xref: /freebsd/sys/net80211/ieee80211_superg.c (revision 656f49f8e2b0656824a5f10aeb760a00fdd3753f)
1 /*-
2  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD$");
28 
29 #include "opt_wlan.h"
30 
31 #ifdef	IEEE80211_SUPPORT_SUPERG
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/mbuf.h>
36 #include <sys/kernel.h>
37 #include <sys/endian.h>
38 
39 #include <sys/socket.h>
40 
41 #include <net/if.h>
42 #include <net/if_var.h>
43 #include <net/if_llc.h>
44 #include <net/if_media.h>
45 #include <net/bpf.h>
46 #include <net/ethernet.h>
47 
48 #include <net80211/ieee80211_var.h>
49 #include <net80211/ieee80211_input.h>
50 #include <net80211/ieee80211_phy.h>
51 #include <net80211/ieee80211_superg.h>
52 
53 /*
54  * Atheros fast-frame encapsulation format.
55  * FF max payload:
56  * 802.2 + FFHDR + HPAD + 802.3 + 802.2 + 1500 + SPAD + 802.3 + 802.2 + 1500:
57  *   8   +   4   +  4   +   14  +   8   + 1500 +  6   +   14  +   8   + 1500
58  * = 3066
59  */
60 /* fast frame header is 32-bits */
61 #define	ATH_FF_PROTO	0x0000003f	/* protocol */
62 #define	ATH_FF_PROTO_S	0
63 #define	ATH_FF_FTYPE	0x000000c0	/* frame type */
64 #define	ATH_FF_FTYPE_S	6
65 #define	ATH_FF_HLEN32	0x00000300	/* optional hdr length */
66 #define	ATH_FF_HLEN32_S	8
67 #define	ATH_FF_SEQNUM	0x001ffc00	/* sequence number */
68 #define	ATH_FF_SEQNUM_S	10
69 #define	ATH_FF_OFFSET	0xffe00000	/* offset to 2nd payload */
70 #define	ATH_FF_OFFSET_S	21
71 
72 #define	ATH_FF_MAX_HDR_PAD	4
73 #define	ATH_FF_MAX_SEP_PAD	6
74 #define	ATH_FF_MAX_HDR		30
75 
76 #define	ATH_FF_PROTO_L2TUNNEL	0	/* L2 tunnel protocol */
77 #define	ATH_FF_ETH_TYPE		0x88bd	/* Ether type for encapsulated frames */
78 #define	ATH_FF_SNAP_ORGCODE_0	0x00
79 #define	ATH_FF_SNAP_ORGCODE_1	0x03
80 #define	ATH_FF_SNAP_ORGCODE_2	0x7f
81 
82 #define	ATH_FF_TXQMIN	2		/* min txq depth for staging */
83 #define	ATH_FF_TXQMAX	50		/* maximum # of queued frames allowed */
84 #define	ATH_FF_STAGEMAX	5		/* max waiting period for staged frame*/
85 
86 #define	ETHER_HEADER_COPY(dst, src) \
87 	memcpy(dst, src, sizeof(struct ether_header))
88 
89 static	int ieee80211_ffppsmin = 2;	/* pps threshold for ff aggregation */
90 SYSCTL_INT(_net_wlan, OID_AUTO, ffppsmin, CTLFLAG_RW,
91 	&ieee80211_ffppsmin, 0, "min packet rate before fast-frame staging");
92 static	int ieee80211_ffagemax = -1;	/* max time frames held on stage q */
93 SYSCTL_PROC(_net_wlan, OID_AUTO, ffagemax, CTLTYPE_INT | CTLFLAG_RW,
94 	&ieee80211_ffagemax, 0, ieee80211_sysctl_msecs_ticks, "I",
95 	"max hold time for fast-frame staging (ms)");
96 
97 void
98 ieee80211_superg_attach(struct ieee80211com *ic)
99 {
100 	struct ieee80211_superg *sg;
101 
102 	if (ic->ic_caps & IEEE80211_C_FF) {
103 		sg = (struct ieee80211_superg *) IEEE80211_MALLOC(
104 		     sizeof(struct ieee80211_superg), M_80211_VAP,
105 		     IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
106 		if (sg == NULL) {
107 			printf("%s: cannot allocate SuperG state block\n",
108 			    __func__);
109 			return;
110 		}
111 		ic->ic_superg = sg;
112 	}
113 	ieee80211_ffagemax = msecs_to_ticks(150);
114 }
115 
116 void
117 ieee80211_superg_detach(struct ieee80211com *ic)
118 {
119 	if (ic->ic_superg != NULL) {
120 		IEEE80211_FREE(ic->ic_superg, M_80211_VAP);
121 		ic->ic_superg = NULL;
122 	}
123 }
124 
125 void
126 ieee80211_superg_vattach(struct ieee80211vap *vap)
127 {
128 	struct ieee80211com *ic = vap->iv_ic;
129 
130 	if (ic->ic_superg == NULL)	/* NB: can't do fast-frames w/o state */
131 		vap->iv_caps &= ~IEEE80211_C_FF;
132 	if (vap->iv_caps & IEEE80211_C_FF)
133 		vap->iv_flags |= IEEE80211_F_FF;
134 	/* NB: we only implement sta mode */
135 	if (vap->iv_opmode == IEEE80211_M_STA &&
136 	    (vap->iv_caps & IEEE80211_C_TURBOP))
137 		vap->iv_flags |= IEEE80211_F_TURBOP;
138 }
139 
140 void
141 ieee80211_superg_vdetach(struct ieee80211vap *vap)
142 {
143 }
144 
145 #define	ATH_OUI_BYTES		0x00, 0x03, 0x7f
146 /*
147  * Add a WME information element to a frame.
