80211_addba_backoff = -1;/* backoff after max ADDBA requests */
154 SYSCTL_PROC(_net_wlan, OID_AUTO, addba_backoff, CTLTYPE_INT | CTLFLAG_RW,
155 	&ieee80211_addba_backoff, 0, ieee80211_sysctl_msecs_ticks, "I",
156 	"ADDBA request backoff (ms)");
157 static	int ieee80211_addba_maxtries = 3;/* max ADDBA requests before backoff */
158 SYSCTL_INT(_net_wlan, OID_AUTO, addba_maxtries, CTLFLAG_RW,
159 	&ieee80211_addba_maxtries, 0, "max ADDBA requests sent before backoff");
160 
161 static	int ieee80211_bar_timeout = -1;	/* timeout waiting for BAR response */
162 static	int ieee80211_bar_maxtries = 50;/* max BAR requests before DELBA */
163 
164 static	ieee80211_recv_action_func ht_recv_action_ba_addba_request;
165 static	ieee80211_recv_action_func ht_recv_action_ba_addba_response;
166 static	ieee80211_recv_action_func ht_recv_action_ba_delba;
167 static	ieee80211_recv_action_func ht_recv_action_ht_mimopwrsave;
168 static	ieee80211_recv_action_func ht_recv_action_ht_txchwidth;
169 
170 static	ieee80211_send_action_func ht_send_action_ba_addba;
171 static	ieee80211_send_action_func ht_send_action_ba_delba;
172 static	ieee80211_send_action_func ht_send_action_ht_txchwidth;
173 
174 static void
175 ieee80211_ht_init(void)
176 {
177 	/*
178 	 * Setup HT parameters that depends on the clock frequency.
179 	 */
180 #ifdef IEEE80211_AMPDU_AGE
181 	ieee80211_ampdu_age = msecs_to_ticks(500);
182 #endif
183 	ieee80211_addba_timeout = msecs_to_ticks(250);
184 	ieee80211_addba_backoff = msecs_to_ticks(10*1000);
185 	ieee80211_bar_timeout = msecs_to_ticks(250);
186 	/*
187 	 * Register action frame handlers.
188 	 */
189 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_BA,
190 	    IEEE80211_ACTION_BA_ADDBA_REQUEST, ht_recv_action_ba_addba_request);
191 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_BA,
192 	    IEEE80211_ACTION_BA_ADDBA_RESPONSE, ht_recv_action_ba_addba_response);
193 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_BA,
194 	    IEEE80211_ACTION_BA_DELBA, ht_recv_action_ba_delba);
195 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_HT,
196 	    IEEE80211_ACTION_HT_MIMOPWRSAVE, ht_recv_action_ht_mimopwrsave);
197 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_HT,
198 	    IEEE80211_ACTION_HT_TXCHWIDTH, ht_recv_action_ht_txchwidth);
199 
200 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_BA,
201 	    IEEE80211_ACTION_BA_ADDBA_REQUEST, ht_send_action_ba_addba);
202 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_BA,
203 	    IEEE80211_ACTION_BA_ADDBA_RESPONSE, ht_send_action_ba_addba);
204 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_BA,
205 	    IEEE80211_ACTION_BA_DELBA, ht_send_action_ba_delba);
206 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_HT,
207 	    IEEE80211_ACTION_HT_TXCHWIDTH, ht_send_action_ht_txchwidth);
208 }
209 SYSINIT(wlan_ht, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_ht_init, NULL);
210 
211 static int ieee80211_ampdu_enable(struct ieee80211_node *ni,
212 	struct ieee80211_tx_ampdu *tap);
213 static int ieee80211_addba_request(struct ieee80211_node *ni,
214 	struct ieee80211_tx_ampdu *tap,
215 	int dialogtoken, int baparamset, int batimeout);
216 static int ieee80211_addba_response(struct ieee80211_node *ni,
217 	struct ieee80211_tx_ampdu *tap,
218 	int code, int baparamset, int batimeout);
219 static void ieee80211_addba_stop(struct ieee80211_node *ni,
220 	struct ieee80211_tx_ampdu *tap);
221 static void null_addba_response_timeout(struct ieee80211_node *ni,
222 	struct ieee80211_tx_ampdu *tap);
223 
224 static void ieee80211_bar_response(struct ieee80211_node *ni,
225 	struct ieee80211_tx_ampdu *tap, int status);
226 static void ampdu_tx_stop(struct ieee80211_tx_ampdu *tap);
227 static void bar_stop_timer(struct ieee80211_tx_ampdu *tap);
228 static int ampdu_rx_start(struct ieee80211_node *, struct ieee80211_rx_ampdu *,
229 	int baparamset, int batimeout, int baseqctl);
230 static void ampdu_rx_stop(struct ieee80211_node *, struct ieee80211_rx_ampdu *);
231 
232 void
233 ieee80211_ht_attach(struct ieee80211com *ic)
234 {
235 	/* setup default aggregation policy */
236 	ic->ic_recv_action = ieee80211_recv_action;
237 	ic->ic_send_action = ieee80211_send_action;
238 	ic->ic_ampdu_enable = ieee80211_ampdu_enable;
239 	ic->ic_addba_request = ieee80211_addba_request;
240 	ic->ic_addba_response = ieee80211_addba_response;
241 	ic->ic_addba_response_timeout = null_addba_response_timeout;
242 	ic->ic_addba_stop = ieee80211_addba_stop;
243 	ic->ic_bar_response = ieee80211_bar_response;
244 	ic->ic_ampdu_rx_start = ampdu_rx_start;
245 	ic->ic_ampdu_rx_stop = ampdu_rx_stop;
246 
247 	ic->ic_htprotmode = IEEE80211_PROT_RTSCTS;
248 	ic->ic_curhtprotmode = IEEE80211_HTINFO_OPMODE_PURE;
249 }
250 
251 void
252 ieee80211_ht_detach(struct ieee80211com *ic)
253 {
254 }
255 
256 void
257 ieee80211_ht_vattach(struct ieee80211vap *vap)
258 {
259 
260 	/* driver can override defaults */
261 	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_8K;
262 	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_NA;
263 	vap->iv_ampdu_limit = vap->iv_ampdu_rxmax;
264 	vap->iv_amsdu_limit = vap->iv_htcaps & IEEE80211_HTCAP_MAXAMSDU;
265 	/* tx aggregation traffic thresholds */
266 	vap->iv_ampdu_mintraffic[WME_AC_BK] = 128;
267 	vap->iv_ampdu_mintraffic[WME_AC_BE] = 64;
268 	vap->iv_ampdu_mintraffic[WME_AC_VO] = 32;
269 	vap->iv_ampdu_mintraffic[WME_AC_VI] = 32;
270 
271 	if (vap->iv_htcaps & IEEE80211_HTC_HT) {
272 		/*
273 		 * Device is HT capable; enable all HT-related
274 		 * facilities by default.
275 		 * XXX these choices may be too aggressive.
276 		 */
277 		vap->iv_flags_ht |= IEEE80211_FHT_HT
278 				 |  IEEE80211_FHT_HTCOMPAT
279 				 ;
280 		if (vap->iv_htcaps & IEEE80211_HTCAP_SHORTGI20)
281 			vap->iv_flags_ht |= IEEE80211_FHT_SHORTGI20;
282 		/* XXX infer from channel list? */
283 		if (vap->iv_htcaps & IEEE80211_HTCAP_CHWIDTH40) {
284 			vap->iv_flags_ht |= IEEE80211_FHT_USEHT40;
285 			if (vap->iv_htcaps & IEEE80211_HTCAP_SHORTGI40)
286 				vap->iv_flags_ht |= IEEE80211_FHT_SHORTGI40;
287 		}
288 		/* enable RIFS if capable */
289 		if (vap->iv_htcaps & IEEE80211_HTC_RIFS)
290 			vap->iv_flags_ht |= IEEE80211_FHT_RIFS;
291 
292 		/* NB: A-MPDU and A-MSDU rx are mandated, these are tx only */
293 		vap->iv_flags_ht |= IEEE80211_FHT_AMPDU_RX;
294 		if (vap->iv_htcaps & IEEE80211_HTC_AMPDU)
295 			vap->iv_flags_ht |= IEEE80211_FHT_AMPDU_TX;
296 		vap->iv_flags_ht |= IEEE80211_FHT_AMSDU_RX;
297 		if (vap->iv_htcaps & IEEE80211_HTC_AMSDU)
298 			vap->iv_flags_ht |= IEEE80211_FHT_AMSDU_TX;
299 	}
300 	/* NB: disable default legacy WDS, too many issues right now */
301 	if (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY)
302 		vap->iv_flags_ht &= ~IEEE80211_FHT_HT;
303 }
304 
305 void
306 ieee80211_ht_vdetach(struct ieee80211vap *vap)
307 {
308 }
309 
310 static int
311 ht_getrate(struct ieee80211com *ic, int index, enum ieee80211_phymode mode,
312     int ratetype)
313 {
314 	int mword, rate;
315 
316 	mword = ieee80211_rate2media(ic, index | IEEE80211_RATE_MCS, mode);
317 	if (IFM_SUBTYPE(mword) != IFM_IEEE80211_MCS)
318 		return (0);
319 	switch (ratetype) {
320 	case 0:
321 		rate = ieee80211_htrates[index].ht20_rate_800ns;
322 		break;
323 	case 1:
324 		rate = ieee80211_htrates[index].ht20_rate_400ns;
325 		break;
326 	case 2:
327 		rate = ieee80211_htrates[index].ht40_rate_800ns;
328 		break;
329 	default:
330 		rate = ieee80211_htrates[index].ht40_rate_400ns;
331 		break;
332 	}
333 	return (rate);
334 }
335 
336 static struct printranges {
337 	int	minmcs;
338 	int	maxmcs;
339 	int	txstream;
340 	int	ratetype;
341 	int	htcapflags;
342 } ranges[] = {
343 	{  0,  7, 1, 0, 0 },
344 	{  8, 15, 2, 0, 0 },
345 	{ 16, 23, 3, 0, 0 },
346 	{ 24, 31, 4, 0, 0 },
347 	{ 32,  0, 1, 2, IEEE80211_HTC_TXMCS32 },
348 	{ 33, 38, 2, 0, IEEE80211_HTC_TXUNEQUAL },
349 	{ 39, 52, 3, 0, IEEE80211_HTC_TXUNEQUAL },
350 	{ 53, 76, 4, 0, IEEE80211_HTC_TXUNEQUAL },
351 	{  0,  0, 0, 0, 0 },
352 };
353 
354 static void
355 ht_rateprint(struct ieee80211com *ic, enum ieee80211_phymode mode, int ratetype)
356 {
357 	int minrate, maxrate;
358 	struct printranges *range;
359 
360 	for (range = ranges; range->txstream != 0; range++) {
361 		if (ic->ic_txstream < range->txstream)
362 			continue;
363 		if (range->htcapflags &&
364 		    (ic->ic_htcaps & range->htcapflags) == 0)
365 			continue;
366 		if (ratetype < range->ratetype)
367 			continue;
368 		minrate = ht_getrate(ic, range->minmcs, mode, ratetype);
369 		maxrate = ht_getrate(ic, range->maxmcs, mode, ratetype);
370 		if (range->maxmcs) {
371 			ic_printf(ic, "MCS %d-%d: %d%sMbps - %d%sMbps\n",
372 			    range->minmcs, range->maxmcs,
373 			    minrate/2, ((minrate & 0x1) != 0 ? ".5" : ""),
374 			    maxrate/2, ((maxrate & 0x1) != 0 ? ".5" : ""));
375 		} else {
376 			ic_printf(ic, "MCS %d: %d%sMbps\n", range->minmcs,
377 			    minrate/2, ((minrate & 0x1) != 0 ? ".5" : ""));
378 		}
379 	}
380 }
381 
382 static void
383 ht_announce(struct ieee80211com *ic, enum ieee80211_phymode mode)
384 {
385 	const char *modestr = ieee80211_phymode_name[mode];
386 
387 	ic_printf(ic, "%s MCS 20MHz\n", modestr);
388 	ht_rateprint(ic, mode, 0);
389 	if (ic->ic_htcaps & IEEE80211_HTCAP_SHORTGI20) {
390 		ic_printf(ic, "%s MCS 20MHz SGI\n", modestr);
391 		ht_rateprint(ic, mode, 1);
392 	}
393 	if (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) {
394 		ic_printf(ic, "%s MCS 40MHz:\n", modestr);
395 		ht_rateprint(ic, mode, 2);
396 	}
397 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) &&
398 	    (ic->ic_htcaps & IEEE80211_HTCAP_SHORTGI40)) {
399 		ic_printf(ic, "%s MCS 40MHz SGI:\n", modestr);
400 		ht_rateprint(ic, mode, 3);
401 	}
402 }
403 
404 void
405 ieee80211_ht_announce(struct ieee80211com *ic)
406 {
407 
408 	if (isset(ic->ic_modecaps, IEEE80211_MODE_11NA) ||
409 	    isset(ic->ic_modecaps, IEEE80211_MODE_11NG))
410 		ic_printf(ic, "%dT%dR\n", ic->ic_txstream, ic->ic_rxstream);
411 	if (isset(ic->ic_modecaps, IEEE80211_MODE_11NA))
412 		ht_announce(ic, IEEE80211_MODE_11NA);
413 	if (isset(ic->ic_modecaps, IEEE80211_MODE_11NG))
414 		ht_announce(ic, IEEE80211_MODE_11NG);
415 }
416 
417 static struct ieee80211_htrateset htrateset;
418 
419 const struct ieee80211_htrateset *
420 ieee80211_get_suphtrates(struct ieee80211com *ic,
421     const struct ieee80211_channel *c)
422 {
423 #define	ADDRATE(x)	do {						\
424 	htrateset.rs_rates[htrateset.rs_nrates] = x;			\
425 	htrateset.rs_nrates++;						\
426 } while (0)
427 	int i;
428 
429 	memset(&htrateset, 0, sizeof(struct ieee80211_htrateset));
430 	for (i = 0; i < ic->ic_txstream * 8; i++)
431 		ADDRATE(i);
432 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) &&
433 	    (ic->ic_htcaps & IEEE80211_HTC_TXMCS32))
434 		ADDRATE(32);
435 	if (ic->ic_htcaps & IEEE80211_HTC_TXUNEQUAL) {
436 		if (ic->ic_txstream >= 2) {
437 			 for (i = 33; i <= 38; i++)
438 				ADDRATE(i);
439 		}
440 		if (ic->ic_txstream >= 3) {
441 			for (i = 39; i <= 52; i++)
442 				ADDRATE(i);
443 		}
444 		if (ic->ic_txstream == 4) {
445 			for (i = 53; i <= 76; i++)
446 				ADDRATE(i);
447 		}
448 	}
449 	return &htrateset;
450 #undef	ADDRATE
451 }
452 
453 /*
454  * Receive processing.
455  */
456 
457 /*
458  * Decap the encapsulated A-MSDU frames and dispatch all but
459  * the last for delivery.  The last frame is returned for
460  * delivery via the normal path.
461  */
462 struct mbuf *
463 ieee80211_decap_amsdu(struct ieee80211_node *ni, struct mbuf *m)
464 {
465 	struct ieee80211vap *vap = ni->ni_vap;
466 	int framelen;
467 	struct mbuf *n;
468 
469 	/* discard 802.3 header inserted by ieee80211_decap */
470 	m_adj(m, sizeof(struct ether_header));
471 
472 	vap->iv_stats.is_amsdu_decap++;
473 
474 	for (;;) {
475 		/*
476 		 * Decap the first frame, bust it apart from the
477 		 * remainder and deliver.  We leave the last frame
478 		 * delivery to the caller (for consistency with other
479 		 * code paths, could also do it here).
