Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC r227293 (by ed):
Mark MALLOC_DEFINEs static that have no corresponding MALLOC_DECLAREs.

This means that their use is restricted to a single C file.

MFC r225941:
Fix an unaligned access issue; tidy up OFDM/DS rate decoding from the PLCP.

This fixes a panic on PPC.

Submitted by: novel
Obtained from: OpenBSD, sys/dev/ic/bwi.c r1.89

MFC r226181:
Update from OpenBSD: Include 0x4402 in the bbp id mapping table used on older devices.

http://bcm-specs.sipsolutions.net/BackPlane agrees.

Obtained from: OpenBSD, sys/dev/ic/bwi.c r1.88

MFC r226182:
Fix an incorrect use of sizeof().

Obtained from: OpenBSD sys/dev/ic/bwi.c r1.87

MFC r228621:
Fix some net80211 enum nits:
- ic_vap_create() uses an ieee80211_opmode argument
- ieee80211_rate2media() takes an ieee80211_phymode argument
- ieee80211_plcp2rate() takes an ieee80211_phytype argument
- cast to enum ieee80211_protmode and ieee80211_roamingmode to silence
compiler warnings

Submitted by: arundel@

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Update the TSF and next-TBTT methods to work for the AR5416 and later NICs.
This is another commit in a series of TDMA support fixes for the 11n NICs.

* Move ath_hal_getnexttbtt() into the HAL; write methods for it.
This returns a timer value in TSF, rather than TU.

* Move ath_hal_getcca() and ath_hal_setcca() into the HAL too, where they
likely now belong.

* Create a new HAL capability: HAL_CAP_LONG_RXDESC_TSF.
The pre-11n NICs write 15 bit TSF snapshots into the RX descriptor;
the AR5416 and later write 32 bit TSF snapshots into the RX descriptor.
* Use the new capability to choose between 15 and 31 bit TSF adjustment
functions in ath_extend_tsf().

* Write ar5416GetTsf64() and ar5416SetTsf64() methods.
ar5416GetTsf64() tries to compensate for TSF changes at the 32 bit boundary.

According to yin, this fixes the TDMA beaconing on 11n chipsets and TDMA
stations can now associate/talk, but there are still issues with traffic
stability which need to be investigated.

The ath_hal_extendtsf() function is also used in RX packet timestamping;
this may improve adhoc mode on the 11n chipsets. It also will affect the
timestamps seen in radiotap frames.

Submitted by: Kang Yin Su <cantona@cantona.net>
Approved by: re (kib)

Fix a missing initialisation of bt_flags when setting up the TDMA beacon.

The AR5212 HAL didn't check this field; timers are enabled a different
way.

The AR5416 HAL however did, and since this field was uninitialised, it had
whatever was on the stack at the time. This lead to "unpredictable"
behaviour.

This allows TDMA to work on the AR5416 and later chipsets.

Thanks to: paradyse@gmail.com
Approved by: re (kib, blanket)

Remove this call, now that I've solved the radar module problem without
needing this particular modification.

It can be called during ath_dfs_radar_enable() and still achieve the
same functionality, so I am.

Approved by: re (kib, blanket)

Introduce some more DFS related hooks, inspired both by local work
and the Atheros reference code.

The radar detection code needs to know what the current DFS domain is.
Since net80211 doesn't currently know this information, it's extracted
from the HAL regulatory domain information.

The specifics:

* add a new ath_dfs API hook, ath_dfs_init_radar_filters(), which
updates the radar filters whenever the regulatory domain changes.
* add HAL_DFS_DOMAIN which describes the currently configured DFS domain .
* add a new HAL internal variable which tracks the currently configured
HAL DFS domain.
* add a new HAL capability, HAL_CAP_DFS_DMN, which returns the currently
configured HAL DFS domain setting.
* update the HAL DFS domain setting whenever the channel setting is
updated.

Since this isn't currently used by any radar code, these should all
be no-ops for existing users.

Obtained from: Atheros
Submitted by: KBC Networks, sibridge
Approved by: re (kib, blanket)

Fix a corner case in RXEOL handling which was likely introduced by yours
truly.

Before 802.11n, the RX descriptor list would employ the "self-linked tail
descriptor" trick which linked the last descriptor back to itself.
This way, the RX engine would never hit the "end" of the list and stop
processing RX (and assert RXEOL) as it never hit a descriptor whose next
pointer was 0. It would just keep overwriting the last descriptor until
the software freed up some more RX descriptors and chained them onto the
end.

For 802.11n, this needs to stop as a self-linked RX descriptor tickles the
block-ack logic into ACK'ing whatever frames are received into that
self-linked descriptor - so in very busy periods, you could end up with
A-MPDU traffic that is ACKed but never received by the 802.11 stack.
This would cause some confusion as the ADDBA windows would suddenly
be out of sync.

So when that occured here, the last descriptor would be hit and the PCU
logic would stop. It would only start again when the RX descriptor list
was updated and the PCU RX engine was re-tickled. That wasn't being done,
so RXEOL would be continuously asserted and no RX would continue.

This patch introduces a new flag - sc->sc_kickpcu - which when set,
signals the RX task to kick the PCU after its processed whatever packets
it can. This way completed packets aren't discarded.

In case some other task gets called which resets the hardware, don't
update sc->sc_imask - instead, just update the hardware interrupt mask
directly and let either ath_rx_proc() or ath_reset() restore the imask
to its former setting.

Note: this bug was only triggered when doing a whole lot of frame snooping
with serial console IO in the RX task. This would defer interrupt processing
enough to cause an RX descriptor overflow. It doesn't happen in normal
conditions.

Approved by: re (kib, blanket)

Disable the RXORN/RXEOL interrupts if RXEOL occurs, preventing an
interrupt storm.

This is easily triggered by flipping on and off tcpdump -y IEEE802_11_RADIO
w/ witness enabled. This causes a whole lot of console IO and when you're
attached to a serial console (eg on my AR7161 embedded board), the RX
interrupt doesn't get called quickly enough and the RX queue fills up.

This wasn't a problem in the past because of the self-linked RX descriptor
trick - the RX would never hit the "end" of the RX descriptor list.
However this isn't possible for 802.11n (see previous commit history for
why.)

Both Linux ath9k and the Atheros reference driver code do this; I'm just
looking now for where they then restart the PCU receive. Right now the RX
will just stop until the interface is reset.

Obtained from: Linux, Atheros
Approved by: re (kib)

Remove two debugging printf()s which snuck in during the testing of the
last commit.

Approved by: re (kib)
Pointy-hat-to: adrian@

Implement the 4KB split transaction workaround for Merlin (AR9280).

The AR9280 apparently has an issue with descriptors which straddle a page
boundary (4k). I'm not yet sure whether I should use PAGE_SIZE in the
calculations or whether I should use 4096; the reference code uses 4096.

This patch fiddles with descriptor allocation so a descriptor entry
doesn't straddle a 4kb address boundary. The descriptor memory allocation
is made larger to contain extra descriptors and then the descriptor
address is advanced to the next 4kb boundary where needed.

I've tested this both on Merlin (AR9280) and non-Merlin (in this case,
AR9160.)

Obtained from: Linux, Atheros
Approved by: re (kib)

This links in the ath dfs ioctl into the driver and defines the
ioctl interface for DFS modules to use.

Since there's no open source dfs code yet, this doesn't introduce any
operational changes.

Approved by: re (kib)

Fix a corner case in STA beacon processing when a CSA is received but
the AP doesn't transmit beacons.

If the AP requests a CSA (ie, a channel switch) and then enters CAC
(channel availability check) for 60 seconds, it doesn't send beacons
and it just listens for radar events (and other things which we don't
do yet.)

Now, ath_newstate() was not resetting the beacon timer config on
a transition to the RUN state when in STA mode - it was setting
sc_syncbeacon, which simply updates the beacon config from the
contents of the next received beacon.

This means the STA never generates beacon miss events.

If the AP goes into CAC for 60 seconds and recovers, the STA will
happily receive the first beacon and reconfigure timers.
But if it gets a radar event after that, it'll change channel
again, not notify the station that it's changed channel..
and since the station is happily waiting for the first beacon
to configure the beacon timer details from, it won't ever
generate a beacon miss interrupt and it'll sit there forever
(or until the AP appears on that channel once again.)

This change forces the last known beacon timer config to be
written to hardware on a transition from CSA->RUN in STA mode.
This forces bmiss events to occur and the STA will eventually
(after a handful of beacon miss events) begin scanning for
another access point.

Fix beacon transmission after a channel set.

The DFS code was tickling the channel set directly whilst going
through the state RUN -> CSA -> RUN. This only changed the channel;
it didn't go via ath_reset(). However in this driver, a channel
change always causes a chip reset, which resets the beacon timer
configuration and interrupt setup. This meant that data would go
out but as the beacon timers never fired, beacons would never
be queued.

The confusing part is that sometimes the state transition was
RUN -> SCAN -> CAC -> RUN (with CSA being in there sometimes);
going via SCAN would clear sc_beacons and thus the transition
to RUN would reprogram beacon transmission.

In case someone tries debugging why suspending a device currently
beaconing (versus just RX'ing beacons which is what occurs in STA
mode), add a silly comment which should hopefully land them at
this commit message. The call to ath_hal_reset() will be clearing
the beacon config and it may not be always reset.

Add ATH_ENABLE_DFS which enables the DFS flag so the DFS code
can be tested.

This doesn't at all actually do radar detection! It's just
so developers who wish to test the net80211 DFS code can easily
do so. Without this flag, the DFS channels are never marked
DFS and thus the DFS stuff doesn't run.

Break out most of the HAL related tweaks into a per-HAL instance,
rather than global variables.

This specifically allows for debugging to be enabled per-NIC, rather
than globally.

Since the ath driver doesn't know about AH_DEBUG, and to keep the ABI
consistent regardless of whether AH_DEBUG is enabled or not, enable the
debug parameter always but only conditionally compile in the debug
methods if needed.

The ALQ support is currently still global pending some brainstorming.

Submitted by: ssgriffonuser@gmail.com
Reviewed by: adrian, bschmidt

Add a missing call to sync the DMAed buffer before the radar event data is extracted.

A few changes to make radar detection implementable in a hal_dfs/
module.

* If sc->sc_dodfs is set to 1 by the ath_dfs_radar_enable(),
set the relevant rx filter bit to begin receiving radar PHY
errors. The HAL code already knows how to set the relevant
error mask register to enable radar events.

* Add a missing call to ath_dfs_radar_enable() after ath_hal_reset()

* change ath_dfs_process_phyerr() to take a const char *buf for now,
rather than a descriptor. This way it can get access to the packet
buffer contents.

Flesh out the radar detection related operations for the ath driver.