148  */
149 uint8_t *
150 ieee80211_add_ath(uint8_t *frm, uint8_t caps, ieee80211_keyix defkeyix)
151 {
152 	static const struct ieee80211_ath_ie info = {
153 		.ath_id		= IEEE80211_ELEMID_VENDOR,
154 		.ath_len	= sizeof(struct ieee80211_ath_ie) - 2,
155 		.ath_oui	= { ATH_OUI_BYTES },
156 		.ath_oui_type	= ATH_OUI_TYPE,
157 		.ath_oui_subtype= ATH_OUI_SUBTYPE,
158 		.ath_version	= ATH_OUI_VERSION,
159 	};
160 	struct ieee80211_ath_ie *ath = (struct ieee80211_ath_ie *) frm;
161 
162 	memcpy(frm, &info, sizeof(info));
163 	ath->ath_capability = caps;
164 	if (defkeyix != IEEE80211_KEYIX_NONE) {
165 		ath->ath_defkeyix[0] = (defkeyix & 0xff);
166 		ath->ath_defkeyix[1] = ((defkeyix >> 8) & 0xff);
167 	} else {
168 		ath->ath_defkeyix[0] = 0xff;
169 		ath->ath_defkeyix[1] = 0x7f;
170 	}
171 	return frm + sizeof(info);
172 }
173 #undef ATH_OUI_BYTES
174 
175 uint8_t *
176 ieee80211_add_athcaps(uint8_t *frm, const struct ieee80211_node *bss)
177 {
178 	const struct ieee80211vap *vap = bss->ni_vap;
179 
180 	return ieee80211_add_ath(frm,
181 	    vap->iv_flags & IEEE80211_F_ATHEROS,
182 	    ((vap->iv_flags & IEEE80211_F_WPA) == 0 &&
183 	    bss->ni_authmode != IEEE80211_AUTH_8021X) ?
184 	    vap->iv_def_txkey : IEEE80211_KEYIX_NONE);
185 }
186 
187 void
188 ieee80211_parse_ath(struct ieee80211_node *ni, uint8_t *ie)
189 {
190 	const struct ieee80211_ath_ie *ath =
191 		(const struct ieee80211_ath_ie *) ie;
192 
193 	ni->ni_ath_flags = ath->ath_capability;
194 	ni->ni_ath_defkeyix = LE_READ_2(&ath->ath_defkeyix);
195 }
196 
197 int
198 ieee80211_parse_athparams(struct ieee80211_node *ni, uint8_t *frm,
199 	const struct ieee80211_frame *wh)
200 {
201 	struct ieee80211vap *vap = ni->ni_vap;
202 	const struct ieee80211_ath_ie *ath;
203 	u_int len = frm[1];
204 	int capschanged;
205 	uint16_t defkeyix;
206 
207 	if (len < sizeof(struct ieee80211_ath_ie)-2) {
208 		IEEE80211_DISCARD_IE(vap,
209 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_SUPERG,
210 		    wh, "Atheros", "too short, len %u", len);
211 		return -1;
212 	}
213 	ath = (const struct ieee80211_ath_ie *)frm;
214 	capschanged = (ni->ni_ath_flags != ath->ath_capability);
215 	defkeyix = LE_READ_2(ath->ath_defkeyix);
216 	if (capschanged || defkeyix != ni->ni_ath_defkeyix) {
217 		ni->ni_ath_flags = ath->ath_capability;
218 		ni->ni_ath_defkeyix = defkeyix;
219 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
220 		    "ath ie change: new caps 0x%x defkeyix 0x%x",
221 		    ni->ni_ath_flags, ni->ni_ath_defkeyix);
222 	}
223 	if (IEEE80211_ATH_CAP(vap, ni, ATHEROS_CAP_TURBO_PRIME)) {
224 		uint16_t curflags, newflags;
225 
226 		/*
227 		 * Check for turbo mode switch.  Calculate flags
228 		 * for the new mode and effect the switch.
