Stop abusing the rcvif pointer to pass wireless nodes down to the

driver start routines.  Instead add & use a pointer in the pkthdr
since we don't want the overhead of using a mbuf_tags(9).

claudio@ pointed out that other subsystems might want to use this
pointer too, so here's a new cookie!

ok claudio@, mikeb@, deraadt@

26 files changed, 67 insertions, 99 deletions

diff --git a/share/man/man9/mbuf.9 b/share/man/man9/mbuf.9
index e3db548d1d8..cf3c308ea8e 100644
--- a/share/man/man9/mbuf.9
+++ b/share/man/man9/mbuf.9
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: mbuf.9,v 1.68 2014/01/21 03:15:46 schwarze Exp $
+.\"     $OpenBSD: mbuf.9,v 1.69 2014/03/19 10:09:19 mpi Exp $
 .\"
 .\" Copyright (c) 2001 Jean-Jacques Bernard-Gundol <jjbg@openbsd.org>
 .\" All rights reserved.
@@ -25,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: January 21 2014 $
+.Dd $Mdocdate: March 19 2014 $
 .Dt MBUF 9
 .Os
 .Sh NAME
@@ -119,6 +119,7 @@ struct pkthdr {
 	u_int16_t csum_flags;
 	u_int16_t ether_vtag;
 	u_int	rdomain;
+	void	*ph_cookie;
 	struct	pkthdr_pf pf;
 };
 
diff --git a/sys/dev/ic/acx.c b/sys/dev/ic/acx.c
index 39910bc988f..96b0cbcd9a3 100644
--- a/sys/dev/ic/acx.c
+++ b/sys/dev/ic/acx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: acx.c,v 1.101 2013/08/07 01:06:27 bluhm Exp $ */
+/*	$OpenBSD: acx.c,v 1.102 2014/03/19 10:09:19 mpi Exp $ */
 
 /*
  * Copyright (c) 2006 Jonathan Gray <jsg@openbsd.org>
@@ -948,8 +948,7 @@ acx_start(struct ifnet *ifp)
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		/* first dequeue management frames */
 		if (m != NULL) {
-			ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-			m->m_pkthdr.rcvif = NULL;
+			ni = m->m_pkthdr.ph_cookie;
 
 			/*
 			 * probe response mgmt frames are handled by the
@@ -976,8 +975,7 @@ acx_start(struct ifnet *ifp)
 			/* then dequeue packets on the powersave queue */
 			IF_DEQUEUE(&ic->ic_pwrsaveq, m);
 			if (m != NULL) {
-				ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-				m->m_pkthdr.rcvif = NULL;
+				ni = m->m_pkthdr.ph_cookie;
 				goto encapped;
 			} else {
 				IFQ_DEQUEUE(&ifp->if_snd, m);
diff --git a/sys/dev/ic/ath.c b/sys/dev/ic/ath.c
index 83cd2339197..89f77189738 100644
--- a/sys/dev/ic/ath.c
+++ b/sys/dev/ic/ath.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ath.c,v 1.98 2013/11/26 09:50:32 mpi Exp $  */
+/*      $OpenBSD: ath.c,v 1.99 2014/03/19 10:09:19 mpi Exp $  */
 /*	$NetBSD: ath.c,v 1.37 2004/08/18 21:59:39 dyoung Exp $	*/
 
