1 /*-
2  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  * $FreeBSD: head/sys/net80211/ieee80211_superg.c 193115 2009-05-30 20:11:23Z sam $
26  * $DragonFly$
27  */
28 
29 #include "opt_wlan.h"
30 
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/mbuf.h>
34 #include <sys/kernel.h>
35 #include <sys/endian.h>
36 
37 #include <sys/socket.h>
38 
39 #include <net/bpf.h>
40 #include <net/ethernet.h>
41 #include <net/route.h>
42 #include <net/if.h>
43 #include <net/if_llc.h>
44 #include <net/if_media.h>
45 
46 #include <netproto/802_11/ieee80211_var.h>
47 #include <netproto/802_11/ieee80211_input.h>
48 #include <netproto/802_11/ieee80211_phy.h>
49 #include <netproto/802_11/ieee80211_superg.h>
50 
51 /*
52  * Atheros fast-frame encapsulation format.
53  * FF max payload:
54  * 802.2 + FFHDR + HPAD + 802.3 + 802.2 + 1500 + SPAD + 802.3 + 802.2 + 1500:
55  *   8   +   4   +  4   +   14  +   8   + 1500 +  6   +   14  +   8   + 1500
56  * = 3066
57  */
58 /* fast frame header is 32-bits */
59 #define	ATH_FF_PROTO	0x0000003f	/* protocol */
60 #define	ATH_FF_PROTO_S	0
61 #define	ATH_FF_FTYPE	0x000000c0	/* frame type */
62 #define	ATH_FF_FTYPE_S	6
63 #define	ATH_FF_HLEN32	0x00000300	/* optional hdr length */
64 #define	ATH_FF_HLEN32_S	8
65 #define	ATH_FF_SEQNUM	0x001ffc00	/* sequence number */
66 #define	ATH_FF_SEQNUM_S	10
67 #define	ATH_FF_OFFSET	0xffe00000	/* offset to 2nd payload */
68 #define	ATH_FF_OFFSET_S	21
69 
70 #define	ATH_FF_MAX_HDR_PAD	4
71 #define	ATH_FF_MAX_SEP_PAD	6
72 #define	ATH_FF_MAX_HDR		30
73 
74 #define	ATH_FF_PROTO_L2TUNNEL	0	/* L2 tunnel protocol */
75 #define	ATH_FF_ETH_TYPE		0x88bd	/* Ether type for encapsulated frames */
76 #define	ATH_FF_SNAP_ORGCODE_0	0x00
77 #define	ATH_FF_SNAP_ORGCODE_1	0x03
78 #define	ATH_FF_SNAP_ORGCODE_2	0x7f
79 
80 #define	ATH_FF_TXQMIN	2		/* min txq depth for staging */
81 #define	ATH_FF_TXQMAX	50		/* maximum # of queued frames allowed */
82 #define	ATH_FF_STAGEMAX	5		/* max waiting period for staged frame*/
83 
84 #define	ETHER_HEADER_COPY(dst, src) \
85 	memcpy(dst, src, sizeof(struct ether_header))
86 
87 static	int ieee80211_ffppsmin = 2;	/* pps threshold for ff aggregation */
88 SYSCTL_INT(_net_wlan, OID_AUTO, ffppsmin, CTLTYPE_INT | CTLFLAG_RW,
89 	&ieee80211_ffppsmin, 0, "min packet rate before fast-frame staging");
90 static	int ieee80211_ffagemax = -1;	/* max time frames held on stage q */
91 SYSCTL_PROC(_net_wlan, OID_AUTO, ffagemax, CTLTYPE_INT | CTLFLAG_RW,
92 	&ieee80211_ffagemax, 0, ieee80211_sysctl_msecs_ticks, "I",
93 	"max hold time for fast-frame staging (ms)");
94 
95 void
96 ieee80211_superg_attach(struct ieee80211com *ic)
97 {
98 	struct ieee80211_superg *sg;
99 
100 	if (ic->ic_caps & IEEE80211_C_FF) {
101 		sg = (struct ieee80211_superg *) kmalloc(
102 		     sizeof(struct ieee80211_superg), M_80211_VAP,
103 		     M_INTWAIT | M_ZERO);
104 		if (sg == NULL) {
105 			kprintf("%s: cannot allocate SuperG state block\n",
106 			    __func__);
107 			return;
108 		}
109 		ic->ic_superg = sg;
110 	}
111 	ieee80211_ffagemax = msecs_to_ticks(150);
112 }
113 
114 void
115 ieee80211_superg_detach(struct ieee80211com *ic)
116 {
117 	if (ic->ic_superg != NULL) {
118 		kfree(ic->ic_superg, M_80211_VAP);
119 		ic->ic_superg = NULL;
120 	}
121 }
122 
123 void
124 ieee80211_superg_vattach(struct ieee80211vap *vap)
125 {
126 	struct ieee80211com *ic = vap->iv_ic;
127 
128 	if (ic->ic_superg == NULL)	/* NB: can't do fast-frames w/o state */
129 		vap->iv_caps &= ~IEEE80211_C_FF;
130 	if (vap->iv_caps & IEEE80211_C_FF)
131 		vap->iv_flags |= IEEE80211_F_FF;
132 	/* NB: we only implement sta mode */
133 	if (vap->iv_opmode == IEEE80211_M_STA &&
134 	    (vap->iv_caps & IEEE80211_C_TURBOP))
135 		vap->iv_flags |= IEEE80211_F_TURBOP;
136 }
137 
138 void
139 ieee80211_superg_vdetach(struct ieee80211vap *vap)
140 {
141 }
142 
143 #define	ATH_OUI_BYTES		0x00, 0x03, 0x7f
144 /*
145  * Add a WME information element to a frame.