This is in no way a complete DFS/radar detection implementation!
It merely creates an abstracted interface which allows for future
development of the DFS radar detection code.

Note: Net80211 already handles the bulk of the DFS machinery,
all we need to do here is figure out that a radar event has occured
and inform it as such. It then drives the DFS state engine for us.

The "null" DFS radar detection module is included by default;
it doesn't require a device line.

This commit:

* Adds a simple abstracted layer for radar detection state -
sys/dev/ath/ath_dfs/;
* Implements a null DFS module which doesn't do anything;
(ie, implements the exact behaviour at the moment);
* Adds hooks to the ath driver to process received radar events
and gives the DFS module a chance to determine whether
a radar has been detected.

Obtained from: Atheros

Set default A-MPDU density/size.

Teach if_ath about devices which have short-GI in 20MHz channel modes.

This has been disabled until now because there hasn't been any supported
device which has this feature. Since the AR9287 is the first device to
support it, and since now the HAL has functional AR9287+11n support,
flip this on.

* Add some more TX descriptor error counters; this'll be helpful when
implementing TX aggregation
* Whilst I'm there, comment some RX error counters

Now that the devices with functioning ps-poll hardware support have
been enumerated (merlin and later), flick this on.

Cosmetic changes to fit 80 character screen width.

Fix a corner-case of interrupt handling which resulted in potentially
spurious (and fatal) interrupt errors.

One user reported seeing this:

Apr 22 18:04:24 ceres kernel: ar5416GetPendingInterrupts: fatal error,
ISR_RAC 0x0 SYNC_CAUSE 0x2000

SYNC_CAUSE of 0x2000 is AR_INTR_SYNC_LOCAL_TIMEOUT which is a bus timeout;
this shouldn't cause HAL_INT_FATAL to be set.

After checking out ath9k, ath9k_ar9002_hw_get_isr() clears (*masked)
before continuing, regardless of whether any bits in the ISR registers
are set. So if AR_INTR_SYNC_CAUSE is set to something that isn't
treated as fatal, and AR_ISR isn't read or is read and is 0, then
(*masked) wouldn't be cleared. Thus any of the existing bits set
that were passed in would be preserved in the output.

The caller in if_ath - ath_intr() - wasn't setting the masked value
to 0 before calling ath_hal_getisr(), so anything that was present
in that uninitialised variable would be preserved in the case above
of AR_ISR=0, AR_INTR_SYNC_CAUSE != 0; and if the HAL_INT_FATAL bit
was set, a fatal condition would be interpreted and the chip was
reset.

This patch does the following:

* ath_intr() - set masked to 0 before calling ath_hal_getisr();
* ar5416GetPendingInterrupts() - clear (*masked) before processing
continues; so if the interrupt source is AR_INTR_SYNC_CAUSE
and it isn't fatal, the hardware isn't reset via returning
HAL_INT_FATAL.

This doesn't fix any underlying errors which trigger
AR_INTR_SYNC_LOCAL_TIMEOUT - which is a bus timeout of some
sort - so that likely should be further investigated.

For now, only enable GTT. CST is firing very frequently during local tests;
I'll figure out what's going on before re-enabling this as it does add
to the interrupt load.

Add TX carrier sense timeout statistics.

Rework the Global TX timeout handling to look more like ath9k.

It correctly now sets the AR_IMR BCNMISC register, along with
the GTT register in AR_IMR_S2.

Add global TX timeout handling.

The global TX timeout counter increments whenever a frame is ready
to be transmitted and the medium is busy.

Add in the AR9285 (Kite) diversity to if_ath, enabling TX/RX antenna
diversity.

This is bit dirty and likely should be revised at a later date,
with an eye to unifying/tidying up the whole diversity setup
and allowing developers to do "tricky stuff" as they desire.
For now, this works.

Add a HAL capability bit for supporting self-linked RX descriptors and disable it for the 11n chipsets.

From the ath9k source:

==

11N: we can no longer afford to self link the last descriptor.
MAC acknowledges BA status as long as it copies frames to host
buffer (or rx fifo). This can incorrectly acknowledge packets
to a sender if last desc is self-linked.

==

Since this is useful for pre-AR5416 chips that communicate PHY errors
via error frames rather than by on-chip counters, leave the support
in there, but disable it for AR5416 and later.

Break out the ath PCI logic into a separate device/module.

Introduce the AHB glue for Atheros embedded systems. Right now it's
hard-coded for the AR9130 chip whose support isn't yet in this HAL;
it'll be added in a subsequent commit.

Kernel configuration files now need both 'ath' and 'ath_pci' devices; both
modules need to be loaded for the ath device to work.

According to ath9k recv.c, one shouldn't be doing self-linked descriptors
in the RX path when doing 11n and block-ack'ed frames. Apparently, the MAC
will loop over that self-linked descriptor and treat it as "good enough"
for (incorrectly!) ACKing the frames in the block-ack.

Until I figure out how to work around this issue in the future, this counter
will tell me if packet RX processing ever gets to the point where it's
touching the self-linked descriptor. If there's ever enough packets to get
to that point, BA's will be invalid and likely very unhappy.

Fix typo.

Rename AH_ENABLE_11N to ATH_ENABLE_11 - the HAL supports 11n by
default but the ath driver doesn't. This is a much more consistent
name.

Add in the hardware PS-POLL frame reception setting, but leave it disabled
by default.

Adventourous souls with an AR9220/AR9280 or later and who have a device
that sends PS-POLL frames may wish to try tinkering with this option and
get back to me.

Enable setting the MCS rate bit for ast_tx_rate.

This allows ath_stats to print the MCS rate when TX'ing.

Flip this over to be a configurable option for people who wish to play with it.

It's still not ready for prime-time - there's some TX niggles with these 11n
cards that I'm still trying to wrap my head around, and AMPDU-TX is just not
implemented so things will come to a crashing halt if you're not careful.

This isn't actually needed any longer, A-MPDU frames work fine if only tagged for 11n nodes.

Break the keycache management functions out into if_ath_keycache.c .

Migrate the sysctl related routines (statistics, debugging, etc) out of
if_ath.c and into if_ath_sysctl.c .

Fix formatting of new stat sysctls; add descriptions

Add a new counter which tracks frames TX'ed with HT protection.

Disable short-GI in 20mhz mode - the hardware doesn't support this.

Some statistics additions - prepare for error codes > 32 (since the AR5416
error mask is > 5 bits) and add some extra CRC/HT40/ShortGI counters to
help debug 802.11n issues.

Add in the (very!) optional glue to flip the 11n bits for if_ath.

There's still a lot of random issues to sort out with the radio side of
things and AMPDU RX handling (and completely missing AMPDU TX handling!)
but if people wish to give this a go and assist in debugging the
issues, they can define ATH_DO_11N to enable it.

I'm just re-iterating - this is here to allow people to assist in
further 11n development; it is not any indication that the 11n support
is complete and functional.

Important notes:

* This doesn't support 1-stream cards yet - (eg AR9285) - the various bits
that negotiate TX/RX MCS don't know not to try >1 stream TX or negotiate
1-stream RX; so don't enable 11n unless you've first taught the rate
control module and the net80211 stack to negotiate 1-stream stuff;

* The only rate control module minimally 11n aware is ath_rate_sample;

* ath_rate_sample doesn't know about HT/40; so airtime will be incorrectly
calculated;

* The AR9160 and AR9280 radio code is unreliable at the higher MCS rates for
some reason; this will definitely impact 11n performance;

* AMPDU-TX isn't yet implemented;

* AMPDU-RX may be a bit buggy still and will definitely suffer from the
radio unreliability mentioned above (ie, don't expect 150/300mbit
RX just yet.)

Fix the keycache behaviour for multicast keycache search.

The correct bit to set is 0x1 in the high MAC address byte, not 0x80.
The hardware isn't programmed with that bit (which is the multicast
adress bit.)

The linux ath9k keycache code uses that bit in the MAC as a "this is
a multicast key!" and doesn't set the AR_KEYTABLE_VALID bit.
This tells the hardware the MAC isn't to be used for unicast destination
matching but it can be used for multicast bssid traffic.

This fixes some encryption problems in station mode.

PR: kern/154598

net80211 really doesn't want A_MPDU to appear on non-11n station node mbufs.
Revert back to the previous method of doing it for where a node can be
identified and it's an 11n node.

I'll have to do some further research into exactly what is being messed up
with the sequence number matching and I'll then revisit this.

Add in a per phy error sysctl.

Just tag all RX packets as needing reorder processing for now.

This fixes two problems -

* All packets need to be processed here, not just aggregate ones - as any
received frames (AMPDU or otherwise) in the given TID (traffic class id)
will update the sequence number and, implied with that, update the window;
* It seems there's situations where packets aren't matching a current node but
somehow need to be tracked. Thus just tag them all for now; I'll figure out
the why later.

Whilst I'm here, bump the stats counters whilst I'm at it.

This fixes AMPDU RX in my tests; the main problems now stem from what look
like PHY level error/retransmits which are impeding general throughput, incl.
AMPDU.

Only tag packets with the A-MPDU bit if they were part of an A-MPDU RX.

Whilst I'm here, add a counter to count said packets.

Oops, fix newbie mistake that breaks the normal build.

Disable the code I previously added from Rui's 802.11n branch.

A-MPDU RX interferes with packet retransmission/reordering.
In local testing, I was seeing A-MPDU being negotiated and then
not used by the AP sending frames to the STA; the STA would then
treat non A-MPDU frames that are retransmits as out of the window
and get plain confused.

The hardware RX status descriptor has a "I'm part of an aggregate"
bit; so this should eventually be tested and then punted to the
A-MPDU reorder handling only if it has this bit set.

Remove the now unneeded XXX.

Enable AMPDU reorder processing and receiving BAR frames when doing 802.11n.

Obtained from: rpaulo@

Migrate the TX path code out of if_ath and into a separate source file.

There's two reasons for this:

* the raw and non-raw TX path shares a lot of duplicate code which should be
refactored;
* the 11n-ready chip TX path needs a little reworking.

Break out the debug macros from if_ath.c into if_ath_debug.[ch] .

This is prep work for breaking out the TX path into a separate
set of source files.

ANI changes #1 - split out the ANI polling from the RxMonitor hook.

The rxmonitor hook is called on each received packet. This can get very,
very busy as the tx/rx/chanbusy registers are thus read each time a packet
is received.

Instead, shuffle out the true per-packet processing which is needed and move
the rest of the ANI processing into a periodic event which runs every 100ms
by default.

Include the initial support for external EEPROMs.

The AR9100 at least doesn't have an external serial EEPROM
attached to the MAC; it instead stores the calibration data
in the normal system flash.

I believe earlier parts can do something similar but I haven't
experienced it first-hand.

