xref: /freebsd/sys/net80211/ieee80211_output.c (revision f0a75d274af375d15b97b830966b99a02b7db911)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include "opt_inet.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/kernel.h>
42 #include <sys/endian.h>
43 
44 #include <sys/socket.h>
45 
46 #include <net/bpf.h>
47 #include <net/ethernet.h>
48 #include <net/if.h>
49 #include <net/if_llc.h>
50 #include <net/if_media.h>
51 #include <net/if_vlan_var.h>
52 
53 #include <net80211/ieee80211_var.h>
54 
55 #ifdef INET
56 #include <netinet/in.h>
57 #include <netinet/if_ether.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/ip.h>
60 #endif
61 
62 #ifdef IEEE80211_DEBUG
63 /*
64  * Decide if an outbound management frame should be
65  * printed when debugging is enabled.  This filters some
66  * of the less interesting frames that come frequently
67  * (e.g. beacons).
68  */
69 static __inline int
70 doprint(struct ieee80211com *ic, int subtype)
71 {
72 	switch (subtype) {
73 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
74 		return (ic->ic_opmode == IEEE80211_M_IBSS);
75 	}
76 	return 1;
77 }
78 #endif
79 
80 /*
81  * Set the direction field and address fields of an outgoing
82  * non-QoS frame.  Note this should be called early on in
83  * constructing a frame as it sets i_fc[1]; other bits can
84  * then be or'd in.
85  */
86 static void
87 ieee80211_send_setup(struct ieee80211com *ic,
88 	struct ieee80211_node *ni,
89 	struct ieee80211_frame *wh,
90 	int type,
91 	const u_int8_t sa[IEEE80211_ADDR_LEN],
92 	const u_int8_t da[IEEE80211_ADDR_LEN],
93 	const u_int8_t bssid[IEEE80211_ADDR_LEN])
94 {
95 #define	WH4(wh)	((struct ieee80211_frame_addr4 *)wh)
96 
97 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | type;
98 	if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
99 		switch (ic->ic_opmode) {
100 		case IEEE80211_M_STA:
101 			wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
102 			IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
103 			IEEE80211_ADDR_COPY(wh->i_addr2, sa);
104 			IEEE80211_ADDR_COPY(wh->i_addr3, da);
105 			break;
106 		case IEEE80211_M_IBSS:
107 		case IEEE80211_M_AHDEMO:
108 			wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
109 			IEEE80211_ADDR_COPY(wh->i_addr1, da);
110 			IEEE80211_ADDR_COPY(wh->i_addr2, sa);
111 			IEEE80211_ADDR_COPY(wh->i_addr3, bssid);
112 			break;
113 		case IEEE80211_M_HOSTAP:
114 			wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
115 			IEEE80211_ADDR_COPY(wh->i_addr1, da);
116 			IEEE80211_ADDR_COPY(wh->i_addr2, bssid);
117 			IEEE80211_ADDR_COPY(wh->i_addr3, sa);
118 			break;
119 		case IEEE80211_M_MONITOR:	/* NB: to quiet compiler */
120 			break;
121 		}
122 	} else {
123 		wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
124 		IEEE80211_ADDR_COPY(wh->i_addr1, da);
125 		IEEE80211_ADDR_COPY(wh->i_addr2, sa);
126 		IEEE80211_ADDR_COPY(wh->i_addr3, bssid);
127 	}
128 	*(u_int16_t *)&wh->i_dur[0] = 0;
129 	/* NB: use non-QoS tid */
130 	*(u_int16_t *)&wh->i_seq[0] =
131 	    htole16(ni->ni_txseqs[IEEE80211_NONQOS_TID] << IEEE80211_SEQ_SEQ_SHIFT);
132 	ni->ni_txseqs[IEEE80211_NONQOS_TID]++;
133 #undef WH4
134 }
135 
136 /*
137  * Send a management frame to the specified node.  The node pointer
138  * must have a reference as the pointer will be passed to the driver
139  * and potentially held for a long time.  If the frame is successfully
140  * dispatched to the driver, then it is responsible for freeing the
141  * reference (and potentially free'ing up any associated storage).
142  */
143 static int
144 ieee80211_mgmt_output(struct ieee80211com *ic, struct ieee80211_node *ni,
145     struct mbuf *m, int type, int timer)
146 {
147 	struct ifnet *ifp = ic->ic_ifp;
148 	struct ieee80211_frame *wh;
149 
150 	KASSERT(ni != NULL, ("null node"));
151 
152 	/*
153 	 * Yech, hack alert!  We want to pass the node down to the
154 	 * driver's start routine.  If we don't do so then the start
155 	 * routine must immediately look it up again and that can
156 	 * cause a lock order reversal if, for example, this frame
157 	 * is being sent because the station is being timedout and
158 	 * the frame being sent is a DEAUTH message.  We could stick
159 	 * this in an m_tag and tack that on to the mbuf.  However
160 	 * that's rather expensive to do for every frame so instead
161 	 * we stuff it in the rcvif field since outbound frames do
162 	 * not (presently) use this.
163 	 */
164 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
165 	if (m == NULL)
166 		return ENOMEM;
167 	KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
168 	m->m_pkthdr.rcvif = (void *)ni;
169 
170 	wh = mtod(m, struct ieee80211_frame *);
171 	ieee80211_send_setup(ic, ni, wh,
172 		IEEE80211_FC0_TYPE_MGT | type,
173 		ic->ic_myaddr, ni->ni_macaddr, ni->ni_bssid);
174 	if ((m->m_flags & M_LINK0) != 0 && ni->ni_challenge != NULL) {
175 		m->m_flags &= ~M_LINK0;
176 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
177 			"[%s] encrypting frame (%s)\n",
178 			ether_sprintf(wh->i_addr1), __func__);
179 		wh->i_fc[1] |= IEEE80211_FC1_WEP;
180 	}
181 #ifdef IEEE80211_DEBUG
182 	/* avoid printing too many frames */
183 	if ((ieee80211_msg_debug(ic) && doprint(ic, type)) ||
184 	    ieee80211_msg_dumppkts(ic)) {
185 		printf("[%s] send %s on channel %u\n",
186 		    ether_sprintf(wh->i_addr1),
187 		    ieee80211_mgt_subtype_name[
188 			(type & IEEE80211_FC0_SUBTYPE_MASK) >>
189 				IEEE80211_FC0_SUBTYPE_SHIFT],
190 		    ieee80211_chan2ieee(ic, ic->ic_curchan));
191 	}
192 #endif
193 	IEEE80211_NODE_STAT(ni, tx_mgmt);
194 	IF_ENQUEUE(&ic->ic_mgtq, m);
195 	if (timer) {
196 		/*
197 		 * Set the mgt frame timeout.
198 		 */
199 		ic->ic_mgt_timer = timer;
200 		ifp->if_timer = 1;
201 	}
202 	if_start(ifp);
203 	return 0;
204 }
205 
206 /*
207  * Raw packet transmit stub for legacy drivers.
208  * Send the packet through the mgt q so we bypass
209  * the normal encapsulation work.
210  */
211 int
212 ieee80211_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
213 	const struct ieee80211_bpf_params *params)
214 {
215 	struct ieee80211com *ic = ni->ni_ic;
216 	struct ifnet *ifp = ic->ic_ifp;
217 
218 	m->m_pkthdr.rcvif = (void *) ni;
219 	IF_ENQUEUE(&ic->ic_mgtq, m);
220 	if_start(ifp);
221 	ifp->if_opackets++;
222 
223 	return 0;
224 }
225 
226 /*
227  * 802.11 output routine. This is (currently) used only to
228  * connect bpf write calls to the 802.11 layer for injecting
229  * raw 802.11 frames.  Note we locate the ieee80211com from
230  * the ifnet using a spare field setup at attach time.  This
231  * will go away when the virtual ap support comes in.
232  */
233 int
234 ieee80211_output(struct ifnet *ifp, struct mbuf *m,
235 	struct sockaddr *dst, struct rtentry *rt0)
236 {
237 #define senderr(e) do { error = (e); goto bad;} while (0)
238 	struct ieee80211com *ic = ifp->if_spare2;	/* XXX */
239 	struct ieee80211_node *ni = NULL;
240 	struct ieee80211_frame *wh;
241 	int error;
242 
243 	/*
244 	 * Hand to the 802.3 code if not tagged as
245 	 * a raw 802.11 frame.
246 	 */
247 	if (dst->sa_family != AF_IEEE80211)
248 		return ether_output(ifp, m, dst, rt0);
249 #ifdef MAC
250 	error = mac_check_ifnet_transmit(ifp, m);
251 	if (error)
252 		senderr(error);
253 #endif
254 	if (ifp->if_flags & IFF_MONITOR)
255 		senderr(ENETDOWN);
256 	if ((ifp->if_flags & IFF_UP) == 0)
257 		senderr(ENETDOWN);
258 
259 	/* XXX bypass bridge, pfil, carp, etc. */
260 
261 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_ack))
262 		senderr(EIO);	/* XXX */
263 	wh = mtod(m, struct ieee80211_frame *);
264 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
265 	    IEEE80211_FC0_VERSION_0)
266 		senderr(EIO);	/* XXX */
267 
268 	/* locate destination node */
269 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
270 	case IEEE80211_FC1_DIR_NODS:
271 	case IEEE80211_FC1_DIR_FROMDS:
272 		ni = ieee80211_find_txnode(ic, wh->i_addr1);
273 		break;
274 	case IEEE80211_FC1_DIR_TODS:
275 	case IEEE80211_FC1_DIR_DSTODS:
276 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame))
277 			senderr(EIO);	/* XXX */
278 		ni = ieee80211_find_txnode(ic, wh->i_addr3);
279 		break;
280 	default:
281 		senderr(EIO);	/* XXX */
282 	}
283 	if (ni == NULL) {
284 		/*
285 		 * Permit packets w/ bpf params through regardless
286 		 * (see below about sa_len).
