xref: /freebsd/sys/net80211/ieee80211_tdma.c (revision 39beb93c3f8bdbf72a61fda42300b5ebed7390c8)
1 /*-
2  * Copyright (c) 2007-2009 Sam Leffler, Errno Consulting
3  * Copyright (c) 2007-2009 Intel Corporation
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 #ifdef __FreeBSD__
29 __FBSDID("$FreeBSD$");
30 #endif
31 
32 /*
33  * IEEE 802.11 TDMA mode support.
34  */
35 #include "opt_inet.h"
36 #include "opt_wlan.h"
37 
38 #ifdef IEEE80211_SUPPORT_TDMA
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/mbuf.h>
42 #include <sys/malloc.h>
43 #include <sys/kernel.h>
44 
45 #include <sys/socket.h>
46 #include <sys/sockio.h>
47 #include <sys/endian.h>
48 #include <sys/errno.h>
49 #include <sys/proc.h>
50 #include <sys/sysctl.h>
51 
52 #include <net/if.h>
53 #include <net/if_media.h>
54 #include <net/if_llc.h>
55 #include <net/ethernet.h>
56 
57 #include <net/bpf.h>
58 
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_tdma.h>
61 #include <net80211/ieee80211_input.h>
62 
63 #include "opt_tdma.h"
64 #ifndef TDMA_SLOTLEN_DEFAULT
65 #define	TDMA_SLOTLEN_DEFAULT	10*1000		/* 10ms */
66 #endif
67 #ifndef TDMA_SLOTCNT_DEFAULT
68 #define	TDMA_SLOTCNT_DEFAULT	2		/* 2x (pt-to-pt) */
69 #endif
70 #ifndef TDMA_BINTVAL_DEFAULT
71 #define	TDMA_BINTVAL_DEFAULT	5		/* 5x ~= 100TU beacon intvl */
72 #endif
73 #ifndef TDMA_TXRATE_11B_DEFAULT
74 #define	TDMA_TXRATE_11B_DEFAULT	2*11
75 #endif
76 #ifndef TDMA_TXRATE_11G_DEFAULT
77 #define	TDMA_TXRATE_11G_DEFAULT	2*24
78 #endif
79 #ifndef TDMA_TXRATE_11A_DEFAULT
80 #define	TDMA_TXRATE_11A_DEFAULT	2*24
81 #endif
82 #ifndef TDMA_TXRATE_STURBO_A_DEFAULT
83 #define	TDMA_TXRATE_STURBO_A_DEFAULT	2*24
84 #endif
85 #ifndef TDMA_TXRATE_HALF_DEFAULT
86 #define	TDMA_TXRATE_HALF_DEFAULT	2*12
87 #endif
88 #ifndef TDMA_TXRATE_QUARTER_DEFAULT
89 #define	TDMA_TXRATE_QUARTER_DEFAULT	2*6
90 #endif
91 #ifndef TDMA_TXRATE_11NA_DEFAULT
92 #define	TDMA_TXRATE_11NA_DEFAULT	(4 | IEEE80211_RATE_MCS)
93 #endif
94 #ifndef TDMA_TXRATE_11NG_DEFAULT
95 #define	TDMA_TXRATE_11NG_DEFAULT	(4 | IEEE80211_RATE_MCS)
96 #endif
97 
98 static void tdma_vdetach(struct ieee80211vap *vap);
99 static int tdma_newstate(struct ieee80211vap *, enum ieee80211_state, int);
100 static void tdma_beacon_miss(struct ieee80211vap *vap);
101 static void tdma_recv_mgmt(struct ieee80211_node *, struct mbuf *,
102 	int subtype, int rssi, int noise, uint32_t rstamp);
103 static int tdma_update(struct ieee80211vap *vap,
104 	const struct ieee80211_tdma_param *tdma, struct ieee80211_node *ni,
105 	int pickslot);
106 static int tdma_process_params(struct ieee80211_node *ni,
107 	const u_int8_t *ie, u_int32_t rstamp, const struct ieee80211_frame *wh);
108 
109 static void
110 settxparms(struct ieee80211vap *vap, enum ieee80211_phymode mode, int rate)