This commit introduces an eepromdata pointer into the API but
doesn't at all commit to using it. A future commit will
include the glue needed to allow the AR9100 support code
to use this data pointer as the EEPROM.

Use the now-exposed diag code, rather than a hard-coded magic number.

Break out the diagnostic codes from ah_internal.h and place them in ah_diagcodes.h.

Since we now have the source code, there's no reason to hide the diag codes
from other areas.

They live in the HAL as they form part of the HAL API and should still be treate
as "potentially flexible; don't publish as a public API." But since they're
already used as a public API (see follow-up commit), we may as well use
them in place of magic constants.

Fix up a few more sysctl(9) mis-typing found in various LINT builds.

sysctl(9) cleanup checkpoint: amd64 GENERIC builds cleanly.

Commit the rest of the devices.

Export ath stats via snmp, rather than requiring a debugging interface
and "athstats".

Add a global counter of missed beacons.

The existing missed beacon count is reset once a beacon isn't missed.

Don't delay updating the longcal timer - instead, update the longcal
flag immediately so it's only set once per longcal interval.

Without this, the current AR5416 code will continuously spam NF
calibrations during a periodic calibration if the longcal flag
is set. The longcal flag wouldn't be cleared until the calibration
method indicates that calibrations are "complete".

This drops the rate of NF calibration updates down from "once every
shortcal" (ie, every 100ms) during a periodic calibration, to only
once per "longcal" interval. Spamming NF calibrations every 100ms
caused some potentially horrific issues in noisy environments as
NF calibrations can take longer than 100ms and this spamming can
cause invalid NF calibration results to be read back - leading to
missed beacons, and thus leading to a stuck beacon situation.

Stuck beacons cause interface resets, which restart calibrations.
This means that the longcal calibration runs every 100ms (shortcal)
until all initial calibrations are completed. This spamming can then
cause the above issues which leads to stuck beacons, leading to
interface resets, etc, etc. Quite annoying.

Extend the ath debugging a little to log the interface name.

Some devices have >1 atheros card and the current debug prints
make it impossible to tell which interface is being unhappy.

sc_lastrs is also used in case the sending station is not known, for
example in a split IBSS scenario. Therefore always assign sc_lastrs.
This removes a hack I committed in r206457.

Approved by: rpaulo (mentor)

Add new tunable 'net.link.ifqmaxlen' to set default send interface
queue length. The default value for this parameter is 50, which is
quite low for many of today's uses and the only way to modify this
parameter right now is to edit if_var.h file. Also add read-only
sysctl with the same name, so that it's possible to retrieve the
current value.

MFC after: 1 month

Add WPA-None support:
* WPA-None requires ap_scan=2:
The major difference between ap_scan=1 (default) and 2 is, that no
IEEE80211_IOC_SCAN* ioctls/functions are called, though, there is a
dependency on those. For example the call to wpa_driver_bsd_scan()
sets the interface UP, this never happens, therefore the interface
must be marked up in wpa_driver_bsd_associate(). IEEE80211_IOC_SSID
also is not called, which means that the SSID has not been set prior
to the IEEE80211_MLME_ASSOC call.
* WPA-None has no support for sequence number updates, it doesn't make
sense to check for replay violations..
* I had some crashes right after the switch to RUN state, issue is
that sc->sc_lastrs was not yet defined.

Approved by: rpaulo (mentor)
MFC after: 3 weeks

Correct spelling of reseting (found while researching the "bb hang detected"
messages that are plaguing me). While I'm here, delete trailing whitespace.

Fix typo in comment.

Pointed out by: danfe

Fixing compilation bustage by removing a stray comment fragment.

Add multicast key search support. This fixes corrupted mcast packets
when we have more than one hostap vap.

Submitted by: Russell Yount <russell.yount at gmail.com>
MFC after: 2 weeks

Spell "Hz" correctly wherever it is user-visible.

PR: bin/142566
Submitted by: N.J. Mann njm njm.me.uk
Approved by: ed (mentor)
MFC after: 2 weeks

cardbus -> CardBus

Take a step towards removing if_watchdog/if_timer. Don't explicitly set
if_watchdog/if_timer to NULL/0 when initializing an ifnet. if_alloc()
sets those members to NULL/0 already.

correct typo that was a noop on 32-bit machines but a bug on 64-bit machines

Submitted by: phk

On resume in sta mode program the beacon timers so when roaming (and
the previous ap is no longer in range) the device will deliver bmiss
interrupts and trigger the state machine. Also arrange to sync the
beacon timers on the next received beacon frame so that when we don't
roam we re-synchronize with the ap.

Tested by: trasz
MFC after: 1 week

track whether any mesh vaps are present to correctly setup the rx filter
when, for example, an ap vap is created first

Reviewed by: rpaulo
Approved by: re (kib)

Fix something bogus deletion that got it during mesh commit.

Approved by: re (implicit)

Implementation of the upcoming Wireless Mesh standard, 802.11s, on the
net80211 wireless stack. This work is based on the March 2009 D3.0 draft
standard. This standard is expected to become final next year.
This includes two main net80211 modules, ieee80211_mesh.c
which deals with peer link management, link metric calculation,
routing table control and mesh configuration and ieee80211_hwmp.c
which deals with the actually routing process on the mesh network.
HWMP is the mandatory routing protocol on by the mesh standard, but
others, such as RA-OLSR, can be implemented.

Authentication and encryption are not implemented.

There are several scripts under tools/tools/net80211/scripts that can be
used to test different mesh network topologies and they also teach you
how to setup a mesh vap (for the impatient: ifconfig wlan0 create
wlandev ... wlanmode mesh).

A new build option is available: IEEE80211_SUPPORT_MESH and it's enabled
by default on GENERIC kernels for i386, amd64, sparc64 and pc98.

Drivers that support mesh networks right now are: ath, ral and mwl.

More information at: http://wiki.freebsd.org/WifiMesh

Please note that this work is experimental. Also, please note that
bridging a mesh vap with another network interface is not yet supported.

Many thanks to the FreeBSD Foundation for sponsoring this project and to
Sam Leffler for his support.
Also, I would like to thank Gateworks Corporation for sending me a
Cambria board which was used during the development of this project.

Reviewed by: sam
Approved by: re (kensmith)
Obtained from: projects/mesh11s

Use if_maddr_rlock()/if_maddr_runlock() rather than IF_ADDR_LOCK()/
IF_ADDR_UNLOCK() across network device drivers when accessing the
per-interface multicast address list, if_multiaddrs. This will
allow us to change the locking strategy without affecting our driver
programming interface or binary interface.

For two wireless drivers, remove unnecessary locking, since they
don't actually access the multicast address list.

Approved by: re (kib)
MFC after: 6 weeks

purge HAL_TXSTAT_ALTRATE; you can figure this out by checking ts_finaltsi
and it cannot be used with MCS rate codes

treat IEEE80211_S_CSA as a "running state"; this fixes
ap mode 11h channel switch announcements

improve raw xmit failure handling

count frag tx failures as an ifnet error

fix comment

restart tdma beacons after vap destroy

Overhaul monitor mode handling:
o replace DLT_IEEE802_11 support in net80211 with DLT_IEEE802_11_RADIO
and remove explicit bpf support from wireless drivers; drivers now
use ieee80211_radiotap_attach to setup shared data structures that
hold the radiotap header for each packet tx/rx
o remove rx timestamp from the rx path; it was used only by the tdma support
for debugging and was mostly useless due to it being 32-bits and mostly
unavailable
o track DLT_IEEE80211_RADIO bpf attachments and maintain per-vap and
per-com state when there are active taps
o track the number of monitor mode vaps
o use bpf tap and monitor mode vap state to decide when to collect radiotap
state and dispatch frames; drivers no longer explicitly directly check
bpf state or use bpf calls to tap frames
o handle radiotap state updates on channel change in net80211; drivers
should not do this (unless they bypass net80211 which is almost always
a mistake)
o update various drivers to be more consistent/correct in handling radiotap
o update ral to include TSF in radiotap'd frames
o add promisc mode callback to wi

Reviewed by: cbzimmer, rpaulo, thompsa

optimize ath_tx_findrix: there's no need to walk the rates table as
sc_rixmap is an inverse map

NB: could eliminate the check for an invalid rate by filling in 0 for
invalid entries but the rate control modules use it to identify
bogus rates so leave it for now

o cleanup checks for which vap combinations are permitted and what to
use for ic_opmode
o fixes the case where creating ahdemo+wds vaps caused ic_opmode to be
set to hostap

make superg/fast-frames state dynamically-allocated (and indirect off
the com structure instead of embedded); this reduces the overhead when
not configured and reduces visibility of the contents

don't use caddr_t to match ieee80211_dump_pkt type; supplying the correct
one costs nothing

o fix dynamic slave-side tdma slot length updating: we need to re-setup the
burst length in the tx q's
o remove re-config of the beaconq on update; it's not needed

remove reference to sc_tdmabintcnt; it was removed in r190848

Hoist 802.11 encapsulation up into net80211:
o call ieee80211_encap in ieee80211_start so frames passed down to drivers
are already encapsulated
o remove ieee80211_encap calls in drivers
o fixup wi so it recreates the 802.3 head it requires from the 802.11
header contents
o move fast-frame aggregation from ath to net80211 (conditional on
IEEE80211_SUPPORT_SUPERG):
- aggregation is now done in ieee80211_start; it is enabled when the
packets/sec exceeds ieee80211_ffppsmin (net.wlan.ffppsmin) and frames
are held on a staging queue according to ieee80211_ffagemax
(net.wlan.ffagemax) to wait for a frame to combine with
- drivers must call back to age/flush the staging queue (ath does this
on tx done, at swba, and on rx according to the state of the tx queues
and/or the contents of the staging queue)
- remove fast-frame-related data structures from ath
- add ieee80211_ff_node_init and ieee80211_ff_node_cleanup to handle
per-node fast-frames state (we reuse 11n tx ampdu state)
o change ieee80211_encap calling convention to include an explicit vap
so frames coming through a WDS vap are recognized w/o setting M_WDS

With these changes any device able to tx/rx 3Kbyte+ frames can use fast-frames.

Reviewed by: thompsa, rpaulo, avatar, imp, sephe

Remove ATH_SUPPORT_TDMA and use IEEE80211_SUPPORT_TDMA instead. It
doesn't make much sense to configure driver support w/o net80211.
Note this means ath now depends on opt_wlan.h.