146  */
147 uint8_t *
148 ieee80211_add_ath(uint8_t *frm, uint8_t caps, ieee80211_keyix defkeyix)
149 {
150 	static const struct ieee80211_ath_ie info = {
151 		.ath_id		= IEEE80211_ELEMID_VENDOR,
152 		.ath_len	= sizeof(struct ieee80211_ath_ie) - 2,
153 		.ath_oui	= { ATH_OUI_BYTES },
154 		.ath_oui_type	= ATH_OUI_TYPE,
155 		.ath_oui_subtype= ATH_OUI_SUBTYPE,
156 		.ath_version	= ATH_OUI_VERSION,
157 	};
158 	struct ieee80211_ath_ie *ath = (struct ieee80211_ath_ie *) frm;
159 
160 	memcpy(frm, &info, sizeof(info));
161 	ath->ath_capability = caps;
162 	if (defkeyix != IEEE80211_KEYIX_NONE) {
163 		ath->ath_defkeyix[0] = (defkeyix & 0xff);
164 		ath->ath_defkeyix[1] = ((defkeyix >> 8) & 0xff);
165 	} else {
166 		ath->ath_defkeyix[0] = 0xff;
167 		ath->ath_defkeyix[1] = 0x7f;
168 	}
169 	return frm + sizeof(info);
170 }
171 #undef ATH_OUI_BYTES
172 
173 uint8_t *
174 ieee80211_add_athcaps(uint8_t *frm, const struct ieee80211_node *bss)
175 {
176 	const struct ieee80211vap *vap = bss->ni_vap;
177 
178 	return ieee80211_add_ath(frm,
179 	    vap->iv_flags & IEEE80211_F_ATHEROS,
180 	    ((vap->iv_flags & IEEE80211_F_WPA) == 0 &&
181 	    bss->ni_authmode != IEEE80211_AUTH_8021X) ?
182 	    vap->iv_def_txkey : IEEE80211_KEYIX_NONE);
183 }
184 
185 void
186 ieee80211_parse_ath(struct ieee80211_node *ni, uint8_t *ie)
187 {
188 	const struct ieee80211_ath_ie *ath =
189 		(const struct ieee80211_ath_ie *) ie;
190 
191 	ni->ni_ath_flags = ath->ath_capability;
192 	ni->ni_ath_defkeyix = LE_READ_2(&ath->ath_defkeyix);
193 }
194 
195 int
196 ieee80211_parse_athparams(struct ieee80211_node *ni, uint8_t *frm,
197 	const struct ieee80211_frame *wh)
198 {
199 	struct ieee80211vap *vap = ni->ni_vap;
200 	const struct ieee80211_ath_ie *ath;
201 	u_int len = frm[1];
202 	int capschanged;
203 	uint16_t defkeyix;
204 
205 	if (len < sizeof(struct ieee80211_ath_ie)-2) {
206 		IEEE80211_DISCARD_IE(vap,
207 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_SUPERG,
208 		    wh, "Atheros", "too short, len %u", len);
209 		return -1;
210 	}
211 	ath = (const struct ieee80211_ath_ie *)frm;
212 	capschanged = (ni->ni_ath_flags != ath->ath_capability);
213 	defkeyix = LE_READ_2(ath->ath_defkeyix);
214 	if (capschanged || defkeyix != ni->ni_ath_defkeyix) {
215 		ni->ni_ath_flags = ath->ath_capability;
216 		ni->ni_ath_defkeyix = defkeyix;
217 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
218 		    "ath ie change: new caps 0x%x defkeyix 0x%x",
219 		    ni->ni_ath_flags, ni->ni_ath_defkeyix);
220 	}
221 	if (IEEE80211_ATH_CAP(vap, ni, ATHEROS_CAP_TURBO_PRIME)) {
222 		uint16_t curflags, newflags;
223 
224 		/*
225 		 * Check for turbo mode switch.  Calculate flags
226 		 * for the new mode and effect the switch.
