MFC r346073:
urtw(4), otus(4), iwi(4): allow to set non-default MAC address via ifconfig(8)

Was tested with Netgear WG111 v3 (RTL8187B, urtw(4)), STA mode.

MFC r344990:
Fix ieee80211_radiotap(9) usage in wireless drivers:

- Alignment issues:
* Add missing __packed attributes + padding across all drivers; in
most places there was an assumption that padding will be always
minimally suitable; in few places - e.g., in urtw(4) / rtwn(4) -
padding was just missing.
* Add __aligned(8) attribute for all Rx radiotap headers since they can
contain 64-bit TSF timestamp; it cannot appear in Tx radiotap headers, so
just drop the attribute here. Refresh ieee80211_radiotap(9) man page
accordingly.

- Since net80211 automatically updates channel frequency / flags in
ieee80211_radiotap_chan_change() drop duplicate setup for these fields
in drivers.

Revert MFC of r330463 r330462 r330454 r330452 r330451:

These commits have KPI/KBI considerations (or are a result of those that
do). I did not properly take into account these concerns when merging to
a kbi-stable branch.

Requested by: jhb
Pointyhat to: eadler

MFC r307158:

net80211: convert all ieee80211_input_mimo*() consumers
to ieee80211_add_rx_params() + drop last (ieee80211_rx_stats) parameter

Note: there is an additional check for ieee80211_get_rx_params()
return value (which does not exist in the original diff).

MFC r306837:

[net80211] extend the ieee80211_rx_stats struct to include more information.

There are a variety of more interesting RX statistics that we should
keep track of but we don't. This is a starting point for adding more
information.

Specifically:

* now the RX rate information and some of the packet status is
passed up;
* The 32 bit or 64 bit TSF is passed up;
* the PHY mode is passed up;
* the "I'm decap'ed AMSDU!" state is passed up;
* number of RX chains is bumped to 4.

This is all mostly a placeholder for getting the data into the RX status
before we pass it up to net80211 - unfortunately we don't yet enforce
that drivers provide it, nor do we pass the provided info back up the
stack so anyone can use the data.

We're going to need to use some of this data moving forward.
Notably, now that some hardware can do AMSDU decap for us (the intel iwm
driver can do it when we flip it on; the ath10k port I'm doing does
it for us) then we need to pass it up through the stack so the duplicate
RX sequence numbers and crypto/IV details don't cause the packet to
be dropped and/or counted against a replay counter.

It's also the beginning of being able to do more interesting node
accounting in net80211. Specifically, once drivers start populating
per-packet rate information, AMPDU information, timestamps, etc,
we can start providing histograms of rate-versus-RSSI, account
for receive time spent per node and other such interesting things.

(Note: I'm also hoping to include ranging and RTT information for
future chipset support; and it's likely going to include it in
this kind of fashion.)

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

otus: minor catchup with OpenBSD.

Bump the OpenBSD revision tag since the corresponding changes don't
apply to us and drop an unnecessary header.

No functional change.

[otus] implement monitor mode.

* break out the operating mode and rx filter into new functions, rather
than them being hard-coded
* if we're in sniffer mode or not associated, set the BSS MAC to all zero,
rather than relying on a chip reset to do it for us
* add comments about .. how interestingly buggy the chip is.

Tested:

* AR9170 + AR9102, STA+monitor mode

Obtained from: linux carl9170 (general chip workings, constant definitions)

otus: switch to ieee80211_add_channel_list_*()

- Use device's channel list instead of default one
(from ieee80211_init_channels()).
- Sort channels (ieee80211_add_channel_list_* requirement).
- Add ic_getradiocaps() method.

Added channels:
2GHz band: 12, 13 and 14.
5GHz band: 34, 38, 42, 46 and 165.

Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D6145

net80211 + drivers: hide size of 'bands' array behind a macro.

Auto-replace 'howmany(IEEE80211_MODE_MAX, 8)' with 'IEEE80211_MODE_BYTES'.
No functional changes.

net80211: replace internal LE_READ_*/LE_WRITE_* macro with system
le*dec / le*enc functions.

Replace net80211 specific macros with system-wide bytestream
encoding/decoding functions:
- LE_READ_2 -> le16dec
- LE_READ_4 -> le32dec
- LE_WRITE_2 -> le16enc
- LE_WRITE_4 -> le32enc

+ drop ieee80211_input.h include, where it was included for these
operations only.

Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D6030

These files were getting sys/malloc.h and vm/uma.h with header pollution
via sys/mbuf.h

net80211 drivers: fix ieee80211_init_channels() usage

Fix out-of-bounds read (all) / write (11n capable) for drivers
that are using ieee80211_init_channels() to initialize channel list.