480 		 */
481 		m = ieee80211_decap1(m, &framelen);
482 		if (m == NULL) {
483 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
484 			    ni->ni_macaddr, "a-msdu", "%s", "decap failed");
485 			vap->iv_stats.is_amsdu_tooshort++;
486 			return NULL;
487 		}
488 		if (m->m_pkthdr.len == framelen)
489 			break;
490 		n = m_split(m, framelen, M_NOWAIT);
491 		if (n == NULL) {
492 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
493 			    ni->ni_macaddr, "a-msdu",
494 			    "%s", "unable to split encapsulated frames");
495 			vap->iv_stats.is_amsdu_split++;
496 			m_freem(m);			/* NB: must reclaim */
497 			return NULL;
498 		}
499 		vap->iv_deliver_data(vap, ni, m);
500 
501 		/*
502 		 * Remove frame contents; each intermediate frame
503 		 * is required to be aligned to a 4-byte boundary.
504 		 */
505 		m = n;
506 		m_adj(m, roundup2(framelen, 4) - framelen);	/* padding */
507 	}
508 	return m;				/* last delivered by caller */
509 }
510 
511 /*
512  * Purge all frames in the A-MPDU re-order queue.
513  */
514 static void
515 ampdu_rx_purge(struct ieee80211_rx_ampdu *rap)
516 {
517 	struct mbuf *m;
518 	int i;
519 
520 	for (i = 0; i < rap->rxa_wnd; i++) {
521 		m = rap->rxa_m[i];
522 		if (m != NULL) {
523 			rap->rxa_m[i] = NULL;
524 			rap->rxa_qbytes -= m->m_pkthdr.len;
525 			m_freem(m);
526 			if (--rap->rxa_qframes == 0)
527 				break;
528 		}
529 	}
530 	KASSERT(rap->rxa_qbytes == 0 && rap->rxa_qframes == 0,
531 	    ("lost %u data, %u frames on ampdu rx q",
532 	    rap->rxa_qbytes, rap->rxa_qframes));
533 }
534 
535 /*
536  * Start A-MPDU rx/re-order processing for the specified TID.
537  */
538 static int
539 ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
540 	int baparamset, int batimeout, int baseqctl)
541 {
542 	int bufsiz = MS(baparamset, IEEE80211_BAPS_BUFSIZ);
543 
544 	if (rap->rxa_flags & IEEE80211_AGGR_RUNNING) {
545 		/*
546 		 * AMPDU previously setup and not terminated with a DELBA,
547 		 * flush the reorder q's in case anything remains.
548 		 */
549 		ampdu_rx_purge(rap);
550 	}
551 	memset(rap, 0, sizeof(*rap));
552 	rap->rxa_wnd = (bufsiz == 0) ?
553 	    IEEE80211_AGGR_BAWMAX : min(bufsiz, IEEE80211_AGGR_BAWMAX);
554 	rap->rxa_start = MS(baseqctl, IEEE80211_BASEQ_START);
555 	rap->rxa_flags |=  IEEE80211_AGGR_RUNNING | IEEE80211_AGGR_XCHGPEND;
556 
557 	return 0;
558 }
559 
560 /*
561  * Public function; manually setup the RX ampdu state.
562  */
563 int
564 ieee80211_ampdu_rx_start_ext(struct ieee80211_node *ni, int tid, int seq, int baw)
565 {
566 	struct ieee80211_rx_ampdu *rap;
567 
568 	/* XXX TODO: sanity check tid, seq, baw */
569 
570 	rap = &ni->ni_rx_ampdu[tid];
571 
572 	if (rap->rxa_flags & IEEE80211_AGGR_RUNNING) {
573 		/*
574 		 * AMPDU previously setup and not terminated with a DELBA,
575 		 * flush the reorder q's in case anything remains.
576 		 */
577 		ampdu_rx_purge(rap);
578 	}
579 
580 	memset(rap, 0, sizeof(*rap));
581 	rap->rxa_wnd = (baw== 0) ?
582 	    IEEE80211_AGGR_BAWMAX : min(baw, IEEE80211_AGGR_BAWMAX);
583 	rap->rxa_start = seq;
584 	rap->rxa_flags |=  IEEE80211_AGGR_RUNNING | IEEE80211_AGGR_XCHGPEND;
585 
586 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N, ni,
587 	    "%s: tid=%d, start=%d, wnd=%d, flags=0x%08x\n",
588 	    __func__,
589 	    tid,
590 	    seq,
591 	    rap->rxa_wnd,
592 	    rap->rxa_flags);
593 
594 	return 0;
595 }
596 
597 /*
598  * Stop A-MPDU rx processing for the specified TID.
599  */
600 static void
601 ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
602 {
603 
604 	ampdu_rx_purge(rap);
605 	rap->rxa_flags &= ~(IEEE80211_AGGR_RUNNING | IEEE80211_AGGR_XCHGPEND);
606 }
607 
608 /*
609  * Dispatch a frame from the A-MPDU reorder queue.  The
610  * frame is fed back into ieee80211_input marked with an
611  * M_AMPDU_MPDU flag so it doesn't come back to us (it also
612  * permits ieee80211_input to optimize re-processing).
613  */
614 static __inline void
615 ampdu_dispatch(struct ieee80211_node *ni, struct mbuf *m)
616 {
617 	m->m_flags |= M_AMPDU_MPDU;	/* bypass normal processing */
618 	/* NB: rssi and noise are ignored w/ M_AMPDU_MPDU set */
619 	(void) ieee80211_input(ni, m, 0, 0);
620 }
621 
622 /*
623  * Dispatch as many frames as possible from the re-order queue.
624  * Frames will always be "at the front"; we process all frames
625  * up to the first empty slot in the window.  On completion we
626  * cleanup state if there are still pending frames in the current
627  * BA window.  We assume the frame at slot 0 is already handled
628  * by the caller; we always start at slot 1.
629  */
630 static void
631 ampdu_rx_dispatch(struct ieee80211_rx_ampdu *rap, struct ieee80211_node *ni)
632 {
633 	struct ieee80211vap *vap = ni->ni_vap;
634 	struct mbuf *m;
635 	int i;
636 
637 	/* flush run of frames */
638 	for (i = 1; i < rap->rxa_wnd; i++) {
639 		m = rap->rxa_m[i];
640 		if (m == NULL)
641 			break;
642 		rap->rxa_m[i] = NULL;
643 		rap->rxa_qbytes -= m->m_pkthdr.len;
644 		rap->rxa_qframes--;
645 
646 		ampdu_dispatch(ni, m);
647 	}
648 	/*
649 	 * If frames remain, copy the mbuf pointers down so
650 	 * they correspond to the offsets in the new window.
651 	 */
652 	if (rap->rxa_qframes != 0) {
653 		int n = rap->rxa_qframes, j;
654 		for (j = i+1; j < rap->rxa_wnd; j++) {
655 			if (rap->rxa_m[j] != NULL) {
656 				rap->rxa_m[j-i] = rap->rxa_m[j];
657 				rap->rxa_m[j] = NULL;
658 				if (--n == 0)
659 					break;
660 			}
661 		}
662 		KASSERT(n == 0, ("lost %d frames", n));
663 		vap->iv_stats.is_ampdu_rx_copy += rap->rxa_qframes;
664 	}
665 	/*
666 	 * Adjust the start of the BA window to
667 	 * reflect the frames just dispatched.
668 	 */
669 	rap->rxa_start = IEEE80211_SEQ_ADD(rap->rxa_start, i);
670 	vap->iv_stats.is_ampdu_rx_oor += i;
671 }
672 
673 #ifdef IEEE80211_AMPDU_AGE
674 /*
675  * Dispatch all frames in the A-MPDU re-order queue.
676  */
677 static void
678 ampdu_rx_flush(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
679 {
680 	struct ieee80211vap *vap = ni->ni_vap;
681 	struct mbuf *m;
682 	int i;
683 
684 	for (i = 0; i < rap->rxa_wnd; i++) {
685 		m = rap->rxa_m[i];
686 		if (m == NULL)
687 			continue;
688 		rap->rxa_m[i] = NULL;
689 		rap->rxa_qbytes -= m->m_pkthdr.len;
690 		rap->rxa_qframes--;
691 		vap->iv_stats.is_ampdu_rx_oor++;
692 
693 		ampdu_dispatch(ni, m);
694 		if (rap->rxa_qframes == 0)
695 			break;
696 	}
697 }
698 #endif /* IEEE80211_AMPDU_AGE */
699 
700 /*
701  * Dispatch all frames in the A-MPDU re-order queue
702  * preceding the specified sequence number.  This logic
703  * handles window moves due to a received MSDU or BAR.
704  */
705 static void
706 ampdu_rx_flush_upto(struct ieee80211_node *ni,
707 	struct ieee80211_rx_ampdu *rap, ieee80211_seq winstart)
708 {
709 	struct ieee80211vap *vap = ni->ni_vap;
710 	struct mbuf *m;
711 	ieee80211_seq seqno;
712 	int i;
713 
714 	/*
715 	 * Flush any complete MSDU's with a sequence number lower
716 	 * than winstart.  Gaps may exist.  Note that we may actually
717 	 * dispatch frames past winstart if a run continues; this is
718 	 * an optimization that avoids having to do a separate pass
719 	 * to dispatch frames after moving the BA window start.
720 	 */
721 	seqno = rap->rxa_start;
722 	for (i = 0; i < rap->rxa_wnd; i++) {
723 		m = rap->rxa_m[i];
724 		if (m != NULL) {
725 			rap->rxa_m[i] = NULL;
726 			rap->rxa_qbytes -= m->m_pkthdr.len;
727 			rap->rxa_qframes--;
728 			vap->iv_stats.is_ampdu_rx_oor++;
729 
730 			ampdu_dispatch(ni, m);
731 		} else {
732 			if (!IEEE80211_SEQ_BA_BEFORE(seqno, winstart))
733 				break;
734 		}
735 		seqno = IEEE80211_SEQ_INC(seqno);
736 	}
737 	/*
738 	 * If frames remain, copy the mbuf pointers down so
739 	 * they correspond to the offsets in the new window.
740 	 */
741 	if (rap->rxa_qframes != 0) {
742 		int n = rap->rxa_qframes, j;
743 
744 		/* NB: this loop assumes i > 0 and/or rxa_m[0] is NULL */
745 		KASSERT(rap->rxa_m[0] == NULL,
746 		    ("%s: BA window slot 0 occupied", __func__));
747 		for (j = i+1; j < rap->rxa_wnd; j++) {
748 			if (rap->rxa_m[j] != NULL) {
749 				rap->rxa_m[j-i] = rap->rxa_m[j];
750 				rap->rxa_m[j] = NULL;
751 				if (--n == 0)
752 					break;
753 			}
754 		}
755 		KASSERT(n == 0, ("%s: lost %d frames, qframes %d off %d "
756 		    "BA win <%d:%d> winstart %d",
757 		    __func__, n, rap->rxa_qframes, i, rap->rxa_start,
758 		    IEEE80211_SEQ_ADD(rap->rxa_start, rap->rxa_wnd-1),
759 		    winstart));
760 		vap->iv_stats.is_ampdu_rx_copy += rap->rxa_qframes;
761 	}
762 	/*
763 	 * Move the start of the BA window; we use the
764 	 * sequence number of the last MSDU that was
765 	 * passed up the stack+1 or winstart if stopped on
766 	 * a gap in the reorder buffer.
767 	 */
768 	rap->rxa_start = seqno;
769 }
770 
771 /*
772  * Process a received QoS data frame for an HT station.  Handle
773  * A-MPDU reordering: if this frame is received out of order
774  * and falls within the BA window hold onto it.  Otherwise if
775  * this frame completes a run, flush any pending frames.  We
776  * return 1 if the frame is consumed.  A 0 is returned if
777  * the frame should be processed normally by the caller.
778  */
779 int
780 ieee80211_ampdu_reorder(struct ieee80211_node *ni, struct mbuf *m)
781 {
782 #define	IEEE80211_FC0_QOSDATA \
783 	(IEEE80211_FC0_TYPE_DATA|IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_VERSION_0)
784 #define	PROCESS		0	/* caller should process frame */
785 #define	CONSUMED	1	/* frame consumed, caller does nothing */
786 	struct ieee80211vap *vap = ni->ni_vap;
787 	struct ieee80211_qosframe *wh;
788 	struct ieee80211_rx_ampdu *rap;
789 	ieee80211_seq rxseq;
790 	uint8_t tid;
791 	int off;
792 
793 	KASSERT((m->m_flags & (M_AMPDU | M_AMPDU_MPDU)) == M_AMPDU,
794 	    ("!a-mpdu or already re-ordered, flags 0x%x", m->m_flags));
795 	KASSERT(ni->ni_flags & IEEE80211_NODE_HT, ("not an HT sta"));
796 
797 	/* NB: m_len known to be sufficient */
798 	wh = mtod(m, struct ieee80211_qosframe *);
799 	if (wh->i_fc[0] != IEEE80211_FC0_QOSDATA) {
800 		/*
801 		 * Not QoS data, shouldn't get here but just
802 		 * return it to the caller for processing.
803 		 */
804 		return PROCESS;
805 	}
806 	if (IEEE80211_IS_DSTODS(wh))
807 		tid = ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0];
808 	else
809 		tid = wh->i_qos[0];
810 	tid &= IEEE80211_QOS_TID;
811 	rap = &ni->ni_rx_ampdu[tid];
812 	if ((rap->rxa_flags & IEEE80211_AGGR_XCHGPEND) == 0) {
813 		/*
814 		 * No ADDBA request yet, don't touch.
815 		 */
816 		return PROCESS;
817 	}
818 	rxseq = le16toh(*(uint16_t *)wh->i_seq);
819 	if ((rxseq & IEEE80211_SEQ_FRAG_MASK) != 0) {
820 		/*
821 		 * Fragments are not allowed; toss.
822 		 */
823 		IEEE80211_DISCARD_MAC(vap,
824 		    IEEE80211_MSG_INPUT | IEEE80211_MSG_11N, ni->ni_macaddr,
825 		    "A-MPDU", "fragment, rxseq 0x%x tid %u%s", rxseq, tid,
826 		    wh->i_fc[1] & IEEE80211_FC1_RETRY ? " (retransmit)" : "");
827 		vap->iv_stats.is_ampdu_rx_drop++;
828 		IEEE80211_NODE_STAT(ni, rx_drop);
829 		m_freem(m);
830 		return CONSUMED;
831 	}
832 	rxseq >>= IEEE80211_SEQ_SEQ_SHIFT;
833 	rap->rxa_nframes++;
834 again:
835 	if (rxseq == rap->rxa_start) {
836 		/*
837 		 * First frame in window.
838 		 */
839 		if (rap->rxa_qframes != 0) {
840 			/*
841 			 * Dispatch as many packets as we can.
842 			 */
843 			KASSERT(rap->rxa_m[0] == NULL, ("unexpected dup"));
844 			ampdu_dispatch(ni, m);
845 			ampdu_rx_dispatch(rap, ni);
846 			return CONSUMED;
847 		} else {
848 			/*
849 			 * In order; advance window and notify
850 			 * caller to dispatch directly.
851 			 */
852 			rap->rxa_start = IEEE80211_SEQ_INC(rxseq);
853 			return PROCESS;
854 		}
855 	}
856 	/*
857 	 * Frame is out of order; store if in the BA window.
858 	 */
859 	/* calculate offset in BA window */
860 	off = IEEE80211_SEQ_SUB(rxseq, rap->rxa_start);
861 	if (off < rap->rxa_wnd) {
862 		/*
863 		 * Common case (hopefully): in the BA window.
864 		 * Sec 9.10.7.6.2 a) (p.137)
865 		 */
866 #ifdef IEEE80211_AMPDU_AGE
867 		/*
868 		 * Check for frames sitting too long in the reorder queue.