227 		 */
228 		newflags = curflags = vap->iv_ic->ic_bsschan->ic_flags;
229 		/* NB: BOOST is not in ic_flags, so get it from the ie */
230 		if (ath->ath_capability & ATHEROS_CAP_BOOST)
231 			newflags |= IEEE80211_CHAN_TURBO;
232 		else
233 			newflags &= ~IEEE80211_CHAN_TURBO;
234 		if (newflags != curflags)
235 			ieee80211_dturbo_switch(vap, newflags);
236 	}
237 	return capschanged;
238 }
239 
240 /*
241  * Decap the encapsulated frame pair and dispatch the first
242  * for delivery.  The second frame is returned for delivery
243  * via the normal path.
244  */
245 struct mbuf *
246 ieee80211_ff_decap(struct ieee80211_node *ni, struct mbuf *m)
247 {
248 #define	FF_LLC_SIZE	(sizeof(struct ether_header) + sizeof(struct llc))
249 #define	MS(x,f)	(((x) & f) >> f##_S)
250 	struct ieee80211vap *vap = ni->ni_vap;
251 	struct llc *llc;
252 	uint32_t ath;
253 	struct mbuf *n;
254 	int framelen;
255 
256 	/* NB: we assume caller does this check for us */
257 	KASSERT(IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF),
258 	    ("ff not negotiated"));
259 	/*
260 	 * Check for fast-frame tunnel encapsulation.
261 	 */
262 	if (m->m_pkthdr.len < 3*FF_LLC_SIZE)
263 		return m;
264 	if (m->m_len < FF_LLC_SIZE &&
265 	    (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
266 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
267 		    ni->ni_macaddr, "fast-frame",
268 		    "%s", "m_pullup(llc) failed");
269 		vap->iv_stats.is_rx_tooshort++;
270 		return NULL;
271 	}
272 	llc = (struct llc *)(mtod(m, uint8_t *) +
273 	    sizeof(struct ether_header));
274 	if (llc->llc_snap.ether_type != htons(ATH_FF_ETH_TYPE))
275 		return m;
276 	m_adj(m, FF_LLC_SIZE);
277 	m_copydata(m, 0, sizeof(uint32_t), (caddr_t) &ath);
278 	if (MS(ath, ATH_FF_PROTO) != ATH_FF_PROTO_L2TUNNEL) {
279 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
280 		    ni->ni_macaddr, "fast-frame",
281 		    "unsupport tunnel protocol, header 0x%x", ath);
282 		vap->iv_stats.is_ff_badhdr++;
283 		m_freem(m);
284 		return NULL;
285 	}
286 	/* NB: skip header and alignment padding */
287 	m_adj(m, roundup(sizeof(uint32_t) - 2, 4) + 2);
288 
289 	vap->iv_stats.is_ff_decap++;
290 
291 	/*
292 	 * Decap the first frame, bust it apart from the
293 	 * second and deliver; then decap the second frame
294 	 * and return it to the caller for normal delivery.
295 	 */
296 	m = ieee80211_decap1(m, &framelen);
297 	if (m == NULL) {
298 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
299 		    ni->ni_macaddr, "fast-frame", "%s", "first decap failed");
300 		vap->iv_stats.is_ff_tooshort++;
301 		return NULL;
302 	}
303 	n = m_split(m, framelen, MB_DONTWAIT);
304 	if (n == NULL) {
305 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
306 		    ni->ni_macaddr, "fast-frame",
307 		    "%s", "unable to split encapsulated frames");
308 		vap->iv_stats.is_ff_split++;
309 		m_freem(m);			/* NB: must reclaim */
310 		return NULL;
311 	}
312 	/* XXX not right for WDS */
313 	vap->iv_deliver_data(vap, ni, m);	/* 1st of pair */
314 
315 	/*
316 	 * Decap second frame.