287 		 */
288 		if (dst->sa_len == 0)
289 			senderr(EHOSTUNREACH);
290 		ni = ieee80211_ref_node(ic->ic_bss);
291 	}
292 
293 	/* XXX ctrl frames should go through */
294 	if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) &&
295 	    (m->m_flags & M_PWR_SAV) == 0) {
296 		/*
297 		 * Station in power save mode; pass the frame
298 		 * to the 802.11 layer and continue.  We'll get
299 		 * the frame back when the time is right.
300 		 */
301 		ieee80211_pwrsave(ic, ni, m);
302 		error = 0;
303 		goto reclaim;
304 	}
305 
306 	/* calculate priority so drivers can find the tx queue */
307 	/* XXX assumes an 802.3 frame */
308 	if (ieee80211_classify(ic, m, ni))
309 		senderr(EIO);		/* XXX */
310 
311 	BPF_MTAP(ifp, m);
312 	/*
313 	 * NB: DLT_IEEE802_11_RADIO identifies the parameters are
314 	 * present by setting the sa_len field of the sockaddr (yes,
315 	 * this is a hack).
316 	 * NB: we assume sa_data is suitably aligned to cast.
317 	 */
318 	return ic->ic_raw_xmit(ni, m, (const struct ieee80211_bpf_params *)
319 		(dst->sa_len ? dst->sa_data : NULL));
320 bad:
321 	if (m != NULL)
322 		m_freem(m);
323 reclaim:
324 	if (ni != NULL)
325 		ieee80211_free_node(ni);
326 	return error;
327 #undef senderr
328 }
329 
330 /*
331  * Send a null data frame to the specified node.
332  *
333  * NB: the caller is assumed to have setup a node reference
334  *     for use; this is necessary to deal with a race condition
335  *     when probing for inactive stations.
336  */
337 int
338 ieee80211_send_nulldata(struct ieee80211_node *ni)
339 {
340 	struct ieee80211com *ic = ni->ni_ic;
341 	struct ifnet *ifp = ic->ic_ifp;
342 	struct mbuf *m;
343 	struct ieee80211_frame *wh;
344 
345 	MGETHDR(m, M_NOWAIT, MT_DATA);
346 	if (m == NULL) {
347 		/* XXX debug msg */
348 		ic->ic_stats.is_tx_nobuf++;
349 		ieee80211_unref_node(&ni);
350 		return ENOMEM;
351 	}
352 	m->m_pkthdr.rcvif = (void *) ni;
353 
354 	wh = mtod(m, struct ieee80211_frame *);
355 	ieee80211_send_setup(ic, ni, wh,
356 		IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
357 		ic->ic_myaddr, ni->ni_macaddr, ni->ni_bssid);
358 	/* NB: power management bit is never sent by an AP */
359 	if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) &&
360 	    ic->ic_opmode != IEEE80211_M_HOSTAP)
361 		wh->i_fc[1] |= IEEE80211_FC1_PWR_MGT;
362 	m->m_len = m->m_pkthdr.len = sizeof(struct ieee80211_frame);
363 
364 	IEEE80211_NODE_STAT(ni, tx_data);
365 
366 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_DUMPPKTS,
367 	    "[%s] send null data frame on channel %u, pwr mgt %s\n",
368 	    ether_sprintf(ni->ni_macaddr),
369 	    ieee80211_chan2ieee(ic, ic->ic_curchan),
370 	    wh->i_fc[1] & IEEE80211_FC1_PWR_MGT ? "ena" : "dis");
371 
372 	IF_ENQUEUE(&ic->ic_mgtq, m);		/* cheat */
373 	if_start(ifp);
374 
375 	return 0;
376 }
377 
378 /*
379  * Assign priority to a frame based on any vlan tag assigned
380  * to the station and/or any Diffserv setting in an IP header.
381  * Finally, if an ACM policy is setup (in station mode) it's
382  * applied.
383  */
384 int
385 ieee80211_classify(struct ieee80211com *ic, struct mbuf *m, struct ieee80211_node *ni)
386 {
387 	int v_wme_ac, d_wme_ac, ac;
388 #ifdef INET
389 	struct ether_header *eh;
390 #endif
391 
392 	if ((ni->ni_flags & IEEE80211_NODE_QOS) == 0) {
393 		ac = WME_AC_BE;
394 		goto done;
395 	}
396 
397 	/*
398 	 * If node has a vlan tag then all traffic
399 	 * to it must have a matching tag.
400 	 */
401 	v_wme_ac = 0;
402 	if (ni->ni_vlan != 0) {
403 		 if ((m->m_flags & M_VLANTAG) == 0) {
404 			IEEE80211_NODE_STAT(ni, tx_novlantag);
405 			return 1;
406 		}
407 		if (EVL_VLANOFTAG(m->m_pkthdr.ether_vtag) !=
408 		    EVL_VLANOFTAG(ni->ni_vlan)) {
409 			IEEE80211_NODE_STAT(ni, tx_vlanmismatch);
410 			return 1;
411 		}
412 		/* map vlan priority to AC */
413 		switch (EVL_PRIOFTAG(ni->ni_vlan)) {
414 		case 1:
415 		case 2:
416 			v_wme_ac = WME_AC_BK;
417 			break;
418 		case 0:
419 		case 3:
420 			v_wme_ac = WME_AC_BE;
421 			break;
422 		case 4:
423 		case 5:
424 			v_wme_ac = WME_AC_VI;
425 			break;
426 		case 6:
427 		case 7:
428 			v_wme_ac = WME_AC_VO;
429 			break;
430 		}
431 	}
432 
433 #ifdef INET
434 	eh = mtod(m, struct ether_header *);
435 	if (eh->ether_type == htons(ETHERTYPE_IP)) {
436 		const struct ip *ip = (struct ip *)
437 			(mtod(m, u_int8_t *) + sizeof (*eh));
438 		/*
439 		 * IP frame, map the TOS field.
440 		 */
441 		switch (ip->ip_tos) {
442 		case 0x08:
443 		case 0x20:
444 			d_wme_ac = WME_AC_BK;	/* background */
445 			break;
446 		case 0x28:
447 		case 0xa0:
448 			d_wme_ac = WME_AC_VI;	/* video */
449 			break;
450 		case 0x30:			/* voice */
451 		case 0xe0:
452 		case 0x88:			/* XXX UPSD */
453 		case 0xb8:
454 			d_wme_ac = WME_AC_VO;
455 			break;
456 		default:
457 			d_wme_ac = WME_AC_BE;
458 			break;
459 		}
460 	} else {
461 #endif /* INET */
462 		d_wme_ac = WME_AC_BE;
463 #ifdef INET
464 	}
465 #endif
466 	/*
467 	 * Use highest priority AC.
468 	 */
469 	if (v_wme_ac > d_wme_ac)
470 		ac = v_wme_ac;
471 	else
472 		ac = d_wme_ac;
473 
474 	/*
475 	 * Apply ACM policy.
476 	 */
477 	if (ic->ic_opmode == IEEE80211_M_STA) {
478 		static const int acmap[4] = {
479 			WME_AC_BK,	/* WME_AC_BE */
480 			WME_AC_BK,	/* WME_AC_BK */
481 			WME_AC_BE,	/* WME_AC_VI */
482 			WME_AC_VI,	/* WME_AC_VO */
483 		};
484 		while (ac != WME_AC_BK &&
485 		    ic->ic_wme.wme_wmeBssChanParams.cap_wmeParams[ac].wmep_acm)
486 			ac = acmap[ac];
487 	}
488 done:
489 	M_WME_SETAC(m, ac);
490 	return 0;
491 }
492 
493 /*
494  * Insure there is sufficient contiguous space to encapsulate the
495  * 802.11 data frame.  If room isn't already there, arrange for it.
496  * Drivers and cipher modules assume we have done the necessary work
497  * and fail rudely if they don't find the space they need.
498  */
499 static struct mbuf *
500 ieee80211_mbuf_adjust(struct ieee80211com *ic, int hdrsize,
501 	struct ieee80211_key *key, struct mbuf *m)
502 {
503 #define	TO_BE_RECLAIMED	(sizeof(struct ether_header) - sizeof(struct llc))
504 	int needed_space = hdrsize;
505 
506 	if (key != NULL) {
507 		/* XXX belongs in crypto code? */
508 		needed_space += key->wk_cipher->ic_header;
509 		/* XXX frags */
510 		/*
511 		 * When crypto is being done in the host we must insure
512 		 * the data are writable for the cipher routines; clone
513 		 * a writable mbuf chain.
514 		 * XXX handle SWMIC specially
515 		 */
516 		if (key->wk_flags & (IEEE80211_KEY_SWCRYPT|IEEE80211_KEY_SWMIC)) {
517 			m = m_unshare(m, M_NOWAIT);
518 			if (m == NULL) {
519 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
520 				    "%s: cannot get writable mbuf\n", __func__);
521 				ic->ic_stats.is_tx_nobuf++; /* XXX new stat */
522 				return NULL;
523 			}
524 		}
525 	}
526 	/*
527 	 * We know we are called just before stripping an Ethernet
528 	 * header and prepending an LLC header.  This means we know
529 	 * there will be
530 	 *	sizeof(struct ether_header) - sizeof(struct llc)
531 	 * bytes recovered to which we need additional space for the
532 	 * 802.11 header and any crypto header.
