xref: /openbsd-src/sys/net80211/ieee80211_output.c (revision b99ef4df7fac99f3475b694d6cd4990521c99ae6)
1 /*	$OpenBSD: ieee80211_output.c,v 1.132 2020/12/08 15:52:04 stsp Exp $	*/
2 /*	$NetBSD: ieee80211_output.c,v 1.13 2004/05/31 11:02:55 dyoung Exp $	*/
3 
4 /*-
5  * Copyright (c) 2001 Atsushi Onoe
6  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
7  * Copyright (c) 2007-2009 Damien Bergamini
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include "bpfilter.h"
34 #include "vlan.h"
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/mbuf.h>
39 #include <sys/kernel.h>
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/endian.h>
43 #include <sys/errno.h>
44 #include <sys/sysctl.h>
45 
46 #include <net/if.h>
47 #include <net/if_dl.h>
48 #include <net/if_media.h>
49 #include <net/if_llc.h>
50 #include <net/bpf.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/if_ether.h>
54 #include <netinet/ip.h>
55 #ifdef INET6
56 #include <netinet/ip6.h>
57 #endif
58 
59 #if NVLAN > 0
60 #include <net/if_vlan_var.h>
61 #endif
62 
63 #include <net80211/ieee80211_var.h>
64 #include <net80211/ieee80211_priv.h>
65 
66 int	ieee80211_mgmt_output(struct ifnet *, struct ieee80211_node *,
67 	    struct mbuf *, int);
68 int	ieee80211_can_use_ampdu(struct ieee80211com *,
69 	    struct ieee80211_node *);
70 u_int8_t *ieee80211_add_rsn_body(u_int8_t *, struct ieee80211com *,
71 	    const struct ieee80211_node *, int);
72 struct	mbuf *ieee80211_getmgmt(int, int, u_int);
73 struct	mbuf *ieee80211_get_probe_req(struct ieee80211com *,
74 	    struct ieee80211_node *);
75 #ifndef IEEE80211_STA_ONLY
76 struct	mbuf *ieee80211_get_probe_resp(struct ieee80211com *);
77 #endif
78 struct	mbuf *ieee80211_get_auth(struct ieee80211com *,
79 	    struct ieee80211_node *, u_int16_t, u_int16_t);
80 struct	mbuf *ieee80211_get_deauth(struct ieee80211com *,
81 	    struct ieee80211_node *, u_int16_t);
82 struct	mbuf *ieee80211_get_assoc_req(struct ieee80211com *,
83 	    struct ieee80211_node *, int);
84 #ifndef IEEE80211_STA_ONLY
85 struct	mbuf *ieee80211_get_assoc_resp(struct ieee80211com *,
86 	    struct ieee80211_node *, u_int16_t);
87 #endif
88 struct	mbuf *ieee80211_get_disassoc(struct ieee80211com *,
89 	    struct ieee80211_node *, u_int16_t);
90 struct	mbuf *ieee80211_get_addba_req(struct ieee80211com *,
91 	    struct ieee80211_node *, u_int8_t);
92 struct	mbuf *ieee80211_get_addba_resp(struct ieee80211com *,
93 	    struct ieee80211_node *, u_int8_t, u_int8_t, u_int16_t);
94 struct	mbuf *ieee80211_get_delba(struct ieee80211com *,
95 	    struct ieee80211_node *, u_int8_t, u_int8_t, u_int16_t);
96 uint8_t *ieee80211_add_wme_info(uint8_t *, struct ieee80211com *);
97 #ifndef IEEE80211_STA_ONLY
98 uint8_t *ieee80211_add_wme_param(uint8_t *, struct ieee80211com *);
99 #endif
100 struct	mbuf *ieee80211_get_sa_query(struct ieee80211com *,
101 	    struct ieee80211_node *, u_int8_t);
102 struct	mbuf *ieee80211_get_action(struct ieee80211com *,
103 	    struct ieee80211_node *, u_int8_t, u_int8_t, int);
104 
105 /*
106  * IEEE 802.11 output routine. Normally this will directly call the
107  * Ethernet output routine because 802.11 encapsulation is called
108  * later by the driver. This function can be used to send raw frames
109  * if the mbuf has been tagged with a 802.11 data link type.