869 		 * This should only ever happen if frames are not delivered
870 		 * without the sender otherwise notifying us (e.g. with a
871 		 * BAR to move the window).  Typically this happens because
872 		 * of vendor bugs that cause the sequence number to jump.
873 		 * When this happens we get a gap in the reorder queue that
874 		 * leaves frame sitting on the queue until they get pushed
875 		 * out due to window moves.  When the vendor does not send
876 		 * BAR this move only happens due to explicit packet sends
877 		 *
878 		 * NB: we only track the time of the oldest frame in the
879 		 * reorder q; this means that if we flush we might push
880 		 * frames that still "new"; if this happens then subsequent
881 		 * frames will result in BA window moves which cost something
882 		 * but is still better than a big throughput dip.
883 		 */
884 		if (rap->rxa_qframes != 0) {
885 			/* XXX honor batimeout? */
886 			if (ticks - rap->rxa_age > ieee80211_ampdu_age) {
887 				/*
888 				 * Too long since we received the first
889 				 * frame; flush the reorder buffer.
890 				 */
891 				if (rap->rxa_qframes != 0) {
892 					vap->iv_stats.is_ampdu_rx_age +=
893 					    rap->rxa_qframes;
894 					ampdu_rx_flush(ni, rap);
895 				}
896 				rap->rxa_start = IEEE80211_SEQ_INC(rxseq);
897 				return PROCESS;
898 			}
899 		} else {
900 			/*
901 			 * First frame, start aging timer.
902 			 */
903 			rap->rxa_age = ticks;
904 		}
905 #endif /* IEEE80211_AMPDU_AGE */
906 		/* save packet */
907 		if (rap->rxa_m[off] == NULL) {
908 			rap->rxa_m[off] = m;
909 			rap->rxa_qframes++;
910 			rap->rxa_qbytes += m->m_pkthdr.len;
911 			vap->iv_stats.is_ampdu_rx_reorder++;
912 		} else {
913 			IEEE80211_DISCARD_MAC(vap,
914 			    IEEE80211_MSG_INPUT | IEEE80211_MSG_11N,
915 			    ni->ni_macaddr, "a-mpdu duplicate",
916 			    "seqno %u tid %u BA win <%u:%u>",
917 			    rxseq, tid, rap->rxa_start,
918 			    IEEE80211_SEQ_ADD(rap->rxa_start, rap->rxa_wnd-1));
919 			vap->iv_stats.is_rx_dup++;
920 			IEEE80211_NODE_STAT(ni, rx_dup);
921 			m_freem(m);
922 		}
923 		return CONSUMED;
924 	}
925 	if (off < IEEE80211_SEQ_BA_RANGE) {
926 		/*
927 		 * Outside the BA window, but within range;
928 		 * flush the reorder q and move the window.
929 		 * Sec 9.10.7.6.2 b) (p.138)
930 		 */
931 		IEEE80211_NOTE(vap, IEEE80211_MSG_11N, ni,
932 		    "move BA win <%u:%u> (%u frames) rxseq %u tid %u",
933 		    rap->rxa_start,
934 		    IEEE80211_SEQ_ADD(rap->rxa_start, rap->rxa_wnd-1),
935 		    rap->rxa_qframes, rxseq, tid);
936 		vap->iv_stats.is_ampdu_rx_move++;
937 
938 		/*
939 		 * The spec says to flush frames up to but not including:
940 		 * 	WinStart_B = rxseq - rap->rxa_wnd + 1
941 		 * Then insert the frame or notify the caller to process
942 		 * it immediately.  We can safely do this by just starting
943 		 * over again because we know the frame will now be within
944 		 * the BA window.
945 		 */
946 		/* NB: rxa_wnd known to be >0 */
947 		ampdu_rx_flush_upto(ni, rap,
948 		    IEEE80211_SEQ_SUB(rxseq, rap->rxa_wnd-1));
949 		goto again;
950 	} else {
951 		/*
952 		 * Outside the BA window and out of range; toss.
953 		 * Sec 9.10.7.6.2 c) (p.138)
954 		 */
955 		IEEE80211_DISCARD_MAC(vap,
956 		    IEEE80211_MSG_INPUT | IEEE80211_MSG_11N, ni->ni_macaddr,
957 		    "MPDU", "BA win <%u:%u> (%u frames) rxseq %u tid %u%s",
958 		    rap->rxa_start,
959 		    IEEE80211_SEQ_ADD(rap->rxa_start, rap->rxa_wnd-1),
960 		    rap->rxa_qframes, rxseq, tid,
961 		    wh->i_fc[1] & IEEE80211_FC1_RETRY ? " (retransmit)" : "");
962 		vap->iv_stats.is_ampdu_rx_drop++;
963 		IEEE80211_NODE_STAT(ni, rx_drop);
964 		m_freem(m);
965 		return CONSUMED;
966 	}
967 #undef CONSUMED
968 #undef PROCESS
969 #undef IEEE80211_FC0_QOSDATA
970 }
971 
972 /*
973  * Process a BAR ctl frame.  Dispatch all frames up to
974  * the sequence number of the frame.  If this frame is
975  * out of range it's discarded.
976  */
977 void
978 ieee80211_recv_bar(struct ieee80211_node *ni, struct mbuf *m0)
979 {
980 	struct ieee80211vap *vap = ni->ni_vap;
981 	struct ieee80211_frame_bar *wh;
982 	struct ieee80211_rx_ampdu *rap;
983 	ieee80211_seq rxseq;
984 	int tid, off;
985 
986 	if (!ieee80211_recv_bar_ena) {
987 #if 0
988 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_11N,
989 		    ni->ni_macaddr, "BAR", "%s", "processing disabled");
990 #endif
991 		vap->iv_stats.is_ampdu_bar_bad++;
992 		return;
993 	}
994 	wh = mtod(m0, struct ieee80211_frame_bar *);
995 	/* XXX check basic BAR */
996 	tid = MS(le16toh(wh->i_ctl), IEEE80211_BAR_TID);
997 	rap = &ni->ni_rx_ampdu[tid];
998 	if ((rap->rxa_flags & IEEE80211_AGGR_XCHGPEND) == 0) {
999 		/*
1000 		 * No ADDBA request yet, don't touch.
1001 		 */
1002 		IEEE80211_DISCARD_MAC(vap,
1003 		    IEEE80211_MSG_INPUT | IEEE80211_MSG_11N,
1004 		    ni->ni_macaddr, "BAR", "no BA stream, tid %u", tid);
1005 		vap->iv_stats.is_ampdu_bar_bad++;
1006 		return;
1007 	}
1008 	vap->iv_stats.is_ampdu_bar_rx++;
1009 	rxseq = le16toh(wh->i_seq) >> IEEE80211_SEQ_SEQ_SHIFT;
1010 	if (rxseq == rap->rxa_start)
1011 		return;
1012 	/* calculate offset in BA window */
1013 	off = IEEE80211_SEQ_SUB(rxseq, rap->rxa_start);
1014 	if (off < IEEE80211_SEQ_BA_RANGE) {
1015 		/*
1016 		 * Flush the reorder q up to rxseq and move the window.
1017 		 * Sec 9.10.7.6.3 a) (p.138)
1018 		 */
1019 		IEEE80211_NOTE(vap, IEEE80211_MSG_11N, ni,
1020 		    "BAR moves BA win <%u:%u> (%u frames) rxseq %u tid %u",
1021 		    rap->rxa_start,
1022 		    IEEE80211_SEQ_ADD(rap->rxa_start, rap->rxa_wnd-1),
1023 		    rap->rxa_qframes, rxseq, tid);
1024 		vap->iv_stats.is_ampdu_bar_move++;
1025 
1026 		ampdu_rx_flush_upto(ni, rap, rxseq);
1027 		if (off >= rap->rxa_wnd) {
1028 			/*
1029 			 * BAR specifies a window start to the right of BA
1030 			 * window; we must move it explicitly since
1031 			 * ampdu_rx_flush_upto will not.
1032 			 */
1033 			rap->rxa_start = rxseq;
1034 		}
1035 	} else {
1036 		/*
1037 		 * Out of range; toss.
1038 		 * Sec 9.10.7.6.3 b) (p.138)
1039 		 */
1040 		IEEE80211_DISCARD_MAC(vap,
1041 		    IEEE80211_MSG_INPUT | IEEE80211_MSG_11N, ni->ni_macaddr,
1042 		    "BAR", "BA win <%u:%u> (%u frames) rxseq %u tid %u%s",
1043 		    rap->rxa_start,
1044 		    IEEE80211_SEQ_ADD(rap->rxa_start, rap->rxa_wnd-1),
1045 		    rap->rxa_qframes, rxseq, tid,
1046 		    wh->i_fc[1] & IEEE80211_FC1_RETRY ? " (retransmit)" : "");
1047 		vap->iv_stats.is_ampdu_bar_oow++;
1048 		IEEE80211_NODE_STAT(ni, rx_drop);
1049 	}
1050 }
1051 
1052 /*
1053  * Setup HT-specific state in a node.  Called only
1054  * when HT use is negotiated so we don't do extra
1055  * work for temporary and/or legacy sta's.
1056  */
1057 void
1058 ieee80211_ht_node_init(struct ieee80211_node *ni)
1059 {
1060 	struct ieee80211_tx_ampdu *tap;
1061 	int tid;
1062 
1063 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
1064 	    ni,
1065 	    "%s: called",
1066 	    __func__);
1067 
1068 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1069 		/*
1070 		 * Clean AMPDU state on re-associate.  This handles the case
1071 		 * where a station leaves w/o notifying us and then returns
1072 		 * before node is reaped for inactivity.
1073 		 */
1074 		IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
1075 		    ni,
1076 		    "%s: calling cleanup",
1077 		    __func__);
1078 		ieee80211_ht_node_cleanup(ni);
1079 	}
1080 	for (tid = 0; tid < WME_NUM_TID; tid++) {
1081 		tap = &ni->ni_tx_ampdu[tid];
1082 		tap->txa_tid = tid;
1083 		tap->txa_ni = ni;
1084 		tap->txa_lastsample = ticks;
1085 		/* NB: further initialization deferred */
1086 	}
1087 	ni->ni_flags |= IEEE80211_NODE_HT | IEEE80211_NODE_AMPDU;
1088 }
1089 
1090 /*
1091  * Cleanup HT-specific state in a node.  Called only
1092  * when HT use has been marked.
1093  */
1094 void
1095 ieee80211_ht_node_cleanup(struct ieee80211_node *ni)
1096 {
1097 	struct ieee80211com *ic = ni->ni_ic;
1098 	int i;
1099 
1100 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
1101 	    ni,
1102 	    "%s: called",
1103 	    __func__);
1104 
1105 	KASSERT(ni->ni_flags & IEEE80211_NODE_HT, ("not an HT node"));
1106 
1107 	/* XXX optimize this */
1108 	for (i = 0; i < WME_NUM_TID; i++) {
1109 		struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[i];
1110 		if (tap->txa_flags & IEEE80211_AGGR_SETUP)
1111 			ampdu_tx_stop(tap);
1112 	}
1113 	for (i = 0; i < WME_NUM_TID; i++)
1114 		ic->ic_ampdu_rx_stop(ni, &ni->ni_rx_ampdu[i]);
1115 
1116 	ni->ni_htcap = 0;
1117 	ni->ni_flags &= ~IEEE80211_NODE_HT_ALL;
1118 }
1119 
1120 /*
1121  * Age out HT resources for a station.
1122  */
1123 void
1124 ieee80211_ht_node_age(struct ieee80211_node *ni)
1125 {
1126 #ifdef IEEE80211_AMPDU_AGE
1127 	struct ieee80211vap *vap = ni->ni_vap;
1128 	uint8_t tid;
1129 #endif
1130 
1131 	KASSERT(ni->ni_flags & IEEE80211_NODE_HT, ("not an HT sta"));
1132 
1133 #ifdef IEEE80211_AMPDU_AGE
1134 	for (tid = 0; tid < WME_NUM_TID; tid++) {
1135 		struct ieee80211_rx_ampdu *rap;
1136 
1137 		rap = &ni->ni_rx_ampdu[tid];
1138 		if ((rap->rxa_flags & IEEE80211_AGGR_XCHGPEND) == 0)
1139 			continue;
1140 		if (rap->rxa_qframes == 0)
1141 			continue;
1142 		/*
1143 		 * Check for frames sitting too long in the reorder queue.
1144 		 * See above for more details on what's happening here.
1145 		 */
1146 		/* XXX honor batimeout? */
1147 		if (ticks - rap->rxa_age > ieee80211_ampdu_age) {
1148 			/*
1149 			 * Too long since we received the first
1150 			 * frame; flush the reorder buffer.
1151 			 */
1152 			vap->iv_stats.is_ampdu_rx_age += rap->rxa_qframes;
1153 			ampdu_rx_flush(ni, rap);
1154 		}
1155 	}
1156 #endif /* IEEE80211_AMPDU_AGE */
1157 }
1158 
1159 static struct ieee80211_channel *
1160 findhtchan(struct ieee80211com *ic, struct ieee80211_channel *c, int htflags)
1161 {
1162 	return ieee80211_find_channel(ic, c->ic_freq,
1163 	    (c->ic_flags &~ IEEE80211_CHAN_HT) | htflags);
1164 }
1165 
1166 /*
1167  * Adjust a channel to be HT/non-HT according to the vap's configuration.
1168  */
1169 struct ieee80211_channel *
1170 ieee80211_ht_adjust_channel(struct ieee80211com *ic,
1171 	struct ieee80211_channel *chan, int flags)
1172 {
1173 	struct ieee80211_channel *c;
1174 
1175 	if (flags & IEEE80211_FHT_HT) {
1176 		/* promote to HT if possible */
1177 		if (flags & IEEE80211_FHT_USEHT40) {
1178 			if (!IEEE80211_IS_CHAN_HT40(chan)) {
1179 				/* NB: arbitrarily pick ht40+ over ht40- */
1180 				c = findhtchan(ic, chan, IEEE80211_CHAN_HT40U);
1181 				if (c == NULL)
1182 					c = findhtchan(ic, chan,
1183 						IEEE80211_CHAN_HT40D);
1184 				if (c == NULL)
1185 					c = findhtchan(ic, chan,
1186 						IEEE80211_CHAN_HT20);
1187 				if (c != NULL)
1188 					chan = c;
1189 			}
1190 		} else if (!IEEE80211_IS_CHAN_HT20(chan)) {
1191 			c = findhtchan(ic, chan, IEEE80211_CHAN_HT20);
1192 			if (c != NULL)
1193 				chan = c;
1194 		}
1195 	} else if (IEEE80211_IS_CHAN_HT(chan)) {
1196 		/* demote to legacy, HT use is disabled */
1197 		c = ieee80211_find_channel(ic, chan->ic_freq,
1198 		    chan->ic_flags &~ IEEE80211_CHAN_HT);
1199 		if (c != NULL)
1200 			chan = c;
1201 	}
1202 	return chan;
1203 }
1204 
1205 /*
1206  * Setup HT-specific state for a legacy WDS peer.
1207  */
1208 void
1209 ieee80211_ht_wds_init(struct ieee80211_node *ni)
1210 {
1211 	struct ieee80211vap *vap = ni->ni_vap;
1212 	struct ieee80211_tx_ampdu *tap;
1213 	int tid;
1214 
1215 	KASSERT(vap->iv_flags_ht & IEEE80211_FHT_HT, ("no HT requested"));
1216 
1217 	/* XXX check scan cache in case peer has an ap and we have info */
1218 	/*
1219 	 * If setup with a legacy channel; locate an HT channel.
1220 	 * Otherwise if the inherited channel (from a companion
1221 	 * AP) is suitable use it so we use the same location
1222 	 * for the extension channel).