317 	 */
318 	m_adj(n, roundup2(framelen, 4) - framelen);	/* padding */
319 	n = ieee80211_decap1(n, &framelen);
320 	if (n == NULL) {
321 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
322 		    ni->ni_macaddr, "fast-frame", "%s", "second decap failed");
323 		vap->iv_stats.is_ff_tooshort++;
324 	}
325 	/* XXX verify framelen against mbuf contents */
326 	return n;				/* 2nd delivered by caller */
327 #undef MS
328 #undef FF_LLC_SIZE
329 }
330 
331 /*
332  * Do Ethernet-LLC encapsulation for each payload in a fast frame
333  * tunnel encapsulation.  The frame is assumed to have an Ethernet
334  * header at the front that must be stripped before prepending the
335  * LLC followed by the Ethernet header passed in (with an Ethernet
336  * type that specifies the payload size).
337  */
338 static struct mbuf *
339 ff_encap1(struct ieee80211vap *vap, struct mbuf *m,
340 	const struct ether_header *eh)
341 {
342 	struct llc *llc;
343 	uint16_t payload;
344 
345 	/* XXX optimize by combining m_adj+M_PREPEND */
346 	m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
347 	llc = mtod(m, struct llc *);
348 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
349 	llc->llc_control = LLC_UI;
350 	llc->llc_snap.org_code[0] = 0;
351 	llc->llc_snap.org_code[1] = 0;
352 	llc->llc_snap.org_code[2] = 0;
353 	llc->llc_snap.ether_type = eh->ether_type;
354 	payload = m->m_pkthdr.len;		/* NB: w/o Ethernet header */
355 
356 	M_PREPEND(m, sizeof(struct ether_header), MB_DONTWAIT);
357 	if (m == NULL) {		/* XXX cannot happen */
358 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
359 			"%s: no space for ether_header\n", __func__);
360 		vap->iv_stats.is_tx_nobuf++;
361 		return NULL;
362 	}
363 	ETHER_HEADER_COPY(mtod(m, void *), eh);
364 	mtod(m, struct ether_header *)->ether_type = htons(payload);
365 	return m;
366 }
367 
368 /*
369  * Fast frame encapsulation.  There must be two packets
370  * chained with m_nextpkt.  We do header adjustment for
371  * each, add the tunnel encapsulation, and then concatenate
372  * the mbuf chains to form a single frame for transmission.
373  */
374 struct mbuf *
375 ieee80211_ff_encap(struct ieee80211vap *vap, struct mbuf *m1, int hdrspace,
376 	struct ieee80211_key *key)
377 {
378 	struct mbuf *m2;
379 	struct ether_header eh1, eh2;
380 	struct llc *llc;
381 	struct mbuf *m;
382 	int pad;
383 
384 	m2 = m1->m_nextpkt;
385 	if (m2 == NULL) {
386 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
387 		    "%s: only one frame\n", __func__);
388 		goto bad;
389 	}
390 	m1->m_nextpkt = NULL;
391 	/*
392 	 * Include fast frame headers in adjusting header layout.
393 	 */
394 	KASSERT(m1->m_len >= sizeof(eh1), ("no ethernet header!"));
395 	ETHER_HEADER_COPY(&eh1, mtod(m1, caddr_t));
396 	m1 = ieee80211_mbuf_adjust(vap,
397 		hdrspace + sizeof(struct llc) + sizeof(uint32_t) + 2 +
398 		    sizeof(struct ether_header),
399 		key, m1);
400 	if (m1 == NULL) {
401 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
402 		m_freem(m2);
403 		goto bad;
404 	}
405 
406 	/*
407 	 * Copy second frame's Ethernet header out of line
408 	 * and adjust for encapsulation headers.  Note that
409 	 * we make room for padding in case there isn't room
410 	 * at the end of first frame.
411 	 */
412 	KASSERT(m2->m_len >= sizeof(eh2), ("no ethernet header!"));
413 	ETHER_HEADER_COPY(&eh2, mtod(m2, caddr_t));
414 	m2 = ieee80211_mbuf_adjust(vap,
415 		ATH_FF_MAX_HDR_PAD + sizeof(struct ether_header),
416 		NULL, m2);
417 	if (m2 == NULL) {
418 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
419 		goto bad;
420 	}
421 
422 	/*
423 	 * Now do tunnel encapsulation.  First, each
424 	 * frame gets a standard encapsulation.
