xref: /freebsd/sys/net80211/ieee80211_output.c (revision 6af83ee0d2941d18880b6aaa2b4facd1d30c6106)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include "opt_inet.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/kernel.h>
42 #include <sys/endian.h>
43 
44 #include <sys/socket.h>
45 
46 #include <net/bpf.h>
47 #include <net/ethernet.h>
48 #include <net/if.h>
49 #include <net/if_llc.h>
50 #include <net/if_media.h>
51 #include <net/if_vlan_var.h>
52 
53 #include <net80211/ieee80211_var.h>
54 
55 #ifdef INET
56 #include <netinet/in.h>
57 #include <netinet/if_ether.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/ip.h>
60 #endif
61 
62 #ifdef IEEE80211_DEBUG
63 /*
64  * Decide if an outbound management frame should be
65  * printed when debugging is enabled.  This filters some
66  * of the less interesting frames that come frequently
67  * (e.g. beacons).
68  */
69 static __inline int
70 doprint(struct ieee80211com *ic, int subtype)
71 {
72 	switch (subtype) {
73 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
74 		return (ic->ic_opmode == IEEE80211_M_IBSS);
75 	}
76 	return 1;
77 }
78 #endif
79 
80 /*
81  * Send a management frame to the specified node.  The node pointer
82  * must have a reference as the pointer will be passed to the driver
83  * and potentially held for a long time.  If the frame is successfully
84  * dispatched to the driver, then it is responsible for freeing the
85  * reference (and potentially free'ing up any associated storage).
86  */
87 static int
88 ieee80211_mgmt_output(struct ieee80211com *ic, struct ieee80211_node *ni,
89     struct mbuf *m, int type)
90 {
91 	struct ifnet *ifp = ic->ic_ifp;
92 	struct ieee80211_frame *wh;
93 
94 	KASSERT(ni != NULL, ("null node"));
95 
96 	/*
97 	 * Yech, hack alert!  We want to pass the node down to the
98 	 * driver's start routine.  If we don't do so then the start
99 	 * routine must immediately look it up again and that can
100 	 * cause a lock order reversal if, for example, this frame
101 	 * is being sent because the station is being timedout and
102 	 * the frame being sent is a DEAUTH message.  We could stick
103 	 * this in an m_tag and tack that on to the mbuf.  However
104 	 * that's rather expensive to do for every frame so instead
105 	 * we stuff it in the rcvif field since outbound frames do
106 	 * not (presently) use this.
107 	 */
108 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
109 	if (m == NULL)
110 		return ENOMEM;
111 	KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
112 	m->m_pkthdr.rcvif = (void *)ni;
113 
114 	wh = mtod(m, struct ieee80211_frame *);
115 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
116 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
117 	*(u_int16_t *)wh->i_dur = 0;
118 	*(u_int16_t *)wh->i_seq =
119 	    htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
120 	ni->ni_txseqs[0]++;
121 	/*
122 	 * Hack.  When sending PROBE_REQ frames while scanning we
123 	 * explicitly force a broadcast rather than (as before) clobber
124 	 * ni_macaddr and ni_bssid.  This is stopgap, we need a way
125 	 * to communicate this directly rather than do something
126 	 * implicit based on surrounding state.
127 	 */
128 	if (type == IEEE80211_FC0_SUBTYPE_PROBE_REQ &&
129 	    (ic->ic_flags & IEEE80211_F_SCAN)) {
130 		IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
131 		IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
132 		IEEE80211_ADDR_COPY(wh->i_addr3, ifp->if_broadcastaddr);
133 	} else {
134 		IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
135 		IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
136 		IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
137 	}
138 
139 	if ((m->m_flags & M_LINK0) != 0 && ni->ni_challenge != NULL) {
140 		m->m_flags &= ~M_LINK0;
141 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
142 			"[%s] encrypting frame (%s)\n",
143 			ether_sprintf(wh->i_addr1), __func__);
144 		wh->i_fc[1] |= IEEE80211_FC1_WEP;
145 	}
146 #ifdef IEEE80211_DEBUG
147 	/* avoid printing too many frames */
148 	if ((ieee80211_msg_debug(ic) && doprint(ic, type)) ||
149 	    ieee80211_msg_dumppkts(ic)) {
150 		printf("[%s] send %s on channel %u\n",
151 		    ether_sprintf(wh->i_addr1),
152 		    ieee80211_mgt_subtype_name[
153 			(type & IEEE80211_FC0_SUBTYPE_MASK) >>
154 				IEEE80211_FC0_SUBTYPE_SHIFT],
155 		    ieee80211_chan2ieee(ic, ni->ni_chan));
156 	}
157 #endif
158 	IEEE80211_NODE_STAT(ni, tx_mgmt);
159 	IF_ENQUEUE(&ic->ic_mgtq, m);
160 	ifp->if_timer = 1;
161 	if_start(ifp);
162 	return 0;
163 }
164 
165 /*
166  * Send a null data frame to the specified node.
167  */
168 int
169 ieee80211_send_nulldata(struct ieee80211com *ic, struct ieee80211_node *ni)
170 {
171 	struct ifnet *ifp = ic->ic_ifp;
172 	struct mbuf *m;
173 	struct ieee80211_frame *wh;
174 
175 	MGETHDR(m, M_NOWAIT, MT_HEADER);
176 	if (m == NULL) {
177 		/* XXX debug msg */
178 		ic->ic_stats.is_tx_nobuf++;
179 		return ENOMEM;
180 	}
181 	m->m_pkthdr.rcvif = (void *) ieee80211_ref_node(ni);
182 
183 	wh = mtod(m, struct ieee80211_frame *);
184 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA |
185 		IEEE80211_FC0_SUBTYPE_NODATA;
186 	*(u_int16_t *)wh->i_dur = 0;
187 	*(u_int16_t *)wh->i_seq =
188 	    htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
189 	ni->ni_txseqs[0]++;
190 
191 	/* XXX WDS */
192 	wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
193 	IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
194 	IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
195 	IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_myaddr);
196 	m->m_len = m->m_pkthdr.len = sizeof(struct ieee80211_frame);
197 
198 	IEEE80211_NODE_STAT(ni, tx_data);
199 
200 	IF_ENQUEUE(&ic->ic_mgtq, m);		/* cheat */
201 	if_start(ifp);
202 
203 	return 0;
204 }
205 
206 /*
207  * Assign priority to a frame based on any vlan tag assigned
208  * to the station and/or any Diffserv setting in an IP header.
209  * Finally, if an ACM policy is setup (in station mode) it's
210  * applied.
211  */
212 int
213 ieee80211_classify(struct ieee80211com *ic, struct mbuf *m, struct ieee80211_node *ni)
214 {
215 	int v_wme_ac, d_wme_ac, ac;
216 #ifdef INET
217 	struct ether_header *eh;
218 #endif
219 
220 	if ((ni->ni_flags & IEEE80211_NODE_QOS) == 0) {
221 		ac = WME_AC_BE;
222 		goto done;
223 	}
224 
225 	/*
226 	 * If node has a vlan tag then all traffic
227 	 * to it must have a matching tag.
228 	 */
229 	v_wme_ac = 0;
230 	if (ni->ni_vlan != 0) {
231 		 struct m_tag *mtag = VLAN_OUTPUT_TAG(ic->ic_ifp, m);
232 		 if (mtag != NULL) {
233 			IEEE80211_NODE_STAT(ni, tx_novlantag);
234 			return 1;
235 		}
236 		if (EVL_VLANOFTAG(VLAN_TAG_VALUE(mtag)) !=
237 		    EVL_VLANOFTAG(ni->ni_vlan)) {
238 			IEEE80211_NODE_STAT(ni, tx_vlanmismatch);
239 			return 1;
240 		}
241 		/* map vlan priority to AC */
242 		switch (EVL_PRIOFTAG(ni->ni_vlan)) {
243 		case 1:
244 		case 2:
245 			v_wme_ac = WME_AC_BK;
246 			break;
247 		case 0:
248 		case 3:
249 			v_wme_ac = WME_AC_BE;
250 			break;
251 		case 4:
252 		case 5:
253 			v_wme_ac = WME_AC_VI;
254 			break;
255 		case 6:
256 		case 7:
257 			v_wme_ac = WME_AC_VO;
258 			break;
259 		}
260 	}
261 
262 #ifdef INET
263 	eh = mtod(m, struct ether_header *);
264 	if (eh->ether_type == htons(ETHERTYPE_IP)) {
265 		const struct ip *ip = (struct ip *)
266 			(mtod(m, u_int8_t *) + sizeof (*eh));
267 		/*
268 		 * IP frame, map the TOS field.