1223 	 */
1224 	ni->ni_chan = ieee80211_ht_adjust_channel(ni->ni_ic,
1225 	    ni->ni_chan, ieee80211_htchanflags(ni->ni_chan));
1226 
1227 	ni->ni_htcap = 0;
1228 	if (vap->iv_flags_ht & IEEE80211_FHT_SHORTGI20)
1229 		ni->ni_htcap |= IEEE80211_HTCAP_SHORTGI20;
1230 	if (IEEE80211_IS_CHAN_HT40(ni->ni_chan)) {
1231 		ni->ni_htcap |= IEEE80211_HTCAP_CHWIDTH40;
1232 		ni->ni_chw = 40;
1233 		if (IEEE80211_IS_CHAN_HT40U(ni->ni_chan))
1234 			ni->ni_ht2ndchan = IEEE80211_HTINFO_2NDCHAN_ABOVE;
1235 		else if (IEEE80211_IS_CHAN_HT40D(ni->ni_chan))
1236 			ni->ni_ht2ndchan = IEEE80211_HTINFO_2NDCHAN_BELOW;
1237 		if (vap->iv_flags_ht & IEEE80211_FHT_SHORTGI40)
1238 			ni->ni_htcap |= IEEE80211_HTCAP_SHORTGI40;
1239 	} else {
1240 		ni->ni_chw = 20;
1241 		ni->ni_ht2ndchan = IEEE80211_HTINFO_2NDCHAN_NONE;
1242 	}
1243 	ni->ni_htctlchan = ni->ni_chan->ic_ieee;
1244 	if (vap->iv_flags_ht & IEEE80211_FHT_RIFS)
1245 		ni->ni_flags |= IEEE80211_NODE_RIFS;
1246 	/* XXX does it make sense to enable SMPS? */
1247 
1248 	ni->ni_htopmode = 0;		/* XXX need protection state */
1249 	ni->ni_htstbc = 0;		/* XXX need info */
1250 
1251 	for (tid = 0; tid < WME_NUM_TID; tid++) {
1252 		tap = &ni->ni_tx_ampdu[tid];
1253 		tap->txa_tid = tid;
1254 		tap->txa_lastsample = ticks;
1255 	}
1256 	/* NB: AMPDU tx/rx governed by IEEE80211_FHT_AMPDU_{TX,RX} */
1257 	ni->ni_flags |= IEEE80211_NODE_HT | IEEE80211_NODE_AMPDU;
1258 }
1259 
1260 /*
1261  * Notify hostap vaps of a change in the HTINFO ie.
1262  */
1263 static void
1264 htinfo_notify(struct ieee80211com *ic)
1265 {
1266 	struct ieee80211vap *vap;
1267 	int first = 1;
1268 
1269 	IEEE80211_LOCK_ASSERT(ic);
1270 
1271 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
1272 		if (vap->iv_opmode != IEEE80211_M_HOSTAP)
1273 			continue;
1274 		if (vap->iv_state != IEEE80211_S_RUN ||
1275 		    !IEEE80211_IS_CHAN_HT(vap->iv_bss->ni_chan))
1276 			continue;
1277 		if (first) {
1278 			IEEE80211_NOTE(vap,
1279 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N,
1280 			    vap->iv_bss,
1281 			    "HT bss occupancy change: %d sta, %d ht, "
1282 			    "%d ht40%s, HT protmode now 0x%x"
1283 			    , ic->ic_sta_assoc
1284 			    , ic->ic_ht_sta_assoc
1285 			    , ic->ic_ht40_sta_assoc
1286 			    , (ic->ic_flags_ht & IEEE80211_FHT_NONHT_PR) ?
1287 				 ", non-HT sta present" : ""
1288 			    , ic->ic_curhtprotmode);
1289 			first = 0;
1290 		}
1291 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_HTINFO);
1292 	}
1293 }
1294 
1295 /*
1296  * Calculate HT protection mode from current
1297  * state and handle updates.
1298  */
1299 static void
1300 htinfo_update(struct ieee80211com *ic)
1301 {
1302 	uint8_t protmode;
1303 
1304 	if (ic->ic_sta_assoc != ic->ic_ht_sta_assoc) {
1305 		protmode = IEEE80211_HTINFO_OPMODE_MIXED
1306 			 | IEEE80211_HTINFO_NONHT_PRESENT;
1307 	} else if (ic->ic_flags_ht & IEEE80211_FHT_NONHT_PR) {
1308 		protmode = IEEE80211_HTINFO_OPMODE_PROTOPT
1309 			 | IEEE80211_HTINFO_NONHT_PRESENT;
1310 	} else if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
1311 	    IEEE80211_IS_CHAN_HT40(ic->ic_bsschan) &&
1312 	    ic->ic_sta_assoc != ic->ic_ht40_sta_assoc) {
1313 		protmode = IEEE80211_HTINFO_OPMODE_HT20PR;
1314 	} else {
1315 		protmode = IEEE80211_HTINFO_OPMODE_PURE;
1316 	}
1317 	if (protmode != ic->ic_curhtprotmode) {
1318 		ic->ic_curhtprotmode = protmode;
1319 		htinfo_notify(ic);
1320 	}
1321 }
1322 
1323 /*
1324  * Handle an HT station joining a BSS.
1325  */
1326 void
1327 ieee80211_ht_node_join(struct ieee80211_node *ni)
1328 {
1329 	struct ieee80211com *ic = ni->ni_ic;
1330 
1331 	IEEE80211_LOCK_ASSERT(ic);
1332 
1333 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1334 		ic->ic_ht_sta_assoc++;
1335 		if (ni->ni_chw == 40)
1336 			ic->ic_ht40_sta_assoc++;
1337 	}
1338 	htinfo_update(ic);
1339 }
1340 
1341 /*
1342  * Handle an HT station leaving a BSS.
1343  */
1344 void
1345 ieee80211_ht_node_leave(struct ieee80211_node *ni)
1346 {
1347 	struct ieee80211com *ic = ni->ni_ic;
1348 
1349 	IEEE80211_LOCK_ASSERT(ic);
1350 
1351 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1352 		ic->ic_ht_sta_assoc--;
1353 		if (ni->ni_chw == 40)
1354 			ic->ic_ht40_sta_assoc--;
1355 	}
1356 	htinfo_update(ic);
1357 }
1358 
1359 /*
1360  * Public version of htinfo_update; used for processing
1361  * beacon frames from overlapping bss.
1362  *
1363  * Caller can specify either IEEE80211_HTINFO_OPMODE_MIXED
1364  * (on receipt of a beacon that advertises MIXED) or
1365  * IEEE80211_HTINFO_OPMODE_PROTOPT (on receipt of a beacon
1366  * from an overlapping legacy bss).  We treat MIXED with
1367  * a higher precedence than PROTOPT (i.e. we will not change
1368  * change PROTOPT -> MIXED; only MIXED -> PROTOPT).  This
1369  * corresponds to how we handle things in htinfo_update.
1370  */
1371 void
1372 ieee80211_htprot_update(struct ieee80211com *ic, int protmode)
1373 {
1374 #define	OPMODE(x)	SM(x, IEEE80211_HTINFO_OPMODE)
1375 	IEEE80211_LOCK(ic);
1376 
1377 	/* track non-HT station presence */
1378 	KASSERT(protmode & IEEE80211_HTINFO_NONHT_PRESENT,
1379 	    ("protmode 0x%x", protmode));
1380 	ic->ic_flags_ht |= IEEE80211_FHT_NONHT_PR;
1381 	ic->ic_lastnonht = ticks;
1382 
1383 	if (protmode != ic->ic_curhtprotmode &&
1384 	    (OPMODE(ic->ic_curhtprotmode) != IEEE80211_HTINFO_OPMODE_MIXED ||
1385 	     OPMODE(protmode) == IEEE80211_HTINFO_OPMODE_PROTOPT)) {
1386 		/* push beacon update */
1387 		ic->ic_curhtprotmode = protmode;
1388 		htinfo_notify(ic);
1389 	}
1390 	IEEE80211_UNLOCK(ic);
1391 #undef OPMODE
1392 }
1393 
1394 /*
1395  * Time out presence of an overlapping bss with non-HT
1396  * stations.  When operating in hostap mode we listen for
1397  * beacons from other stations and if we identify a non-HT
1398  * station is present we update the opmode field of the
1399  * HTINFO ie.  To identify when all non-HT stations are
1400  * gone we time out this condition.
1401  */
1402 void
1403 ieee80211_ht_timeout(struct ieee80211com *ic)
1404 {
1405 	IEEE80211_LOCK_ASSERT(ic);
1406 
1407 	if ((ic->ic_flags_ht & IEEE80211_FHT_NONHT_PR) &&
1408 	    time_after(ticks, ic->ic_lastnonht + IEEE80211_NONHT_PRESENT_AGE)) {
1409 #if 0
1410 		IEEE80211_NOTE(vap, IEEE80211_MSG_11N, ni,
1411 		    "%s", "time out non-HT STA present on channel");
1412 #endif
1413 		ic->ic_flags_ht &= ~IEEE80211_FHT_NONHT_PR;
1414 		htinfo_update(ic);
1415 	}
1416 }
1417 
1418 /* unalligned little endian access */
1419 #define LE_READ_2(p)					\
1420 	((uint16_t)					\
1421 	 ((((const uint8_t *)(p))[0]      ) |		\
1422 	  (((const uint8_t *)(p))[1] <<  8)))
1423 
1424 /*
1425  * Process an 802.11n HT capabilities ie.
1426  */
1427 void
1428 ieee80211_parse_htcap(struct ieee80211_node *ni, const uint8_t *ie)
1429 {
1430 	if (ie[0] == IEEE80211_ELEMID_VENDOR) {
1431 		/*
1432 		 * Station used Vendor OUI ie to associate;
1433 		 * mark the node so when we respond we'll use
1434 		 * the Vendor OUI's and not the standard ie's.
1435 		 */
1436 		ni->ni_flags |= IEEE80211_NODE_HTCOMPAT;
1437 		ie += 4;
1438 	} else
1439 		ni->ni_flags &= ~IEEE80211_NODE_HTCOMPAT;
1440 
1441 	ni->ni_htcap = LE_READ_2(ie +
1442 		__offsetof(struct ieee80211_ie_htcap, hc_cap));
1443 	ni->ni_htparam = ie[__offsetof(struct ieee80211_ie_htcap, hc_param)];
1444 }
1445 
1446 static void
1447 htinfo_parse(struct ieee80211_node *ni,
1448 	const struct ieee80211_ie_htinfo *htinfo)
1449 {
1450 	uint16_t w;
1451 
1452 	ni->ni_htctlchan = htinfo->hi_ctrlchannel;
1453 	ni->ni_ht2ndchan = SM(htinfo->hi_byte1, IEEE80211_HTINFO_2NDCHAN);
1454 	w = LE_READ_2(&htinfo->hi_byte2);
1455 	ni->ni_htopmode = SM(w, IEEE80211_HTINFO_OPMODE);
1456 	w = LE_READ_2(&htinfo->hi_byte45);
1457 	ni->ni_htstbc = SM(w, IEEE80211_HTINFO_BASIC_STBCMCS);
1458 }
1459 
1460 /*
1461  * Parse an 802.11n HT info ie and save useful information
1462  * to the node state.  Note this does not effect any state
1463  * changes such as for channel width change.
1464  */
1465 void
1466 ieee80211_parse_htinfo(struct ieee80211_node *ni, const uint8_t *ie)
1467 {
1468 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
1469 		ie += 4;
1470 	htinfo_parse(ni, (const struct ieee80211_ie_htinfo *) ie);
1471 }
1472 
1473 /*
1474  * Handle 11n channel switch.  Use the received HT ie's to
1475  * identify the right channel to use.  If we cannot locate it
1476  * in the channel table then fallback to legacy operation.
1477  * Note that we use this information to identify the node's
1478  * channel only; the caller is responsible for insuring any
1479  * required channel change is done (e.g. in sta mode when
1480  * parsing the contents of a beacon frame).
1481  */
1482 static int
1483 htinfo_update_chw(struct ieee80211_node *ni, int htflags)
1484 {
1485 	struct ieee80211com *ic = ni->ni_ic;
1486 	struct ieee80211_channel *c;
1487 	int chanflags;
1488 	int ret = 0;
1489 
1490 	chanflags = (ni->ni_chan->ic_flags &~ IEEE80211_CHAN_HT) | htflags;
1491 	if (chanflags != ni->ni_chan->ic_flags) {
1492 		/* XXX not right for ht40- */
1493 		c = ieee80211_find_channel(ic, ni->ni_chan->ic_freq, chanflags);
1494 		if (c == NULL && (htflags & IEEE80211_CHAN_HT40)) {
1495 			/*
1496 			 * No HT40 channel entry in our table; fall back
1497 			 * to HT20 operation.  This should not happen.
1498 			 */
1499 			c = findhtchan(ic, ni->ni_chan, IEEE80211_CHAN_HT20);
1500 #if 0
1501 			IEEE80211_NOTE(ni->ni_vap,
1502 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
1503 			    "no HT40 channel (freq %u), falling back to HT20",
1504 			    ni->ni_chan->ic_freq);
1505 #endif
1506 			/* XXX stat */
1507 		}
1508 		if (c != NULL && c != ni->ni_chan) {
1509 			IEEE80211_NOTE(ni->ni_vap,
1510 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
1511 			    "switch station to HT%d channel %u/0x%x",
1512 			    IEEE80211_IS_CHAN_HT40(c) ? 40 : 20,
1513 			    c->ic_freq, c->ic_flags);
1514 			ni->ni_chan = c;
1515 			ret = 1;
1516 		}
1517 		/* NB: caller responsible for forcing any channel change */
1518 	}
1519 	/* update node's tx channel width */
1520 	ni->ni_chw = IEEE80211_IS_CHAN_HT40(ni->ni_chan)? 40 : 20;
1521 	return (ret);
1522 }
1523 
1524 /*
1525  * Update 11n MIMO PS state according to received htcap.
1526  */
1527 static __inline int
1528 htcap_update_mimo_ps(struct ieee80211_node *ni)
1529 {
1530 	uint16_t oflags = ni->ni_flags;
1531 
1532 	switch (ni->ni_htcap & IEEE80211_HTCAP_SMPS) {
1533 	case IEEE80211_HTCAP_SMPS_DYNAMIC:
1534 		ni->ni_flags |= IEEE80211_NODE_MIMO_PS;
1535 		ni->ni_flags |= IEEE80211_NODE_MIMO_RTS;
1536 		break;
1537 	case IEEE80211_HTCAP_SMPS_ENA:
1538 		ni->ni_flags |= IEEE80211_NODE_MIMO_PS;
1539 		ni->ni_flags &= ~IEEE80211_NODE_MIMO_RTS;
1540 		break;
1541 	case IEEE80211_HTCAP_SMPS_OFF:
1542 	default:		/* disable on rx of reserved value */
1543 		ni->ni_flags &= ~IEEE80211_NODE_MIMO_PS;
1544 		ni->ni_flags &= ~IEEE80211_NODE_MIMO_RTS;
1545 		break;
1546 	}
1547 	return (oflags ^ ni->ni_flags);
1548 }
1549 
1550 /*
1551  * Update short GI state according to received htcap
1552  * and local settings.
1553  */
1554 static __inline void
1555 htcap_update_shortgi(struct ieee80211_node *ni)
1556 {
1557 	struct ieee80211vap *vap = ni->ni_vap;
1558 
1559 	ni->ni_flags &= ~(IEEE80211_NODE_SGI20|IEEE80211_NODE_SGI40);
1560 	if ((ni->ni_htcap & IEEE80211_HTCAP_SHORTGI20) &&
1561 	    (vap->iv_flags_ht & IEEE80211_FHT_SHORTGI20))
1562 		ni->ni_flags |= IEEE80211_NODE_SGI20;
1563 	if ((ni->ni_htcap & IEEE80211_HTCAP_SHORTGI40) &&
1564 	    (vap->iv_flags_ht & IEEE80211_FHT_SHORTGI40))
1565 		ni->ni_flags |= IEEE80211_NODE_SGI40;
1566 }
1567 
1568 /*
1569  * Parse and update HT-related state extracted from
1570  * the HT cap and info ie's.