111 {
112 	vap->iv_txparms[mode].ucastrate = rate;
113 	vap->iv_txparms[mode].mcastrate = rate;
114 }
115 
116 static void
117 setackpolicy(struct ieee80211com *ic, int noack)
118 {
119 	struct ieee80211_wme_state *wme = &ic->ic_wme;
120 	int ac;
121 
122 	for (ac = 0; ac < WME_NUM_AC; ac++) {
123 		wme->wme_chanParams.cap_wmeParams[ac].wmep_noackPolicy = noack;
124 		wme->wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy = noack;
125 	}
126 }
127 
128 void
129 ieee80211_tdma_vattach(struct ieee80211vap *vap)
130 {
131 	struct ieee80211_tdma_state *ts;
132 
133 	KASSERT(vap->iv_caps & IEEE80211_C_TDMA,
134 	     ("not a tdma vap, caps 0x%x", vap->iv_caps));
135 
136 	ts = (struct ieee80211_tdma_state *) malloc(
137 	     sizeof(struct ieee80211_tdma_state), M_80211_VAP, M_NOWAIT | M_ZERO);
138 	if (ts == NULL) {
139 		printf("%s: cannot allocate TDMA state block\n", __func__);
140 		/* NB: fall back to adhdemo mode */
141 		vap->iv_caps &= ~IEEE80211_C_TDMA;
142 		return;
143 	}
144 	/* NB: default configuration is passive so no beacons */
145 	ts->tdma_slotlen = TDMA_SLOTLEN_DEFAULT;
146 	ts->tdma_slotcnt = TDMA_SLOTCNT_DEFAULT;
147 	ts->tdma_bintval = TDMA_BINTVAL_DEFAULT;
148 	ts->tdma_slot = 1;			/* passive operation */
149 
150 	/* setup default fixed rates */
151 	settxparms(vap, IEEE80211_MODE_11A, TDMA_TXRATE_11A_DEFAULT);
152 	settxparms(vap, IEEE80211_MODE_11B, TDMA_TXRATE_11B_DEFAULT);
153 	settxparms(vap, IEEE80211_MODE_11G, TDMA_TXRATE_11G_DEFAULT);
154 	settxparms(vap, IEEE80211_MODE_STURBO_A, TDMA_TXRATE_STURBO_A_DEFAULT);
155 	settxparms(vap, IEEE80211_MODE_11NA, TDMA_TXRATE_11NA_DEFAULT);
156 	settxparms(vap, IEEE80211_MODE_11NG, TDMA_TXRATE_11NG_DEFAULT);
157 	settxparms(vap, IEEE80211_MODE_HALF, TDMA_TXRATE_HALF_DEFAULT);
158 	settxparms(vap, IEEE80211_MODE_QUARTER, TDMA_TXRATE_QUARTER_DEFAULT);
159 
160 	setackpolicy(vap->iv_ic, 1);	/* disable ACK's */
161 
162 	ts->tdma_opdetach = vap->iv_opdetach;
163 	vap->iv_opdetach = tdma_vdetach;
164 	ts->tdma_newstate = vap->iv_newstate;
165 	vap->iv_newstate = tdma_newstate;
166 	vap->iv_bmiss = tdma_beacon_miss;
167 	ts->tdma_recv_mgmt = vap->iv_recv_mgmt;
168 	vap->iv_recv_mgmt = tdma_recv_mgmt;
169 
170 	vap->iv_tdma = ts;
171 }
172 
173 static void
174 tdma_vdetach(struct ieee80211vap *vap)
175 {
176 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
177 
178 	ts->tdma_opdetach(vap);
179 	free(vap->iv_tdma, M_80211_VAP);
180 
181 	setackpolicy(vap->iv_ic, 0);	/* enable ACK's */
182 }
183 
184 static void
185 sta_leave(void *arg, struct ieee80211_node *ni)
186 {
187 	struct ieee80211vap *vap = arg;
188 
189 	if (ni->ni_vap == vap && ni != vap->iv_bss)
190 		ieee80211_node_leave(ni);
191 }
192 
193 /*
194  * TDMA state machine handler.