269 		 */
270 		switch (ip->ip_tos) {
271 		case 0x08:
272 		case 0x20:
273 			d_wme_ac = WME_AC_BK;	/* background */
274 			break;
275 		case 0x28:
276 		case 0xa0:
277 			d_wme_ac = WME_AC_VI;	/* video */
278 			break;
279 		case 0x30:			/* voice */
280 		case 0xe0:
281 		case 0x88:			/* XXX UPSD */
282 		case 0xb8:
283 			d_wme_ac = WME_AC_VO;
284 			break;
285 		default:
286 			d_wme_ac = WME_AC_BE;
287 			break;
288 		}
289 	} else {
290 #endif /* INET */
291 		d_wme_ac = WME_AC_BE;
292 #ifdef INET
293 	}
294 #endif
295 	/*
296 	 * Use highest priority AC.
297 	 */
298 	if (v_wme_ac > d_wme_ac)
299 		ac = v_wme_ac;
300 	else
301 		ac = d_wme_ac;
302 
303 	/*
304 	 * Apply ACM policy.
305 	 */
306 	if (ic->ic_opmode == IEEE80211_M_STA) {
307 		static const int acmap[4] = {
308 			WME_AC_BK,	/* WME_AC_BE */
309 			WME_AC_BK,	/* WME_AC_BK */
310 			WME_AC_BE,	/* WME_AC_VI */
311 			WME_AC_VI,	/* WME_AC_VO */
312 		};
313 		while (ac != WME_AC_BK &&
314 		    ic->ic_wme.wme_wmeBssChanParams.cap_wmeParams[ac].wmep_acm)
315 			ac = acmap[ac];
316 	}
317 done:
318 	M_WME_SETAC(m, ac);
319 	return 0;
320 }
321 
322 /*
323  * Insure there is sufficient contiguous space to encapsulate the
324  * 802.11 data frame.  If room isn't already there, arrange for it.
325  * Drivers and cipher modules assume we have done the necessary work
326  * and fail rudely if they don't find the space they need.
327  */
328 static struct mbuf *
329 ieee80211_mbuf_adjust(struct ieee80211com *ic, int hdrsize,
330 	struct ieee80211_key *key, struct mbuf *m)
331 {
332 #define	TO_BE_RECLAIMED	(sizeof(struct ether_header) - sizeof(struct llc))
333 	int needed_space = hdrsize;
334 
335 	if (key != NULL) {
336 		/* XXX belongs in crypto code? */
337 		needed_space += key->wk_cipher->ic_header;
338 		/* XXX frags */
339 	}
340 	/*
341 	 * We know we are called just before stripping an Ethernet
342 	 * header and prepending an LLC header.  This means we know
343 	 * there will be
344 	 *	sizeof(struct ether_header) - sizeof(struct llc)
345 	 * bytes recovered to which we need additional space for the
346 	 * 802.11 header and any crypto header.
347 	 */
348 	/* XXX check trailing space and copy instead? */
349 	if (M_LEADINGSPACE(m) < needed_space - TO_BE_RECLAIMED) {
350 		struct mbuf *n = m_gethdr(M_NOWAIT, m->m_type);
351 		if (n == NULL) {
352 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
353 			    "%s: cannot expand storage\n", __func__);
354 			ic->ic_stats.is_tx_nobuf++;
355 			m_freem(m);
356 			return NULL;
357 		}
358 		KASSERT(needed_space <= MHLEN,
359 		    ("not enough room, need %u got %zu\n", needed_space, MHLEN));
360 		/*
361 		 * Setup new mbuf to have leading space to prepend the
362 		 * 802.11 header and any crypto header bits that are
363 		 * required (the latter are added when the driver calls
364 		 * back to ieee80211_crypto_encap to do crypto encapsulation).
365 		 */
366 		/* NB: must be first 'cuz it clobbers m_data */
367 		m_move_pkthdr(n, m);
368 		n->m_len = 0;			/* NB: m_gethdr does not set */
369 		n->m_data += needed_space;
370 		/*
371 		 * Pull up Ethernet header to create the expected layout.
372 		 * We could use m_pullup but that's overkill (i.e. we don't
373 		 * need the actual data) and it cannot fail so do it inline
374 		 * for speed.
375 		 */
376 		/* NB: struct ether_header is known to be contiguous */
377 		n->m_len += sizeof(struct ether_header);
378 		m->m_len -= sizeof(struct ether_header);
379 		m->m_data += sizeof(struct ether_header);
380 		/*
381 		 * Replace the head of the chain.
382 		 */
383 		n->m_next = m;
384 		m = n;
385 	}
386 	return m;
387 #undef TO_BE_RECLAIMED
388 }
389 
390 #define	KEY_UNDEFINED(k)	((k).wk_cipher == &ieee80211_cipher_none)
391 /*
392  * Return the transmit key to use in sending a unicast frame.
393  * If a unicast key is set we use that.  When no unicast key is set
394  * we fall back to the default transmit key.
395  */
396 static __inline struct ieee80211_key *
397 ieee80211_crypto_getucastkey(struct ieee80211com *ic, struct ieee80211_node *ni)
398 {
399 	if (KEY_UNDEFINED(ni->ni_ucastkey)) {
400 		if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE ||
401 		    KEY_UNDEFINED(ic->ic_nw_keys[ic->ic_def_txkey]))
402 			return NULL;
403 		return &ic->ic_nw_keys[ic->ic_def_txkey];
404 	} else {
405 		return &ni->ni_ucastkey;
406 	}
407 }
408 
409 /*
410  * Return the transmit key to use in sending a multicast frame.
411  * Multicast traffic always uses the group key which is installed as
412  * the default tx key.
413  */
414 static __inline struct ieee80211_key *
415 ieee80211_crypto_getmcastkey(struct ieee80211com *ic, struct ieee80211_node *ni)
416 {
417 	if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE ||
418 	    KEY_UNDEFINED(ic->ic_nw_keys[ic->ic_def_txkey]))
419 		return NULL;
420 	return &ic->ic_nw_keys[ic->ic_def_txkey];
421 }
422 
423 /*
424  * Encapsulate an outbound data frame.  The mbuf chain is updated.
425  * If an error is encountered NULL is returned.  The caller is required
426  * to provide a node reference and pullup the ethernet header in the
427  * first mbuf.
428  */
429 struct mbuf *
430 ieee80211_encap(struct ieee80211com *ic, struct mbuf *m,
431 	struct ieee80211_node *ni)
432 {
433 	struct ether_header eh;
434 	struct ieee80211_frame *wh;
435 	struct ieee80211_key *key;
436 	struct llc *llc;
437 	int hdrsize, datalen, addqos;
438 
439 	KASSERT(m->m_len >= sizeof(eh), ("no ethernet header!"));
440 	memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
441 
442 	/*
443 	 * Insure space for additional headers.  First identify
444 	 * transmit key to use in calculating any buffer adjustments
445 	 * required.  This is also used below to do privacy
446 	 * encapsulation work.  Then calculate the 802.11 header
447 	 * size and any padding required by the driver.
448 	 *
449 	 * Note key may be NULL if we fall back to the default
450 	 * transmit key and that is not set.  In that case the
451 	 * buffer may not be expanded as needed by the cipher
452 	 * routines, but they will/should discard it.