425 	 */
426 	m1 = ff_encap1(vap, m1, &eh1);
427 	if (m1 == NULL)
428 		goto bad;
429 	m2 = ff_encap1(vap, m2, &eh2);
430 	if (m2 == NULL)
431 		goto bad;
432 
433 	/*
434 	 * Pad leading frame to a 4-byte boundary.  If there
435 	 * is space at the end of the first frame, put it
436 	 * there; otherwise prepend to the front of the second
437 	 * frame.  We know doing the second will always work
438 	 * because we reserve space above.  We prefer appending
439 	 * as this typically has better DMA alignment properties.
440 	 */
441 	for (m = m1; m->m_next != NULL; m = m->m_next)
442 		;
443 	pad = roundup2(m1->m_pkthdr.len, 4) - m1->m_pkthdr.len;
444 	if (pad) {
445 		if (M_TRAILINGSPACE(m) < pad) {		/* prepend to second */
446 			m2->m_data -= pad;
447 			m2->m_len += pad;
448 			m2->m_pkthdr.len += pad;
449 		} else {				/* append to first */
450 			m->m_len += pad;
451 			m1->m_pkthdr.len += pad;
452 		}
453 	}
454 
455 	/*
456 	 * Now, stick 'em together and prepend the tunnel headers;
457 	 * first the Atheros tunnel header (all zero for now) and
458 	 * then a special fast frame LLC.
459 	 *
460 	 * XXX optimize by prepending together
461 	 */
462 	m->m_next = m2;			/* NB: last mbuf from above */
463 	m1->m_pkthdr.len += m2->m_pkthdr.len;
464 	M_PREPEND(m1, sizeof(uint32_t)+2, MB_DONTWAIT);
465 	if (m1 == NULL) {		/* XXX cannot happen */
466 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
467 		    "%s: no space for tunnel header\n", __func__);
468 		vap->iv_stats.is_tx_nobuf++;
469 		return NULL;
470 	}
471 	memset(mtod(m1, void *), 0, sizeof(uint32_t)+2);
472 
473 	M_PREPEND(m1, sizeof(struct llc), MB_DONTWAIT);
474 	if (m1 == NULL) {		/* XXX cannot happen */
475 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
476 		    "%s: no space for llc header\n", __func__);
477 		vap->iv_stats.is_tx_nobuf++;
478 		return NULL;
479 	}
480 	llc = mtod(m1, struct llc *);
481 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
482 	llc->llc_control = LLC_UI;
483 	llc->llc_snap.org_code[0] = ATH_FF_SNAP_ORGCODE_0;
484 	llc->llc_snap.org_code[1] = ATH_FF_SNAP_ORGCODE_1;
485 	llc->llc_snap.org_code[2] = ATH_FF_SNAP_ORGCODE_2;
486 	llc->llc_snap.ether_type = htons(ATH_FF_ETH_TYPE);
487 
488 	vap->iv_stats.is_ff_encap++;
489 
490 	return m1;
491 bad:
492 	if (m1 != NULL)
493 		m_freem(m1);
494 	if (m2 != NULL)
495 		m_freem(m2);
496 	return NULL;
497 }
498 
499 static void
500 ff_transmit(struct ieee80211_node *ni, struct mbuf *m)
501 {
502 	struct ieee80211vap *vap = ni->ni_vap;
503 	int error;
504 
505 	/* encap and xmit */
506 	m = ieee80211_encap(vap, ni, m);
507 	if (m != NULL) {
508 		struct ifnet *ifp = vap->iv_ifp;
509 		struct ifnet *parent = ni->ni_ic->ic_ifp;
510 
511 		error = ieee80211_handoff(parent, m);
512 		if (error != 0) {
513 			/* NB: IFQ_HANDOFF reclaims mbuf */
514 			ieee80211_free_node(ni);
515 		} else {
516 			ifp->if_opackets++;
517 		}
518 	} else
519 		ieee80211_free_node(ni);
520 }
521 
522 /*
523  * Flush frames to device; note we re-use the linked list
524  * the frames were stored on and use the sentinel (unchanged)
525  * which may be non-NULL.
526  */
527 static void
528 ff_flush(struct mbuf *head, struct mbuf *last)
529 {
530 	struct mbuf *m, *next;
531 	struct ieee80211_node *ni;
532 	struct ieee80211vap *vap;
533 
534 	for (m = head; m != last; m = next) {
535 		next = m->m_nextpkt;
536 		m->m_nextpkt = NULL;
537 
538 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
539 		vap = ni->ni_vap;
540 
541 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
542 		    "%s: flush frame, age %u", __func__, M_AGE_GET(m));
543 		vap->iv_stats.is_ff_flush++;
544 
545 		ff_transmit(ni, m);
546 	}
547 }
548 
549 /*
550  * Age frames on the staging queue.
