xref: /freebsd/sys/net80211/ieee80211_output.c (revision 33644623554bb0fc57ed3c7d874193a498679b22)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include "opt_inet.h"
31 #include "opt_wlan.h"
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/mbuf.h>
36 #include <sys/kernel.h>
37 #include <sys/endian.h>
38 
39 #include <sys/socket.h>
40 
41 #include <net/bpf.h>
42 #include <net/ethernet.h>
43 #include <net/if.h>
44 #include <net/if_llc.h>
45 #include <net/if_media.h>
46 #include <net/if_vlan_var.h>
47 
48 #include <net80211/ieee80211_var.h>
49 #include <net80211/ieee80211_regdomain.h>
50 #include <net80211/ieee80211_wds.h>
51 
52 #ifdef INET
53 #include <netinet/in.h>
54 #include <netinet/if_ether.h>
55 #include <netinet/in_systm.h>
56 #include <netinet/ip.h>
57 #endif
58 
59 #define	ETHER_HEADER_COPY(dst, src) \
60 	memcpy(dst, src, sizeof(struct ether_header))
61 
62 static struct mbuf *ieee80211_encap_fastframe(struct ieee80211vap *,
63 	struct mbuf *m1, const struct ether_header *eh1,
64 	struct mbuf *m2, const struct ether_header *eh2);
65 static int ieee80211_fragment(struct ieee80211vap *, struct mbuf *,
66 	u_int hdrsize, u_int ciphdrsize, u_int mtu);
67 static	void ieee80211_tx_mgt_cb(struct ieee80211_node *, void *, int);
68 
69 #ifdef IEEE80211_DEBUG
70 /*
71  * Decide if an outbound management frame should be
72  * printed when debugging is enabled.  This filters some
73  * of the less interesting frames that come frequently
74  * (e.g. beacons).
75  */
76 static __inline int
77 doprint(struct ieee80211vap *vap, int subtype)
78 {
79 	switch (subtype) {
80 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
81 		return (vap->iv_opmode == IEEE80211_M_IBSS);
82 	}
83 	return 1;
84 }
85 #endif
86 
87 /*
88  * Start method for vap's.  All packets from the stack come
89  * through here.  We handle common processing of the packets
90  * before dispatching them to the underlying device.
91  */
92 void
93 ieee80211_start(struct ifnet *ifp)
94 {
95 #define	IS_DWDS(vap) \
96 	(vap->iv_opmode == IEEE80211_M_WDS && \
97 	 (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY) == 0)
98 	struct ieee80211vap *vap = ifp->if_softc;
99 	struct ieee80211com *ic = vap->iv_ic;
100 	struct ifnet *parent = ic->ic_ifp;
101 	struct ieee80211_node *ni;
102 	struct mbuf *m;
103 	struct ether_header *eh;
104 	int error;
105 
106 	/* NB: parent must be up and running */
107 	if (!IFNET_IS_UP_RUNNING(parent)) {
108 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_OUTPUT,
109 		    "%s: ignore queue, parent %s not up+running\n",
110 		    __func__, parent->if_xname);
111 		/* XXX stat */
112 		return;
113 	}
114 	if (vap->iv_state == IEEE80211_S_SLEEP) {
115 		/*
116 		 * In power save, wakeup device for transmit.
117 		 */
118 		ieee80211_new_state(vap, IEEE80211_S_RUN, 0);
119 		return;
120 	}
121 	/*
122 	 * No data frames go out unless we're running.
123 	 * Note in particular this covers CAC and CSA
124 	 * states (though maybe we should check muting
125 	 * for CSA).
126 	 */
127 	if (vap->iv_state != IEEE80211_S_RUN) {
128 		IEEE80211_LOCK(ic);
129 		/* re-check under the com lock to avoid races */
130 		if (vap->iv_state != IEEE80211_S_RUN) {
131 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_OUTPUT,
132 			    "%s: ignore queue, in %s state\n",
133 			    __func__, ieee80211_state_name[vap->iv_state]);
134 			vap->iv_stats.is_tx_badstate++;
135 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
136 			IEEE80211_UNLOCK(ic);
137 			return;
138 		}
139 		IEEE80211_UNLOCK(ic);
140 	}
141 	for (;;) {
142 		IFQ_DEQUEUE(&ifp->if_snd, m);
143 		if (m == NULL)
144 			break;
145 		/*
146 		 * Sanitize mbuf flags for net80211 use.  We cannot
147 		 * clear M_PWR_SAV because this may be set for frames
148 		 * that are re-submitted from the power save queue.
149 		 *
150 		 * NB: This must be done before ieee80211_classify as
151 		 *     it marks EAPOL in frames with M_EAPOL.
152 		 */
153 		m->m_flags &= ~(M_80211_TX - M_PWR_SAV);
154 		/*
155 		 * Cancel any background scan.
156 		 */
157 		if (ic->ic_flags & IEEE80211_F_SCAN)
158 			ieee80211_cancel_anyscan(vap);
159 		/*
160 		 * Find the node for the destination so we can do
161 		 * things like power save and fast frames aggregation.
162 		 *
163 		 * NB: past this point various code assumes the first
164 		 *     mbuf has the 802.3 header present (and contiguous).
165 		 */
166 		ni = NULL;
167 		if (m->m_len < sizeof(struct ether_header) &&
168 		   (m = m_pullup(m, sizeof(struct ether_header))) == NULL) {
169 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_OUTPUT,
170 			    "discard frame, %s\n", "m_pullup failed");
171 			vap->iv_stats.is_tx_nobuf++;	/* XXX */
172 			ifp->if_oerrors++;
173 			continue;
174 		}
175 		eh = mtod(m, struct ether_header *);
176 		if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
177 			if (IS_DWDS(vap)) {
178 				/*
179 				 * Only unicast frames from the above go out
180 				 * DWDS vaps; multicast frames are handled by
181 				 * dispatching the frame as it comes through
182 				 * the AP vap (see below).
183 				 */
184 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_WDS,
185 				    eh->ether_dhost, "mcast", "%s", "on DWDS");
186 				vap->iv_stats.is_dwds_mcast++;
187 				m_freem(m);
188 				continue;
189 			}
190 			if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
191 				/*
192 				 * Spam DWDS vap's w/ multicast traffic.
193 				 */
194 				/* XXX only if dwds in use? */
195 				ieee80211_dwds_mcast(vap, m);
196 			}
197 		}
198 		ni = ieee80211_find_txnode(vap, eh->ether_dhost);
199 		if (ni == NULL) {
200 			/* NB: ieee80211_find_txnode does stat+msg */
201 			ifp->if_oerrors++;
202 			m_freem(m);
203 			continue;
204 		}
205 		/* XXX AUTH'd */
206 		/* XXX mark vap to identify if associd is required */
207 		if (ni->ni_associd == 0 &&
208 		    (vap->iv_opmode == IEEE80211_M_STA ||
209 		     vap->iv_opmode == IEEE80211_M_HOSTAP || IS_DWDS(vap))) {
210 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_OUTPUT,
211 			    eh->ether_dhost, NULL,
212 			    "sta not associated (type 0x%04x)",
213 			    htons(eh->ether_type));
214 			vap->iv_stats.is_tx_notassoc++;
215 			ifp->if_oerrors++;
216 			m_freem(m);
217 			ieee80211_free_node(ni);
218 			continue;
219 		}
220 		if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) &&
221 		    (m->m_flags & M_PWR_SAV) == 0) {
222 			/*
223 			 * Station in power save mode; pass the frame
224 			 * to the 802.11 layer and continue.  We'll get
225 			 * the frame back when the time is right.
226 			 * XXX lose WDS vap linkage?
227 			 */
228 			(void) ieee80211_pwrsave(ni, m);
229 			ieee80211_free_node(ni);
230 			continue;
231 		}
232 		/* calculate priority so drivers can find the tx queue */
233 		if (ieee80211_classify(ni, m)) {
234 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_OUTPUT,
235 			    eh->ether_dhost, NULL,
236 			    "%s", "classification failure");
237 			vap->iv_stats.is_tx_classify++;
238 			ifp->if_oerrors++;
239 			m_freem(m);
240 			ieee80211_free_node(ni);
241 			continue;
242 		}
243 
244 		BPF_MTAP(ifp, m);		/* 802.11 tx path */
245 
246 		/*
247 		 * XXX When ni is associated with a WDS link then
248 		 * the vap will be the WDS vap but ni_vap will point
249 		 * to the ap vap the station associated to.  Once
250 		 * we handoff the packet to the driver the callback
251 		 * to ieee80211_encap won't be able to tell if the
252 		 * packet should be encapsulated for WDS or not (e.g.
253 		 * multicast frames will not be handled correctly).
254 		 * We hack this by marking the mbuf so ieee80211_encap
255 		 * can do the right thing.
256 		 */
257 		if (vap->iv_opmode == IEEE80211_M_WDS)
258 			m->m_flags |= M_WDS;
259 		else
260 			m->m_flags &= ~M_WDS;
261 
262 		/*
263 		 * Stash the node pointer and hand the frame off to
264 		 * the underlying device.  Note that we do this after
265 		 * any call to ieee80211_dwds_mcast because that code
266 		 * uses any existing value for rcvif.
267 		 */
268 		m->m_pkthdr.rcvif = (void *)ni;
269 
270 		/* XXX defer if_start calls? */
271 		error = (parent->if_transmit)(parent, m);
272 		if (error != 0) {
273 			/* NB: IFQ_HANDOFF reclaims mbuf */
274 			ieee80211_free_node(ni);
275 		} else {
276 			ifp->if_opackets++;
277 		}
278 		ic->ic_lastdata = ticks;
279 	}
280 #undef IS_DWDS
281 }
282 
283 /*
284  * 802.11 output routine. This is (currently) used only to
285  * connect bpf write calls to the 802.11 layer for injecting
286  * raw 802.11 frames.  Note we locate the ieee80211com from
287  * the ifnet using a spare field setup at attach time.  This
288  * will go away when the virtual ap support comes in.
289  */
290 int
291 ieee80211_output(struct ifnet *ifp, struct mbuf *m,
292 	struct sockaddr *dst, struct rtentry *rt0)
293 {
294 #define senderr(e) do { error = (e); goto bad;} while (0)
295 	struct ieee80211_node *ni = NULL;
296 	struct ieee80211vap *vap;
297 	struct ieee80211_frame *wh;
298 	int error;
299 
300 	if (ifp->if_drv_flags & IFF_DRV_OACTIVE) {
301 		/*
302 		 * Short-circuit requests if the vap is marked OACTIVE
303 		 * as this is used when tearing down state to indicate
304 		 * the vap may be gone.  This can also happen because a
305 		 * packet came down through ieee80211_start before the
306 		 * vap entered RUN state in which case it's also ok to
307 		 * just drop the frame.  This should not be necessary
308 		 * but callers of if_output don't check OACTIVE.
309 		 */
310 		senderr(ENETDOWN);
311 	}
312 	vap = ifp->if_softc;
313 	/*
314 	 * Hand to the 802.3 code if not tagged as
315 	 * a raw 802.11 frame.
316 	 */
317 	if (dst->sa_family != AF_IEEE80211)
318 		return vap->iv_output(ifp, m, dst, rt0);
319 #ifdef MAC
320 	error = mac_check_ifnet_transmit(ifp, m);
321 	if (error)
322 		senderr(error);
323 #endif
324 	if (ifp->if_flags & IFF_MONITOR)
325 		senderr(ENETDOWN);
326 	if (!IFNET_IS_UP_RUNNING(ifp))
327 		senderr(ENETDOWN);
328 	if (vap->iv_state == IEEE80211_S_CAC) {
329 		IEEE80211_DPRINTF(vap,
330 		    IEEE80211_MSG_OUTPUT | IEEE80211_MSG_DOTH,
331 		    "block %s frame in CAC state\n", "raw data");
332 		vap->iv_stats.is_tx_badstate++;
333 		senderr(EIO);		/* XXX */
334 	}
335 	/* XXX bypass bridge, pfil, carp, etc. */
336 
337 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_ack))
338 		senderr(EIO);	/* XXX */
339 	wh = mtod(m, struct ieee80211_frame *);
340 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
341 	    IEEE80211_FC0_VERSION_0)
342 		senderr(EIO);	/* XXX */
343 
344 	/* locate destination node */
345 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
346 	case IEEE80211_FC1_DIR_NODS:
347 	case IEEE80211_FC1_DIR_FROMDS:
348 		ni = ieee80211_find_txnode(vap, wh->i_addr1);
349 		break;
350 	case IEEE80211_FC1_DIR_TODS:
351 	case IEEE80211_FC1_DIR_DSTODS:
352 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame))
353 			senderr(EIO);	/* XXX */
354 		ni = ieee80211_find_txnode(vap, wh->i_addr3);
355 		break;
356 	default:
357 		senderr(EIO);	/* XXX */
358 	}
359 	if (ni == NULL) {
360 		/*
361 		 * Permit packets w/ bpf params through regardless
362 		 * (see below about sa_len).
363 		 */
364 		if (dst->sa_len == 0)
365 			senderr(EHOSTUNREACH);
366 		ni = ieee80211_ref_node(vap->iv_bss);
367 	}
368 
369 	/*
370 	 * Sanitize mbuf for net80211 flags leaked from above.
371 	 *
372 	 * NB: This must be done before ieee80211_classify as
373 	 *     it marks EAPOL in frames with M_EAPOL.
374 	 */
375 	m->m_flags &= ~M_80211_TX;
376 
377 	/* calculate priority so drivers can find the tx queue */
378 	/* XXX assumes an 802.3 frame */
379 	if (ieee80211_classify(ni, m))
380 		senderr(EIO);		/* XXX */
381 
382 	BPF_MTAP(ifp, m);
383 
384 	/*
385 	 * NB: DLT_IEEE802_11_RADIO identifies the parameters are
386 	 * present by setting the sa_len field of the sockaddr (yes,
387 	 * this is a hack).
388 	 * NB: we assume sa_data is suitably aligned to cast.
389 	 */
390 	return vap->iv_ic->ic_raw_xmit(ni, m,
391 	    (const struct ieee80211_bpf_params *)(dst->sa_len ?
392 		dst->sa_data : NULL));
393 bad:
394 	if (m != NULL)
395 		m_freem(m);
396 	if (ni != NULL)
397 		ieee80211_free_node(ni);
398 	return error;
399 #undef senderr
400 }
401 
402 /*
403  * Set the direction field and address fields of an outgoing
404  * frame.  Note this should be called early on in constructing
405  * a frame as it sets i_fc[1]; other bits can then be or'd in.
406  */
407 static void
408 ieee80211_send_setup(
409 	struct ieee80211_node *ni,
410 	struct ieee80211_frame *wh,
411 	int type, int tid,
412 	const uint8_t sa[IEEE80211_ADDR_LEN],
413 	const uint8_t da[IEEE80211_ADDR_LEN],
414 	const uint8_t bssid[IEEE80211_ADDR_LEN])
415 {
416 #define	WH4(wh)	((struct ieee80211_frame_addr4 *)wh)
417 
418 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | type;
419 	if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
420 		struct ieee80211vap *vap = ni->ni_vap;
421 
422 		switch (vap->iv_opmode) {
423 		case IEEE80211_M_STA:
424 			wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
425 			IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
426 			IEEE80211_ADDR_COPY(wh->i_addr2, sa);
427 			IEEE80211_ADDR_COPY(wh->i_addr3, da);
428 			break;
429 		case IEEE80211_M_IBSS:
430 		case IEEE80211_M_AHDEMO:
431 			wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
432 			IEEE80211_ADDR_COPY(wh->i_addr1, da);
433 			IEEE80211_ADDR_COPY(wh->i_addr2, sa);
434 			IEEE80211_ADDR_COPY(wh->i_addr3, bssid);
435 			break;
436 		case IEEE80211_M_HOSTAP:
437 			wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
438 			IEEE80211_ADDR_COPY(wh->i_addr1, da);
439 			IEEE80211_ADDR_COPY(wh->i_addr2, bssid);
440 			IEEE80211_ADDR_COPY(wh->i_addr3, sa);
441 			break;
442 		case IEEE80211_M_WDS:
443 			wh->i_fc[1] = IEEE80211_FC1_DIR_DSTODS;
444 			IEEE80211_ADDR_COPY(wh->i_addr1, da);
445 			IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
446 			IEEE80211_ADDR_COPY(wh->i_addr3, da);
447 			IEEE80211_ADDR_COPY(WH4(wh)->i_addr4, sa);
448 			break;
449 		case IEEE80211_M_MONITOR:	/* NB: to quiet compiler */
450 			break;
451 		}
452 	} else {
453 		wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
454 		IEEE80211_ADDR_COPY(wh->i_addr1, da);
455 		IEEE80211_ADDR_COPY(wh->i_addr2, sa);
456 		IEEE80211_ADDR_COPY(wh->i_addr3, bssid);
457 	}
458 	*(uint16_t *)&wh->i_dur[0] = 0;
459 	*(uint16_t *)&wh->i_seq[0] =
460 	    htole16(ni->ni_txseqs[tid] << IEEE80211_SEQ_SEQ_SHIFT);
461 	ni->ni_txseqs[tid]++;
462 #undef WH4
463 }
464 
465 /*
466  * Send a management frame to the specified node.  The node pointer
467  * must have a reference as the pointer will be passed to the driver
468  * and potentially held for a long time.  If the frame is successfully
469  * dispatched to the driver, then it is responsible for freeing the
470  * reference (and potentially free'ing up any associated storage);
471  * otherwise deal with reclaiming any reference (on error).
