Home | History | Annotate | Line # | Download | only in net80211
ieee80211_output.c revision 1.6
      1 /*	$NetBSD: ieee80211_output.c,v 1.6 2003/10/13 04:22:55 dyoung Exp $	*/
      2 /*-
      3  * Copyright (c) 2001 Atsushi Onoe
      4  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. The name of the author may not be used to endorse or promote products
     16  *    derived from this software without specific prior written permission.
     17  *
     18  * Alternatively, this software may be distributed under the terms of the
     19  * GNU General Public License ("GPL") version 2 as published by the Free
     20  * Software Foundation.
     21  *
     22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     32  */
     33 
     34 #include <sys/cdefs.h>
     35 #ifdef __FreeBSD__
     36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_output.c,v 1.5 2003/09/01 02:55:09 sam Exp $");
     37 #else
     38 __KERNEL_RCSID(0, "$NetBSD: ieee80211_output.c,v 1.6 2003/10/13 04:22:55 dyoung Exp $");
     39 #endif
     40 
     41 #include "opt_inet.h"
     42 
     43 #ifdef __NetBSD__
     44 #include "bpfilter.h"
     45 #endif /* __NetBSD__ */
     46 
     47 #include <sys/param.h>
     48 #include <sys/systm.h>
     49 #include <sys/mbuf.h>
     50 #include <sys/malloc.h>
     51 #include <sys/kernel.h>
     52 #include <sys/socket.h>
     53 #include <sys/sockio.h>
     54 #include <sys/endian.h>
     55 #include <sys/errno.h>
     56 #ifdef __FreeBSD__
     57 #include <sys/bus.h>
     58 #endif
     59 #include <sys/proc.h>
     60 #include <sys/sysctl.h>
     61 
     62 #ifdef __FreeBSD__
     63 #include <machine/atomic.h>
     64 #endif
     65 
     66 #include <net/if.h>
     67 #include <net/if_dl.h>
     68 #include <net/if_media.h>
     69 #include <net/if_arp.h>
     70 #ifdef __FreeBSD__
     71 #include <net/ethernet.h>
     72 #else
     73 #include <net/if_ether.h>
     74 #endif
     75 #include <net/if_llc.h>
     76 
     77 #include <net80211/ieee80211_var.h>
     78 #include <net80211/ieee80211_compat.h>
     79 
     80 #if NBPFILTER > 0
     81 #include <net/bpf.h>
     82 #endif
     83 
     84 #ifdef INET
     85 #include <netinet/in.h>
     86 #ifdef __FreeBSD__
     87 #include <netinet/if_ether.h>
     88 #else
     89 #include <net/if_ether.h>
     90 #endif
     91 #endif
     92 
     93 /*
     94  * Send a management frame to the specified node.  The node pointer
     95  * must have a reference as the pointer will be passed to the driver
     96  * and potentially held for a long time.  If the frame is successfully
     97  * dispatched to the driver, then it is responsible for freeing the
     98  * reference (and potentially free'ing up any associated storage).
     99  */
    100 static int
    101 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
    102     struct mbuf *m, int type)
    103 {
    104 	struct ieee80211com *ic = (void *)ifp;
    105 	struct ieee80211_frame *wh;
    106 
    107 	KASSERT(ni != NULL, ("null node"));
    108 	ni->ni_inact = 0;
    109 
    110 	/*
    111 	 * Yech, hack alert!  We want to pass the node down to the
    112 	 * driver's start routine.  If we don't do so then the start
    113 	 * routine must immediately look it up again and that can
    114 	 * cause a lock order reversal if, for example, this frame
    115 	 * is being sent because the station is being timedout and
    116 	 * the frame being sent is a DEAUTH message.  We could stick
    117 	 * this in an m_tag and tack that on to the mbuf.  However
    118 	 * that's rather expensive to do for every frame so instead
    119 	 * we stuff it in the rcvif field since outbound frames do
    120 	 * not (presently) use this.
