MFC r344990:
Fix ieee80211_radiotap(9) usage in wireless drivers:

- Alignment issues:
* Add missing __packed attributes + padding across all drivers; in
most places there was an assumption that padding will be always
minimally suitable; in few places - e.g., in urtw(4) / rtwn(4) -
padding was just missing.
* Add __aligned(8) attribute for all Rx radiotap headers since they can
contain 64-bit TSF timestamp; it cannot appear in Tx radiotap headers, so
just drop the attribute here. Refresh ieee80211_radiotap(9) man page
accordingly.

- Since net80211 automatically updates channel frequency / flags in
ieee80211_radiotap_chan_change() drop duplicate setup for these fields
in drivers.

MFC r343474:
Remove 2GHz channel list copies from wireless drivers.

Wrap ieee80211_add_channel_list_2ghz into another function
which supplies default (1-14) channel list to it and drop
its copies from drivers.

MFC r343541:
Drop some unneeded includes from wireless USB drivers.

MFC r306173:
Add TP-Link Archer T4U (and TPLINK vendor record in usbdevs).

MFC r341786,r342156
urtwn, rsu: add more USB ids (rtwn -> urtwn merge was done manually).

PR: 233638
Submitted by: cezary.sliwa@gmail.com

Revert MFC of r330463 r330462 r330454 r330452 r330451:

These commits have KPI/KBI considerations (or are a result of those that
do). I did not properly take into account these concerns when merging to
a kbi-stable branch.

Requested by: jhb
Pointyhat to: eadler

MFC r311830:

[rsu] add support for the "green" rsu NICs.

They're still a 1T2R NIC, so reuse the same rfconfig and
nstream configuration.

MFC r307158:

net80211: convert all ieee80211_input_mimo*() consumers
to ieee80211_add_rx_params() + drop last (ieee80211_rx_stats) parameter

Note: there is an additional check for ieee80211_get_rx_params()
return value (which does not exist in the original diff).

MFC r306837:

[net80211] extend the ieee80211_rx_stats struct to include more information.

There are a variety of more interesting RX statistics that we should
keep track of but we don't. This is a starting point for adding more
information.

Specifically:

* now the RX rate information and some of the packet status is
passed up;
* The 32 bit or 64 bit TSF is passed up;
* the PHY mode is passed up;
* the "I'm decap'ed AMSDU!" state is passed up;
* number of RX chains is bumped to 4.

This is all mostly a placeholder for getting the data into the RX status
before we pass it up to net80211 - unfortunately we don't yet enforce
that drivers provide it, nor do we pass the provided info back up the
stack so anyone can use the data.

We're going to need to use some of this data moving forward.
Notably, now that some hardware can do AMSDU decap for us (the intel iwm
driver can do it when we flip it on; the ath10k port I'm doing does
it for us) then we need to pass it up through the stack so the duplicate
RX sequence numbers and crypto/IV details don't cause the packet to
be dropped and/or counted against a replay counter.

It's also the beginning of being able to do more interesting node
accounting in net80211. Specifically, once drivers start populating
per-packet rate information, AMPDU information, timestamps, etc,
we can start providing histograms of rate-versus-RSSI, account
for receive time spent per node and other such interesting things.

(Note: I'm also hoping to include ranging and RTT information for
future chipset support; and it's likely going to include it in
this kind of fashion.)

MFC r321722:
Properly range check length of parsed information elements in RSU driver.

Found by: Ilja van Sprundel <ivansprundel@ioactive.com>
Sponsored by: Mellanox Technologies

MFC r311105:
rsu: restore 40Mhz channel support.

MFC r306320:

rsu: do not restart calibration task when going out of RUN state.

Clear 'sc_calibrating' flag and stop calibration task when interface
is not associated; this fixes possible panic after detach.

Reported and tested by: hselasky
Reviewed by: adrian

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

urtwn, rtwn, rsu: switch to ieee80211_add_channel_list_2ghz().

- Use device's channel list instead of default one (from
ieee80211_init_channels()); adds 12 - 14 2GHz channels.
- Add ic_getradiocaps() method.

net80211 + drivers: hide size of 'bands' array behind a macro.

Auto-replace 'howmany(IEEE80211_MODE_MAX, 8)' with 'IEEE80211_MODE_BYTES'.
No functional changes.

[rsu] We don't do A-MPDU transmit right now, so don't bother registering
for it.

These files were getting sys/malloc.h and vm/uma.h with header pollution
via sys/mbuf.h

net80211 drivers: fix ieee80211_init_channels() usage

Fix out-of-bounds read (all) / write (11n capable) for drivers
that are using ieee80211_init_channels() to initialize channel list.