 /*-
@@ -897,17 +897,7 @@ ath_start(struct ifnet *ifp)
 			}
 			wh = mtod(m, struct ieee80211_frame *);
 		} else {
-			/*
-			 * Hack!  The referenced node pointer is in the
-			 * rcvif field of the packet header.  This is
-			 * placed there by ieee80211_mgmt_output because
-			 * we need to hold the reference with the frame
-			 * and there's no other way (other than packet
-			 * tags which we consider too expensive to use)
-			 * to pass it along.
-			 */
-			ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
-			m->m_pkthdr.rcvif = NULL;
+			ni = m->m_pkthdr.ph_cookie;
 
 			wh = mtod(m, struct ieee80211_frame *);
 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
diff --git a/sys/dev/ic/athn.c b/sys/dev/ic/athn.c
index 3aa4f0b64f1..d0c7a498686 100644
--- a/sys/dev/ic/athn.c
+++ b/sys/dev/ic/athn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: athn.c,v 1.80 2013/12/06 21:03:02 deraadt Exp $	*/
+/*	$OpenBSD: athn.c,v 1.81 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
@@ -2554,7 +2554,7 @@ athn_start(struct ifnet *ifp)
 		/* Send pending management frames first. */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
@@ -2562,7 +2562,7 @@ athn_start(struct ifnet *ifp)
 
 		IF_DEQUEUE(&ic->ic_pwrsaveq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/ic/atw.c b/sys/dev/ic/atw.c
index 443c1c0d08e..559239ae048 100644
--- a/sys/dev/ic/atw.c
+++ b/sys/dev/ic/atw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atw.c,v 1.80 2013/12/06 21:03:02 deraadt Exp $	*/
+/*	$OpenBSD: atw.c,v 1.81 2014/03/19 10:09:19 mpi Exp $	*/
 /*	$NetBSD: atw.c,v 1.69 2004/07/23 07:07:55 dyoung Exp $	*/
 
 /*-
@@ -3605,8 +3605,7 @@ atw_start(struct ifnet *ifp)
 		 */
 		IF_DEQUEUE(&ic->ic_mgtq, m0);
 		if (m0 != NULL) {
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 		} else {
 			/* send no data packets until we are associated */
 			if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/ic/bwi.c b/sys/dev/ic/bwi.c
index 1ac1cdeea16..2f316ecab99 100644
--- a/sys/dev/ic/bwi.c
+++ b/sys/dev/ic/bwi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bwi.c,v 1.100 2013/12/06 21:03:02 deraadt Exp $	*/
+/*	$OpenBSD: bwi.c,v 1.101 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*
  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
@@ -7202,8 +7202,7 @@ bwi_start(struct ifnet *ifp)
 		if (m != NULL) {
 			IF_DEQUEUE(&ic->ic_mgtq, m);
 
-			ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-			m->m_pkthdr.rcvif = NULL;
+			ni = m->m_pkthdr.ph_cookie;
 
 			mgt_pkt = 1;
 		} else {
diff --git a/sys/dev/ic/malo.c b/sys/dev/ic/malo.c
index 1d4e370e994..0722b6d0160 100644
--- a/sys/dev/ic/malo.c
+++ b/sys/dev/ic/malo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: malo.c,v 1.97 2013/12/06 21:03:03 deraadt Exp $ */
+/*	$OpenBSD: malo.c,v 1.98 2014/03/19 10:09:19 mpi Exp $ */
 
 /*
  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
@@ -1026,8 +1026,7 @@ malo_start(struct ifnet *ifp)
 			}
 			IF_DEQUEUE(&ic->ic_mgtq, m0);
 
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/ic/rt2560.c b/sys/dev/ic/rt2560.c
index 199fe8ff597..8749e1d2e15 100644
--- a/sys/dev/ic/rt2560.c
+++ b/sys/dev/ic/rt2560.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2560.c,v 1.62 2013/12/06 21:03:03 deraadt Exp $  */
+/*	$OpenBSD: rt2560.c,v 1.63 2014/03/19 10:09:19 mpi Exp $  */
 
 /*-
  * Copyright (c) 2005, 2006
@@ -1945,8 +1945,7 @@ rt2560_start(struct ifnet *ifp)
 			}
 			IF_DEQUEUE(&ic->ic_mgtq, m0);
 