    121 	 */
    122 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
    123 	if (m == NULL)
    124 		return ENOMEM;
    125 #ifdef __FreeBSD__
    126 	KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
    127 #endif
    128 	m->m_pkthdr.rcvif = (void *)ni;
    129 
    130 	wh = mtod(m, struct ieee80211_frame *);
    131 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
    132 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
    133 	*(u_int16_t *)&wh->i_dur[0] = 0;
    134 	*(u_int16_t *)&wh->i_seq[0] =
    135 	    htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
    136 	ni->ni_txseq++;
    137 	IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
    138 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
    139 	IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
    140 
    141 	if (ifp->if_flags & IFF_DEBUG) {
    142 		/* avoid to print too many frames */
    143 		if (ic->ic_opmode == IEEE80211_M_IBSS ||
    144 #ifdef IEEE80211_DEBUG
    145 		    ieee80211_debug > 1 ||
    146 #endif
    147 		    (type & IEEE80211_FC0_SUBTYPE_MASK) !=
    148 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
    149 			if_printf(ifp, "sending %s to %s on channel %u\n",
    150 			    ieee80211_mgt_subtype_name[
    151 			    (type & IEEE80211_FC0_SUBTYPE_MASK)
    152 			    >> IEEE80211_FC0_SUBTYPE_SHIFT],
    153 			    ether_sprintf(ni->ni_macaddr),
    154 			    ieee80211_chan2ieee(ic, ni->ni_chan));
    155 	}
    156 
    157 	IF_ENQUEUE(&ic->ic_mgtq, m);
    158 	ifp->if_timer = 1;
    159 	(*ifp->if_start)(ifp);
    160 	return 0;
    161 }
    162 
    163 /*
    164  * Encapsulate an outbound data frame.  The mbuf chain is updated and
    165  * a reference to the destination node is returned.  If an error is
    166  * encountered NULL is returned and the node reference will also be NULL.
    167  *
    168  * NB: The caller is responsible for free'ing a returned node reference.
    169  *     The convention is ic_bss is not reference counted; the caller must
    170  *     maintain that.
    171  */
    172 struct mbuf *
    173 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni)
    174 {
    175 	struct ieee80211com *ic = (void *)ifp;
    176 	struct ether_header eh;
    177 	struct ieee80211_frame *wh;
    178 	struct ieee80211_node *ni = NULL;
    179 	struct llc *llc;
    180 
    181 	if (m->m_len < sizeof(struct ether_header)) {
    182 		m = m_pullup(m, sizeof(struct ether_header));
    183 		if (m == NULL) {
    184 			/* XXX statistic */
    185 			goto bad;
    186 		}
    187 	}
    188 	memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
    189 
    190 	if (ic->ic_opmode != IEEE80211_M_STA) {
    191 		ni = ieee80211_find_node(ic, eh.ether_dhost);
    192 		if (ni == NULL) {
    193 			/*
    194 			 * When not in station mode the
    195 			 * destination address should always be
    196 			 * in the node table unless this is a
    197 			 * multicast/broadcast frame.