551  */
552 void
553 ieee80211_ff_age(struct ieee80211com *ic, struct ieee80211_stageq *sq,
554     int quanta)
555 {
556 	struct ieee80211_superg *sg = ic->ic_superg;
557 	struct mbuf *m, *head;
558 	struct ieee80211_node *ni;
559 	struct ieee80211_tx_ampdu *tap;
560 
561 	KASSERT(sq->head != NULL, ("stageq empty"));
562 
563 	head = sq->head;
564 	while ((m = sq->head) != NULL && M_AGE_GET(m) < quanta) {
565 		/* clear tap ref to frame */
566 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
567 		tap = &ni->ni_tx_ampdu[M_WME_GETAC(m)];
568 		KASSERT(tap->txa_private == m, ("staging queue empty"));
569 		tap->txa_private = NULL;
570 
571 		sq->head = m->m_nextpkt;
572 		sq->depth--;
573 		sg->ff_stageqdepth--;
574 	}
575 	if (m == NULL)
576 		sq->tail = NULL;
577 	else
578 		M_AGE_SUB(m, quanta);
579 
580 	ff_flush(head, m);
581 }
582 
583 static void
584 stageq_add(struct ieee80211_stageq *sq, struct mbuf *m)
585 {
586 	int age = ieee80211_ffagemax;
587 	if (sq->tail != NULL) {
588 		sq->tail->m_nextpkt = m;
589 		age -= M_AGE_GET(sq->head);
590 	} else
591 		sq->head = m;
592 	KASSERT(age >= 0, ("age %d", age));
593 	M_AGE_SET(m, age);
594 	m->m_nextpkt = NULL;
595 	sq->tail = m;
596 	sq->depth++;
597 }
598 
599 static void
600 stageq_remove(struct ieee80211_stageq *sq, struct mbuf *mstaged)
601 {
602 	struct mbuf *m, *mprev;
603 
604 	mprev = NULL;
605 	for (m = sq->head; m != NULL; m = m->m_nextpkt) {
606 		if (m == mstaged) {
607 			if (mprev == NULL)
608 				sq->head = m->m_nextpkt;
609 			else
610 				mprev->m_nextpkt = m->m_nextpkt;
611 			if (sq->tail == m)
612 				sq->tail = mprev;
613 			sq->depth--;
614 			return;
615 		}
616 		mprev = m;
617 	}
618 	kprintf("%s: packet not found\n", __func__);
619 }
620 
621 static uint32_t
622 ff_approx_txtime(struct ieee80211_node *ni,
623 	const struct mbuf *m1, const struct mbuf *m2)
624 {
625 	struct ieee80211com *ic = ni->ni_ic;
626 	struct ieee80211vap *vap = ni->ni_vap;
627 	uint32_t framelen;
628 
629 	/*
630 	 * Approximate the frame length to be transmitted. A swag to add
631 	 * the following maximal values to the skb payload:
632 	 *   - 32: 802.11 encap + CRC
633 	 *   - 24: encryption overhead (if wep bit)
634 	 *   - 4 + 6: fast-frame header and padding
635 	 *   - 16: 2 LLC FF tunnel headers
636 	 *   - 14: 1 802.3 FF tunnel header (mbuf already accounts for 2nd)
637 	 */
638 	framelen = m1->m_pkthdr.len + 32 +
639 	    ATH_FF_MAX_HDR_PAD + ATH_FF_MAX_SEP_PAD + ATH_FF_MAX_HDR;
640 	if (vap->iv_flags & IEEE80211_F_PRIVACY)
641 		framelen += 24;
642 	if (m2 != NULL)
643 		framelen += m2->m_pkthdr.len;
644 	return ieee80211_compute_duration(ic->ic_rt, framelen, ni->ni_txrate, 0);
645 }
646 
647 /*
648  * Check if the supplied frame can be partnered with an existing
649  * or pending frame.  Return a reference to any frame that should be
650  * sent on return; otherwise return NULL.
651  */
652 struct mbuf *
653 ieee80211_ff_check(struct ieee80211_node *ni, struct mbuf *m)
654 {
655 	struct ieee80211vap *vap = ni->ni_vap;
656 	struct ieee80211com *ic = ni->ni_ic;
657 	struct ieee80211_superg *sg = ic->ic_superg;
658 	const int pri = M_WME_GETAC(m);
659 	struct ieee80211_stageq *sq;
660 	struct ieee80211_tx_ampdu *tap;
661 	struct mbuf *mstaged;
662 	uint32_t txtime, limit;
663 
664 	/*
665 	 * Check if the supplied frame can be aggregated.