229 		 */
230 		newflags = curflags = vap->iv_ic->ic_bsschan->ic_flags;
231 		/* NB: BOOST is not in ic_flags, so get it from the ie */
232 		if (ath->ath_capability & ATHEROS_CAP_BOOST)
233 			newflags |= IEEE80211_CHAN_TURBO;
234 		else
235 			newflags &= ~IEEE80211_CHAN_TURBO;
236 		if (newflags != curflags)
237 			ieee80211_dturbo_switch(vap, newflags);
238 	}
239 	return capschanged;
240 }
241 
242 /*
243  * Decap the encapsulated frame pair and dispatch the first
244  * for delivery.  The second frame is returned for delivery
245  * via the normal path.
246  */
247 struct mbuf *
248 ieee80211_ff_decap(struct ieee80211_node *ni, struct mbuf *m)
249 {
250 #define	FF_LLC_SIZE	(sizeof(struct ether_header) + sizeof(struct llc))
251 #define	MS(x,f)	(((x) & f) >> f##_S)
252 	struct ieee80211vap *vap = ni->ni_vap;
253 	struct llc *llc;
254 	uint32_t ath;
255 	struct mbuf *n;
256 	int framelen;
257 
258 	/* NB: we assume caller does this check for us */
259 	KASSERT(IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF),
260 	    ("ff not negotiated"));
261 	/*
262 	 * Check for fast-frame tunnel encapsulation.
263 	 */
264 	if (m->m_pkthdr.len < 3*FF_LLC_SIZE)
265 		return m;
266 	if (m->m_len < FF_LLC_SIZE &&
267 	    (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
268 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
269 		    ni->ni_macaddr, "fast-frame",
270 		    "%s", "m_pullup(llc) failed");
271 		vap->iv_stats.is_rx_tooshort++;
272 		return NULL;
273 	}
274 	llc = (struct llc *)(mtod(m, uint8_t *) +
275 	    sizeof(struct ether_header));
276 	if (llc->llc_snap.ether_type != htons(ATH_FF_ETH_TYPE))
277 		return m;
278 	m_adj(m, FF_LLC_SIZE);
279 	m_copydata(m, 0, sizeof(uint32_t), (caddr_t) &ath);
280 	if (MS(ath, ATH_FF_PROTO) != ATH_FF_PROTO_L2TUNNEL) {
281 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
282 		    ni->ni_macaddr, "fast-frame",
283 		    "unsupport tunnel protocol, header 0x%x", ath);
284 		vap->iv_stats.is_ff_badhdr++;
285 		m_freem(m);
286 		return NULL;
287 	}
288 	/* NB: skip header and alignment padding */
289 	m_adj(m, roundup(sizeof(uint32_t) - 2, 4) + 2);
290 
291 	vap->iv_stats.is_ff_decap++;
292 
293 	/*
294 	 * Decap the first frame, bust it apart from the
295 	 * second and deliver; then decap the second frame
296 	 * and return it to the caller for normal delivery.
297 	 */
298 	m = ieee80211_decap1(m, &framelen);
299 	if (m == NULL) {
300 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
301 		    ni->ni_macaddr, "fast-frame", "%s", "first decap failed");
302 		vap->iv_stats.is_ff_tooshort++;
303 		return NULL;
304 	}
305 	n = m_split(m, framelen, M_NOWAIT);
306 	if (n == NULL) {
307 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
308 		    ni->ni_macaddr, "fast-frame",
309 		    "%s", "unable to split encapsulated frames");
310 		vap->iv_stats.is_ff_split++;
311 		m_freem(m);			/* NB: must reclaim */
312 		return NULL;
313 	}
314 	/* XXX not right for WDS */
315 	vap->iv_deliver_data(vap, ni, m);	/* 1st of pair */
316 
317 	/*
318 	 * Decap second frame.
319 	 */
320 	m_adj(n, roundup2(framelen, 4) - framelen);	/* padding */
321 	n = ieee80211_decap1(n, &framelen);
322 	if (n == NULL) {
323 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
324 		    ni->ni_macaddr, "fast-frame", "%s", "second decap failed");
325 		vap->iv_stats.is_ff_tooshort++;
326 	}
327 	/* XXX verify framelen against mbuf contents */
328 	return n;				/* 2nd delivered by caller */
329 #undef MS
330 #undef FF_LLC_SIZE
331 }
332 
333 /*
334  * Fast frame encapsulation.  There must be two packets
335  * chained with m_nextpkt.  We do header adjustment for
336  * each, add the tunnel encapsulation, and then concatenate
337  * the mbuf chains to form a single frame for transmission.