453 	 */
454 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
455 		if (ic->ic_opmode == IEEE80211_M_STA ||
456 		    !IEEE80211_IS_MULTICAST(eh.ether_dhost))
457 			key = ieee80211_crypto_getucastkey(ic, ni);
458 		else
459 			key = ieee80211_crypto_getmcastkey(ic, ni);
460 		if (key == NULL && eh.ether_type != htons(ETHERTYPE_PAE)) {
461 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
462 			    "[%s] no default transmit key (%s) deftxkey %u\n",
463 			    ether_sprintf(eh.ether_dhost), __func__,
464 			    ic->ic_def_txkey);
465 			ic->ic_stats.is_tx_nodefkey++;
466 		}
467 	} else
468 		key = NULL;
469 	/* XXX 4-address format */
470 	/*
471 	 * XXX Some ap's don't handle QoS-encapsulated EAPOL
472 	 * frames so suppress use.  This may be an issue if other
473 	 * ap's require all data frames to be QoS-encapsulated
474 	 * once negotiated in which case we'll need to make this
475 	 * configurable.
476 	 */
477 	addqos = (ni->ni_flags & IEEE80211_NODE_QOS) &&
478 		 eh.ether_type != htons(ETHERTYPE_PAE);
479 	if (addqos)
480 		hdrsize = sizeof(struct ieee80211_qosframe);
481 	else
482 		hdrsize = sizeof(struct ieee80211_frame);
483 	if (ic->ic_flags & IEEE80211_F_DATAPAD)
484 		hdrsize = roundup(hdrsize, sizeof(u_int32_t));
485 	m = ieee80211_mbuf_adjust(ic, hdrsize, key, m);
486 	if (m == NULL) {
487 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
488 		goto bad;
489 	}
490 
491 	/* NB: this could be optimized because of ieee80211_mbuf_adjust */
492 	m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
493 	llc = mtod(m, struct llc *);
494 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
495 	llc->llc_control = LLC_UI;
496 	llc->llc_snap.org_code[0] = 0;
497 	llc->llc_snap.org_code[1] = 0;
498 	llc->llc_snap.org_code[2] = 0;
499 	llc->llc_snap.ether_type = eh.ether_type;
500 	datalen = m->m_pkthdr.len;		/* NB: w/o 802.11 header */
501 
502 	M_PREPEND(m, hdrsize, M_DONTWAIT);
503 	if (m == NULL) {
504 		ic->ic_stats.is_tx_nobuf++;
505 		goto bad;
506 	}
507 	wh = mtod(m, struct ieee80211_frame *);
508 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
509 	*(u_int16_t *)wh->i_dur = 0;
510 	switch (ic->ic_opmode) {
511 	case IEEE80211_M_STA:
512 		wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
513 		IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
514 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
515 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
516 		break;
517 	case IEEE80211_M_IBSS:
518 	case IEEE80211_M_AHDEMO:
519 		wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
520 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
521 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
522 		/*
523 		 * NB: always use the bssid from ic_bss as the
524 		 *     neighbor's may be stale after an ibss merge
525 		 */
526 		IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_bss->ni_bssid);
527 		break;
528 	case IEEE80211_M_HOSTAP:
529 		wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
530 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
531 		IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
532 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
533 		break;
534 	case IEEE80211_M_MONITOR:
535 		goto bad;
536 	}
537 	if (addqos) {
538 		struct ieee80211_qosframe *qwh =
539 			(struct ieee80211_qosframe *) wh;
540 		int ac, tid;
541 
542 		ac = M_WME_GETAC(m);
543 		/* map from access class/queue to 11e header priorty value */
544 		tid = WME_AC_TO_TID(ac);
545 		qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
546 		if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy)
547 			qwh->i_qos[0] |= 1 << IEEE80211_QOS_ACKPOLICY_S;
548 		qwh->i_qos[1] = 0;
549 		qwh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS;
550 
551 		*(u_int16_t *)wh->i_seq =
552 		    htole16(ni->ni_txseqs[tid] << IEEE80211_SEQ_SEQ_SHIFT);
553 		ni->ni_txseqs[tid]++;
554 	} else {
555 		*(u_int16_t *)wh->i_seq =
556 		    htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
557 		ni->ni_txseqs[0]++;
558 	}
559 	if (key != NULL) {
560 		/*
561 		 * IEEE 802.1X: send EAPOL frames always in the clear.
562 		 * WPA/WPA2: encrypt EAPOL keys when pairwise keys are set.
563 		 */
564 		if (eh.ether_type != htons(ETHERTYPE_PAE) ||
565 		    ((ic->ic_flags & IEEE80211_F_WPA) &&
566 		     (ic->ic_opmode == IEEE80211_M_STA ?
567 		      !KEY_UNDEFINED(*key) : !KEY_UNDEFINED(ni->ni_ucastkey)))) {
568 			wh->i_fc[1] |= IEEE80211_FC1_WEP;
569 			/* XXX do fragmentation */
570 			if (!ieee80211_crypto_enmic(ic, key, m)) {
571 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
572 				    "[%s] enmic failed, discard frame\n",
573 				    ether_sprintf(eh.ether_dhost));
574 				ic->ic_stats.is_crypto_enmicfail++;
575 				goto bad;
576 			}
577 		}
578 	}
579 
580 	IEEE80211_NODE_STAT(ni, tx_data);
581 	IEEE80211_NODE_STAT_ADD(ni, tx_bytes, datalen);
582 
583 	return m;
584 bad:
585 	if (m != NULL)
586 		m_freem(m);
587 	return NULL;
588 }
589 
590 /*
591  * Add a supported rates element id to a frame.
592  */
593 static u_int8_t *
594 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
595 {
596 	int nrates;
597 
598 	*frm++ = IEEE80211_ELEMID_RATES;
599 	nrates = rs->rs_nrates;
600 	if (nrates > IEEE80211_RATE_SIZE)
601 		nrates = IEEE80211_RATE_SIZE;
602 	*frm++ = nrates;
603 	memcpy(frm, rs->rs_rates, nrates);
604 	return frm + nrates;
605 }
606 
607 /*
608  * Add an extended supported rates element id to a frame.
609  */
610 static u_int8_t *
611 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
612 {
613 	/*
614 	 * Add an extended supported rates element if operating in 11g mode.
615 	 */
616 	if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
617 		int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
618 		*frm++ = IEEE80211_ELEMID_XRATES;
619 		*frm++ = nrates;
620 		memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
621 		frm += nrates;
622 	}
623 	return frm;
624 }
625 
626 /*
627  * Add an ssid elemet to a frame.
628  */
629 static u_int8_t *
630 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
631 {
632 	*frm++ = IEEE80211_ELEMID_SSID;
633 	*frm++ = len;
634 	memcpy(frm, ssid, len);
635 	return frm + len;
636 }
637 
638 /*
639  * Add an erp element to a frame.