533 	 */
534 	/* XXX check trailing space and copy instead? */
535 	if (M_LEADINGSPACE(m) < needed_space - TO_BE_RECLAIMED) {
536 		struct mbuf *n = m_gethdr(M_NOWAIT, m->m_type);
537 		if (n == NULL) {
538 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
539 			    "%s: cannot expand storage\n", __func__);
540 			ic->ic_stats.is_tx_nobuf++;
541 			m_freem(m);
542 			return NULL;
543 		}
544 		KASSERT(needed_space <= MHLEN,
545 		    ("not enough room, need %u got %zu\n", needed_space, MHLEN));
546 		/*
547 		 * Setup new mbuf to have leading space to prepend the
548 		 * 802.11 header and any crypto header bits that are
549 		 * required (the latter are added when the driver calls
550 		 * back to ieee80211_crypto_encap to do crypto encapsulation).
551 		 */
552 		/* NB: must be first 'cuz it clobbers m_data */
553 		m_move_pkthdr(n, m);
554 		n->m_len = 0;			/* NB: m_gethdr does not set */
555 		n->m_data += needed_space;
556 		/*
557 		 * Pull up Ethernet header to create the expected layout.
558 		 * We could use m_pullup but that's overkill (i.e. we don't
559 		 * need the actual data) and it cannot fail so do it inline
560 		 * for speed.
561 		 */
562 		/* NB: struct ether_header is known to be contiguous */
563 		n->m_len += sizeof(struct ether_header);
564 		m->m_len -= sizeof(struct ether_header);
565 		m->m_data += sizeof(struct ether_header);
566 		/*
567 		 * Replace the head of the chain.
568 		 */
569 		n->m_next = m;
570 		m = n;
571 	}
572 	return m;
573 #undef TO_BE_RECLAIMED
574 }
575 
576 /*
577  * Return the transmit key to use in sending a unicast frame.
578  * If a unicast key is set we use that.  When no unicast key is set
579  * we fall back to the default transmit key.
580  */
581 static __inline struct ieee80211_key *
582 ieee80211_crypto_getucastkey(struct ieee80211com *ic, struct ieee80211_node *ni)
583 {
584 	if (IEEE80211_KEY_UNDEFINED(&ni->ni_ucastkey)) {
585 		if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE ||
586 		    IEEE80211_KEY_UNDEFINED(&ic->ic_nw_keys[ic->ic_def_txkey]))
587 			return NULL;
588 		return &ic->ic_nw_keys[ic->ic_def_txkey];
589 	} else {
590 		return &ni->ni_ucastkey;
591 	}
592 }
593 
594 /*
595  * Return the transmit key to use in sending a multicast frame.
596  * Multicast traffic always uses the group key which is installed as
597  * the default tx key.
598  */
599 static __inline struct ieee80211_key *
600 ieee80211_crypto_getmcastkey(struct ieee80211com *ic, struct ieee80211_node *ni)
601 {
602 	if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE ||
603 	    IEEE80211_KEY_UNDEFINED(&ic->ic_nw_keys[ic->ic_def_txkey]))
604 		return NULL;
605 	return &ic->ic_nw_keys[ic->ic_def_txkey];
606 }
607 
608 /*
609  * Encapsulate an outbound data frame.  The mbuf chain is updated.
610  * If an error is encountered NULL is returned.  The caller is required
611  * to provide a node reference and pullup the ethernet header in the
612  * first mbuf.
613  */
614 struct mbuf *
615 ieee80211_encap(struct ieee80211com *ic, struct mbuf *m,
616 	struct ieee80211_node *ni)
617 {
618 	struct ether_header eh;
619 	struct ieee80211_frame *wh;
620 	struct ieee80211_key *key;
621 	struct llc *llc;
622 	int hdrsize, datalen, addqos;
623 
624 	KASSERT(m->m_len >= sizeof(eh), ("no ethernet header!"));
625 	memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
626 
627 	/*
628 	 * Insure space for additional headers.  First identify
629 	 * transmit key to use in calculating any buffer adjustments
630 	 * required.  This is also used below to do privacy
631 	 * encapsulation work.  Then calculate the 802.11 header
632 	 * size and any padding required by the driver.
633 	 *
634 	 * Note key may be NULL if we fall back to the default
635 	 * transmit key and that is not set.  In that case the
636 	 * buffer may not be expanded as needed by the cipher
637 	 * routines, but they will/should discard it.
638 	 */
639 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
640 		if (ic->ic_opmode == IEEE80211_M_STA ||
641 		    !IEEE80211_IS_MULTICAST(eh.ether_dhost))
642 			key = ieee80211_crypto_getucastkey(ic, ni);
643 		else
644 			key = ieee80211_crypto_getmcastkey(ic, ni);
645 		if (key == NULL && eh.ether_type != htons(ETHERTYPE_PAE)) {
646 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
647 			    "[%s] no default transmit key (%s) deftxkey %u\n",
648 			    ether_sprintf(eh.ether_dhost), __func__,
649 			    ic->ic_def_txkey);
650 			ic->ic_stats.is_tx_nodefkey++;
651 		}
652 	} else
653 		key = NULL;
654 	/* XXX 4-address format */
655 	/*
656 	 * XXX Some ap's don't handle QoS-encapsulated EAPOL
657 	 * frames so suppress use.  This may be an issue if other
658 	 * ap's require all data frames to be QoS-encapsulated
659 	 * once negotiated in which case we'll need to make this
660 	 * configurable.
661 	 */
662 	addqos = (ni->ni_flags & IEEE80211_NODE_QOS) &&
663 		 eh.ether_type != htons(ETHERTYPE_PAE);
664 	if (addqos)
665 		hdrsize = sizeof(struct ieee80211_qosframe);
666 	else
667 		hdrsize = sizeof(struct ieee80211_frame);
668 	if (ic->ic_flags & IEEE80211_F_DATAPAD)
669 		hdrsize = roundup(hdrsize, sizeof(u_int32_t));
670 	m = ieee80211_mbuf_adjust(ic, hdrsize, key, m);
671 	if (m == NULL) {
672 		/* NB: ieee80211_mbuf_adjust handles msgs+statistics */
673 		goto bad;
674 	}
675 
676 	/* NB: this could be optimized because of ieee80211_mbuf_adjust */
677 	m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
678 	llc = mtod(m, struct llc *);
679 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
680 	llc->llc_control = LLC_UI;
681 	llc->llc_snap.org_code[0] = 0;
682 	llc->llc_snap.org_code[1] = 0;
683 	llc->llc_snap.org_code[2] = 0;
684 	llc->llc_snap.ether_type = eh.ether_type;
685 	datalen = m->m_pkthdr.len;		/* NB: w/o 802.11 header */
686 
687 	M_PREPEND(m, hdrsize, M_DONTWAIT);
688 	if (m == NULL) {
689 		ic->ic_stats.is_tx_nobuf++;
690 		goto bad;
691 	}
692 	wh = mtod(m, struct ieee80211_frame *);
693 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
694 	*(u_int16_t *)wh->i_dur = 0;
695 	switch (ic->ic_opmode) {
696 	case IEEE80211_M_STA:
697 		wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
698 		IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
699 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
700 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
701 		break;
702 	case IEEE80211_M_IBSS:
703 	case IEEE80211_M_AHDEMO:
704 		wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
705 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
706 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
707 		/*
708 		 * NB: always use the bssid from ic_bss as the
709 		 *     neighbor's may be stale after an ibss merge
710 		 */
711 		IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_bss->ni_bssid);
712 		break;
713 	case IEEE80211_M_HOSTAP:
714 		wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
715 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
716 		IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
717 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
718 		break;
719 	case IEEE80211_M_MONITOR:
720 		goto bad;
721 	}
722 	if (m->m_flags & M_MORE_DATA)
723 		wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
724 	if (addqos) {
725 		struct ieee80211_qosframe *qwh =
726 			(struct ieee80211_qosframe *) wh;
727 		int ac, tid;
728 
729 		ac = M_WME_GETAC(m);
730 		/* map from access class/queue to 11e header priorty value */
731 		tid = WME_AC_TO_TID(ac);
732 		qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
733 		if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy)
734 			qwh->i_qos[0] |= 1 << IEEE80211_QOS_ACKPOLICY_S;
735 		qwh->i_qos[1] = 0;
736 		qwh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS;
737 
738 		*(u_int16_t *)wh->i_seq =
739 		    htole16(ni->ni_txseqs[tid] << IEEE80211_SEQ_SEQ_SHIFT);
740 		ni->ni_txseqs[tid]++;
741 	} else {
742 		*(u_int16_t *)wh->i_seq =
743 		    htole16(ni->ni_txseqs[IEEE80211_NONQOS_TID] << IEEE80211_SEQ_SEQ_SHIFT);
744 		ni->ni_txseqs[IEEE80211_NONQOS_TID]++;
745 	}
746 	if (key != NULL) {
747 		/*
748 		 * IEEE 802.1X: send EAPOL frames always in the clear.
749 		 * WPA/WPA2: encrypt EAPOL keys when pairwise keys are set.
750 		 */
751 		if (eh.ether_type != htons(ETHERTYPE_PAE) ||
752 		    ((ic->ic_flags & IEEE80211_F_WPA) &&
753 		     (ic->ic_opmode == IEEE80211_M_STA ?
