xref: /freebsd/sys/net80211/ieee80211_superg.c (revision 6e660824a82f590542932de52f128db584029893)
1 /*-
2  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD$");
28 
29 #include "opt_wlan.h"
30 
31 #ifdef	IEEE80211_SUPPORT_SUPERG
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/mbuf.h>
36 #include <sys/kernel.h>
37 #include <sys/endian.h>
38 
39 #include <sys/socket.h>
40 
41 #include <net/bpf.h>
42 #include <net/ethernet.h>
43 #include <net/if.h>
44 #include <net/if_llc.h>
45 #include <net/if_media.h>
46 
47 #include <net80211/ieee80211_var.h>
48 #include <net80211/ieee80211_input.h>
49 #include <net80211/ieee80211_phy.h>
50 #include <net80211/ieee80211_superg.h>
51 
52 /*
53  * Atheros fast-frame encapsulation format.
54  * FF max payload:
55  * 802.2 + FFHDR + HPAD + 802.3 + 802.2 + 1500 + SPAD + 802.3 + 802.2 + 1500:
56  *   8   +   4   +  4   +   14  +   8   + 1500 +  6   +   14  +   8   + 1500
57  * = 3066
58  */
59 /* fast frame header is 32-bits */
60 #define	ATH_FF_PROTO	0x0000003f	/* protocol */
61 #define	ATH_FF_PROTO_S	0
62 #define	ATH_FF_FTYPE	0x000000c0	/* frame type */
63 #define	ATH_FF_FTYPE_S	6
64 #define	ATH_FF_HLEN32	0x00000300	/* optional hdr length */
65 #define	ATH_FF_HLEN32_S	8
66 #define	ATH_FF_SEQNUM	0x001ffc00	/* sequence number */
67 #define	ATH_FF_SEQNUM_S	10
68 #define	ATH_FF_OFFSET	0xffe00000	/* offset to 2nd payload */
69 #define	ATH_FF_OFFSET_S	21
70 
71 #define	ATH_FF_MAX_HDR_PAD	4
72 #define	ATH_FF_MAX_SEP_PAD	6
73 #define	ATH_FF_MAX_HDR		30
74 
75 #define	ATH_FF_PROTO_L2TUNNEL	0	/* L2 tunnel protocol */
76 #define	ATH_FF_ETH_TYPE		0x88bd	/* Ether type for encapsulated frames */
77 #define	ATH_FF_SNAP_ORGCODE_0	0x00
78 #define	ATH_FF_SNAP_ORGCODE_1	0x03
79 #define	ATH_FF_SNAP_ORGCODE_2	0x7f
80 
81 #define	ATH_FF_TXQMIN	2		/* min txq depth for staging */
82 #define	ATH_FF_TXQMAX	50		/* maximum # of queued frames allowed */
83 #define	ATH_FF_STAGEMAX	5		/* max waiting period for staged frame*/
84 
85 #define	ETHER_HEADER_COPY(dst, src) \
86 	memcpy(dst, src, sizeof(struct ether_header))
87 
88 static	int ieee80211_ffppsmin = 2;	/* pps threshold for ff aggregation */
89 SYSCTL_INT(_net_wlan, OID_AUTO, ffppsmin, CTLTYPE_INT | CTLFLAG_RW,
90 	&ieee80211_ffppsmin, 0, "min packet rate before fast-frame staging");
91 static	int ieee80211_ffagemax = -1;	/* max time frames held on stage q */
92 SYSCTL_PROC(_net_wlan, OID_AUTO, ffagemax, CTLTYPE_INT | CTLFLAG_RW,
93 	&ieee80211_ffagemax, 0, ieee80211_sysctl_msecs_ticks, "I",
94 	"max hold time for fast-frame staging (ms)");
95 
96 void
97 ieee80211_superg_attach(struct ieee80211com *ic)
98 {
99 	struct ieee80211_superg *sg;
100 
101 	if (ic->ic_caps & IEEE80211_C_FF) {
102 		sg = (struct ieee80211_superg *) malloc(
103 		     sizeof(struct ieee80211_superg), M_80211_VAP,
104 		     M_NOWAIT | M_ZERO);
105 		if (sg == NULL) {
106 			printf("%s: cannot allocate SuperG state block\n",
107 			    __func__);
108 			return;
109 		}
110 		ic->ic_superg = sg;
111 	}
112 	ieee80211_ffagemax = msecs_to_ticks(150);
113 }
114 
115 void
116 ieee80211_superg_detach(struct ieee80211com *ic)
117 {
118 	if (ic->ic_superg != NULL) {
119 		free(ic->ic_superg, M_80211_VAP);
120 		ic->ic_superg = NULL;
121 	}
122 }
123 
124 void
125 ieee80211_superg_vattach(struct ieee80211vap *vap)
126 {
127 	struct ieee80211com *ic = vap->iv_ic;
128 
129 	if (ic->ic_superg == NULL)	/* NB: can't do fast-frames w/o state */
130 		vap->iv_caps &= ~IEEE80211_C_FF;
131 	if (vap->iv_caps & IEEE80211_C_FF)
132 		vap->iv_flags |= IEEE80211_F_FF;
133 	/* NB: we only implement sta mode */
134 	if (vap->iv_opmode == IEEE80211_M_STA &&
135 	    (vap->iv_caps & IEEE80211_C_TURBOP))
136 		vap->iv_flags |= IEEE80211_F_TURBOP;
137 }
138 
139 void
140 ieee80211_superg_vdetach(struct ieee80211vap *vap)
141 {
142 }
143 
144 #define	ATH_OUI_BYTES		0x00, 0x03, 0x7f
145 /*
146  * Add a WME information element to a frame.