Eliminate ic_myaddr so changing the mac address of a device works correctly:
o remove ic_myaddr from ieee80211com
o change ieee80211_ifattach to take the mac address of the physical device
and use that to setup the lladdr.
o replace all references to ic_myaddr in drivers by IF_LLADDR
o related cleanups (e.g. kill dead code)

PR: kern/133178
Reviewed by: thompsa, rpaulo

purge hal abi support; now that the hal is merged w/ the driver
we cannot be out of sync

MFC after: 1 week

Minor cleanups of tdma protocol handling:
o break out version-related code to simplify rev'ing the protocol
o add parameter validation macros so checks that appear multiple places
are consistent (and easy to change)
o add protocol version check when looking for a scan candidate
o improve scan debug output format
o rewrite beacon update handling to calculate a bitmask of changed values
and pass that down through the driver callback so drivers can optimize work
o do slot bounds check before use when parsing received beacons

replace if_watchdog w/ private callout; probably can merge this with the
calibration work sometime in the future

add a sysctl to ena/dis frobbing cca

5416 and later parts mux the gpio outputs; extend the api to include
a signal type that's used to select the appropriate mux

print mac+rf part names; drop the printing 2ghz rf stuff (might come back)

remove private support for IEEE80211_MODE_HALF and IEEE80211_MODE_QUARTER
now that net80211 has them

add SIOCZATHSTATS ioctl to zero driver statistics

add driver stat to count tx drops due to insufficient frag buffers

don't do phantom beacon miss checking for s/w beacon miss handling,
this can mistakenly drop events that cause the s/w bmiss timer to
never get re-armed

mark the CLR key installed for open auth stations such that it is reclaimed
when net80211 tears down station state; without this we leak keycache slots

add hw.ath.bstuck to control the stuck beacon threshold

on resume ah_curchan may be NULL if no channel change has been done;
workaround this by passing net80211's channel as we know it'll never
be null

Submitted by: trasz

count stuck beacon events

Minor packet drop improvements:
o change tdma packet drop msg when ack required to ATH_DEBUG_TDMA
(ATH_DEBUG_XMIT is too noisy)
o add a debug msg for raw packet drop due to interface down/invalid
o add stats for these two cases
o explain how another drop case is handled

Overhaul regulatory support:
o remove HAL_CHANNEL; convert the hal to use net80211 channels; this
mostly involves mechanical changes to variable names and channel
attribute macros
o gut HAL_CHANNEL_PRIVATE as most of the contents are now redundant
with the net80211 channel available
o change api for ath_hal_init_channels: no more reglass id's, no more outdoor
indication (was a noop), anM contents
o add ath_hal_getchannels to have the hal construct a channel list without
altering runtime state; this is used to retrieve the calibration list for
the device in ath_getradiocaps
o add ath_hal_set_channels to take a channel list and regulatory data from
above and construct internal state to match (maps frequencies for 900MHz
cards, setup for CTL lookups, etc)
o compact the private channel table: we keep one private channel
per frequency instead of one per HAL_CHANNEL; this gives a big
space savings and potentially improves ani and calibration by
sharing state (to be seen; didn't see anything in testing); a new config
option AH_MAXCHAN controls the table size (default to 96 which
was chosen to be ~3x the largest expected size)
o shrink ani state and change to mirror private channel table (one entry per
frequency indexed by ic_devdata)
o move ani state flags to private channel state
o remove country codes; use net80211 definitions instead
o remove GSM regulatory support; it's no longer needed now that we
pass in channel lists from above
o consolidate ADHOC_NO_11A attribute with DISALLOW_ADHOC_11A
o simplify initial channel list construction based on the EEPROM contents;
we preserve country code support for now but may want to just fallback
to a WWR sku and dispatch the discovered country code up to user space
so the channel list can be constructed using the master regdomain tables
o defer to net80211 for max antenna gain
o eliminate sorting of internal channel table; now that we use ic_devdata
as an index, table lookups are O(1)
o remove internal copy of the country code; the public one is sufficient
o remove AH_SUPPORT_11D conditional compilation; we always support 11d
o remove ath_hal_ispublicsafetysku; not needed any more
o remove ath_hal_isgsmsku; no more GSM stuff
o move Conformance Test Limit (CTL) state from private channel to a lookup
using per-band pointers cached in the private state block
o remove regulatory class id support; was unused and belongs in net80211
o fix channel list construction to set IEEE80211_CHAN_NOADHOC,
IEEE80211_CHAN_NOHOSTAP, and IEEE80211_CHAN_4MSXMIT
o remove private channel flags CHANNEL_DFS and CHANNEL_4MS_LIMIT; these are
now set in the constructed net80211 channel
o store CHANNEL_NFCREQUIRED (Noise Floor Required) channel attribute in one
of the driver-private flag bits of the net80211 channel
o move 900MHz frequency mapping into the hal; the mapped frequency is stored
in the private channel and used throughout the hal (no more mapping in the
driver and/or net80211)
o remove ath_hal_mhz2ieee; it's no longer needed as net80211 does the
calculation and available in the net80211 channel
o change noise floor calibration logic to work with compacted private channel
table setup; this may require revisiting as we no longer can distinguish
channel attributes (e.g. 11b vs 11g vs turbo) but since the data is used
only to calculate status data we can live with it for now
o change ah_getChipPowerLimits internal method to operate on a single channel
instead of all channels in the private channel table
o add ath_hal_gethwchannel to map a net80211 channel to a h/w frequency
(always the same except for 900MHz channels)
o add HAL_EEBADREG and HAL_EEBADCC status codes to better identify regulatory
problems
o remove CTRY_DEBUG and CTRY_DEFAULT enum's; these come from net80211 now
o change ath_hal_getwirelessmodes to really return wireless modes supported
by the hardware (was previously applying regulatory constraints)
o return channel interference status with IEEE80211_CHANSTATE_CWINT (should
change to a callback so hal api's can take const pointers)
o remove some #define's no longer needed with the inclusion of
<net80211/_ieee80211.h>

Sponsored by: Carlson Wireless

change ic_getradiocaps driver callback to include the max # channels
so callers know the size of the array passed down

don't run the calibration code if scanning, we won't be on the home channel

TDMA support for long distance point-to-point links using ath devices:
o add net80211 support for a tdma vap that is built on top of the
existing adhoc-demo support
o add tdma scheduling of frame transmission to the ath driver; it's
conceivable other devices might be capable of this too in which case
they can make use of the 802.11 protocol additions etc.
o add minor bits to user tools that need to know: ifconfig to setup and
configure, new statistics in athstats, and new debug mask bits

While the architecture can support >2 slots in a TDMA BSS the current
design is intended (and tested) for only 2 slots.

Sponsored by: Intel

honor IEEE80211_BPF_CRYPTO for raw xmit; fixes shared key auth in sta mode

PR: kern/129022

New periodic calibration scheme needed for 11n parts that have
multiple algorithms and potentially collect multiple samples.
Instead of a single calibration interval we now have short and long
intervals; the long interval roughly corresponds to the previous
single interval. The short interval is used to speedup collection
of samples and happens much quicker. We make calls using the short
interval until we're told the calibration work is complete at which
point we fallback to the long interval. In addition there is a
much longer reset interval used to flush all calibration state and
cause everthing to start anew.

With these changes you can also disable calibration entirely by
setting the long interval to zero.

Switch to ath hal source code. Note this removes the ath_hal
module; the ath module now brings in the hal support. Kernel
config files are almost backwards compatible; supplying

device ath_hal

gives you the same chip support that the binary hal did but you
must also include

options AH_SUPPORT_AR5416

to enable the extended format descriptors used by 11n parts.
It is now possible to control the chip support included in a
build by specifying exactly which chips are to be supported
in the config file; consult ath_hal(4) for information.

sync w/ p4 branch

some of the 11n parts can hang under certain conditions without
necessary workarounds, add code to detect these hangs and distinguish
them from other events; note this code is only invoked for anomalous
conditions and (at the moment) is a noop because the hang detection
code is in a new hal that's coming shortly

add frequency mapping for the Zcomax GZ-901

print the extended tx/rx descriptor for 5416 and later parts

nuke special handling of RXORN interrupt; the hal marks the FATAL
bit in the interrupt status when RXORN is hit and the chip requires
a reset so our special handling was causing useless resets

Fix checks for fast frames negotiation. ni_ath_flags holds the
capabilities reported by the ap. These need to be cross-checked
against the local configuration in the vap. Previously we were
only checking the ap capabilities which meant that if an ap reported
it was ff-capable but we were not setup to use them we'd try to do
ff aggregation and drop the frame.

There are a number of problems to be fixed here but applying this
fix immediately as the problem causes all traffic to stop (and has
not workaround).

Reported by: Ashish Shukla

prepare for a new hal

o With the addition of HT rates the set of h/w codes has a much wider range
making the use of sc_hwmap to do direct mapping impractical. Switch to
indexing by the rate index instead of the rate code and adjust associated
state and logic appropriately. This has several benefits including
simplification of the led code.
o fix radiotap capture of HT rates
o fix conditional compilation of HT radiotap support to be based on the
hal having 5416 support; not the ABI version as hal builds may or may
not include 5416 support

prefer #define to naked constant

fix handling of HT rates; these overlap legacy rates and need to be
marked as MCS in the inverse mapping table

add hack to deal with Ubiquiti XR9 cards, they have a different mapping
between 900MHz and 2.4GHz frequencies than SR9 cards; they are distinguished
by different country codes

install bssid for ahdemo mode too

fix comment

correct callback status parameter; only indicate success when an ACK was
received

Fixup statistics:
o update tx rssi data only when an ACK was received
o return tx rssi from sampled data instead of the last frame
o track noise floor
o return rx rssi and noise floor (was broken)

update the sta inactivity timer only if we actually received an ACK

Regdomain fixups:
o pass country code, outdoor indication, and ecm mode into the hal
when requesting a channel list
o add a console msg when regulatory setup fails
o add placeholder code to map between Atheros sku's and 802.11 sku's
that handles only the debug country code used to unlock the full
channel list (to be used only for debugging)
o fix multiple instances of mismapping the 802.11 location to the
outdoor indication (anywhere may be outdoor also)

add regdomain debug msgs

add sys.dev.ath.X.intmit knob to enable/disable ANI
(the intmit name is historical)

shuffle debug setup to simplify debugging events during attach

rename bf_flags to bf_txflags in preparation for the addition of flags
separate from the tx descriptor flags currently recorded

use the ic's opmode instead of our hal equivalent to check for adhoc mode;
they are always the same

intercept IEEE80211_IOC_TXPOWER and service tx power changes immediately

remove driver-private equivalent of ni_txparms; it's now superfluous

now that the new association callback is used when joining a bss we can
eliminate the ath_rate_newassoc callback and associated code

o use the new association callback to notify the driver when joining a bss
in sta and adhoc modes; this should've been done forever ago as most all
drivers use this hook to set per-station transmit parameters such as for
tx rate control
o adjust drivers to remove explicit calls to the driver newassoc method

fix static key wep; r183248 caused drivers to be called for keys to be
assigned to slots in the global key table but ath_key_alloc was not
updated to handle that