754 		      !IEEE80211_KEY_UNDEFINED(key) :
755 		      !IEEE80211_KEY_UNDEFINED(&ni->ni_ucastkey)))) {
756 			wh->i_fc[1] |= IEEE80211_FC1_WEP;
757 			/* XXX do fragmentation */
758 			if (!ieee80211_crypto_enmic(ic, key, m, 0)) {
759 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
760 				    "[%s] enmic failed, discard frame\n",
761 				    ether_sprintf(eh.ether_dhost));
762 				ic->ic_stats.is_crypto_enmicfail++;
763 				goto bad;
764 			}
765 		}
766 	}
767 
768 	IEEE80211_NODE_STAT(ni, tx_data);
769 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
770 		IEEE80211_NODE_STAT(ni, tx_mcast);
771 	else
772 		IEEE80211_NODE_STAT(ni, tx_ucast);
773 	IEEE80211_NODE_STAT_ADD(ni, tx_bytes, datalen);
774 
775 	return m;
776 bad:
777 	if (m != NULL)
778 		m_freem(m);
779 	return NULL;
780 }
781 
782 /*
783  * Add a supported rates element id to a frame.
784  */
785 static u_int8_t *
786 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
787 {
788 	int nrates;
789 
790 	*frm++ = IEEE80211_ELEMID_RATES;
791 	nrates = rs->rs_nrates;
792 	if (nrates > IEEE80211_RATE_SIZE)
793 		nrates = IEEE80211_RATE_SIZE;
794 	*frm++ = nrates;
795 	memcpy(frm, rs->rs_rates, nrates);
796 	return frm + nrates;
797 }
798 
799 /*
800  * Add an extended supported rates element id to a frame.
801  */
802 static u_int8_t *
803 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
804 {
805 	/*
806 	 * Add an extended supported rates element if operating in 11g mode.
807 	 */
808 	if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
809 		int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
810 		*frm++ = IEEE80211_ELEMID_XRATES;
811 		*frm++ = nrates;
812 		memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
813 		frm += nrates;
814 	}
815 	return frm;
816 }
817 
818 /*
819  * Add an ssid elemet to a frame.
820  */
821 static u_int8_t *
822 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
823 {
824 	*frm++ = IEEE80211_ELEMID_SSID;
825 	*frm++ = len;
826 	memcpy(frm, ssid, len);
827 	return frm + len;
828 }
829 
830 /*
831  * Add an erp element to a frame.
832  */
833 static u_int8_t *
834 ieee80211_add_erp(u_int8_t *frm, struct ieee80211com *ic)
835 {
836 	u_int8_t erp;
837 
838 	*frm++ = IEEE80211_ELEMID_ERP;
839 	*frm++ = 1;
840 	erp = 0;
841 	if (ic->ic_nonerpsta != 0)
842 		erp |= IEEE80211_ERP_NON_ERP_PRESENT;
843 	if (ic->ic_flags & IEEE80211_F_USEPROT)
844 		erp |= IEEE80211_ERP_USE_PROTECTION;
845 	if (ic->ic_flags & IEEE80211_F_USEBARKER)
846 		erp |= IEEE80211_ERP_LONG_PREAMBLE;
847 	*frm++ = erp;
848 	return frm;
849 }
850 
851 static u_int8_t *
852 ieee80211_setup_wpa_ie(struct ieee80211com *ic, u_int8_t *ie)
853 {
854 #define	WPA_OUI_BYTES		0x00, 0x50, 0xf2
855 #define	ADDSHORT(frm, v) do {			\
856 	frm[0] = (v) & 0xff;			\
857 	frm[1] = (v) >> 8;			\
858 	frm += 2;				\
859 } while (0)
860 #define	ADDSELECTOR(frm, sel) do {		\
861 	memcpy(frm, sel, 4);			\
862 	frm += 4;				\
863 } while (0)
864 	static const u_int8_t oui[4] = { WPA_OUI_BYTES, WPA_OUI_TYPE };
865 	static const u_int8_t cipher_suite[][4] = {
866 		{ WPA_OUI_BYTES, WPA_CSE_WEP40 },	/* NB: 40-bit */
867 		{ WPA_OUI_BYTES, WPA_CSE_TKIP },
868 		{ 0x00, 0x00, 0x00, 0x00 },		/* XXX WRAP */
869 		{ WPA_OUI_BYTES, WPA_CSE_CCMP },
870 		{ 0x00, 0x00, 0x00, 0x00 },		/* XXX CKIP */
871 		{ WPA_OUI_BYTES, WPA_CSE_NULL },
872 	};
873 	static const u_int8_t wep104_suite[4] =
874 		{ WPA_OUI_BYTES, WPA_CSE_WEP104 };
875 	static const u_int8_t key_mgt_unspec[4] =
876 		{ WPA_OUI_BYTES, WPA_ASE_8021X_UNSPEC };
877 	static const u_int8_t key_mgt_psk[4] =
878 		{ WPA_OUI_BYTES, WPA_ASE_8021X_PSK };
879 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
880 	u_int8_t *frm = ie;
881 	u_int8_t *selcnt;
882 
883 	*frm++ = IEEE80211_ELEMID_VENDOR;
884 	*frm++ = 0;				/* length filled in below */
885 	memcpy(frm, oui, sizeof(oui));		/* WPA OUI */
886 	frm += sizeof(oui);
887 	ADDSHORT(frm, WPA_VERSION);
888 
889 	/* XXX filter out CKIP */
890 
891 	/* multicast cipher */
892 	if (rsn->rsn_mcastcipher == IEEE80211_CIPHER_WEP &&
893 	    rsn->rsn_mcastkeylen >= 13)
894 		ADDSELECTOR(frm, wep104_suite);
895 	else
896 		ADDSELECTOR(frm, cipher_suite[rsn->rsn_mcastcipher]);
897 
898 	/* unicast cipher list */
899 	selcnt = frm;
900 	ADDSHORT(frm, 0);			/* selector count */
901 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_AES_CCM)) {
902 		selcnt[0]++;
903 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_AES_CCM]);
904 	}
905 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_TKIP)) {
906 		selcnt[0]++;
907 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_TKIP]);
908 	}
909 
910 	/* authenticator selector list */
911 	selcnt = frm;
912 	ADDSHORT(frm, 0);			/* selector count */
913 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_UNSPEC) {
914 		selcnt[0]++;
915 		ADDSELECTOR(frm, key_mgt_unspec);
916 	}
917 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_PSK) {
918 		selcnt[0]++;
919 		ADDSELECTOR(frm, key_mgt_psk);
920 	}
921 
922 	/* optional capabilities */
923 	if (rsn->rsn_caps != 0 && rsn->rsn_caps != RSN_CAP_PREAUTH)
924 		ADDSHORT(frm, rsn->rsn_caps);
925 
926 	/* calculate element length */
927 	ie[1] = frm - ie - 2;
928 	KASSERT(ie[1]+2 <= sizeof(struct ieee80211_ie_wpa),
929 		("WPA IE too big, %u > %zu",
930 		ie[1]+2, sizeof(struct ieee80211_ie_wpa)));
931 	return frm;
932 #undef ADDSHORT
933 #undef ADDSELECTOR
934 #undef WPA_OUI_BYTES
935 }
936 
937 static u_int8_t *
938 ieee80211_setup_rsn_ie(struct ieee80211com *ic, u_int8_t *ie)
939 {
940 #define	RSN_OUI_BYTES		0x00, 0x0f, 0xac
941 #define	ADDSHORT(frm, v) do {			\
942 	frm[0] = (v) & 0xff;			\
943 	frm[1] = (v) >> 8;			\
944 	frm += 2;				\
945 } while (0)
946 #define	ADDSELECTOR(frm, sel) do {		\
947 	memcpy(frm, sel, 4);			\
948 	frm += 4;				\
949 } while (0)
950 	static const u_int8_t cipher_suite[][4] = {
951 		{ RSN_OUI_BYTES, RSN_CSE_WEP40 },	/* NB: 40-bit */
952 		{ RSN_OUI_BYTES, RSN_CSE_TKIP },
953 		{ RSN_OUI_BYTES, RSN_CSE_WRAP },
954 		{ RSN_OUI_BYTES, RSN_CSE_CCMP },
955 		{ 0x00, 0x00, 0x00, 0x00 },		/* XXX CKIP */
956 		{ RSN_OUI_BYTES, RSN_CSE_NULL },
957 	};
958 	static const u_int8_t wep104_suite[4] =
959 		{ RSN_OUI_BYTES, RSN_CSE_WEP104 };
960 	static const u_int8_t key_mgt_unspec[4] =
961 		{ RSN_OUI_BYTES, RSN_ASE_8021X_UNSPEC };
962 	static const u_int8_t key_mgt_psk[4] =
963 		{ RSN_OUI_BYTES, RSN_ASE_8021X_PSK };
964 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
965 	u_int8_t *frm = ie;
966 	u_int8_t *selcnt;
967 
968 	*frm++ = IEEE80211_ELEMID_RSN;
969 	*frm++ = 0;				/* length filled in below */
970 	ADDSHORT(frm, RSN_VERSION);
971 
972 	/* XXX filter out CKIP */
973 
974 	/* multicast cipher */
975 	if (rsn->rsn_mcastcipher == IEEE80211_CIPHER_WEP &&
976 	    rsn->rsn_mcastkeylen >= 13)
977 		ADDSELECTOR(frm, wep104_suite);
978 	else
979 		ADDSELECTOR(frm, cipher_suite[rsn->rsn_mcastcipher]);
980 
981 	/* unicast cipher list */
982 	selcnt = frm;
983 	ADDSHORT(frm, 0);			/* selector count */
984 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_AES_CCM)) {
985 		selcnt[0]++;
986 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_AES_CCM]);
987 	}
988 	if (rsn->rsn_ucastcipherset & (1<<IEEE80211_CIPHER_TKIP)) {
989 		selcnt[0]++;
990 		ADDSELECTOR(frm, cipher_suite[IEEE80211_CIPHER_TKIP]);
991 	}
992 
993 	/* authenticator selector list */
994 	selcnt = frm;
995 	ADDSHORT(frm, 0);			/* selector count */
996 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_UNSPEC) {
997 		selcnt[0]++;
998 		ADDSELECTOR(frm, key_mgt_unspec);
999 	}
1000 	if (rsn->rsn_keymgmtset & WPA_ASE_8021X_PSK) {
1001 		selcnt[0]++;
1002 		ADDSELECTOR(frm, key_mgt_psk);
1003 	}
1004 
1005 	/* optional capabilities */
1006 	ADDSHORT(frm, rsn->rsn_caps);
1007 	/* XXX PMKID */
1008 
1009 	/* calculate element length */
1010 	ie[1] = frm - ie - 2;
1011 	KASSERT(ie[1]+2 <= sizeof(struct ieee80211_ie_wpa),
1012 		("RSN IE too big, %u > %zu",
1013 		ie[1]+2, sizeof(struct ieee80211_ie_wpa)));
1014 	return frm;
1015 #undef ADDSELECTOR
1016 #undef ADDSHORT
1017 #undef RSN_OUI_BYTES
1018 }
1019 
1020 /*
1021  * Add a WPA/RSN element to a frame.