640  */
641 static u_int8_t *
642 ieee80211_add_erp(u_int8_t *frm, struct ieee80211com *ic)
643 {
644 	u_int8_t erp;
645 
646 	*frm++ = IEEE80211_ELEMID_ERP;
647 	*frm++ = 1;
648 	erp = 0;
649 	if (ic->ic_nonerpsta != 0)
650 		erp |= IEEE80211_ERP_NON_ERP_PRESENT;
651 	if (ic->ic_flags & IEEE80211_F_USEPROT)
652 		erp |= IEEE80211_ERP_USE_PROTECTION;
653 	if (ic->ic_flags & IEEE80211_F_USEBARKER)
654 		erp |= IEEE80211_ERP_LONG_PREAMBLE;
655 	*frm++ = erp;
656 	return frm;
657 }
658 
659 static u_int8_t *
660 ieee80211_setup_wpa_ie(struct ieee80211com *ic, u_int8_t *ie)
661 {
662 #define	WPA_OUI_BYTES		0x00, 0x50, 0xf2
663 #define	ADDSHORT(frm, v) do {			\
664 	frm[0] = (v) & 0xff;			\
665 	frm[1] = (v) >> 8;			\
666 	frm += 2;				\
667 } while (0)
668 #define	ADDSELECTOR(frm, sel) do {		\
669 	memcpy(frm, sel, 4);			\
670 	frm += 4;				\
671 } while (0)
672 	static const u_int8_t oui[4] = { WPA_OUI_BYTES, WPA_OUI_TYPE };
673 	static const u_int8_t cipher_suite[][4] = {
674 		{ WPA_OUI_BYTES, WPA_CSE_WEP40 },	/* NB: 40-bit */
675 		{ WPA_OUI_BYTES, WPA_CSE_TKIP },
676 		{ 0x00, 0x00, 0x00, 0x00 },		/* XXX WRAP */
677 		{ WPA_OUI_BYTES, WPA_CSE_CCMP },
678 		{ 0x00, 0x00, 0x00, 0x00 },		/* XXX CKIP */
679 		{ WPA_OUI_BYTES, WPA_CSE_NULL },
680 	};
681 	static const u_int8_t wep104_suite[4] =
682 		{ WPA_OUI_BYTES, WPA_CSE_WEP104 };
683 	static const u_int8_t key_mgt_unspec[4] =
684 		{ WPA_OUI_BYTES, WPA_ASE_8021X_UNSPEC };
685 	static const u_int8_t key_mgt_psk[4] =
686 		{ WPA_OUI_BYTES, WPA_ASE_8021X_PSK };
687 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
688 	u_int8_t *frm = ie;
689 	u_int8_t *selcnt;
690 
691 	*frm++ = IEEE80211_ELEMID_VENDOR;
692 	*frm++ = 0;				/* length filled in below */
693 	memcpy(frm, oui, sizeof(oui));		/* WPA OUI */
694 	frm += sizeof(oui);
695 	ADDSHORT(frm, WPA_VERSION);
696 
697 	/* XXX filter out CKIP */
698 
699 	/* multicast cipher */
700 	if (rsn->rsn_mcastcipher == IEEE80211_CIPHER_WEP &&
701 	    rsn->rsn_mcastkeylen >= 13)
702 		ADDSELECTOR(frm, wep104_suite);
703 	else
704 		ADDSELECTOR(frm, cipher_suite[rsn->rsn_mcastcipher]);
705 
706 	/* unicast cipher list */
707 	selcnt = frm;
708 	ADDSHORT(frm, 0);			/* selector count */
709 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_AES_CCM)) {
710 		selcnt[0]++;
711 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_AES_CCM]);
712 	}
713 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_TKIP)) {
714 		selcnt[0]++;
715 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_TKIP]);
716 	}
717 
718 	/* authenticator selector list */
719 	selcnt = frm;
720 	ADDSHORT(frm, 0);			/* selector count */
721 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_UNSPEC) {
722 		selcnt[0]++;
723 		ADDSELECTOR(frm, key_mgt_unspec);
724 	}
725 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_PSK) {
726 		selcnt[0]++;
727 		ADDSELECTOR(frm, key_mgt_psk);
728 	}
729 
730 	/* optional capabilities */
731 	if (rsn->rsn_caps != 0)
732 		ADDSHORT(frm, rsn->rsn_caps);
733 
734 	/* calculate element length */
735 	ie[1] = frm - ie - 2;
736 	KASSERT(ie[1]+2 <= sizeof(struct ieee80211_ie_wpa),
737 		("WPA IE too big, %u > %zu",
738 		ie[1]+2, sizeof(struct ieee80211_ie_wpa)));
739 	return frm;
740 #undef ADDSHORT
741 #undef ADDSELECTOR
742 #undef WPA_OUI_BYTES
743 }
744 
745 static u_int8_t *
746 ieee80211_setup_rsn_ie(struct ieee80211com *ic, u_int8_t *ie)
747 {
748 #define	RSN_OUI_BYTES		0x00, 0x0f, 0xac
749 #define	ADDSHORT(frm, v) do {			\
750 	frm[0] = (v) & 0xff;			\
751 	frm[1] = (v) >> 8;			\
752 	frm += 2;				\
753 } while (0)
754 #define	ADDSELECTOR(frm, sel) do {		\
755 	memcpy(frm, sel, 4);			\
756 	frm += 4;				\
757 } while (0)
758 	static const u_int8_t cipher_suite[][4] = {
759 		{ RSN_OUI_BYTES, RSN_CSE_WEP40 },	/* NB: 40-bit */
760 		{ RSN_OUI_BYTES, RSN_CSE_TKIP },
761 		{ RSN_OUI_BYTES, RSN_CSE_WRAP },
762 		{ RSN_OUI_BYTES, RSN_CSE_CCMP },
763 		{ 0x00, 0x00, 0x00, 0x00 },		/* XXX CKIP */
764 		{ RSN_OUI_BYTES, RSN_CSE_NULL },
765 	};
766 	static const u_int8_t wep104_suite[4] =
767 		{ RSN_OUI_BYTES, RSN_CSE_WEP104 };
768 	static const u_int8_t key_mgt_unspec[4] =
769 		{ RSN_OUI_BYTES, RSN_ASE_8021X_UNSPEC };
770 	static const u_int8_t key_mgt_psk[4] =
771 		{ RSN_OUI_BYTES, RSN_ASE_8021X_PSK };
772 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
773 	u_int8_t *frm = ie;
774 	u_int8_t *selcnt;
775 
776 	*frm++ = IEEE80211_ELEMID_RSN;
777 	*frm++ = 0;				/* length filled in below */
778 	ADDSHORT(frm, RSN_VERSION);
779 
780 	/* XXX filter out CKIP */
781 
782 	/* multicast cipher */
783 	if (rsn->rsn_mcastcipher == IEEE80211_CIPHER_WEP &&
784 	    rsn->rsn_mcastkeylen >= 13)
785 		ADDSELECTOR(frm, wep104_suite);
786 	else
787 		ADDSELECTOR(frm, cipher_suite[rsn->rsn_mcastcipher]);
788 
789 	/* unicast cipher list */
790 	selcnt = frm;
791 	ADDSHORT(frm, 0);			/* selector count */
792 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_AES_CCM)) {
793 		selcnt[0]++;
794 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_AES_CCM]);
795 	}
796 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_TKIP)) {
797 		selcnt[0]++;
798 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_TKIP]);
799 	}
800 
801 	/* authenticator selector list */
802 	selcnt = frm;
803 	ADDSHORT(frm, 0);			/* selector count */
804 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_UNSPEC) {
805 		selcnt[0]++;
806 		ADDSELECTOR(frm, key_mgt_unspec);
807 	}
808 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_PSK) {
809 		selcnt[0]++;
810 		ADDSELECTOR(frm, key_mgt_psk);
811 	}
812 
813 	/* optional capabilities */
814 	if (rsn->rsn_caps != 0)
815 		ADDSHORT(frm, rsn->rsn_caps);
816 	/* XXX PMKID */
817 
818 	/* calculate element length */
819 	ie[1] = frm - ie - 2;
820 	KASSERT(ie[1]+2 <= sizeof(struct ieee80211_ie_wpa),
821 		("RSN IE too big, %u > %zu",
822 		ie[1]+2, sizeof(struct ieee80211_ie_wpa)));
823 	return frm;
824 #undef ADDSELECTOR
825 #undef ADDSHORT
826 #undef RSN_OUI_BYTES
827 }
828 
829 /*
830  * Add a WPA/RSN element to a frame.
831  */
832 static u_int8_t *
833 ieee80211_add_wpa(u_int8_t *frm, struct ieee80211com *ic)
834 {
835 
836 	KASSERT(ic->ic_flags & IEEE80211_F_WPA, ("no WPA/RSN!"));
837 	if (ic->ic_flags & IEEE80211_F_WPA2)
838 		frm = ieee80211_setup_rsn_ie(ic, frm);
839 	if (ic->ic_flags & IEEE80211_F_WPA1)
840 		frm = ieee80211_setup_wpa_ie(ic, frm);
841 	return frm;
842 }
843 
844 #define	WME_OUI_BYTES		0x00, 0x50, 0xf2
845 /*
846  * Add a WME information element to a frame.
847  */
848 static u_int8_t *
849 ieee80211_add_wme_info(u_int8_t *frm, struct ieee80211_wme_state *wme)
850 {
851 	static const struct ieee80211_wme_info info = {
852 		.wme_id		= IEEE80211_ELEMID_VENDOR,
853 		.wme_len	= sizeof(struct ieee80211_wme_info) - 2,
854 		.wme_oui	= { WME_OUI_BYTES },
855 		.wme_type	= WME_OUI_TYPE,
856 		.wme_subtype	= WME_INFO_OUI_SUBTYPE,
857 		.wme_version	= WME_VERSION,
858 		.wme_info	= 0,
859 	};
860 	memcpy(frm, &info, sizeof(info));
861 	return frm + sizeof(info);
862 }
863 
864 /*
865  * Add a WME parameters element to a frame.