472  */
473 int
474 ieee80211_mgmt_output(struct ieee80211_node *ni, struct mbuf *m, int type,
475 	struct ieee80211_bpf_params *params)
476 {
477 	struct ieee80211vap *vap = ni->ni_vap;
478 	struct ieee80211com *ic = ni->ni_ic;
479 	struct ieee80211_frame *wh;
480 
481 	KASSERT(ni != NULL, ("null node"));
482 
483 	if (vap->iv_state == IEEE80211_S_CAC) {
484 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT | IEEE80211_MSG_DOTH,
485 		    ni, "block %s frame in CAC state",
486 			ieee80211_mgt_subtype_name[
487 			    (type & IEEE80211_FC0_SUBTYPE_MASK) >>
488 				IEEE80211_FC0_SUBTYPE_SHIFT]);
489 		vap->iv_stats.is_tx_badstate++;
490 		ieee80211_free_node(ni);
491 		m_freem(m);
492 		return EIO;		/* XXX */
493 	}
494 
495 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
496 	if (m == NULL) {
497 		ieee80211_free_node(ni);
498 		return ENOMEM;
499 	}
500 
501 	wh = mtod(m, struct ieee80211_frame *);
502 	ieee80211_send_setup(ni, wh,
503 	     IEEE80211_FC0_TYPE_MGT | type, IEEE80211_NONQOS_TID,
504 	     vap->iv_myaddr, ni->ni_macaddr, ni->ni_bssid);
505 	if (params->ibp_flags & IEEE80211_BPF_CRYPTO) {
506 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr1,
507 		    "encrypting frame (%s)", __func__);
508 		wh->i_fc[1] |= IEEE80211_FC1_WEP;
509 	}
510 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
511 
512 	KASSERT(type != IEEE80211_FC0_SUBTYPE_PROBE_RESP, ("probe response?"));
513 	M_WME_SETAC(m, params->ibp_pri);
514 
515 #ifdef IEEE80211_DEBUG
516 	/* avoid printing too many frames */
517 	if ((ieee80211_msg_debug(vap) && doprint(vap, type)) ||
518 	    ieee80211_msg_dumppkts(vap)) {
519 		printf("[%s] send %s on channel %u\n",
520 		    ether_sprintf(wh->i_addr1),
521 		    ieee80211_mgt_subtype_name[
522 			(type & IEEE80211_FC0_SUBTYPE_MASK) >>
523 				IEEE80211_FC0_SUBTYPE_SHIFT],
524 		    ieee80211_chan2ieee(ic, ic->ic_curchan));
525 	}
526 #endif
527 	IEEE80211_NODE_STAT(ni, tx_mgmt);
528 
529 	return ic->ic_raw_xmit(ni, m, params);
530 }
531 
532 /*
533  * Send a null data frame to the specified node.  If the station
534  * is setup for QoS then a QoS Null Data frame is constructed.
535  * If this is a WDS station then a 4-address frame is constructed.
536  *
537  * NB: the caller is assumed to have setup a node reference
538  *     for use; this is necessary to deal with a race condition
539  *     when probing for inactive stations.  Like ieee80211_mgmt_output
540  *     we must cleanup any node reference on error;  however we
541  *     can safely just unref it as we know it will never be the
542  *     last reference to the node.
543  */
544 int
545 ieee80211_send_nulldata(struct ieee80211_node *ni)
546 {
547 	struct ieee80211vap *vap = ni->ni_vap;
548 	struct ieee80211com *ic = ni->ni_ic;
549 	struct mbuf *m;
550 	struct ieee80211_frame *wh;
551 	int hdrlen;
552 	uint8_t *frm;
553 
554 	if (vap->iv_state == IEEE80211_S_CAC) {
555 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT | IEEE80211_MSG_DOTH,
556 		    ni, "block %s frame in CAC state", "null data");
557 		ieee80211_unref_node(&ni);
558 		vap->iv_stats.is_tx_badstate++;
559 		return EIO;		/* XXX */
560 	}
561 
562 	if (ni->ni_flags & (IEEE80211_NODE_QOS|IEEE80211_NODE_HT))
563 		hdrlen = sizeof(struct ieee80211_qosframe);
564 	else
565 		hdrlen = sizeof(struct ieee80211_frame);
566 	/* NB: only WDS vap's get 4-address frames */
567 	if (vap->iv_opmode == IEEE80211_M_WDS)
568 		hdrlen += IEEE80211_ADDR_LEN;
569 	if (ic->ic_flags & IEEE80211_F_DATAPAD)
570 		hdrlen = roundup(hdrlen, sizeof(uint32_t));
571 
572 	m = ieee80211_getmgtframe(&frm, ic->ic_headroom + hdrlen, 0);
573 	if (m == NULL) {
574 		/* XXX debug msg */
575 		ieee80211_unref_node(&ni);
576 		vap->iv_stats.is_tx_nobuf++;
577 		return ENOMEM;
578 	}
579 	KASSERT(M_LEADINGSPACE(m) >= hdrlen,
580 	    ("leading space %zd", M_LEADINGSPACE(m)));
581 	M_PREPEND(m, hdrlen, M_DONTWAIT);
582 	if (m == NULL) {
583 		/* NB: cannot happen */
584 		ieee80211_free_node(ni);
585 		return ENOMEM;
586 	}
587 
588 	wh = mtod(m, struct ieee80211_frame *);		/* NB: a little lie */
589 	if (ni->ni_flags & IEEE80211_NODE_QOS) {
590 		const int tid = WME_AC_TO_TID(WME_AC_BE);
591 		uint8_t *qos;
592 
593 		ieee80211_send_setup(ni, wh,
594 		    IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS_NULL,
595 		    tid, vap->iv_myaddr, ni->ni_macaddr, ni->ni_bssid);
596 
597 		if (vap->iv_opmode == IEEE80211_M_WDS)
598 			qos = ((struct ieee80211_qosframe_addr4 *) wh)->i_qos;
599 		else
600 			qos = ((struct ieee80211_qosframe *) wh)->i_qos;
601 		qos[0] = tid & IEEE80211_QOS_TID;
602 		if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[WME_AC_BE].wmep_noackPolicy)
603 			qos[0] |= IEEE80211_QOS_ACKPOLICY_NOACK;
604 		qos[1] = 0;
605 	} else {
606 		ieee80211_send_setup(ni, wh,
607 		    IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
608 		    IEEE80211_NONQOS_TID,
609 		    vap->iv_myaddr, ni->ni_macaddr, ni->ni_bssid);
610 	}
611 	if (vap->iv_opmode != IEEE80211_M_WDS) {
612 		/* NB: power management bit is never sent by an AP */
613 		if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) &&
614 		    vap->iv_opmode != IEEE80211_M_HOSTAP)
615 			wh->i_fc[1] |= IEEE80211_FC1_PWR_MGT;
616 	}
617 	m->m_len = m->m_pkthdr.len = hdrlen;
618 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
619 
620 	M_WME_SETAC(m, WME_AC_BE);
621 
622 	IEEE80211_NODE_STAT(ni, tx_data);
623 
624 	IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_DUMPPKTS, ni,
625 	    "send %snull data frame on channel %u, pwr mgt %s",
626 	    ni->ni_flags & IEEE80211_NODE_QOS ? "QoS " : "",
627 	    ieee80211_chan2ieee(ic, ic->ic_curchan),
628 	    wh->i_fc[1] & IEEE80211_FC1_PWR_MGT ? "ena" : "dis");
629 
630 	return ic->ic_raw_xmit(ni, m, NULL);
631 }
632 
633 /*
634  * Assign priority to a frame based on any vlan tag assigned
635  * to the station and/or any Diffserv setting in an IP header.
636  * Finally, if an ACM policy is setup (in station mode) it's
637  * applied.
638  */
639 int
640 ieee80211_classify(struct ieee80211_node *ni, struct mbuf *m)
641 {
642 	const struct ether_header *eh = mtod(m, struct ether_header *);
643 	int v_wme_ac, d_wme_ac, ac;
644 
645 	/*
646 	 * Always promote PAE/EAPOL frames to high priority.
647 	 */
648 	if (eh->ether_type == htons(ETHERTYPE_PAE)) {
649 		/* NB: mark so others don't need to check header */
650 		m->m_flags |= M_EAPOL;
651 		ac = WME_AC_VO;
652 		goto done;
653 	}
654 	/*
655 	 * Non-qos traffic goes to BE.
656 	 */
657 	if ((ni->ni_flags & IEEE80211_NODE_QOS) == 0) {
658 		ac = WME_AC_BE;
659 		goto done;
660 	}
661 
662 	/*
663 	 * If node has a vlan tag then all traffic
664 	 * to it must have a matching tag.
665 	 */
666 	v_wme_ac = 0;
667 	if (ni->ni_vlan != 0) {
668 		 if ((m->m_flags & M_VLANTAG) == 0) {
669 			IEEE80211_NODE_STAT(ni, tx_novlantag);
670 			return 1;
671 		}
672 		if (EVL_VLANOFTAG(m->m_pkthdr.ether_vtag) !=
673 		    EVL_VLANOFTAG(ni->ni_vlan)) {
674 			IEEE80211_NODE_STAT(ni, tx_vlanmismatch);
675 			return 1;
676 		}
677 		/* map vlan priority to AC */
678 		v_wme_ac = TID_TO_WME_AC(EVL_PRIOFTAG(ni->ni_vlan));
679 	}
680 
681 #ifdef INET
682 	if (eh->ether_type == htons(ETHERTYPE_IP)) {
683 		uint8_t tos;
684 		/*
685 		 * IP frame, map the DSCP bits from the TOS field.
686 		 */
687 		/* XXX m_copydata may be too slow for fast path */
688 		/* NB: ip header may not be in first mbuf */
689 		m_copydata(m, sizeof(struct ether_header) +
690 		    offsetof(struct ip, ip_tos), sizeof(tos), &tos);
691 		tos >>= 5;		/* NB: ECN + low 3 bits of DSCP */
692 		d_wme_ac = TID_TO_WME_AC(tos);
693 	} else {
694 #endif /* INET */
695 		d_wme_ac = WME_AC_BE;
696 #ifdef INET
697 	}
698 #endif
699 	/*
700 	 * Use highest priority AC.
701 	 */
702 	if (v_wme_ac > d_wme_ac)
703 		ac = v_wme_ac;
704 	else
705 		ac = d_wme_ac;
706 
707 	/*
708 	 * Apply ACM policy.
709 	 */
710 	if (ni->ni_vap->iv_opmode == IEEE80211_M_STA) {
711 		static const int acmap[4] = {
712 			WME_AC_BK,	/* WME_AC_BE */
713 			WME_AC_BK,	/* WME_AC_BK */
714 			WME_AC_BE,	/* WME_AC_VI */
715 			WME_AC_VI,	/* WME_AC_VO */
716 		};
717 		struct ieee80211com *ic = ni->ni_ic;
718 
719 		while (ac != WME_AC_BK &&
720 		    ic->ic_wme.wme_wmeBssChanParams.cap_wmeParams[ac].wmep_acm)
721 			ac = acmap[ac];
722 	}
723 done:
724 	M_WME_SETAC(m, ac);
725 	return 0;
726 }
727 
728 /*
729  * Insure there is sufficient contiguous space to encapsulate the
730  * 802.11 data frame.  If room isn't already there, arrange for it.
731  * Drivers and cipher modules assume we have done the necessary work
732  * and fail rudely if they don't find the space they need.
733  */
734 static struct mbuf *
735 ieee80211_mbuf_adjust(struct ieee80211vap *vap, int hdrsize,
736 	struct ieee80211_key *key, struct mbuf *m)
737 {
738 #define	TO_BE_RECLAIMED	(sizeof(struct ether_header) - sizeof(struct llc))
739 	int needed_space = vap->iv_ic->ic_headroom + hdrsize;
740 
741 	if (key != NULL) {
742 		/* XXX belongs in crypto code? */
743 		needed_space += key->wk_cipher->ic_header;
744 		/* XXX frags */
745 		/*
746 		 * When crypto is being done in the host we must insure
747 		 * the data are writable for the cipher routines; clone
748 		 * a writable mbuf chain.
749 		 * XXX handle SWMIC specially
750 		 */
751 		if (key->wk_flags & (IEEE80211_KEY_SWENCRYPT|IEEE80211_KEY_SWENMIC)) {
752 			m = m_unshare(m, M_NOWAIT);
753 			if (m == NULL) {
754 				IEEE80211_DPRINTF(vap, IEEE80211_MSG_OUTPUT,
755 				    "%s: cannot get writable mbuf\n", __func__);
756 				vap->iv_stats.is_tx_nobuf++; /* XXX new stat */
757 				return NULL;
758 			}
759 		}
760 	}
761 	/*
762 	 * We know we are called just before stripping an Ethernet
763 	 * header and prepending an LLC header.  This means we know
764 	 * there will be
765 	 *	sizeof(struct ether_header) - sizeof(struct llc)
766 	 * bytes recovered to which we need additional space for the
767 	 * 802.11 header and any crypto header.
768 	 */
769 	/* XXX check trailing space and copy instead? */
770 	if (M_LEADINGSPACE(m) < needed_space - TO_BE_RECLAIMED) {
771 		struct mbuf *n = m_gethdr(M_NOWAIT, m->m_type);
772 		if (n == NULL) {
773 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_OUTPUT,
774 			    "%s: cannot expand storage\n", __func__);
775 			vap->iv_stats.is_tx_nobuf++;
776 			m_freem(m);
777 			return NULL;
778 		}
779 		KASSERT(needed_space <= MHLEN,
780 		    ("not enough room, need %u got %zu\n", needed_space, MHLEN));
781 		/*
782 		 * Setup new mbuf to have leading space to prepend the
783 		 * 802.11 header and any crypto header bits that are
784 		 * required (the latter are added when the driver calls
785 		 * back to ieee80211_crypto_encap to do crypto encapsulation).
786 		 */
787 		/* NB: must be first 'cuz it clobbers m_data */
788 		m_move_pkthdr(n, m);
789 		n->m_len = 0;			/* NB: m_gethdr does not set */
790 		n->m_data += needed_space;
791 		/*
792 		 * Pull up Ethernet header to create the expected layout.
793 		 * We could use m_pullup but that's overkill (i.e. we don't
794 		 * need the actual data) and it cannot fail so do it inline
795 		 * for speed.
796 		 */
797 		/* NB: struct ether_header is known to be contiguous */
798 		n->m_len += sizeof(struct ether_header);
799 		m->m_len -= sizeof(struct ether_header);
800 		m->m_data += sizeof(struct ether_header);
801 		/*
802 		 * Replace the head of the chain.
803 		 */
804 		n->m_next = m;
805 		m = n;
806 	}
807 	return m;
808 #undef TO_BE_RECLAIMED
809 }
810 
811 /*
812  * Return the transmit key to use in sending a unicast frame.