1571  */
1572 int
1573 ieee80211_ht_updateparams(struct ieee80211_node *ni,
1574 	const uint8_t *htcapie, const uint8_t *htinfoie)
1575 {
1576 	struct ieee80211vap *vap = ni->ni_vap;
1577 	const struct ieee80211_ie_htinfo *htinfo;
1578 	int htflags;
1579 	int ret = 0;
1580 
1581 	ieee80211_parse_htcap(ni, htcapie);
1582 	if (vap->iv_htcaps & IEEE80211_HTCAP_SMPS)
1583 		htcap_update_mimo_ps(ni);
1584 	htcap_update_shortgi(ni);
1585 
1586 	if (htinfoie[0] == IEEE80211_ELEMID_VENDOR)
1587 		htinfoie += 4;
1588 	htinfo = (const struct ieee80211_ie_htinfo *) htinfoie;
1589 	htinfo_parse(ni, htinfo);
1590 
1591 	htflags = (vap->iv_flags_ht & IEEE80211_FHT_HT) ?
1592 	    IEEE80211_CHAN_HT20 : 0;
1593 	/* NB: honor operating mode constraint */
1594 	if ((htinfo->hi_byte1 & IEEE80211_HTINFO_TXWIDTH_2040) &&
1595 	    (vap->iv_flags_ht & IEEE80211_FHT_USEHT40)) {
1596 		if (ni->ni_ht2ndchan == IEEE80211_HTINFO_2NDCHAN_ABOVE)
1597 			htflags = IEEE80211_CHAN_HT40U;
1598 		else if (ni->ni_ht2ndchan == IEEE80211_HTINFO_2NDCHAN_BELOW)
1599 			htflags = IEEE80211_CHAN_HT40D;
1600 	}
1601 	if (htinfo_update_chw(ni, htflags))
1602 		ret = 1;
1603 
1604 	if ((htinfo->hi_byte1 & IEEE80211_HTINFO_RIFSMODE_PERM) &&
1605 	    (vap->iv_flags_ht & IEEE80211_FHT_RIFS))
1606 		ni->ni_flags |= IEEE80211_NODE_RIFS;
1607 	else
1608 		ni->ni_flags &= ~IEEE80211_NODE_RIFS;
1609 
1610 	return (ret);
1611 }
1612 
1613 /*
1614  * Parse and update HT-related state extracted from the HT cap ie
1615  * for a station joining an HT BSS.
1616  */
1617 void
1618 ieee80211_ht_updatehtcap(struct ieee80211_node *ni, const uint8_t *htcapie)
1619 {
1620 	struct ieee80211vap *vap = ni->ni_vap;
1621 	int htflags;
1622 
1623 	ieee80211_parse_htcap(ni, htcapie);
1624 	if (vap->iv_htcaps & IEEE80211_HTCAP_SMPS)
1625 		htcap_update_mimo_ps(ni);
1626 	htcap_update_shortgi(ni);
1627 
1628 	/* NB: honor operating mode constraint */
1629 	/* XXX 40 MHz intolerant */
1630 	htflags = (vap->iv_flags_ht & IEEE80211_FHT_HT) ?
1631 	    IEEE80211_CHAN_HT20 : 0;
1632 	if ((ni->ni_htcap & IEEE80211_HTCAP_CHWIDTH40) &&
1633 	    (vap->iv_flags_ht & IEEE80211_FHT_USEHT40)) {
1634 		if (IEEE80211_IS_CHAN_HT40U(vap->iv_bss->ni_chan))
1635 			htflags = IEEE80211_CHAN_HT40U;
1636 		else if (IEEE80211_IS_CHAN_HT40D(vap->iv_bss->ni_chan))
1637 			htflags = IEEE80211_CHAN_HT40D;
1638 	}
1639 	(void) htinfo_update_chw(ni, htflags);
1640 }
1641 
1642 /*
1643  * Install received HT rate set by parsing the HT cap ie.
1644  */
1645 int
1646 ieee80211_setup_htrates(struct ieee80211_node *ni, const uint8_t *ie, int flags)
1647 {
1648 	struct ieee80211com *ic = ni->ni_ic;
1649 	struct ieee80211vap *vap = ni->ni_vap;
1650 	const struct ieee80211_ie_htcap *htcap;
1651 	struct ieee80211_htrateset *rs;
1652 	int i, maxequalmcs, maxunequalmcs;
1653 
1654 	maxequalmcs = ic->ic_txstream * 8 - 1;
1655 	if (ic->ic_htcaps & IEEE80211_HTC_TXUNEQUAL) {
1656 		if (ic->ic_txstream >= 2)
1657 			maxunequalmcs = 38;
1658 		if (ic->ic_txstream >= 3)
1659 			maxunequalmcs = 52;
1660 		if (ic->ic_txstream >= 4)
1661 			maxunequalmcs = 76;
1662 	} else
1663 		maxunequalmcs = 0;
1664 
1665 	rs = &ni->ni_htrates;
1666 	memset(rs, 0, sizeof(*rs));
1667 	if (ie != NULL) {
1668 		if (ie[0] == IEEE80211_ELEMID_VENDOR)
1669 			ie += 4;
1670 		htcap = (const struct ieee80211_ie_htcap *) ie;
1671 		for (i = 0; i < IEEE80211_HTRATE_MAXSIZE; i++) {
1672 			if (isclr(htcap->hc_mcsset, i))
1673 				continue;
1674 			if (rs->rs_nrates == IEEE80211_HTRATE_MAXSIZE) {
1675 				IEEE80211_NOTE(vap,
1676 				    IEEE80211_MSG_XRATE | IEEE80211_MSG_11N, ni,
1677 				    "WARNING, HT rate set too large; only "
1678 				    "using %u rates", IEEE80211_HTRATE_MAXSIZE);
1679 				vap->iv_stats.is_rx_rstoobig++;
1680 				break;
1681 			}
1682 			if (i <= 31 && i > maxequalmcs)
1683 				continue;
1684 			if (i == 32 &&
1685 			    (ic->ic_htcaps & IEEE80211_HTC_TXMCS32) == 0)
1686 				continue;
1687 			if (i > 32 && i > maxunequalmcs)
1688 				continue;
1689 			rs->rs_rates[rs->rs_nrates++] = i;
1690 		}
1691 	}
1692 	return ieee80211_fix_rate(ni, (struct ieee80211_rateset *) rs, flags);
1693 }
1694 
1695 /*
1696  * Mark rates in a node's HT rate set as basic according
1697  * to the information in the supplied HT info ie.
1698  */
1699 void
1700 ieee80211_setup_basic_htrates(struct ieee80211_node *ni, const uint8_t *ie)
1701 {
1702 	const struct ieee80211_ie_htinfo *htinfo;
1703 	struct ieee80211_htrateset *rs;
1704 	int i, j;
1705 
1706 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
1707 		ie += 4;
1708 	htinfo = (const struct ieee80211_ie_htinfo *) ie;
1709 	rs = &ni->ni_htrates;
1710 	if (rs->rs_nrates == 0) {
1711 		IEEE80211_NOTE(ni->ni_vap,
1712 		    IEEE80211_MSG_XRATE | IEEE80211_MSG_11N, ni,
1713 		    "%s", "WARNING, empty HT rate set");
1714 		return;
1715 	}
1716 	for (i = 0; i < IEEE80211_HTRATE_MAXSIZE; i++) {
1717 		if (isclr(htinfo->hi_basicmcsset, i))
1718 			continue;
1719 		for (j = 0; j < rs->rs_nrates; j++)
1720 			if ((rs->rs_rates[j] & IEEE80211_RATE_VAL) == i)
1721 				rs->rs_rates[j] |= IEEE80211_RATE_BASIC;
1722 	}
1723 }
1724 
1725 static void
1726 ampdu_tx_setup(struct ieee80211_tx_ampdu *tap)
1727 {
1728 	callout_init(&tap->txa_timer, 1);
1729 	tap->txa_flags |= IEEE80211_AGGR_SETUP;
1730 	tap->txa_lastsample = ticks;
1731 }
1732 
1733 static void
1734 ampdu_tx_stop(struct ieee80211_tx_ampdu *tap)
1735 {
1736 	struct ieee80211_node *ni = tap->txa_ni;
1737 	struct ieee80211com *ic = ni->ni_ic;
1738 
1739 	IEEE80211_NOTE(tap->txa_ni->ni_vap, IEEE80211_MSG_11N,
1740 	    tap->txa_ni,
1741 	    "%s: called",
1742 	    __func__);
1743 
1744 	KASSERT(tap->txa_flags & IEEE80211_AGGR_SETUP,
1745 	    ("txa_flags 0x%x tid %d ac %d", tap->txa_flags, tap->txa_tid,
1746 	    TID_TO_WME_AC(tap->txa_tid)));
1747 
1748 	/*
1749 	 * Stop BA stream if setup so driver has a chance
1750 	 * to reclaim any resources it might have allocated.
1751 	 */
1752 	ic->ic_addba_stop(ni, tap);
1753 	/*
1754 	 * Stop any pending BAR transmit.
1755 	 */
1756 	bar_stop_timer(tap);
1757 
1758 	/*
1759 	 * Reset packet estimate.
1760 	 */
1761 	tap->txa_lastsample = ticks;
1762 	tap->txa_avgpps = 0;
1763 
1764 	/* NB: clearing NAK means we may re-send ADDBA */
1765 	tap->txa_flags &= ~(IEEE80211_AGGR_SETUP | IEEE80211_AGGR_NAK);
1766 }
1767 
1768 /*
1769  * ADDBA response timeout.
1770  *
1771  * If software aggregation and per-TID queue management was done here,
1772  * that queue would be unpaused after the ADDBA timeout occurs.
1773  */
1774 static void
1775 addba_timeout(void *arg)
1776 {
1777 	struct ieee80211_tx_ampdu *tap = arg;
1778 	struct ieee80211_node *ni = tap->txa_ni;
1779 	struct ieee80211com *ic = ni->ni_ic;
1780 
1781 	/* XXX ? */
1782 	tap->txa_flags &= ~IEEE80211_AGGR_XCHGPEND;
1783 	tap->txa_attempts++;
1784 	ic->ic_addba_response_timeout(ni, tap);
1785 }
1786 
1787 static void
1788 addba_start_timeout(struct ieee80211_tx_ampdu *tap)
1789 {
1790 	/* XXX use CALLOUT_PENDING instead? */
1791 	callout_reset(&tap->txa_timer, ieee80211_addba_timeout,
1792 	    addba_timeout, tap);
1793 	tap->txa_flags |= IEEE80211_AGGR_XCHGPEND;
1794 	tap->txa_nextrequest = ticks + ieee80211_addba_timeout;
1795 }
1796 
1797 static void
1798 addba_stop_timeout(struct ieee80211_tx_ampdu *tap)
1799 {
1800 	/* XXX use CALLOUT_PENDING instead? */
1801 	if (tap->txa_flags & IEEE80211_AGGR_XCHGPEND) {
1802 		callout_stop(&tap->txa_timer);
1803 		tap->txa_flags &= ~IEEE80211_AGGR_XCHGPEND;
1804 	}
1805 }
1806 
1807 static void
1808 null_addba_response_timeout(struct ieee80211_node *ni,
1809     struct ieee80211_tx_ampdu *tap)
1810 {
1811 }
1812 
1813 /*
1814  * Default method for requesting A-MPDU tx aggregation.
1815  * We setup the specified state block and start a timer
1816  * to wait for an ADDBA response frame.
1817  */
1818 static int
1819 ieee80211_addba_request(struct ieee80211_node *ni,
1820 	struct ieee80211_tx_ampdu *tap,
1821 	int dialogtoken, int baparamset, int batimeout)
1822 {
1823 	int bufsiz;
1824 
1825 	/* XXX locking */
1826 	tap->txa_token = dialogtoken;
1827 	tap->txa_flags |= IEEE80211_AGGR_IMMEDIATE;
1828 	bufsiz = MS(baparamset, IEEE80211_BAPS_BUFSIZ);
1829 	tap->txa_wnd = (bufsiz == 0) ?
1830 	    IEEE80211_AGGR_BAWMAX : min(bufsiz, IEEE80211_AGGR_BAWMAX);
1831 	addba_start_timeout(tap);
1832 	return 1;
1833 }
1834 
1835 /*
1836  * Default method for processing an A-MPDU tx aggregation
1837  * response.  We shutdown any pending timer and update the
1838  * state block according to the reply.
1839  */
1840 static int
1841 ieee80211_addba_response(struct ieee80211_node *ni,
1842 	struct ieee80211_tx_ampdu *tap,
1843 	int status, int baparamset, int batimeout)
1844 {
1845 	int bufsiz, tid;
1846 
1847 	/* XXX locking */
1848 	addba_stop_timeout(tap);
1849 	if (status == IEEE80211_STATUS_SUCCESS) {
1850 		bufsiz = MS(baparamset, IEEE80211_BAPS_BUFSIZ);
1851 		/* XXX override our request? */
1852 		tap->txa_wnd = (bufsiz == 0) ?
1853 		    IEEE80211_AGGR_BAWMAX : min(bufsiz, IEEE80211_AGGR_BAWMAX);
1854 		/* XXX AC/TID */
1855 		tid = MS(baparamset, IEEE80211_BAPS_TID);
1856 		tap->txa_flags |= IEEE80211_AGGR_RUNNING;
1857 		tap->txa_attempts = 0;
1858 	} else {
1859 		/* mark tid so we don't try again */
1860 		tap->txa_flags |= IEEE80211_AGGR_NAK;
1861 	}
1862 	return 1;
1863 }
1864 
1865 /*
1866  * Default method for stopping A-MPDU tx aggregation.
1867  * Any timer is cleared and we drain any pending frames.
1868  */
1869 static void
1870 ieee80211_addba_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
1871 {
1872 	/* XXX locking */
1873 	addba_stop_timeout(tap);
1874 	if (tap->txa_flags & IEEE80211_AGGR_RUNNING) {
1875 		/* XXX clear aggregation queue */
1876 		tap->txa_flags &= ~IEEE80211_AGGR_RUNNING;
1877 	}
1878 	tap->txa_attempts = 0;
1879 }
1880 
1881 /*
1882  * Process a received action frame using the default aggregation
1883  * policy.  We intercept ADDBA-related frames and use them to
1884  * update our aggregation state.  All other frames are passed up
1885  * for processing by ieee80211_recv_action.
1886  */
1887 static int
1888 ht_recv_action_ba_addba_request(struct ieee80211_node *ni,
1889 	const struct ieee80211_frame *wh,
1890 	const uint8_t *frm, const uint8_t *efrm)
1891 {
1892 	struct ieee80211com *ic = ni->ni_ic;
1893 	struct ieee80211vap *vap = ni->ni_vap;
1894 	struct ieee80211_rx_ampdu *rap;
1895 	uint8_t dialogtoken;
1896 	uint16_t baparamset, batimeout, baseqctl;
1897 	uint16_t args[5];
1898 	int tid;
1899 
1900 	dialogtoken = frm[2];
1901 	baparamset = LE_READ_2(frm+3);
1902 	batimeout = LE_READ_2(frm+5);
1903 	baseqctl = LE_READ_2(frm+7);
1904 
1905 	tid = MS(baparamset, IEEE80211_BAPS_TID);
1906 
1907 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
1908 	    "recv ADDBA request: dialogtoken %u baparamset 0x%x "
1909 	    "(tid %d bufsiz %d) batimeout %d baseqctl %d:%d",
1910 	    dialogtoken, baparamset,
1911 	    tid, MS(baparamset, IEEE80211_BAPS_BUFSIZ),
1912 	    batimeout,
1913 	    MS(baseqctl, IEEE80211_BASEQ_START),
1914 	    MS(baseqctl, IEEE80211_BASEQ_FRAG));
1915 
1916 	rap = &ni->ni_rx_ampdu[tid];
1917 
1918 	/* Send ADDBA response */
1919 	args[0] = dialogtoken;
1920 	/*
1921 	 * NB: We ack only if the sta associated with HT and
1922 	 * the ap is configured to do AMPDU rx (the latter
1923 	 * violates the 11n spec and is mostly for testing).