1022  */
1023 static u_int8_t *
1024 ieee80211_add_wpa(u_int8_t *frm, struct ieee80211com *ic)
1025 {
1026 
1027 	KASSERT(ic->ic_flags & IEEE80211_F_WPA, ("no WPA/RSN!"));
1028 	if (ic->ic_flags & IEEE80211_F_WPA2)
1029 		frm = ieee80211_setup_rsn_ie(ic, frm);
1030 	if (ic->ic_flags & IEEE80211_F_WPA1)
1031 		frm = ieee80211_setup_wpa_ie(ic, frm);
1032 	return frm;
1033 }
1034 
1035 #define	WME_OUI_BYTES		0x00, 0x50, 0xf2
1036 /*
1037  * Add a WME information element to a frame.
1038  */
1039 static u_int8_t *
1040 ieee80211_add_wme_info(u_int8_t *frm, struct ieee80211_wme_state *wme)
1041 {
1042 	static const struct ieee80211_wme_info info = {
1043 		.wme_id		= IEEE80211_ELEMID_VENDOR,
1044 		.wme_len	= sizeof(struct ieee80211_wme_info) - 2,
1045 		.wme_oui	= { WME_OUI_BYTES },
1046 		.wme_type	= WME_OUI_TYPE,
1047 		.wme_subtype	= WME_INFO_OUI_SUBTYPE,
1048 		.wme_version	= WME_VERSION,
1049 		.wme_info	= 0,
1050 	};
1051 	memcpy(frm, &info, sizeof(info));
1052 	return frm + sizeof(info);
1053 }
1054 
1055 /*
1056  * Add a WME parameters element to a frame.
1057  */
1058 static u_int8_t *
1059 ieee80211_add_wme_param(u_int8_t *frm, struct ieee80211_wme_state *wme)
1060 {
1061 #define	SM(_v, _f)	(((_v) << _f##_S) & _f)
1062 #define	ADDSHORT(frm, v) do {			\
1063 	frm[0] = (v) & 0xff;			\
1064 	frm[1] = (v) >> 8;			\
1065 	frm += 2;				\
1066 } while (0)
1067 	/* NB: this works 'cuz a param has an info at the front */
1068 	static const struct ieee80211_wme_info param = {
1069 		.wme_id		= IEEE80211_ELEMID_VENDOR,
1070 		.wme_len	= sizeof(struct ieee80211_wme_param) - 2,
1071 		.wme_oui	= { WME_OUI_BYTES },
1072 		.wme_type	= WME_OUI_TYPE,
1073 		.wme_subtype	= WME_PARAM_OUI_SUBTYPE,
1074 		.wme_version	= WME_VERSION,
1075 	};
1076 	int i;
1077 
1078 	memcpy(frm, &param, sizeof(param));
1079 	frm += __offsetof(struct ieee80211_wme_info, wme_info);
1080 	*frm++ = wme->wme_bssChanParams.cap_info;	/* AC info */
1081 	*frm++ = 0;					/* reserved field */
1082 	for (i = 0; i < WME_NUM_AC; i++) {
1083 		const struct wmeParams *ac =
1084 		       &wme->wme_bssChanParams.cap_wmeParams[i];
1085 		*frm++ = SM(i, WME_PARAM_ACI)
1086 		       | SM(ac->wmep_acm, WME_PARAM_ACM)
1087 		       | SM(ac->wmep_aifsn, WME_PARAM_AIFSN)
1088 		       ;
1089 		*frm++ = SM(ac->wmep_logcwmax, WME_PARAM_LOGCWMAX)
1090 		       | SM(ac->wmep_logcwmin, WME_PARAM_LOGCWMIN)
1091 		       ;
1092 		ADDSHORT(frm, ac->wmep_txopLimit);
1093 	}
1094 	return frm;
1095 #undef SM
1096 #undef ADDSHORT
1097 }
1098 #undef WME_OUI_BYTES
1099 
1100 /*
1101  * Send a probe request frame with the specified ssid
1102  * and any optional information element data.
1103  */
1104 int
1105 ieee80211_send_probereq(struct ieee80211_node *ni,
1106 	const u_int8_t sa[IEEE80211_ADDR_LEN],
1107 	const u_int8_t da[IEEE80211_ADDR_LEN],
1108 	const u_int8_t bssid[IEEE80211_ADDR_LEN],
1109 	const u_int8_t *ssid, size_t ssidlen,
1110 	const void *optie, size_t optielen)
1111 {
1112 	struct ieee80211com *ic = ni->ni_ic;
1113 	struct ieee80211_frame *wh;
1114 	const struct ieee80211_rateset *rs;
1115 	struct mbuf *m;
1116 	u_int8_t *frm;
1117 
1118 	/*
1119 	 * Hold a reference on the node so it doesn't go away until after
1120 	 * the xmit is complete all the way in the driver.  On error we
1121 	 * will remove our reference.
1122 	 */
1123 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1124 		"ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n",
1125 		__func__, __LINE__,
1126 		ni, ether_sprintf(ni->ni_macaddr),
1127 		ieee80211_node_refcnt(ni)+1);
1128 	ieee80211_ref_node(ni);
1129 
1130 	/*
1131 	 * prreq frame format
1132 	 *	[tlv] ssid
1133 	 *	[tlv] supported rates
1134 	 *	[tlv] extended supported rates
1135 	 *	[tlv] user-specified ie's
1136 	 */
1137 	m = ieee80211_getmgtframe(&frm,
1138 		 2 + IEEE80211_NWID_LEN
1139 	       + 2 + IEEE80211_RATE_SIZE
1140 	       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1141 	       + (optie != NULL ? optielen : 0)
1142 	);
1143 	if (m == NULL) {
1144 		ic->ic_stats.is_tx_nobuf++;
1145 		ieee80211_free_node(ni);
1146 		return ENOMEM;
1147 	}
1148 
1149 	frm = ieee80211_add_ssid(frm, ssid, ssidlen);
1150 	rs = ieee80211_get_suprates(ic, ic->ic_curchan);
1151 	frm = ieee80211_add_rates(frm, rs);
1152 	frm = ieee80211_add_xrates(frm, rs);
1153 
1154 	if (optie != NULL) {
1155 		memcpy(frm, optie, optielen);
1156 		frm += optielen;
1157 	}
1158 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1159 
1160 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
1161 	if (m == NULL)
1162 		return ENOMEM;
1163 	KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
1164 	m->m_pkthdr.rcvif = (void *)ni;
1165 
1166 	wh = mtod(m, struct ieee80211_frame *);
1167 	ieee80211_send_setup(ic, ni, wh,
1168 		IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ,
1169 		sa, da, bssid);
1170 	/* XXX power management? */
1171 
1172 	IEEE80211_NODE_STAT(ni, tx_probereq);
1173 	IEEE80211_NODE_STAT(ni, tx_mgmt);
1174 
1175 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_DUMPPKTS,
1176 	    "[%s] send probe req on channel %u\n",
1177 	    ether_sprintf(wh->i_addr1),
1178 	    ieee80211_chan2ieee(ic, ic->ic_curchan));
1179 
1180 	IF_ENQUEUE(&ic->ic_mgtq, m);
1181 	if_start(ic->ic_ifp);
1182 	return 0;
1183 }
1184 
1185 /*
1186  * Calculate capability information for mgt frames.
1187  */
1188 static u_int16_t
1189 getcapinfo(struct ieee80211com *ic, struct ieee80211_channel *chan)
1190 {
1191 	u_int16_t capinfo;
1192 
1193 	KASSERT(ic->ic_opmode != IEEE80211_M_STA, ("station mode"));
1194 
1195 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1196 		capinfo = IEEE80211_CAPINFO_ESS;
1197 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
1198 		capinfo = IEEE80211_CAPINFO_IBSS;
1199 	else
1200 		capinfo = 0;
1201 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
1202 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1203 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1204 	    IEEE80211_IS_CHAN_2GHZ(chan))
1205 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1206 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1207 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1208 	return capinfo;
1209 }
1210 
1211 /*
1212  * Send a management frame.  The node is for the destination (or ic_bss
1213  * when in station mode).  Nodes other than ic_bss have their reference
1214  * count bumped to reflect our use for an indeterminant time.