813  * If a unicast key is set we use that.  When no unicast key is set
814  * we fall back to the default transmit key.
815  */
816 static __inline struct ieee80211_key *
817 ieee80211_crypto_getucastkey(struct ieee80211vap *vap,
818 	struct ieee80211_node *ni)
819 {
820 	if (IEEE80211_KEY_UNDEFINED(&ni->ni_ucastkey)) {
821 		if (vap->iv_def_txkey == IEEE80211_KEYIX_NONE ||
822 		    IEEE80211_KEY_UNDEFINED(&vap->iv_nw_keys[vap->iv_def_txkey]))
823 			return NULL;
824 		return &vap->iv_nw_keys[vap->iv_def_txkey];
825 	} else {
826 		return &ni->ni_ucastkey;
827 	}
828 }
829 
830 /*
831  * Return the transmit key to use in sending a multicast frame.
832  * Multicast traffic always uses the group key which is installed as
833  * the default tx key.
834  */
835 static __inline struct ieee80211_key *
836 ieee80211_crypto_getmcastkey(struct ieee80211vap *vap,
837 	struct ieee80211_node *ni)
838 {
839 	if (vap->iv_def_txkey == IEEE80211_KEYIX_NONE ||
840 	    IEEE80211_KEY_UNDEFINED(&vap->iv_nw_keys[vap->iv_def_txkey]))
841 		return NULL;
842 	return &vap->iv_nw_keys[vap->iv_def_txkey];
843 }
844 
845 /*
846  * Encapsulate an outbound data frame.  The mbuf chain is updated.
847  * If an error is encountered NULL is returned.  The caller is required
848  * to provide a node reference and pullup the ethernet header in the
849  * first mbuf.
850  *
851  * NB: Packet is assumed to be processed by ieee80211_classify which
852  *     marked EAPOL frames w/ M_EAPOL.
853  */
854 struct mbuf *
855 ieee80211_encap(struct ieee80211_node *ni, struct mbuf *m)
856 {
857 #define	WH4(wh)	((struct ieee80211_frame_addr4 *)(wh))
858 	struct ieee80211vap *vap = ni->ni_vap;
859 	struct ieee80211com *ic = ni->ni_ic;
860 	struct ether_header eh;
861 	struct ieee80211_frame *wh;
862 	struct ieee80211_key *key;
863 	struct llc *llc;
864 	int hdrsize, hdrspace, datalen, addqos, txfrag, isff, is4addr;
865 
866 	/*
867 	 * Copy existing Ethernet header to a safe place.  The
868 	 * rest of the code assumes it's ok to strip it when
869 	 * reorganizing state for the final encapsulation.
870 	 */
871 	KASSERT(m->m_len >= sizeof(eh), ("no ethernet header!"));
872 	ETHER_HEADER_COPY(&eh, mtod(m, caddr_t));
873 
874 	/*
875 	 * Insure space for additional headers.  First identify
876 	 * transmit key to use in calculating any buffer adjustments
877 	 * required.  This is also used below to do privacy
878 	 * encapsulation work.  Then calculate the 802.11 header
879 	 * size and any padding required by the driver.
880 	 *
881 	 * Note key may be NULL if we fall back to the default
882 	 * transmit key and that is not set.  In that case the
883 	 * buffer may not be expanded as needed by the cipher
884 	 * routines, but they will/should discard it.
885 	 */
886 	if (vap->iv_flags & IEEE80211_F_PRIVACY) {
887 		if (vap->iv_opmode == IEEE80211_M_STA ||
888 		    !IEEE80211_IS_MULTICAST(eh.ether_dhost) ||
889 		    (vap->iv_opmode == IEEE80211_M_WDS &&
890 		     (vap->iv_flags_ext & IEEE80211_FEXT_WDSLEGACY)))
891 			key = ieee80211_crypto_getucastkey(vap, ni);
892 		else
893 			key = ieee80211_crypto_getmcastkey(vap, ni);
894 		if (key == NULL && (m->m_flags & M_EAPOL) == 0) {
895 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO,
896 			    eh.ether_dhost,
897 			    "no default transmit key (%s) deftxkey %u",
898 			    __func__, vap->iv_def_txkey);
899 			vap->iv_stats.is_tx_nodefkey++;
900 			goto bad;
901 		}
902 	} else
903 		key = NULL;
904 	/*
905 	 * XXX Some ap's don't handle QoS-encapsulated EAPOL
906 	 * frames so suppress use.  This may be an issue if other
907 	 * ap's require all data frames to be QoS-encapsulated
908 	 * once negotiated in which case we'll need to make this
909 	 * configurable.
910 	 */
911 	addqos = (ni->ni_flags & (IEEE80211_NODE_QOS|IEEE80211_NODE_HT)) &&
912 		 (m->m_flags & M_EAPOL) == 0;
913 	if (addqos)
914 		hdrsize = sizeof(struct ieee80211_qosframe);
915 	else
916 		hdrsize = sizeof(struct ieee80211_frame);
917 	/*
918 	 * 4-address frames need to be generated for:
919 	 * o packets sent through a WDS vap (M_WDS || IEEE80211_M_WDS)
920 	 * o packets relayed by a station operating with dynamic WDS
921 	 *   (IEEE80211_M_STA+IEEE80211_F_DWDS and src address)
922 	 */
923 	is4addr = (m->m_flags & M_WDS) ||
924 	    vap->iv_opmode == IEEE80211_M_WDS ||	/* XXX redundant? */
925 	    (vap->iv_opmode == IEEE80211_M_STA &&
926 	     (vap->iv_flags & IEEE80211_F_DWDS) &&
927 	     !IEEE80211_ADDR_EQ(eh.ether_shost, vap->iv_myaddr));
928 	if (is4addr)
929 		hdrsize += IEEE80211_ADDR_LEN;
930 	/*
931 	 * Honor driver DATAPAD requirement.
932 	 */
933 	if (ic->ic_flags & IEEE80211_F_DATAPAD)
934 		hdrspace = roundup(hdrsize, sizeof(uint32_t));
935 	else
936 		hdrspace = hdrsize;
937 
938 	if ((isff = m->m_flags & M_FF) != 0) {
939 		struct mbuf *m2;
940 		struct ether_header eh2;
941 
942 		/*
943 		 * Fast frame encapsulation.  There must be two packets
944 		 * chained with m_nextpkt.  We do header adjustment for
945 		 * each, add the tunnel encapsulation, and then concatenate
946 		 * the mbuf chains to form a single frame for transmission.
947 		 */
948 		m2 = m->m_nextpkt;
949 		if (m2 == NULL) {
950 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
951 				"%s: only one frame\n", __func__);
952 			goto bad;
953 		}
954 		m->m_nextpkt = NULL;
955 		/*
956 		 * Include fast frame headers in adjusting header
957 		 * layout; this allocates space according to what
958 		 * ieee80211_encap_fastframe will do.
959 		 */
960 		m = ieee80211_mbuf_adjust(vap,
961 			hdrspace + sizeof(struct llc) + sizeof(uint32_t) + 2 +
962 			    sizeof(struct ether_header),
963 			key, m);
964 		if (m == NULL) {
965 			/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
966 			m_freem(m2);
967 			goto bad;
968 		}
969 		/*
970 		 * Copy second frame's Ethernet header out of line
971 		 * and adjust for encapsulation headers.  Note that
972 		 * we make room for padding in case there isn't room
973 		 * at the end of first frame.
974 		 */
975 		KASSERT(m2->m_len >= sizeof(eh2), ("no ethernet header!"));
976 		ETHER_HEADER_COPY(&eh2, mtod(m2, caddr_t));
977 		m2 = ieee80211_mbuf_adjust(vap,
978 			ATH_FF_MAX_HDR_PAD + sizeof(struct ether_header),
979 			NULL, m2);
980 		if (m2 == NULL) {
981 			/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
982 			goto bad;
983 		}
984 		m = ieee80211_encap_fastframe(vap, m, &eh, m2, &eh2);
985 		if (m == NULL)
986 			goto bad;
987 	} else {
988 		/*
989 		 * Normal frame.
990 		 */
991 		m = ieee80211_mbuf_adjust(vap, hdrspace, key, m);
992 		if (m == NULL) {
993 			/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
994 			goto bad;
995 		}
996 		/* NB: this could be optimized 'cuz of ieee80211_mbuf_adjust */
997 		m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
998 		llc = mtod(m, struct llc *);
999 		llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
1000 		llc->llc_control = LLC_UI;
1001 		llc->llc_snap.org_code[0] = 0;
1002 		llc->llc_snap.org_code[1] = 0;
1003 		llc->llc_snap.org_code[2] = 0;
1004 		llc->llc_snap.ether_type = eh.ether_type;
1005 	}
1006 	datalen = m->m_pkthdr.len;		/* NB: w/o 802.11 header */
1007 
1008 	M_PREPEND(m, hdrspace, M_DONTWAIT);
1009 	if (m == NULL) {
1010 		vap->iv_stats.is_tx_nobuf++;
1011 		goto bad;
1012 	}
1013 	wh = mtod(m, struct ieee80211_frame *);
1014 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
1015 	*(uint16_t *)wh->i_dur = 0;
1016 	if (is4addr) {
1017 		wh->i_fc[1] = IEEE80211_FC1_DIR_DSTODS;
1018 		IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
1019 		IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
1020 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
1021 		IEEE80211_ADDR_COPY(WH4(wh)->i_addr4, eh.ether_shost);
1022 	} else switch (vap->iv_opmode) {
1023 	case IEEE80211_M_STA:
1024 		wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
1025 		IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
1026 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
1027 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
1028 		break;
1029 	case IEEE80211_M_IBSS:
1030 	case IEEE80211_M_AHDEMO:
1031 		wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1032 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
1033 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
1034 		/*
1035 		 * NB: always use the bssid from iv_bss as the
1036 		 *     neighbor's may be stale after an ibss merge
1037 		 */
1038 		IEEE80211_ADDR_COPY(wh->i_addr3, vap->iv_bss->ni_bssid);
1039 		break;
1040 	case IEEE80211_M_HOSTAP:
1041 		wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
1042 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
1043 		IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
1044 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
1045 		break;
1046 	case IEEE80211_M_MONITOR:
1047 	case IEEE80211_M_WDS:		/* NB: is4addr should always be true */
1048 		goto bad;
1049 	}
1050 	if (m->m_flags & M_MORE_DATA)
1051 		wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
1052 	if (addqos) {
1053 		uint8_t *qos;
1054 		int ac, tid;
1055 
1056 		if (is4addr) {
1057 			qos = ((struct ieee80211_qosframe_addr4 *) wh)->i_qos;
1058 		} else
1059 			qos = ((struct ieee80211_qosframe *) wh)->i_qos;
1060 		ac = M_WME_GETAC(m);
1061 		/* map from access class/queue to 11e header priorty value */
1062 		tid = WME_AC_TO_TID(ac);
1063 		qos[0] = tid & IEEE80211_QOS_TID;
1064 		/*
1065 		 * Check if A-MPDU tx aggregation is setup or if we
1066 		 * should try to enable it.  The sta must be associated
1067 		 * with HT and A-MPDU enabled for use.  When the policy
1068 		 * routine decides we should enable A-MPDU we issue an
1069 		 * ADDBA request and wait for a reply.  The frame being
1070 		 * encapsulated will go out w/o using A-MPDU, or possibly
1071 		 * it might be collected by the driver and held/retransmit.
1072 		 * The default ic_ampdu_enable routine handles staggering
1073 		 * ADDBA requests in case the receiver NAK's us or we are
1074 		 * otherwise unable to establish a BA stream.
1075 		 */
1076 		if ((ni->ni_flags & IEEE80211_NODE_AMPDU_TX) &&
1077 		    (vap->iv_flags_ext & IEEE80211_FEXT_AMPDU_TX)) {
1078 			struct ieee80211_tx_ampdu *tap = &ni->ni_tx_ampdu[ac];
1079 
1080 			ieee80211_txampdu_count_packet(tap);
1081 			if (IEEE80211_AMPDU_RUNNING(tap)) {
1082 				/*
1083 				 * Operational, mark frame for aggregation.
1084 				 *
1085 				 * NB: We support only immediate BA's for
1086 				 * AMPDU which means we set the QoS control
1087 				 * field to "normal ack" (0) to get "implicit
1088 				 * block ack" behaviour.
1089 				 */
1090 				m->m_flags |= M_AMPDU_MPDU;
1091 			} else if (!IEEE80211_AMPDU_REQUESTED(tap) &&
1092 			    ic->ic_ampdu_enable(ni, tap)) {
1093 				/*
1094 				 * Not negotiated yet, request service.
1095 				 */
1096 				ieee80211_ampdu_request(ni, tap);
1097 			}
1098 		}
1099 		/* XXX works even when BA marked above */
1100 		if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy)
1101 			qos[0] |= IEEE80211_QOS_ACKPOLICY_NOACK;
1102 		qos[1] = 0;
1103 		wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS;
1104 
1105 		if ((m->m_flags & M_AMPDU_MPDU) == 0) {
1106 			/*
1107 			 * NB: don't assign a sequence # to potential
1108 			 * aggregates; we expect this happens at the
1109 			 * point the frame comes off any aggregation q
1110 			 * as otherwise we may introduce holes in the
1111 			 * BA sequence space and/or make window accouting
1112 			 * more difficult.
1113 			 *
1114 			 * XXX may want to control this with a driver
1115 			 * capability; this may also change when we pull
1116 			 * aggregation up into net80211
1117 			 */
1118 			*(uint16_t *)wh->i_seq =
1119 			    htole16(ni->ni_txseqs[tid] << IEEE80211_SEQ_SEQ_SHIFT);
1120 			ni->ni_txseqs[tid]++;
1121 		}
1122 	} else {
1123 		*(uint16_t *)wh->i_seq =
1124 		    htole16(ni->ni_txseqs[IEEE80211_NONQOS_TID] << IEEE80211_SEQ_SEQ_SHIFT);
1125 		ni->ni_txseqs[IEEE80211_NONQOS_TID]++;
1126 	}
1127 	/* check if xmit fragmentation is required */
1128 	txfrag = (m->m_pkthdr.len > vap->iv_fragthreshold &&
1129 	    !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1130 	    (vap->iv_caps & IEEE80211_C_TXFRAG) &&
1131 	    !isff);		/* NB: don't fragment ff's */
1132 	if (key != NULL) {
1133 		/*
1134 		 * IEEE 802.1X: send EAPOL frames always in the clear.
1135 		 * WPA/WPA2: encrypt EAPOL keys when pairwise keys are set.
1136 		 */
1137 		if ((m->m_flags & M_EAPOL) == 0 ||
1138 		    ((vap->iv_flags & IEEE80211_F_WPA) &&
1139 		     (vap->iv_opmode == IEEE80211_M_STA ?
1140 		      !IEEE80211_KEY_UNDEFINED(key) :
1141 		      !IEEE80211_KEY_UNDEFINED(&ni->ni_ucastkey)))) {
1142 			wh->i_fc[1] |= IEEE80211_FC1_WEP;
1143 			if (!ieee80211_crypto_enmic(vap, key, m, txfrag)) {
1144 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT,
1145 				    eh.ether_dhost,
1146 				    "%s", "enmic failed, discard frame");
1147 				vap->iv_stats.is_crypto_enmicfail++;
1148 				goto bad;
1149 			}
1150 		}
1151 	}
1152 	if (txfrag && !ieee80211_fragment(vap, m, hdrsize,
1153 	    key != NULL ? key->wk_cipher->ic_header : 0, vap->iv_fragthreshold))
1154 		goto bad;
1155 
1156 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
1157 
1158 	IEEE80211_NODE_STAT(ni, tx_data);
1159 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1160 		IEEE80211_NODE_STAT(ni, tx_mcast);
1161 	else
1162 		IEEE80211_NODE_STAT(ni, tx_ucast);
1163 	IEEE80211_NODE_STAT_ADD(ni, tx_bytes, datalen);
1164 
1165 	/* XXX fragmented frames not handled */
1166 	if (bpf_peers_present(vap->iv_rawbpf))
1167 		bpf_mtap(vap->iv_rawbpf, m);
1168 
1169 	return m;
1170 bad:
1171 	if (m != NULL)
1172 		m_freem(m);
1173 	return NULL;
1174 #undef WH4
1175 }
1176 
1177 /*
1178  * Do Ethernet-LLC encapsulation for each payload in a fast frame
1179  * tunnel encapsulation.  The frame is assumed to have an Ethernet
1180  * header at the front that must be stripped before prepending the
1181  * LLC followed by the Ethernet header passed in (with an Ethernet
1182  * type that specifies the payload size).