195  */
196 static int
197 tdma_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
198 {
199 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
200 	struct ieee80211com *ic = vap->iv_ic;
201 	enum ieee80211_state ostate;
202 	int status;
203 
204 	IEEE80211_LOCK_ASSERT(ic);
205 
206 	ostate = vap->iv_state;
207 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
208 	    __func__, ieee80211_state_name[ostate],
209 	    ieee80211_state_name[nstate], arg);
210 
211 	if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
212 		callout_stop(&vap->iv_swbmiss);
213 	if (nstate == IEEE80211_S_SCAN &&
214 	    (ostate == IEEE80211_S_INIT || ostate == IEEE80211_S_RUN) &&
215 	    ts->tdma_slot != 0) {
216 		/*
217 		 * Override adhoc behaviour when operating as a slave;
218 		 * we need to scan even if the channel is locked.
219 		 */
220 		vap->iv_state = nstate;			/* state transition */
221 		ieee80211_cancel_scan(vap);		/* background scan */
222 		if (ostate == IEEE80211_S_RUN) {
223 			/* purge station table; entries are stale */
224 			ieee80211_iterate_nodes(&ic->ic_sta, sta_leave, vap);
225 		}
226 		if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
227 			ieee80211_check_scan(vap,
228 			    vap->iv_scanreq_flags,
229 			    vap->iv_scanreq_duration,
230 			    vap->iv_scanreq_mindwell,
231 			    vap->iv_scanreq_maxdwell,
232 			    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
233 			vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
234 		} else
235 			ieee80211_check_scan_current(vap);
236 		status = 0;
237 	} else {
238 		status = ts->tdma_newstate(vap, nstate, arg);
239 	}
240 	if (status == 0 &&
241 	    nstate == IEEE80211_S_RUN && ostate != IEEE80211_S_RUN &&
242 	    (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) &&
243 	    ts->tdma_slot != 0 &&
244 	    vap->iv_des_chan == IEEE80211_CHAN_ANYC) {
245 		/*
246 		 * Start s/w beacon miss timer for slave devices w/o
247 		 * hardware support.  Note we do this only if we're
248 		 * not locked to a channel (i.e. roam to follow the
249 		 * master). The 2x is a fudge for our doing this in
250 		 * software.
251 		 */
252 		vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
253 		    2 * vap->iv_bmissthreshold * ts->tdma_bintval *
254 		    ((ts->tdma_slotcnt * ts->tdma_slotlen) / 1024));
255 		vap->iv_swbmiss_count = 0;
256 		callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
257 			ieee80211_swbmiss, vap);
258 	}
259 	return status;
260 }
261 
262 static void
263 tdma_beacon_miss(struct ieee80211vap *vap)
264 {
265 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
266 
267 	KASSERT((vap->iv_ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
268 	KASSERT(vap->iv_state == IEEE80211_S_RUN,
269 	    ("wrong state %d", vap->iv_state));
270 
271 	IEEE80211_DPRINTF(vap,
272 		IEEE80211_MSG_STATE | IEEE80211_MSG_TDMA | IEEE80211_MSG_DEBUG,
273 		"beacon miss, mode %u state %s\n",
274 		vap->iv_opmode, ieee80211_state_name[vap->iv_state]);
275 
276 	if (ts->tdma_peer != NULL) {	/* XXX? can this be null? */
277 		ieee80211_notify_node_leave(vap->iv_bss);
278 		ts->tdma_peer = NULL;
279 		/*
280 		 * Treat beacon miss like an associate failure wrt the
281 		 * scan policy; this forces the entry in the scan cache
282 		 * to be ignored after several tries.