Tested with:
* RTL8188EU, STA mode.
* RTL8188CUS, STA mode.
* WUSB54GC, HOSTAP mode.

Approved by: adrian (mentor)
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D4818

net80211: remove hardcoded slot time durations from drivers

- Add IEEE80211_GET_SLOTTIME(ic) macro.
- Use predefined macroses to set slot time.

Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D4044

net80211: WME callback cleanup in various drivers

Since r288350, ic_wme_task() is called via ieee80211_runtask(),
so, any additional deferring from the driver side is not needed.

Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D4072

otus(4) - monitor mode fixes, large-mbuf crash fix

* refactor out the rx filter and operating mode code into a separate
method.
* add some comments about what's left with setting the operating mode
based on what carl9170 does.
* comment out some init from otus_init_mac() - it's no longer needed as
it's always init'ed now.
* add debugging and a missing return around a failure to call m_get2() -
during monitor mode operation I found RXing of frames > 2k, which
fails allocation. I'm sure they're valid (it's configuring 11n RX and
receiving 11n frames even though the driver doesn't "do" 11n)
and may be A-MSDU; but allocations fail and we should handle that
gracefully.

Tested:

* UB82 reference NIC (AR9170 + AR9104 2x2 dual band NIC); STA and
monitor mode operation.

otus(4) - add missing ieee80211_free_node() call.

otus(4) - demagicify register names.

Obtained from: Linux carl9170 hw.h

otus(4): begin supporting raw transmit parameters in otus_tx()

* Add a comment about the parameters I should support, stolen shamelessly
from iwn(4);
* Implement the rate bit for the raw transmit path;
* Print out the host-order versions of each of the transmit bits, so
I have a hope in heck of debugging why things are going wrong.

This still doesn't fix 5GHz in the office but that's likely due to a lot
of other configuration parameters being 2GHz-specific. That'll come next.

Tested:

* AR9170 + AR9103 (2/5GHz) 2x2, 5GHz association

otus(4) - use the local node alloc function so there's space for statistics.

* Use the correct malloc type for node allocation - M_80211_NODE - so
the default node free method in net80211 will work correctly.
* Fix otus_node_alloc() to suit FreeBSD's net80211.
* .. and actually call otus_node_alloc() so there's space for the
per-node tx statistics. Otherwise, well, it will be scribbling over
random memory.

Tested:

* AR9170, STA mode

otus(4) - add initial monitor mode; use lowest rate for EAPOL

The monitor mode stuff is from the openbsd driver, but it doesn't
100% work. It doesn't seem to get all frames for all BSSes.
However, it's enough to at start debugging things. That 0xffffffff
write is /I think/ the RX filter, but I am still not 100% sure about
it all.

Then, whilst here, use the lowest rate for EAPOL frames. This is just
generally a good thing to do.

net80211 drivers: eliminate any references to sc_rxtap_len/sc_txtap_len (never used here)

Submitted by: <s3erios@gmail.com>
Differential Revision: https://reviews.freebsd.org/D3776

net80211: move ieee80211_free_node() call on error from ic_raw_xmit() to ieee80211_raw_output().

This doesn't free the mbuf upon error; the driver ic_raw_xmit method is still
doing that.

Submitted by: <s3erios@gmail.com>
Differential Revision: https://reviews.freebsd.org/D3774

if_otus fixes; add fast-frames support.

Fast-frames:

* include opt_wlan.h ; tsk to not doing it earlier;
* add a tx pending tracking counter for seeing how deep
the hardware TX queue is;
* add the frame aging code from if_ath;
* add fast-frames capability to the driver setup.

Bugs:

* free the buffers (and node references) before
detaching net80211 state. This prevents a use-after-free in
the node free path where we've destroyed net80211 underneath it.

Track the command response code buffer size and verify it in the
receive path.

Fix a bug in the TX command handling - log when a too-large payload is
sent, and fix a bug I found when doing so.

Add an initial driver for the AR9170 series draft-11n hardware from
Atheros.

Thanks to OpenBSD for providing a driver based on the original
Atheros open source driver circa 2008. This uses the early, pre-carl9170
atheros provided firmware.

It only supports 11bg at the moment. I've not tested it with 11a
(and so the TX rate control logic may be slightly wrong!) so if
you do have the dual-band version of this hardware please do let me know.

Tested:

* AR9170, TP-Link WN821N 2GHz.

TODO:

* Hook this up to a non-module build.