ieee80211_output.c revision 1.6 1 /* $NetBSD: ieee80211_output.c,v 1.6 2003/10/13 04:22:55 dyoung Exp $ */
2 /*-
3 * Copyright (c) 2001 Atsushi Onoe
4 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
17 *
18 * Alternatively, this software may be distributed under the terms of the
19 * GNU General Public License ("GPL") version 2 as published by the Free
20 * Software Foundation.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 */
33
34 #include <sys/cdefs.h>
35 #ifdef __FreeBSD__
36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_output.c,v 1.5 2003/09/01 02:55:09 sam Exp $");
37 #else
38 __KERNEL_RCSID(0, "$NetBSD: ieee80211_output.c,v 1.6 2003/10/13 04:22:55 dyoung Exp $");
39 #endif
40
41 #include "opt_inet.h"
42
43 #ifdef __NetBSD__
44 #include "bpfilter.h"
45 #endif /* __NetBSD__ */
46
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/mbuf.h>
50 #include <sys/malloc.h>
51 #include <sys/kernel.h>
52 #include <sys/socket.h>
53 #include <sys/sockio.h>
54 #include <sys/endian.h>
55 #include <sys/errno.h>
56 #ifdef __FreeBSD__
57 #include <sys/bus.h>
58 #endif
59 #include <sys/proc.h>
60 #include <sys/sysctl.h>
61
62 #ifdef __FreeBSD__
63 #include <machine/atomic.h>
64 #endif
65
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_media.h>
69 #include <net/if_arp.h>
70 #ifdef __FreeBSD__
71 #include <net/ethernet.h>
72 #else
73 #include <net/if_ether.h>
74 #endif
75 #include <net/if_llc.h>
76
77 #include <net80211/ieee80211_var.h>
78 #include <net80211/ieee80211_compat.h>
79
80 #if NBPFILTER > 0
81 #include <net/bpf.h>
82 #endif
83
84 #ifdef INET
85 #include <netinet/in.h>
86 #ifdef __FreeBSD__
87 #include <netinet/if_ether.h>
88 #else
89 #include <net/if_ether.h>
90 #endif
91 #endif
92
93 /*
94 * Send a management frame to the specified node. The node pointer
95 * must have a reference as the pointer will be passed to the driver
96 * and potentially held for a long time. If the frame is successfully
97 * dispatched to the driver, then it is responsible for freeing the
98 * reference (and potentially free'ing up any associated storage).
99 */
100 static int
101 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
102 struct mbuf *m, int type)
103 {
104 struct ieee80211com *ic = (void *)ifp;
105 struct ieee80211_frame *wh;
106
107 KASSERT(ni != NULL, ("null node"));
108 ni->ni_inact = 0;
109
110 /*
111 * Yech, hack alert! We want to pass the node down to the
112 * driver's start routine. If we don't do so then the start
113 * routine must immediately look it up again and that can
114 * cause a lock order reversal if, for example, this frame
115 * is being sent because the station is being timedout and
116 * the frame being sent is a DEAUTH message. We could stick
117 * this in an m_tag and tack that on to the mbuf. However
118 * that's rather expensive to do for every frame so instead
119 * we stuff it in the rcvif field since outbound frames do
120 * not (presently) use this.
121 */
122 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
123 if (m == NULL)
124 return ENOMEM;
125 #ifdef __FreeBSD__
126 KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
127 #endif
128 m->m_pkthdr.rcvif = (void *)ni;
129
130 wh = mtod(m, struct ieee80211_frame *);
131 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
132 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
133 *(u_int16_t *)&wh->i_dur[0] = 0;
134 *(u_int16_t *)&wh->i_seq[0] =
135 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
136 ni->ni_txseq++;
137 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
138 IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
139 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
140
141 if (ifp->if_flags & IFF_DEBUG) {
142 /* avoid to print too many frames */
143 if (ic->ic_opmode == IEEE80211_M_IBSS ||
144 #ifdef IEEE80211_DEBUG
145 ieee80211_debug > 1 ||
146 #endif
147 (type & IEEE80211_FC0_SUBTYPE_MASK) !=
148 IEEE80211_FC0_SUBTYPE_PROBE_RESP)
149 if_printf(ifp, "sending %s to %s on channel %u\n",
150 ieee80211_mgt_subtype_name[
151 (type & IEEE80211_FC0_SUBTYPE_MASK)
152 >> IEEE80211_FC0_SUBTYPE_SHIFT],
153 ether_sprintf(ni->ni_macaddr),
154 ieee80211_chan2ieee(ic, ni->ni_chan));
155 }
156
157 IF_ENQUEUE(&ic->ic_mgtq, m);
158 ifp->if_timer = 1;
159 (*ifp->if_start)(ifp);
160 return 0;
161 }
162
163 /*
164 * Encapsulate an outbound data frame. The mbuf chain is updated and
165 * a reference to the destination node is returned. If an error is
166 * encountered NULL is returned and the node reference will also be NULL.