1183  */
1184 static struct mbuf *
1185 ieee80211_encap1(struct ieee80211vap *vap, struct mbuf *m,
1186 	const struct ether_header *eh)
1187 {
1188 	struct llc *llc;
1189 	uint16_t payload;
1190 
1191 	/* XXX optimize by combining m_adj+M_PREPEND */
1192 	m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
1193 	llc = mtod(m, struct llc *);
1194 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
1195 	llc->llc_control = LLC_UI;
1196 	llc->llc_snap.org_code[0] = 0;
1197 	llc->llc_snap.org_code[1] = 0;
1198 	llc->llc_snap.org_code[2] = 0;
1199 	llc->llc_snap.ether_type = eh->ether_type;
1200 	payload = m->m_pkthdr.len;		/* NB: w/o Ethernet header */
1201 
1202 	M_PREPEND(m, sizeof(struct ether_header), M_DONTWAIT);
1203 	if (m == NULL) {		/* XXX cannot happen */
1204 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1205 			"%s: no space for ether_header\n", __func__);
1206 		vap->iv_stats.is_tx_nobuf++;
1207 		return NULL;
1208 	}
1209 	ETHER_HEADER_COPY(mtod(m, void *), eh);
1210 	mtod(m, struct ether_header *)->ether_type = htons(payload);
1211 	return m;
1212 }
1213 
1214 /*
1215  * Do fast frame tunnel encapsulation.  The two frames and
1216  * Ethernet headers are supplied.  The caller is assumed to
1217  * have arrange for space in the mbuf chains for encapsulating
1218  * headers (to avoid major mbuf fragmentation).
1219  *
1220  * The encapsulated frame is returned or NULL if there is a
1221  * problem (should not happen).
1222  */
1223 static struct mbuf *
1224 ieee80211_encap_fastframe(struct ieee80211vap *vap,
1225 	struct mbuf *m1, const struct ether_header *eh1,
1226 	struct mbuf *m2, const struct ether_header *eh2)
1227 {
1228 	struct llc *llc;
1229 	struct mbuf *m;
1230 	int pad;
1231 
1232 	/*
1233 	 * First, each frame gets a standard encapsulation.
1234 	 */
1235 	m1 = ieee80211_encap1(vap, m1, eh1);
1236 	if (m1 == NULL) {
1237 		m_freem(m2);
1238 		return NULL;
1239 	}
1240 	m2 = ieee80211_encap1(vap, m2, eh2);
1241 	if (m2 == NULL) {
1242 		m_freem(m1);
1243 		return NULL;
1244 	}
1245 
1246 	/*
1247 	 * Pad leading frame to a 4-byte boundary.  If there
1248 	 * is space at the end of the first frame, put it
1249 	 * there; otherwise prepend to the front of the second
1250 	 * frame.  We know doing the second will always work
1251 	 * because we reserve space above.  We prefer appending
1252 	 * as this typically has better DMA alignment properties.
1253 	 */
1254 	for (m = m1; m->m_next != NULL; m = m->m_next)
1255 		;
1256 	pad = roundup2(m1->m_pkthdr.len, 4) - m1->m_pkthdr.len;
1257 	if (pad) {
1258 		if (M_TRAILINGSPACE(m) < pad) {		/* prepend to second */
1259 			m2->m_data -= pad;
1260 			m2->m_len += pad;
1261 			m2->m_pkthdr.len += pad;
1262 		} else {				/* append to first */
1263 			m->m_len += pad;
1264 			m1->m_pkthdr.len += pad;
1265 		}
1266 	}
1267 
1268 	/*
1269 	 * Now, stick 'em together and prepend the tunnel headers;
1270 	 * first the Atheros tunnel header (all zero for now) and
1271 	 * then a special fast frame LLC.
1272 	 *
1273 	 * XXX optimize by prepending together
1274 	 */
1275 	m->m_next = m2;			/* NB: last mbuf from above */
1276 	m1->m_pkthdr.len += m2->m_pkthdr.len;
1277 	M_PREPEND(m1, sizeof(uint32_t)+2, M_DONTWAIT);
1278 	if (m1 == NULL) {		/* XXX cannot happen */
1279 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1280 			"%s: no space for tunnel header\n", __func__);
1281 		vap->iv_stats.is_tx_nobuf++;
1282 		return NULL;
1283 	}
1284 	memset(mtod(m1, void *), 0, sizeof(uint32_t)+2);
1285 
1286 	M_PREPEND(m1, sizeof(struct llc), M_DONTWAIT);
1287 	if (m1 == NULL) {		/* XXX cannot happen */
1288 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SUPERG,
1289 			"%s: no space for llc header\n", __func__);
1290 		vap->iv_stats.is_tx_nobuf++;
1291 		return NULL;
1292 	}
1293 	llc = mtod(m1, struct llc *);
1294 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
1295 	llc->llc_control = LLC_UI;
1296 	llc->llc_snap.org_code[0] = ATH_FF_SNAP_ORGCODE_0;
1297 	llc->llc_snap.org_code[1] = ATH_FF_SNAP_ORGCODE_1;
1298 	llc->llc_snap.org_code[2] = ATH_FF_SNAP_ORGCODE_2;
1299 	llc->llc_snap.ether_type = htons(ATH_FF_ETH_TYPE);
1300 
1301 	vap->iv_stats.is_ff_encap++;
1302 
1303 	return m1;
1304 }
1305 
1306 /*
1307  * Fragment the frame according to the specified mtu.
1308  * The size of the 802.11 header (w/o padding) is provided
1309  * so we don't need to recalculate it.  We create a new
1310  * mbuf for each fragment and chain it through m_nextpkt;
1311  * we might be able to optimize this by reusing the original
1312  * packet's mbufs but that is significantly more complicated.
1313  */
1314 static int
1315 ieee80211_fragment(struct ieee80211vap *vap, struct mbuf *m0,
1316 	u_int hdrsize, u_int ciphdrsize, u_int mtu)
1317 {
1318 	struct ieee80211_frame *wh, *whf;
1319 	struct mbuf *m, *prev, *next;
1320 	u_int totalhdrsize, fragno, fragsize, off, remainder, payload;
1321 
1322 	KASSERT(m0->m_nextpkt == NULL, ("mbuf already chained?"));
1323 	KASSERT(m0->m_pkthdr.len > mtu,
1324 		("pktlen %u mtu %u", m0->m_pkthdr.len, mtu));
1325 
1326 	wh = mtod(m0, struct ieee80211_frame *);
1327 	/* NB: mark the first frag; it will be propagated below */
1328 	wh->i_fc[1] |= IEEE80211_FC1_MORE_FRAG;
1329 	totalhdrsize = hdrsize + ciphdrsize;
1330 	fragno = 1;
1331 	off = mtu - ciphdrsize;
1332 	remainder = m0->m_pkthdr.len - off;
1333 	prev = m0;
1334 	do {
1335 		fragsize = totalhdrsize + remainder;
1336 		if (fragsize > mtu)
1337 			fragsize = mtu;
1338 		/* XXX fragsize can be >2048! */
1339 		KASSERT(fragsize < MCLBYTES,
1340 			("fragment size %u too big!", fragsize));
1341 		if (fragsize > MHLEN)
1342 			m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1343 		else
1344 			m = m_gethdr(M_DONTWAIT, MT_DATA);
1345 		if (m == NULL)
1346 			goto bad;
1347 		/* leave room to prepend any cipher header */
1348 		m_align(m, fragsize - ciphdrsize);
1349 
1350 		/*
1351 		 * Form the header in the fragment.  Note that since
1352 		 * we mark the first fragment with the MORE_FRAG bit
1353 		 * it automatically is propagated to each fragment; we
1354 		 * need only clear it on the last fragment (done below).
1355 		 */
1356 		whf = mtod(m, struct ieee80211_frame *);
1357 		memcpy(whf, wh, hdrsize);
1358 		*(uint16_t *)&whf->i_seq[0] |= htole16(
1359 			(fragno & IEEE80211_SEQ_FRAG_MASK) <<
1360 				IEEE80211_SEQ_FRAG_SHIFT);
1361 		fragno++;
1362 
1363 		payload = fragsize - totalhdrsize;
1364 		/* NB: destination is known to be contiguous */
1365 		m_copydata(m0, off, payload, mtod(m, uint8_t *) + hdrsize);
1366 		m->m_len = hdrsize + payload;
1367 		m->m_pkthdr.len = hdrsize + payload;
1368 		m->m_flags |= M_FRAG;
1369 
1370 		/* chain up the fragment */
1371 		prev->m_nextpkt = m;
1372 		prev = m;
1373 
1374 		/* deduct fragment just formed */
1375 		remainder -= payload;
1376 		off += payload;
1377 	} while (remainder != 0);
1378 	whf->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
1379 
1380 	/* strip first mbuf now that everything has been copied */
1381 	m_adj(m0, -(m0->m_pkthdr.len - (mtu - ciphdrsize)));
1382 	m0->m_flags |= M_FIRSTFRAG | M_FRAG;
1383 
1384 	vap->iv_stats.is_tx_fragframes++;
1385 	vap->iv_stats.is_tx_frags += fragno-1;
1386 
1387 	return 1;
1388 bad:
1389 	/* reclaim fragments but leave original frame for caller to free */
1390 	for (m = m0->m_nextpkt; m != NULL; m = next) {
1391 		next = m->m_nextpkt;
1392 		m->m_nextpkt = NULL;		/* XXX paranoid */
1393 		m_freem(m);
1394 	}
1395 	m0->m_nextpkt = NULL;
1396 	return 0;
1397 }
1398 
1399 /*
1400  * Add a supported rates element id to a frame.
1401  */
1402 static uint8_t *
1403 ieee80211_add_rates(uint8_t *frm, const struct ieee80211_rateset *rs)
1404 {
1405 	int nrates;
1406 
1407 	*frm++ = IEEE80211_ELEMID_RATES;
1408 	nrates = rs->rs_nrates;
1409 	if (nrates > IEEE80211_RATE_SIZE)
1410 		nrates = IEEE80211_RATE_SIZE;
1411 	*frm++ = nrates;
1412 	memcpy(frm, rs->rs_rates, nrates);
1413 	return frm + nrates;
1414 }
1415 
1416 /*
1417  * Add an extended supported rates element id to a frame.
1418  */
1419 static uint8_t *
1420 ieee80211_add_xrates(uint8_t *frm, const struct ieee80211_rateset *rs)
1421 {
1422 	/*
1423 	 * Add an extended supported rates element if operating in 11g mode.
1424 	 */
1425 	if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
1426 		int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
1427 		*frm++ = IEEE80211_ELEMID_XRATES;
1428 		*frm++ = nrates;
1429 		memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
1430 		frm += nrates;
1431 	}
1432 	return frm;
1433 }
1434 
1435 /*
1436  * Add an ssid element to a frame.
1437  */
1438 static uint8_t *
1439 ieee80211_add_ssid(uint8_t *frm, const uint8_t *ssid, u_int len)
1440 {
1441 	*frm++ = IEEE80211_ELEMID_SSID;
1442 	*frm++ = len;
1443 	memcpy(frm, ssid, len);
1444 	return frm + len;
1445 }
1446 
1447 /*
1448  * Add an erp element to a frame.
1449  */
1450 static uint8_t *
1451 ieee80211_add_erp(uint8_t *frm, struct ieee80211com *ic)
1452 {
1453 	uint8_t erp;
1454 
1455 	*frm++ = IEEE80211_ELEMID_ERP;
1456 	*frm++ = 1;
1457 	erp = 0;
1458 	if (ic->ic_nonerpsta != 0)
1459 		erp |= IEEE80211_ERP_NON_ERP_PRESENT;
1460 	if (ic->ic_flags & IEEE80211_F_USEPROT)
1461 		erp |= IEEE80211_ERP_USE_PROTECTION;
1462 	if (ic->ic_flags & IEEE80211_F_USEBARKER)
1463 		erp |= IEEE80211_ERP_LONG_PREAMBLE;
1464 	*frm++ = erp;
1465 	return frm;
1466 }
1467 
1468 /*
1469  * Add a CFParams element to a frame.
1470  */
1471 static uint8_t *
1472 ieee80211_add_cfparms(uint8_t *frm, struct ieee80211com *ic)
1473 {
1474 #define	ADDSHORT(frm, v) do {			\
1475 	frm[0] = (v) & 0xff;			\
1476 	frm[1] = (v) >> 8;			\
1477 	frm += 2;				\
1478 } while (0)
1479 	*frm++ = IEEE80211_ELEMID_CFPARMS;
1480 	*frm++ = 6;
1481 	*frm++ = 0;		/* CFP count */
1482 	*frm++ = 2;		/* CFP period */
1483 	ADDSHORT(frm, 0);	/* CFP MaxDuration (TU) */
1484 	ADDSHORT(frm, 0);	/* CFP CurRemaining (TU) */
1485 	return frm;
1486 #undef ADDSHORT
1487 }
1488 
1489 static __inline uint8_t *
1490 add_appie(uint8_t *frm, const struct ieee80211_appie *ie)
1491 {
1492 	memcpy(frm, ie->ie_data, ie->ie_len);
1493 	return frm + ie->ie_len;
1494 }
1495 
1496 static __inline uint8_t *
1497 add_ie(uint8_t *frm, const uint8_t *ie)
1498 {
1499 	memcpy(frm, ie, 2 + ie[1]);
1500 	return frm + 2 + ie[1];
1501 }
1502 
1503 #define	WME_OUI_BYTES		0x00, 0x50, 0xf2
1504 /*
1505  * Add a WME information element to a frame.
1506  */
1507 static uint8_t *
1508 ieee80211_add_wme_info(uint8_t *frm, struct ieee80211_wme_state *wme)
1509 {
1510 	static const struct ieee80211_wme_info info = {
1511 		.wme_id		= IEEE80211_ELEMID_VENDOR,
1512 		.wme_len	= sizeof(struct ieee80211_wme_info) - 2,
1513 		.wme_oui	= { WME_OUI_BYTES },
1514 		.wme_type	= WME_OUI_TYPE,
1515 		.wme_subtype	= WME_INFO_OUI_SUBTYPE,
1516 		.wme_version	= WME_VERSION,
1517 		.wme_info	= 0,
1518 	};
1519 	memcpy(frm, &info, sizeof(info));
1520 	return frm + sizeof(info);
1521 }
1522 
1523 /*
1524  * Add a WME parameters element to a frame.
1525  */
1526 static uint8_t *
1527 ieee80211_add_wme_param(uint8_t *frm, struct ieee80211_wme_state *wme)
1528 {
1529 #define	SM(_v, _f)	(((_v) << _f##_S) & _f)
1530 #define	ADDSHORT(frm, v) do {			\
1531 	frm[0] = (v) & 0xff;			\
1532 	frm[1] = (v) >> 8;			\
1533 	frm += 2;				\
1534 } while (0)
1535 	/* NB: this works 'cuz a param has an info at the front */
1536 	static const struct ieee80211_wme_info param = {
1537 		.wme_id		= IEEE80211_ELEMID_VENDOR,
1538 		.wme_len	= sizeof(struct ieee80211_wme_param) - 2,
1539 		.wme_oui	= { WME_OUI_BYTES },
1540 		.wme_type	= WME_OUI_TYPE,
1541 		.wme_subtype	= WME_PARAM_OUI_SUBTYPE,
1542 		.wme_version	= WME_VERSION,
1543 	};
1544 	int i;
1545 
1546 	memcpy(frm, &param, sizeof(param));
1547 	frm += __offsetof(struct ieee80211_wme_info, wme_info);
1548 	*frm++ = wme->wme_bssChanParams.cap_info;	/* AC info */
1549 	*frm++ = 0;					/* reserved field */
1550 	for (i = 0; i < WME_NUM_AC; i++) {
1551 		const struct wmeParams *ac =
1552 		       &wme->wme_bssChanParams.cap_wmeParams[i];
1553 		*frm++ = SM(i, WME_PARAM_ACI)
1554 		       | SM(ac->wmep_acm, WME_PARAM_ACM)
1555 		       | SM(ac->wmep_aifsn, WME_PARAM_AIFSN)
1556 		       ;
1557 		*frm++ = SM(ac->wmep_logcwmax, WME_PARAM_LOGCWMAX)
1558 		       | SM(ac->wmep_logcwmin, WME_PARAM_LOGCWMIN)
1559 		       ;
1560 		ADDSHORT(frm, ac->wmep_txopLimit);
1561 	}
1562 	return frm;
1563 #undef SM
1564 #undef ADDSHORT
1565 }
1566 #undef WME_OUI_BYTES
1567 
1568 #define	ATH_OUI_BYTES		0x00, 0x03, 0x7f
1569 /*
1570  * Add a WME information element to a frame.