283 		 */
284 		ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr,
285 		    IEEE80211_STATUS_TIMEOUT);
286 	}
287 #if 0
288 	ts->tdma_inuse = 0;		/* clear slot usage */
289 #endif
290 	ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
291 }
292 
293 static void
294 tdma_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
295 	int subtype, int rssi, int noise, uint32_t rstamp)
296 {
297 	struct ieee80211com *ic = ni->ni_ic;
298 	struct ieee80211vap *vap = ni->ni_vap;
299 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
300 
301 	if (subtype == IEEE80211_FC0_SUBTYPE_BEACON &&
302 	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
303 		struct ieee80211_frame *wh = mtod(m0, struct ieee80211_frame *);
304 		struct ieee80211_scanparams scan;
305 
306 		if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
307 			return;
308 		if (scan.tdma == NULL) {
309 			/*
310 			 * TDMA stations must beacon a TDMA ie; ignore
311 			 * any other station.
312 			 * XXX detect overlapping bss and change channel
313 			 */
314 			IEEE80211_DISCARD(vap,
315 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
316 			    wh, ieee80211_mgt_subtype_name[subtype >>
317 				IEEE80211_FC0_SUBTYPE_SHIFT],
318 			    "%s", "no TDMA ie");
319 			vap->iv_stats.is_rx_mgtdiscard++;
320 			return;
321 		}
322 		if (ni == vap->iv_bss &&
323 		    !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
324 			/*
325 			 * Fake up a node for this newly
326 			 * discovered member of the IBSS.
327 			 */
328 			ni = ieee80211_add_neighbor(vap, wh, &scan);
329 			if (ni == NULL) {
330 				/* NB: stat kept for alloc failure */
331 				return;
332 			}
333 		}
334 		/*
335 		 * Check for state updates.
336 		 */
337 		if (IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid)) {
338 			/*
339 			 * Count frame now that we know it's to be processed.
340 			 */
341 			vap->iv_stats.is_rx_beacon++;
342 			IEEE80211_NODE_STAT(ni, rx_beacons);
343 			/*
344 			 * Record tsf of last beacon.  NB: this must be
345 			 * done before calling tdma_process_params
346 			 * as deeper routines reference it.
347 			 */
348 			memcpy(&ni->ni_tstamp.data, scan.tstamp,
349 				sizeof(ni->ni_tstamp.data));
350 			/*
351 			 * Count beacon frame for s/w bmiss handling.
352 			 */
353 			vap->iv_swbmiss_count++;
354 			/*
355 			 * Process tdma ie.  The contents are used to sync
356 			 * the slot timing, reconfigure the bss, etc.
357 			 */
358 			(void) tdma_process_params(ni, scan.tdma, rstamp, wh);
359 			return;
360 		}
361 		/*
362 		 * NB: defer remaining work to the adhoc code; this causes
363 		 *     2x parsing of the frame but should happen infrequently
364 		 */
365 	}
366 	ts->tdma_recv_mgmt(ni, m0, subtype, rssi, noise, rstamp);
367 }
368 
369 /*
370  * Update TDMA state on receipt of a beacon frame with
371  * a TDMA information element.  The sender's identity
372  * is provided so we can track who our peer is.  If pickslot
373  * is non-zero we scan the slot allocation state in the ie
374  * locate a free slot for our use.