147  */
148 uint8_t *
149 ieee80211_add_ath(uint8_t *frm, uint8_t caps, ieee80211_keyix defkeyix)
150 {
151 	static const struct ieee80211_ath_ie info = {
152 		.ath_id		= IEEE80211_ELEMID_VENDOR,
153 		.ath_len	= sizeof(struct ieee80211_ath_ie) - 2,
154 		.ath_oui	= { ATH_OUI_BYTES },
155 		.ath_oui_type	= ATH_OUI_TYPE,
156 		.ath_oui_subtype= ATH_OUI_SUBTYPE,
157 		.ath_version	= ATH_OUI_VERSION,
158 	};
159 	struct ieee80211_ath_ie *ath = (struct ieee80211_ath_ie *) frm;
160 
161 	memcpy(frm, &info, sizeof(info));
162 	ath->ath_capability = caps;
163 	if (defkeyix != IEEE80211_KEYIX_NONE) {
164 		ath->ath_defkeyix[0] = (defkeyix & 0xff);
165 		ath->ath_defkeyix[1] = ((defkeyix >> 8) & 0xff);
166 	} else {
167 		ath->ath_defkeyix[0] = 0xff;
168 		ath->ath_defkeyix[1] = 0x7f;
169 	}
170 	return frm + sizeof(info);
171 }
172 #undef ATH_OUI_BYTES
173 
174 uint8_t *
175 ieee80211_add_athcaps(uint8_t *frm, const struct ieee80211_node *bss)
176 {
177 	const struct ieee80211vap *vap = bss->ni_vap;
178 
179 	return ieee80211_add_ath(frm,
180 	    vap->iv_flags & IEEE80211_F_ATHEROS,
181 	    ((vap->iv_flags & IEEE80211_F_WPA) == 0 &&
182 	    bss->ni_authmode != IEEE80211_AUTH_8021X) ?
183 	    vap->iv_def_txkey : IEEE80211_KEYIX_NONE);
184 }
185 
186 void
187 ieee80211_parse_ath(struct ieee80211_node *ni, uint8_t *ie)
188 {
189 	const struct ieee80211_ath_ie *ath =
190 		(const struct ieee80211_ath_ie *) ie;
191 
192 	ni->ni_ath_flags = ath->ath_capability;
193 	ni->ni_ath_defkeyix = LE_READ_2(&ath->ath_defkeyix);
194 }
195 
196 int
197 ieee80211_parse_athparams(struct ieee80211_node *ni, uint8_t *frm,
198 	const struct ieee80211_frame *wh)
199 {
200 	struct ieee80211vap *vap = ni->ni_vap;
201 	const struct ieee80211_ath_ie *ath;
202 	u_int len = frm[1];
203 	int capschanged;
204 	uint16_t defkeyix;
205 
206 	if (len < sizeof(struct ieee80211_ath_ie)-2) {
207 		IEEE80211_DISCARD_IE(vap,
208 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_SUPERG,
209 		    wh, "Atheros", "too short, len %u", len);
210 		return -1;
211 	}
212 	ath = (const struct ieee80211_ath_ie *)frm;
213 	capschanged = (ni->ni_ath_flags != ath->ath_capability);
214 	defkeyix = LE_READ_2(ath->ath_defkeyix);
215 	if (capschanged || defkeyix != ni->ni_ath_defkeyix) {
216 		ni->ni_ath_flags = ath->ath_capability;
217 		ni->ni_ath_defkeyix = defkeyix;
218 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
219 		    "ath ie change: new caps 0x%x defkeyix 0x%x",
220 		    ni->ni_ath_flags, ni->ni_ath_defkeyix);
221 	}
222 	if (IEEE80211_ATH_CAP(vap, ni, ATHEROS_CAP_TURBO_PRIME)) {
223 		uint16_t curflags, newflags;
224 
225 		/*
226 		 * Check for turbo mode switch.  Calculate flags
227 		 * for the new mode and effect the switch.