    198 			 */
    199 			if (!IEEE80211_IS_MULTICAST(eh.ether_dhost)) {
    200 				/* ic->ic_stats.st_tx_nonode++; XXX statistic */
    201 				goto bad;
    202 			}
    203 			ni = ic->ic_bss;
    204 		}
    205 	} else
    206 		ni = ic->ic_bss;
    207 	ni->ni_inact = 0;
    208 
    209 	m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
    210 	llc = mtod(m, struct llc *);
    211 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
    212 	llc->llc_control = LLC_UI;
    213 	llc->llc_snap.org_code[0] = 0;
    214 	llc->llc_snap.org_code[1] = 0;
    215 	llc->llc_snap.org_code[2] = 0;
    216 	llc->llc_snap.ether_type = eh.ether_type;
    217 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
    218 	if (m == NULL)
    219 		goto bad;
    220 	wh = mtod(m, struct ieee80211_frame *);
    221 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
    222 	*(u_int16_t *)&wh->i_dur[0] = 0;
    223 	*(u_int16_t *)&wh->i_seq[0] =
    224 	    htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
    225 	ni->ni_txseq++;
    226 	switch (ic->ic_opmode) {
    227 	case IEEE80211_M_STA:
    228 		wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
    229 		IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
    230 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
    231 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
    232 		break;
    233 	case IEEE80211_M_IBSS:
    234 	case IEEE80211_M_AHDEMO:
    235 		wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
    236 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
    237 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
    238 		IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
    239 		break;
    240 	case IEEE80211_M_HOSTAP:
    241 		wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
    242 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
    243 		IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
    244 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
    245 		break;
    246 	case IEEE80211_M_MONITOR:
    247 		goto bad;
    248 	}
    249 	*pni = ni;
    250 	return m;
    251 bad:
    252 	if (m != NULL)
    253 		m_freem(m);
    254 	if (ni && ni != ic->ic_bss)
    255 		ieee80211_free_node(ic, ni);
    256 	*pni = NULL;
    257 	return NULL;
    258 }
    259 
    260 /*
    261  * Add a supported rates element id to a frame.
    262  */
    263 u_int8_t *
    264 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
    265 {
    266 	int nrates;
    267 
    268 	*frm++ = IEEE80211_ELEMID_RATES;
    269 	nrates = rs->rs_nrates;
    270 	if (nrates > IEEE80211_RATE_SIZE)
    271 		nrates = IEEE80211_RATE_SIZE;
    272 	*frm++ = nrates;
    273 	memcpy(frm, rs->rs_rates, nrates);
    274 	return frm + nrates;
    275 }
    276 
    277 /*
    278  * Add an extended supported rates element id to a frame.
    279  */
    280 u_int8_t *
    281 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
    282 {
    283 	/*
    284 	 * Add an extended supported rates element if operating in 11g mode.
    285 	 */
    286 	if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
    287 		int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
    288 		*frm++ = IEEE80211_ELEMID_XRATES;
    289 		*frm++ = nrates;
    290 		memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
    291 		frm += nrates;
    292 	}
    293 	return frm;
    294 }
    295 
    296 /*
    297  * Add an ssid elemet to a frame.
    298  */
    299 static u_int8_t *
    300 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
    301 {
    302 	*frm++ = IEEE80211_ELEMID_SSID;
    303 	*frm++ = len;
    304 	memcpy(frm, ssid, len);
    305 	return frm + len;
    306 }
    307 
    308 static struct mbuf *
    309 ieee80211_getmbuf(int flags, int type, u_int pktlen)
    310 {
    311 	struct mbuf *m;
    312 
    313 	KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
    314 #ifdef __FreeBSD__
    315 	if (pktlen <= MHLEN)
    316 		MGETHDR(m, flags, type);
    317 	else
    318 		m = m_getcl(flags, type, M_PKTHDR);
    319 #else
    320 	MGETHDR(m, flags, type);
    321 	if (m != NULL && pktlen > MHLEN)
    322 		MCLGET(m, flags);
    323 #endif
    324 	return m;
    325 }
    326 
    327 /*
    328  * Send a management frame.  The node is for the destination (or ic_bss
    329  * when in station mode).  Nodes other than ic_bss have their reference
    330  * count bumped to reflect our use for an indeterminant time.
    331  */
    332 int
    333 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
    334 	int type, int arg)
    335 {
    336 #define	senderr(_x)	do { ret = _x; goto bad; } while (0)
    337 	struct ifnet *ifp = &ic->ic_if;
    338 	struct mbuf *m;
    339 	u_int8_t *frm;
    340 	enum ieee80211_phymode mode;
    341 	u_int16_t capinfo;
    342 	int ret, timer;
    343 
    344 	KASSERT(ni != NULL, ("null node"));
    345 
    346 	/*
    347 	 * Hold a reference on the node so it doesn't go away until after
    348 	 * the xmit is complete all the way in the driver.  On error we
    349 	 * will remove our reference.