1215  */
1216 int
1217 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
1218 	int type, int arg)
1219 {
1220 #define	senderr(_x, _v)	do { ic->ic_stats._v++; ret = _x; goto bad; } while (0)
1221 	struct mbuf *m;
1222 	u_int8_t *frm;
1223 	u_int16_t capinfo;
1224 	int has_challenge, is_shared_key, ret, timer, status;
1225 
1226 	KASSERT(ni != NULL, ("null node"));
1227 
1228 	/*
1229 	 * Hold a reference on the node so it doesn't go away until after
1230 	 * the xmit is complete all the way in the driver.  On error we
1231 	 * will remove our reference.
1232 	 */
1233 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1234 		"ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n",
1235 		__func__, __LINE__,
1236 		ni, ether_sprintf(ni->ni_macaddr),
1237 		ieee80211_node_refcnt(ni)+1);
1238 	ieee80211_ref_node(ni);
1239 
1240 	timer = 0;
1241 	switch (type) {
1242 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1243 		/*
1244 		 * probe response frame format
1245 		 *	[8] time stamp
1246 		 *	[2] beacon interval
1247 		 *	[2] cabability information
1248 		 *	[tlv] ssid
1249 		 *	[tlv] supported rates
1250 		 *	[tlv] parameter set (FH/DS)
1251 		 *	[tlv] parameter set (IBSS)
1252 		 *	[tlv] extended rate phy (ERP)
1253 		 *	[tlv] extended supported rates
1254 		 *	[tlv] WPA
1255 		 *	[tlv] WME (optional)
1256 		 */
1257 		m = ieee80211_getmgtframe(&frm,
1258 			 8
1259 		       + sizeof(u_int16_t)
1260 		       + sizeof(u_int16_t)
1261 		       + 2 + IEEE80211_NWID_LEN
1262 		       + 2 + IEEE80211_RATE_SIZE
1263 		       + 7	/* max(7,3) */
1264 		       + 6
1265 		       + 3
1266 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1267 		       /* XXX !WPA1+WPA2 fits w/o a cluster */
1268 		       + (ic->ic_flags & IEEE80211_F_WPA ?
1269 				2*sizeof(struct ieee80211_ie_wpa) : 0)
1270 		       + sizeof(struct ieee80211_wme_param)
1271 		);
1272 		if (m == NULL)
1273 			senderr(ENOMEM, is_tx_nobuf);
1274 
1275 		memset(frm, 0, 8);	/* timestamp should be filled later */
1276 		frm += 8;
1277 		*(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval);
1278 		frm += 2;
1279 		capinfo = getcapinfo(ic, ic->ic_curchan);
1280 		*(u_int16_t *)frm = htole16(capinfo);
1281 		frm += 2;
1282 
1283 		frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
1284 				ic->ic_bss->ni_esslen);
1285 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
1286 
1287 		if (ic->ic_phytype == IEEE80211_T_FH) {
1288                         *frm++ = IEEE80211_ELEMID_FHPARMS;
1289                         *frm++ = 5;
1290                         *frm++ = ni->ni_fhdwell & 0x00ff;
1291                         *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff;
1292                         *frm++ = IEEE80211_FH_CHANSET(
1293 			    ieee80211_chan2ieee(ic, ic->ic_curchan));
1294                         *frm++ = IEEE80211_FH_CHANPAT(
1295 			    ieee80211_chan2ieee(ic, ic->ic_curchan));
1296                         *frm++ = ni->ni_fhindex;
1297 		} else {
1298 			*frm++ = IEEE80211_ELEMID_DSPARMS;
1299 			*frm++ = 1;
1300 			*frm++ = ieee80211_chan2ieee(ic, ic->ic_curchan);
1301 		}
1302 
1303 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
1304 			*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1305 			*frm++ = 2;
1306 			*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1307 		}
1308 		if (ic->ic_flags & IEEE80211_F_WPA)
1309 			frm = ieee80211_add_wpa(frm, ic);
1310 		if (ic->ic_curmode == IEEE80211_MODE_11G)
1311 			frm = ieee80211_add_erp(frm, ic);
1312 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
1313 		if (ic->ic_flags & IEEE80211_F_WME)
1314 			frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
1315 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1316 		break;
1317 
1318 	case IEEE80211_FC0_SUBTYPE_AUTH:
1319 		status = arg >> 16;
1320 		arg &= 0xffff;
1321 		has_challenge = ((arg == IEEE80211_AUTH_SHARED_CHALLENGE ||
1322 		    arg == IEEE80211_AUTH_SHARED_RESPONSE) &&
1323 		    ni->ni_challenge != NULL);
1324 
1325 		/*
1326 		 * Deduce whether we're doing open authentication or
1327 		 * shared key authentication.  We do the latter if
1328 		 * we're in the middle of a shared key authentication
1329 		 * handshake or if we're initiating an authentication
1330 		 * request and configured to use shared key.
1331 		 */
1332 		is_shared_key = has_challenge ||
1333 		     arg >= IEEE80211_AUTH_SHARED_RESPONSE ||
1334 		     (arg == IEEE80211_AUTH_SHARED_REQUEST &&
1335 		      ic->ic_bss->ni_authmode == IEEE80211_AUTH_SHARED);
1336 
1337 		m = ieee80211_getmgtframe(&frm,
1338 			  3 * sizeof(u_int16_t)
1339 			+ (has_challenge && status == IEEE80211_STATUS_SUCCESS ?
1340 				sizeof(u_int16_t)+IEEE80211_CHALLENGE_LEN : 0)
1341 		);
1342 		if (m == NULL)
1343 			senderr(ENOMEM, is_tx_nobuf);
1344 
1345 		((u_int16_t *)frm)[0] =
1346 		    (is_shared_key) ? htole16(IEEE80211_AUTH_ALG_SHARED)
1347 		                    : htole16(IEEE80211_AUTH_ALG_OPEN);
1348 		((u_int16_t *)frm)[1] = htole16(arg);	/* sequence number */
1349 		((u_int16_t *)frm)[2] = htole16(status);/* status */
1350 
1351 		if (has_challenge && status == IEEE80211_STATUS_SUCCESS) {
1352 			((u_int16_t *)frm)[3] =
1353 			    htole16((IEEE80211_CHALLENGE_LEN << 8) |
1354 			    IEEE80211_ELEMID_CHALLENGE);
1355 			memcpy(&((u_int16_t *)frm)[4], ni->ni_challenge,
1356 			    IEEE80211_CHALLENGE_LEN);
1357 			m->m_pkthdr.len = m->m_len =
1358 				4 * sizeof(u_int16_t) + IEEE80211_CHALLENGE_LEN;
1359 			if (arg == IEEE80211_AUTH_SHARED_RESPONSE) {
1360 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
1361 				    "[%s] request encrypt frame (%s)\n",
1362 				    ether_sprintf(ni->ni_macaddr), __func__);
1363 				m->m_flags |= M_LINK0; /* WEP-encrypt, please */
1364 			}
1365 		} else
1366 			m->m_pkthdr.len = m->m_len = 3 * sizeof(u_int16_t);
1367 
1368 		/* XXX not right for shared key */
1369 		if (status == IEEE80211_STATUS_SUCCESS)
1370 			IEEE80211_NODE_STAT(ni, tx_auth);
1371 		else
1372 			IEEE80211_NODE_STAT(ni, tx_auth_fail);
1373 
1374 		if (ic->ic_opmode == IEEE80211_M_STA)
1375 			timer = IEEE80211_TRANS_WAIT;
1376 		break;
1377 
1378 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1379 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
1380 			"[%s] send station deauthenticate (reason %d)\n",
1381 			ether_sprintf(ni->ni_macaddr), arg);
1382 		m = ieee80211_getmgtframe(&frm, sizeof(u_int16_t));
1383 		if (m == NULL)
1384 			senderr(ENOMEM, is_tx_nobuf);
1385 		*(u_int16_t *)frm = htole16(arg);	/* reason */
1386 		m->m_pkthdr.len = m->m_len = sizeof(u_int16_t);
1387 
1388 		IEEE80211_NODE_STAT(ni, tx_deauth);
1389 		IEEE80211_NODE_STAT_SET(ni, tx_deauth_code, arg);
1390 
1391 		ieee80211_node_unauthorize(ni);		/* port closed */
1392 		break;
1393 
1394 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1395 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1396 		/*
1397 		 * asreq frame format
1398 		 *	[2] capability information
1399 		 *	[2] listen interval
1400 		 *	[6*] current AP address (reassoc only)
1401 		 *	[tlv] ssid
1402 		 *	[tlv] supported rates
1403 		 *	[tlv] extended supported rates
1404 		 *	[tlv] WME
1405 		 *	[tlv] user-specified ie's
1406 		 */
1407 		m = ieee80211_getmgtframe(&frm,
1408 			 sizeof(u_int16_t)
1409 		       + sizeof(u_int16_t)
1410 		       + IEEE80211_ADDR_LEN
1411 		       + 2 + IEEE80211_NWID_LEN
1412 		       + 2 + IEEE80211_RATE_SIZE
1413 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1414 		       + sizeof(struct ieee80211_wme_info)
1415 		       + (ic->ic_opt_ie != NULL ? ic->ic_opt_ie_len : 0)
1416 		);
1417 		if (m == NULL)
1418 			senderr(ENOMEM, is_tx_nobuf);
1419 
1420 		KASSERT(ic->ic_opmode == IEEE80211_M_STA,
1421 		    ("wrong mode %u", ic->ic_opmode));
1422 		capinfo = IEEE80211_CAPINFO_ESS;
1423 		if (ic->ic_flags & IEEE80211_F_PRIVACY)
1424 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
1425 		/*
1426 		 * NB: Some 11a AP's reject the request when
1427 		 *     short premable is set.