338  */
339 struct mbuf *
340 ieee80211_ff_encap(struct ieee80211vap *vap, struct mbuf *m1, int hdrspace,
341 	struct ieee80211_key *key)
342 {
343 	struct mbuf *m2;
344 	struct ether_header eh1, eh2;
345 	struct llc *llc;
346 	struct mbuf *m;
347 	int pad;
348 
349 	m2 = m1->m_nextpkt;
350 	if (m2 == NULL) {
351 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
352 		    "%s: only one frame\n", __func__);
353 		goto bad;
354 	}
355 	m1->m_nextpkt = NULL;
356 	/*
357 	 * Include fast frame headers in adjusting header layout.
358 	 */
359 	KASSERT(m1->m_len >= sizeof(eh1), ("no ethernet header!"));
360 	ETHER_HEADER_COPY(&eh1, mtod(m1, caddr_t));
361 	m1 = ieee80211_mbuf_adjust(vap,
362 		hdrspace + sizeof(struct llc) + sizeof(uint32_t) + 2 +
363 		    sizeof(struct ether_header),
364 		key, m1);
365 	if (m1 == NULL) {
366 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
367 		m_freem(m2);
368 		goto bad;
369 	}
370 
371 	/*
372 	 * Copy second frame's Ethernet header out of line
373 	 * and adjust for encapsulation headers.  Note that
374 	 * we make room for padding in case there isn't room
375 	 * at the end of first frame.
376 	 */
377 	KASSERT(m2->m_len >= sizeof(eh2), ("no ethernet header!"));
378 	ETHER_HEADER_COPY(&eh2, mtod(m2, caddr_t));
379 	m2 = ieee80211_mbuf_adjust(vap,
380 		ATH_FF_MAX_HDR_PAD + sizeof(struct ether_header),
381 		NULL, m2);
382 	if (m2 == NULL) {
383 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
384 		goto bad;
385 	}
386 
387 	/*
388 	 * Now do tunnel encapsulation.  First, each
389 	 * frame gets a standard encapsulation.
390 	 */
391 	m1 = ieee80211_ff_encap1(vap, m1, &eh1);
392 	if (m1 == NULL)
393 		goto bad;
394 	m2 = ieee80211_ff_encap1(vap, m2, &eh2);
395 	if (m2 == NULL)
396 		goto bad;
397 
398 	/*
399 	 * Pad leading frame to a 4-byte boundary.  If there
400 	 * is space at the end of the first frame, put it
401 	 * there; otherwise prepend to the front of the second
402 	 * frame.  We know doing the second will always work
403 	 * because we reserve space above.  We prefer appending
404 	 * as this typically has better DMA alignment properties.
405 	 */
406 	for (m = m1; m->m_next != NULL; m = m->m_next)
407 		;
408 	pad = roundup2(m1->m_pkthdr.len, 4) - m1->m_pkthdr.len;
409 	if (pad) {
410 		if (M_TRAILINGSPACE(m) < pad) {		/* prepend to second */
411 			m2->m_data -= pad;
412 			m2->m_len += pad;
413 			m2->m_pkthdr.len += pad;
414 		} else {				/* append to first */
415 			m->m_len += pad;
416 			m1->m_pkthdr.len += pad;
417 		}
418 	}
419 
420 	/*
421 	 * Now, stick 'em together and prepend the tunnel headers;
422 	 * first the Atheros tunnel header (all zero for now) and
423 	 * then a special fast frame LLC.