375  */
376 static int
377 tdma_update(struct ieee80211vap *vap, const struct ieee80211_tdma_param *tdma,
378 	struct ieee80211_node *ni, int pickslot)
379 {
380 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
381 	int slotlen, slotcnt, slot, bintval;
382 
383 	KASSERT(vap->iv_caps & IEEE80211_C_TDMA,
384 	     ("not a tdma vap, caps 0x%x", vap->iv_caps));
385 
386 	slotlen = le16toh(tdma->tdma_slotlen);
387 	slotcnt = tdma->tdma_slotcnt;
388 	bintval = tdma->tdma_bintval;
389 
390 	/* XXX rate-limit printf's */
391 	if (!(2 <= slotcnt && slotcnt <= IEEE80211_TDMA_MAXSLOTS)) {
392 		printf("%s: bogus slot cnt %u\n", __func__, slotcnt);
393 		return 0;
394 	}
395 	/* XXX magic constants */
396 	if (slotlen < 2 || slotlen > (0xfffff/100)) {
397 		printf("%s: bogus slot len %u\n", __func__, slotlen);
398 		return 0;
399 	}
400 	if (bintval < 1) {
401 		printf("%s: bogus beacon interval %u\n", __func__, bintval);
402 		return 0;
403 	}
404 	if (pickslot) {
405 		/*
406 		 * Pick unoccupied slot.  Note we never choose slot 0.
407 		 */
408 		for (slot = slotcnt-1; slot > 0; slot--)
409 			if (isclr(tdma->tdma_inuse, slot))
410 				break;
411 		if (slot <= 0) {
412 			printf("%s: no free slot, slotcnt %u inuse: 0x%x\n",
413 				__func__, slotcnt, tdma->tdma_inuse[0]);
414 			/* XXX need to do something better */
415 			return 0;
416 		}
417 	} else
418 		slot = ts->tdma_slot;
419 
420 	if (slotcnt != ts->tdma_slotcnt ||
421 	    100*slotlen != ts->tdma_slotlen ||
422 	    bintval != ts->tdma_bintval ||
423 	    slot != ts->tdma_slot ||
424 	    ts->tdma_peer != ni) {
425 		/*
426 		 * New/changed parameters; update runtime state.
427 		 */
428 		/* XXX overwrites user parameters */
429 		ts->tdma_slotcnt = slotcnt;
430 		ts->tdma_slotlen = 100*slotlen;
431 		ts->tdma_slot = slot;
432 		ts->tdma_bintval = bintval;
433 		/* mark beacon to be updated before next xmit */
434 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_TDMA);
435 
436 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_TDMA,
437 		    "%s: slot %u slotcnt %u slotlen %u us bintval %u\n",
438 		    __func__, slot, slotcnt, 100*slotlen, tdma->tdma_bintval);
439 	}
440 	/*
441 	 * Notify driver.  Note we can be called before
442 	 * entering RUN state if we scanned and are
443 	 * joining an existing bss.  In that case do not
444 	 * call the driver because not all necessary state
445 	 * has been setup.  The next beacon will dtrt.
446 	 */
447 	if (vap->iv_state == IEEE80211_S_RUN)
448 		vap->iv_ic->ic_tdma_update(ni, tdma);
449 	/*
450 	 * Dispatch join event on first beacon from new master.
451 	 */
452 	if (ts->tdma_peer != ni) {
453 		if (ts->tdma_peer != NULL)
454 			ieee80211_notify_node_leave(vap->iv_bss);
455 		ieee80211_notify_node_join(ni, 1);
456 		/* NB: no reference, we just use the address */
457 		ts->tdma_peer = ni;
458 	}
459 	return 1;
460 }
461 
462 /*
463  * Process received TDMA parameters.
464  */
465 static int
466 tdma_process_params(struct ieee80211_node *ni,
467 	const u_int8_t *ie, u_int32_t rstamp, const struct ieee80211_frame *wh)
468 {
469 	struct ieee80211vap *vap = ni->ni_vap;
470 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
471 	const struct ieee80211_tdma_param *tdma =
472 		(const struct ieee80211_tdma_param *) ie;
473 	u_int len = ie[1];
474 
475 	KASSERT(vap->iv_caps & IEEE80211_C_TDMA,
476 	     ("not a tdma vap, caps 0x%x", vap->iv_caps));
477 
478 	if (len < sizeof(*tdma) - 2) {
479 		IEEE80211_DISCARD_IE(vap,
480 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_TDMA,
481 		    wh, "tdma", "too short, len %u", len);
482 		return IEEE80211_REASON_IE_INVALID;
483 	}
484 	if (tdma->tdma_version != TDMA_VERSION) {
485 		IEEE80211_DISCARD_IE(vap,
486 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_TDMA,
487 		    wh, "tdma", "bad version %u", tdma->tdma_version);
488 		return IEEE80211_REASON_IE_INVALID;
489 	}
490 	/*
491 	 * Can reach here while scanning, update
492 	 * operational state only in RUN state.