Crypto api changes:
o don't use the key index to identify when the driver has been
asked to allocate a key slot, use an explicit flag; allows
drivers to force s/w fallback for entries in the global table
o change callback api to allocate driver resources for a crypto key:
- de-const the key parameter so drivers can muck with the flags
- on callback failure don't automatically try to setup s/w crypto;
instead the driver must now mark the key entry for s/w crypto and
the caller will re-attach the cipher module

NB: api change permits drivers more control over fallback to s/w
crypto (e.g. based on a limited number of h/w key slots)

fix compilation on 64-bit platform w/ ATH_DEBUG

Change the calling convention for ic_node_alloc to deal with
some longstanding issues:
o pass the vap since it's now the "coin of the realm" and required
to do things like set initial tx parameters in private node
state for use prior to association
o pass the mac address as cards that maintain outboard station
tables require this to create an entry (e.g. in ibss mode)
o remove the node table reference, we only have one node table
and it's unlikely this will change so this is not needed to
find the com structure

correct rx radiotap channel flags construction for 11n frames

Cleanup power handling and fix suspend/resume:
o do not put the chip into full sleep in ath_stop as it gains
nothing and causes many parts to hang in ath_detach because we
may touch the chip during vap teardown; this may also fix issues
with unloading the module
o add a note in ath_detach to explain ath_hal_detach puts the
chip in low power mode; this is useful to know as it means
unloading the module will place a pci device in the lowest
possible power state
o leave an #ifdef notyet marker for powering down the chip when
a device is marked down; we can't do that until we handle all
the ways the driver may be entered and touch the chip
o fix resume by reloading the h/w key cache as it's been clobbered
(for pci) by the socket being powered off; for station mode we
directly stop+init the chip and then simulate a beacon miss to
get the upper layers sync'd up; for other configs we must brute
force stop+start the vaps so they go through the state machine

close a race on detach by reordering bpfdetach and taskqueue_free

send EAPOL frames at the same rate used for mgt frames

Minor cleanup of vap create work:
o add IEEE80211_C_STA capability to indicate sta mode is supported
(was previously assumed) and mark drivers as capable
o add ieee80211_opcap array to map an opmode to the equivalent capability bit
o move IEEE80211_C_OPMODE definition to where capabilities are defined so it's
clear it should be kept in sync (on future additions)
o check device capabilities in clone create before trying to create a vap;
this makes driver checks unneeded
o make error codes return on failed clone request unique
o temporarily add console printfs on clone request failures to aid in
debugging; these will move under DIAGNOSTIC or similar before release

o unbreak handling of TKIP tx-only keys for splitmic chips
o yank compat support for hal's older than 0.9.20.3; leave a
CTASSERT in place just in case

add back sysctl's to display the regdomain and country code from eeprom;
useful for debugging

Unify all the wifi *_ioctl routines
- Limit grabbing the lock to SIOCSIFFLAGS.
- Move ieee80211_start_all() to SIOCSIFFLAGS.
- Remove SIOCSIFMEDIA as it is not useful.
- Limit ether_ioctl to only SIOCGIFADDR. SIOCSIFADDR and SIOCSIFMTU have no
affect as there is no input/output path in the vap parent. The vap code
will handle the reinit of the mac address changes.
- Split off ndis_ioctl_80211 as it was getting too different to wired devices.

This fixes a copyout while locked and a lock recursion.

Reviewed by: sam

remove old code to handle mcast address changes; this is all done through
net80211 and pushed into the driver through non-ioctl callbacks

restore the hal's channel list when doing getradiocaps so it's in sync with
the 802.11 layer's list

Multi-bss (aka vap) support for 802.11 devices.

Note this includes changes to all drivers and moves some device firmware
loading to use firmware(9) and a separate module (e.g. ral). Also there
no longer are separate wlan_scan* modules; this functionality is now
bundled into the wlan module.

Supported by: Hobnob and Marvell
Reviewed by: many
Obtained from: Atheros (some bits)

(finally) add the hal status to the diagnostic generated after
a failed ath_hal_reset call

MFC after: 3 days

promote ath_defrag to m_collapse (and retire private+unused
m_collapse from cxgb)

Reviewed by: pyun, jhb, kmacy
MFC after: 2 weeks

Update beacon handling to sync w/ vap code base:
o add driver callback to handle notification of beacon changes;
this is required for devices that manage beacon frames themselves
(devices must override the default handler which does nothing)
o move beacon update-related flags from ieee80211com to the beacon
offsets storage (or handle however a driver wants)
o expand beacon offsets structure with members needed for 11h/dfs
and appie's
o change calling convention for ieee80211_beacon_alloc and
ieee80211_beacon_update
o add overlapping bss support for 11g; requires driver to pass
beacon frames from overlapping bss up to net80211 which is not
presently done by any driver
o move HT beacon contents update to a routine in the HT code area

Reviewed by: avatar, thompsa, sephe
Approved by: re (blanket wireless)

bandaid Dynamic Turbo A operation with old hal's: HAL_MODE_108A
does not have a rate table in older hal's so if we scan such a
channel the driver will hit an assertion or crash; for old hal's
fallback to using the static turbo rate table for this mode
(not correct but good enough for now given none of the rate
control algorithms understand how to switch between base+boost)

Approved by: re (blanket wireless)

fix led blinking in RUN state: the addition of the CAC state moved
IEEE80211_S_RUN and broke the array lookup used to find the LED flags

Approved by: re (blanket wireless)

Add missing bits that made bg scanning lame:
o update ic_lastdata to reflect time of last outbound frame
o outbound traffic must preempt/cancel bg scanning to avoid delays

This stuff was somehow missed in the initial import.

Reviewed by: thompsa, avatar, sephe (earlier version)
Approved by: re (blanket wireless)

Remove the now-unused NET_{LOCK,UNLOCK,ASSERT}_GIANT() macros, which
previously conditionally acquired Giant based on debug.mpsafenet. As that
has now been removed, they are no longer required. Removing them
significantly simplifies error-handling in the socket layer, eliminated
quite a bit of unwinding of locking in error cases.

While here clean up the now unneeded opt_net.h, which previously was used
for the NET_WITH_GIANT kernel option. Clean up some related gotos for
consistency.

Reviewed by: bz, csjp
Tested by: kris
Approved by: re (kensmith)

Process tx callbacks when draining the tx q; this fixes a problem
where a device timeout that occurs with a mgt frame on the tx q
will leave the net80211 layer w/o any way to make progress.

Reviewed by: thompsa, sephe
Approved by: re (hrs)

Update 802.11 wireless support:
o major overhaul of the way channels are handled: channels are now
fully enumerated and uniquely identify the operating characteristics;
these changes are visible to user applications which require changes
o make scanning support independent of the state machine to enable
background scanning and roaming
o move scanning support into loadable modules based on the operating
mode to enable different policies and reduce the memory footprint
on systems w/ constrained resources
o add background scanning in station mode (no support for adhoc/ibss
mode yet)
o significantly speedup sta mode scanning with a variety of techniques
o add roaming support when background scanning is supported; for now
we use a simple algorithm to trigger a roam: we threshold the rssi
and tx rate, if either drops too low we try to roam to a new ap
o add tx fragmentation support
o add first cut at 802.11n support: this code works with forthcoming
drivers but is incomplete; it's included now to establish a baseline
for other drivers to be developed and for user applications
o adjust max_linkhdr et. al. to reflect 802.11 requirements; this eliminates
prepending mbufs for traffic generated locally
o add support for Atheros protocol extensions; mainly the fast frames
encapsulation (note this can be used with any card that can tx+rx
large frames correctly)
o add sta support for ap's that beacon both WPA1+2 support
o change all data types from bsd-style to posix-style
o propagate noise floor data from drivers to net80211 and on to user apps
o correct various issues in the sta mode state machine related to handling
authentication and association failures
o enable the addition of sta mode power save support for drivers that need
net80211 support (not in this commit)
o remove old WI compatibility ioctls (wicontrol is officially dead)
o change the data structures returned for get sta info and get scan
results so future additions will not break user apps
o fixed tx rate is now maintained internally as an ieee rate and not an
index into the rate set; this needs to be extended to deal with
multi-mode operation
o add extended channel specifications to radiotap to enable 11n sniffing

Drivers:
o ath: add support for bg scanning, tx fragmentation, fast frames,
dynamic turbo (lightly tested), 11n (sniffing only and needs
new hal)
o awi: compile tested only
o ndis: lightly tested
o ipw: lightly tested
o iwi: add support for bg scanning (well tested but may have some
rough edges)
o ral, ural, rum: add suppoort for bg scanning, calibrate rssi data
o wi: lightly tested

This work is based on contributions by Atheros, kmacy, sephe, thompsa,
mlaier, kevlo, and others. Much of the scanning work was supported by
Atheros. The 11n work was supported by Marvell.

update copyrights to 2007 and convert to be 2-clause bsd-only

disable taskqueue_drain calls on transition to INIT state; we need to
find another way to do this as we cannot hold the softc mtx across
these calls

Drain task q items when transitioning to INIT state; this closes a
race seen on smp laptops when suspending where the rx task can be
entered after the interface is detach'd.

NB: use of taskqueue_drain while holding the softc mutex is problematic

Submitted by: ambrisko
MFC after: 1 month

silence some compiler complaints

make dev.ath.N.ledpin have an immediate effect

PR: kern/111810
Submitted by: Henrik Brix Andersen <henrik@brixandersen.dk>
MFC after: 1 week

- Fix mbuf/node leakage in drivers' raw_xmit().
- For ural(4):
o Fix node leakage in ural_start(), if ural_tx_mgt() fails.
o Fix mbuf leakage in ural_tx_{mgt,data}(), if usbd_transfer() fails.
o In ural_tx_{mgt,data}(), set ural_tx_data.{m,ni} to NULL, if
usbd_transfer() fails, so they will not be freed again in ural_stop().

Approved by: sam (mentor)

Change mtx's to use the formulated name as type so witness does not
complain on nested tx q lock acquisitions when processing the cab q.

MFC after: 2 weeks

Kick tx after processing rx'd frames; this fixes latency issues
for processing frames from the power save queue when operating
in ap mode. This is especially noticeable for realtime data going
to devices like voip phones.

Submitted by: "J.R. Oldroyd" <jr@opal.com>
MFC after: 2 weeks

don't call ath_reset when processing sysctl's before the device
is marked running; we don't have all the needed state in place

Noticed by: Hugo Silva <hugo@barafranca.com>
MFC after: 1 week

set the antenna switch when fixing the tx antenna using the
dev.ath.X.txantenna sysctl; this is typically what folks
want but beware this has the side effect of disabling rx
diversity

MFC after: 2 weeks

Change the remainder of the drivers for DMA'ing devices enabled in the
sparc64 GENERIC and the sound device drivers known working on sparc64
to use bus_get_dma_tag() to obtain the parent DMA tag so we can get rid
of the sparc64_root_dma_tag kludge eventually. Except for ath(4), sk(4),
stge(4) and ti(4) these changes are runtime tested (unless I booted up
the wrong kernels again...).