424 	 *
425 	 * XXX optimize by prepending together
426 	 */
427 	m->m_next = m2;			/* NB: last mbuf from above */
428 	m1->m_pkthdr.len += m2->m_pkthdr.len;
429 	M_PREPEND(m1, sizeof(uint32_t)+2, M_NOWAIT);
430 	if (m1 == NULL) {		/* XXX cannot happen */
431 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
432 		    "%s: no space for tunnel header\n", __func__);
433 		vap->iv_stats.is_tx_nobuf++;
434 		return NULL;
435 	}
436 	memset(mtod(m1, void *), 0, sizeof(uint32_t)+2);
437 
438 	M_PREPEND(m1, sizeof(struct llc), M_NOWAIT);
439 	if (m1 == NULL) {		/* XXX cannot happen */
440 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
441 		    "%s: no space for llc header\n", __func__);
442 		vap->iv_stats.is_tx_nobuf++;
443 		return NULL;
444 	}
445 	llc = mtod(m1, struct llc *);
446 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
447 	llc->llc_control = LLC_UI;
448 	llc->llc_snap.org_code[0] = ATH_FF_SNAP_ORGCODE_0;
449 	llc->llc_snap.org_code[1] = ATH_FF_SNAP_ORGCODE_1;
450 	llc->llc_snap.org_code[2] = ATH_FF_SNAP_ORGCODE_2;
451 	llc->llc_snap.ether_type = htons(ATH_FF_ETH_TYPE);
452 
453 	vap->iv_stats.is_ff_encap++;
454 
455 	return m1;
456 bad:
457 	if (m1 != NULL)
458 		m_freem(m1);
459 	if (m2 != NULL)
460 		m_freem(m2);
461 	return NULL;
462 }
463 
464 static void
465 ff_transmit(struct ieee80211_node *ni, struct mbuf *m)
466 {
467 	struct ieee80211vap *vap = ni->ni_vap;
468 	struct ieee80211com *ic = ni->ni_ic;
469 	int error;
470 
471 	IEEE80211_TX_LOCK_ASSERT(vap->iv_ic);
472 
473 	/* encap and xmit */
474 	m = ieee80211_encap(vap, ni, m);
475 	if (m != NULL) {
476 		struct ifnet *ifp = vap->iv_ifp;
477 
478 		error = ieee80211_parent_xmitpkt(ic, m);;
479 		if (error != 0) {
480 			/* NB: IFQ_HANDOFF reclaims mbuf */
481 			ieee80211_free_node(ni);
482 		} else {
483 			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
484 		}
485 	} else
486 		ieee80211_free_node(ni);
487 }
488 
489 /*
490  * Flush frames to device; note we re-use the linked list
491  * the frames were stored on and use the sentinel (unchanged)
492  * which may be non-NULL.
493  */
494 static void
495 ff_flush(struct mbuf *head, struct mbuf *last)
496 {
497 	struct mbuf *m, *next;
498 	struct ieee80211_node *ni;
499 	struct ieee80211vap *vap;
500 
501 	for (m = head; m != last; m = next) {
502 		next = m->m_nextpkt;
503 		m->m_nextpkt = NULL;
504 
505 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
506 		vap = ni->ni_vap;
507 
508 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
509 		    "%s: flush frame, age %u", __func__, M_AGE_GET(m));
510 		vap->iv_stats.is_ff_flush++;
511 
512 		ff_transmit(ni, m);
513 	}
514 }
515 
516 /*
517  * Age frames on the staging queue.
518  *
519  * This is called without the comlock held, but it does all its work
520  * behind the comlock.  Because of this, it's possible that the
521  * staging queue will be serviced between the function which called
522  * it and now; thus simply checking that the queue has work in it
523  * may fail.
524  *
525  * See PR kern/174283 for more details.
526  */
527 void
528 ieee80211_ff_age(struct ieee80211com *ic, struct ieee80211_stageq *sq,
529     int quanta)
530 {
531 	struct mbuf *m, *head;
532 	struct ieee80211_node *ni;
533 
534 #if 0
535 	KASSERT(sq->head != NULL, ("stageq empty"));
536 #endif
537 
538 	IEEE80211_LOCK(ic);
539 	head = sq->head;
540 	while ((m = sq->head) != NULL && M_AGE_GET(m) < quanta) {
541 		int tid = WME_AC_TO_TID(M_WME_GETAC(m));
542 
543 		/* clear staging ref to frame */
544 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
545 		KASSERT(ni->ni_tx_superg[tid] == m, ("staging queue empty"));
546 		ni->ni_tx_superg[tid] = NULL;
547 
548 		sq->head = m->m_nextpkt;
549 		sq->depth--;
550 	}
551 	if (m == NULL)
552 		sq->tail = NULL;
553 	else
554 		M_AGE_SUB(m, quanta);
555 	IEEE80211_UNLOCK(ic);
556 
557 	IEEE80211_TX_LOCK(ic);