    350 	 */
    351 	if (ni != ic->ic_bss)
    352 		ieee80211_ref_node(ni);
    353 	timer = 0;
    354 	switch (type) {
    355 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
    356 		/*
    357 		 * prreq frame format
    358 		 *	[tlv] ssid
    359 		 *	[tlv] supported rates
    360 		 *	[tlv] extended supported rates
    361 		 */
    362 		m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
    363 			 2 + ic->ic_des_esslen
    364 		       + 2 + IEEE80211_RATE_SIZE
    365 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
    366 		if (m == NULL)
    367 			senderr(ENOMEM);
    368 		m->m_data += sizeof(struct ieee80211_frame);
    369 		frm = mtod(m, u_int8_t *);
    370 		frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
    371 		mode = ieee80211_chan2mode(ic, ni->ni_chan);
    372 		frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]);
    373 		frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]);
    374 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
    375 
    376 		timer = IEEE80211_TRANS_WAIT;
    377 		break;
    378 
    379 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
    380 		/*
    381 		 * probe response frame format
    382 		 *	[8] time stamp
    383 		 *	[2] beacon interval
    384 		 *	[2] cabability information
    385 		 *	[tlv] ssid
    386 		 *	[tlv] supported rates
    387 		 *	[tlv] parameter set (IBSS)
    388 		 *	[tlv] extended supported rates
    389 		 */
    390 		m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
    391 			 8 + 2 + 2 + 2
    392 		       + 2 + ni->ni_esslen
    393 		       + 2 + IEEE80211_RATE_SIZE
    394 		       + 6
    395 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
    396 		if (m == NULL)
    397 			senderr(ENOMEM);
    398 		m->m_data += sizeof(struct ieee80211_frame);
    399 		frm = mtod(m, u_int8_t *);
    400 
    401 		memset(frm, 0, 8);	/* timestamp should be filled later */
    402 		frm += 8;
    403 		*(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval);
    404 		frm += 2;
    405 		if (ic->ic_opmode == IEEE80211_M_IBSS)
    406 			capinfo = IEEE80211_CAPINFO_IBSS;
    407 		else
    408 			capinfo = IEEE80211_CAPINFO_ESS;
    409 		if (ic->ic_flags & IEEE80211_F_WEPON)
    410 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
    411 		*(u_int16_t *)frm = htole16(capinfo);
    412 		frm += 2;
    413 
    414 		frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
    415 				ic->ic_bss->ni_esslen);
    416 		frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates);
    417 
    418                 switch (ic->ic_phytype) {
    419                 case IEEE80211_T_FH:
    420                         *frm++ = IEEE80211_ELEMID_FHPARMS;
    421                         *frm++ = 5;
    422                         *frm++ = ni->ni_fhdwell & 0x00ff;
    423                         *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff;
    424                         *frm++ = IEEE80211_FH_CHANSET(
    425 			    ieee80211_chan2ieee(ic, ni->ni_chan));
    426                         *frm++ = IEEE80211_FH_CHANPAT(
    427 			    ieee80211_chan2ieee(ic, ni->ni_chan));
    428                         *frm++ = ni->ni_fhindex;
    429                         break;
    430 		case IEEE80211_T_OFDM:	/* probably multi-mode */
    431 		default:
    432 			if (ieee80211_chan2mode(ic, ni->ni_chan) !=
    433 			    IEEE80211_MODE_11B) {
    434 				if_printf(ifp, "unhandled mode %d for %s\n",
    435 				    ieee80211_chan2mode(ic, ni->ni_chan),
    436 				    ether_sprintf(ni->ni_macaddr));
    437 				break;
    438 			}
    439 			/*FALLTHROUGH*/
    440                 case IEEE80211_T_DS:
    441                         *frm++ = IEEE80211_ELEMID_DSPARMS;
    442                         *frm++ = 1;
    443                         *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
    444                         break;
    445                 }
    446 
    447 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
    448 			*frm++ = IEEE80211_ELEMID_IBSSPARMS;
    449 			*frm++ = 2;
    450 			*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
    451 		} else {	/* IEEE80211_M_HOSTAP */
    452 			/* TODO: TIM */
    453 			*frm++ = IEEE80211_ELEMID_TIM;
    454 			*frm++ = 4;	/* length */
    455 			*frm++ = 0;	/* DTIM count */
    456 			*frm++ = 1;	/* DTIM period */
    457 			*frm++ = 0;	/* bitmap control */
    458 			*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
    459 		}
    460 		frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates);
    461 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
    462 		break;
    463 
    464 	case IEEE80211_FC0_SUBTYPE_AUTH:
    465 		MGETHDR(m, M_DONTWAIT, MT_DATA);
    466 		if (m == NULL)
    467 			senderr(ENOMEM);
    468 		MH_ALIGN(m, 2 * 3);
    469 		m->m_pkthdr.len = m->m_len = 6;
    470 		frm = mtod(m, u_int8_t *);
    471 		/* TODO: shared key auth */
    472 		((u_int16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN);
    473 		((u_int16_t *)frm)[1] = htole16(arg);	/* sequence number */
    474 		((u_int16_t *)frm)[2] = 0;		/* status */
    475 		if (ic->ic_opmode == IEEE80211_M_STA)
    476 			timer = IEEE80211_TRANS_WAIT;
    477 		break;
    478 
    479 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
    480 		if (ifp->if_flags & IFF_DEBUG)
    481 			if_printf(ifp, "station %s deauthenticate (reason %d)\n",
    482 			    ether_sprintf(ni->ni_macaddr), arg);
    483 		MGETHDR(m, M_DONTWAIT, MT_DATA);
    484 		if (m == NULL)
    485 			senderr(ENOMEM);
    486 		MH_ALIGN(m, 2);
    487 		m->m_pkthdr.len = m->m_len = 2;
    488 		*mtod(m, u_int16_t *) = htole16(arg);	/* reason */
    489 		break;
    490 
    491 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
    492 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
    493 		/*
    494 		 * asreq frame format
    495 		 *	[2] capability information
    496 		 *	[2] listen interval
    497 		 *	[6*] current AP address (reassoc only)
    498 		 *	[tlv] ssid
    499 		 *	[tlv] supported rates
    500 		 *	[tlv] extended supported rates
    501 		 */
    502 		m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
    503 			 sizeof(capinfo)
    504 		       + sizeof(u_int16_t)
    505 		       + IEEE80211_ADDR_LEN
    506 		       + 2 + ni->ni_esslen
    507 		       + 2 + IEEE80211_RATE_SIZE
    508 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
    509 		if (m == NULL)
    510 			senderr(ENOMEM);
    511 		m->m_data += sizeof(struct ieee80211_frame);
    512 		frm = mtod(m, u_int8_t *);
    513 
    514 		capinfo = 0;
    515 		if (ic->ic_opmode == IEEE80211_M_IBSS)
    516 			capinfo |= IEEE80211_CAPINFO_IBSS;
    517 		else		/* IEEE80211_M_STA */
    518 			capinfo |= IEEE80211_CAPINFO_ESS;
    519 		if (ic->ic_flags & IEEE80211_F_WEPON)
    520 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
    521 		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
    522 			capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
    523 		if (ic->ic_flags & IEEE80211_F_SHSLOT)
    524 			capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
    525 		*(u_int16_t *)frm = htole16(capinfo);
    526 		frm += 2;
    527 
    528 		*(u_int16_t *)frm = htole16(ic->ic_lintval);
    529 		frm += 2;
    530 
    531 		if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