866  */
867 static u_int8_t *
868 ieee80211_add_wme_param(u_int8_t *frm, struct ieee80211_wme_state *wme)
869 {
870 #define	SM(_v, _f)	(((_v) << _f##_S) & _f)
871 #define	ADDSHORT(frm, v) do {			\
872 	frm[0] = (v) & 0xff;			\
873 	frm[1] = (v) >> 8;			\
874 	frm += 2;				\
875 } while (0)
876 	/* NB: this works 'cuz a param has an info at the front */
877 	static const struct ieee80211_wme_info param = {
878 		.wme_id		= IEEE80211_ELEMID_VENDOR,
879 		.wme_len	= sizeof(struct ieee80211_wme_param) - 2,
880 		.wme_oui	= { WME_OUI_BYTES },
881 		.wme_type	= WME_OUI_TYPE,
882 		.wme_subtype	= WME_PARAM_OUI_SUBTYPE,
883 		.wme_version	= WME_VERSION,
884 	};
885 	int i;
886 
887 	memcpy(frm, &param, sizeof(param));
888 	frm += __offsetof(struct ieee80211_wme_info, wme_info);
889 	*frm++ = wme->wme_bssChanParams.cap_info;	/* AC info */
890 	*frm++ = 0;					/* reserved field */
891 	for (i = 0; i < WME_NUM_AC; i++) {
892 		const struct wmeParams *ac =
893 		       &wme->wme_bssChanParams.cap_wmeParams[i];
894 		*frm++ = SM(i, WME_PARAM_ACI)
895 		       | SM(ac->wmep_acm, WME_PARAM_ACM)
896 		       | SM(ac->wmep_aifsn, WME_PARAM_AIFSN)
897 		       ;
898 		*frm++ = SM(ac->wmep_logcwmax, WME_PARAM_LOGCWMAX)
899 		       | SM(ac->wmep_logcwmin, WME_PARAM_LOGCWMIN)
900 		       ;
901 		ADDSHORT(frm, ac->wmep_txopLimit);
902 	}
903 	return frm;
904 #undef SM
905 #undef ADDSHORT
906 }
907 #undef WME_OUI_BYTES
908 
909 /*
910  * Send a management frame.  The node is for the destination (or ic_bss
911  * when in station mode).  Nodes other than ic_bss have their reference
912  * count bumped to reflect our use for an indeterminant time.
913  */
914 int
915 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
916 	int type, int arg)
917 {
918 #define	senderr(_x, _v)	do { ic->ic_stats._v++; ret = _x; goto bad; } while (0)
919 	struct mbuf *m;
920 	u_int8_t *frm;
921 	enum ieee80211_phymode mode;
922 	u_int16_t capinfo;
923 	int has_challenge, is_shared_key, ret, timer, status;
924 
925 	KASSERT(ni != NULL, ("null node"));
926 
927 	/*
928 	 * Hold a reference on the node so it doesn't go away until after
929 	 * the xmit is complete all the way in the driver.  On error we
930 	 * will remove our reference.
931 	 */
932 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
933 		"ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n",
934 		__func__, __LINE__,
935 		ni, ether_sprintf(ni->ni_macaddr),
936 		ieee80211_node_refcnt(ni)+1);
937 	ieee80211_ref_node(ni);
938 
939 	timer = 0;
940 	switch (type) {
941 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
942 		/*
943 		 * prreq frame format
944 		 *	[tlv] ssid
945 		 *	[tlv] supported rates
946 		 *	[tlv] extended supported rates
947 		 *	[tlv] WME (optional)
948 		 *	[tlv] user-specified ie's
949 		 */
950 		m = ieee80211_getmgtframe(&frm,
951 			 2 + IEEE80211_NWID_LEN
952 		       + 2 + IEEE80211_RATE_SIZE
953 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
954 		       + sizeof(struct ieee80211_wme_param)
955 		       + (ic->ic_opt_ie != NULL ? ic->ic_opt_ie_len : 0)
956 		);
957 		if (m == NULL)
958 			senderr(ENOMEM, is_tx_nobuf);
959 
960 		frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
961 		mode = ieee80211_chan2mode(ic, ni->ni_chan);
962 		frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]);
963 		frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]);
964 		if (ic->ic_flags & IEEE80211_F_WME)
965 			frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
966 		if (ic->ic_opt_ie != NULL) {
967 			memcpy(frm, ic->ic_opt_ie, ic->ic_opt_ie_len);
968 			frm += ic->ic_opt_ie_len;
969 		}
970 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
971 
972 		IEEE80211_NODE_STAT(ni, tx_probereq);
973 		if (ic->ic_opmode == IEEE80211_M_STA)
974 			timer = IEEE80211_TRANS_WAIT;
975 		break;
976 
977 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
978 		/*
979 		 * probe response frame format
980 		 *	[8] time stamp
981 		 *	[2] beacon interval
982 		 *	[2] cabability information
983 		 *	[tlv] ssid
984 		 *	[tlv] supported rates
985 		 *	[tlv] parameter set (FH/DS)
986 		 *	[tlv] parameter set (IBSS)
987 		 *	[tlv] extended rate phy (ERP)
988 		 *	[tlv] extended supported rates
989 		 *	[tlv] WPA
990 		 */
991 		m = ieee80211_getmgtframe(&frm,
992 			 8
993 		       + sizeof(u_int16_t)
994 		       + sizeof(u_int16_t)
995 		       + 2 + IEEE80211_NWID_LEN
996 		       + 2 + IEEE80211_RATE_SIZE
997 		       + 7	/* max(7,3) */
998 		       + 6
999 		       + 3
1000 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1001 		       /* XXX !WPA1+WPA2 fits w/o a cluster */
1002 		       + (ic->ic_flags & IEEE80211_F_WPA ?
1003 				2*sizeof(struct ieee80211_ie_wpa) : 0)
1004 		);
1005 		if (m == NULL)
1006 			senderr(ENOMEM, is_tx_nobuf);
1007 
1008 		memset(frm, 0, 8);	/* timestamp should be filled later */
1009 		frm += 8;
1010 		*(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval);
1011 		frm += 2;
1012 		if (ic->ic_opmode == IEEE80211_M_IBSS)
1013 			capinfo = IEEE80211_CAPINFO_IBSS;
1014 		else
1015 			capinfo = IEEE80211_CAPINFO_ESS;
1016 		if (ic->ic_flags & IEEE80211_F_PRIVACY)
1017 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
1018 		if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1019 		    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1020 			capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1021 		if (ic->ic_flags & IEEE80211_F_SHSLOT)
1022 			capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1023 		*(u_int16_t *)frm = htole16(capinfo);
1024 		frm += 2;
1025 
1026 		frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
1027 				ic->ic_bss->ni_esslen);
1028 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
1029 
1030 		if (ic->ic_phytype == IEEE80211_T_FH) {
1031                         *frm++ = IEEE80211_ELEMID_FHPARMS;
1032                         *frm++ = 5;
1033                         *frm++ = ni->ni_fhdwell & 0x00ff;
1034                         *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff;
1035                         *frm++ = IEEE80211_FH_CHANSET(
1036 			    ieee80211_chan2ieee(ic, ni->ni_chan));
1037                         *frm++ = IEEE80211_FH_CHANPAT(
1038 			    ieee80211_chan2ieee(ic, ni->ni_chan));
1039                         *frm++ = ni->ni_fhindex;
1040 		} else {
1041 			*frm++ = IEEE80211_ELEMID_DSPARMS;
1042 			*frm++ = 1;
1043 			*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
1044 		}
1045 
1046 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
1047 			*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1048 			*frm++ = 2;
1049 			*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1050 		}
1051 		if (ic->ic_flags & IEEE80211_F_WPA)
1052 			frm = ieee80211_add_wpa(frm, ic);
1053 		if (ic->ic_curmode == IEEE80211_MODE_11G)
1054 			frm = ieee80211_add_erp(frm, ic);
1055 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
1056 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1057 		break;
1058 
1059 	case IEEE80211_FC0_SUBTYPE_AUTH:
1060 		status = arg >> 16;
1061 		arg &= 0xffff;
1062 		has_challenge = ((arg == IEEE80211_AUTH_SHARED_CHALLENGE ||
1063 		    arg == IEEE80211_AUTH_SHARED_RESPONSE) &&
1064 		    ni->ni_challenge != NULL);
1065 
1066 		/*
1067 		 * Deduce whether we're doing open authentication or
1068 		 * shared key authentication.  We do the latter if
1069 		 * we're in the middle of a shared key authentication
1070 		 * handshake or if we're initiating an authentication
1071 		 * request and configured to use shared key.