558 	ff_flush(head, m);
559 	IEEE80211_TX_UNLOCK(ic);
560 }
561 
562 static void
563 stageq_add(struct ieee80211com *ic, struct ieee80211_stageq *sq, struct mbuf *m)
564 {
565 	int age = ieee80211_ffagemax;
566 
567 	IEEE80211_LOCK_ASSERT(ic);
568 
569 	if (sq->tail != NULL) {
570 		sq->tail->m_nextpkt = m;
571 		age -= M_AGE_GET(sq->head);
572 	} else
573 		sq->head = m;
574 	KASSERT(age >= 0, ("age %d", age));
575 	M_AGE_SET(m, age);
576 	m->m_nextpkt = NULL;
577 	sq->tail = m;
578 	sq->depth++;
579 }
580 
581 static void
582 stageq_remove(struct ieee80211com *ic, struct ieee80211_stageq *sq, struct mbuf *mstaged)
583 {
584 	struct mbuf *m, *mprev;
585 
586 	IEEE80211_LOCK_ASSERT(ic);
587 
588 	mprev = NULL;
589 	for (m = sq->head; m != NULL; m = m->m_nextpkt) {
590 		if (m == mstaged) {
591 			if (mprev == NULL)
592 				sq->head = m->m_nextpkt;
593 			else
594 				mprev->m_nextpkt = m->m_nextpkt;
595 			if (sq->tail == m)
596 				sq->tail = mprev;
597 			sq->depth--;
598 			return;
599 		}
600 		mprev = m;
601 	}
602 	printf("%s: packet not found\n", __func__);
603 }
604 
605 static uint32_t
606 ff_approx_txtime(struct ieee80211_node *ni,
607 	const struct mbuf *m1, const struct mbuf *m2)
608 {
609 	struct ieee80211com *ic = ni->ni_ic;
610 	struct ieee80211vap *vap = ni->ni_vap;
611 	uint32_t framelen;
612 
613 	/*
614 	 * Approximate the frame length to be transmitted. A swag to add
615 	 * the following maximal values to the skb payload:
616 	 *   - 32: 802.11 encap + CRC
617 	 *   - 24: encryption overhead (if wep bit)
618 	 *   - 4 + 6: fast-frame header and padding
619 	 *   - 16: 2 LLC FF tunnel headers
620 	 *   - 14: 1 802.3 FF tunnel header (mbuf already accounts for 2nd)
621 	 */
622 	framelen = m1->m_pkthdr.len + 32 +
623 	    ATH_FF_MAX_HDR_PAD + ATH_FF_MAX_SEP_PAD + ATH_FF_MAX_HDR;
624 	if (vap->iv_flags & IEEE80211_F_PRIVACY)
625 		framelen += 24;
626 	if (m2 != NULL)
627 		framelen += m2->m_pkthdr.len;
628 	return ieee80211_compute_duration(ic->ic_rt, framelen, ni->ni_txrate, 0);
629 }
630 
631 /*
632  * Check if the supplied frame can be partnered with an existing
633  * or pending frame.  Return a reference to any frame that should be
634  * sent on return; otherwise return NULL.
635  */
636 struct mbuf *
637 ieee80211_ff_check(struct ieee80211_node *ni, struct mbuf *m)
638 {
639 	struct ieee80211vap *vap = ni->ni_vap;
640 	struct ieee80211com *ic = ni->ni_ic;
641 	struct ieee80211_superg *sg = ic->ic_superg;
642 	const int pri = M_WME_GETAC(m);
643 	struct ieee80211_stageq *sq;
644 	struct ieee80211_tx_ampdu *tap;
645 	struct mbuf *mstaged;
646 	uint32_t txtime, limit;
647 
648 	IEEE80211_TX_UNLOCK_ASSERT(ic);
649 
650 	/*
651 	 * Check if the supplied frame can be aggregated.
652 	 *
653 	 * NB: we allow EAPOL frames to be aggregated with other ucast traffic.
654 	 *     Do 802.1x EAPOL frames proceed in the clear? Then they couldn't
655 	 *     be aggregated with other types of frames when encryption is on?
656 	 */
657 	IEEE80211_LOCK(ic);
658 	tap = &ni->ni_tx_ampdu[WME_AC_TO_TID(pri)];
659 	mstaged = ni->ni_tx_superg[WME_AC_TO_TID(pri)];
660 	/* XXX NOTE: reusing packet counter state from A-MPDU */
661 	/*
662 	 * XXX NOTE: this means we're double-counting; it should just
663 	 * be done in ieee80211_output.c once for both superg and A-MPDU.
664 	 */
665 	ieee80211_txampdu_count_packet(tap);
666 
667 	/*
668 	 * When not in station mode never aggregate a multicast
669 	 * frame; this insures, for example, that a combined frame
670 	 * does not require multiple encryption keys.
671 	 */
672 	if (vap->iv_opmode != IEEE80211_M_STA &&
673 	    ETHER_IS_MULTICAST(mtod(m, struct ether_header *)->ether_dhost)) {
674 		/* XXX flush staged frame? */
675 		IEEE80211_UNLOCK(ic);
676 		return m;
677 	}
678 	/*
679 	 * If there is no frame to combine with and the pps is
680 	 * too low; then do not attempt to aggregate this frame.