167 *
168 * NB: The caller is responsible for free'ing a returned node reference.
169 * The convention is ic_bss is not reference counted; the caller must
170 * maintain that.
171 */
172 struct mbuf *
173 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni)
174 {
175 struct ieee80211com *ic = (void *)ifp;
176 struct ether_header eh;
177 struct ieee80211_frame *wh;
178 struct ieee80211_node *ni = NULL;
179 struct llc *llc;
180
181 if (m->m_len < sizeof(struct ether_header)) {
182 m = m_pullup(m, sizeof(struct ether_header));
183 if (m == NULL) {
184 /* XXX statistic */
185 goto bad;
186 }
187 }
188 memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
189
190 if (ic->ic_opmode != IEEE80211_M_STA) {
191 ni = ieee80211_find_node(ic, eh.ether_dhost);
192 if (ni == NULL) {
193 /*
194 * When not in station mode the
195 * destination address should always be
196 * in the node table unless this is a
197 * multicast/broadcast frame.
198 */
199 if (!IEEE80211_IS_MULTICAST(eh.ether_dhost)) {
200 /* ic->ic_stats.st_tx_nonode++; XXX statistic */
201 goto bad;
202 }
203 ni = ic->ic_bss;
204 }
205 } else
206 ni = ic->ic_bss;
207 ni->ni_inact = 0;
208
209 m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
210 llc = mtod(m, struct llc *);
211 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
212 llc->llc_control = LLC_UI;
213 llc->llc_snap.org_code[0] = 0;
214 llc->llc_snap.org_code[1] = 0;
215 llc->llc_snap.org_code[2] = 0;
216 llc->llc_snap.ether_type = eh.ether_type;
217 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
218 if (m == NULL)
219 goto bad;
220 wh = mtod(m, struct ieee80211_frame *);
221 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
222 *(u_int16_t *)&wh->i_dur[0] = 0;
223 *(u_int16_t *)&wh->i_seq[0] =
224 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
225 ni->ni_txseq++;
226 switch (ic->ic_opmode) {
227 case IEEE80211_M_STA:
228 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
229 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
230 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
231 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
232 break;
233 case IEEE80211_M_IBSS:
234 case IEEE80211_M_AHDEMO:
235 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
236 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
237 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
238 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
239 break;
240 case IEEE80211_M_HOSTAP:
241 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
242 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
243 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
244 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
245 break;
246 case IEEE80211_M_MONITOR:
247 goto bad;
248 }
249 *pni = ni;
250 return m;
251 bad:
252 if (m != NULL)
253 m_freem(m);
254 if (ni && ni != ic->ic_bss)
255 ieee80211_free_node(ic, ni);
256 *pni = NULL;
257 return NULL;
258 }
259
260 /*
261 * Add a supported rates element id to a frame.
262 */
263 u_int8_t *
264 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
265 {
266 int nrates;
267
268 *frm++ = IEEE80211_ELEMID_RATES;
269 nrates = rs->rs_nrates;
270 if (nrates > IEEE80211_RATE_SIZE)
271 nrates = IEEE80211_RATE_SIZE;
272 *frm++ = nrates;
273 memcpy(frm, rs->rs_rates, nrates);
274 return frm + nrates;
275 }
276
277 /*
278 * Add an extended supported rates element id to a frame.