110  */
111 int
112 ieee80211_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
113     struct rtentry *rt)
114 {
115 	struct ieee80211_frame *wh;
116 	struct m_tag *mtag;
117 	int error = 0;
118 
119 	/* Interface has to be up and running */
120 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) !=
121 	    (IFF_UP | IFF_RUNNING)) {
122 		error = ENETDOWN;
123 		goto bad;
124 	}
125 
126 	/* Try to get the DLT from a mbuf tag */
127 	if ((mtag = m_tag_find(m, PACKET_TAG_DLT, NULL)) != NULL) {
128 		struct ieee80211com *ic = (void *)ifp;
129 		u_int dlt = *(u_int *)(mtag + 1);
130 
131 		/* Fallback to ethernet for non-802.11 linktypes */
132 		if (!(dlt == DLT_IEEE802_11 || dlt == DLT_IEEE802_11_RADIO))
133 			goto fallback;
134 
135 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min))
136 			return (EINVAL);
137 		wh = mtod(m, struct ieee80211_frame *);
138 		if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
139 		    IEEE80211_FC0_VERSION_0)
140 			return (EINVAL);
141 		if (!(ic->ic_caps & IEEE80211_C_RAWCTL) &&
142 		    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
143 		    IEEE80211_FC0_TYPE_CTL)
144 			return (EINVAL);
145 
146 		return (if_enqueue(ifp, m));
147 	}
148 
149  fallback:
150 	return (ether_output(ifp, m, dst, rt));
151 
152  bad:
153 	m_freem(m);
154 	return (error);
155 }
156 
157 /*
158  * Send a management frame to the specified node.  The node pointer
159  * must have a reference as the pointer will be passed to the driver
160  * and potentially held for a long time.  If the frame is successfully
161  * dispatched to the driver, then it is responsible for freeing the
162  * reference (and potentially free'ing up any associated storage).
163  */
164 int
165 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
166     struct mbuf *m, int type)
167 {
168 	struct ieee80211com *ic = (void *)ifp;
169 	struct ieee80211_frame *wh;
170 
171 	if (ni == NULL)
172 		panic("null node");
173 	ni->ni_inact = 0;
174 
175 	/*
176 	 * We want to pass the node down to the driver's start
177 	 * routine.  We could stick this in an m_tag and tack that
178 	 * on to the mbuf.  However that's rather expensive to do
179 	 * for every frame so instead we stuff it in a special pkthdr
180 	 * field.
181 	 */
182 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
183 	if (m == NULL)
184 		return ENOMEM;
185 	m->m_pkthdr.ph_cookie = ni;
186 
187 	wh = mtod(m, struct ieee80211_frame *);
188 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
189 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
190 	*(u_int16_t *)&wh->i_dur[0] = 0;
191 	*(u_int16_t *)&wh->i_seq[0] =
192 	    htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
193 	ni->ni_txseq = (ni->ni_txseq + 1) & 0xfff;
194 	IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
195 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
196 	IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
197 
198 	/* check if protection is required for this mgmt frame */
199 	if ((ic->ic_caps & IEEE80211_C_MFP) &&
200 	    (type == IEEE80211_FC0_SUBTYPE_DISASSOC ||
201 	     type == IEEE80211_FC0_SUBTYPE_DEAUTH ||
202 	     type == IEEE80211_FC0_SUBTYPE_ACTION)) {
203 		/*
204 		 * Hack: we should not set the Protected bit in outgoing
205 		 * group management frames, however it is used as an
206 		 * indication to the drivers that they must encrypt the
207 		 * frame.  Drivers should clear this bit from group
208 		 * management frames (software crypto code will do it).
209 		 * XXX could use an mbuf flag..