681 	 */
682 	if (mstaged == NULL &&
683 	    ieee80211_txampdu_getpps(tap) < ieee80211_ffppsmin) {
684 		IEEE80211_UNLOCK(ic);
685 		return m;
686 	}
687 	sq = &sg->ff_stageq[pri];
688 	/*
689 	 * Check the txop limit to insure the aggregate fits.
690 	 */
691 	limit = IEEE80211_TXOP_TO_US(
692 		ic->ic_wme.wme_chanParams.cap_wmeParams[pri].wmep_txopLimit);
693 	if (limit != 0 &&
694 	    (txtime = ff_approx_txtime(ni, m, mstaged)) > limit) {
695 		/*
696 		 * Aggregate too long, return to the caller for direct
697 		 * transmission.  In addition, flush any pending frame
698 		 * before sending this one.
699 		 */
700 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
701 		    "%s: txtime %u exceeds txop limit %u\n",
702 		    __func__, txtime, limit);
703 
704 		ni->ni_tx_superg[WME_AC_TO_TID(pri)] = NULL;
705 		if (mstaged != NULL)
706 			stageq_remove(ic, sq, mstaged);
707 		IEEE80211_UNLOCK(ic);
708 
709 		if (mstaged != NULL) {
710 			IEEE80211_TX_LOCK(ic);
711 			IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
712 			    "%s: flush staged frame", __func__);
713 			/* encap and xmit */
714 			ff_transmit(ni, mstaged);
715 			IEEE80211_TX_UNLOCK(ic);
716 		}
717 		return m;		/* NB: original frame */
718 	}
719 	/*
720 	 * An aggregation candidate.  If there's a frame to partner
721 	 * with then combine and return for processing.  Otherwise
722 	 * save this frame and wait for a partner to show up (or
723 	 * the frame to be flushed).  Note that staged frames also
724 	 * hold their node reference.
725 	 */
726 	if (mstaged != NULL) {
727 		ni->ni_tx_superg[WME_AC_TO_TID(pri)] = NULL;
728 		stageq_remove(ic, sq, mstaged);
729 		IEEE80211_UNLOCK(ic);
730 
731 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
732 		    "%s: aggregate fast-frame", __func__);
733 		/*
734 		 * Release the node reference; we only need
735 		 * the one already in mstaged.
736 		 */
737 		KASSERT(mstaged->m_pkthdr.rcvif == (void *)ni,
738 		    ("rcvif %p ni %p", mstaged->m_pkthdr.rcvif, ni));
739 		ieee80211_free_node(ni);
740 
741 		m->m_nextpkt = NULL;
742 		mstaged->m_nextpkt = m;
743 		mstaged->m_flags |= M_FF; /* NB: mark for encap work */
744 	} else {
745 		KASSERT(ni->ni_tx_superg[WME_AC_TO_TID(pri)]== NULL,
746 		    ("ni_tx_superg[]: %p",
747 		    ni->ni_tx_superg[WME_AC_TO_TID(pri)]));
748 		ni->ni_tx_superg[WME_AC_TO_TID(pri)] = m;
749 
750 		stageq_add(ic, sq, m);
751 		IEEE80211_UNLOCK(ic);
752 
753 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
754 		    "%s: stage frame, %u queued", __func__, sq->depth);
755 		/* NB: mstaged is NULL */
756 	}
757 	return mstaged;
758 }
759 
760 void
761 ieee80211_ff_node_init(struct ieee80211_node *ni)
762 {
763 	/*
764 	 * Clean FF state on re-associate.  This handles the case
765 	 * where a station leaves w/o notifying us and then returns
766 	 * before node is reaped for inactivity.
767 	 */
768 	ieee80211_ff_node_cleanup(ni);
769 }
770 
771 void
772 ieee80211_ff_node_cleanup(struct ieee80211_node *ni)
773 {
774 	struct ieee80211com *ic = ni->ni_ic;
775 	struct ieee80211_superg *sg = ic->ic_superg;
776 	struct mbuf *m, *next_m, *head;
777 	int tid;
778 
779 	IEEE80211_LOCK(ic);
780 	head = NULL;
781 	for (tid = 0; tid < WME_NUM_TID; tid++) {
782 		int ac = TID_TO_WME_AC(tid);
783 		/*
784 		 * XXX Initialise the packet counter.
785 		 *
786 		 * This may be double-work for 11n stations;
787 		 * but without it we never setup things.