1924 	 */
1925 	if ((ni->ni_flags & IEEE80211_NODE_AMPDU_RX) &&
1926 	    (vap->iv_flags_ht & IEEE80211_FHT_AMPDU_RX)) {
1927 		/* XXX handle ampdu_rx_start failure */
1928 		ic->ic_ampdu_rx_start(ni, rap,
1929 		    baparamset, batimeout, baseqctl);
1930 
1931 		args[1] = IEEE80211_STATUS_SUCCESS;
1932 	} else {
1933 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N,
1934 		    ni, "reject ADDBA request: %s",
1935 		    ni->ni_flags & IEEE80211_NODE_AMPDU_RX ?
1936 		       "administratively disabled" :
1937 		       "not negotiated for station");
1938 		vap->iv_stats.is_addba_reject++;
1939 		args[1] = IEEE80211_STATUS_UNSPECIFIED;
1940 	}
1941 	/* XXX honor rap flags? */
1942 	args[2] = IEEE80211_BAPS_POLICY_IMMEDIATE
1943 		| SM(tid, IEEE80211_BAPS_TID)
1944 		| SM(rap->rxa_wnd, IEEE80211_BAPS_BUFSIZ)
1945 		;
1946 	args[3] = 0;
1947 	args[4] = 0;
1948 	ic->ic_send_action(ni, IEEE80211_ACTION_CAT_BA,
1949 		IEEE80211_ACTION_BA_ADDBA_RESPONSE, args);
1950 	return 0;
1951 }
1952 
1953 static int
1954 ht_recv_action_ba_addba_response(struct ieee80211_node *ni,
1955 	const struct ieee80211_frame *wh,
1956 	const uint8_t *frm, const uint8_t *efrm)
1957 {
1958 	struct ieee80211com *ic = ni->ni_ic;
1959 	struct ieee80211vap *vap = ni->ni_vap;
1960 	struct ieee80211_tx_ampdu *tap;
1961 	uint8_t dialogtoken, policy;
1962 	uint16_t baparamset, batimeout, code;
1963 	int tid, bufsiz;
1964 
1965 	dialogtoken = frm[2];
1966 	code = LE_READ_2(frm+3);
1967 	baparamset = LE_READ_2(frm+5);
1968 	tid = MS(baparamset, IEEE80211_BAPS_TID);
1969 	bufsiz = MS(baparamset, IEEE80211_BAPS_BUFSIZ);
1970 	policy = MS(baparamset, IEEE80211_BAPS_POLICY);
1971 	batimeout = LE_READ_2(frm+7);
1972 
1973 	tap = &ni->ni_tx_ampdu[tid];
1974 	if ((tap->txa_flags & IEEE80211_AGGR_XCHGPEND) == 0) {
1975 		IEEE80211_DISCARD_MAC(vap,
1976 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_11N,
1977 		    ni->ni_macaddr, "ADDBA response",
1978 		    "no pending ADDBA, tid %d dialogtoken %u "
1979 		    "code %d", tid, dialogtoken, code);
1980 		vap->iv_stats.is_addba_norequest++;
1981 		return 0;
1982 	}
1983 	if (dialogtoken != tap->txa_token) {
1984 		IEEE80211_DISCARD_MAC(vap,
1985 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_11N,
1986 		    ni->ni_macaddr, "ADDBA response",
1987 		    "dialogtoken mismatch: waiting for %d, "
1988 		    "received %d, tid %d code %d",
1989 		    tap->txa_token, dialogtoken, tid, code);
1990 		vap->iv_stats.is_addba_badtoken++;
1991 		return 0;
1992 	}
1993 	/* NB: assumes IEEE80211_AGGR_IMMEDIATE is 1 */
1994 	if (policy != (tap->txa_flags & IEEE80211_AGGR_IMMEDIATE)) {
1995 		IEEE80211_DISCARD_MAC(vap,
1996 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_11N,
1997 		    ni->ni_macaddr, "ADDBA response",
1998 		    "policy mismatch: expecting %s, "
1999 		    "received %s, tid %d code %d",
2000 		    tap->txa_flags & IEEE80211_AGGR_IMMEDIATE,
2001 		    policy, tid, code);
2002 		vap->iv_stats.is_addba_badpolicy++;
2003 		return 0;
2004 	}
2005 #if 0
2006 	/* XXX we take MIN in ieee80211_addba_response */
2007 	if (bufsiz > IEEE80211_AGGR_BAWMAX) {
2008 		IEEE80211_DISCARD_MAC(vap,
2009 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_11N,
2010 		    ni->ni_macaddr, "ADDBA response",
2011 		    "BA window too large: max %d, "
2012 		    "received %d, tid %d code %d",
2013 		    bufsiz, IEEE80211_AGGR_BAWMAX, tid, code);
2014 		vap->iv_stats.is_addba_badbawinsize++;
2015 		return 0;
2016 	}
2017 #endif
2018 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
2019 	    "recv ADDBA response: dialogtoken %u code %d "
2020 	    "baparamset 0x%x (tid %d bufsiz %d) batimeout %d",
2021 	    dialogtoken, code, baparamset, tid, bufsiz,
2022 	    batimeout);
2023 	ic->ic_addba_response(ni, tap, code, baparamset, batimeout);
2024 	return 0;
2025 }
2026 
2027 static int
2028 ht_recv_action_ba_delba(struct ieee80211_node *ni,
2029 	const struct ieee80211_frame *wh,
2030 	const uint8_t *frm, const uint8_t *efrm)
2031 {
2032 	struct ieee80211com *ic = ni->ni_ic;
2033 	struct ieee80211_rx_ampdu *rap;
2034 	struct ieee80211_tx_ampdu *tap;
2035 	uint16_t baparamset, code;
2036 	int tid;
2037 
2038 	baparamset = LE_READ_2(frm+2);
2039 	code = LE_READ_2(frm+4);
2040 
2041 	tid = MS(baparamset, IEEE80211_DELBAPS_TID);
2042 
2043 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
2044 	    "recv DELBA: baparamset 0x%x (tid %d initiator %d) "
2045 	    "code %d", baparamset, tid,
2046 	    MS(baparamset, IEEE80211_DELBAPS_INIT), code);
2047 
2048 	if ((baparamset & IEEE80211_DELBAPS_INIT) == 0) {
2049 		tap = &ni->ni_tx_ampdu[tid];
2050 		ic->ic_addba_stop(ni, tap);
2051 	} else {
2052 		rap = &ni->ni_rx_ampdu[tid];
2053 		ic->ic_ampdu_rx_stop(ni, rap);
2054 	}
2055 	return 0;
2056 }
2057 
2058 static int
2059 ht_recv_action_ht_txchwidth(struct ieee80211_node *ni,
2060 	const struct ieee80211_frame *wh,
2061 	const uint8_t *frm, const uint8_t *efrm)
2062 {
2063 	int chw;
2064 
2065 	chw = (frm[2] == IEEE80211_A_HT_TXCHWIDTH_2040) ? 40 : 20;
2066 
2067 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
2068 	    "%s: HT txchwidth, width %d%s",
2069 	    __func__, chw, ni->ni_chw != chw ? "*" : "");
2070 	if (chw != ni->ni_chw) {
2071 		ni->ni_chw = chw;
2072 		/* XXX notify on change */
2073 	}
2074 	return 0;
2075 }
2076 
2077 static int
2078 ht_recv_action_ht_mimopwrsave(struct ieee80211_node *ni,
2079 	const struct ieee80211_frame *wh,
2080 	const uint8_t *frm, const uint8_t *efrm)
2081 {
2082 	const struct ieee80211_action_ht_mimopowersave *mps =
2083 	    (const struct ieee80211_action_ht_mimopowersave *) frm;
2084 
2085 	/* XXX check iv_htcaps */
2086 	if (mps->am_control & IEEE80211_A_HT_MIMOPWRSAVE_ENA)
2087 		ni->ni_flags |= IEEE80211_NODE_MIMO_PS;
2088 	else
2089 		ni->ni_flags &= ~IEEE80211_NODE_MIMO_PS;
2090 	if (mps->am_control & IEEE80211_A_HT_MIMOPWRSAVE_MODE)
2091 		ni->ni_flags |= IEEE80211_NODE_MIMO_RTS;
2092 	else
2093 		ni->ni_flags &= ~IEEE80211_NODE_MIMO_RTS;
2094 	/* XXX notify on change */
2095 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
2096 	    "%s: HT MIMO PS (%s%s)", __func__,
2097 	    (ni->ni_flags & IEEE80211_NODE_MIMO_PS) ?  "on" : "off",
2098 	    (ni->ni_flags & IEEE80211_NODE_MIMO_RTS) ?  "+rts" : ""
2099 	);
2100 	return 0;
2101 }
2102 
2103 /*
2104  * Transmit processing.
2105  */
2106 
2107 /*
2108  * Check if A-MPDU should be requested/enabled for a stream.
2109  * We require a traffic rate above a per-AC threshold and we
2110  * also handle backoff from previous failed attempts.
2111  *
2112  * Drivers may override this method to bring in information
2113  * such as link state conditions in making the decision.
2114  */
2115 static int
2116 ieee80211_ampdu_enable(struct ieee80211_node *ni,
2117 	struct ieee80211_tx_ampdu *tap)
2118 {
2119 	struct ieee80211vap *vap = ni->ni_vap;
2120 
2121 	if (tap->txa_avgpps <
2122 	    vap->iv_ampdu_mintraffic[TID_TO_WME_AC(tap->txa_tid)])
2123 		return 0;
2124 	/* XXX check rssi? */
2125 	if (tap->txa_attempts >= ieee80211_addba_maxtries &&
2126 	    ticks < tap->txa_nextrequest) {
2127 		/*
2128 		 * Don't retry too often; txa_nextrequest is set
2129 		 * to the minimum interval we'll retry after
2130 		 * ieee80211_addba_maxtries failed attempts are made.
2131 		 */
2132 		return 0;
2133 	}
2134 	IEEE80211_NOTE(vap, IEEE80211_MSG_11N, ni,
2135 	    "enable AMPDU on tid %d (%s), avgpps %d pkts %d",
2136 	    tap->txa_tid, ieee80211_wme_acnames[TID_TO_WME_AC(tap->txa_tid)],
2137 	    tap->txa_avgpps, tap->txa_pkts);
2138 	return 1;
2139 }
2140 
2141 /*
2142  * Request A-MPDU tx aggregation.  Setup local state and
2143  * issue an ADDBA request.  BA use will only happen after
2144  * the other end replies with ADDBA response.
2145  */
2146 int
2147 ieee80211_ampdu_request(struct ieee80211_node *ni,
2148 	struct ieee80211_tx_ampdu *tap)
2149 {
2150 	struct ieee80211com *ic = ni->ni_ic;
2151 	uint16_t args[5];
2152 	int tid, dialogtoken;
2153 	static int tokens = 0;	/* XXX */
2154 
2155 	/* XXX locking */
2156 	if ((tap->txa_flags & IEEE80211_AGGR_SETUP) == 0) {
2157 		/* do deferred setup of state */
2158 		ampdu_tx_setup(tap);
2159 	}
2160 	/* XXX hack for not doing proper locking */
2161 	tap->txa_flags &= ~IEEE80211_AGGR_NAK;
2162 
2163 	dialogtoken = (tokens+1) % 63;		/* XXX */
2164 	tid = tap->txa_tid;
2165 	tap->txa_start = ni->ni_txseqs[tid];
2166 
2167 	args[0] = dialogtoken;
2168 	args[1] = 0;	/* NB: status code not used */
2169 	args[2]	= IEEE80211_BAPS_POLICY_IMMEDIATE
2170 		| SM(tid, IEEE80211_BAPS_TID)
2171 		| SM(IEEE80211_AGGR_BAWMAX, IEEE80211_BAPS_BUFSIZ)
2172 		;
2173 	args[3] = 0;	/* batimeout */
2174 	/* NB: do first so there's no race against reply */
2175 	if (!ic->ic_addba_request(ni, tap, dialogtoken, args[2], args[3])) {
2176 		/* unable to setup state, don't make request */
2177 		IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
2178 		    ni, "%s: could not setup BA stream for TID %d AC %d",
2179 		    __func__, tap->txa_tid, TID_TO_WME_AC(tap->txa_tid));
2180 		/* defer next try so we don't slam the driver with requests */
2181 		tap->txa_attempts = ieee80211_addba_maxtries;
2182 		/* NB: check in case driver wants to override */
2183 		if (tap->txa_nextrequest <= ticks)
2184 			tap->txa_nextrequest = ticks + ieee80211_addba_backoff;
2185 		return 0;
2186 	}
2187 	tokens = dialogtoken;			/* allocate token */
2188 	/* NB: after calling ic_addba_request so driver can set txa_start */
2189 	args[4] = SM(tap->txa_start, IEEE80211_BASEQ_START)
2190 		| SM(0, IEEE80211_BASEQ_FRAG)
2191 		;
2192 	return ic->ic_send_action(ni, IEEE80211_ACTION_CAT_BA,
2193 		IEEE80211_ACTION_BA_ADDBA_REQUEST, args);
2194 }
2195 
2196 /*
2197  * Terminate an AMPDU tx stream.  State is reclaimed
2198  * and the peer notified with a DelBA Action frame.
2199  */
2200 void
2201 ieee80211_ampdu_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
2202 	int reason)
2203 {
2204 	struct ieee80211com *ic = ni->ni_ic;
2205 	struct ieee80211vap *vap = ni->ni_vap;
2206 	uint16_t args[4];
2207 
2208 	/* XXX locking */
2209 	tap->txa_flags &= ~IEEE80211_AGGR_BARPEND;
2210 	if (IEEE80211_AMPDU_RUNNING(tap)) {
2211 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N,
2212 		    ni, "%s: stop BA stream for TID %d (reason %d)",
2213 		    __func__, tap->txa_tid, reason);
2214 		vap->iv_stats.is_ampdu_stop++;
2215 
2216 		ic->ic_addba_stop(ni, tap);
2217 		args[0] = tap->txa_tid;
2218 		args[1] = IEEE80211_DELBAPS_INIT;
2219 		args[2] = reason;			/* XXX reason code */
2220 		ic->ic_send_action(ni, IEEE80211_ACTION_CAT_BA,
2221 			IEEE80211_ACTION_BA_DELBA, args);
2222 	} else {
2223 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N,
2224 		    ni, "%s: BA stream for TID %d not running (reason %d)",
2225 		    __func__, tap->txa_tid, reason);
2226 		vap->iv_stats.is_ampdu_stop_failed++;
2227 	}
2228 }
2229 
2230 /* XXX */
2231 static void bar_start_timer(struct ieee80211_tx_ampdu *tap);
2232 
2233 static void
2234 bar_timeout(void *arg)
2235 {
2236 	struct ieee80211_tx_ampdu *tap = arg;
2237 	struct ieee80211_node *ni = tap->txa_ni;
2238 
2239 	KASSERT((tap->txa_flags & IEEE80211_AGGR_XCHGPEND) == 0,
2240 	    ("bar/addba collision, flags 0x%x", tap->txa_flags));
2241 
2242 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
2243 	    ni, "%s: tid %u flags 0x%x attempts %d", __func__,
2244 	    tap->txa_tid, tap->txa_flags, tap->txa_attempts);
2245 
2246 	/* guard against race with bar_tx_complete */
2247 	if ((tap->txa_flags & IEEE80211_AGGR_BARPEND) == 0)
2248 		return;
2249 	/* XXX ? */
2250 	if (tap->txa_attempts >= ieee80211_bar_maxtries) {
2251 		struct ieee80211com *ic = ni->ni_ic;
2252 
2253 		ni->ni_vap->iv_stats.is_ampdu_bar_tx_fail++;
2254 		/*
2255 		 * If (at least) the last BAR TX timeout was due to
2256 		 * an ieee80211_send_bar() failures, then we need
2257 		 * to make sure we notify the driver that a BAR
2258 		 * TX did occur and fail.  This gives the driver
2259 		 * a chance to undo any queue pause that may
2260 		 * have occured.