210 		 */
211 		if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
212 		    (ni->ni_flags & IEEE80211_NODE_TXMGMTPROT))
213 			wh->i_fc[1] |= IEEE80211_FC1_PROTECTED;
214 	}
215 
216 	if (ifp->if_flags & IFF_DEBUG) {
217 		/* avoid to print too many frames */
218 		if (
219 #ifndef IEEE80211_STA_ONLY
220 		    ic->ic_opmode == IEEE80211_M_IBSS ||
221 #endif
222 #ifdef IEEE80211_DEBUG
223 		    ieee80211_debug > 1 ||
224 #endif
225 		    (type & IEEE80211_FC0_SUBTYPE_MASK) !=
226 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
227 			printf("%s: sending %s to %s on channel %u mode %s\n",
228 			    ifp->if_xname,
229 			    ieee80211_mgt_subtype_name[
230 			    (type & IEEE80211_FC0_SUBTYPE_MASK)
231 			    >> IEEE80211_FC0_SUBTYPE_SHIFT],
232 			    ether_sprintf(ni->ni_macaddr),
233 			    ieee80211_chan2ieee(ic, ni->ni_chan),
234 			    ieee80211_phymode_name[ic->ic_curmode]);
235 	}
236 
237 #ifndef IEEE80211_STA_ONLY
238 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
239 	    ieee80211_pwrsave(ic, m, ni) != 0)
240 		return 0;
241 #endif
242 	mq_enqueue(&ic->ic_mgtq, m);
243 	ifp->if_timer = 1;
244 	if_start(ifp);
245 	return 0;
246 }
247 
248 /*-
249  * EDCA tables are computed using the following formulas:
250  *
251  * 1) EDCATable (non-AP QSTA)
252  *
253  * AC     CWmin 	   CWmax	   AIFSN  TXOP limit(ms)
254  * -------------------------------------------------------------
255  * AC_BK  aCWmin	   aCWmax	   7	  0
256  * AC_BE  aCWmin	   aCWmax	   3	  0
257  * AC_VI  (aCWmin+1)/2-1   aCWmin	   2	  agn=3.008 b=6.016 others=0
258  * AC_VO  (aCWmin+1)/4-1   (aCWmin+1)/2-1  2	  agn=1.504 b=3.264 others=0
259  *
260  * 2) QAPEDCATable (QAP)
261  *
262  * AC     CWmin 	   CWmax	   AIFSN  TXOP limit(ms)
263  * -------------------------------------------------------------
264  * AC_BK  aCWmin	   aCWmax	   7	  0
265  * AC_BE  aCWmin	   4*(aCWmin+1)-1  3	  0
266  * AC_VI  (aCWmin+1)/2-1   aCWmin	   1	  agn=3.008 b=6.016 others=0
267  * AC_VO  (aCWmin+1)/4-1   (aCWmin+1)/2-1  1	  agn=1.504 b=3.264 others=0
268  *
269  * and the following aCWmin/aCWmax values:
270  *
271  * PHY		aCWmin	aCWmax
272  * ---------------------------
273  * 11A		15	1023
274  * 11B  	31	1023
275  * 11G		15*	1023	(*) aCWmin(1)
276  * 11N		15	1023
277  */
278 const struct ieee80211_edca_ac_params
279     ieee80211_edca_table[IEEE80211_MODE_MAX][EDCA_NUM_AC] = {
280 	[IEEE80211_MODE_11B] = {
281 		[EDCA_AC_BK] = { 5, 10, 7,   0 },
282 		[EDCA_AC_BE] = { 5, 10, 3,   0 },
283 		[EDCA_AC_VI] = { 4,  5, 2, 188 },
284 		[EDCA_AC_VO] = { 3,  4, 2, 102 }
285 	},