Tested with:
* RTL8188EU, STA mode.
* RTL8188CUS, STA mode.
* WUSB54GC, HOSTAP mode.

Approved by: adrian (mentor)
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D4818

Create a USB_PNP_INFO and use it to export the existing PNP
tables. Some drivers needed some slight re-arrangement of declarations
to accommodate this. Change the USB pnp tables slightly to allow
better compatibility with the system by moving linux driver info from
start of each entry to the end. All other PNP tables in the system
have the per-device flags and such at the end of the elements rather
that at the beginning.

Differential Review: https://reviews.freebsd.org/D3458

net80211: move ieee80211_free_node() call on error from ic_raw_xmit() to ieee80211_raw_output().

This doesn't free the mbuf upon error; the driver ic_raw_xmit method is still
doing that.

Submitted by: <s3erios@gmail.com>
Differential Revision: https://reviews.freebsd.org/D3774

modify the rssi logic a bit to actually return a useful rssi.

The fullmac firmware doesn't seem to populate a useful rssi indicator
in the RX descriptor, so if one plotted said values, they'd basically
look like garbage.

The reference driver implements a "get current rssi" firmware command
which I guess is really meant for station operation only (as hostap
operation would need rssi per station, not a single firmware read.)

So:

* populate sc_currssi during each calibration run;
* use this in the RX path instead of trying to reconstruct the RSSI
value and passing it around as a pointer;
* do up a quick hack to map the rssi hardware value to some useful
signal level;
* the survey results provide an RSSI value between 0..100, so just
do another quick hack to map it into some usefulish signal level;
* supply a faked noise floor - I haven't yet found how to pull it
out of the firmware.

The scan results and the station RSSI information is now more useful
for indicating signal strength / distance.

rsu(4): Add support for 1T2R and 2T2R NICs.

This logic is mostly crimed from the reference driver and the linux
r92su driver.

I verified that it (a) worked on the rsu hardware I have, and (b)
did traffic testing whilst watching what ath(4) sent as a hostap.
It successfully sent MCS8..15 rates (which requires 2-stream reception)
as well as MCS0..7 (which is 1-stream.)

Tested:

* RTL8712, 1T1R NIC, MCS rates 0..7.
* RTL8712, 1T2R NIC, MCS rates 0..15

TODO:

* Find a 2T2R NIC!

include opt_wlan.h . Tsk adrian.

Free the TX/RX list buffers /before/ tearing down net80211 state.

Otherwise buffers in the RX queue get freed with their parent vap
being gone and you end up with a juicy kernel panic.

* Add 11n HT40 support - i needed to send both HTINFO and HTCAP fields
in the join message so the firmware would pick it up.

* Strip out the direct hardware fiddling for 40MHz mode - the firmware
we're using doesn't require it (the rtl8712su firmware does; it
is less 'fullmac' than what we're using.)

* Fix the mbuf handling during errors - rsu_tx shouldn't free mbufs;
it's up to the caller to do so. This brings it in line with
what other drivers do or should be doing.

Tested:

* RTL8712, HT40 channel, STA mode (during this commit)

Send a power command to the firmware to shut down the radio as well
during rsu_stop().

Begin fleshing out basic power-on / power-off and A-MPDU TX support.

* Add a new method to control NIC poweron / network-sleep / power off;
* Add in A-MPDU TX negotiation support, but comment it out because it
does break TX traffic;
* blank out the tx buffer before sending a firmware message, just in case;
* go into network-sleep once associated;

TODO:

* figure out why ampdu negotiation isn't working and breaking TX traffic,
then enable it.

Flip on 11n by default; update TODO items.

Convert if_rsu to use a deferred transmit task rather than using rsu_start()
to do it directly.

Ensure that we re-queue starting transmit upon TX completion.

This solves two issues:

* It stops tx stalls - before this, if the transmit path filled the
mbuf queue then it'd never start another transmit.

* It enforces ordering - this is very required for 802.11n which
requires frames to be transmitted in the order they're queued.
Since everything remotely involved in USB has an unlock/thing/relock
pattern with that mutex, the only way to guarantee TX ordering is
to 100% defer it into a separate thread.

This now survives an iperf test and gets a reliable 30mbit/sec.

Drain the mbuf queue upon rsu_stop().

Correctly (I hope!) remove net80211 references before doing so.
Just doing a dumb mbufq drain isn't enough.