2261 		 */
2262 		ic->ic_bar_response(ni, tap, 1);
2263 		ieee80211_ampdu_stop(ni, tap, IEEE80211_REASON_TIMEOUT);
2264 	} else {
2265 		ni->ni_vap->iv_stats.is_ampdu_bar_tx_retry++;
2266 		if (ieee80211_send_bar(ni, tap, tap->txa_seqpending) != 0) {
2267 			IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
2268 			    ni, "%s: failed to TX, starting timer\n",
2269 			    __func__);
2270 			/*
2271 			 * If ieee80211_send_bar() fails here, the
2272 			 * timer may have stopped and/or the pending
2273 			 * flag may be clear.  Because of this,
2274 			 * fake the BARPEND and reset the timer.
2275 			 * A retransmission attempt will then occur
2276 			 * during the next timeout.
2277 			 */
2278 			/* XXX locking */
2279 			tap->txa_flags |= IEEE80211_AGGR_BARPEND;
2280 			bar_start_timer(tap);
2281 		}
2282 	}
2283 }
2284 
2285 static void
2286 bar_start_timer(struct ieee80211_tx_ampdu *tap)
2287 {
2288 	IEEE80211_NOTE(tap->txa_ni->ni_vap, IEEE80211_MSG_11N,
2289 	    tap->txa_ni,
2290 	    "%s: called",
2291 	    __func__);
2292 	callout_reset(&tap->txa_timer, ieee80211_bar_timeout, bar_timeout, tap);
2293 }
2294 
2295 static void
2296 bar_stop_timer(struct ieee80211_tx_ampdu *tap)
2297 {
2298 	IEEE80211_NOTE(tap->txa_ni->ni_vap, IEEE80211_MSG_11N,
2299 	    tap->txa_ni,
2300 	    "%s: called",
2301 	    __func__);
2302 	callout_stop(&tap->txa_timer);
2303 }
2304 
2305 static void
2306 bar_tx_complete(struct ieee80211_node *ni, void *arg, int status)
2307 {
2308 	struct ieee80211_tx_ampdu *tap = arg;
2309 
2310 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
2311 	    ni, "%s: tid %u flags 0x%x pending %d status %d",
2312 	    __func__, tap->txa_tid, tap->txa_flags,
2313 	    callout_pending(&tap->txa_timer), status);
2314 
2315 	ni->ni_vap->iv_stats.is_ampdu_bar_tx++;
2316 	/* XXX locking */
2317 	if ((tap->txa_flags & IEEE80211_AGGR_BARPEND) &&
2318 	    callout_pending(&tap->txa_timer)) {
2319 		struct ieee80211com *ic = ni->ni_ic;
2320 
2321 		if (status == 0)		/* ACK'd */
2322 			bar_stop_timer(tap);
2323 		ic->ic_bar_response(ni, tap, status);
2324 		/* NB: just let timer expire so we pace requests */
2325 	}
2326 }
2327 
2328 static void
2329 ieee80211_bar_response(struct ieee80211_node *ni,
2330 	struct ieee80211_tx_ampdu *tap, int status)
2331 {
2332 
2333 	IEEE80211_NOTE(tap->txa_ni->ni_vap, IEEE80211_MSG_11N,
2334 	    tap->txa_ni,
2335 	    "%s: called",
2336 	    __func__);
2337 	if (status == 0) {		/* got ACK */
2338 		IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_11N,
2339 		    ni, "BAR moves BA win <%u:%u> (%u frames) txseq %u tid %u",
2340 		    tap->txa_start,
2341 		    IEEE80211_SEQ_ADD(tap->txa_start, tap->txa_wnd-1),
2342 		    tap->txa_qframes, tap->txa_seqpending,
2343 		    tap->txa_tid);
2344 
2345 		/* NB: timer already stopped in bar_tx_complete */
2346 		tap->txa_start = tap->txa_seqpending;
2347 		tap->txa_flags &= ~IEEE80211_AGGR_BARPEND;
2348 	}
2349 }
2350 
2351 /*
2352  * Transmit a BAR frame to the specified node.  The
2353  * BAR contents are drawn from the supplied aggregation
2354  * state associated with the node.
2355  *
2356  * NB: we only handle immediate ACK w/ compressed bitmap.
2357  */
2358 int
2359 ieee80211_send_bar(struct ieee80211_node *ni,
2360 	struct ieee80211_tx_ampdu *tap, ieee80211_seq seq)
2361 {
2362 #define	senderr(_x, _v)	do { vap->iv_stats._v++; ret = _x; goto bad; } while (0)
2363 	struct ieee80211vap *vap = ni->ni_vap;
2364 	struct ieee80211com *ic = ni->ni_ic;
2365 	struct ieee80211_frame_bar *bar;
2366 	struct mbuf *m;
2367 	uint16_t barctl, barseqctl;
2368 	uint8_t *frm;
2369 	int tid, ret;
2370 
2371 
2372 	IEEE80211_NOTE(tap->txa_ni->ni_vap, IEEE80211_MSG_11N,
2373 	    tap->txa_ni,
2374 	    "%s: called",
2375 	    __func__);
2376 
2377 	if ((tap->txa_flags & IEEE80211_AGGR_RUNNING) == 0) {
2378 		/* no ADDBA response, should not happen */
2379 		/* XXX stat+msg */
2380 		return EINVAL;
2381 	}
2382 	/* XXX locking */
2383 	bar_stop_timer(tap);
2384 
2385 	ieee80211_ref_node(ni);
2386 
2387 	m = ieee80211_getmgtframe(&frm, ic->ic_headroom, sizeof(*bar));
2388 	if (m == NULL)
2389 		senderr(ENOMEM, is_tx_nobuf);
2390 
2391 	if (!ieee80211_add_callback(m, bar_tx_complete, tap)) {
2392 		m_freem(m);
2393 		senderr(ENOMEM, is_tx_nobuf);	/* XXX */
2394 		/* NOTREACHED */
2395 	}
2396 
2397 	bar = mtod(m, struct ieee80211_frame_bar *);
2398 	bar->i_fc[0] = IEEE80211_FC0_VERSION_0 |
2399 		IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_BAR;
2400 	bar->i_fc[1] = 0;
2401 	IEEE80211_ADDR_COPY(bar->i_ra, ni->ni_macaddr);
2402 	IEEE80211_ADDR_COPY(bar->i_ta, vap->iv_myaddr);
2403 
2404 	tid = tap->txa_tid;
2405 	barctl 	= (tap->txa_flags & IEEE80211_AGGR_IMMEDIATE ?
2406 			0 : IEEE80211_BAR_NOACK)
2407 		| IEEE80211_BAR_COMP
2408 		| SM(tid, IEEE80211_BAR_TID)
2409 		;
2410 	barseqctl = SM(seq, IEEE80211_BAR_SEQ_START);
2411 	/* NB: known to have proper alignment */
2412 	bar->i_ctl = htole16(barctl);
2413 	bar->i_seq = htole16(barseqctl);
2414 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_bar);
2415 
2416 	M_WME_SETAC(m, WME_AC_VO);
2417 
2418 	IEEE80211_NODE_STAT(ni, tx_mgmt);	/* XXX tx_ctl? */
2419 
2420 	/* XXX locking */
2421 	/* init/bump attempts counter */
2422 	if ((tap->txa_flags & IEEE80211_AGGR_BARPEND) == 0)
2423 		tap->txa_attempts = 1;
2424 	else
2425 		tap->txa_attempts++;
2426 	tap->txa_seqpending = seq;
2427 	tap->txa_flags |= IEEE80211_AGGR_BARPEND;
2428 
2429 	IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_11N,
2430 	    ni, "send BAR: tid %u ctl 0x%x start %u (attempt %d)",
2431 	    tid, barctl, seq, tap->txa_attempts);
2432 
2433 	/*
2434 	 * ic_raw_xmit will free the node reference
2435 	 * regardless of queue/TX success or failure.
2436 	 */
2437 	IEEE80211_TX_LOCK(ic);
2438 	ret = ieee80211_raw_output(vap, ni, m, NULL);
2439 	IEEE80211_TX_UNLOCK(ic);
2440 	if (ret != 0) {
2441 		IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_11N,
2442 		    ni, "send BAR: failed: (ret = %d)\n",
2443 		    ret);
2444 		/* xmit failed, clear state flag */
2445 		tap->txa_flags &= ~IEEE80211_AGGR_BARPEND;
2446 		vap->iv_stats.is_ampdu_bar_tx_fail++;
2447 		return ret;
2448 	}
2449 	/* XXX hack against tx complete happening before timer is started */
2450 	if (tap->txa_flags & IEEE80211_AGGR_BARPEND)
2451 		bar_start_timer(tap);
2452 	return 0;
2453 bad:
2454 	IEEE80211_NOTE(tap->txa_ni->ni_vap, IEEE80211_MSG_11N,
2455 	    tap->txa_ni,
2456 	    "%s: bad! ret=%d",
2457 	    __func__, ret);
2458 	vap->iv_stats.is_ampdu_bar_tx_fail++;
2459 	ieee80211_free_node(ni);
2460 	return ret;
2461 #undef senderr
2462 }
2463 
2464 static int
2465 ht_action_output(struct ieee80211_node *ni, struct mbuf *m)
2466 {
2467 	struct ieee80211_bpf_params params;
2468 
2469 	memset(&params, 0, sizeof(params));
2470 	params.ibp_pri = WME_AC_VO;
2471 	params.ibp_rate0 = ni->ni_txparms->mgmtrate;
2472 	/* NB: we know all frames are unicast */
2473 	params.ibp_try0 = ni->ni_txparms->maxretry;
2474 	params.ibp_power = ni->ni_txpower;
2475 	return ieee80211_mgmt_output(ni, m, IEEE80211_FC0_SUBTYPE_ACTION,
2476 	     &params);
2477 }
2478 
2479 #define	ADDSHORT(frm, v) do {			\
2480 	frm[0] = (v) & 0xff;			\
2481 	frm[1] = (v) >> 8;			\
2482 	frm += 2;				\
2483 } while (0)
2484 
2485 /*
2486  * Send an action management frame.  The arguments are stuff
2487  * into a frame without inspection; the caller is assumed to
2488  * prepare them carefully (e.g. based on the aggregation state).
2489  */
2490 static int
2491 ht_send_action_ba_addba(struct ieee80211_node *ni,
2492 	int category, int action, void *arg0)
2493 {
2494 	struct ieee80211vap *vap = ni->ni_vap;
2495 	struct ieee80211com *ic = ni->ni_ic;
2496 	uint16_t *args = arg0;
2497 	struct mbuf *m;
2498 	uint8_t *frm;
2499 
2500 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
2501 	    "send ADDBA %s: dialogtoken %d status %d "
2502 	    "baparamset 0x%x (tid %d) batimeout 0x%x baseqctl 0x%x",
2503 	    (action == IEEE80211_ACTION_BA_ADDBA_REQUEST) ?
2504 		"request" : "response",
2505 	    args[0], args[1], args[2], MS(args[2], IEEE80211_BAPS_TID),
2506 	    args[3], args[4]);
2507 
2508 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2509 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2510 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2511 	ieee80211_ref_node(ni);
2512 
2513 	m = ieee80211_getmgtframe(&frm,
2514 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2515 	    sizeof(uint16_t)	/* action+category */
2516 	    /* XXX may action payload */
2517 	    + sizeof(struct ieee80211_action_ba_addbaresponse)
2518 	);
2519 	if (m != NULL) {
2520 		*frm++ = category;
2521 		*frm++ = action;
2522 		*frm++ = args[0];		/* dialog token */
2523 		if (action == IEEE80211_ACTION_BA_ADDBA_RESPONSE)
2524 			ADDSHORT(frm, args[1]);	/* status code */
2525 		ADDSHORT(frm, args[2]);		/* baparamset */
2526 		ADDSHORT(frm, args[3]);		/* batimeout */
2527 		if (action == IEEE80211_ACTION_BA_ADDBA_REQUEST)
2528 			ADDSHORT(frm, args[4]);	/* baseqctl */
2529 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2530 		return ht_action_output(ni, m);
2531 	} else {
2532 		vap->iv_stats.is_tx_nobuf++;
2533 		ieee80211_free_node(ni);
2534 		return ENOMEM;
2535 	}
2536 }
2537 
2538 static int
2539 ht_send_action_ba_delba(struct ieee80211_node *ni,
2540 	int category, int action, void *arg0)
2541 {
2542 	struct ieee80211vap *vap = ni->ni_vap;
2543 	struct ieee80211com *ic = ni->ni_ic;
2544 	uint16_t *args = arg0;
2545 	struct mbuf *m;
2546 	uint16_t baparamset;
2547 	uint8_t *frm;
2548 
2549 	baparamset = SM(args[0], IEEE80211_DELBAPS_TID)
2550 		   | args[1]
2551 		   ;
2552 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
2553 	    "send DELBA action: tid %d, initiator %d reason %d",
2554 	    args[0], args[1], args[2]);
2555 
2556 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2557 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2558 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2559 	ieee80211_ref_node(ni);
2560 
2561 	m = ieee80211_getmgtframe(&frm,
2562 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2563 	    sizeof(uint16_t)	/* action+category */
2564 	    /* XXX may action payload */
2565 	    + sizeof(struct ieee80211_action_ba_addbaresponse)
2566 	);
2567 	if (m != NULL) {
2568 		*frm++ = category;
2569 		*frm++ = action;
2570 		ADDSHORT(frm, baparamset);
2571 		ADDSHORT(frm, args[2]);		/* reason code */
2572 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2573 		return ht_action_output(ni, m);
2574 	} else {
2575 		vap->iv_stats.is_tx_nobuf++;
2576 		ieee80211_free_node(ni);
2577 		return ENOMEM;
2578 	}
2579 }
2580 
2581 static int
2582 ht_send_action_ht_txchwidth(struct ieee80211_node *ni,
2583 	int category, int action, void *arg0)
2584 {
2585 	struct ieee80211vap *vap = ni->ni_vap;
2586 	struct ieee80211com *ic = ni->ni_ic;
2587 	struct mbuf *m;
2588 	uint8_t *frm;
2589 
2590 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_11N, ni,
2591 	    "send HT txchwidth: width %d",
2592 	    IEEE80211_IS_CHAN_HT40(ni->ni_chan) ? 40 : 20);
2593 
2594 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2595 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2596 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2597 	ieee80211_ref_node(ni);
2598 
2599 	m = ieee80211_getmgtframe(&frm,
2600 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2601 	    sizeof(uint16_t)	/* action+category */
2602 	    /* XXX may action payload */
2603 	    + sizeof(struct ieee80211_action_ba_addbaresponse)
2604 	);
2605 	if (m != NULL) {
2606 		*frm++ = category;
2607 		*frm++ = action;
2608 		*frm++ = IEEE80211_IS_CHAN_HT40(ni->ni_chan) ?