286 	[IEEE80211_MODE_11A] = {
287 		[EDCA_AC_BK] = { 4, 10, 7,   0 },
288 		[EDCA_AC_BE] = { 4, 10, 3,   0 },
289 		[EDCA_AC_VI] = { 3,  4, 2,  94 },
290 		[EDCA_AC_VO] = { 2,  3, 2,  47 }
291 	},
292 	[IEEE80211_MODE_11G] = {
293 		[EDCA_AC_BK] = { 4, 10, 7,   0 },
294 		[EDCA_AC_BE] = { 4, 10, 3,   0 },
295 		[EDCA_AC_VI] = { 3,  4, 2,  94 },
296 		[EDCA_AC_VO] = { 2,  3, 2,  47 }
297 	},
298 	[IEEE80211_MODE_11N] = {
299 		[EDCA_AC_BK] = { 4, 10, 7,   0 },
300 		[EDCA_AC_BE] = { 4, 10, 3,   0 },
301 		[EDCA_AC_VI] = { 3,  4, 2,  94 },
302 		[EDCA_AC_VO] = { 2,  3, 2,  47 }
303 	},
304 };
305 
306 #ifndef IEEE80211_STA_ONLY
307 const struct ieee80211_edca_ac_params
308     ieee80211_qap_edca_table[IEEE80211_MODE_MAX][EDCA_NUM_AC] = {
309 	[IEEE80211_MODE_11B] = {
310 		[EDCA_AC_BK] = { 5, 10, 7,   0 },
311 		[EDCA_AC_BE] = { 5,  7, 3,   0 },
312 		[EDCA_AC_VI] = { 4,  5, 1, 188 },
313 		[EDCA_AC_VO] = { 3,  4, 1, 102 }
314 	},
315 	[IEEE80211_MODE_11A] = {
316 		[EDCA_AC_BK] = { 4, 10, 7,   0 },
317 		[EDCA_AC_BE] = { 4,  6, 3,   0 },
318 		[EDCA_AC_VI] = { 3,  4, 1,  94 },
319 		[EDCA_AC_VO] = { 2,  3, 1,  47 }
320 	},
321 	[IEEE80211_MODE_11G] = {
322 		[EDCA_AC_BK] = { 4, 10, 7,   0 },
323 		[EDCA_AC_BE] = { 4,  6, 3,   0 },
324 		[EDCA_AC_VI] = { 3,  4, 1,  94 },
325 		[EDCA_AC_VO] = { 2,  3, 1,  47 }
326 	},
327 	[IEEE80211_MODE_11N] = {
328 		[EDCA_AC_BK] = { 4, 10, 7,   0 },
329 		[EDCA_AC_BE] = { 4,  6, 3,   0 },
330 		[EDCA_AC_VI] = { 3,  4, 1,  94 },
331 		[EDCA_AC_VO] = { 2,  3, 1,  47 }
332 	},
333 };
334 #endif	/* IEEE80211_STA_ONLY */
335 
336 /*
337  * Return the EDCA Access Category to be used for transmitting a frame with
338  * user-priority `up'.
339  */
340 enum ieee80211_edca_ac
341 ieee80211_up_to_ac(struct ieee80211com *ic, int up)
342 {
343 	/* see Table 9-1 */
344 	static const enum ieee80211_edca_ac up_to_ac[] = {
345 		EDCA_AC_BE,	/* BE */
346 		EDCA_AC_BK,	/* BK */
347 		EDCA_AC_BK,	/* -- */
348 		EDCA_AC_BE,	/* EE */
349 		EDCA_AC_VI,	/* CL */
350 		EDCA_AC_VI,	/* VI */
351 		EDCA_AC_VO,	/* VO */
352 		EDCA_AC_VO	/* NC */
353 	};
354 	enum ieee80211_edca_ac ac;
355 
356 	ac = (up <= 7) ? up_to_ac[up] : EDCA_AC_BE;
357 
358 #ifndef IEEE80211_STA_ONLY
359 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
360 		return ac;
361 #endif
362 	/*
363 	 * We do not support the admission control procedure defined in
364 	 * IEEE Std 802.11-2012 section 9.19.4.2.3. The spec says that
365 	 * non-AP QSTAs that don't support this procedure shall use EDCA
366 	 * parameters of a lower priority AC that does not require
367 	 * admission control.