228 		 */
229 		newflags = curflags = vap->iv_ic->ic_bsschan->ic_flags;
230 		/* NB: BOOST is not in ic_flags, so get it from the ie */
231 		if (ath->ath_capability & ATHEROS_CAP_BOOST)
232 			newflags |= IEEE80211_CHAN_TURBO;
233 		else
234 			newflags &= ~IEEE80211_CHAN_TURBO;
235 		if (newflags != curflags)
236 			ieee80211_dturbo_switch(vap, newflags);
237 	}
238 	return capschanged;
239 }
240 
241 /*
242  * Decap the encapsulated frame pair and dispatch the first
243  * for delivery.  The second frame is returned for delivery
244  * via the normal path.
245  */
246 struct mbuf *
247 ieee80211_ff_decap(struct ieee80211_node *ni, struct mbuf *m)
248 {
249 #define	FF_LLC_SIZE	(sizeof(struct ether_header) + sizeof(struct llc))
250 #define	MS(x,f)	(((x) & f) >> f##_S)
251 	struct ieee80211vap *vap = ni->ni_vap;
252 	struct llc *llc;
253 	uint32_t ath;
254 	struct mbuf *n;
255 	int framelen;
256 
257 	/* NB: we assume caller does this check for us */
258 	KASSERT(IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF),
259 	    ("ff not negotiated"));
260 	/*
261 	 * Check for fast-frame tunnel encapsulation.
262 	 */
263 	if (m->m_pkthdr.len < 3*FF_LLC_SIZE)
264 		return m;
265 	if (m->m_len < FF_LLC_SIZE &&
266 	    (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
267 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
268 		    ni->ni_macaddr, "fast-frame",
269 		    "%s", "m_pullup(llc) failed");
270 		vap->iv_stats.is_rx_tooshort++;
271 		return NULL;
272 	}
273 	llc = (struct llc *)(mtod(m, uint8_t *) +
274 	    sizeof(struct ether_header));
275 	if (llc->llc_snap.ether_type != htons(ATH_FF_ETH_TYPE))
276 		return m;
277 	m_adj(m, FF_LLC_SIZE);
278 	m_copydata(m, 0, sizeof(uint32_t), (caddr_t) &ath);
279 	if (MS(ath, ATH_FF_PROTO) != ATH_FF_PROTO_L2TUNNEL) {
280 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
281 		    ni->ni_macaddr, "fast-frame",
282 		    "unsupport tunnel protocol, header 0x%x", ath);
283 		vap->iv_stats.is_ff_badhdr++;
284 		m_freem(m);
285 		return NULL;
286 	}
287 	/* NB: skip header and alignment padding */
288 	m_adj(m, roundup(sizeof(uint32_t) - 2, 4) + 2);
289 
290 	vap->iv_stats.is_ff_decap++;
291 
292 	/*
293 	 * Decap the first frame, bust it apart from the
294 	 * second and deliver; then decap the second frame
295 	 * and return it to the caller for normal delivery.
296 	 */
297 	m = ieee80211_decap1(m, &framelen);
298 	if (m == NULL) {
299 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
300 		    ni->ni_macaddr, "fast-frame", "%s", "first decap failed");
301 		vap->iv_stats.is_ff_tooshort++;
302 		return NULL;
303 	}
304 	n = m_split(m, framelen, M_NOWAIT);
305 	if (n == NULL) {
306 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
307 		    ni->ni_macaddr, "fast-frame",
308 		    "%s", "unable to split encapsulated frames");
309 		vap->iv_stats.is_ff_split++;
310 		m_freem(m);			/* NB: must reclaim */
311 		return NULL;
312 	}
313 	/* XXX not right for WDS */
314 	vap->iv_deliver_data(vap, ni, m);	/* 1st of pair */
315 
316 	/*
317 	 * Decap second frame.
318 	 */
319 	m_adj(n, roundup2(framelen, 4) - framelen);	/* padding */
320 	n = ieee80211_decap1(n, &framelen);
321 	if (n == NULL) {
322 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
323 		    ni->ni_macaddr, "fast-frame", "%s", "second decap failed");
324 		vap->iv_stats.is_ff_tooshort++;
325 	}
326 	/* XXX verify framelen against mbuf contents */
327 	return n;				/* 2nd delivered by caller */
328 #undef MS
329 #undef FF_LLC_SIZE
330 }
331 
332 /*
333  * Do Ethernet-LLC encapsulation for each payload in a fast frame
334  * tunnel encapsulation.  The frame is assumed to have an Ethernet
335  * header at the front that must be stripped before prepending the
336  * LLC followed by the Ethernet header passed in (with an Ethernet
337  * type that specifies the payload size).