666 	 *
667 	 * NB: we allow EAPOL frames to be aggregated with other ucast traffic.
668 	 *     Do 802.1x EAPOL frames proceed in the clear? Then they couldn't
669 	 *     be aggregated with other types of frames when encryption is on?
670 	 */
671 	tap = &ni->ni_tx_ampdu[pri];
672 	mstaged = tap->txa_private;		/* NB: we reuse AMPDU state */
673 	ieee80211_txampdu_count_packet(tap);
674 
675 	/*
676 	 * When not in station mode never aggregate a multicast
677 	 * frame; this insures, for example, that a combined frame
678 	 * does not require multiple encryption keys.
679 	 */
680 	if (vap->iv_opmode != IEEE80211_M_STA &&
681 	    ETHER_IS_MULTICAST(mtod(m, struct ether_header *)->ether_dhost)) {
682 		/* XXX flush staged frame? */
683 		return m;
684 	}
685 	/*
686 	 * If there is no frame to combine with and the pps is
687 	 * too low; then do not attempt to aggregate this frame.
688 	 */
689 	if (mstaged == NULL &&
690 	    ieee80211_txampdu_getpps(tap) < ieee80211_ffppsmin) {
691 		return m;
692 	}
693 	sq = &sg->ff_stageq[pri];
694 	/*
695 	 * Check the txop limit to insure the aggregate fits.
696 	 */
697 	limit = IEEE80211_TXOP_TO_US(
698 		ic->ic_wme.wme_chanParams.cap_wmeParams[pri].wmep_txopLimit);
699 	if (limit != 0 &&
700 	    (txtime = ff_approx_txtime(ni, m, mstaged)) > limit) {
701 		/*
702 		 * Aggregate too long, return to the caller for direct
703 		 * transmission.  In addition, flush any pending frame
704 		 * before sending this one.
705 		 */
706 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
707 		    "%s: txtime %u exceeds txop limit %u\n",
708 		    __func__, txtime, limit);
709 
710 		tap->txa_private = NULL;
711 		if (mstaged != NULL)
712 			stageq_remove(sq, mstaged);
713 
714 		if (mstaged != NULL) {
715 			IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
716 			    "%s: flush staged frame", __func__);
717 			/* encap and xmit */
718 			ff_transmit(ni, mstaged);
719 		}
720 		return m;		/* NB: original frame */
721 	}
722 	/*
723 	 * An aggregation candidate.  If there's a frame to partner
724 	 * with then combine and return for processing.  Otherwise
725 	 * save this frame and wait for a partner to show up (or
726 	 * the frame to be flushed).  Note that staged frames also
727 	 * hold their node reference.
728 	 */
729 	if (mstaged != NULL) {
730 		tap->txa_private = NULL;
731 		stageq_remove(sq, mstaged);
732 
733 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
734 		    "%s: aggregate fast-frame", __func__);
735 		/*
736 		 * Release the node reference; we only need
737 		 * the one already in mstaged.
738 		 */
739 		KASSERT(mstaged->m_pkthdr.rcvif == (void *)ni,
740 		    ("rcvif %p ni %p", mstaged->m_pkthdr.rcvif, ni));
741 		ieee80211_free_node(ni);
742 
743 		m->m_nextpkt = NULL;
744 		mstaged->m_nextpkt = m;
745 		mstaged->m_flags |= M_FF; /* NB: mark for encap work */
746 	} else {
747 		KASSERT(tap->txa_private == NULL,
748 		    ("txa_private %p", tap->txa_private));
749 		tap->txa_private = m;
750 
751 		stageq_add(sq, m);
752 		sg->ff_stageqdepth++;
753 
754 		IEEE80211_NOTE(vap, IEEE80211_MSG_SUPERG, ni,
755 		    "%s: stage frame, %u queued", __func__, sq->depth);
756 		/* NB: mstaged is NULL */
757 	}
758 	return mstaged;
759 }
760 
761 void
762 ieee80211_ff_node_init(struct ieee80211_node *ni)
763 {
764 	/*
765 	 * Clean FF state on re-associate.  This handles the case
766 	 * where a station leaves w/o notifying us and then returns
767 	 * before node is reaped for inactivity.