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/ic/rt2661.c b/sys/dev/ic/rt2661.c
index 393b84cadb5..bb9eabe3f11 100644
--- a/sys/dev/ic/rt2661.c
+++ b/sys/dev/ic/rt2661.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2661.c,v 1.71 2014/03/11 19:45:28 guenther Exp $	*/
+/*	$OpenBSD: rt2661.c,v 1.72 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2006
@@ -1947,8 +1947,7 @@ rt2661_start(struct ifnet *ifp)
 			}
 			IF_DEQUEUE(&ic->ic_mgtq, m0);
 
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/ic/rt2860.c b/sys/dev/ic/rt2860.c
index 21ed2f2b1b9..7879145f740 100644
--- a/sys/dev/ic/rt2860.c
+++ b/sys/dev/ic/rt2860.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2860.c,v 1.71 2013/12/06 21:03:03 deraadt Exp $	*/
+/*	$OpenBSD: rt2860.c,v 1.72 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -1758,7 +1758,7 @@ rt2860_start(struct ifnet *ifp)
 		/* send pending management frames first */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
@@ -1767,7 +1767,7 @@ rt2860_start(struct ifnet *ifp)
 		/* send buffered frames for power-save mode */
 		IF_DEQUEUE(&ic->ic_pwrsaveq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 
diff --git a/sys/dev/ic/rtw.c b/sys/dev/ic/rtw.c
index 02622421ac3..d880dcfd03b 100644
--- a/sys/dev/ic/rtw.c
+++ b/sys/dev/ic/rtw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtw.c,v 1.83 2013/11/26 09:50:33 mpi Exp $	*/
+/*	$OpenBSD: rtw.c,v 1.84 2014/03/19 10:09:19 mpi Exp $	*/
 /*	$NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
 
 /*-
@@ -1504,7 +1504,7 @@ rtw_intr_beacon(struct rtw_softc *sc, u_int16_t isr)
 			    sc->sc_dev.dv_xname);
 			return;
 		}
-		m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ic->ic_bss);
+		m->m_pkthdr.ph_cookie = ieee80211_ref_node(ic->ic_bss);
 		IF_ENQUEUE(&sc->sc_beaconq, m);
 		rtw_start(&sc->sc_if);
 	}
@@ -2706,8 +2706,7 @@ rtw_80211_dequeue(struct rtw_softc *sc, struct ifqueue *ifq, int pri,
 		return NULL;
 	}
 	IF_DEQUEUE(ifq, m);
-	*nip = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-	m->m_pkthdr.rcvif = NULL;
+	*nip = m->m_pkthdr.ph_cookie;
 	return m;
 }
 
diff --git a/sys/dev/pci/if_iwn.c b/sys/dev/pci/if_iwn.c
index 65a9da515fd..10f09259788 100644
--- a/sys/dev/pci/if_iwn.c
+++ b/sys/dev/pci/if_iwn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwn.c,v 1.130 2014/02/11 19:44:22 kettenis Exp $	*/
+/*	$OpenBSD: if_iwn.c,v 1.131 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -3064,7 +3064,7 @@ iwn_start(struct ifnet *ifp)
 		/* Send pending management frames first. */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/pci/if_wpi.c b/sys/dev/pci/if_wpi.c
index 635fc73147c..e0da804d2a9 100644
--- a/sys/dev/pci/if_wpi.c
+++ b/sys/dev/pci/if_wpi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_wpi.c,v 1.117 2013/12/06 21:03:04 deraadt Exp $	*/
+/*	$OpenBSD: if_wpi.c,v 1.118 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2006-2008
@@ -1926,7 +1926,7 @@ wpi_start(struct ifnet *ifp)
 		/* Send pending management frames first. */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/usb/if_athn_usb.c b/sys/dev/usb/if_athn_usb.c
index 0b46741874c..576a73d5323 100644
--- a/sys/dev/usb/if_athn_usb.c
+++ b/sys/dev/usb/if_athn_usb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_athn_usb.c,v 1.18 2013/08/07 01:06:41 bluhm Exp $	*/
+/*	$OpenBSD: if_athn_usb.c,v 1.19 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2011 Damien Bergamini <damien.bergamini@free.fr>
@@ -2009,7 +2009,7 @@ athn_usb_start(struct ifnet *ifp)
 		/* Send pending management frames first. */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/usb/if_atu.c b/sys/dev/usb/if_atu.c
index e5a698ab4d0..df8144a52f7 100644
--- a/sys/dev/usb/if_atu.c
+++ b/sys/dev/usb/if_atu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_atu.c,v 1.105 2014/03/07 18:39:02 mpi Exp $ */
+/*	$OpenBSD: if_atu.c,v 1.106 2014/03/19 10:09:19 mpi Exp $ */
 /*
  * Copyright (c) 2003, 2004
  *	Daan Vreeken <Danovitsch@Vitsch.net>.  All rights reserved.
@@ -2013,17 +2013,7 @@ atu_start(struct ifnet *ifp)
 			DPRINTFN(25, ("%s: atu_start: mgmt packet\n",
 			    sc->atu_dev.dv_xname));
 