368 	 */
369 	while (ac != EDCA_AC_BK && ic->ic_edca_ac[ac].ac_acm) {
370 		switch (ac) {
371 		case EDCA_AC_BK:
372 			/* can't get there */
373 			break;
374 		case EDCA_AC_BE:
375 			/* BE shouldn't require admission control */
376 			ac = EDCA_AC_BK;
377 			break;
378 		case EDCA_AC_VI:
379 			ac = EDCA_AC_BE;
380 			break;
381 		case EDCA_AC_VO:
382 			ac = EDCA_AC_VI;
383 			break;
384 		}
385 	}
386 	return ac;
387 }
388 
389 /*
390  * Get mbuf's user-priority: if mbuf is not VLAN tagged, select user-priority
391  * based on the DSCP (Differentiated Services Codepoint) field.
392  */
393 int
394 ieee80211_classify(struct ieee80211com *ic, struct mbuf *m)
395 {
396 	struct ether_header eh;
397 	u_int8_t ds_field;
398 #if NVLAN > 0
399 	if (m->m_flags & M_VLANTAG)	/* use VLAN 802.1D user-priority */
400 		return EVL_PRIOFTAG(m->m_pkthdr.ether_vtag);
401 #endif
402 	m_copydata(m, 0, sizeof(eh), (caddr_t)&eh);
403 	if (eh.ether_type == htons(ETHERTYPE_IP)) {
404 		struct ip ip;
405 		m_copydata(m, sizeof(eh), sizeof(ip), (caddr_t)&ip);
406 		if (ip.ip_v != 4)
407 			return 0;
408 		ds_field = ip.ip_tos;
409 	}
410 #ifdef INET6
411 	else if (eh.ether_type == htons(ETHERTYPE_IPV6)) {
412 		struct ip6_hdr ip6;
413 		u_int32_t flowlabel;
414 		m_copydata(m, sizeof(eh), sizeof(ip6), (caddr_t)&ip6);
415 		flowlabel = ntohl(ip6.ip6_flow);
416 		if ((flowlabel >> 28) != 6)
417 			return 0;
418 		ds_field = (flowlabel >> 20) & 0xff;
419 	}
420 #endif	/* INET6 */
421 	else	/* neither IPv4 nor IPv6 */
422 		return 0;
423 
424 	/*
425 	 * Map Differentiated Services Codepoint field (see RFC2474).
426 	 * Preserves backward compatibility with IP Precedence field.
427 	 */
428 	switch (ds_field & 0xfc) {
429 	case IPTOS_PREC_PRIORITY:
430 		return EDCA_AC_VI;
431 	case IPTOS_PREC_IMMEDIATE:
432 		return EDCA_AC_BK;
433 	case IPTOS_PREC_FLASH:
434 	case IPTOS_PREC_FLASHOVERRIDE:
435 	case IPTOS_PREC_CRITIC_ECP:
436 	case IPTOS_PREC_INTERNETCONTROL:
437 	case IPTOS_PREC_NETCONTROL:
438 		return EDCA_AC_VO;
439 	default:
440 		return EDCA_AC_BE;
441 	}
442 }
443 
444 int
445 ieee80211_can_use_ampdu(struct ieee80211com *ic, struct ieee80211_node *ni)
446 {
447 	return (ni->ni_flags & IEEE80211_NODE_HT) &&
448 	    (ic->ic_caps & IEEE80211_C_TX_AMPDU) &&
449 	    !(ic->ic_opmode == IEEE80211_M_STA && ni != ic->ic_bss) &&
450 	    /*
451 	     * Don't use A-MPDU on non-encrypted networks. There are devices
452 	     * with buggy firmware which allow an attacker to inject 802.11
453 	     * frames into a wifi network by embedding rouge A-MPDU subframes
454 	     * in an arbitrary data payload (e.g. PNG images) which may end
455 	     * up appearing as actual frames after de-aggregation by a buggy
456 	     * device; see https://github.com/rpp0/aggr-inject for details.