1072 		 */
1073 		is_shared_key = has_challenge ||
1074 		     arg >= IEEE80211_AUTH_SHARED_RESPONSE ||
1075 		     (arg == IEEE80211_AUTH_SHARED_REQUEST &&
1076 		      ic->ic_bss->ni_authmode == IEEE80211_AUTH_SHARED);
1077 
1078 		m = ieee80211_getmgtframe(&frm,
1079 			  3 * sizeof(u_int16_t)
1080 			+ (has_challenge && status == IEEE80211_STATUS_SUCCESS ?
1081 				sizeof(u_int16_t)+IEEE80211_CHALLENGE_LEN : 0)
1082 		);
1083 		if (m == NULL)
1084 			senderr(ENOMEM, is_tx_nobuf);
1085 
1086 		((u_int16_t *)frm)[0] =
1087 		    (is_shared_key) ? htole16(IEEE80211_AUTH_ALG_SHARED)
1088 		                    : htole16(IEEE80211_AUTH_ALG_OPEN);
1089 		((u_int16_t *)frm)[1] = htole16(arg);	/* sequence number */
1090 		((u_int16_t *)frm)[2] = htole16(status);/* status */
1091 
1092 		if (has_challenge && status == IEEE80211_STATUS_SUCCESS) {
1093 			((u_int16_t *)frm)[3] =
1094 			    htole16((IEEE80211_CHALLENGE_LEN << 8) |
1095 			    IEEE80211_ELEMID_CHALLENGE);
1096 			memcpy(&((u_int16_t *)frm)[4], ni->ni_challenge,
1097 			    IEEE80211_CHALLENGE_LEN);
1098 			m->m_pkthdr.len = m->m_len =
1099 				4 * sizeof(u_int16_t) + IEEE80211_CHALLENGE_LEN;
1100 			if (arg == IEEE80211_AUTH_SHARED_RESPONSE) {
1101 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
1102 				    "[%s] request encrypt frame (%s)\n",
1103 				    ether_sprintf(ni->ni_macaddr), __func__);
1104 				m->m_flags |= M_LINK0; /* WEP-encrypt, please */
1105 			}
1106 		} else
1107 			m->m_pkthdr.len = m->m_len = 3 * sizeof(u_int16_t);
1108 
1109 		/* XXX not right for shared key */
1110 		if (status == IEEE80211_STATUS_SUCCESS)
1111 			IEEE80211_NODE_STAT(ni, tx_auth);
1112 		else
1113 			IEEE80211_NODE_STAT(ni, tx_auth_fail);
1114 
1115 		/*
1116 		 * When 802.1x is not in use mark the port
1117 		 * authorized at this point so traffic can flow.
1118 		 */
1119 		if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1120 		    status == IEEE80211_STATUS_SUCCESS &&
1121 		    ni->ni_authmode != IEEE80211_AUTH_8021X)
1122 			ieee80211_node_authorize(ic, ni);
1123 		if (ic->ic_opmode == IEEE80211_M_STA)
1124 			timer = IEEE80211_TRANS_WAIT;
1125 		break;
1126 
1127 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1128 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
1129 			"[%s] send station deauthenticate (reason %d)\n",
1130 			ether_sprintf(ni->ni_macaddr), arg);
1131 		m = ieee80211_getmgtframe(&frm, sizeof(u_int16_t));
1132 		if (m == NULL)
1133 			senderr(ENOMEM, is_tx_nobuf);
1134 		*(u_int16_t *)frm = htole16(arg);	/* reason */
1135 		m->m_pkthdr.len = m->m_len = sizeof(u_int16_t);
1136 
1137 		IEEE80211_NODE_STAT(ni, tx_deauth);
1138 		IEEE80211_NODE_STAT_SET(ni, tx_deauth_code, arg);
1139 
1140 		ieee80211_node_unauthorize(ic, ni);	/* port closed */
1141 		break;
1142 
1143 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1144 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1145 		/*
1146 		 * asreq frame format
1147 		 *	[2] capability information
1148 		 *	[2] listen interval
1149 		 *	[6*] current AP address (reassoc only)
1150 		 *	[tlv] ssid
1151 		 *	[tlv] supported rates
1152 		 *	[tlv] extended supported rates
1153 		 *	[tlv] WME
1154 		 *	[tlv] user-specified ie's
1155 		 */
1156 		m = ieee80211_getmgtframe(&frm,
1157 			 sizeof(u_int16_t)
1158 		       + sizeof(u_int16_t)
1159 		       + IEEE80211_ADDR_LEN
1160 		       + 2 + IEEE80211_NWID_LEN
1161 		       + 2 + IEEE80211_RATE_SIZE
1162 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1163 		       + sizeof(struct ieee80211_wme_info)
1164 		       + (ic->ic_opt_ie != NULL ? ic->ic_opt_ie_len : 0)
1165 		);
1166 		if (m == NULL)
1167 			senderr(ENOMEM, is_tx_nobuf);
1168 
1169 		capinfo = 0;
1170 		if (ic->ic_opmode == IEEE80211_M_IBSS)
1171 			capinfo |= IEEE80211_CAPINFO_IBSS;
1172 		else		/* IEEE80211_M_STA */
1173 			capinfo |= IEEE80211_CAPINFO_ESS;
1174 		if (ic->ic_flags & IEEE80211_F_PRIVACY)
1175 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
1176 		/*
1177 		 * NB: Some 11a AP's reject the request when
1178 		 *     short premable is set.
1179 		 */
1180 		if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1181 		    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1182 			capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1183 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) &&
1184 		    (ic->ic_caps & IEEE80211_C_SHSLOT))
1185 			capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1186 		*(u_int16_t *)frm = htole16(capinfo);
1187 		frm += 2;
1188 
1189 		*(u_int16_t *)frm = htole16(ic->ic_lintval);
1190 		frm += 2;
1191 
1192 		if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1193 			IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
1194 			frm += IEEE80211_ADDR_LEN;
1195 		}
1196 
1197 		frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
1198 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
1199 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
1200 		if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
1201 			frm = ieee80211_add_wme_info(frm, &ic->ic_wme);
1202 		if (ic->ic_opt_ie != NULL) {
1203 			memcpy(frm, ic->ic_opt_ie, ic->ic_opt_ie_len);
1204 			frm += ic->ic_opt_ie_len;
1205 		}
1206 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1207 
1208 		timer = IEEE80211_TRANS_WAIT;
1209 		break;
1210 
1211 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1212 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1213 		/*
1214 		 * asreq frame format
1215 		 *	[2] capability information
1216 		 *	[2] status
1217 		 *	[2] association ID
1218 		 *	[tlv] supported rates
1219 		 *	[tlv] extended supported rates
1220 		 *	[tlv] WME (if enabled and STA enabled)
1221 		 */
1222 		m = ieee80211_getmgtframe(&frm,
1223 			 sizeof(u_int16_t)
1224 		       + sizeof(u_int16_t)
1225 		       + sizeof(u_int16_t)
1226 		       + 2 + IEEE80211_RATE_SIZE
1227 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1228 		       + sizeof(struct ieee80211_wme_param)
1229 		);
1230 		if (m == NULL)
1231 			senderr(ENOMEM, is_tx_nobuf);
1232 
1233 		capinfo = IEEE80211_CAPINFO_ESS;
1234 		if (ic->ic_flags & IEEE80211_F_PRIVACY)
1235 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
1236 		if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1237 		    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1238 			capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1239 		if (ic->ic_flags & IEEE80211_F_SHSLOT)
1240 			capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1241 		*(u_int16_t *)frm = htole16(capinfo);
1242 		frm += 2;
1243 
1244 		*(u_int16_t *)frm = htole16(arg);	/* status */
1245 		frm += 2;
1246 
1247 		if (arg == IEEE80211_STATUS_SUCCESS) {
1248 			*(u_int16_t *)frm = htole16(ni->ni_associd);
1249 			IEEE80211_NODE_STAT(ni, tx_assoc);
1250 		} else
1251 			IEEE80211_NODE_STAT(ni, tx_assoc_fail);
1252 		frm += 2;
1253 
1254 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
1255 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
1256 		if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
1257 			frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
1258 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1259 		break;
1260 
1261 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1262 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1263 			"[%s] send station disassociate (reason %d)\n",
1264 			ether_sprintf(ni->ni_macaddr), arg);
1265 		m = ieee80211_getmgtframe(&frm, sizeof(u_int16_t));
1266 		if (m == NULL)
1267 			senderr(ENOMEM, is_tx_nobuf);
1268 		*(u_int16_t *)frm = htole16(arg);	/* reason */
1269 		m->m_pkthdr.len = m->m_len = sizeof(u_int16_t);
1270 
1271 		IEEE80211_NODE_STAT(ni, tx_disassoc);
1272 		IEEE80211_NODE_STAT_SET(ni, tx_disassoc_code, arg);
1273 		break;
1274 
1275 	default:
1276 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1277 			"[%s] invalid mgmt frame type %u\n",
1278 			ether_sprintf(ni->ni_macaddr), type);
1279 		senderr(EINVAL, is_tx_unknownmgt);
1280 		/* NOTREACHED */
1281 	}
1282 
1283 	ret = ieee80211_mgmt_output(ic, ni, m, type);
1284 	if (ret == 0) {
1285 		if (timer)
1286 			ic->ic_mgt_timer = timer;
1287 	} else {
1288 bad:
1289 		ieee80211_free_node(ni);
1290 	}
1291 	return ret;
1292 #undef senderr
1293 }
1294 
1295 /*
1296  * Allocate a beacon frame and fillin the appropriate bits.