493 	 */
494 	if (vap->iv_state == IEEE80211_S_RUN) {
495 		if (tdma->tdma_slot != ts->tdma_slot &&
496 		    isclr(ts->tdma_inuse, tdma->tdma_slot)) {
497 			IEEE80211_NOTE(vap, IEEE80211_MSG_TDMA, ni,
498 			    "discovered in slot %u", tdma->tdma_slot);
499 			setbit(ts->tdma_inuse, tdma->tdma_slot);
500 			/* XXX dispatch event only when operating as master */
501 			if (ts->tdma_slot == 0)
502 				ieee80211_notify_node_join(ni, 1);
503 		}
504 		setbit(ts->tdma_active, tdma->tdma_slot);
505 		if (tdma->tdma_slot == ts->tdma_slot-1) {
506 			/*
507 			 * Slave tsf synchronization to station
508 			 * just before us in the schedule. The driver
509 			 * is responsible for copying the timestamp
510 			 * of the received beacon into our beacon
511 			 * frame so the sender can calculate round
512 			 * trip time.  We cannot do that here because
513 			 * we don't know how to update our beacon frame.
514 			 */
515 			(void) tdma_update(vap, tdma, ni, 0);
516 			/* XXX reschedule swbmiss timer on parameter change */
517 		} else if (tdma->tdma_slot == ts->tdma_slot+1) {
518 			uint64_t tstamp;
519 			int32_t rtt;
520 			/*
521 			 * Use returned timstamp to calculate the
522 			 * roundtrip time.
523 			 */
524 			memcpy(&tstamp, tdma->tdma_tstamp, 8);
525 			/* XXX use only 15 bits of rstamp */
526 			rtt = rstamp - (le64toh(tstamp) & 0x7fff);
527 			if (rtt < 0)
528 				rtt += 0x7fff;
529 			/* XXX hack to quiet normal use */
530 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOT1X,
531 			    "tdma rtt %5u [rstamp %5u tstamp %llu]\n",
532 			    rtt, rstamp,
533 			    (unsigned long long) le64toh(tstamp));
534 		} else if (tdma->tdma_slot == ts->tdma_slot &&
535 		    le64toh(ni->ni_tstamp.tsf) > vap->iv_bss->ni_tstamp.tsf) {
536 			/*
537 			 * Station using the same slot as us and has
538 			 * been around longer than us; we must move.
539 			 * Note this can happen if stations do not
540 			 * see each other while scanning.
541 			 */
542 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_TDMA,
543 			    "slot %u collision rxtsf %llu tsf %llu\n",
544 			    tdma->tdma_slot,
545 			    (unsigned long long) le64toh(ni->ni_tstamp.tsf),
546 			    vap->iv_bss->ni_tstamp.tsf);
547 			setbit(ts->tdma_inuse, tdma->tdma_slot);
548 
549 			(void) tdma_update(vap, tdma, ni, 1);
550 		}
551 	}
552 	return 0;
553 }
554 
555 int
556 ieee80211_tdma_getslot(struct ieee80211vap *vap)
557 {
558 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
559 
560 	KASSERT(vap->iv_caps & IEEE80211_C_TDMA,
561 	     ("not a tdma vap, caps 0x%x", vap->iv_caps));
562 	return ts->tdma_slot;
563 }
564 
565 /*
566  * Parse a TDMA ie on station join and use it to setup node state.