-			/*
-			 * Hack!  The referenced node pointer is in the
-			 * rcvif field of the packet header.  This is
-			 * placed there by ieee80211_mgmt_output because
-			 * we need to hold the reference with the frame
-			 * and there's no other way (other than packet
-			 * tags which we consider too expensive to use)
-			 * to pass it along.
-			 */
-			ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-			m->m_pkthdr.rcvif = NULL;
+			ni = m->m_pkthdr.ph_cookie;
 
 			wh = mtod(m, struct ieee80211_frame *);
 			/* sc->sc_stats.ast_tx_mgmt++; */
diff --git a/sys/dev/usb/if_otus.c b/sys/dev/usb/if_otus.c
index 7075713a3c0..707fb808243 100644
--- a/sys/dev/usb/if_otus.c
+++ b/sys/dev/usb/if_otus.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_otus.c,v 1.38 2014/03/07 18:39:02 mpi Exp $	*/
+/*	$OpenBSD: if_otus.c,v 1.39 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
@@ -1438,7 +1438,7 @@ otus_start(struct ifnet *ifp)
 		/* Send pending management frames first. */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/usb/if_ral.c b/sys/dev/usb/if_ral.c
index ac663f7e947..70b70579268 100644
--- a/sys/dev/usb/if_ral.c
+++ b/sys/dev/usb/if_ral.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ral.c,v 1.125 2014/03/07 18:39:02 mpi Exp $	*/
+/*	$OpenBSD: if_ral.c,v 1.126 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2005, 2006
@@ -1255,8 +1255,7 @@ ural_start(struct ifnet *ifp)
 			}
 			IF_DEQUEUE(&ic->ic_mgtq, m0);
 
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/usb/if_rum.c b/sys/dev/usb/if_rum.c
index 548b23aa372..8b980c76605 100644
--- a/sys/dev/usb/if_rum.c
+++ b/sys/dev/usb/if_rum.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_rum.c,v 1.102 2014/03/07 18:39:02 mpi Exp $	*/
+/*	$OpenBSD: if_rum.c,v 1.103 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
@@ -1274,8 +1274,7 @@ rum_start(struct ifnet *ifp)
 			}
 			IF_DEQUEUE(&ic->ic_mgtq, m0);
 