768 	 */
769 	ieee80211_ff_node_cleanup(ni);
770 }
771 
772 void
773 ieee80211_ff_node_cleanup(struct ieee80211_node *ni)
774 {
775 	struct ieee80211com *ic = ni->ni_ic;
776 	struct ieee80211_superg *sg = ic->ic_superg;
777 	struct ieee80211_tx_ampdu *tap;
778 	struct mbuf *m, *head;
779 	int ac;
780 
781 	head = NULL;
782 	for (ac = 0; ac < WME_NUM_AC; ac++) {
783 		tap = &ni->ni_tx_ampdu[ac];
784 		m = tap->txa_private;
785 		if (m != NULL) {
786 			tap->txa_private = NULL;
787 			stageq_remove(&sg->ff_stageq[ac], m);
788 			m->m_nextpkt = head;
789 			head = m;
790 		}
791 	}
792 
793 	for (m = head; m != NULL; m = m->m_nextpkt) {
794 		m_freem(m);
795 		ieee80211_free_node(ni);
796 	}
797 }
798 
799 /*
800  * Switch between turbo and non-turbo operating modes.
801  * Use the specified channel flags to locate the new
802  * channel, update 802.11 state, and then call back into
803  * the driver to effect the change.
804  */
805 void
806 ieee80211_dturbo_switch(struct ieee80211vap *vap, int newflags)
807 {
808 	struct ieee80211com *ic = vap->iv_ic;
809 	struct ieee80211_channel *chan;
810 
811 	chan = ieee80211_find_channel(ic, ic->ic_bsschan->ic_freq, newflags);
812 	if (chan == NULL) {		/* XXX should not happen */
813 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
814 		    "%s: no channel with freq %u flags 0x%x\n",
815 		    __func__, ic->ic_bsschan->ic_freq, newflags);
816 		return;
817 	}
818 
819 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
820 	    "%s: %s -> %s (freq %u flags 0x%x)\n", __func__,
821 	    ieee80211_phymode_name[ieee80211_chan2mode(ic->ic_bsschan)],
822 	    ieee80211_phymode_name[ieee80211_chan2mode(chan)],
823 	    chan->ic_freq, chan->ic_flags);
824 
825 	ic->ic_bsschan = chan;
826 	ic->ic_prevchan = ic->ic_curchan;
827 	ic->ic_curchan = chan;
828 	ic->ic_rt = ieee80211_get_ratetable(chan);
829 	ic->ic_set_channel(ic);
830 	ieee80211_radiotap_chan_change(ic);
831 	/* NB: do not need to reset ERP state 'cuz we're in sta mode */
832 }
833 
834 /*
835  * Return the current ``state'' of an Atheros capbility.
836  * If associated in station mode report the negotiated
837  * setting. Otherwise report the current setting.
838  */
839 static int
840 getathcap(struct ieee80211vap *vap, int cap)
841 {
842 	if (vap->iv_opmode == IEEE80211_M_STA &&
843 	    vap->iv_state == IEEE80211_S_RUN)
844 		return IEEE80211_ATH_CAP(vap, vap->iv_bss, cap) != 0;
845 	else
846 		return (vap->iv_flags & cap) != 0;
847 }
848 
849 static int
850 superg_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
851 {
852 	switch (ireq->i_type) {
853 	case IEEE80211_IOC_FF:
854 		ireq->i_val = getathcap(vap, IEEE80211_F_FF);
855 		break;
856 	case IEEE80211_IOC_TURBOP:
857 		ireq->i_val = getathcap(vap, IEEE80211_F_TURBOP);
858 		break;
859 	default:
860 		return ENOSYS;
861 	}
862 	return 0;
863 }
864 IEEE80211_IOCTL_GET(superg, superg_ioctl_get80211);
865 
866 static int
867 superg_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
868 {
869 	switch (ireq->i_type) {
870 	case IEEE80211_IOC_FF:
871 		if (ireq->i_val) {
872 			if ((vap->iv_caps & IEEE80211_C_FF) == 0)
873 				return EOPNOTSUPP;
874 			vap->iv_flags |= IEEE80211_F_FF;
875 		} else
876 			vap->iv_flags &= ~IEEE80211_F_FF;
877 		return ENETRESET;
878 	case IEEE80211_IOC_TURBOP:
879 		if (ireq->i_val) {
880 			if ((vap->iv_caps & IEEE80211_C_TURBOP) == 0)
881 				return EOPNOTSUPP;
882 			vap->iv_flags |= IEEE80211_F_TURBOP;
883 		} else
884 			vap->iv_flags &= ~IEEE80211_F_TURBOP;
885 		return ENETRESET;
886 	default:
887 		return ENOSYS;
888 	}
889 	return 0;
890 }
891 IEEE80211_IOCTL_SET(superg, superg_ioctl_set80211);
892