567  */
568 void
569 ieee80211_parse_tdma(struct ieee80211_node *ni, const uint8_t *ie)
570 {
571 	struct ieee80211vap *vap = ni->ni_vap;
572 
573 	if (vap->iv_caps & IEEE80211_C_TDMA) {
574 		const struct ieee80211_tdma_param *tdma =
575 		    (const struct ieee80211_tdma_param *)ie;
576 		struct ieee80211_tdma_state *ts = vap->iv_tdma;
577 		/*
578 		 * Adopt TDMA configuration when joining an
579 		 * existing network.
580 		 */
581 		setbit(ts->tdma_inuse, tdma->tdma_slot);
582 		(void) tdma_update(vap, tdma, ni, 1);
583 		/*
584 		 * Propagate capabilities based on the local
585 		 * configuration and the remote station's advertised
586 		 * capabilities. In particular this permits us to
587 		 * enable use of QoS to disable ACK's.
588 		 */
589 		if ((vap->iv_flags & IEEE80211_F_WME) &&
590 		    ni->ni_ies.wme_ie != NULL)
591 			ni->ni_flags |= IEEE80211_NODE_QOS;
592 	}
593 }
594 
595 #define	TDMA_OUI_BYTES		0x00, 0x03, 0x7f
596 /*
597  * Add a TDMA parameters element to a frame.
598  */
599 uint8_t *
600 ieee80211_add_tdma(uint8_t *frm, struct ieee80211vap *vap)
601 {
602 #define	ADDSHORT(frm, v) do {			\
603 	frm[0] = (v) & 0xff;			\
604 	frm[1] = (v) >> 8;			\
605 	frm += 2;				\
606 } while (0)
607 	static const struct ieee80211_tdma_param param = {
608 		.tdma_id	= IEEE80211_ELEMID_VENDOR,
609 		.tdma_len	= sizeof(struct ieee80211_tdma_param) - 2,
610 		.tdma_oui	= { TDMA_OUI_BYTES },
611 		.tdma_type	= TDMA_OUI_TYPE,
612 		.tdma_subtype	= TDMA_SUBTYPE_PARAM,
613 		.tdma_version	= TDMA_VERSION,
614 	};
615 	const struct ieee80211_tdma_state *tdma = vap->iv_tdma;
616 	uint16_t slotlen;
617 
618 	KASSERT(vap->iv_caps & IEEE80211_C_TDMA,
619 	     ("not a tdma vap, caps 0x%x", vap->iv_caps));
620 
621 	memcpy(frm, &param, sizeof(param));
622 	frm += __offsetof(struct ieee80211_tdma_param, tdma_slot);
623 	*frm++ = tdma->tdma_slot;
624 	*frm++ = tdma->tdma_slotcnt;
625 	/* NB: convert units to fit in 16-bits */
626 	slotlen = tdma->tdma_slotlen / 100;	/* 100us units */
627 	ADDSHORT(frm, slotlen);
628 	*frm++ = tdma->tdma_bintval;
629 	*frm++ = tdma->tdma_inuse[0];
630 	frm += 10;				/* pad+timestamp */
631 	return frm;
632 #undef ADDSHORT
633 }
634 #undef TDMA_OUI_BYTES
635 
636 /*
637  * Update TDMA state at TBTT.
638  */
639 void
640 ieee80211_tdma_update_beacon(struct ieee80211vap *vap,
641 	struct ieee80211_beacon_offsets *bo)
642 {
643 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
644 
645 	KASSERT(vap->iv_caps & IEEE80211_C_TDMA,
646 	     ("not a tdma vap, caps 0x%x", vap->iv_caps));
647 
648 	if (isset(bo->bo_flags,  IEEE80211_BEACON_TDMA)) {
649 		(void) ieee80211_add_tdma(bo->bo_tdma, vap);
650 		clrbit(bo->bo_flags, IEEE80211_BEACON_TDMA);
651 	}
652 	if (ts->tdma_slot != 0)		/* only on master */
653 		return;
654 	if (ts->tdma_count <= 0) {
655 		/*
656 		 * Time to update the mask of active/inuse stations.