1428 		 */
1429 		if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1430 		    IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
1431 			capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1432 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) &&
1433 		    (ic->ic_caps & IEEE80211_C_SHSLOT))
1434 			capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1435 		*(u_int16_t *)frm = htole16(capinfo);
1436 		frm += 2;
1437 
1438 		*(u_int16_t *)frm = htole16(ic->ic_lintval);
1439 		frm += 2;
1440 
1441 		if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1442 			IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
1443 			frm += IEEE80211_ADDR_LEN;
1444 		}
1445 
1446 		frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
1447 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
1448 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
1449 		if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
1450 			frm = ieee80211_add_wme_info(frm, &ic->ic_wme);
1451 		if (ic->ic_opt_ie != NULL) {
1452 			memcpy(frm, ic->ic_opt_ie, ic->ic_opt_ie_len);
1453 			frm += ic->ic_opt_ie_len;
1454 		}
1455 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1456 
1457 		timer = IEEE80211_TRANS_WAIT;
1458 		break;
1459 
1460 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1461 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1462 		/*
1463 		 * asreq frame format
1464 		 *	[2] capability information
1465 		 *	[2] status
1466 		 *	[2] association ID
1467 		 *	[tlv] supported rates
1468 		 *	[tlv] extended supported rates
1469 		 *	[tlv] WME (if enabled and STA enabled)
1470 		 */
1471 		m = ieee80211_getmgtframe(&frm,
1472 			 sizeof(u_int16_t)
1473 		       + sizeof(u_int16_t)
1474 		       + sizeof(u_int16_t)
1475 		       + 2 + IEEE80211_RATE_SIZE
1476 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1477 		       + sizeof(struct ieee80211_wme_param)
1478 		);
1479 		if (m == NULL)
1480 			senderr(ENOMEM, is_tx_nobuf);
1481 
1482 		capinfo = getcapinfo(ic, ic->ic_curchan);
1483 		*(u_int16_t *)frm = htole16(capinfo);
1484 		frm += 2;
1485 
1486 		*(u_int16_t *)frm = htole16(arg);	/* status */
1487 		frm += 2;
1488 
1489 		if (arg == IEEE80211_STATUS_SUCCESS) {
1490 			*(u_int16_t *)frm = htole16(ni->ni_associd);
1491 			IEEE80211_NODE_STAT(ni, tx_assoc);
1492 		} else
1493 			IEEE80211_NODE_STAT(ni, tx_assoc_fail);
1494 		frm += 2;
1495 
1496 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
1497 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
1498 		if ((ic->ic_flags & IEEE80211_F_WME) && ni->ni_wme_ie != NULL)
1499 			frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
1500 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1501 		break;
1502 
1503 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1504 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1505 			"[%s] send station disassociate (reason %d)\n",
1506 			ether_sprintf(ni->ni_macaddr), arg);
1507 		m = ieee80211_getmgtframe(&frm, sizeof(u_int16_t));
1508 		if (m == NULL)
1509 			senderr(ENOMEM, is_tx_nobuf);
1510 		*(u_int16_t *)frm = htole16(arg);	/* reason */
1511 		m->m_pkthdr.len = m->m_len = sizeof(u_int16_t);
1512 
1513 		IEEE80211_NODE_STAT(ni, tx_disassoc);
1514 		IEEE80211_NODE_STAT_SET(ni, tx_disassoc_code, arg);
1515 		break;
1516 
1517 	default:
1518 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1519 			"[%s] invalid mgmt frame type %u\n",
1520 			ether_sprintf(ni->ni_macaddr), type);
1521 		senderr(EINVAL, is_tx_unknownmgt);
1522 		/* NOTREACHED */
1523 	}
1524 	ret = ieee80211_mgmt_output(ic, ni, m, type, timer);
1525 	if (ret != 0) {
1526 bad:
1527 		ieee80211_free_node(ni);
1528 	}
1529 	return ret;
1530 #undef senderr
1531 }
1532 
1533 /*
1534  * Allocate a beacon frame and fillin the appropriate bits.
1535  */
1536 struct mbuf *
1537 ieee80211_beacon_alloc(struct ieee80211com *ic, struct ieee80211_node *ni,
1538 	struct ieee80211_beacon_offsets *bo)
1539 {
1540 	struct ifnet *ifp = ic->ic_ifp;
1541 	struct ieee80211_frame *wh;
1542 	struct mbuf *m;
1543 	int pktlen;
1544 	u_int8_t *frm, *efrm;
1545 	u_int16_t capinfo;
1546 	struct ieee80211_rateset *rs;
1547 
1548 	/*
1549 	 * beacon frame format
1550 	 *	[8] time stamp
1551 	 *	[2] beacon interval
1552 	 *	[2] cabability information
1553 	 *	[tlv] ssid
1554 	 *	[tlv] supported rates
1555 	 *	[3] parameter set (DS)
1556 	 *	[tlv] parameter set (IBSS/TIM)
1557 	 *	[tlv] extended rate phy (ERP)
1558 	 *	[tlv] extended supported rates
1559 	 *	[tlv] WME parameters
1560 	 *	[tlv] WPA/RSN parameters
1561 	 * XXX Vendor-specific OIDs (e.g. Atheros)
1562 	 * NB: we allocate the max space required for the TIM bitmap.
1563 	 */
1564 	rs = &ni->ni_rates;
1565 	pktlen =   8					/* time stamp */
1566 		 + sizeof(u_int16_t)			/* beacon interval */
1567 		 + sizeof(u_int16_t)			/* capabilities */
1568 		 + 2 + ni->ni_esslen			/* ssid */
1569 	         + 2 + IEEE80211_RATE_SIZE		/* supported rates */
1570 	         + 2 + 1				/* DS parameters */
1571 		 + 2 + 4 + ic->ic_tim_len		/* DTIM/IBSSPARMS */
1572 		 + 2 + 1				/* ERP */
1573 	         + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1574 		 + (ic->ic_caps & IEEE80211_C_WME ?	/* WME */
1575 			sizeof(struct ieee80211_wme_param) : 0)
1576 		 + (ic->ic_caps & IEEE80211_C_WPA ?	/* WPA 1+2 */
1577 			2*sizeof(struct ieee80211_ie_wpa) : 0)
1578 		 ;
1579 	m = ieee80211_getmgtframe(&frm, pktlen);
1580 	if (m == NULL) {
1581 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1582 			"%s: cannot get buf; size %u\n", __func__, pktlen);
1583 		ic->ic_stats.is_tx_nobuf++;
1584 		return NULL;
1585 	}
1586 
1587 	memset(frm, 0, 8);	/* XXX timestamp is set by hardware/driver */
1588 	frm += 8;
1589 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1590 	frm += 2;
1591 	capinfo = getcapinfo(ic, ni->ni_chan);
1592 	bo->bo_caps = (u_int16_t *)frm;
1593 	*(u_int16_t *)frm = htole16(capinfo);
1594 	frm += 2;
1595 	*frm++ = IEEE80211_ELEMID_SSID;
1596 	if ((ic->ic_flags & IEEE80211_F_HIDESSID) == 0) {
1597 		*frm++ = ni->ni_esslen;
1598 		memcpy(frm, ni->ni_essid, ni->ni_esslen);
1599 		frm += ni->ni_esslen;
1600 	} else
1601 		*frm++ = 0;
1602 	frm = ieee80211_add_rates(frm, rs);
1603 	if (ic->ic_curmode != IEEE80211_MODE_FH) {
1604 		*frm++ = IEEE80211_ELEMID_DSPARMS;
1605 		*frm++ = 1;
1606 		*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
1607 	}
1608 	bo->bo_tim = frm;
1609 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1610 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1611 		*frm++ = 2;
1612 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1613 		bo->bo_tim_len = 0;
1614 	} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1615 		struct ieee80211_tim_ie *tie = (struct ieee80211_tim_ie *) frm;
1616 
1617 		tie->tim_ie = IEEE80211_ELEMID_TIM;
1618 		tie->tim_len = 4;	/* length */
1619 		tie->tim_count = 0;	/* DTIM count */
1620 		tie->tim_period = ic->ic_dtim_period;	/* DTIM period */
1621 		tie->tim_bitctl = 0;	/* bitmap control */
1622 		tie->tim_bitmap[0] = 0;	/* Partial Virtual Bitmap */
1623 		frm += sizeof(struct ieee80211_tim_ie);
1624 		bo->bo_tim_len = 1;
1625 	}
1626 	bo->bo_trailer = frm;
1627 	if (ic->ic_flags & IEEE80211_F_WME) {
1628 		bo->bo_wme = frm;
1629 		frm = ieee80211_add_wme_param(frm, &ic->ic_wme);
1630 		ic->ic_flags &= ~IEEE80211_F_WMEUPDATE;
1631 	}
1632 	if (ic->ic_flags & IEEE80211_F_WPA)
1633 		frm = ieee80211_add_wpa(frm, ic);
1634 	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1635 		bo->bo_erp = frm;
1636 		frm = ieee80211_add_erp(frm, ic);
1637 	}
1638 	efrm = ieee80211_add_xrates(frm, rs);
1639 	bo->bo_trailer_len = efrm - bo->bo_trailer;
1640 	m->m_pkthdr.len = m->m_len = efrm - mtod(m, u_int8_t *);
1641 
1642 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
1643 	KASSERT(m != NULL, ("no space for 802.11 header?"));
1644 	wh = mtod(m, struct ieee80211_frame *);
1645 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
1646 	    IEEE80211_FC0_SUBTYPE_BEACON;
1647 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1648 	*(u_int16_t *)wh->i_dur = 0;
1649 	IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
1650 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
1651 	IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
1652 	*(u_int16_t *)wh->i_seq = 0;
1653 
1654 	return m;
1655 }
1656 
1657 /*
1658  * Update the dynamic parts of a beacon frame based on the current state.