Add initial support for 900MHz cards like the Ubiquiti SR9:
o eliminate assumptions that half/quarter rate channels on exist in 11a
o handle frequency mapping between hal and net80211; hal gives us freq's
in the range 2422..2437 that we remap

MFC after: 1 month

Add half/quarter rate 11a channel support:
o change handling of regdomain-related mib knobs so they can be set
post-attach: regdomain, countrycode, outdoor, and xchanmode; the
hal will not permit changing the regdomain but we expose it for now
o on regdomain/countrycode change recalculate the channel list and
push it to the net80211 layer (NB: looks to need more tweaking)
o setup rate tables for half/quarter rate channels
o honor half/quarter rate channel configs when changing channels
o honor half/quarter rate channel configs when setting the slot time
o use hack/nonstandard channel numbering scheme for the public safety
band to avoid overlapping 2.4G channels on dual-band cards
o remove setup of ic_sup_rates; the net80211 layer can do this for us
and it simplifies handling of half/quarter rate channels

Tested only in Public Safety Band with cards that have RF5112.

Track v0.9.20.3 hal:

o no more ds_vdata in tx/rx descriptors
o split h/w tx/rx descriptor from s/w status
o as part of the descriptor split change the rate control module api
so the ath_buf is passed in to the module so it can fetch both
descriptor and status information as needed
o add some const poisoning

Also for sample rate control algorithm:

o split debug msgs (node, rate, any)
o uniformly bounds check rate indices (and in some cases correct checks)
o move array index ops to after bounds checking
o use final tsi from the status block instead of the h/w descriptor
o replace h/w descriptor struct's with proper mask+shift defs (this
doesn't belong here; everything is known by the driver and should
just be sent down so there's no h/w-specific knowledge)

MFC after: 1 month

mark tx/rx descriptors COHERENT; we do not sync changes so on
architectures like arm this is necessary

MFC after: 1 month

Add support for newer parts that do not require separate keycache
entries for tx+rx mic keys. This requires a newer hal, but works
fine with the current hal in cvs.

MFC after: 2 weeks

remove stub radar support; it's never been used and future
hal's will not include the calls (due to redesign)

MFC after: 1 week

o add noise floor to stats
o include current tx rate in stats so athstats gets a consistent
snapshot and doesn't have to make an extra ioctl
o record tx rate for raw frames

MFC after: 3 weeks

check return value of ath_tx_dmasetup

Noticed by: yongari

raw 802.11 packet transmit support

Joint work with: Andrea Bittau <a.bittau@cs.ucl.ac.uk>

check tim is present in the beacon before defer'ing the mcast buffer bit;
insures we don't do this when operating in adhoc mode

Submitted by: avatar@
MFC after: 1 week

enable rx of control frames when in monitor mode

Submitted by: Andrea Bittau <a.bittau@cs.ucl.ac.uk>
MFC after: 1 week

Close race in handling mcast traffic when operating as an ap with
stations in power save: add a new q where mcast frames are stashed
and on beacon update (at DTIM) move frames from the mcast q to the
cabq and start it. This ensures the cabq is only manipulated in
one place.

Sponsored by: Hobnob
MFC after: 2 weeks

move hal bus+tag externalization to the bus glue code where it belongs;
this is a noop on all current freebsd architectures

MFC after: 1 month

add missed calls to bpf_peers_present

Fix the following bpf(4) race condition which can result in a panic:

(1) bpf peer attaches to interface netif0
(2) Packet is received by netif0
(3) ifp->if_bpf pointer is checked and handed off to bpf
(4) bpf peer detaches from netif0 resulting in ifp->if_bpf being
initialized to NULL.
(5) ifp->if_bpf is dereferenced by bpf machinery
(6) Kaboom

This race condition likely explains the various different kernel panics
reported around sending SIGINT to tcpdump or dhclient processes. But really
this race can result in kernel panics anywhere you have frequent bpf attach
and detach operations with high packet per second load.

Summary of changes:

- Remove the bpf interface's "driverp" member
- When we attach bpf interfaces, we now set the ifp->if_bpf member to the
bpf interface structure. Once this is done, ifp->if_bpf should never be
NULL. [1]
- Introduce bpf_peers_present function, an inline operation which will do
a lockless read bpf peer list associated with the interface. It should
be noted that the bpf code will pickup the bpf_interface lock before adding
or removing bpf peers. This should serialize the access to the bpf descriptor
list, removing the race.
- Expose the bpf_if structure in bpf.h so that the bpf_peers_present function
can use it. This also removes the struct bpf_if; hack that was there.
- Adjust all consumers of the raw if_bpf structure to use bpf_peers_present

Now what happens is:

(1) Packet is received by netif0
(2) Check to see if bpf descriptor list is empty
(3) Pickup the bpf interface lock
(4) Hand packet off to process

From the attach/detach side:

(1) Pickup the bpf interface lock
(2) Add/remove from bpf descriptor list

Now that we are storing the bpf interface structure with the ifnet, there is
is no need to walk the bpf interface list to locate the correct bpf interface.
We now simply look up the interface, and initialize the pointer. This has a
nice side effect of changing a bpf interface attach operation from O(N) (where
N is the number of bpf interfaces), to O(1).

[1] From now on, we can no longer check ifp->if_bpf to tell us whether or
not we have any bpf peers that might be interested in receiving packets.

In collaboration with: sam@
MFC after: 1 month

quiet tindexbox complaints about passing BUS_SPACE_MAXADDR as
a bus_size_t to bus_dma_tag_create; when PAE is enabled this
does not work

Cluebat by: scottl
MFC after: 2 weeks

force type coercion for bus tag+handle when calling ath_hal_attach
to ensure we match the type signature; we cannot assume HAL_BUS_TAG
and HAL_BUS_HANDLE correspond to bus_space_tag_t and bus_space_handle_t
(should probably do this for HAL_SOFTC too but leave that for now)

MFC after: 1 month

intercept public safety channels and do explicit mapping of freq->ieee
channel number since we're not ready at the net80211 layer to deal with them;
note this mapping has to match what's done in ieee80211_mhz2ieee

MFC after: 3 days

honor fixed tx antenna when sending beacon frames

Submitted by: Michael Stevens (from netbsd)
MFC after: 1 week

Improve ath_draintxq debug info: dump the packet as well
as the descriptor and handle the beacon q like other q's

MFC after: 1 month

Unbreak cabq handling: check the s/w q, not the h/w q as the frames
have not been passed to the h/w yet. This remedies watchdog timeout
of buffered multicast frames in hostap mode.

While here eliminate an extraneous check; ieee80211_beacon_update sets
the tim bit based on ncabq != 0 so there's no reason to check it too.

Noticed by: Christophe Prevotaux

o add opt_ath.h enable tweaking various config parameters for the driver
without modifying the source code
o default debug msgs and diag support to off

MFC after: 3 days

backout 1.136 until we can resolve report that it causes output to stall

fix a race whereby a tx descriptor might get reused before the hardware
is finished with it; this may only occur when the tx queue is setup as
dba-gated but since the fix is cheap apply it to all queues

while here make the queue depth signed for use in assertions

Reviewed by: apatti
MFC after: 2 weeks

drop softc lock around copyin/copyout

MFC after: 2 weeks

fix build w/o AR_DEBUG

MFC after: 2 weeks

improve tx/rx buf printing routines

MFC after: 2 weeks

add missing bit from 1.130

o handle fatal errors directly instead of via the task queue
o temporarily dump some h/w state for diagnosis; this will be
removed once some issues are resolved

MFC after: 2 weeks

use ath_hal_gettxintrtxqs so we only process h/w tx
queues that have an interrupt pending

MFC after: 2 weeks

fixup comments

close race between ath_tx_start and ath_tx_processq

Reviewed by: apatti
MFC after: 1 week

fix merge botch (duplicate processing of cabq for old cards)

Update for rev 0.9.16.16 hal:
o add dfs+radar hooks; DFS is presently disabled in the hal
o channel and mode handling changes
o various api changes
o be more aggressive about iq calibration settling so ap mode
operation is better immediately after startup
o rfkill/rfsilent sysctl support
o tpc ack/cts sysctl support

MFC after: 2 weeks

Minor tx path cleanups:
o assume all data frames have been classified so there's no need
to check if QoS is being used, just fetch the wme priority from
the mbuf
o fix double counting of noack frames
o fix nearby comment

MFC after: 2 weeks

correct handling of mbuf allocation failure when replenishing the rx list
(leave a printf for the moment, need to make a debug msg)

Obtained from: atheros
MFC after: 2 weeks

Beacon timer setup fixes:
o pull nexttbtt forward in adhoc mode too
o resync beacon timers on joining a bss or ibss as the tstamp we
collected while scanning is almost certainly out of date

Note we may need to refine the ibss mode check in ath_recv_mgmt.

Reviewed by: avatar, dyoung
Obtained from: atheros
MFC after: 2 weeks

only start the cab queue if there are frames to send

MFC after: 2 weeks

debug fixups: reduce noise msgs, report channel flags on reset failure,
mark data+link fields in descriptor dumps

MFC after: 2 weeks

Phantom beacon miss workaround: track the tsf of the last received
frame and if we get a beacon miss interrupt ignore it if we've received
a frame within the beacon miss interval. This should never trigger
and the handling at the net80211 layer should likewise deal with this
but it doesn't hurt and can suppress extranous probe request frames.
Note that we can legtimately get a bmiss when under heavy load.

MFC after: 2 weeks

use a private task queue thread

MFC after: 2 weeks

add adhoc demo mode support

MFC after: 2 weeks

make regdomain sysctl r/w in case it's possible to do this in the future

MFC after: 2 weeks

cleanup rate setup

MFC after: 2 weeks

add tx99 hooks

MFC after: 2 weeks

move hal statistics to softc; the per-node stats are overkill, they're
only used when operating in station mode

MFC after: 2 weeks

lookup the protection tx rate index in the rate tables
instead of using a known value

MFC after: 2 weeks

honor net80211 mcast tx rate

MFC after: 2 weeks

allow the size of tx+rx buffer pools to be tuned

MFC after: 2 weeks

lower try count on mgt (and ctl) frames to avoid clogging the tx queue
and loading the bss when operating in ap mode under load; adjust recognition
of multi-rate retry to match

MFC after: 2 weeks

move mgt frame tx rate responsibility from the rate control modules
to the driver; this avoids redundant logic and will be necessary
for future additions

MFC after: 2 weeks

track bmiss threshold change from time to frame count

Update monitoring support:
o record tsf in tx+rx frames
o switch from raw rssi to dbm for signal data and record both
signal and noise floor data (hacked for now to assume a fixed
noise floor; is correct with new hal)
o add monpass sysctl to control which rx'd frames are passed
up with errors; especially useful to see frames with CRC errors
o mark 'd packets w/ a CRC error with radiotap's BADFCS flag

Also add placeholder code for calibrating the noise floor when
using newer hals.