If enough traffic occurs and the mbuf queue fills up then transmit
stalls (which I'm not fixing in this commit!) but then the mbuf queue
stays full until the driver is removed. There's also the net80211
node refcounting leak.

This just ensures that during rsu_stop and detach the mbuf queue
is purged (and references!) so the queue-full situation can be
recovered from.

Disable HT40 in if_rsu for now. There's something missing in the HT40
setup pieces and so (at least) transmit doesn't work.

It'll just fall back to being a straight HT20 device and negotiate
HT20 only.

Tested by: Idwer Vollering <vidwer@gmail.com>

Add in a temporary (hah!) workaround for net80211 scanning versus NIC
requirements.

Don't start the opmode and join path until a pending survey is finished.
This seems to reliably fix things.

Ideally I'd just finish off the net80211 pluggable scan stuff and implement
the methods here so if_rsu can just drive the scan machinery.
However, that's a .. later thing.

Whilst here, remove the getbuf debugging; it's okay to run out of transmit
buffers under load; it however isn't okay to not be able to send commands.
I'll fix that later.

Refactor out the tx buffer free code into a routine, rsu_freebuf().

This makes it easier to add more transmit buffers, have different buffer
pools for things, etc.

Set AMPDU density/size parameters during vap creation.

Inspired from: Linux r92su

Add a very hacked up station only A-MPDU negotiation path.

This is enough to set things up; there are still lots of retransmits
seen but it's enough to get things working.

Add initial 11n support to if_rsu.

* Add a tunable to enable 11n if it's available, so to not anger people
who upgrade.

kenv hw.usb.rsu.enable_11n=1 before inserting the device.

* Add initial 11n htconfig bits;
* Enable 40MHz mode if it's available;
* Add 11n channels;
* Set 11n bits in the firmware.

It works for RX; I haven't tested TX aggregation just yet.
However the firmware doesn't do RX re-ordering, so I have to tie it into
the net80211 A-MPDU RX reorder path before I flip this on by default.

I've verified that I'm indeed actually seeing MCS 0->7 rates being received.
I haven't dug into whether it's actually transmitting 11n rates; I'll dig into
that later.

.. oops, flip on QoS.

Bring over the QoS logic from the Linux r92su driver.

* the tx descriptor TID is priority, not TID.
* the tx descriptor queue id mapping is separate from the
TID/priority; rather than just "BE".

TODO:

* go and re-re-re-verify the queue mappings; the linux and openbsd
mappings aren't exactly the same. I need to verify all of this
before I try to flip on 11n RX.

Program the firmware setup stuff with the current hardware setup:

* Do 1T1R for now, until we read the config out of ROM and use it.
* Disable turbo mode, I dunno what this is, but the linux drivers
have this disabled.
* Set the firmware endpoints to what we read from USB.

Tested:

* RTL8712 cut 3, STA mode

Use the H2C endpoint for sending firmware commands, rather than the voice
data queues.

This is similar to the openbsd and rtlwifi/r92su drivers.

Note: this driver still assumes it's a 4-endpoint device; I'll enforce
that in a follow-up commit.

Add 11n and QoS methods.

The firmware takes care of ampdu tx/rx (except for RX reordering, grr),
QoS/WME and other bits/pieces. So they're stubs, just in case.

Prepare for 11n - get the number of endpoints and whether 11n is available.

Use DELAY() rather than usb_pause_mtx() - the latter releases the lock
before waiting, which prevents the lock from really acting like
a hardware serialiser. Sigh.

Replace the scan event input path hack with the new rx-stats based method.
This allows for arbitrary channel info to be placed in the input call rather
than the totally gross hack of overriding ic_curchan.

Without this I'm sure ic_curchan setting was racing with the scan code
setting the channel itself..

Disable mgmt frame sending in if_rsu.

The firmware in this NIC sends management frames. So far I'm not sure which
ones it handles and which ones it doesn't handle - but this is what openbsd
does.

The association messages are handled by the firmware; the key negotiation
for 802.1x and WPA are done as raw frames, not management frames.

This successfully allows it to associate to my home networks whereas it didn't
work beforehand.

Tested:

* RTL8712, cut 3, STA mode

TODO:

* The firmware does send a join response with a status code; that should be
logged in a more obvious way to assist with debugging. Ie, the firmware
is the thing that is saying "couldn't join, sorry!", not net80211.

Add RSSI logging to the event survey results.

After reading the linux driver, document what this bit is doing
(doing a full NIC awake.)

* fiddle with some more of the debugging output
* yes, when a "sta disconnect" message comes through we should, like,
disconnect things. We're not currently generating beacon miss messages,
and net80211 isn't disconnecting things via software beacon miss receive.