1571  */
1572 static uint8_t *
1573 ieee80211_add_ath(uint8_t *frm, uint8_t caps, uint16_t defkeyix)
1574 {
1575 	static const struct ieee80211_ath_ie info = {
1576 		.ath_id		= IEEE80211_ELEMID_VENDOR,
1577 		.ath_len	= sizeof(struct ieee80211_ath_ie) - 2,
1578 		.ath_oui	= { ATH_OUI_BYTES },
1579 		.ath_oui_type	= ATH_OUI_TYPE,
1580 		.ath_oui_subtype= ATH_OUI_SUBTYPE,
1581 		.ath_version	= ATH_OUI_VERSION,
1582 	};
1583 	struct ieee80211_ath_ie *ath = (struct ieee80211_ath_ie *) frm;
1584 
1585 	memcpy(frm, &info, sizeof(info));
1586 	ath->ath_capability = caps;
1587 	ath->ath_defkeyix[0] = (defkeyix & 0xff);
1588 	ath->ath_defkeyix[1] = ((defkeyix >> 8) & 0xff);
1589 	return frm + sizeof(info);
1590 }
1591 #undef ATH_OUI_BYTES
1592 
1593 /*
1594  * Add an 11h Power Constraint element to a frame.
1595  */
1596 static uint8_t *
1597 ieee80211_add_powerconstraint(uint8_t *frm, struct ieee80211vap *vap)
1598 {
1599 	const struct ieee80211_channel *c = vap->iv_bss->ni_chan;
1600 	/* XXX per-vap tx power limit? */
1601 	int8_t limit = vap->iv_ic->ic_txpowlimit / 2;
1602 
1603 	frm[0] = IEEE80211_ELEMID_PWRCNSTR;
1604 	frm[1] = 1;
1605 	frm[2] = c->ic_maxregpower > limit ?  c->ic_maxregpower - limit : 0;
1606 	return frm + 3;
1607 }
1608 
1609 /*
1610  * Add an 11h Power Capability element to a frame.
1611  */
1612 static uint8_t *
1613 ieee80211_add_powercapability(uint8_t *frm, const struct ieee80211_channel *c)
1614 {
1615 	frm[0] = IEEE80211_ELEMID_PWRCAP;
1616 	frm[1] = 2;
1617 	frm[2] = c->ic_minpower;
1618 	frm[3] = c->ic_maxpower;
1619 	return frm + 4;
1620 }
1621 
1622 /*
1623  * Add an 11h Supported Channels element to a frame.
1624  */
1625 static uint8_t *
1626 ieee80211_add_supportedchannels(uint8_t *frm, struct ieee80211com *ic)
1627 {
1628 	static const int ielen = 26;
1629 
1630 	frm[0] = IEEE80211_ELEMID_SUPPCHAN;
1631 	frm[1] = ielen;
1632 	/* XXX not correct */
1633 	memcpy(frm+2, ic->ic_chan_avail, ielen);
1634 	return frm + 2 + ielen;
1635 }
1636 
1637 /*
1638  * Add an 11h Channel Switch Announcement element to a frame.
1639  * Note that we use the per-vap CSA count to adjust the global
1640  * counter so we can use this routine to form probe response
1641  * frames and get the current count.
1642  */
1643 static uint8_t *
1644 ieee80211_add_csa(uint8_t *frm, struct ieee80211vap *vap)
1645 {
1646 	struct ieee80211com *ic = vap->iv_ic;
1647 	struct ieee80211_csa_ie *csa = (struct ieee80211_csa_ie *) frm;
1648 
1649 	csa->csa_ie = IEEE80211_ELEMID_CHANSWITCHANN;
1650 	csa->csa_len = 3;
1651 	csa->csa_mode = 1;		/* XXX force quiet on channel */
1652 	csa->csa_newchan = ieee80211_chan2ieee(ic, ic->ic_csa_newchan);
1653 	csa->csa_count = ic->ic_csa_count - vap->iv_csa_count;
1654 	return frm + sizeof(*csa);
1655 }
1656 
1657 /*
1658  * Add an 11h country information element to a frame.
1659  */
1660 static uint8_t *
1661 ieee80211_add_countryie(uint8_t *frm, struct ieee80211com *ic)
1662 {
1663 
1664 	if (ic->ic_countryie == NULL ||
1665 	    ic->ic_countryie_chan != ic->ic_bsschan) {
1666 		/*
1667 		 * Handle lazy construction of ie.  This is done on
1668 		 * first use and after a channel change that requires
1669 		 * re-calculation.
1670 		 */
1671 		if (ic->ic_countryie != NULL)
1672 			free(ic->ic_countryie, M_80211_NODE_IE);
1673 		ic->ic_countryie = ieee80211_alloc_countryie(ic);
1674 		if (ic->ic_countryie == NULL)
1675 			return frm;
1676 		ic->ic_countryie_chan = ic->ic_bsschan;
1677 	}
1678 	return add_appie(frm, ic->ic_countryie);
1679 }
1680 
1681 /*
1682  * Send a probe request frame with the specified ssid
1683  * and any optional information element data.
1684  */
1685 int
1686 ieee80211_send_probereq(struct ieee80211_node *ni,
1687 	const uint8_t sa[IEEE80211_ADDR_LEN],
1688 	const uint8_t da[IEEE80211_ADDR_LEN],
1689 	const uint8_t bssid[IEEE80211_ADDR_LEN],
1690 	const uint8_t *ssid, size_t ssidlen)
1691 {
1692 	struct ieee80211vap *vap = ni->ni_vap;
1693 	struct ieee80211com *ic = ni->ni_ic;
1694 	const struct ieee80211_txparam *tp;
1695 	struct ieee80211_bpf_params params;
1696 	struct ieee80211_frame *wh;
1697 	const struct ieee80211_rateset *rs;
1698 	struct mbuf *m;
1699 	uint8_t *frm;
1700 
1701 	if (vap->iv_state == IEEE80211_S_CAC) {
1702 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
1703 		    "block %s frame in CAC state", "probe request");
1704 		vap->iv_stats.is_tx_badstate++;
1705 		return EIO;		/* XXX */
1706 	}
1707 
1708 	/*
1709 	 * Hold a reference on the node so it doesn't go away until after
1710 	 * the xmit is complete all the way in the driver.  On error we
1711 	 * will remove our reference.
1712 	 */
1713 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1714 		"ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n",
1715 		__func__, __LINE__,
1716 		ni, ether_sprintf(ni->ni_macaddr),
1717 		ieee80211_node_refcnt(ni)+1);
1718 	ieee80211_ref_node(ni);
1719 
1720 	/*
1721 	 * prreq frame format
1722 	 *	[tlv] ssid
1723 	 *	[tlv] supported rates
1724 	 *	[tlv] RSN (optional)
1725 	 *	[tlv] extended supported rates
1726 	 *	[tlv] WPA (optional)
1727 	 *	[tlv] user-specified ie's
1728 	 */
1729 	m = ieee80211_getmgtframe(&frm,
1730 		 ic->ic_headroom + sizeof(struct ieee80211_frame),
1731 	       	 2 + IEEE80211_NWID_LEN
1732 	       + 2 + IEEE80211_RATE_SIZE
1733 	       + sizeof(struct ieee80211_ie_wpa)
1734 	       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1735 	       + sizeof(struct ieee80211_ie_wpa)
1736 	       + (vap->iv_appie_probereq != NULL ?
1737 		   vap->iv_appie_probereq->ie_len : 0)
1738 	);
1739 	if (m == NULL) {
1740 		vap->iv_stats.is_tx_nobuf++;
1741 		ieee80211_free_node(ni);
1742 		return ENOMEM;
1743 	}
1744 
1745 	frm = ieee80211_add_ssid(frm, ssid, ssidlen);
1746 	rs = ieee80211_get_suprates(ic, ic->ic_curchan);
1747 	frm = ieee80211_add_rates(frm, rs);
1748 	if (vap->iv_flags & IEEE80211_F_WPA2) {
1749 		if (vap->iv_rsn_ie != NULL)
1750 			frm = add_ie(frm, vap->iv_rsn_ie);
1751 		/* XXX else complain? */
1752 	}
1753 	frm = ieee80211_add_xrates(frm, rs);
1754 	if (vap->iv_flags & IEEE80211_F_WPA1) {
1755 		if (vap->iv_wpa_ie != NULL)
1756 			frm = add_ie(frm, vap->iv_wpa_ie);
1757 		/* XXX else complain? */
1758 	}
1759 	if (vap->iv_appie_probereq != NULL)
1760 		frm = add_appie(frm, vap->iv_appie_probereq);
1761 	m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
1762 
1763 	KASSERT(M_LEADINGSPACE(m) >= sizeof(struct ieee80211_frame),
1764 	    ("leading space %zd", M_LEADINGSPACE(m)));
1765 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
1766 	if (m == NULL) {
1767 		/* NB: cannot happen */
1768 		ieee80211_free_node(ni);
1769 		return ENOMEM;
1770 	}
1771 
1772 	wh = mtod(m, struct ieee80211_frame *);
1773 	ieee80211_send_setup(ni, wh,
1774 	     IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ,
1775 	     IEEE80211_NONQOS_TID, sa, da, bssid);
1776 	/* XXX power management? */
1777 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
1778 
1779 	M_WME_SETAC(m, WME_AC_BE);
1780 
1781 	IEEE80211_NODE_STAT(ni, tx_probereq);
1782 	IEEE80211_NODE_STAT(ni, tx_mgmt);
1783 
1784 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_DUMPPKTS,
1785 	    "send probe req on channel %u bssid %s ssid \"%.*s\"\n",
1786 	    ieee80211_chan2ieee(ic, ic->ic_curchan), ether_sprintf(bssid),
1787 	    ssidlen, ssid);
1788 
1789 	memset(&params, 0, sizeof(params));
1790 	params.ibp_pri = M_WME_GETAC(m);
1791 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1792 	params.ibp_rate0 = tp->mgmtrate;
1793 	if (IEEE80211_IS_MULTICAST(da)) {
1794 		params.ibp_flags |= IEEE80211_BPF_NOACK;
1795 		params.ibp_try0 = 1;
1796 	} else
1797 		params.ibp_try0 = tp->maxretry;
1798 	params.ibp_power = ni->ni_txpower;
1799 	return ic->ic_raw_xmit(ni, m, &params);
1800 }
1801 
1802 /*
1803  * Calculate capability information for mgt frames.
1804  */
1805 static uint16_t
1806 getcapinfo(struct ieee80211vap *vap, struct ieee80211_channel *chan)
1807 {
1808 	struct ieee80211com *ic = vap->iv_ic;
1809 	uint16_t capinfo;
1810 
1811 	KASSERT(vap->iv_opmode != IEEE80211_M_STA, ("station mode"));
1812 
1813 	if (vap->iv_opmode == IEEE80211_M_HOSTAP)
1814 		capinfo = IEEE80211_CAPINFO_ESS;
1815 	else if (vap->iv_opmode == IEEE80211_M_IBSS)
1816 		capinfo = IEEE80211_CAPINFO_IBSS;
1817 	else
1818 		capinfo = 0;
1819 	if (vap->iv_flags & IEEE80211_F_PRIVACY)
1820 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1821 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1822 	    IEEE80211_IS_CHAN_2GHZ(chan))
1823 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1824 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1825 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1826 	if (IEEE80211_IS_CHAN_5GHZ(chan) && (vap->iv_flags & IEEE80211_F_DOTH))
1827 		capinfo |= IEEE80211_CAPINFO_SPECTRUM_MGMT;
1828 	return capinfo;
1829 }
1830 
1831 /*
1832  * Send a management frame.  The node is for the destination (or ic_bss
1833  * when in station mode).  Nodes other than ic_bss have their reference
1834  * count bumped to reflect our use for an indeterminant time.
1835  */
1836 int
1837 ieee80211_send_mgmt(struct ieee80211_node *ni, int type, int arg)
1838 {
1839 #define	HTFLAGS (IEEE80211_NODE_HT | IEEE80211_NODE_HTCOMPAT)
1840 #define	senderr(_x, _v)	do { vap->iv_stats._v++; ret = _x; goto bad; } while (0)
1841 	struct ieee80211vap *vap = ni->ni_vap;
1842 	struct ieee80211com *ic = ni->ni_ic;
1843 	struct ieee80211_node *bss = vap->iv_bss;
1844 	struct ieee80211_bpf_params params;
1845 	struct mbuf *m;
1846 	uint8_t *frm;
1847 	uint16_t capinfo;
1848 	int has_challenge, is_shared_key, ret, status;
1849 
1850 	KASSERT(ni != NULL, ("null node"));
1851 
1852 	/*
1853 	 * Hold a reference on the node so it doesn't go away until after
1854 	 * the xmit is complete all the way in the driver.  On error we
1855 	 * will remove our reference.
1856 	 */
1857 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1858 		"ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n",
1859 		__func__, __LINE__,
1860 		ni, ether_sprintf(ni->ni_macaddr),
1861 		ieee80211_node_refcnt(ni)+1);
1862 	ieee80211_ref_node(ni);
1863 
1864 	memset(&params, 0, sizeof(params));
1865 	switch (type) {
1866 
1867 	case IEEE80211_FC0_SUBTYPE_AUTH:
1868 		status = arg >> 16;
1869 		arg &= 0xffff;
1870 		has_challenge = ((arg == IEEE80211_AUTH_SHARED_CHALLENGE ||
1871 		    arg == IEEE80211_AUTH_SHARED_RESPONSE) &&
1872 		    ni->ni_challenge != NULL);
1873 
1874 		/*
1875 		 * Deduce whether we're doing open authentication or
1876 		 * shared key authentication.  We do the latter if
1877 		 * we're in the middle of a shared key authentication
1878 		 * handshake or if we're initiating an authentication
1879 		 * request and configured to use shared key.
1880 		 */
1881 		is_shared_key = has_challenge ||
1882 		     arg >= IEEE80211_AUTH_SHARED_RESPONSE ||
1883 		     (arg == IEEE80211_AUTH_SHARED_REQUEST &&
1884 		      bss->ni_authmode == IEEE80211_AUTH_SHARED);
1885 
1886 		m = ieee80211_getmgtframe(&frm,
1887 			  ic->ic_headroom + sizeof(struct ieee80211_frame),
1888 			  3 * sizeof(uint16_t)
1889 			+ (has_challenge && status == IEEE80211_STATUS_SUCCESS ?