338  */
339 static struct mbuf *
340 ff_encap1(struct ieee80211vap *vap, struct mbuf *m,
341 	const struct ether_header *eh)
342 {
343 	struct llc *llc;
344 	uint16_t payload;
345 
346 	/* XXX optimize by combining m_adj+M_PREPEND */
347 	m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
348 	llc = mtod(m, struct llc *);
349 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
350 	llc->llc_control = LLC_UI;
351 	llc->llc_snap.org_code[0] = 0;
352 	llc->llc_snap.org_code[1] = 0;
353 	llc->llc_snap.org_code[2] = 0;
354 	llc->llc_snap.ether_type = eh->ether_type;
355 	payload = m->m_pkthdr.len;		/* NB: w/o Ethernet header */
356 
357 	M_PREPEND(m, sizeof(struct ether_header), M_NOWAIT);
358 	if (m == NULL) {		/* XXX cannot happen */
359 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
360 			"%s: no space for ether_header\n", __func__);
361 		vap->iv_stats.is_tx_nobuf++;
362 		return NULL;
363 	}
364 	ETHER_HEADER_COPY(mtod(m, void *), eh);
365 	mtod(m, struct ether_header *)->ether_type = htons(payload);
366 	return m;
367 }
368 
369 /*
370  * Fast frame encapsulation.  There must be two packets
371  * chained with m_nextpkt.  We do header adjustment for
372  * each, add the tunnel encapsulation, and then concatenate
373  * the mbuf chains to form a single frame for transmission.
374  */
375 struct mbuf *
376 ieee80211_ff_encap(struct ieee80211vap *vap, struct mbuf *m1, int hdrspace,
377 	struct ieee80211_key *key)
378 {
379 	struct mbuf *m2;
380 	struct ether_header eh1, eh2;
381 	struct llc *llc;
382 	struct mbuf *m;
383 	int pad;
384 
385 	m2 = m1->m_nextpkt;
386 	if (m2 == NULL) {
387 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
388 		    "%s: only one frame\n", __func__);
389 		goto bad;
390 	}
391 	m1->m_nextpkt = NULL;
392 	/*
393 	 * Include fast frame headers in adjusting header layout.
394 	 */
395 	KASSERT(m1->m_len >= sizeof(eh1), ("no ethernet header!"));
396 	ETHER_HEADER_COPY(&eh1, mtod(m1, caddr_t));
397 	m1 = ieee80211_mbuf_adjust(vap,
398 		hdrspace + sizeof(struct llc) + sizeof(uint32_t) + 2 +
399 		    sizeof(struct ether_header),
400 		key, m1);
401 	if (m1 == NULL) {
402 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
403 		m_freem(m2);
404 		goto bad;
405 	}
406 
407 	/*
408 	 * Copy second frame's Ethernet header out of line
409 	 * and adjust for encapsulation headers.  Note that
410 	 * we make room for padding in case there isn't room
411 	 * at the end of first frame.
412 	 */
413 	KASSERT(m2->m_len >= sizeof(eh2), ("no ethernet header!"));
414 	ETHER_HEADER_COPY(&eh2, mtod(m2, caddr_t));
415 	m2 = ieee80211_mbuf_adjust(vap,
416 		ATH_FF_MAX_HDR_PAD + sizeof(struct ether_header),
417 		NULL, m2);
418 	if (m2 == NULL) {
419 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
420 		goto bad;
421 	}
422 
423 	/*
424 	 * Now do tunnel encapsulation.  First, each
425 	 * frame gets a standard encapsulation.
426 	 */
427 	m1 = ff_encap1(vap, m1, &eh1);
428 	if (m1 == NULL)
429 		goto bad;
430 	m2 = ff_encap1(vap, m2, &eh2);
431 	if (m2 == NULL)
432 		goto bad;
433 
434 	/*
435 	 * Pad leading frame to a 4-byte boundary.  If there
436 	 * is space at the end of the first frame, put it
437 	 * there; otherwise prepend to the front of the second
438 	 * frame.  We know doing the second will always work
439 	 * because we reserve space above.  We prefer appending
440 	 * as this typically has better DMA alignment properties.
441 	 */
442 	for (m = m1; m->m_next != NULL; m = m->m_next)
443 		;
444 	pad = roundup2(m1->m_pkthdr.len, 4) - m1->m_pkthdr.len;
445 	if (pad) {
446 		if (M_TRAILINGSPACE(m) < pad) {		/* prepend to second */
447 			m2->m_data -= pad;
448 			m2->m_len += pad;
449 			m2->m_pkthdr.len += pad;
450 		} else {				/* append to first */
451 			m->m_len += pad;
452 			m1->m_pkthdr.len += pad;
453 		}
454 	}
455 
456 	/*
457 	 * Now, stick 'em together and prepend the tunnel headers;
458 	 * first the Atheros tunnel header (all zero for now) and
459 	 * then a special fast frame LLC.