2609 			IEEE80211_A_HT_TXCHWIDTH_2040 :
2610 			IEEE80211_A_HT_TXCHWIDTH_20;
2611 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2612 		return ht_action_output(ni, m);
2613 	} else {
2614 		vap->iv_stats.is_tx_nobuf++;
2615 		ieee80211_free_node(ni);
2616 		return ENOMEM;
2617 	}
2618 }
2619 #undef ADDSHORT
2620 
2621 /*
2622  * Construct the MCS bit mask for inclusion in an HT capabilities
2623  * information element.
2624  */
2625 static void
2626 ieee80211_set_mcsset(struct ieee80211com *ic, uint8_t *frm)
2627 {
2628 	int i;
2629 	uint8_t txparams;
2630 
2631 	KASSERT((ic->ic_rxstream > 0 && ic->ic_rxstream <= 4),
2632 	    ("ic_rxstream %d out of range", ic->ic_rxstream));
2633 	KASSERT((ic->ic_txstream > 0 && ic->ic_txstream <= 4),
2634 	    ("ic_txstream %d out of range", ic->ic_txstream));
2635 
2636 	for (i = 0; i < ic->ic_rxstream * 8; i++)
2637 		setbit(frm, i);
2638 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) &&
2639 	    (ic->ic_htcaps & IEEE80211_HTC_RXMCS32))
2640 		setbit(frm, 32);
2641 	if (ic->ic_htcaps & IEEE80211_HTC_RXUNEQUAL) {
2642 		if (ic->ic_rxstream >= 2) {
2643 			for (i = 33; i <= 38; i++)
2644 				setbit(frm, i);
2645 		}
2646 		if (ic->ic_rxstream >= 3) {
2647 			for (i = 39; i <= 52; i++)
2648 				setbit(frm, i);
2649 		}
2650 		if (ic->ic_txstream >= 4) {
2651 			for (i = 53; i <= 76; i++)
2652 				setbit(frm, i);
2653 		}
2654 	}
2655 
2656 	if (ic->ic_rxstream != ic->ic_txstream) {
2657 		txparams = 0x1;			/* TX MCS set defined */
2658 		txparams |= 0x2;		/* TX RX MCS not equal */
2659 		txparams |= (ic->ic_txstream - 1) << 2;	/* num TX streams */
2660 		if (ic->ic_htcaps & IEEE80211_HTC_TXUNEQUAL)
2661 			txparams |= 0x16;	/* TX unequal modulation sup */
2662 	} else
2663 		txparams = 0;
2664 	frm[12] = txparams;
2665 }
2666 
2667 /*
2668  * Add body of an HTCAP information element.
2669  */
2670 static uint8_t *
2671 ieee80211_add_htcap_body(uint8_t *frm, struct ieee80211_node *ni)
2672 {
2673 #define	ADDSHORT(frm, v) do {			\
2674 	frm[0] = (v) & 0xff;			\
2675 	frm[1] = (v) >> 8;			\
2676 	frm += 2;				\
2677 } while (0)
2678 	struct ieee80211com *ic = ni->ni_ic;
2679 	struct ieee80211vap *vap = ni->ni_vap;
2680 	uint16_t caps, extcaps;
2681 	int rxmax, density;
2682 
2683 	/* HT capabilities */
2684 	caps = vap->iv_htcaps & 0xffff;
2685 	/*
2686 	 * Note channel width depends on whether we are operating as
2687 	 * a sta or not.  When operating as a sta we are generating
2688 	 * a request based on our desired configuration.  Otherwise
2689 	 * we are operational and the channel attributes identify
2690 	 * how we've been setup (which might be different if a fixed
2691 	 * channel is specified).
2692 	 */
2693 	if (vap->iv_opmode == IEEE80211_M_STA) {
2694 		/* override 20/40 use based on config */
2695 		if (vap->iv_flags_ht & IEEE80211_FHT_USEHT40)
2696 			caps |= IEEE80211_HTCAP_CHWIDTH40;
2697 		else
2698 			caps &= ~IEEE80211_HTCAP_CHWIDTH40;
2699 
2700 		/* Start by using the advertised settings */
2701 		rxmax = MS(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
2702 		density = MS(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
2703 
2704 		/* Cap at VAP rxmax */
2705 		if (rxmax > vap->iv_ampdu_rxmax)
2706 			rxmax = vap->iv_ampdu_rxmax;
2707 
2708 		/*
2709 		 * If the VAP ampdu density value greater, use that.
2710 		 *
2711 		 * (Larger density value == larger minimum gap between A-MPDU
2712 		 * subframes.)
2713 		 */
2714 		if (vap->iv_ampdu_density > density)
2715 			density = vap->iv_ampdu_density;
2716 
2717 		/*
2718 		 * NB: Hardware might support HT40 on some but not all
2719 		 * channels. We can't determine this earlier because only
2720 		 * after association the channel is upgraded to HT based
2721 		 * on the negotiated capabilities.
2722 		 */
2723 		if (ni->ni_chan != IEEE80211_CHAN_ANYC &&
2724 		    findhtchan(ic, ni->ni_chan, IEEE80211_CHAN_HT40U) == NULL &&
2725 		    findhtchan(ic, ni->ni_chan, IEEE80211_CHAN_HT40D) == NULL)
2726 			caps &= ~IEEE80211_HTCAP_CHWIDTH40;
2727 	} else {
2728 		/* override 20/40 use based on current channel */
2729 		if (IEEE80211_IS_CHAN_HT40(ni->ni_chan))
2730 			caps |= IEEE80211_HTCAP_CHWIDTH40;
2731 		else
2732 			caps &= ~IEEE80211_HTCAP_CHWIDTH40;
2733 
2734 		/* XXX TODO should it start by using advertised settings? */
2735 		rxmax = vap->iv_ampdu_rxmax;
2736 		density = vap->iv_ampdu_density;
2737 	}
2738 
2739 	/* adjust short GI based on channel and config */
2740 	if ((vap->iv_flags_ht & IEEE80211_FHT_SHORTGI20) == 0)
2741 		caps &= ~IEEE80211_HTCAP_SHORTGI20;
2742 	if ((vap->iv_flags_ht & IEEE80211_FHT_SHORTGI40) == 0 ||
2743 	    (caps & IEEE80211_HTCAP_CHWIDTH40) == 0)
2744 		caps &= ~IEEE80211_HTCAP_SHORTGI40;
2745 	ADDSHORT(frm, caps);
2746 
2747 	/* HT parameters */
2748 	*frm = SM(rxmax, IEEE80211_HTCAP_MAXRXAMPDU)
2749 	     | SM(density, IEEE80211_HTCAP_MPDUDENSITY)
2750 	     ;
2751 	frm++;
2752 
2753 	/* pre-zero remainder of ie */
2754 	memset(frm, 0, sizeof(struct ieee80211_ie_htcap) -
2755 		__offsetof(struct ieee80211_ie_htcap, hc_mcsset));
2756 
2757 	/* supported MCS set */
2758 	/*
2759 	 * XXX: For sta mode the rate set should be restricted based
2760 	 * on the AP's capabilities, but ni_htrates isn't setup when
2761 	 * we're called to form an AssocReq frame so for now we're
2762 	 * restricted to the device capabilities.
2763 	 */
2764 	ieee80211_set_mcsset(ni->ni_ic, frm);
2765 
2766 	frm += __offsetof(struct ieee80211_ie_htcap, hc_extcap) -
2767 		__offsetof(struct ieee80211_ie_htcap, hc_mcsset);
2768 
2769 	/* HT extended capabilities */
2770 	extcaps = vap->iv_htextcaps & 0xffff;
2771 
2772 	ADDSHORT(frm, extcaps);
2773 
2774 	frm += sizeof(struct ieee80211_ie_htcap) -
2775 		__offsetof(struct ieee80211_ie_htcap, hc_txbf);
2776 
2777 	return frm;
2778 #undef ADDSHORT
2779 }
2780 
2781 /*
2782  * Add 802.11n HT capabilities information element
2783  */
2784 uint8_t *
2785 ieee80211_add_htcap(uint8_t *frm, struct ieee80211_node *ni)
2786 {
2787 	frm[0] = IEEE80211_ELEMID_HTCAP;
2788 	frm[1] = sizeof(struct ieee80211_ie_htcap) - 2;
2789 	return ieee80211_add_htcap_body(frm + 2, ni);
2790 }
2791 
2792 /*
2793  * Add Broadcom OUI wrapped standard HTCAP ie; this is
2794  * used for compatibility w/ pre-draft implementations.
2795  */
2796 uint8_t *
2797 ieee80211_add_htcap_vendor(uint8_t *frm, struct ieee80211_node *ni)
2798 {
2799 	frm[0] = IEEE80211_ELEMID_VENDOR;
2800 	frm[1] = 4 + sizeof(struct ieee80211_ie_htcap) - 2;
2801 	frm[2] = (BCM_OUI >> 0) & 0xff;
2802 	frm[3] = (BCM_OUI >> 8) & 0xff;
2803 	frm[4] = (BCM_OUI >> 16) & 0xff;
2804 	frm[5] = BCM_OUI_HTCAP;
2805 	return ieee80211_add_htcap_body(frm + 6, ni);
2806 }
2807 
2808 /*
2809  * Construct the MCS bit mask of basic rates
2810  * for inclusion in an HT information element.
2811  */
2812 static void
2813 ieee80211_set_basic_htrates(uint8_t *frm, const struct ieee80211_htrateset *rs)
2814 {
2815 	int i;
2816 
2817 	for (i = 0; i < rs->rs_nrates; i++) {
2818 		int r = rs->rs_rates[i] & IEEE80211_RATE_VAL;
2819 		if ((rs->rs_rates[i] & IEEE80211_RATE_BASIC) &&
2820 		    r < IEEE80211_HTRATE_MAXSIZE) {
2821 			/* NB: this assumes a particular implementation */
2822 			setbit(frm, r);
2823 		}
2824 	}
2825 }
2826 
2827 /*
2828  * Update the HTINFO ie for a beacon frame.
2829  */
2830 void
2831 ieee80211_ht_update_beacon(struct ieee80211vap *vap,
2832 	struct ieee80211_beacon_offsets *bo)
2833 {
2834 #define	PROTMODE	(IEEE80211_HTINFO_OPMODE|IEEE80211_HTINFO_NONHT_PRESENT)
2835 	struct ieee80211_node *ni;
2836 	const struct ieee80211_channel *bsschan;
2837 	struct ieee80211com *ic = vap->iv_ic;
2838 	struct ieee80211_ie_htinfo *ht =
2839 	   (struct ieee80211_ie_htinfo *) bo->bo_htinfo;
2840 
2841 	ni = ieee80211_ref_node(vap->iv_bss);
2842 	bsschan = ni->ni_chan;
2843 
2844 	/* XXX only update on channel change */
2845 	ht->hi_ctrlchannel = ieee80211_chan2ieee(ic, bsschan);
2846 	if (vap->iv_flags_ht & IEEE80211_FHT_RIFS)
2847 		ht->hi_byte1 = IEEE80211_HTINFO_RIFSMODE_PERM;
2848 	else
2849 		ht->hi_byte1 = IEEE80211_HTINFO_RIFSMODE_PROH;
2850 	if (IEEE80211_IS_CHAN_HT40U(bsschan))
2851 		ht->hi_byte1 |= IEEE80211_HTINFO_2NDCHAN_ABOVE;
2852 	else if (IEEE80211_IS_CHAN_HT40D(bsschan))
2853 		ht->hi_byte1 |= IEEE80211_HTINFO_2NDCHAN_BELOW;
2854 	else
2855 		ht->hi_byte1 |= IEEE80211_HTINFO_2NDCHAN_NONE;
2856 	if (IEEE80211_IS_CHAN_HT40(bsschan))
2857 		ht->hi_byte1 |= IEEE80211_HTINFO_TXWIDTH_2040;
2858 
2859 	/* protection mode */
2860 	ht->hi_byte2 = (ht->hi_byte2 &~ PROTMODE) | ic->ic_curhtprotmode;
2861 
2862 	ieee80211_free_node(ni);
2863 
2864 	/* XXX propagate to vendor ie's */
2865 #undef PROTMODE
2866 }
2867 
2868 /*
2869  * Add body of an HTINFO information element.
2870  *
2871  * NB: We don't use struct ieee80211_ie_htinfo because we can
2872  * be called to fillin both a standard ie and a compat ie that
2873  * has a vendor OUI at the front.
2874  */
2875 static uint8_t *
2876 ieee80211_add_htinfo_body(uint8_t *frm, struct ieee80211_node *ni)
2877 {
2878 	struct ieee80211vap *vap = ni->ni_vap;
2879 	struct ieee80211com *ic = ni->ni_ic;
2880 
2881 	/* pre-zero remainder of ie */
2882 	memset(frm, 0, sizeof(struct ieee80211_ie_htinfo) - 2);
2883 
2884 	/* primary/control channel center */
2885 	*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
2886 
2887 	if (vap->iv_flags_ht & IEEE80211_FHT_RIFS)
2888 		frm[0] = IEEE80211_HTINFO_RIFSMODE_PERM;
2889 	else
2890 		frm[0] = IEEE80211_HTINFO_RIFSMODE_PROH;
2891 	if (IEEE80211_IS_CHAN_HT40U(ni->ni_chan))
2892 		frm[0] |= IEEE80211_HTINFO_2NDCHAN_ABOVE;
2893 	else if (IEEE80211_IS_CHAN_HT40D(ni->ni_chan))
2894 		frm[0] |= IEEE80211_HTINFO_2NDCHAN_BELOW;
2895 	else
2896 		frm[0] |= IEEE80211_HTINFO_2NDCHAN_NONE;
2897 	if (IEEE80211_IS_CHAN_HT40(ni->ni_chan))
2898 		frm[0] |= IEEE80211_HTINFO_TXWIDTH_2040;
2899 
2900 	frm[1] = ic->ic_curhtprotmode;
2901 
2902 	frm += 5;
2903 
2904 	/* basic MCS set */
2905 	ieee80211_set_basic_htrates(frm, &ni->ni_htrates);
2906 	frm += sizeof(struct ieee80211_ie_htinfo) -
2907 		__offsetof(struct ieee80211_ie_htinfo, hi_basicmcsset);
2908 	return frm;
2909 }
2910 
2911 /*
2912  * Add 802.11n HT information information element.
2913  */
2914 uint8_t *
2915 ieee80211_add_htinfo(uint8_t *frm, struct ieee80211_node *ni)
2916 {
2917 	frm[0] = IEEE80211_ELEMID_HTINFO;
2918 	frm[1] = sizeof(struct ieee80211_ie_htinfo) - 2;
2919 	return ieee80211_add_htinfo_body(frm + 2, ni);
2920 }
2921 
2922 /*
2923  * Add Broadcom OUI wrapped standard HTINFO ie; this is
2924  * used for compatibility w/ pre-draft implementations.
2925  */
2926 uint8_t *
2927 ieee80211_add_htinfo_vendor(uint8_t *frm, struct ieee80211_node *ni)
2928 {
2929 	frm[0] = IEEE80211_ELEMID_VENDOR;
2930 	frm[1] = 4 + sizeof(struct ieee80211_ie_htinfo) - 2;
2931 	frm[2] = (BCM_OUI >> 0) & 0xff;
2932 	frm[3] = (BCM_OUI >> 8) & 0xff;
2933 	frm[4] = (BCM_OUI >> 16) & 0xff;
2934 	frm[5] = BCM_OUI_HTINFO;
2935 	return ieee80211_add_htinfo_body(frm + 6, ni);
2936 }
2937