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/usb/if_run.c b/sys/dev/usb/if_run.c
index 214cf12d630..4a3ee8966e7 100644
--- a/sys/dev/usb/if_run.c
+++ b/sys/dev/usb/if_run.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_run.c,v 1.96 2014/03/07 18:39:02 mpi Exp $	*/
+/*	$OpenBSD: if_run.c,v 1.97 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2008-2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -2273,7 +2273,7 @@ run_start(struct ifnet *ifp)
 		/* send pending management frames first */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/usb/if_uath.c b/sys/dev/usb/if_uath.c
index ec6852209d2..3b7d76f84e2 100644
--- a/sys/dev/usb/if_uath.c
+++ b/sys/dev/usb/if_uath.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_uath.c,v 1.57 2014/03/07 18:39:02 mpi Exp $	*/
+/*	$OpenBSD: if_uath.c,v 1.58 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2006
@@ -1492,8 +1492,7 @@ uath_start(struct ifnet *ifp)
 			}
 			IF_DEQUEUE(&ic->ic_mgtq, m0);
 
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/usb/if_upgt.c b/sys/dev/usb/if_upgt.c
index 3d371f1d106..c81df52588a 100644
--- a/sys/dev/usb/if_upgt.c
+++ b/sys/dev/usb/if_upgt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_upgt.c,v 1.60 2013/08/21 05:21:45 dlg Exp $ */
+/*	$OpenBSD: if_upgt.c,v 1.61 2014/03/19 10:09:19 mpi Exp $ */
 
 /*
  * Copyright (c) 2007 Marcus Glocker <mglocker@openbsd.org>
@@ -1410,8 +1410,7 @@ upgt_start(struct ifnet *ifp)
 			/* management frame */
 			IF_DEQUEUE(&ic->ic_mgtq, m);
 
-			ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-			m->m_pkthdr.rcvif = NULL;
+			ni = m->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
diff --git a/sys/dev/usb/if_urtw.c b/sys/dev/usb/if_urtw.c
index 1bc4c5c1114..2cc01166582 100644
--- a/sys/dev/usb/if_urtw.c
+++ b/sys/dev/usb/if_urtw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_urtw.c,v 1.44 2014/03/07 18:39:02 mpi Exp $	*/
+/*	$OpenBSD: if_urtw.c,v 1.45 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
@@ -2496,8 +2496,7 @@ urtw_start(struct ifnet *ifp)
 				break;
 			}
 			IF_DEQUEUE(&ic->ic_mgtq, m0);
-			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
-			m0->m_pkthdr.rcvif = NULL;
+			ni = m0->m_pkthdr.ph_cookie;
 #if NBPFILTER > 0
 			if (ic->ic_rawbpf != NULL)
 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
diff --git a/sys/dev/usb/if_urtwn.c b/sys/dev/usb/if_urtwn.c
index f78f18504ae..ffe880e18d8 100644
--- a/sys/dev/usb/if_urtwn.c
+++ b/sys/dev/usb/if_urtwn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_urtwn.c,v 1.34 2014/03/14 15:00:47 mpi Exp $	*/
+/*	$OpenBSD: if_urtwn.c,v 1.35 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -1919,7 +1919,7 @@ urtwn_start(struct ifnet *ifp)
 		/* Send pending management frames first. */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/dev/usb/if_zyd.c b/sys/dev/usb/if_zyd.c
index e75c2670526..34937c393b9 100644
--- a/sys/dev/usb/if_zyd.c
+++ b/sys/dev/usb/if_zyd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_zyd.c,v 1.96 2014/03/07 18:39:02 mpi Exp $	*/
+/*	$OpenBSD: if_zyd.c,v 1.97 2014/03/19 10:09:19 mpi Exp $	*/
 
 /*-
  * Copyright (c) 2006 by Damien Bergamini <damien.bergamini@free.fr>
@@ -2230,7 +2230,7 @@ zyd_start(struct ifnet *ifp)
 		/* send pending management frames first */
 		IF_DEQUEUE(&ic->ic_mgtq, m);
 		if (m != NULL) {
-			ni = (void *)m->m_pkthdr.rcvif;
+			ni = m->m_pkthdr.ph_cookie;
 			goto sendit;
 		}
 		if (ic->ic_state != IEEE80211_S_RUN)
diff --git a/sys/net80211/ieee80211_output.c b/sys/net80211/ieee80211_output.c
index 3c776053b0d..31c59400aa6 100644
--- a/sys/net80211/ieee80211_output.c
+++ b/sys/net80211/ieee80211_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_output.c,v 1.89 2013/12/07 01:55:06 brad Exp $	*/
+/*	$OpenBSD: ieee80211_output.c,v 1.90 2014/03/19 10:09:19 mpi Exp $	*/
 /*	$NetBSD: ieee80211_output.c,v 1.13 2004/05/31 11:02:55 dyoung Exp $	*/
 