460 	 *
461 	 * XXX optimize by prepending together
462 	 */
463 	m->m_next = m2;			/* NB: last mbuf from above */
464 	m1->m_pkthdr.len += m2->m_pkthdr.len;
465 	M_PREPEND(m1, sizeof(uint32_t)+2, M_NOWAIT);
466 	if (m1 == NULL) {		/* XXX cannot happen */
467 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
468 		    "%s: no space for tunnel header\n", __func__);
469 		vap->iv_stats.is_tx_nobuf++;
470 		return NULL;
471 	}
472 	memset(mtod(m1, void *), 0, sizeof(uint32_t)+2);
473 
474 	M_PREPEND(m1, sizeof(struct llc), M_NOWAIT);
475 	if (m1 == NULL) {		/* XXX cannot happen */
476 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
477 		    "%s: no space for llc header\n", __func__);
478 		vap->iv_stats.is_tx_nobuf++;
479 		return NULL;
480 	}
481 	llc = mtod(m1, struct llc *);
482 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
483 	llc->llc_control = LLC_UI;
484 	llc->llc_snap.org_code[0] = ATH_FF_SNAP_ORGCODE_0;
485 	llc->llc_snap.org_code[1] = ATH_FF_SNAP_ORGCODE_1;
486 	llc->llc_snap.org_code[2] = ATH_FF_SNAP_ORGCODE_2;
487 	llc->llc_snap.ether_type = htons(ATH_FF_ETH_TYPE);
488 
489 	vap->iv_stats.is_ff_encap++;
490 
491 	return m1;
492 bad:
493 	if (m1 != NULL)
494 		m_freem(m1);
495 	if (m2 != NULL)
496 		m_freem(m2);
497 	return NULL;
498 }
499 
500 static void
501 ff_transmit(struct ieee80211_node *ni, struct mbuf *m)
502 {
503 	struct ieee80211vap *vap = ni->ni_vap;
504 	struct ieee80211com *ic = ni->ni_ic;
505 	int error;
506 
507 	IEEE80211_TX_LOCK_ASSERT(vap->iv_ic);
508 
509 	/* encap and xmit */
510 	m = ieee80211_encap(vap, ni, m);
511 	if (m != NULL) {
512 		struct ifnet *ifp = vap->iv_ifp;
513 
514 		error = ieee80211_parent_transmit(ic, m);;
515 		if (error != 0) {
516 			/* NB: IFQ_HANDOFF reclaims mbuf */
517 			ieee80211_free_node(ni);
518 		} else {
519 			ifp->if_opackets++;
520 		}
521 	} else
522 		ieee80211_free_node(ni);
523 }
524 
525 /*
526  * Flush frames to device; note we re-use the linked list
527  * the frames were stored on and use the sentinel (unchanged)
528  * which may be non-NULL.
529  */
530 static void
531 ff_flush(struct mbuf *head, struct mbuf *last)
532 {
533 	struct mbuf *m, *next;
534 	struct ieee80211_node *ni;
535 	struct ieee80211vap *vap;
536 
537 	for (m = head; m != last; m = next) {
538 		next = m->m_nextpkt;
539 		m->m_nextpkt = NULL;
540 
541 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
542 		vap = ni->ni_vap;
543 
544 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
545 		    "%s: flush frame, age %u", __func__, M_AGE_GET(m));
546 		vap->iv_stats.is_ff_flush++;
547 
548 		ff_transmit(ni, m);
549 	}
550 }
551 
552 /*
553  * Age frames on the staging queue.
554  *
555  * This is called without the comlock held, but it does all its work
556  * behind the comlock.  Because of this, it's possible that the
557  * staging queue will be serviced between the function which called
558  * it and now; thus simply checking that the queue has work in it
559  * may fail.
560  *
561  * See PR kern/174283 for more details.