657 		 * We track stations that we've received a beacon
658 		 * frame from and update this mask periodically.
659 		 * This allows us to miss a few beacons before marking
660 		 * a slot free for re-use.
661 		 */
662 		ts->tdma_inuse[0] = ts->tdma_active[0];
663 		ts->tdma_active[0] = 0x01;
664 		/* update next time 'round */
665 		/* XXX use notify framework */
666 		setbit(bo->bo_flags, IEEE80211_BEACON_TDMA);
667 		/* NB: use s/w beacon miss threshold; may be too high */
668 		ts->tdma_count = vap->iv_bmissthreshold-1;
669 	} else
670 		ts->tdma_count--;
671 }
672 
673 int
674 ieee80211_tdma_ioctl_get80211(struct ieee80211vap *vap,
675 	struct ieee80211req *ireq)
676 {
677 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
678 
679 	if ((vap->iv_caps & IEEE80211_C_TDMA) == 0)
680 		return EOPNOTSUPP;
681 
682 	switch (ireq->i_type) {
683 	case IEEE80211_IOC_TDMA_SLOT:
684 		ireq->i_val = ts->tdma_slot;
685 		break;
686 	case IEEE80211_IOC_TDMA_SLOTCNT:
687 		ireq->i_val = ts->tdma_slotcnt;
688 		break;
689 	case IEEE80211_IOC_TDMA_SLOTLEN:
690 		ireq->i_val = ts->tdma_slotlen;
691 		break;
692 	case IEEE80211_IOC_TDMA_BINTERVAL:
693 		ireq->i_val = ts->tdma_bintval;
694 		break;
695 	default:
696 		return EINVAL;
697 	}
698 	return 0;
699 }
700 
701 int
702 ieee80211_tdma_ioctl_set80211(struct ieee80211vap *vap,
703 	struct ieee80211req *ireq)
704 {
705 	struct ieee80211_tdma_state *ts = vap->iv_tdma;
706 
707 	if ((vap->iv_caps & IEEE80211_C_TDMA) == 0)
708 		return EOPNOTSUPP;
709 
710 	switch (ireq->i_type) {
711 	case IEEE80211_IOC_TDMA_SLOT:
712 		if (!(0 <= ireq->i_val && ireq->i_val <= ts->tdma_slotcnt))
713 			return EINVAL;
714 		if (ireq->i_val != ts->tdma_slot) {
715 			ts->tdma_slot = ireq->i_val;
716 			return ERESTART;
717 		}
718 		break;
719 	case IEEE80211_IOC_TDMA_SLOTCNT:
720 		if (!(2 <= ireq->i_val &&
721 		      ireq->i_val <= IEEE80211_TDMA_MAXSLOTS))
722 			return EINVAL;
723 		if (ireq->i_val != ts->tdma_slotcnt) {
724 			ts->tdma_slotcnt = ireq->i_val;
725 			return ERESTART;
726 		}
727 		break;
728 	case IEEE80211_IOC_TDMA_SLOTLEN:
729 		/*
730 		 * XXX
731 		 * 150 insures at least 1/8 TU
732 		 * 0xfffff is the max duration for bursting
733 		 * (implict by way of 16-bit data type for i_val)
734 		 */
735 		if (ireq->i_val < 150)
736 			return EINVAL;
737 		if (ireq->i_val != ts->tdma_slotlen) {
738 			ts->tdma_slotlen = ireq->i_val;
739 			return ERESTART;
740 		}
741 		break;
742 	case IEEE80211_IOC_TDMA_BINTERVAL:
743 		if (ireq->i_val < 1)
744 			return EINVAL;
745 		if (ireq->i_val != ts->tdma_bintval) {
746 			ts->tdma_bintval = ireq->i_val;
747 			return ERESTART;
748 		}
749 		break;
750 	default:
751 		return EINVAL;
752 	}
753 	return 0;
754 }
755 #endif /* IEEE80211_SUPPORT_TDMA */
756