1890 				sizeof(uint16_t)+IEEE80211_CHALLENGE_LEN : 0)
1891 		);
1892 		if (m == NULL)
1893 			senderr(ENOMEM, is_tx_nobuf);
1894 
1895 		((uint16_t *)frm)[0] =
1896 		    (is_shared_key) ? htole16(IEEE80211_AUTH_ALG_SHARED)
1897 		                    : htole16(IEEE80211_AUTH_ALG_OPEN);
1898 		((uint16_t *)frm)[1] = htole16(arg);	/* sequence number */
1899 		((uint16_t *)frm)[2] = htole16(status);/* status */
1900 
1901 		if (has_challenge && status == IEEE80211_STATUS_SUCCESS) {
1902 			((uint16_t *)frm)[3] =
1903 			    htole16((IEEE80211_CHALLENGE_LEN << 8) |
1904 			    IEEE80211_ELEMID_CHALLENGE);
1905 			memcpy(&((uint16_t *)frm)[4], ni->ni_challenge,
1906 			    IEEE80211_CHALLENGE_LEN);
1907 			m->m_pkthdr.len = m->m_len =
1908 				4 * sizeof(uint16_t) + IEEE80211_CHALLENGE_LEN;
1909 			if (arg == IEEE80211_AUTH_SHARED_RESPONSE) {
1910 				IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1911 				    "request encrypt frame (%s)", __func__);
1912 				/* mark frame for encryption */
1913 				params.ibp_flags |= IEEE80211_BPF_CRYPTO;
1914 			}
1915 		} else
1916 			m->m_pkthdr.len = m->m_len = 3 * sizeof(uint16_t);
1917 
1918 		/* XXX not right for shared key */
1919 		if (status == IEEE80211_STATUS_SUCCESS)
1920 			IEEE80211_NODE_STAT(ni, tx_auth);
1921 		else
1922 			IEEE80211_NODE_STAT(ni, tx_auth_fail);
1923 
1924 		if (vap->iv_opmode == IEEE80211_M_STA)
1925 			ieee80211_add_callback(m, ieee80211_tx_mgt_cb,
1926 				(void *) vap->iv_state);
1927 		break;
1928 
1929 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1930 		IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1931 		    "send station deauthenticate (reason %d)", arg);
1932 		m = ieee80211_getmgtframe(&frm,
1933 			ic->ic_headroom + sizeof(struct ieee80211_frame),
1934 			sizeof(uint16_t));
1935 		if (m == NULL)
1936 			senderr(ENOMEM, is_tx_nobuf);
1937 		*(uint16_t *)frm = htole16(arg);	/* reason */
1938 		m->m_pkthdr.len = m->m_len = sizeof(uint16_t);
1939 
1940 		IEEE80211_NODE_STAT(ni, tx_deauth);
1941 		IEEE80211_NODE_STAT_SET(ni, tx_deauth_code, arg);
1942 
1943 		ieee80211_node_unauthorize(ni);		/* port closed */
1944 		break;
1945 
1946 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1947 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1948 		/*
1949 		 * asreq frame format
1950 		 *	[2] capability information
1951 		 *	[2] listen interval
1952 		 *	[6*] current AP address (reassoc only)
1953 		 *	[tlv] ssid
1954 		 *	[tlv] supported rates
1955 		 *	[tlv] extended supported rates
1956 		 *	[4] power capability (optional)
1957 		 *	[28] supported channels (optional)
1958 		 *	[tlv] HT capabilities
1959 		 *	[tlv] WME (optional)
1960 		 *	[tlv] Vendor OUI HT capabilities (optional)
1961 		 *	[tlv] Atheros capabilities (if negotiated)
1962 		 *	[tlv] AppIE's (optional)
1963 		 */
1964 		m = ieee80211_getmgtframe(&frm,
1965 			 ic->ic_headroom + sizeof(struct ieee80211_frame),
1966 			 sizeof(uint16_t)
1967 		       + sizeof(uint16_t)
1968 		       + IEEE80211_ADDR_LEN
1969 		       + 2 + IEEE80211_NWID_LEN
1970 		       + 2 + IEEE80211_RATE_SIZE
1971 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1972 		       + 4
1973 		       + 2 + 26
1974 		       + sizeof(struct ieee80211_wme_info)
1975 		       + sizeof(struct ieee80211_ie_htcap)
1976 		       + 4 + sizeof(struct ieee80211_ie_htcap)
1977 		       + sizeof(struct ieee80211_ath_ie)
1978 		       + (vap->iv_appie_wpa != NULL ?
1979 				vap->iv_appie_wpa->ie_len : 0)
1980 		       + (vap->iv_appie_assocreq != NULL ?
1981 				vap->iv_appie_assocreq->ie_len : 0)
1982 		);
1983 		if (m == NULL)
1984 			senderr(ENOMEM, is_tx_nobuf);
1985 
1986 		KASSERT(vap->iv_opmode == IEEE80211_M_STA,
1987 		    ("wrong mode %u", vap->iv_opmode));
1988 		capinfo = IEEE80211_CAPINFO_ESS;
1989 		if (vap->iv_flags & IEEE80211_F_PRIVACY)
1990 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
1991 		/*
1992 		 * NB: Some 11a AP's reject the request when
1993 		 *     short premable is set.
1994 		 */
1995 		if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1996 		    IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
1997 			capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1998 		if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1999 		    (ic->ic_caps & IEEE80211_C_SHSLOT))
2000 			capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
2001 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_SPECTRUM_MGMT) &&
2002 		    (vap->iv_flags & IEEE80211_F_DOTH))
2003 			capinfo |= IEEE80211_CAPINFO_SPECTRUM_MGMT;
2004 		*(uint16_t *)frm = htole16(capinfo);
2005 		frm += 2;
2006 
2007 		KASSERT(bss->ni_intval != 0, ("beacon interval is zero!"));
2008 		*(uint16_t *)frm = htole16(howmany(ic->ic_lintval,
2009 						    bss->ni_intval));
2010 		frm += 2;
2011 
2012 		if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
2013 			IEEE80211_ADDR_COPY(frm, bss->ni_bssid);
2014 			frm += IEEE80211_ADDR_LEN;
2015 		}
2016 
2017 		frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
2018 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
2019 		if (vap->iv_flags & IEEE80211_F_WPA2) {
2020 			if (vap->iv_rsn_ie != NULL)
2021 				frm = add_ie(frm, vap->iv_rsn_ie);
2022 			/* XXX else complain? */
2023 		}
2024 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
2025 		if (capinfo & IEEE80211_CAPINFO_SPECTRUM_MGMT) {
2026 			frm = ieee80211_add_powercapability(frm,
2027 			    ic->ic_curchan);
2028 			frm = ieee80211_add_supportedchannels(frm, ic);
2029 		}
2030 		if ((vap->iv_flags_ext & IEEE80211_FEXT_HT) &&
2031 		    ni->ni_ies.htcap_ie != NULL &&
2032 		    ni->ni_ies.htcap_ie[0] == IEEE80211_ELEMID_HTCAP)
2033 			frm = ieee80211_add_htcap(frm, ni);
2034 		if (vap->iv_flags & IEEE80211_F_WPA1) {
2035 			if (vap->iv_wpa_ie != NULL)
2036 				frm = add_ie(frm, vap->iv_wpa_ie);
2037 			/* XXX else complain */
2038 		}
2039 		if ((ic->ic_flags & IEEE80211_F_WME) &&
2040 		    ni->ni_ies.wme_ie != NULL)
2041 			frm = ieee80211_add_wme_info(frm, &ic->ic_wme);
2042 		if ((vap->iv_flags_ext & IEEE80211_FEXT_HT) &&
2043 		    ni->ni_ies.htcap_ie != NULL &&
2044 		    ni->ni_ies.htcap_ie[0] == IEEE80211_ELEMID_VENDOR)
2045 			frm = ieee80211_add_htcap_vendor(frm, ni);
2046 		if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_F_ATHEROS))
2047 			frm = ieee80211_add_ath(frm,
2048 				IEEE80211_ATH_CAP(vap, ni, IEEE80211_F_ATHEROS),
2049 				(vap->iv_flags & IEEE80211_F_WPA) == 0 &&
2050 				ni->ni_authmode != IEEE80211_AUTH_8021X &&
2051 				vap->iv_def_txkey != IEEE80211_KEYIX_NONE ?
2052 				vap->iv_def_txkey : 0x7fff);
2053 		if (vap->iv_appie_assocreq != NULL)
2054 			frm = add_appie(frm, vap->iv_appie_assocreq);
2055 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2056 
2057 		ieee80211_add_callback(m, ieee80211_tx_mgt_cb,
2058 			(void *) vap->iv_state);
2059 		break;
2060 
2061 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2062 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2063 		/*
2064 		 * asresp frame format
2065 		 *	[2] capability information
2066 		 *	[2] status
2067 		 *	[2] association ID
2068 		 *	[tlv] supported rates
2069 		 *	[tlv] extended supported rates
2070 		 *	[tlv] HT capabilities (standard, if STA enabled)
2071 		 *	[tlv] HT information (standard, if STA enabled)
2072 		 *	[tlv] WME (if configured and STA enabled)
2073 		 *	[tlv] HT capabilities (vendor OUI, if STA enabled)
2074 		 *	[tlv] HT information (vendor OUI, if STA enabled)
2075 		 *	[tlv] Atheros capabilities (if STA enabled)
2076 		 *	[tlv] AppIE's (optional)
2077 		 */
2078 		m = ieee80211_getmgtframe(&frm,
2079 			 ic->ic_headroom + sizeof(struct ieee80211_frame),
2080 			 sizeof(uint16_t)
2081 		       + sizeof(uint16_t)
2082 		       + sizeof(uint16_t)
2083 		       + 2 + IEEE80211_RATE_SIZE
2084 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2085 		       + sizeof(struct ieee80211_ie_htcap) + 4
2086 		       + sizeof(struct ieee80211_ie_htinfo) + 4
2087 		       + sizeof(struct ieee80211_wme_param)
2088 		       + sizeof(struct ieee80211_ath_ie)
2089 		       + (vap->iv_appie_assocresp != NULL ?
2090 				vap->iv_appie_assocresp->ie_len : 0)
2091 		);
2092 		if (m == NULL)
2093 			senderr(ENOMEM, is_tx_nobuf);
2094 
2095 		capinfo = getcapinfo(vap, bss->ni_chan);
2096 		*(uint16_t *)frm = htole16(capinfo);
2097 		frm += 2;
2098 
2099 		*(uint16_t *)frm = htole16(arg);	/* status */
2100 		frm += 2;
2101 
2102 		if (arg == IEEE80211_STATUS_SUCCESS) {
2103 			*(uint16_t *)frm = htole16(ni->ni_associd);
2104 			IEEE80211_NODE_STAT(ni, tx_assoc);
2105 		} else
2106 			IEEE80211_NODE_STAT(ni, tx_assoc_fail);
2107 		frm += 2;
2108 
2109 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
2110 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
2111 		/* NB: respond according to what we received */
2112 		if ((ni->ni_flags & HTFLAGS) == IEEE80211_NODE_HT) {
2113 			frm = ieee80211_add_htcap(frm, ni);
2114 			frm = ieee80211_add_htinfo(frm, ni);
2115 		}
2116 		if ((vap->iv_flags & IEEE80211_F_WME) &&
2117 		    ni->ni_ies.wme_ie != NULL)
2118 			frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
2119 		if ((ni->ni_flags & HTFLAGS) == HTFLAGS) {
2120 			frm = ieee80211_add_htcap_vendor(frm, ni);
2121 			frm = ieee80211_add_htinfo_vendor(frm, ni);
2122 		}
2123 		if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_F_ATHEROS))
2124 			frm = ieee80211_add_ath(frm,
2125 				IEEE80211_ATH_CAP(vap, ni, IEEE80211_F_ATHEROS),
2126 				ni->ni_ath_defkeyix);
2127 		if (vap->iv_appie_assocresp != NULL)
2128 			frm = add_appie(frm, vap->iv_appie_assocresp);
2129 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2130 		break;
2131 
2132 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
2133 		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2134 		    "send station disassociate (reason %d)", arg);
2135 		m = ieee80211_getmgtframe(&frm,
2136 			ic->ic_headroom + sizeof(struct ieee80211_frame),
2137 			sizeof(uint16_t));
2138 		if (m == NULL)
2139 			senderr(ENOMEM, is_tx_nobuf);
2140 		*(uint16_t *)frm = htole16(arg);	/* reason */
2141 		m->m_pkthdr.len = m->m_len = sizeof(uint16_t);
2142 
2143 		IEEE80211_NODE_STAT(ni, tx_disassoc);
2144 		IEEE80211_NODE_STAT_SET(ni, tx_disassoc_code, arg);
2145 		break;
2146 
2147 	default:
2148 		IEEE80211_NOTE(vap, IEEE80211_MSG_ANY, ni,
2149 		    "invalid mgmt frame type %u", type);
2150 		senderr(EINVAL, is_tx_unknownmgt);
2151 		/* NOTREACHED */
2152 	}
2153 
2154 	/* NB: force non-ProbeResp frames to the highest queue */
2155 	params.ibp_pri = WME_AC_VO;
2156 	params.ibp_rate0 = bss->ni_txparms->mgmtrate;
2157 	/* NB: we know all frames are unicast */
2158 	params.ibp_try0 = bss->ni_txparms->maxretry;
2159 	params.ibp_power = bss->ni_txpower;
2160 	return ieee80211_mgmt_output(ni, m, type, &params);
2161 bad:
2162 	ieee80211_free_node(ni);
2163 	return ret;
2164 #undef senderr
2165 #undef HTFLAGS
2166 }
2167 
2168 /*
2169  * Return an mbuf with a probe response frame in it.
2170  * Space is left to prepend and 802.11 header at the
2171  * front but it's left to the caller to fill in.
2172  */
2173 struct mbuf *
2174 ieee80211_alloc_proberesp(struct ieee80211_node *bss, int legacy)
2175 {
2176 	struct ieee80211vap *vap = bss->ni_vap;
2177 	struct ieee80211com *ic = bss->ni_ic;
2178 	const struct ieee80211_rateset *rs;
2179 	struct mbuf *m;
2180 	uint16_t capinfo;
2181 	uint8_t *frm;
2182 
2183 	/*
2184 	 * probe response frame format
2185 	 *	[8] time stamp
2186 	 *	[2] beacon interval
2187 	 *	[2] cabability information
2188 	 *	[tlv] ssid
2189 	 *	[tlv] supported rates
2190 	 *	[tlv] parameter set (FH/DS)
2191 	 *	[tlv] parameter set (IBSS)
2192 	 *	[tlv] country (optional)
2193 	 *	[3] power control (optional)
2194 	 *	[5] channel switch announcement (CSA) (optional)
2195 	 *	[tlv] extended rate phy (ERP)
2196 	 *	[tlv] extended supported rates
2197 	 *	[tlv] RSN (optional)
2198 	 *	[tlv] HT capabilities
2199 	 *	[tlv] HT information
2200 	 *	[tlv] WPA (optional)
2201 	 *	[tlv] WME (optional)
2202 	 *	[tlv] Vendor OUI HT capabilities (optional)
2203 	 *	[tlv] Vendor OUI HT information (optional)
2204 	 *	[tlv] Atheros capabilities
2205 	 *	[tlv] AppIE's (optional)
2206 	 */
2207 	m = ieee80211_getmgtframe(&frm,
2208 		 ic->ic_headroom + sizeof(struct ieee80211_frame),
2209 		 8
2210 	       + sizeof(uint16_t)
2211 	       + sizeof(uint16_t)
2212 	       + 2 + IEEE80211_NWID_LEN
2213 	       + 2 + IEEE80211_RATE_SIZE
2214 	       + 7	/* max(7,3) */
2215 	       + IEEE80211_COUNTRY_MAX_SIZE
2216 	       + 3
2217 	       + sizeof(struct ieee80211_csa_ie)
2218 	       + 3
2219 	       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2220 	       + sizeof(struct ieee80211_ie_wpa)
2221 	       + sizeof(struct ieee80211_ie_htcap)
2222 	       + sizeof(struct ieee80211_ie_htinfo)
2223 	       + sizeof(struct ieee80211_ie_wpa)
2224 	       + sizeof(struct ieee80211_wme_param)
2225 	       + 4 + sizeof(struct ieee80211_ie_htcap)
2226 	       + 4 + sizeof(struct ieee80211_ie_htinfo)
2227 	       + sizeof(struct ieee80211_ath_ie)
2228 	       + (vap->iv_appie_proberesp != NULL ?