Tested:

* RTL8712, cut 3, STA mode

if_rsu debug fixes:

* use an ath/iwn style debug bitmap - it's still global rather than per-device,
but it's better than debug levels
* disable bgscan - it just makes things unstable/unpredictable for now.

Tested:

* if_rsu - RTL8712 cut 3, STA mode

Replay r286410. Change KPI of how device drivers that provide wireless
connectivity interact with the net80211 stack.

Historical background: originally wireless devices created an interface,
just like Ethernet devices do. Name of an interface matched the name of
the driver that created. Later, wlan(4) layer was introduced, and the
wlanX interfaces become the actual interface, leaving original ones as
"a parent interface" of wlanX. Kernelwise, the KPI between net80211 layer
and a driver became a mix of methods that pass a pointer to struct ifnet
as identifier and methods that pass pointer to struct ieee80211com. From
user point of view, the parent interface just hangs on in the ifconfig
list, and user can't do anything useful with it.

Now, the struct ifnet goes away. The struct ieee80211com is the only
KPI between a device driver and net80211. Details:

- The struct ieee80211com is embedded into drivers softc.
- Packets are sent via new ic_transmit method, which is very much like
the previous if_transmit.
- Bringing parent up/down is done via new ic_parent method, which notifies
driver about any changes: number of wlan(4) interfaces, number of them
in promisc or allmulti state.
- Device specific ioctls (if any) are received on new ic_ioctl method.
- Packets/errors accounting are done by the stack. In certain cases, when
driver experiences errors and can not attribute them to any specific
interface, driver updates ic_oerrors or ic_ierrors counters.

Details on interface configuration with new world order:
- A sequence of commands needed to bring up wireless DOESN"T change.
- /etc/rc.conf parameters DON'T change.
- List of devices that can be used to create wlan(4) interfaces is
now provided by net.wlan.devices sysctl.

Most drivers in this change were converted by me, except of wpi(4),
that was done by Andriy Voskoboinyk. Big thanks to Kevin Lo for testing
changes to at least 8 drivers. Thanks to pluknet@, Oliver Hartmann,
Olivier Cochard, gjb@, mmoll@, op@ and lev@, who also participated in
testing.

Reviewed by: adrian
Sponsored by: Netflix
Sponsored by: Nginx, Inc.

Further conversions from ifp->if_softc -> ic_softc.

Revert the wifi ifnet changes until things are more baked and tested.

* 286410
* 286413
* 286416

The initial commit broke a variety of debug and features that aren't
in the GENERIC kernels but are enabled in other platforms.

Change KPI of how device drivers that provide wireless connectivity interact
with the net80211 stack.

Historical background: originally wireless devices created an interface,
just like Ethernet devices do. Name of an interface matched the name of
the driver that created. Later, wlan(4) layer was introduced, and the
wlanX interfaces become the actual interface, leaving original ones as
"a parent interface" of wlanX. Kernelwise, the KPI between net80211 layer
and a driver became a mix of methods that pass a pointer to struct ifnet
as identifier and methods that pass pointer to struct ieee80211com. From
user point of view, the parent interface just hangs on in the ifconfig
list, and user can't do anything useful with it.

Now, the struct ifnet goes away. The struct ieee80211com is the only
KPI between a device driver and net80211. Details:

- The struct ieee80211com is embedded into drivers softc.
- Packets are sent via new ic_transmit method, which is very much like
the previous if_transmit.
- Bringing parent up/down is done via new ic_parent method, which notifies
driver about any changes: number of wlan(4) interfaces, number of them
in promisc or allmulti state.
- Device specific ioctls (if any) are received on new ic_ioctl method.
- Packets/errors accounting are done by the stack. In certain cases, when
driver experiences errors and can not attribute them to any specific
interface, driver updates ic_oerrors or ic_ierrors counters.

Details on interface configuration with new world order:
- A sequence of commands needed to bring up wireless DOESN"T change.
- /etc/rc.conf parameters DON'T change.
- List of devices that can be used to create wlan(4) interfaces is
now provided by net.wlan.devices sysctl.

Most drivers in this change were converted by me, except of wpi(4),
that was done by Andriy Voskoboinyk. Big thanks to Kevin Lo for testing
changes to at least 8 drivers. Thanks to Olivier Cochard, gjb@, mmoll@,
op@ and lev@, who also participated in testing. Details here:

https://wiki.freebsd.org/projects/ifnet/net80211

Still, drivers: ndis, wtap, mwl, ipw, bwn, wi, upgt, uath were not
tested. Changes to mwl, ipw, bwn, wi, upgt are trivial and chances
of problems are low. The wtap wasn't compilable even before this change.
But the ndis driver is complex, and it is likely to be broken with this
commit. Help with testing and debugging it is appreciated.