457 	     * WPA2 prevents this injection attack since the attacker would
458 	     * need to inject frames which get decrypted correctly.
459 	     */
460 	    ((ic->ic_flags & IEEE80211_F_RSNON) &&
461 	      (ni->ni_rsnprotos & IEEE80211_PROTO_RSN));
462 }
463 
464 void
465 ieee80211_tx_compressed_bar(struct ieee80211com *ic, struct ieee80211_node *ni,
466     int tid, uint16_t ssn)
467 {
468 	struct ifnet *ifp = &ic->ic_if;
469 	struct mbuf *m;
470 
471 	m = ieee80211_get_compressed_bar(ic, ni, tid, ssn);
472 	if (m == NULL)
473 		return;
474 
475 	ieee80211_ref_node(ni);
476 	if (mq_enqueue(&ic->ic_mgtq, m) == 0)
477 		if_start(ifp);
478 	else
479 		ieee80211_release_node(ic, ni);
480 }
481 
482 /*
483  * Encapsulate an outbound data frame.  The mbuf chain is updated and
484  * a reference to the destination node is returned.  If an error is
485  * encountered NULL is returned and the node reference will also be NULL.
486  *
487  * NB: The caller is responsible for free'ing a returned node reference.
488  *     The convention is ic_bss is not reference counted; the caller must
489  *     maintain that.
490  */
491 struct mbuf *
492 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni)
493 {
494 	struct ieee80211com *ic = (void *)ifp;
495 	struct ether_header eh;
496 	struct ieee80211_frame *wh;
497 	struct ieee80211_node *ni = NULL;
498 	struct llc *llc;
499 	struct m_tag *mtag;
500 	u_int8_t *addr;
501 	u_int dlt, hdrlen;
502 	int addqos, tid;
503 
504 	/* Handle raw frames if mbuf is tagged as 802.11 */
505 	if ((mtag = m_tag_find(m, PACKET_TAG_DLT, NULL)) != NULL) {
506 		dlt = *(u_int *)(mtag + 1);
507 
508 		if (!(dlt == DLT_IEEE802_11 || dlt == DLT_IEEE802_11_RADIO))
509 			goto fallback;
510 
511 		wh = mtod(m, struct ieee80211_frame *);
512 		switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
513 		case IEEE80211_FC1_DIR_NODS:
514 		case IEEE80211_FC1_DIR_FROMDS:
515 			addr = wh->i_addr1;
516 			break;
517 		case IEEE80211_FC1_DIR_DSTODS:
518 		case IEEE80211_FC1_DIR_TODS:
519 			addr = wh->i_addr3;
520 			break;
521 		default:
522 			goto bad;
523 		}
524 
525 		ni = ieee80211_find_txnode(ic, addr);
526 		if (ni == NULL)
527 			ni = ieee80211_ref_node(ic->ic_bss);
528 		if (ni == NULL) {
529 			printf("%s: no node for dst %s, "
530 			    "discard raw tx frame\n", ifp->if_xname,
531 			    ether_sprintf(addr));
532 			ic->ic_stats.is_tx_nonode++;
533 			goto bad;
534 		}
535 		ni->ni_inact = 0;
536 
537 		*pni = ni;
538 		return (m);
539 	}
540 
541  fallback:
542 	if (m->m_len < sizeof(struct ether_header)) {
543 		m = m_pullup(m, sizeof(struct ether_header));
544 		if (m == NULL) {
545 			ic->ic_stats.is_tx_nombuf++;
546 			goto bad;
547 		}
548 	}
549 	memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
550 
551 	ni = ieee80211_find_txnode(ic, eh.ether_dhost);
552 	if (ni == NULL) {
553 		DPRINTF(("no node for dst %s, discard frame\n",
554 		    ether_sprintf(eh.ether_dhost)));
555 		ic->ic_stats.is_tx_nonode++;
556 		goto bad;
557 	}
558 
559 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
560 	    !ni->ni_port_valid &&
561 	    eh.ether_type != htons(ETHERTYPE_PAE)) {
562 		DPRINTF(("port not valid: %s\n",