788 		 */
789 		ieee80211_txampdu_init_pps(&ni->ni_tx_ampdu[tid]);
790 		m = ni->ni_tx_superg[tid];
791 		if (m != NULL) {
792 			ni->ni_tx_superg[tid] = NULL;
793 			stageq_remove(ic, &sg->ff_stageq[ac], m);
794 			m->m_nextpkt = head;
795 			head = m;
796 		}
797 	}
798 	IEEE80211_UNLOCK(ic);
799 
800 	/*
801 	 * Free mbufs, taking care to not dereference the mbuf after
802 	 * we free it (hence grabbing m_nextpkt before we free it.)
803 	 */
804 	m = head;
805 	while (m != NULL) {
806 		next_m = m->m_nextpkt;
807 		m_freem(m);
808 		ieee80211_free_node(ni);
809 		m = next_m;
810 	}
811 }
812 
813 /*
814  * Switch between turbo and non-turbo operating modes.
815  * Use the specified channel flags to locate the new
816  * channel, update 802.11 state, and then call back into
817  * the driver to effect the change.
818  */
819 void
820 ieee80211_dturbo_switch(struct ieee80211vap *vap, int newflags)
821 {
822 	struct ieee80211com *ic = vap->iv_ic;
823 	struct ieee80211_channel *chan;
824 
825 	chan = ieee80211_find_channel(ic, ic->ic_bsschan->ic_freq, newflags);
826 	if (chan == NULL) {		/* XXX should not happen */
827 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
828 		    "%s: no channel with freq %u flags 0x%x\n",
829 		    __func__, ic->ic_bsschan->ic_freq, newflags);
830 		return;
831 	}
832 
833 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
834 	    "%s: %s -> %s (freq %u flags 0x%x)\n", __func__,
835 	    ieee80211_phymode_name[ieee80211_chan2mode(ic->ic_bsschan)],
836 	    ieee80211_phymode_name[ieee80211_chan2mode(chan)],
837 	    chan->ic_freq, chan->ic_flags);
838 
839 	ic->ic_bsschan = chan;
840 	ic->ic_prevchan = ic->ic_curchan;
841 	ic->ic_curchan = chan;
842 	ic->ic_rt = ieee80211_get_ratetable(chan);
843 	ic->ic_set_channel(ic);
844 	ieee80211_radiotap_chan_change(ic);
845 	/* NB: do not need to reset ERP state 'cuz we're in sta mode */
846 }
847 
848 /*
849  * Return the current ``state'' of an Atheros capbility.
850  * If associated in station mode report the negotiated
851  * setting. Otherwise report the current setting.
852  */
853 static int
854 getathcap(struct ieee80211vap *vap, int cap)
855 {
856 	if (vap->iv_opmode == IEEE80211_M_STA &&
857 	    vap->iv_state == IEEE80211_S_RUN)
858 		return IEEE80211_ATH_CAP(vap, vap->iv_bss, cap) != 0;
859 	else
860 		return (vap->iv_flags & cap) != 0;
861 }
862 
863 static int
864 superg_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
865 {
866 	switch (ireq->i_type) {
867 	case IEEE80211_IOC_FF:
868 		ireq->i_val = getathcap(vap, IEEE80211_F_FF);
869 		break;
870 	case IEEE80211_IOC_TURBOP:
871 		ireq->i_val = getathcap(vap, IEEE80211_F_TURBOP);
872 		break;
873 	default:
874 		return ENOSYS;
875 	}
876 	return 0;
877 }
878 IEEE80211_IOCTL_GET(superg, superg_ioctl_get80211);
879 
880 static int
881 superg_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
882 {
883 	switch (ireq->i_type) {
884 	case IEEE80211_IOC_FF:
885 		if (ireq->i_val) {
886 			if ((vap->iv_caps & IEEE80211_C_FF) == 0)
887 				return EOPNOTSUPP;
888 			vap->iv_flags |= IEEE80211_F_FF;
889 		} else
890 			vap->iv_flags &= ~IEEE80211_F_FF;
891 		return ENETRESET;
892 	case IEEE80211_IOC_TURBOP:
893 		if (ireq->i_val) {
894 			if ((vap->iv_caps & IEEE80211_C_TURBOP) == 0)
895 				return EOPNOTSUPP;
896 			vap->iv_flags |= IEEE80211_F_TURBOP;
897 		} else
898 			vap->iv_flags &= ~IEEE80211_F_TURBOP;
899 		return ENETRESET;
900 	default:
901 		return ENOSYS;
902 	}
903 	return 0;
904 }
905 IEEE80211_IOCTL_SET(superg, superg_ioctl_set80211);
906 
907 #endif	/* IEEE80211_SUPPORT_SUPERG */
908