Reviewed by: avatar
MFC after: 1 week

nuke special handling to extend cts when bursting; it was race prone

MFC after: 7 days

- Store pointer to the link-level address right in "struct ifnet"
rather than in ifindex_table[]; all (except one) accesses are
through ifp anyway. IF_LLADDR() works faster, and all (except
one) ifaddr_byindex() users were converted to use ifp->if_addr.

- Stop storing a (pointer to) Ethernet address in "struct arpcom",
and drop the IFP2ENADDR() macro; all users have been converted
to use IF_LLADDR() instead.

Fix "struct ifnet" leak on detach.

correct CTS duration calculation; SIFS+ACK should use the xmit rate not
the rate for CTS

MFC after: 3 days
Obtained from: Atheros

Clarify/fix handling of the current channel:
o add ic_curchan and use it uniformly for specifying the current
channel instead of overloading ic->ic_bss->ni_chan (or in some
drivers ic_ibss_chan)
o add ieee80211_scanparams structure to encapsulate scanning-related
state captured for rx frames
o move rx beacon+probe response frame handling into separate routines
o change beacon+probe response handling to treat the scan table
more like a scan cache--look for an existing entry before adding
a new one; this combined with ic_curchan use corrects handling of
stations that were previously found at a different channel
o move adhoc neighbor discovery by beacon+probe response frames to
a new ieee80211_add_neighbor routine

Reviewed by: avatar
Tested by: avatar, Michal Mertl
MFC after: 2 weeks

Propagate rename of IFF_OACTIVE and IFF_RUNNING to IFF_DRV_OACTIVE and
IFF_DRV_RUNNING, as well as the move from ifnet.if_flags to
ifnet.if_drv_flags. Device drivers are now responsible for
synchronizing access to these flags, as they are in if_drv_flags. This
helps prevent races between the network stack and device driver in
maintaining the interface flags field.

Many __FreeBSD__ and __FreeBSD_version checks maintained and continued;
some less so.

Reviewed by: pjd, bz
MFC after: 7 days

Split crypto tx+rx key indices and add a key index -> node mapping table:

Crypto changes:
o change driver/net80211 key_alloc api to return tx+rx key indices; a
driver can leave the rx key index set to IEEE80211_KEYIX_NONE or set
it to be the same as the tx key index (the former disables use of
the key index in building the keyix->node mapping table and is the
default setup for naive drivers by null_key_alloc)
o add cs_max_keyid to crypto state to specify the max h/w key index a
driver will return; this is used to allocate the key index mapping
table and to bounds check table loookups
o while here introduce ieee80211_keyix (finally) for the type of a h/w
key index
o change crypto notifiers for rx failures to pass the rx key index up
as appropriate (michael failure, replay, etc.)

Node table changes:
o optionally allocate a h/w key index to node mapping table for the
station table using the max key index setting supplied by drivers
(note the scan table does not get a map)
o defer node table allocation to lateattach so the driver has a chance
to set the max key id to size the key index map
o while here also defer the aid bitmap allocation
o add new ieee80211_find_rxnode_withkey api to find a sta/node entry
on frame receive with an optional h/w key index to use in checking
mapping table; also updates the map if it does a hash lookup and the
found node has a rx key index set in the unicast key; note this work
is separated from the old ieee80211_find_rxnode call so drivers do
not need to be aware of the new mechanism
o move some node table manipulation under the node table lock to close
a race on node delete
o add ieee80211_node_delucastkey to do the dirty work of deleting
unicast key state for a node (deletes any key and handles key map
references)

Ath driver:
o nuke private sc_keyixmap mechansim in favor of net80211 support
o update key alloc api

These changes close several race conditions for the ath driver operating
in ap mode. Other drivers should see no change. Station mode operation
for ath no longer uses the key index map but performance tests show no
noticeable change and this will be fixed when the scan table is eliminated
with the new scanning support.

Tested by: Michal Mertl, avatar, others
Reviewed by: avatar, others
MFC after: 2 weeks

Modify device drivers supporting multicast addresses to lock if_addr_mtx
over iteration of their multicast address lists when synchronizing the
hardware address filter with the network stack-maintained list.

Problem reported by: Ed Maste (emaste at phaedrus dot sandvine dot ca>
MFC after: 1 week

o fix setup of sc_diversity; the hal does not give us reliable
status after attach, only after a reset
o when setting diversity via the sysctl don't update sc_diversity
until we know the hal requested worked
o while here eliminate sc_hasdiversity and sc_hastpc; just query
the hal each time since these are the only places we need to know

MFC after: 3 days

o move ath_sysctlattach down so variables it depends on are setup
o use any fixed tx antenna for beacons transmitted in adhoc mode

Submitted by: David Young
MFC after: 3 days

simplify ic_newassoc callback

MFC after: 3 days

simplify ieee80211_ibss_merge api

MFC after: 3 days

only invoke ath_rate_tx_complete to update rate control state when the
frame being sent is to be ack'd and hasn't been filtered by the h/w;
this insures we don't pass in tx descriptors that have no meaningful
state (e.g. mcast/bcast frames are not acked and so have no tx retry
counts)

Approved by: re (scottl)
Obtained from: Atheros

Stop embedding struct ifnet at the top of driver softcs. Instead the
struct ifnet or the layer 2 common structure it was embedded in have
been replaced with a struct ifnet pointer to be filled by a call to the
new function, if_alloc(). The layer 2 common structure is also allocated
via if_alloc() based on the interface type. It is hung off the new
struct ifnet member, if_l2com.

This change removes the size of these structures from the kernel ABI and
will allow us to better manage them as interfaces come and go.

Other changes of note:
- Struct arpcom is no longer referenced in normal interface code.
Instead the Ethernet address is accessed via the IFP2ENADDR() macro.
To enforce this ac_enaddr has been renamed to _ac_enaddr.
- The second argument to ether_ifattach is now always the mac address
from driver private storage rather than sometimes being ac_enaddr.

Reviewed by: sobomax, sam

Change station mode beacon timer setup to insure the calculated
nextTbtt is always ahead of the h/w TSF.

Reviewed by: avatar

Set the correct IFS parameters for the beacon tx queue
when operating in ap and adhoc modes.

Misc keycache changes:
o purge ath_initkeytable; it's not needed
o add multicast key search support for supporting multiple group keys
(disabled for now; requires updated hal)
o create keycache entry for stations using open auth so they get h/w
antenna management support
o add keycache -> node mapping table; eliminates mac-based lookup in
the net80211 layer

restore led state on resume

Submitted by: markus

honor new IEEE80211_KEY_GROUP key flag

Reviewed by: Tai-hwa Liang

use frame type returned by ieee80211_input to drive softled code
instead of monitoring the input packet count

reclaim mbufs in failure cases

Submitted by: Tai-hwa Liang

close unlikely race

Submitted by: Michael Wong

correct comment

rev rate control api to pass the both the first+last tx descriptors
to the rate control module for tx complete processing; this enables
rate control algorithms to extract the packet length for xmits that
require multiple descriptors

o extend cts to cover packet burst when operating in 11g w/ protection
o check current channel parameters, not shadow state, for acm policy
on data frames

Fixing kernel build on amd64 machines.

Reviewed by: sam (mentor)

extend the timestamp from the rx descriptor to calculate the tsf to
use when checking for an ibss merge

forgot to merge this bit from p4

replace m_defrag with something more suitable

reclaim mbuf chain when ieee80211_crypto_encap fails

Noticed by: David Young

Fixup radiotap handling of FCS and QoS frames per discussion with David Young:
o mark rx frames including FCS in the payload with the
IEEE80211_RADIOTAP_F_FCS flag
o remove hack to copy 802.11 headers with padding out of line; instead mark
the frames with IEEE80211_RADIOTAP_F_DATAPAD and require applications to
do the work
o split precalculated radiotap flags into tx+rx now that they can be different

Note the full usefulness of these changes depends on updates to applications
that process radiotap data.

beacon handling fixups for adhoc mode:
o don't reclaim any previous beacon state in ath_beacon_alloc; do it
explicitly in ath_newstate
o reference count the node held in the beacon frame state block
o process ibss merge more intelligently; let the state machine do the
right thing instead of explicitly setting the new bssi id
o explicitly stop tx dma before doing beacon setup to handle the ibss
merge case

switch to use bus_dmamap_load_mbuf_sg

o correct beacon interval calculation; the internal setting is in TU's not ms
o replace the private macro to convert MS->TU with the common one

add missing statistic

disable interrupts when transitioning to INIT state so we don't rx frames

replace hand-rolled code to compact an mbuf chain with m_defrag; this is
suboptimal but needed for fast frames which won't fit in a single cluster

setup the beacon xmit queue to not interrupt; we don't use them and
they make the led's flash unnecessarily in adhoc mode

better led blinking

add paren's so we can supply a|b as a debug mask

bump copyright for 2005

correct some typos

Submitted by: Tai-hwa Liang

Radiotap fixups:
o catch one place where we were not using ath_chan_change to
switch channels; this fixes a problem where the channel
settings were not being correctly reported in captured packets
o return unique channel identification in the channel flags;
ethereal gets confused if you return merged flags (e.g. ofdm,
cck, and 2Ghz) (this is workaround and should be removed if
we can ever cleanup radiotap consumers)
o correct short/long preamble flag state for rx and treat tx
the same--use a new hwflags array that gives us the data
based on the h/w rate index/cookie
o add gross hack to handle radiotap capture of frames that
come in with hardware padding; should be replaced by a
flag in the radiotap header and more smarts in the apps
that decode radiotap data

for parts that require split keycache entries report the
the index of the first entry on a mic error so we're
consistent with parts that don't have split keycache

Correct beacon timer setup logic:
o lintval is in ms; must convert to TU's for passing to the hal
o roundup to calculate nexttbtt (should look at current tsf and pull the
calculated nextbtt forward but this'll do for now)
o don't or- in HAL_BEACON_RESET_TSF when doing station timer setup; this
is not needed and messes up the sleep timer calcs, though it's unclear
if it mattered as the hal masks these values before use

Submitted by: Thorsten von Eicken

no need to sweep the tx q's for node references in ath_node_free; we know
there are none since we're only called when the ref count goes to zero

cleanup some assertions

Make this amd64-clean. sizeof is long on amd64, so things that do a printf
of a sizeof, need to use %z to get the correct type on all our platforms.
Also, convert integers<->pointers via uintptr_t.