279 */
280 u_int8_t *
281 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
282 {
283 /*
284 * Add an extended supported rates element if operating in 11g mode.
285 */
286 if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
287 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
288 *frm++ = IEEE80211_ELEMID_XRATES;
289 *frm++ = nrates;
290 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
291 frm += nrates;
292 }
293 return frm;
294 }
295
296 /*
297 * Add an ssid elemet to a frame.
298 */
299 static u_int8_t *
300 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
301 {
302 *frm++ = IEEE80211_ELEMID_SSID;
303 *frm++ = len;
304 memcpy(frm, ssid, len);
305 return frm + len;
306 }
307
308 static struct mbuf *
309 ieee80211_getmbuf(int flags, int type, u_int pktlen)
310 {
311 struct mbuf *m;
312
313 KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
314 #ifdef __FreeBSD__
315 if (pktlen <= MHLEN)
316 MGETHDR(m, flags, type);
317 else
318 m = m_getcl(flags, type, M_PKTHDR);
319 #else
320 MGETHDR(m, flags, type);
321 if (m != NULL && pktlen > MHLEN)
322 MCLGET(m, flags);
323 #endif
324 return m;
325 }
326
327 /*
328 * Send a management frame. The node is for the destination (or ic_bss
329 * when in station mode). Nodes other than ic_bss have their reference
330 * count bumped to reflect our use for an indeterminant time.
331 */
332 int
333 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
334 int type, int arg)
335 {
336 #define senderr(_x) do { ret = _x; goto bad; } while (0)
337 struct ifnet *ifp = &ic->ic_if;
338 struct mbuf *m;
339 u_int8_t *frm;
340 enum ieee80211_phymode mode;
341 u_int16_t capinfo;
342 int ret, timer;
343
344 KASSERT(ni != NULL, ("null node"));
345
346 /*
347 * Hold a reference on the node so it doesn't go away until after
348 * the xmit is complete all the way in the driver. On error we
349 * will remove our reference.
350 */
351 if (ni != ic->ic_bss)
352 ieee80211_ref_node(ni);
353 timer = 0;
354 switch (type) {
355 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
356 /*
357 * prreq frame format
358 * [tlv] ssid
359 * [tlv] supported rates
360 * [tlv] extended supported rates
361 */
362 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
363 2 + ic->ic_des_esslen
364 + 2 + IEEE80211_RATE_SIZE
365 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
366 if (m == NULL)
367 senderr(ENOMEM);
368 m->m_data += sizeof(struct ieee80211_frame);
369 frm = mtod(m, u_int8_t *);
370 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
371 mode = ieee80211_chan2mode(ic, ni->ni_chan);
372 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]);
373 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]);
374 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
375
376 timer = IEEE80211_TRANS_WAIT;
377 break;
378
379 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
380 /*
381 * probe response frame format
382 * [8] time stamp
383 * [2] beacon interval
384 * [2] cabability information
385 * [tlv] ssid
386 * [tlv] supported rates
387 * [tlv] parameter set (IBSS)
388 * [tlv] extended supported rates
389 */
390 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
391 8 + 2 + 2 + 2
392 + 2 + ni->ni_esslen
393 + 2 + IEEE80211_RATE_SIZE
394 + 6
395 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
396 if (m == NULL)
397 senderr(ENOMEM);
398 m->m_data += sizeof(struct ieee80211_frame);
399 frm = mtod(m, u_int8_t *);
400
401 memset(frm, 0, 8); /* timestamp should be filled later */
402 frm += 8;
403 *(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval);
404 frm += 2;