2229 			vap->iv_appie_proberesp->ie_len : 0)
2230 	);
2231 	if (m == NULL) {
2232 		vap->iv_stats.is_tx_nobuf++;
2233 		return NULL;
2234 	}
2235 
2236 	memset(frm, 0, 8);	/* timestamp should be filled later */
2237 	frm += 8;
2238 	*(uint16_t *)frm = htole16(bss->ni_intval);
2239 	frm += 2;
2240 	capinfo = getcapinfo(vap, bss->ni_chan);
2241 	*(uint16_t *)frm = htole16(capinfo);
2242 	frm += 2;
2243 
2244 	frm = ieee80211_add_ssid(frm, bss->ni_essid, bss->ni_esslen);
2245 	rs = ieee80211_get_suprates(ic, bss->ni_chan);
2246 	frm = ieee80211_add_rates(frm, rs);
2247 
2248 	if (IEEE80211_IS_CHAN_FHSS(bss->ni_chan)) {
2249 		*frm++ = IEEE80211_ELEMID_FHPARMS;
2250 		*frm++ = 5;
2251 		*frm++ = bss->ni_fhdwell & 0x00ff;
2252 		*frm++ = (bss->ni_fhdwell >> 8) & 0x00ff;
2253 		*frm++ = IEEE80211_FH_CHANSET(
2254 		    ieee80211_chan2ieee(ic, bss->ni_chan));
2255 		*frm++ = IEEE80211_FH_CHANPAT(
2256 		    ieee80211_chan2ieee(ic, bss->ni_chan));
2257 		*frm++ = bss->ni_fhindex;
2258 	} else {
2259 		*frm++ = IEEE80211_ELEMID_DSPARMS;
2260 		*frm++ = 1;
2261 		*frm++ = ieee80211_chan2ieee(ic, bss->ni_chan);
2262 	}
2263 
2264 	if (vap->iv_opmode == IEEE80211_M_IBSS) {
2265 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
2266 		*frm++ = 2;
2267 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
2268 	}
2269 	if ((vap->iv_flags & IEEE80211_F_DOTH) ||
2270 	    (vap->iv_flags_ext & IEEE80211_FEXT_DOTD))
2271 		frm = ieee80211_add_countryie(frm, ic);
2272 	if (vap->iv_flags & IEEE80211_F_DOTH) {
2273 		if (IEEE80211_IS_CHAN_5GHZ(bss->ni_chan))
2274 			frm = ieee80211_add_powerconstraint(frm, vap);
2275 		if (ic->ic_flags & IEEE80211_F_CSAPENDING)
2276 			frm = ieee80211_add_csa(frm, vap);
2277 	}
2278 	if (IEEE80211_IS_CHAN_ANYG(bss->ni_chan))
2279 		frm = ieee80211_add_erp(frm, ic);
2280 	frm = ieee80211_add_xrates(frm, rs);
2281 	if (vap->iv_flags & IEEE80211_F_WPA2) {
2282 		if (vap->iv_rsn_ie != NULL)
2283 			frm = add_ie(frm, vap->iv_rsn_ie);
2284 		/* XXX else complain? */
2285 	}
2286 	/*
2287 	 * NB: legacy 11b clients do not get certain ie's.
2288 	 *     The caller identifies such clients by passing
2289 	 *     a token in legacy to us.  Could expand this to be
2290 	 *     any legacy client for stuff like HT ie's.
2291 	 */
2292 	if (IEEE80211_IS_CHAN_HT(bss->ni_chan) &&
2293 	    legacy != IEEE80211_SEND_LEGACY_11B) {
2294 		frm = ieee80211_add_htcap(frm, bss);
2295 		frm = ieee80211_add_htinfo(frm, bss);
2296 	}
2297 	if (vap->iv_flags & IEEE80211_F_WPA1) {
2298 		if (vap->iv_wpa_ie != NULL)
2299 			frm = add_ie(frm, vap->iv_wpa_ie);
2300 		/* XXX else complain? */
2301 	}
2302 	if (vap->iv_flags & IEEE80211_F_WME)
2303 		frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
2304 	if (IEEE80211_IS_CHAN_HT(bss->ni_chan) &&
2305 	    (vap->iv_flags_ext & IEEE80211_FEXT_HTCOMPAT) &&
2306 	    legacy != IEEE80211_SEND_LEGACY_11B) {
2307 		frm = ieee80211_add_htcap_vendor(frm, bss);
2308 		frm = ieee80211_add_htinfo_vendor(frm, bss);
2309 	}
2310 	if (bss->ni_ies.ath_ie != NULL && legacy != IEEE80211_SEND_LEGACY_11B)
2311 		frm = ieee80211_add_ath(frm, bss->ni_ath_flags,
2312 			bss->ni_ath_defkeyix);
2313 	if (vap->iv_appie_proberesp != NULL)
2314 		frm = add_appie(frm, vap->iv_appie_proberesp);
2315 	m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2316 
2317 	return m;
2318 }
2319 
2320 /*
2321  * Send a probe response frame to the specified mac address.
2322  * This does not go through the normal mgt frame api so we
2323  * can specify the destination address and re-use the bss node
2324  * for the sta reference.
2325  */
2326 int
2327 ieee80211_send_proberesp(struct ieee80211vap *vap,
2328 	const uint8_t da[IEEE80211_ADDR_LEN], int legacy)
2329 {
2330 	struct ieee80211_node *bss = vap->iv_bss;
2331 	struct ieee80211com *ic = vap->iv_ic;
2332 	struct ieee80211_frame *wh;
2333 	struct mbuf *m;
2334 
2335 	if (vap->iv_state == IEEE80211_S_CAC) {
2336 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, bss,
2337 		    "block %s frame in CAC state", "probe response");
2338 		vap->iv_stats.is_tx_badstate++;
2339 		return EIO;		/* XXX */
2340 	}
2341 
2342 	/*
2343 	 * Hold a reference on the node so it doesn't go away until after
2344 	 * the xmit is complete all the way in the driver.  On error we
2345 	 * will remove our reference.
2346 	 */
2347 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2348 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n",
2349 	    __func__, __LINE__, bss, ether_sprintf(bss->ni_macaddr),
2350 	    ieee80211_node_refcnt(bss)+1);
2351 	ieee80211_ref_node(bss);
2352 
2353 	m = ieee80211_alloc_proberesp(bss, legacy);
2354 	if (m == NULL) {
2355 		ieee80211_free_node(bss);
2356 		return ENOMEM;
2357 	}
2358 
2359 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
2360 	KASSERT(m != NULL, ("no room for header"));
2361 
2362 	wh = mtod(m, struct ieee80211_frame *);
2363 	ieee80211_send_setup(bss, wh,
2364 	     IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP,
2365 	     IEEE80211_NONQOS_TID, vap->iv_myaddr, da, bss->ni_bssid);
2366 	/* XXX power management? */
2367 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
2368 
2369 	M_WME_SETAC(m, WME_AC_BE);
2370 
2371 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_DUMPPKTS,
2372 	    "send probe resp on channel %u to %s%s\n",
2373 	    ieee80211_chan2ieee(ic, ic->ic_curchan), ether_sprintf(da),
2374 	    legacy ? " <legacy>" : "");
2375 	IEEE80211_NODE_STAT(bss, tx_mgmt);
2376 
2377 	return ic->ic_raw_xmit(bss, m, NULL);
2378 }
2379 
2380 /*
2381  * Allocate and build a RTS (Request To Send) control frame.
2382  */
2383 struct mbuf *
2384 ieee80211_alloc_rts(struct ieee80211com *ic,
2385 	const uint8_t ra[IEEE80211_ADDR_LEN],
2386 	const uint8_t ta[IEEE80211_ADDR_LEN],
2387 	uint16_t dur)
2388 {
2389 	struct ieee80211_frame_rts *rts;
2390 	struct mbuf *m;
2391 
2392 	/* XXX honor ic_headroom */
2393 	m = m_gethdr(M_DONTWAIT, MT_DATA);
2394 	if (m != NULL) {
2395 		rts = mtod(m, struct ieee80211_frame_rts *);
2396 		rts->i_fc[0] = IEEE80211_FC0_VERSION_0 |
2397 			IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_RTS;
2398 		rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2399 		*(u_int16_t *)rts->i_dur = htole16(dur);
2400 		IEEE80211_ADDR_COPY(rts->i_ra, ra);
2401 		IEEE80211_ADDR_COPY(rts->i_ta, ta);
2402 
2403 		m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_rts);
2404 	}
2405 	return m;
2406 }
2407 
2408 /*
2409  * Allocate and build a CTS (Clear To Send) control frame.
2410  */
2411 struct mbuf *
2412 ieee80211_alloc_cts(struct ieee80211com *ic,
2413 	const uint8_t ra[IEEE80211_ADDR_LEN], uint16_t dur)
2414 {
2415 	struct ieee80211_frame_cts *cts;
2416 	struct mbuf *m;
2417 
2418 	/* XXX honor ic_headroom */
2419 	m = m_gethdr(M_DONTWAIT, MT_DATA);
2420 	if (m != NULL) {
2421 		cts = mtod(m, struct ieee80211_frame_cts *);
2422 		cts->i_fc[0] = IEEE80211_FC0_VERSION_0 |
2423 			IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_CTS;
2424 		cts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2425 		*(u_int16_t *)cts->i_dur = htole16(dur);
2426 		IEEE80211_ADDR_COPY(cts->i_ra, ra);
2427 
2428 		m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_cts);
2429 	}
2430 	return m;
2431 }
2432 
2433 static void
2434 ieee80211_tx_mgt_timeout(void *arg)
2435 {
2436 	struct ieee80211_node *ni = arg;
2437 	struct ieee80211vap *vap = ni->ni_vap;
2438 
2439 	if (vap->iv_state != IEEE80211_S_INIT &&
2440 	    (vap->iv_ic->ic_flags & IEEE80211_F_SCAN) == 0) {
2441 		/*
2442 		 * NB: it's safe to specify a timeout as the reason here;
2443 		 *     it'll only be used in the right state.
2444 		 */
2445 		ieee80211_new_state(vap, IEEE80211_S_SCAN,
2446 			IEEE80211_SCAN_FAIL_TIMEOUT);
2447 	}
2448 }
2449 
2450 static void
2451 ieee80211_tx_mgt_cb(struct ieee80211_node *ni, void *arg, int status)
2452 {
2453 	struct ieee80211vap *vap = ni->ni_vap;
2454 	enum ieee80211_state ostate = (enum ieee80211_state) arg;
2455 
2456 	/*
2457 	 * Frame transmit completed; arrange timer callback.  If
2458 	 * transmit was successfuly we wait for response.  Otherwise
2459 	 * we arrange an immediate callback instead of doing the
2460 	 * callback directly since we don't know what state the driver
2461 	 * is in (e.g. what locks it is holding).  This work should
2462 	 * not be too time-critical and not happen too often so the
2463 	 * added overhead is acceptable.
2464 	 *
2465 	 * XXX what happens if !acked but response shows up before callback?
2466 	 */
2467 	if (vap->iv_state == ostate)
2468 		callout_reset(&vap->iv_mgtsend,
2469 			status == 0 ? IEEE80211_TRANS_WAIT*hz : 0,
2470 			ieee80211_tx_mgt_timeout, ni);
2471 }
2472 
2473 static void
2474 ieee80211_beacon_construct(struct mbuf *m, uint8_t *frm,
2475 	struct ieee80211_beacon_offsets *bo, struct ieee80211_node *ni)
2476 {
2477 	struct ieee80211vap *vap = ni->ni_vap;
2478 	struct ieee80211com *ic = ni->ni_ic;
2479 	struct ieee80211_rateset *rs = &ni->ni_rates;
2480 	uint16_t capinfo;
2481 
2482 	/*
2483 	 * beacon frame format
2484 	 *	[8] time stamp
2485 	 *	[2] beacon interval
2486 	 *	[2] cabability information
2487 	 *	[tlv] ssid
2488 	 *	[tlv] supported rates
2489 	 *	[3] parameter set (DS)
2490 	 *	[8] CF parameter set (optional)
2491 	 *	[tlv] parameter set (IBSS/TIM)
2492 	 *	[tlv] country (optional)
2493 	 *	[3] power control (optional)
2494 	 *	[5] channel switch announcement (CSA) (optional)
2495 	 *	[tlv] extended rate phy (ERP)
2496 	 *	[tlv] extended supported rates
2497 	 *	[tlv] RSN parameters
2498 	 *	[tlv] HT capabilities
2499 	 *	[tlv] HT information
2500 	 * XXX Vendor-specific OIDs (e.g. Atheros)
2501 	 *	[tlv] WPA parameters
2502 	 *	[tlv] WME parameters
2503 	 *	[tlv] Vendor OUI HT capabilities (optional)
2504 	 *	[tlv] Vendor OUI HT information (optional)
2505 	 *	[tlv] application data (optional)
2506 	 */
2507 
2508 	memset(bo, 0, sizeof(*bo));
2509 
2510 	memset(frm, 0, 8);	/* XXX timestamp is set by hardware/driver */
2511 	frm += 8;
2512 	*(uint16_t *)frm = htole16(ni->ni_intval);
2513 	frm += 2;
2514 	capinfo = getcapinfo(vap, ni->ni_chan);
2515 	bo->bo_caps = (uint16_t *)frm;
2516 	*(uint16_t *)frm = htole16(capinfo);
2517 	frm += 2;
2518 	*frm++ = IEEE80211_ELEMID_SSID;
2519 	if ((vap->iv_flags & IEEE80211_F_HIDESSID) == 0) {
2520 		*frm++ = ni->ni_esslen;
2521 		memcpy(frm, ni->ni_essid, ni->ni_esslen);
2522 		frm += ni->ni_esslen;
2523 	} else
2524 		*frm++ = 0;
2525 	frm = ieee80211_add_rates(frm, rs);
2526 	if (!IEEE80211_IS_CHAN_FHSS(ni->ni_chan)) {
2527 		*frm++ = IEEE80211_ELEMID_DSPARMS;
2528 		*frm++ = 1;
2529 		*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
2530 	}
2531 	if (ic->ic_flags & IEEE80211_F_PCF) {
2532 		bo->bo_cfp = frm;
2533 		frm = ieee80211_add_cfparms(frm, ic);
2534 	}
2535 	bo->bo_tim = frm;
2536 	if (vap->iv_opmode == IEEE80211_M_IBSS) {
2537 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
2538 		*frm++ = 2;
2539 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
2540 		bo->bo_tim_len = 0;
2541 	} else if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
2542 		struct ieee80211_tim_ie *tie = (struct ieee80211_tim_ie *) frm;
2543 
2544 		tie->tim_ie = IEEE80211_ELEMID_TIM;
2545 		tie->tim_len = 4;	/* length */
2546 		tie->tim_count = 0;	/* DTIM count */
2547 		tie->tim_period = vap->iv_dtim_period;	/* DTIM period */
2548 		tie->tim_bitctl = 0;	/* bitmap control */
2549 		tie->tim_bitmap[0] = 0;	/* Partial Virtual Bitmap */
2550 		frm += sizeof(struct ieee80211_tim_ie);
2551 		bo->bo_tim_len = 1;
2552 	}
2553 	bo->bo_tim_trailer = frm;
2554 	if ((vap->iv_flags & IEEE80211_F_DOTH) ||
2555 	    (vap->iv_flags_ext & IEEE80211_FEXT_DOTD))
2556 		frm = ieee80211_add_countryie(frm, ic);
2557 	if (vap->iv_flags & IEEE80211_F_DOTH) {
2558 		if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan))
2559 			frm = ieee80211_add_powerconstraint(frm, vap);
2560 		bo->bo_csa = frm;
2561 		if (ic->ic_flags & IEEE80211_F_CSAPENDING)
2562 			frm = ieee80211_add_csa(frm, vap);
2563 	} else
2564 		bo->bo_csa = frm;
2565 	if (IEEE80211_IS_CHAN_ANYG(ni->ni_chan)) {
2566 		bo->bo_erp = frm;
2567 		frm = ieee80211_add_erp(frm, ic);
2568 	}
2569 	frm = ieee80211_add_xrates(frm, rs);
2570 	if (vap->iv_flags & IEEE80211_F_WPA2) {
2571 		if (vap->iv_rsn_ie != NULL)
2572 			frm = add_ie(frm, vap->iv_rsn_ie);
2573 		/* XXX else complain */
2574 	}
2575 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
2576 		frm = ieee80211_add_htcap(frm, ni);
2577 		bo->bo_htinfo = frm;
2578 		frm = ieee80211_add_htinfo(frm, ni);
2579 	}
2580 	if (vap->iv_flags & IEEE80211_F_WPA1) {
2581 		if (vap->iv_wpa_ie != NULL)
2582 			frm = add_ie(frm, vap->iv_wpa_ie);
2583 		/* XXX else complain */
2584 	}
2585 	if (vap->iv_flags & IEEE80211_F_WME) {
2586 		bo->bo_wme = frm;
2587 		frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
2588 	}
2589 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan) &&
2590 	    (vap->iv_flags_ext & IEEE80211_FEXT_HTCOMPAT)) {
2591 		frm = ieee80211_add_htcap_vendor(frm, ni);
2592 		frm = ieee80211_add_htinfo_vendor(frm, ni);
2593 	}
2594 	if (vap->iv_appie_beacon != NULL) {
2595 		bo->bo_appie = frm;
2596 		bo->bo_appie_len = vap->iv_appie_beacon->ie_len;
2597 		frm = add_appie(frm, vap->iv_appie_beacon);
2598 	}
2599 	bo->bo_tim_trailer_len = frm - bo->bo_tim_trailer;
2600 	bo->bo_csa_trailer_len = frm - bo->bo_csa;
2601 	m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2602 }
2603 
2604 /*
2605  * Allocate a beacon frame and fillin the appropriate bits.