1297  */
1298 struct mbuf *
1299 ieee80211_beacon_alloc(struct ieee80211com *ic, struct ieee80211_node *ni,
1300 	struct ieee80211_beacon_offsets *bo)
1301 {
1302 	struct ifnet *ifp = ic->ic_ifp;
1303 	struct ieee80211_frame *wh;
1304 	struct mbuf *m;
1305 	int pktlen;
1306 	u_int8_t *frm, *efrm;
1307 	u_int16_t capinfo;
1308 	struct ieee80211_rateset *rs;
1309 
1310 	/*
1311 	 * beacon frame format
1312 	 *	[8] time stamp
1313 	 *	[2] beacon interval
1314 	 *	[2] cabability information
1315 	 *	[tlv] ssid
1316 	 *	[tlv] supported rates
1317 	 *	[3] parameter set (DS)
1318 	 *	[tlv] parameter set (IBSS/TIM)
1319 	 *	[tlv] extended rate phy (ERP)
1320 	 *	[tlv] extended supported rates
1321 	 *	[tlv] WME parameters
1322 	 *	[tlv] WPA/RSN parameters
1323 	 * XXX Vendor-specific OIDs (e.g. Atheros)
1324 	 * NB: we allocate the max space required for the TIM bitmap.
1325 	 */
1326 	rs = &ni->ni_rates;
1327 	pktlen =   8					/* time stamp */
1328 		 + sizeof(u_int16_t)			/* beacon interval */
1329 		 + sizeof(u_int16_t)			/* capabilities */
1330 		 + 2 + ni->ni_esslen			/* ssid */
1331 	         + 2 + IEEE80211_RATE_SIZE		/* supported rates */
1332 	         + 2 + 1				/* DS parameters */
1333 		 + 2 + 4 + ic->ic_tim_len		/* DTIM/IBSSPARMS */
1334 		 + 2 + 1				/* ERP */
1335 	         + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1336 		 + (ic->ic_caps & IEEE80211_C_WME ?	/* WME */
1337 			sizeof(struct ieee80211_wme_param) : 0)
1338 		 + (ic->ic_caps & IEEE80211_C_WPA ?	/* WPA 1+2 */
1339 			2*sizeof(struct ieee80211_ie_wpa) : 0)
1340 		 ;
1341 	m = ieee80211_getmgtframe(&frm, pktlen);
1342 	if (m == NULL) {
1343 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1344 			"%s: cannot get buf; size %u\n", __func__, pktlen);
1345 		ic->ic_stats.is_tx_nobuf++;
1346 		return NULL;
1347 	}
1348 
1349 	memset(frm, 0, 8);	/* XXX timestamp is set by hardware/driver */
1350 	frm += 8;
1351 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1352 	frm += 2;
1353 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1354 		capinfo = IEEE80211_CAPINFO_IBSS;
1355 	else
1356 		capinfo = IEEE80211_CAPINFO_ESS;
1357 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
1358 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1359 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1360 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1361 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1362 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1363 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1364 	bo->bo_caps = (u_int16_t *)frm;
1365 	*(u_int16_t *)frm = htole16(capinfo);
1366 	frm += 2;
1367 	*frm++ = IEEE80211_ELEMID_SSID;
1368 	if ((ic->ic_flags & IEEE80211_F_HIDESSID) == 0) {
1369 		*frm++ = ni->ni_esslen;
1370 		memcpy(frm, ni->ni_essid, ni->ni_esslen);
1371 		frm += ni->ni_esslen;
1372 	} else
1373 		*frm++ = 0;
1374 	frm = ieee80211_add_rates(frm, rs);
1375 	if (ic->ic_curmode != IEEE80211_MODE_FH) {
1376 		*frm++ = IEEE80211_ELEMID_DSPARMS;
1377 		*frm++ = 1;
1378 		*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
1379 	}
1380 	bo->bo_tim = frm;
1381 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1382 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1383 		*frm++ = 2;
1384 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1385 		bo->bo_tim_len = 0;
1386 	} else {
1387 		struct ieee80211_tim_ie *tie = (struct ieee80211_tim_ie *) frm;
1388 
1389 		tie->tim_ie = IEEE80211_ELEMID_TIM;
1390 		tie->tim_len = 4;	/* length */
1391 		tie->tim_count = 0;	/* DTIM count */
1392 		tie->tim_period = ic->ic_dtim_period;	/* DTIM period */
1393 		tie->tim_bitctl = 0;	/* bitmap control */
1394 		tie->tim_bitmap[0] = 0;	/* Partial Virtual Bitmap */
1395 		frm += sizeof(struct ieee80211_tim_ie);
1396 		bo->bo_tim_len = 1;
1397 	}
1398 	bo->bo_trailer = frm;
1399 	if (ic->ic_flags & IEEE80211_F_WME) {
1400 		bo->bo_wme = frm;
1401 		frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
1402 		ic->ic_flags &= ~IEEE80211_F_WMEUPDATE;
1403 	}
1404 	if (ic->ic_flags & IEEE80211_F_WPA)
1405 		frm = ieee80211_add_wpa(frm, ic);
1406 	if (ic->ic_curmode == IEEE80211_MODE_11G)
1407 		frm = ieee80211_add_erp(frm, ic);
1408 	efrm = ieee80211_add_xrates(frm, rs);
1409 	bo->bo_trailer_len = efrm - bo->bo_trailer;
1410 	m->m_pkthdr.len = m->m_len = efrm - mtod(m, u_int8_t *);
1411 
1412 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
1413 	KASSERT(m != NULL, ("no space for 802.11 header?"));
1414 	wh = mtod(m, struct ieee80211_frame *);
1415 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
1416 	    IEEE80211_FC0_SUBTYPE_BEACON;
1417 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1418 	*(u_int16_t *)wh->i_dur = 0;
1419 	IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
1420 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
1421 	IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
1422 	*(u_int16_t *)wh->i_seq = 0;
1423 
1424 	return m;
1425 }
1426 
1427 /*
1428  * Update the dynamic parts of a beacon frame based on the current state.