563 		    ether_sprintf(eh.ether_dhost)));
564 		ic->ic_stats.is_tx_noauth++;
565 		goto bad;
566 	}
567 
568 	if ((ic->ic_flags & IEEE80211_F_COUNTERM) &&
569 	    ni->ni_rsncipher == IEEE80211_CIPHER_TKIP)
570 		/* XXX TKIP countermeasures! */;
571 
572 	ni->ni_inact = 0;
573 
574 	if ((ic->ic_flags & IEEE80211_F_QOS) &&
575 	    (ni->ni_flags & IEEE80211_NODE_QOS) &&
576 	    /* do not QoS-encapsulate EAPOL frames */
577 	    eh.ether_type != htons(ETHERTYPE_PAE)) {
578 		struct ieee80211_tx_ba *ba;
579 		tid = ieee80211_classify(ic, m);
580 		ba = &ni->ni_tx_ba[tid];
581 		/* We use QoS data frames for aggregation only. */
582 		if (ba->ba_state != IEEE80211_BA_AGREED) {
583 			hdrlen = sizeof(struct ieee80211_frame);
584 			addqos = 0;
585 			if (ieee80211_can_use_ampdu(ic, ni))
586 				ieee80211_node_trigger_addba_req(ni, tid);
587 		} else {
588 			hdrlen = sizeof(struct ieee80211_qosframe);
589 			addqos = 1;
590 		}
591 	} else {
592 		hdrlen = sizeof(struct ieee80211_frame);
593 		addqos = 0;
594 	}
595 	m_adj(m, sizeof(struct ether_header) - LLC_SNAPFRAMELEN);
596 	llc = mtod(m, struct llc *);
597 	llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
598 	llc->llc_control = LLC_UI;
599 	llc->llc_snap.org_code[0] = 0;
600 	llc->llc_snap.org_code[1] = 0;
601 	llc->llc_snap.org_code[2] = 0;
602 	llc->llc_snap.ether_type = eh.ether_type;
603 	M_PREPEND(m, hdrlen, M_DONTWAIT);
604 	if (m == NULL) {
605 		ic->ic_stats.is_tx_nombuf++;
606 		goto bad;
607 	}
608 	wh = mtod(m, struct ieee80211_frame *);
609 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
610 	*(u_int16_t *)&wh->i_dur[0] = 0;
611 	if (addqos) {
612 		struct ieee80211_qosframe *qwh =
613 		    (struct ieee80211_qosframe *)wh;
614 		u_int16_t qos = tid;
615 
616 		if (ic->ic_tid_noack & (1 << tid))
617 			qos |= IEEE80211_QOS_ACK_POLICY_NOACK;
618 		else {
619 			/* Use HT immediate block-ack. */
620 			qos |= IEEE80211_QOS_ACK_POLICY_NORMAL;
621 		}
622 		qwh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS;
623 		*(u_int16_t *)qwh->i_qos = htole16(qos);
624 		*(u_int16_t *)qwh->i_seq =
625 		    htole16(ni->ni_qos_txseqs[tid] << IEEE80211_SEQ_SEQ_SHIFT);
626 		ni->ni_qos_txseqs[tid] = (ni->ni_qos_txseqs[tid] + 1) & 0xfff;
627 	} else {
628 		*(u_int16_t *)&wh->i_seq[0] =
629 		    htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
630 		ni->ni_txseq = (ni->ni_txseq + 1) & 0xfff;
631 	}
632 	switch (ic->ic_opmode) {
633 	case IEEE80211_M_STA:
634 		wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
635 		IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
636 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
637 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
638 		break;
639 #ifndef IEEE80211_STA_ONLY
640 	case IEEE80211_M_IBSS:
641 	case IEEE80211_M_AHDEMO:
642 		wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
643 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
644 		IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
645 		IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_bss->ni_bssid);
646 		break;
647 	case IEEE80211_M_HOSTAP:
648 		wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