562  */
563 void
564 ieee80211_ff_age(struct ieee80211com *ic, struct ieee80211_stageq *sq,
565     int quanta)
566 {
567 	struct mbuf *m, *head;
568 	struct ieee80211_node *ni;
569 	struct ieee80211_tx_ampdu *tap;
570 
571 #if 0
572 	KASSERT(sq->head != NULL, ("stageq empty"));
573 #endif
574 
575 	IEEE80211_LOCK(ic);
576 	head = sq->head;
577 	while ((m = sq->head) != NULL && M_AGE_GET(m) < quanta) {
578 		int tid = WME_AC_TO_TID(M_WME_GETAC(m));
579 
580 		/* clear tap ref to frame */
581 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
582 		tap = &ni->ni_tx_ampdu[tid];
583 		KASSERT(tap->txa_private == m, ("staging queue empty"));
584 		tap->txa_private = NULL;
585 
586 		sq->head = m->m_nextpkt;
587 		sq->depth--;
588 	}
589 	if (m == NULL)
590 		sq->tail = NULL;
591 	else
592 		M_AGE_SUB(m, quanta);
593 	IEEE80211_UNLOCK(ic);
594 
595 	IEEE80211_TX_LOCK(ic);
596 	ff_flush(head, m);
597 	IEEE80211_TX_UNLOCK(ic);
598 }
599 
600 static void
601 stageq_add(struct ieee80211com *ic, struct ieee80211_stageq *sq, struct mbuf *m)
602 {
603 	int age = ieee80211_ffagemax;
604 
605 	IEEE80211_LOCK_ASSERT(ic);
606 
607 	if (sq->tail != NULL) {
608 		sq->tail->m_nextpkt = m;
609 		age -= M_AGE_GET(sq->head);
610 	} else
611 		sq->head = m;
612 	KASSERT(age >= 0, ("age %d", age));
613 	M_AGE_SET(m, age);
614 	m->m_nextpkt = NULL;
615 	sq->tail = m;
616 	sq->depth++;
617 }
618 
619 static void
620 stageq_remove(struct ieee80211com *ic, struct ieee80211_stageq *sq, struct mbuf *mstaged)
621 {
622 	struct mbuf *m, *mprev;
623 
624 	IEEE80211_LOCK_ASSERT(ic);
625 
626 	mprev = NULL;
627 	for (m = sq->head; m != NULL; m = m->m_nextpkt) {
628 		if (m == mstaged) {
629 			if (mprev == NULL)
630 				sq->head = m->m_nextpkt;
631 			else
632 				mprev->m_nextpkt = m->m_nextpkt;
633 			if (sq->tail == m)
634 				sq->tail = mprev;
635 			sq->depth--;
636 			return;
637 		}
638 		mprev = m;
639 	}
640 	printf("%s: packet not found\n", __func__);
641 }
642 
643 static uint32_t
644 ff_approx_txtime(struct ieee80211_node *ni,
645 	const struct mbuf *m1, const struct mbuf *m2)
646 {
647 	struct ieee80211com *ic = ni->ni_ic;
648 	struct ieee80211vap *vap = ni->ni_vap;
649 	uint32_t framelen;
650 
651 	/*
652 	 * Approximate the frame length to be transmitted. A swag to add
653 	 * the following maximal values to the skb payload:
654 	 *   - 32: 802.11 encap + CRC
655 	 *   - 24: encryption overhead (if wep bit)
656 	 *   - 4 + 6: fast-frame header and padding
657 	 *   - 16: 2 LLC FF tunnel headers
658 	 *   - 14: 1 802.3 FF tunnel header (mbuf already accounts for 2nd)
659 	 */
660 	framelen = m1->m_pkthdr.len + 32 +
661 	    ATH_FF_MAX_HDR_PAD + ATH_FF_MAX_SEP_PAD + ATH_FF_MAX_HDR;
662 	if (vap->iv_flags & IEEE80211_F_PRIVACY)
663 		framelen += 24;
664 	if (m2 != NULL)
665 		framelen += m2->m_pkthdr.len;
666 	return ieee80211_compute_duration(ic->ic_rt, framelen, ni->ni_txrate, 0);
667 }
668 
669 /*
670  * Check if the supplied frame can be partnered with an existing
671  * or pending frame.  Return a reference to any frame that should be
672  * sent on return; otherwise return NULL.
673  */
674 struct mbuf *
675 ieee80211_ff_check(struct ieee80211_node *ni, struct mbuf *m)
676 {
677 	struct ieee80211vap *vap = ni->ni_vap;
678 	struct ieee80211com *ic = ni->ni_ic;
679 	struct ieee80211_superg *sg = ic->ic_superg;
680 	const int pri = M_WME_GETAC(m);
681 	struct ieee80211_stageq *sq;
682 	struct ieee80211_tx_ampdu *tap;
683 	struct mbuf *mstaged;
684 	uint32_t txtime, limit;
685 
686 	IEEE80211_TX_UNLOCK_ASSERT(ic);
687 
688 	/*
689 	 * Check if the supplied frame can be aggregated.
690 	 *
691 	 * NB: we allow EAPOL frames to be aggregated with other ucast traffic.
692 	 *     Do 802.1x EAPOL frames proceed in the clear? Then they couldn't
693 	 *     be aggregated with other types of frames when encryption is on?