1429  */
1430 int
1431 ieee80211_beacon_update(struct ieee80211com *ic, struct ieee80211_node *ni,
1432 	struct ieee80211_beacon_offsets *bo, struct mbuf *m, int mcast)
1433 {
1434 	int len_changed = 0;
1435 	u_int16_t capinfo;
1436 
1437 	IEEE80211_BEACON_LOCK(ic);
1438 	/* XXX faster to recalculate entirely or just changes? */
1439 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1440 		capinfo = IEEE80211_CAPINFO_IBSS;
1441 	else
1442 		capinfo = IEEE80211_CAPINFO_ESS;
1443 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
1444 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1445 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1446 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1447 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1448 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1449 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1450 	*bo->bo_caps = htole16(capinfo);
1451 
1452 	if (ic->ic_flags & IEEE80211_F_WME) {
1453 		struct ieee80211_wme_state *wme = &ic->ic_wme;
1454 
1455 		/*
1456 		 * Check for agressive mode change.  When there is
1457 		 * significant high priority traffic in the BSS
1458 		 * throttle back BE traffic by using conservative
1459 		 * parameters.  Otherwise BE uses agressive params
1460 		 * to optimize performance of legacy/non-QoS traffic.
1461 		 */
1462 		if (wme->wme_flags & WME_F_AGGRMODE) {
1463 			if (wme->wme_hipri_traffic >
1464 			    wme->wme_hipri_switch_thresh) {
1465 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_WME,
1466 				    "%s: traffic %u, disable aggressive mode\n",
1467 				    __func__, wme->wme_hipri_traffic);
1468 				wme->wme_flags &= ~WME_F_AGGRMODE;
1469 				ieee80211_wme_updateparams_locked(ic);
1470 				wme->wme_hipri_traffic =
1471 					wme->wme_hipri_switch_hysteresis;
1472 			} else
1473 				wme->wme_hipri_traffic = 0;
1474 		} else {
1475 			if (wme->wme_hipri_traffic <=
1476 			    wme->wme_hipri_switch_thresh) {
1477 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_WME,
1478 				    "%s: traffic %u, enable aggressive mode\n",
1479 				    __func__, wme->wme_hipri_traffic);
1480 				wme->wme_flags |= WME_F_AGGRMODE;
1481 				ieee80211_wme_updateparams_locked(ic);
1482 				wme->wme_hipri_traffic = 0;
1483 			} else
1484 				wme->wme_hipri_traffic =
1485 					wme->wme_hipri_switch_hysteresis;
1486 		}
1487 		if (ic->ic_flags & IEEE80211_F_WMEUPDATE) {
1488 			(void) ieee80211_add_wme_param(bo->bo_wme, wme);
1489 			ic->ic_flags &= ~IEEE80211_F_WMEUPDATE;
1490 		}
1491 	}
1492 
1493 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {	/* NB: no IBSS support*/
1494 		struct ieee80211_tim_ie *tie =
1495 			(struct ieee80211_tim_ie *) bo->bo_tim;
1496 		if (ic->ic_flags & IEEE80211_F_TIMUPDATE) {
1497 			u_int timlen, timoff, i;
1498 			/*
1499 			 * ATIM/DTIM needs updating.  If it fits in the
1500 			 * current space allocated then just copy in the
1501 			 * new bits.  Otherwise we need to move any trailing
1502 			 * data to make room.  Note that we know there is
1503 			 * contiguous space because ieee80211_beacon_allocate
1504 			 * insures there is space in the mbuf to write a
1505 			 * maximal-size virtual bitmap (based on ic_max_aid).
1506 			 */
1507 			/*
1508 			 * Calculate the bitmap size and offset, copy any
1509 			 * trailer out of the way, and then copy in the
1510 			 * new bitmap and update the information element.
1511 			 * Note that the tim bitmap must contain at least
1512 			 * one byte and any offset must be even.
1513 			 */
1514 			if (ic->ic_ps_pending != 0) {
1515 				timoff = 128;		/* impossibly large */
1516 				for (i = 0; i < ic->ic_tim_len; i++)
1517 					if (ic->ic_tim_bitmap[i]) {
1518 						timoff = i &~ 1;
1519 						break;
1520 					}
1521 				KASSERT(timoff != 128, ("tim bitmap empty!"));
1522 				for (i = ic->ic_tim_len-1; i >= timoff; i--)
1523 					if (ic->ic_tim_bitmap[i])
1524 						break;
1525 				timlen = 1 + (i - timoff);
1526 			} else {
1527 				timoff = 0;
1528 				timlen = 1;
1529 			}
1530 			if (timlen != bo->bo_tim_len) {
1531 				/* copy up/down trailer */
1532 				ovbcopy(bo->bo_trailer, tie->tim_bitmap+timlen,
1533 					bo->bo_trailer_len);
1534 				bo->bo_trailer = tie->tim_bitmap+timlen;
1535 				bo->bo_wme = bo->bo_trailer;
1536 				bo->bo_tim_len = timlen;
1537 
1538 				/* update information element */
1539 				tie->tim_len = 3 + timlen;
1540 				tie->tim_bitctl = timoff;
1541 				len_changed = 1;
1542 			}
1543 			memcpy(tie->tim_bitmap, ic->ic_tim_bitmap + timoff,
1544 				bo->bo_tim_len);
1545 
1546 			ic->ic_flags &= ~IEEE80211_F_TIMUPDATE;
1547 
1548 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
1549 				"%s: TIM updated, pending %u, off %u, len %u\n",
1550 				__func__, ic->ic_ps_pending, timoff, timlen);
1551 		}
1552 		/* count down DTIM period */
1553 		if (tie->tim_count == 0)
1554 			tie->tim_count = tie->tim_period - 1;
1555 		else
1556 			tie->tim_count--;
1557 		/* update state for buffered multicast frames on DTIM */
1558 		if (mcast && (tie->tim_count == 1 || tie->tim_period == 1))
1559 			tie->tim_bitctl |= 1;
1560 		else
1561 			tie->tim_bitctl &= ~1;
1562 	}
1563 	IEEE80211_BEACON_UNLOCK(ic);
1564 
1565 	return len_changed;
1566 }
1567 
1568 /*
1569  * Save an outbound packet for a node in power-save sleep state.
1570  * The new packet is placed on the node's saved queue, and the TIM
1571  * is changed, if necessary.
1572  */
1573 void
1574 ieee80211_pwrsave(struct ieee80211com *ic, struct ieee80211_node *ni,
1575 		  struct mbuf *m)
1576 {
1577 	int qlen, age;
1578 
1579 	IEEE80211_NODE_SAVEQ_LOCK(ni);
1580 	if (_IF_QFULL(&ni->ni_savedq)) {
1581 		_IF_DROP(&ni->ni_savedq);
1582 		IEEE80211_NODE_SAVEQ_UNLOCK(ni);
1583 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1584 			"[%s] pwr save q overflow, drops %d (size %d)\n",
1585 			ether_sprintf(ni->ni_macaddr),
1586 			ni->ni_savedq.ifq_drops, IEEE80211_PS_MAX_QUEUE);
1587 #ifdef IEEE80211_DEBUG
1588 		if (ieee80211_msg_dumppkts(ic))
1589 			ieee80211_dump_pkt(mtod(m, caddr_t), m->m_len, -1, -1);
1590 #endif
1591 		m_freem(m);
1592 		return;
1593 	}
1594 	/*
1595 	 * Tag the frame with it's expiry time and insert
1596 	 * it in the queue.  The aging interval is 4 times
1597 	 * the listen interval specified by the station.
1598 	 * Frames that sit around too long are reclaimed
1599 	 * using this information.
1600 	 */
1601 	/* XXX handle overflow? */
1602 	age = ((ni->ni_intval * ic->ic_lintval) << 2) / 1024; /* TU -> secs */
1603 	_IEEE80211_NODE_SAVEQ_ENQUEUE(ni, m, qlen, age);
1604 	IEEE80211_NODE_SAVEQ_UNLOCK(ni);
1605 
1606 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
1607 		"[%s] save frame, %u now queued\n",
1608 		ether_sprintf(ni->ni_macaddr), qlen);
1609 
1610 	if (qlen == 1)
1611 		ic->ic_set_tim(ic, ni, 1);
1612 }
1613