(I think Sam's instructions were for me to commit this. If I
misunderstood, then I apologize in advance.)

Update with last year of work.

Add missing bit of last if_start workaround: mark scan callout
MPSAFE only debug_mpsafenet is 1 so callbacks to send management
frames hold Giant; this is another bandaid on the path to removing Giant.

Pickup Giant in ath_rx_proc and when handling a beacon miss in order to
satisfy the assertion in if_start.

Second part of ALTQ driver modifications, covering:
an(4), ath(4), hme(4), ndis(4), vr(4) and wi(4)

Please help testing: http://people.freebsd.org/~mlaier/ALTQ_driver/

Tested by: Vaidas Damosevicius (an, ath, wi)
Roman Divacky (vr)
Submitted by: yongari (hme)

use correct malloc type to allocate struct ieee80211_node's

Noticed by: phk

do proper subclassing of node free+copy; the previous hack falls apart when
the 802.11 layer does useful work

Obtained from: madwifi

transmit beacon frames directly instead of defering them to a swi; there
was too much delay

Obtained from: madwifi

update copyright notice for 2004

check more quickly (and directly) if an interrupt is pending; this reduces
work done in ath_intr when the irq is shared

Obtained from: madwifi

cleanup descriptor allocation if attach fails

Obtained from: madwifi

remove use IEEE80211_C_RCVMGT

radiotap updates:

o force little-endian byte order for header
o pad header to 32-bit boundary to guard against applications that assume
packet data alignment

Don't announce MAC addresses twice.
(ieee80211_ifattach() calls ether_ifattach().)

Make this compile on amd64.

"I'll cope" by: sam

When draining the tx queue reclaim any node references held in packets.
This fixes a problem when operating as an AP where clients would get
stuck in the node table because the reference count never went to zero.

When ath_hal_stoptxdma returns an error dma is still likely stopped
so don't just stop trying to send a beacon frame or we'll be more likely
to lose sync. This only seems to happen on some older chips.

use ath_reset instead of ath_init when recovering from a watchdog timeout:
resetting the hardware is sufficient, no need to reset the 802.11 fsm

make hw.ath.debug a tunable

make hw.ath.outdoor and hw.ath.countrycode tunables

split debugging messages up into classes;
ah_debug is now treated as a bit vector

update radiotap support to reflect recent changes:

o move tx taps from ath_start to ath_tx_start so lots more
state is available to tap
o add tx flags
o add tx rate
o add tx power (constant for the moment)
o add tx antenna state

o eliminate widespread on-stack mbuf use for bpf by introducing
a new bpf_mtap2 routine that does the right thing for an mbuf
and a variable-length chunk of data that should be prepended.
o while we're sweeping the drivers, use u_int32_t uniformly when
when prepending the address family (several places were assuming
sizeof(int) was 4)
o return M_ASSERTVALID to BPF_MTAP* now that all stack-allocated
mbufs have been eliminated; this may better be moved to the bpf
routines

Reviewed by: arch@ and several others

o track API change for HAL v0.9.6.1
o fix race condition when processing rx descriptors: because we use
a self-linked descriptor at the end of the rx descriptor list to
avoid rx overruns (which can easily happen for 5212 parts that enable
PHY errors) we must carefully check that a descriptor is "done" by
looking ahead to the next descriptor before believing the done bit
in the current descriptor (this is all handled in the HAL since the
rx descriptor format is chip-specific so we need to pass in two
additional parameters--the physical address of the current descriptor
and the virtual address of the next descriptor in the list)
o check copyout return status for SIOCGATHSTATS ioctl

Approved by: re (scottl)

move rate control change messages under ath_debug

o fix WEP use in hostap mode; need to reset the pointer to the
802.11 packet header after stripping the WEP header on input

on a beacon miss try to reassociate before starting a scan

Submitted by: Henry Qian

Don't count PHY errors as input errors. This is important for
5212-based devices because PHY errors are used to collect data
on environmental noise that and doesn't truly reflect the state
of the communications media. The result is confused users.
Folks that want to watch PHY errors can still get the statistics
through the device ioctl (used by athstats).

o check hal ABI version to catch driver-HAL mismatches
o print MAC, PHY, and radio h/w revisions at attach

Replace the if_name and if_unit members of struct ifnet with new members
if_xname, if_dname, and if_dunit. if_xname is the name of the interface
and if_dname/unit are the driver name and instance.

This change paves the way for interface renaming and enhanced pseudo
device creation and configuration symantics.

Approved By: re (in principle)
Reviewed By: njl, imp
Tested On: i386, amd64, sparc64
Obtained From: NetBSD (if_xname)

terminate the rx descriptor list with a self-linked entry
so high phy error rates on a 5212 don't cause rx overruns

o consolidate rx filter calculations in one place
o enable beacon reception when operating in adhoc mode
so the 802.11 layer can use them to create nodes for peers

indicate device receives all management frames

o correct handling of a frame that has too many segments to fit in the
tx descriptor array
o while here fix a whitespace nit

Obtained from: NetBSD

o convert mutex calls to #defines for portability, etc.
o destroy mutex's on detach (was missing)

remove dangling mtx_unlock orphaned by rev 1.21 change

Reduce per-packet overhead when using WEP by using an advancing IV
seeded with arc4random rather than calling arc4random for each
packet. Note this is the same algorithm used to select the IV when
doing WEP on the host.

Must reset the pointer to the 802.11 header after prepending
for WEP in case the prepend addes a new mbuf. This fixes WEP.

MFp4:

o don't grab the mutex at the top of ath_detach; it does nothing
useful
o deal with entry to ath_ioctl during detach to disable promiscuous
mode as a result of calling bpfdetach2: cannot call ath_init when
the device is marked invalid as the code isn't prepared to deal
with it (in particular by that time the hal reference may have
been yanked)

MFp4:

change ath_rate_ctl_reset to handle transition from station
mode to adhoc mode; was not resetting the initial xmit rate
causing outbound frames to be dicarded

include the DS element in beacons

Maintain a history of data associated with received frames and use this to
calculate smoothed signal quality data for each node.

o add a 16-deep history buffer to each driver-private node storage that
holds rssi and antenna info for received frames
o override the default per-node "get rssi" method to return an average
rssi value based on samples collected over the last second
o enable beacon reception so even idle systems maintain a running history
of signal quality

This data may also be useful for improving the rate control algorithm.
Based on work by Tom Marshall <tommy@home.tig-grr.com> for MADWIFI.

o do not filter received frames based on type or length; pass 'em all up
to the 802.11 layer if they are at least IEEE80211_MIN_LEN
o mask off interrupt status bits that we don't care about so we don't do
the wrong thing; this fixes a problem where the beacon miss interrupt status
bit is delivered together with other status bits when operating in monitor
mode (we would post a beacon miss swi and then do the wrong thing)

must also check for 5Ghz channels when marking short preamble capability in
the beacon frames

Reminded by: Stephane Laroche <stephane.laroche@colubris.com>

o mark the device capable of short preamble (meaningless for the 5210 but
safe since the 802.11 layer does the right thing for 11a operation)
o select short preamble operation based on the negotiated capabilities; not
just the local state/capability
o fillin the duration field in the 802.11 header as appropriate
o remove detection of 11g support; no longer needed

Obtained from: MADWIFI (with modifications)

Add support for the experimental radiotap capture format. With this
we no longer need the debugging code to dump packets.

Explicitly enable probe request frame reception when not in station mode;
this is needed for the 5212 which a separate filter bit for these frames.

Submitted by: Stephane Laroche <stephane.laroche@colubris.com>

MFp4 changes to fix locking issues and correct reference
count handling of station entries in hostap mode:

Input path:

o driver is now expected to find the node associated with the
sender of a received frame; use ic_bss if none is located
o driver passes the (referenced) node into ieee80211_input for
use within the wlan module and is responsible for cleaning up
on return
o the antenna state is no longer passed up with each frame; this
is now considered driver-private state and drivers are responsible
for keeping it in the driver-private part of a node

Output path:

Revamp output path for management frames to eliminate redundant
locking that causes problems and to correct reference counting
bogosity that occurs when stations are timed out due to inactivity
(in AP mode). On output the refcnt'd node is stashed in the pkthdr's
recvif field (yech) and retrieved by the driver. This eliminates
an unref/ref scenario and related node table unlock/lock due to the
driver looking up the node. This is particularly important when
stations are timed out as this causes a lock order reversal that
can result in a deadlock. As a byproduct we also reduce the overhead
for sending management frames (minimal). Additional fallout from
this is a change to ieee80211_encap to return a refcn't node for
tieing to the outbound frame. Node refcnts are not reclaimed until
after a frame is completely processed (e.g. in the tx interrupt
handler). This is especially important for timed out stations as
this deref will be the final one causing the node entry to be
reclaimed.

Additional semi-related changes:
o replace m_copym use with m_copypacket (optimization)
o add assert to verify ic_bss is never free'd during normal operation
o add comments explaining calling conventions by drivers for frames
going in each direction
o remove extraneous code that "cannot be executed" (e.g. because
pointers may never be null)

o pass control frames up the stack when in monitor mode (the 802.11 layer will
quietly discard them; this just permits them to be collected with bpf)
o add a counter for the number of rate control frames discarded when not in
monitor mode
o move the rx "too short" statistic in the stat structure so non-error rx stats
are together (NB: ABI change to apps that collect stats via driver ioctl)

o correct beacon frame length calculation and add an assert to catch any future
mistakes (this mistake was not an issue because the length is only used to
decide whether or not to allocate a cluster)
o while here, move a beacon length comment to the "right place"

maintain a table for mapping hardware rate codes to 802.11 rates for
calculating the rate for each rx'd frame

mark the scan and calibrate callouts MPSAFE

remove unneeded include files

Close a race where ath_intr is installed and may be called before
the HAL is setup: use sc_invalid to discard such entries into
ath_intr. This can easily happen if the device is assigned a shared IRQ.

o remove bmisshack no longer needed with the BSSID fix in v0.9.5.2 of the hal
o add monitor mode support
o fix short preamble handling in beacon setup (noop)
o correct resume handling

track changes to 802.11 code:

o override new_state method per new model
o use ieee80211_state_name instead of private copy

o add read-only sysctls to view regulatory domain, country code, and
outdoor use controls
o use sysctl-visible values in setting up channel list

acknowledge the contribution of Atsushi Onoe

Atheros 802.11 driver. Requires Atheros Hardware Access Lay (HAL).

Supported by: Atheros Comunications