405 if (ic->ic_opmode == IEEE80211_M_IBSS)
406 capinfo = IEEE80211_CAPINFO_IBSS;
407 else
408 capinfo = IEEE80211_CAPINFO_ESS;
409 if (ic->ic_flags & IEEE80211_F_WEPON)
410 capinfo |= IEEE80211_CAPINFO_PRIVACY;
411 *(u_int16_t *)frm = htole16(capinfo);
412 frm += 2;
413
414 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
415 ic->ic_bss->ni_esslen);
416 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates);
417
418 switch (ic->ic_phytype) {
419 case IEEE80211_T_FH:
420 *frm++ = IEEE80211_ELEMID_FHPARMS;
421 *frm++ = 5;
422 *frm++ = ni->ni_fhdwell & 0x00ff;
423 *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff;
424 *frm++ = IEEE80211_FH_CHANSET(
425 ieee80211_chan2ieee(ic, ni->ni_chan));
426 *frm++ = IEEE80211_FH_CHANPAT(
427 ieee80211_chan2ieee(ic, ni->ni_chan));
428 *frm++ = ni->ni_fhindex;
429 break;
430 case IEEE80211_T_OFDM: /* probably multi-mode */
431 default:
432 if (ieee80211_chan2mode(ic, ni->ni_chan) !=
433 IEEE80211_MODE_11B) {
434 if_printf(ifp, "unhandled mode %d for %s\n",
435 ieee80211_chan2mode(ic, ni->ni_chan),
436 ether_sprintf(ni->ni_macaddr));
437 break;
438 }
439 /*FALLTHROUGH*/
440 case IEEE80211_T_DS:
441 *frm++ = IEEE80211_ELEMID_DSPARMS;
442 *frm++ = 1;
443 *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
444 break;
445 }
446
447 if (ic->ic_opmode == IEEE80211_M_IBSS) {
448 *frm++ = IEEE80211_ELEMID_IBSSPARMS;
449 *frm++ = 2;
450 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */
451 } else { /* IEEE80211_M_HOSTAP */
452 /* TODO: TIM */
453 *frm++ = IEEE80211_ELEMID_TIM;
454 *frm++ = 4; /* length */
455 *frm++ = 0; /* DTIM count */
456 *frm++ = 1; /* DTIM period */
457 *frm++ = 0; /* bitmap control */
458 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */
459 }
460 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates);
461 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
462 break;
463
464 case IEEE80211_FC0_SUBTYPE_AUTH:
465 MGETHDR(m, M_DONTWAIT, MT_DATA);
466 if (m == NULL)
467 senderr(ENOMEM);
468 MH_ALIGN(m, 2 * 3);
469 m->m_pkthdr.len = m->m_len = 6;
470 frm = mtod(m, u_int8_t *);
471 /* TODO: shared key auth */
472 ((u_int16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN);
473 ((u_int16_t *)frm)[1] = htole16(arg); /* sequence number */
474 ((u_int16_t *)frm)[2] = 0; /* status */
475 if (ic->ic_opmode == IEEE80211_M_STA)
476 timer = IEEE80211_TRANS_WAIT;
477 break;
478
479 case IEEE80211_FC0_SUBTYPE_DEAUTH:
480 if (ifp->if_flags & IFF_DEBUG)
481 if_printf(ifp, "station %s deauthenticate (reason %d)\n",
482 ether_sprintf(ni->ni_macaddr), arg);
483 MGETHDR(m, M_DONTWAIT, MT_DATA);
484 if (m == NULL)
485 senderr(ENOMEM);
486 MH_ALIGN(m, 2);
487 m->m_pkthdr.len = m->m_len = 2;
488 *mtod(m, u_int16_t *) = htole16(arg); /* reason */
489 break;
490
491 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
492 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
493 /*
494 * asreq frame format
495 * [2] capability information
496 * [2] listen interval
497 * [6*] current AP address (reassoc only)
498 * [tlv] ssid
499 * [tlv] supported rates
500 * [tlv] extended supported rates
501 */
502 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
503 sizeof(capinfo)
504 + sizeof(u_int16_t)
505 + IEEE80211_ADDR_LEN
506 + 2 + ni->ni_esslen
507 + 2 + IEEE80211_RATE_SIZE
508 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
509 if (m == NULL)
510 senderr(ENOMEM);
511 m->m_data += sizeof(struct ieee80211_frame);
512 frm = mtod(m, u_int8_t *);
513
514 capinfo = 0;
515 if (ic->ic_opmode == IEEE80211_M_IBSS)
516 capinfo |= IEEE80211_CAPINFO_IBSS;