    532 			IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
    533 			frm += IEEE80211_ADDR_LEN;
    534 		}
    535 
    536 		frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
    537 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
    538 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
    539 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
    540 
    541 		timer = IEEE80211_TRANS_WAIT;
    542 		break;
    543 
    544 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
    545 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
    546 		/*
    547 		 * asreq frame format
    548 		 *	[2] capability information
    549 		 *	[2] status
    550 		 *	[2] association ID
    551 		 *	[tlv] supported rates
    552 		 *	[tlv] extended supported rates
    553 		 */
    554 		m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
    555 			 sizeof(capinfo)
    556 		       + sizeof(u_int16_t)
    557 		       + sizeof(u_int16_t)
    558 		       + 2 + IEEE80211_RATE_SIZE
    559 		       + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
    560 		if (m == NULL)
    561 			senderr(ENOMEM);
    562 		m->m_data += sizeof(struct ieee80211_frame);
    563 		frm = mtod(m, u_int8_t *);
    564 
    565 		capinfo = IEEE80211_CAPINFO_ESS;
    566 		if (ic->ic_flags & IEEE80211_F_WEPON)
    567 			capinfo |= IEEE80211_CAPINFO_PRIVACY;
    568 		*(u_int16_t *)frm = htole16(capinfo);
    569 		frm += 2;
    570 
    571 		*(u_int16_t *)frm = htole16(arg);	/* status */
    572 		frm += 2;
    573 
    574 		if (arg == IEEE80211_STATUS_SUCCESS)
    575 			*(u_int16_t *)frm = htole16(ni->ni_associd);
    576 		frm += 2;
    577 
    578 		frm = ieee80211_add_rates(frm, &ni->ni_rates);
    579 		frm = ieee80211_add_xrates(frm, &ni->ni_rates);
    580 		m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
    581 		break;
    582 
    583 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
    584 		if (ifp->if_flags & IFF_DEBUG)
    585 			if_printf(ifp, "station %s disassociate (reason %d)\n",
    586 			    ether_sprintf(ni->ni_macaddr), arg);
    587 		MGETHDR(m, M_DONTWAIT, MT_DATA);
    588 		if (m == NULL)
    589 			senderr(ENOMEM);
    590 		MH_ALIGN(m, 2);
    591 		m->m_pkthdr.len = m->m_len = 2;
    592 		*mtod(m, u_int16_t *) = htole16(arg);	/* reason */
    593 		break;
    594 
    595 	default:
    596 		IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n",
    597 			__func__, type));
    598 		senderr(EINVAL);
    599 		/* NOTREACHED */
    600 	}
    601 
    602 	ret = ieee80211_mgmt_output(ifp, ni, m, type);
    603 	if (ret == 0) {
    604 		if (timer)
    605 			ic->ic_mgt_timer = timer;
    606 	} else {
    607 bad:
    608 		if (ni != ic->ic_bss)		/* remove ref we added */
    609 			ieee80211_free_node(ic, ni);
    610 	}
    611 	return ret;
    612 #undef senderr
    613 }
    614 
    615 void
    616 ieee80211_pwrsave(struct ieee80211com *ic, struct ieee80211_node *ni,
    617 		  struct mbuf *m)
    618 {
    619 	/* Store the new packet on our queue, changing the TIM if necessary */
    620 
    621 	if (IF_IS_EMPTY(&ni->ni_savedq)) {
    622 		ic->ic_set_tim(ic, ni->ni_associd, 1);
    623 	}
    624 	if (ni->ni_savedq.ifq_len >= IEEE80211_PS_MAX_QUEUE) {
    625 		IF_DROP(&ni->ni_savedq);
    626 		m_freem(m);
    627 		if (ic->ic_if.if_flags & IFF_DEBUG)
    628 			printf("%s: station %s power save queue overflow"
    629 			       " of size %d drops %d\n",
    630 			       ic->ic_if.if_xname,
    631 			       ether_sprintf(ni->ni_macaddr),
    632 			       IEEE80211_PS_MAX_QUEUE,
    633 			       ni->ni_savedq.ifq_drops);
    634 	} else {
    635 		IF_ENQUEUE(&ni->ni_savedq, m);
    636 	}
    637 }
    638 
    639