Differential Revision: D2655, D2740
Sponsored by: Nginx, Inc.
Sponsored by: Netflix

Change three methods in struct ieee80211com, namely ic_updateslot,
ic_update_mcast and ic_update_promisc, to pass pointer to the ieee80211com,
not to the ifnet.

Sponsored by: Netflix
Sponsored by: Nginx, Inc.

Set ic_softc in all 802.11 drivers. Not required right now, but will be
used quite soon.

Sponsored by: Netflix
Sponsored by: Nginx, Inc.

Make net80211 drivers supply their device name to the net80211 layer, so
that the latter doesn't need to go through struct ifnet to get their name.

Sponsored by: Netflix
Sponsored by: Nginx, Inc.

Make a bunch of USB debug SYSCTLs tunable, so that their value(s) can
be set before the USB device(s) are probed.

Make sure an error case exits unlocked.

Submitted by: Dmitry Luhtionov <dmitryluhtionov@gmail.com>
MFC after: 1 week

Add Trendnet TEW-646UBH.

Submitted by: bolshakov_1 at yahoo dot com

Mechanically convert to if_inc_counter().

More RSU fixes:
- Properly align temporary buffer to 32-bit.
- Add an extra parenthesis to make expression clear.
- Range check the association ID received from hardware.

MFC after: 1 week

Fixes for the RSU driver:
- The R92S_TCR register is an 8-bit register. Don't access it like a
16-bit register.
- Disable parsing the delete station event, due to many false events.
- Ensure that there is only one transfer queue for each endpoint, so
that packets transmitted don't get out of order.

MFC after: 1 week

- Give firmware loading more time.

MFC after: 3 days

- Stop transfers when RSU init fails.
- Make sure TX/RX lists don't leak and are only allocated once.
- Fix off-by one transfer index computation.
- Give firmware loading more time.

MFC after: 3 days

- Split transmit queue into one for each type. Apparently there will
be a race when using a single active queue for all transmit types.
- Last argument of usb_pause_mtx() is ticks and not milliseconds.
- Remove unused watchdog.
- Remove some unused fields from the RSU softc structure.
- Workaround usbd_transfer_start() recursion from inside of completion
callback.

MFC after: 3 days

Avoid starting a USB transfer inside the callback function, right
after its been submitted.

MFC after: 3 days

- The DELAY() should not be used in USB drivers.
- The usb_pause_mtx() function takes ticks and not milliseconds as last argument.

MFC after: 3 days

Make sure detach code is executed in all cases. This fixes a panic
when debugging is enabled.

Reported by: Idwer Vollering <vidwer@gmail.com>
MFC after: 3 days

Use m_get2() instead of m_getcl().

Spotted by: glebius

Use m_getcl() instead of MGETHDR/MCLGET macros.

Suggested by: glebius

Replace deprecated M_DONTWAIT with M_NOWAIT.

Rename definition of IEEE80211_FC1_WEP to IEEE80211_FC1_PROTECTED.

The origin of WEP comes from IEEE Std 802.11-1997 where it defines
whether the frame body of MAC frame has been encrypted using WEP
algorithm or not.
IEEE Std. 802.11-2007 changes WEP to Protected Frame, indicates
whether the frame is protected by a cryptographic encapsulation
algorithm.

Reviewed by: adrian, rpaulo

Fix external compiler warning(s). Avoid pointer dereferencing.

Use the real product name for Edimax rsu(4) id.

Check for "ieee80211_vap_setup()" failure in all USB WLAN drivers.

MFC after: 1 week

The r48589 promised to remove implicit inclusion of if_var.h soon. Prepare
to this event, adding if_var.h to files that do need it. Also, include
all includes that now are included due to implicit pollution via if_var.h

Sponsored by: Netflix
Sponsored by: Nginx, Inc.

Cleanup the allocations when the attachment fails.

Unbreak sparc64 LINT. Need to fix this correctly at some point in the future.

Import OpenBSD's rsu(4) WLAN driver.
Support chipsets are the Realtek RTL8188SU, RTL8191SU, and RTL8192SU.

Many thanks to Idwer Vollering for porting/writing the man page and for
testing.

Reviewed by: adrian, hselasky
Obtained from: OpenBSD
Tested by: kevlo, Idwer Vollering <vidwer at gmail.com>