1659  */
1660 int
1661 ieee80211_beacon_update(struct ieee80211com *ic, struct ieee80211_node *ni,
1662 	struct ieee80211_beacon_offsets *bo, struct mbuf *m, int mcast)
1663 {
1664 	int len_changed = 0;
1665 	u_int16_t capinfo;
1666 
1667 	IEEE80211_BEACON_LOCK(ic);
1668 	/* XXX faster to recalculate entirely or just changes? */
1669 	capinfo = getcapinfo(ic, ni->ni_chan);
1670 	*bo->bo_caps = htole16(capinfo);
1671 
1672 	if (ic->ic_flags & IEEE80211_F_WME) {
1673 		struct ieee80211_wme_state *wme = &ic->ic_wme;
1674 
1675 		/*
1676 		 * Check for agressive mode change.  When there is
1677 		 * significant high priority traffic in the BSS
1678 		 * throttle back BE traffic by using conservative
1679 		 * parameters.  Otherwise BE uses agressive params
1680 		 * to optimize performance of legacy/non-QoS traffic.
1681 		 */
1682 		if (wme->wme_flags & WME_F_AGGRMODE) {
1683 			if (wme->wme_hipri_traffic >
1684 			    wme->wme_hipri_switch_thresh) {
1685 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_WME,
1686 				    "%s: traffic %u, disable aggressive mode\n",
1687 				    __func__, wme->wme_hipri_traffic);
1688 				wme->wme_flags &= ~WME_F_AGGRMODE;
1689 				ieee80211_wme_updateparams_locked(ic);
1690 				wme->wme_hipri_traffic =
1691 					wme->wme_hipri_switch_hysteresis;
1692 			} else
1693 				wme->wme_hipri_traffic = 0;
1694 		} else {
1695 			if (wme->wme_hipri_traffic <=
1696 			    wme->wme_hipri_switch_thresh) {
1697 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_WME,
1698 				    "%s: traffic %u, enable aggressive mode\n",
1699 				    __func__, wme->wme_hipri_traffic);
1700 				wme->wme_flags |= WME_F_AGGRMODE;
1701 				ieee80211_wme_updateparams_locked(ic);
1702 				wme->wme_hipri_traffic = 0;
1703 			} else
1704 				wme->wme_hipri_traffic =
1705 					wme->wme_hipri_switch_hysteresis;
1706 		}
1707 		if (ic->ic_flags & IEEE80211_F_WMEUPDATE) {
1708 			(void) ieee80211_add_wme_param(bo->bo_wme, wme);
1709 			ic->ic_flags &= ~IEEE80211_F_WMEUPDATE;
1710 		}
1711 	}
1712 
1713 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {	/* NB: no IBSS support*/
1714 		struct ieee80211_tim_ie *tie =
1715 			(struct ieee80211_tim_ie *) bo->bo_tim;
1716 		if (ic->ic_flags & IEEE80211_F_TIMUPDATE) {
1717 			u_int timlen, timoff, i;
1718 			/*
1719 			 * ATIM/DTIM needs updating.  If it fits in the
1720 			 * current space allocated then just copy in the
1721 			 * new bits.  Otherwise we need to move any trailing
1722 			 * data to make room.  Note that we know there is
1723 			 * contiguous space because ieee80211_beacon_allocate
1724 			 * insures there is space in the mbuf to write a
1725 			 * maximal-size virtual bitmap (based on ic_max_aid).
1726 			 */
1727 			/*
1728 			 * Calculate the bitmap size and offset, copy any
1729 			 * trailer out of the way, and then copy in the
1730 			 * new bitmap and update the information element.
1731 			 * Note that the tim bitmap must contain at least
1732 			 * one byte and any offset must be even.
1733 			 */
1734 			if (ic->ic_ps_pending != 0) {
1735 				timoff = 128;		/* impossibly large */
1736 				for (i = 0; i < ic->ic_tim_len; i++)
1737 					if (ic->ic_tim_bitmap[i]) {
1738 						timoff = i &~ 1;
1739 						break;
1740 					}
1741 				KASSERT(timoff != 128, ("tim bitmap empty!"));
1742 				for (i = ic->ic_tim_len-1; i >= timoff; i--)
1743 					if (ic->ic_tim_bitmap[i])
1744 						break;
1745 				timlen = 1 + (i - timoff);
1746 			} else {
1747 				timoff = 0;
1748 				timlen = 1;
1749 			}
1750 			if (timlen != bo->bo_tim_len) {
1751 				/* copy up/down trailer */
1752 				int adjust = tie->tim_bitmap+timlen
1753 					   - bo->bo_trailer;
1754 				ovbcopy(bo->bo_trailer, bo->bo_trailer+adjust,
1755 					bo->bo_trailer_len);
1756 				bo->bo_trailer += adjust;
1757 				bo->bo_wme += adjust;
1758 				bo->bo_erp += adjust;
1759 				bo->bo_tim_len = timlen;
1760 
1761 				/* update information element */
1762 				tie->tim_len = 3 + timlen;
1763 				tie->tim_bitctl = timoff;
1764 				len_changed = 1;
1765 			}
1766 			memcpy(tie->tim_bitmap, ic->ic_tim_bitmap + timoff,
1767 				bo->bo_tim_len);
1768 
1769 			ic->ic_flags &= ~IEEE80211_F_TIMUPDATE;
1770 
1771 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
1772 				"%s: TIM updated, pending %u, off %u, len %u\n",
1773 				__func__, ic->ic_ps_pending, timoff, timlen);
1774 		}
1775 		/* count down DTIM period */
1776 		if (tie->tim_count == 0)
1777 			tie->tim_count = tie->tim_period - 1;
1778 		else
1779 			tie->tim_count--;
1780 		/* update state for buffered multicast frames on DTIM */
1781 		if (mcast && tie->tim_count == 0)
1782 			tie->tim_bitctl |= 1;
1783 		else
1784 			tie->tim_bitctl &= ~1;
1785 		if (ic->ic_flags_ext & IEEE80211_FEXT_ERPUPDATE) {
1786 			/*
1787 			 * ERP element needs updating.
1788 			 */
1789 			(void) ieee80211_add_erp(bo->bo_erp, ic);
1790 			ic->ic_flags_ext &= ~IEEE80211_FEXT_ERPUPDATE;
1791 		}
1792 	}
1793 	IEEE80211_BEACON_UNLOCK(ic);
1794 
1795 	return len_changed;
1796 }
1797 
1798 /*
1799  * Save an outbound packet for a node in power-save sleep state.
1800  * The new packet is placed on the node's saved queue, and the TIM
1801  * is changed, if necessary.
1802  */
1803 void
1804 ieee80211_pwrsave(struct ieee80211com *ic, struct ieee80211_node *ni,
1805 		  struct mbuf *m)
1806 {
1807 	int qlen, age;
1808 
1809 	IEEE80211_NODE_SAVEQ_LOCK(ni);
1810 	if (_IF_QFULL(&ni->ni_savedq)) {
1811 		_IF_DROP(&ni->ni_savedq);
1812 		IEEE80211_NODE_SAVEQ_UNLOCK(ni);
1813 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1814 			"[%s] pwr save q overflow, drops %d (size %d)\n",
1815 			ether_sprintf(ni->ni_macaddr),
1816 			ni->ni_savedq.ifq_drops, IEEE80211_PS_MAX_QUEUE);
1817 #ifdef IEEE80211_DEBUG
1818 		if (ieee80211_msg_dumppkts(ic))
1819 			ieee80211_dump_pkt(mtod(m, caddr_t), m->m_len, -1, -1);
1820 #endif
1821 		m_freem(m);
1822 		return;
1823 	}
1824 	/*
1825 	 * Tag the frame with it's expiry time and insert
1826 	 * it in the queue.  The aging interval is 4 times
1827 	 * the listen interval specified by the station.
1828 	 * Frames that sit around too long are reclaimed
1829 	 * using this information.
1830 	 */
1831 	/* XXX handle overflow? */
1832 	age = ((ni->ni_intval * ic->ic_bintval) << 2) / 1024; /* TU -> secs */
1833 	_IEEE80211_NODE_SAVEQ_ENQUEUE(ni, m, qlen, age);
1834 	IEEE80211_NODE_SAVEQ_UNLOCK(ni);
1835 
1836 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
1837 		"[%s] save frame with age %d, %u now queued\n",
1838 		ether_sprintf(ni->ni_macaddr), age, qlen);
1839 
1840 	if (qlen == 1)
1841 		ic->ic_set_tim(ni, 1);
1842 }
1843