694 	 */
695 	IEEE80211_LOCK(ic);
696 	tap = &ni->ni_tx_ampdu[WME_AC_TO_TID(pri)];
697 	mstaged = tap->txa_private;		/* NB: we reuse AMPDU state */
698 	ieee80211_txampdu_count_packet(tap);
699 
700 	/*
701 	 * When not in station mode never aggregate a multicast
702 	 * frame; this insures, for example, that a combined frame
703 	 * does not require multiple encryption keys.
704 	 */
705 	if (vap->iv_opmode != IEEE80211_M_STA &&
706 	    ETHER_IS_MULTICAST(mtod(m, struct ether_header *)->ether_dhost)) {
707 		/* XXX flush staged frame? */
708 		IEEE80211_UNLOCK(ic);
709 		return m;
710 	}
711 	/*
712 	 * If there is no frame to combine with and the pps is
713 	 * too low; then do not attempt to aggregate this frame.
714 	 */
715 	if (mstaged == NULL &&
716 	    ieee80211_txampdu_getpps(tap) < ieee80211_ffppsmin) {
717 		IEEE80211_UNLOCK(ic);
718 		return m;
719 	}
720 	sq = &sg->ff_stageq[pri];
721 	/*
722 	 * Check the txop limit to insure the aggregate fits.
723 	 */
724 	limit = IEEE80211_TXOP_TO_US(
725 		ic->ic_wme.wme_chanParams.cap_wmeParams[pri].wmep_txopLimit);
726 	if (limit != 0 &&
727 	    (txtime = ff_approx_txtime(ni, m, mstaged)) > limit) {
728 		/*
729 		 * Aggregate too long, return to the caller for direct
730 		 * transmission.  In addition, flush any pending frame
731 		 * before sending this one.
732 		 */
733 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
734 		    "%s: txtime %u exceeds txop limit %u\n",
735 		    __func__, txtime, limit);
736 
737 		tap->txa_private = NULL;
738 		if (mstaged != NULL)
739 			stageq_remove(ic, sq, mstaged);
740 		IEEE80211_UNLOCK(ic);
741 
742 		if (mstaged != NULL) {
743 			IEEE80211_TX_LOCK(ic);
744 			IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
745 			    "%s: flush staged frame", __func__);
746 			/* encap and xmit */
747 			ff_transmit(ni, mstaged);
748 			IEEE80211_TX_UNLOCK(ic);
749 		}
750 		return m;		/* NB: original frame */
751 	}
752 	/*
753 	 * An aggregation candidate.  If there's a frame to partner
754 	 * with then combine and return for processing.  Otherwise
755 	 * save this frame and wait for a partner to show up (or
756 	 * the frame to be flushed).  Note that staged frames also
757 	 * hold their node reference.
758 	 */
759 	if (mstaged != NULL) {
760 		tap->txa_private = NULL;
761 		stageq_remove(ic, sq, mstaged);
762 		IEEE80211_UNLOCK(ic);
763 
764 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
765 		    "%s: aggregate fast-frame", __func__);
766 		/*
767 		 * Release the node reference; we only need
768 		 * the one already in mstaged.
769 		 */
770 		KASSERT(mstaged->m_pkthdr.rcvif == (void *)ni,
771 		    ("rcvif %p ni %p", mstaged->m_pkthdr.rcvif, ni));
772 		ieee80211_free_node(ni);
773 
774 		m->m_nextpkt = NULL;
775 		mstaged->m_nextpkt = m;
776 		mstaged->m_flags |= M_FF; /* NB: mark for encap work */
777 	} else {
778 		KASSERT(tap->txa_private == NULL,
779 		    ("txa_private %p", tap->txa_private));
780 		tap->txa_private = m;
781 
782 		stageq_add(ic, sq, m);
783 		IEEE80211_UNLOCK(ic);
784 
785 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
786 		    "%s: stage frame, %u queued", __func__, sq->depth);
787 		/* NB: mstaged is NULL */
788 	}
789 	return mstaged;
790 }
791 
792 void
793 ieee80211_ff_node_init(struct ieee80211_node *ni)
794 {
795 	/*
796 	 * Clean FF state on re-associate.  This handles the case
797 	 * where a station leaves w/o notifying us and then returns
798 	 * before node is reaped for inactivity.