 /*-
@@ -202,17 +202,16 @@ ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
 	ni->ni_inact = 0;
 
 	/*
-	 * Yech, hack alert!  We want to pass the node down to the
-	 * driver's start routine.  We could stick this in an m_tag
-	 * and tack that on to the mbuf.  However that's rather
-	 * expensive to do for every frame so instead we stuff it in
-	 * the rcvif field since outbound frames do not (presently)
-	 * use this.
+	 * We want to pass the node down to the driver's start
+	 * routine.  We could stick this in an m_tag and tack that
+	 * on to the mbuf.  However that's rather expensive to do
+	 * for every frame so instead we stuff it in a special pkthdr
+	 * field.
 	 */
 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
 	if (m == NULL)
 		return ENOMEM;
-	m->m_pkthdr.rcvif = (void *)ni;
+	m->m_pkthdr.ph_cookie = ni;
 
 	wh = mtod(m, struct ieee80211_frame *);
 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
@@ -1864,7 +1863,7 @@ ieee80211_beacon_alloc(struct ieee80211com *ic, struct ieee80211_node *ni)
 #endif
 
 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
-	m->m_pkthdr.rcvif = (void *)ni;
+	m->m_pkthdr.ph_cookie = ni;
 
 	return m;
 }
@@ -1914,10 +1913,10 @@ ieee80211_pwrsave(struct ieee80211com *ic, struct mbuf *m,
 	} else {
 		IF_ENQUEUE(&ni->ni_savedq, m);
 		/*
-		 * Similar to ieee80211_mgmt_output, store the node in the
-		 * rcvif field.
+		 * Similar to ieee80211_mgmt_output, store the node in a
+		 * special pkthdr field.
 		 */
-		m->m_pkthdr.rcvif = (void *)ni;
+		m->m_pkthdr.ph_cookie = ni;
 	}
 	return 1;
 }
diff --git a/sys/sys/mbuf.h b/sys/sys/mbuf.h
index 3a9d0ff8adc..471f7bb7a35 100644
--- a/sys/sys/mbuf.h
+++ b/sys/sys/mbuf.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mbuf.h,v 1.172 2014/01/19 03:04:54 claudio Exp $	*/
+/*	$OpenBSD: mbuf.h,v 1.173 2014/03/19 10:09:20 mpi Exp $	*/
 /*	$NetBSD: mbuf.h,v 1.19 1996/02/09 18:25:14 christos Exp $	*/
 
 /*
@@ -111,13 +111,14 @@ struct pkthdr_pf {
 /* record/packet header in first mbuf of chain; valid if M_PKTHDR set */
 struct	pkthdr {
 	struct ifnet		*rcvif;		/* rcv interface */
-	SLIST_HEAD(packet_tags, m_tag) tags; /* list of packet tags */
+	SLIST_HEAD(packet_tags, m_tag) tags;	/* list of packet tags */
 	int			 len;		/* total packet length */
 	u_int16_t		 tagsset;	/* mtags attached */
 	u_int16_t		 pad;
 	u_int16_t		 csum_flags;	/* checksum flags */
 	u_int16_t		 ether_vtag;	/* Ethernet 802.1p+Q vlan tag */
 	u_int			 rdomain;	/* routing domain id */
+	void			*ph_cookie;	/* additional data */
 	struct pkthdr_pf	 pf;
 };