517 else /* IEEE80211_M_STA */
518 capinfo |= IEEE80211_CAPINFO_ESS;
519 if (ic->ic_flags & IEEE80211_F_WEPON)
520 capinfo |= IEEE80211_CAPINFO_PRIVACY;
521 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
522 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
523 if (ic->ic_flags & IEEE80211_F_SHSLOT)
524 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
525 *(u_int16_t *)frm = htole16(capinfo);
526 frm += 2;
527
528 *(u_int16_t *)frm = htole16(ic->ic_lintval);
529 frm += 2;
530
531 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
532 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
533 frm += IEEE80211_ADDR_LEN;
534 }
535
536 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
537 frm = ieee80211_add_rates(frm, &ni->ni_rates);
538 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
539 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
540
541 timer = IEEE80211_TRANS_WAIT;
542 break;
543
544 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
545 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
546 /*
547 * asreq frame format
548 * [2] capability information
549 * [2] status
550 * [2] association ID
551 * [tlv] supported rates
552 * [tlv] extended supported rates
553 */
554 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
555 sizeof(capinfo)
556 + sizeof(u_int16_t)
557 + sizeof(u_int16_t)
558 + 2 + IEEE80211_RATE_SIZE
559 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
560 if (m == NULL)
561 senderr(ENOMEM);
562 m->m_data += sizeof(struct ieee80211_frame);
563 frm = mtod(m, u_int8_t *);
564
565 capinfo = IEEE80211_CAPINFO_ESS;
566 if (ic->ic_flags & IEEE80211_F_WEPON)
567 capinfo |= IEEE80211_CAPINFO_PRIVACY;
568 *(u_int16_t *)frm = htole16(capinfo);
569 frm += 2;
570
571 *(u_int16_t *)frm = htole16(arg); /* status */
572 frm += 2;
573
574 if (arg == IEEE80211_STATUS_SUCCESS)
575 *(u_int16_t *)frm = htole16(ni->ni_associd);
576 frm += 2;
577
578 frm = ieee80211_add_rates(frm, &ni->ni_rates);
579 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
580 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
581 break;
582
583 case IEEE80211_FC0_SUBTYPE_DISASSOC:
584 if (ifp->if_flags & IFF_DEBUG)
585 if_printf(ifp, "station %s disassociate (reason %d)\n",
586 ether_sprintf(ni->ni_macaddr), arg);
587 MGETHDR(m, M_DONTWAIT, MT_DATA);
588 if (m == NULL)
589 senderr(ENOMEM);
590 MH_ALIGN(m, 2);
591 m->m_pkthdr.len = m->m_len = 2;
592 *mtod(m, u_int16_t *) = htole16(arg); /* reason */
593 break;
594
595 default:
596 IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n",
597 __func__, type));
598 senderr(EINVAL);
599 /* NOTREACHED */
600 }
601
602 ret = ieee80211_mgmt_output(ifp, ni, m, type);
603 if (ret == 0) {
604 if (timer)
605 ic->ic_mgt_timer = timer;
606 } else {
607 bad:
608 if (ni != ic->ic_bss) /* remove ref we added */
609 ieee80211_free_node(ic, ni);
610 }
611 return ret;
612 #undef senderr
613 }
614
615 void
616 ieee80211_pwrsave(struct ieee80211com *ic, struct ieee80211_node *ni,
617 struct mbuf *m)
618 {
619 /* Store the new packet on our queue, changing the TIM if necessary */
620
621 if (IF_IS_EMPTY(&ni->ni_savedq)) {
622 ic->ic_set_tim(ic, ni->ni_associd, 1);
623 }
624 if (ni->ni_savedq.ifq_len >= IEEE80211_PS_MAX_QUEUE) {
625 IF_DROP(&ni->ni_savedq);
626 m_freem(m);
627 if (ic->ic_if.if_flags & IFF_DEBUG)
628 printf("%s: station %s power save queue overflow"
629 " of size %d drops %d\n",
630 ic->ic_if.if_xname,
631 ether_sprintf(ni->ni_macaddr),
632 IEEE80211_PS_MAX_QUEUE,
633 ni->ni_savedq.ifq_drops);
634 } else {
635 IF_ENQUEUE(&ni->ni_savedq, m);
636 }
637 }
638
639