2606  */
2607 struct mbuf *
2608 ieee80211_beacon_alloc(struct ieee80211_node *ni,
2609 	struct ieee80211_beacon_offsets *bo)
2610 {
2611 	struct ieee80211vap *vap = ni->ni_vap;
2612 	struct ieee80211com *ic = ni->ni_ic;
2613 	struct ifnet *ifp = vap->iv_ifp;
2614 	struct ieee80211_frame *wh;
2615 	struct mbuf *m;
2616 	int pktlen;
2617 	uint8_t *frm;
2618 
2619 	/*
2620 	 * beacon frame format
2621 	 *	[8] time stamp
2622 	 *	[2] beacon interval
2623 	 *	[2] cabability information
2624 	 *	[tlv] ssid
2625 	 *	[tlv] supported rates
2626 	 *	[3] parameter set (DS)
2627 	 *	[8] CF parameter set (optional)
2628 	 *	[tlv] parameter set (IBSS/TIM)
2629 	 *	[tlv] country (optional)
2630 	 *	[3] power control (optional)
2631 	 *	[5] channel switch announcement (CSA) (optional)
2632 	 *	[tlv] extended rate phy (ERP)
2633 	 *	[tlv] extended supported rates
2634 	 *	[tlv] RSN parameters
2635 	 *	[tlv] HT capabilities
2636 	 *	[tlv] HT information
2637 	 *	[tlv] Vendor OUI HT capabilities (optional)
2638 	 *	[tlv] Vendor OUI HT information (optional)
2639 	 * XXX Vendor-specific OIDs (e.g. Atheros)
2640 	 *	[tlv] WPA parameters
2641 	 *	[tlv] WME parameters
2642 	 *	[tlv] application data (optional)
2643 	 * NB: we allocate the max space required for the TIM bitmap.
2644 	 * XXX how big is this?
2645 	 */
2646 	pktlen =   8					/* time stamp */
2647 		 + sizeof(uint16_t)			/* beacon interval */
2648 		 + sizeof(uint16_t)			/* capabilities */
2649 		 + 2 + ni->ni_esslen			/* ssid */
2650 	         + 2 + IEEE80211_RATE_SIZE		/* supported rates */
2651 	         + 2 + 1				/* DS parameters */
2652 		 + 2 + 6				/* CF parameters */
2653 		 + 2 + 4 + vap->iv_tim_len		/* DTIM/IBSSPARMS */
2654 		 + IEEE80211_COUNTRY_MAX_SIZE		/* country */
2655 		 + 2 + 1				/* power control */
2656 	         + sizeof(struct ieee80211_csa_ie)	/* CSA */
2657 		 + 2 + 1				/* ERP */
2658 	         + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2659 		 + (vap->iv_caps & IEEE80211_C_WPA ?	/* WPA 1+2 */
2660 			2*sizeof(struct ieee80211_ie_wpa) : 0)
2661 		 /* XXX conditional? */
2662 		 + 4+2*sizeof(struct ieee80211_ie_htcap)/* HT caps */
2663 		 + 4+2*sizeof(struct ieee80211_ie_htinfo)/* HT info */
2664 		 + (vap->iv_caps & IEEE80211_C_WME ?	/* WME */
2665 			sizeof(struct ieee80211_wme_param) : 0)
2666 		 + IEEE80211_MAX_APPIE
2667 		 ;
2668 	m = ieee80211_getmgtframe(&frm,
2669 		ic->ic_headroom + sizeof(struct ieee80211_frame), pktlen);
2670 	if (m == NULL) {
2671 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
2672 			"%s: cannot get buf; size %u\n", __func__, pktlen);
2673 		vap->iv_stats.is_tx_nobuf++;
2674 		return NULL;
2675 	}
2676 	ieee80211_beacon_construct(m, frm, bo, ni);
2677 
2678 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
2679 	KASSERT(m != NULL, ("no space for 802.11 header?"));
2680 	wh = mtod(m, struct ieee80211_frame *);
2681 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2682 	    IEEE80211_FC0_SUBTYPE_BEACON;
2683 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2684 	*(uint16_t *)wh->i_dur = 0;
2685 	IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
2686 	IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
2687 	IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
2688 	*(uint16_t *)wh->i_seq = 0;
2689 
2690 	return m;
2691 }
2692 
2693 /*
2694  * Update the dynamic parts of a beacon frame based on the current state.
2695  */
2696 int
2697 ieee80211_beacon_update(struct ieee80211_node *ni,
2698 	struct ieee80211_beacon_offsets *bo, struct mbuf *m, int mcast)
2699 {
2700 	struct ieee80211vap *vap = ni->ni_vap;
2701 	struct ieee80211com *ic = ni->ni_ic;
2702 	int len_changed = 0;
2703 	uint16_t capinfo;
2704 
2705 	IEEE80211_LOCK(ic);
2706 	/*
2707 	 * Handle 11h channel change when we've reached the count.
2708 	 * We must recalculate the beacon frame contents to account
2709 	 * for the new channel.  Note we do this only for the first
2710 	 * vap that reaches this point; subsequent vaps just update
2711 	 * their beacon state to reflect the recalculated channel.
2712 	 */
2713 	if (isset(bo->bo_flags, IEEE80211_BEACON_CSA) &&
2714 	    vap->iv_csa_count == ic->ic_csa_count) {
2715 		vap->iv_csa_count = 0;
2716 		/*
2717 		 * Effect channel change before reconstructing the beacon
2718 		 * frame contents as many places reference ni_chan.
2719 		 */
2720 		if (ic->ic_csa_newchan != NULL)
2721 			ieee80211_csa_completeswitch(ic);
2722 		/*
2723 		 * NB: ieee80211_beacon_construct clears all pending
2724 		 * updates in bo_flags so we don't need to explicitly
2725 		 * clear IEEE80211_BEACON_CSA.
2726 		 */
2727 		ieee80211_beacon_construct(m,
2728 		    mtod(m, uint8_t*) + sizeof(struct ieee80211_frame), bo, ni);
2729 
2730 		/* XXX do WME aggressive mode processing? */
2731 		IEEE80211_UNLOCK(ic);
2732 		return 1;		/* just assume length changed */
2733 	}
2734 
2735 	/* XXX faster to recalculate entirely or just changes? */
2736 	capinfo = getcapinfo(vap, ni->ni_chan);
2737 	*bo->bo_caps = htole16(capinfo);
2738 
2739 	if (vap->iv_flags & IEEE80211_F_WME) {
2740 		struct ieee80211_wme_state *wme = &ic->ic_wme;
2741 
2742 		/*
2743 		 * Check for agressive mode change.  When there is
2744 		 * significant high priority traffic in the BSS
2745 		 * throttle back BE traffic by using conservative
2746 		 * parameters.  Otherwise BE uses agressive params
2747 		 * to optimize performance of legacy/non-QoS traffic.
2748 		 */
2749 		if (wme->wme_flags & WME_F_AGGRMODE) {
2750 			if (wme->wme_hipri_traffic >
2751 			    wme->wme_hipri_switch_thresh) {
2752 				IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
2753 				    "%s: traffic %u, disable aggressive mode\n",
2754 				    __func__, wme->wme_hipri_traffic);
2755 				wme->wme_flags &= ~WME_F_AGGRMODE;
2756 				ieee80211_wme_updateparams_locked(vap);
2757 				wme->wme_hipri_traffic =
2758 					wme->wme_hipri_switch_hysteresis;
2759 			} else
2760 				wme->wme_hipri_traffic = 0;
2761 		} else {
2762 			if (wme->wme_hipri_traffic <=
2763 			    wme->wme_hipri_switch_thresh) {
2764 				IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
2765 				    "%s: traffic %u, enable aggressive mode\n",
2766 				    __func__, wme->wme_hipri_traffic);
2767 				wme->wme_flags |= WME_F_AGGRMODE;
2768 				ieee80211_wme_updateparams_locked(vap);
2769 				wme->wme_hipri_traffic = 0;
2770 			} else
2771 				wme->wme_hipri_traffic =
2772 					wme->wme_hipri_switch_hysteresis;
2773 		}
2774 		if (isset(bo->bo_flags, IEEE80211_BEACON_WME)) {
2775 			(void) ieee80211_add_wme_param(bo->bo_wme, wme);
2776 			clrbit(bo->bo_flags, IEEE80211_BEACON_WME);
2777 		}
2778 	}
2779 
2780 	if (isset(bo->bo_flags,  IEEE80211_BEACON_HTINFO)) {
2781 		ieee80211_ht_update_beacon(vap, bo);
2782 		clrbit(bo->bo_flags, IEEE80211_BEACON_HTINFO);
2783 	}
2784 
2785 	if (vap->iv_opmode == IEEE80211_M_HOSTAP) {	/* NB: no IBSS support*/
2786 		struct ieee80211_tim_ie *tie =
2787 			(struct ieee80211_tim_ie *) bo->bo_tim;
2788 		if (isset(bo->bo_flags, IEEE80211_BEACON_TIM)) {
2789 			u_int timlen, timoff, i;
2790 			/*
2791 			 * ATIM/DTIM needs updating.  If it fits in the
2792 			 * current space allocated then just copy in the
2793 			 * new bits.  Otherwise we need to move any trailing
2794 			 * data to make room.  Note that we know there is
2795 			 * contiguous space because ieee80211_beacon_allocate
2796 			 * insures there is space in the mbuf to write a
2797 			 * maximal-size virtual bitmap (based on iv_max_aid).
2798 			 */
2799 			/*
2800 			 * Calculate the bitmap size and offset, copy any
2801 			 * trailer out of the way, and then copy in the
2802 			 * new bitmap and update the information element.
2803 			 * Note that the tim bitmap must contain at least
2804 			 * one byte and any offset must be even.
2805 			 */
2806 			if (vap->iv_ps_pending != 0) {
2807 				timoff = 128;		/* impossibly large */
2808 				for (i = 0; i < vap->iv_tim_len; i++)
2809 					if (vap->iv_tim_bitmap[i]) {
2810 						timoff = i &~ 1;
2811 						break;
2812 					}
2813 				KASSERT(timoff != 128, ("tim bitmap empty!"));
2814 				for (i = vap->iv_tim_len-1; i >= timoff; i--)
2815 					if (vap->iv_tim_bitmap[i])
2816 						break;
2817 				timlen = 1 + (i - timoff);
2818 			} else {
2819 				timoff = 0;
2820 				timlen = 1;
2821 			}
2822 			if (timlen != bo->bo_tim_len) {
2823 				/* copy up/down trailer */
2824 				int adjust = tie->tim_bitmap+timlen
2825 					   - bo->bo_tim_trailer;
2826 				ovbcopy(bo->bo_tim_trailer,
2827 				    bo->bo_tim_trailer+adjust,
2828 				    bo->bo_tim_trailer_len);
2829 				bo->bo_tim_trailer += adjust;
2830 				bo->bo_erp += adjust;
2831 				bo->bo_htinfo += adjust;
2832 				bo->bo_appie += adjust;
2833 				bo->bo_wme += adjust;
2834 				bo->bo_csa += adjust;
2835 				bo->bo_tim_len = timlen;
2836 
2837 				/* update information element */
2838 				tie->tim_len = 3 + timlen;
2839 				tie->tim_bitctl = timoff;
2840 				len_changed = 1;
2841 			}
2842 			memcpy(tie->tim_bitmap, vap->iv_tim_bitmap + timoff,
2843 				bo->bo_tim_len);
2844 
2845 			clrbit(bo->bo_flags, IEEE80211_BEACON_TIM);
2846 
2847 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_POWER,
2848 				"%s: TIM updated, pending %u, off %u, len %u\n",
2849 				__func__, vap->iv_ps_pending, timoff, timlen);
2850 		}
2851 		/* count down DTIM period */
2852 		if (tie->tim_count == 0)
2853 			tie->tim_count = tie->tim_period - 1;
2854 		else
2855 			tie->tim_count--;
2856 		/* update state for buffered multicast frames on DTIM */
2857 		if (mcast && tie->tim_count == 0)
2858 			tie->tim_bitctl |= 1;
2859 		else
2860 			tie->tim_bitctl &= ~1;
2861 		if (isset(bo->bo_flags, IEEE80211_BEACON_CSA)) {
2862 			struct ieee80211_csa_ie *csa =
2863 			    (struct ieee80211_csa_ie *) bo->bo_csa;
2864 
2865 			/*
2866 			 * Insert or update CSA ie.  If we're just starting
2867 			 * to count down to the channel switch then we need
2868 			 * to insert the CSA ie.  Otherwise we just need to
2869 			 * drop the count.  The actual change happens above
2870 			 * when the vap's count reaches the target count.
2871 			 */
2872 			if (vap->iv_csa_count == 0) {
2873 				memmove(&csa[1], csa, bo->bo_csa_trailer_len);
2874 				bo->bo_erp += sizeof(*csa);
2875 				bo->bo_wme += sizeof(*csa);
2876 				bo->bo_appie += sizeof(*csa);
2877 				bo->bo_csa_trailer_len += sizeof(*csa);
2878 				bo->bo_tim_trailer_len += sizeof(*csa);
2879 				m->m_len += sizeof(*csa);
2880 				m->m_pkthdr.len += sizeof(*csa);
2881 
2882 				ieee80211_add_csa(bo->bo_csa, vap);
2883 			} else
2884 				csa->csa_count--;
2885 			vap->iv_csa_count++;
2886 			/* NB: don't clear IEEE80211_BEACON_CSA */
2887 		}
2888 		if (isset(bo->bo_flags, IEEE80211_BEACON_ERP)) {
2889 			/*
2890 			 * ERP element needs updating.
2891 			 */
2892 			(void) ieee80211_add_erp(bo->bo_erp, ic);
2893 			clrbit(bo->bo_flags, IEEE80211_BEACON_ERP);
2894 		}
2895 	}
2896 	if (isset(bo->bo_flags, IEEE80211_BEACON_APPIE)) {
2897 		const struct ieee80211_appie *aie = vap->iv_appie_beacon;
2898 		int aielen;
2899 		uint8_t *frm;
2900 
2901 		aielen = 0;
2902 		if (aie != NULL)
2903 			aielen += aie->ie_len;
2904 		if (aielen != bo->bo_appie_len) {
2905 			/* copy up/down trailer */
2906 			int adjust = aielen - bo->bo_appie_len;
2907 			ovbcopy(bo->bo_tim_trailer, bo->bo_tim_trailer+adjust,
2908 				bo->bo_tim_trailer_len);
2909 			bo->bo_tim_trailer += adjust;
2910 			bo->bo_appie += adjust;
2911 			bo->bo_appie_len = aielen;
2912 
2913 			len_changed = 1;
2914 		}
2915 		frm = bo->bo_appie;
2916 		if (aie != NULL)
2917 			frm  = add_appie(frm, aie);
2918 		clrbit(bo->bo_flags, IEEE80211_BEACON_APPIE);
2919 	}
2920 	IEEE80211_UNLOCK(ic);
2921 
2922 	return len_changed;
2923 }
2924