799 	 */
800 	ieee80211_ff_node_cleanup(ni);
801 }
802 
803 void
804 ieee80211_ff_node_cleanup(struct ieee80211_node *ni)
805 {
806 	struct ieee80211com *ic = ni->ni_ic;
807 	struct ieee80211_superg *sg = ic->ic_superg;
808 	struct ieee80211_tx_ampdu *tap;
809 	struct mbuf *m, *next_m, *head;
810 	int tid;
811 
812 	IEEE80211_LOCK(ic);
813 	head = NULL;
814 	for (tid = 0; tid < WME_NUM_TID; tid++) {
815 		int ac = TID_TO_WME_AC(tid);
816 
817 		tap = &ni->ni_tx_ampdu[tid];
818 		m = tap->txa_private;
819 		if (m != NULL) {
820 			tap->txa_private = NULL;
821 			stageq_remove(ic, &sg->ff_stageq[ac], m);
822 			m->m_nextpkt = head;
823 			head = m;
824 		}
825 	}
826 	IEEE80211_UNLOCK(ic);
827 
828 	/*
829 	 * Free mbufs, taking care to not dereference the mbuf after
830 	 * we free it (hence grabbing m_nextpkt before we free it.)
831 	 */
832 	m = head;
833 	while (m != NULL) {
834 		next_m = m->m_nextpkt;
835 		m_freem(m);
836 		ieee80211_free_node(ni);
837 		m = next_m;
838 	}
839 }
840 
841 /*
842  * Switch between turbo and non-turbo operating modes.
843  * Use the specified channel flags to locate the new
844  * channel, update 802.11 state, and then call back into
845  * the driver to effect the change.
846  */
847 void
848 ieee80211_dturbo_switch(struct ieee80211vap *vap, int newflags)
849 {
850 	struct ieee80211com *ic = vap->iv_ic;
851 	struct ieee80211_channel *chan;
852 
853 	chan = ieee80211_find_channel(ic, ic->ic_bsschan->ic_freq, newflags);
854 	if (chan == NULL) {		/* XXX should not happen */
855 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
856 		    "%s: no channel with freq %u flags 0x%x\n",
857 		    __func__, ic->ic_bsschan->ic_freq, newflags);
858 		return;
859 	}
860 
861 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
862 	    "%s: %s -> %s (freq %u flags 0x%x)\n", __func__,
863 	    ieee80211_phymode_name[ieee80211_chan2mode(ic->ic_bsschan)],
864 	    ieee80211_phymode_name[ieee80211_chan2mode(chan)],
865 	    chan->ic_freq, chan->ic_flags);
866 
867 	ic->ic_bsschan = chan;
868 	ic->ic_prevchan = ic->ic_curchan;
869 	ic->ic_curchan = chan;
870 	ic->ic_rt = ieee80211_get_ratetable(chan);
871 	ic->ic_set_channel(ic);
872 	ieee80211_radiotap_chan_change(ic);
873 	/* NB: do not need to reset ERP state 'cuz we're in sta mode */
874 }
875 
876 /*
877  * Return the current ``state'' of an Atheros capbility.
878  * If associated in station mode report the negotiated
879  * setting. Otherwise report the current setting.
880  */
881 static int
882 getathcap(struct ieee80211vap *vap, int cap)
883 {
884 	if (vap->iv_opmode == IEEE80211_M_STA &&
885 	    vap->iv_state == IEEE80211_S_RUN)
886 		return IEEE80211_ATH_CAP(vap, vap->iv_bss, cap) != 0;
887 	else
888 		return (vap->iv_flags & cap) != 0;
889 }
890 
891 static int
892 superg_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
893 {
894 	switch (ireq->i_type) {
895 	case IEEE80211_IOC_FF:
896 		ireq->i_val = getathcap(vap, IEEE80211_F_FF);
897 		break;
898 	case IEEE80211_IOC_TURBOP:
899 		ireq->i_val = getathcap(vap, IEEE80211_F_TURBOP);
900 		break;
901 	default:
902 		return ENOSYS;
903 	}
904 	return 0;
905 }
906 IEEE80211_IOCTL_GET(superg, superg_ioctl_get80211);
907 
908 static int
909 superg_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
910 {
911 	switch (ireq->i_type) {
912 	case IEEE80211_IOC_FF:
913 		if (ireq->i_val) {
914 			if ((vap->iv_caps & IEEE80211_C_FF) == 0)
915 				return EOPNOTSUPP;
916 			vap->iv_flags |= IEEE80211_F_FF;
917 		} else
918 			vap->iv_flags &= ~IEEE80211_F_FF;
919 		return ENETRESET;
920 	case IEEE80211_IOC_TURBOP:
921 		if (ireq->i_val) {
922 			if ((vap->iv_caps & IEEE80211_C_TURBOP) == 0)
923 				return EOPNOTSUPP;
924 			vap->iv_flags |= IEEE80211_F_TURBOP;
925 		} else
926 			vap->iv_flags &= ~IEEE80211_F_TURBOP;
927 		return ENETRESET;
928 	default:
929 		return ENOSYS;
930 	}
931 	return 0;
932 }
933 IEEE80211_IOCTL_SET(superg, superg_ioctl_set80211);
934 
935 #endif	/* IEEE80211_SUPPORT_SUPERG */
936