649 		IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
650 		IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
651 		IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
652 		break;
653 #endif
654 	default:
655 		/* should not get there */
656 		goto bad;
657 	}
658 
659 	if ((ic->ic_flags & IEEE80211_F_WEPON) ||
660 	    ((ic->ic_flags & IEEE80211_F_RSNON) &&
661 	     (ni->ni_flags & IEEE80211_NODE_TXPROT)))
662 		wh->i_fc[1] |= IEEE80211_FC1_PROTECTED;
663 
664 #ifndef IEEE80211_STA_ONLY
665 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
666 	    ieee80211_pwrsave(ic, m, ni) != 0) {
667 		*pni = NULL;
668 		return NULL;
669 	}
670 #endif
671 	*pni = ni;
672 	return m;
673 bad:
674 	m_freem(m);
675 	if (ni != NULL)
676 		ieee80211_release_node(ic, ni);
677 	*pni = NULL;
678 	return NULL;
679 }
680 
681 /*
682  * Add a Capability Information field to a frame (see 7.3.1.4).
683  */
684 u_int8_t *
685 ieee80211_add_capinfo(u_int8_t *frm, struct ieee80211com *ic,
686     const struct ieee80211_node *ni)
687 {
688 	u_int16_t capinfo;
689 
690 #ifndef IEEE80211_STA_ONLY
691 	if (ic->ic_opmode == IEEE80211_M_IBSS)
692 		capinfo = IEEE80211_CAPINFO_IBSS;
693 	else if (ic->ic_opmode == IEEE80211_M_HOSTAP)
694 		capinfo = IEEE80211_CAPINFO_ESS;
695 	else
696 #endif
697 		capinfo = 0;
698 #ifndef IEEE80211_STA_ONLY
699 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
700 	    (ic->ic_flags & (IEEE80211_F_WEPON | IEEE80211_F_RSNON)))
701 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
702 #endif
703 	/* NB: some 11a AP's reject the request when short preamble is set */
704 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
705 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
706 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
707 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
708 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
709 	LE_WRITE_2(frm, capinfo);
710 	return frm + 2;
711 }
712 
713 /*
714  * Add an SSID element to a frame (see 7.3.2.1).
715  */
716 u_int8_t *
717 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
718 {
719 	*frm++ = IEEE80211_ELEMID_SSID;
720 	*frm++ = len;
721 	memcpy(frm, ssid, len);
722 	return frm + len;
723 }
724 
725 /*
726  * Add a supported rates element to a frame (see 7.3.2.2).
727  */
728 u_int8_t *
729 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
730 {
731 	int nrates;
732 
733 	*frm++ = IEEE80211_ELEMID_RATES;
734 	nrates = min(rs->rs_nrates, IEEE80211_RATE_SIZE);
735 	*frm++ = nrates;
736 	memcpy(frm, rs->rs_rates, nrates);
737 	return frm + nrates;
738 }
739 
740 #ifndef IEEE80211_STA_ONLY
741 /*
742  * Add a DS Parameter Set element to a frame (see 7.3.2.4).
743  */
744 u_int8_t *
745 ieee80211_add_ds_params(u_int8_t *frm, struct ieee80211com *ic,
746     const struct ieee80211_node *ni)
747 {
748 	*frm++ = IEEE80211_ELEMID_DSPARMS;
749 	*frm++ = 1;
750 	*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
751 	return frm;
752 }
753 
754 /*
755  * Add a TIM element to a frame (see 7.3.2.6 and Annex L).
756  */
757 u_int8_t *
758 ieee80211_add_tim(u_int8_t *frm, struct ieee80211com *ic)
759 {
760 	u_int i, offset = 0, len;
761 
762 	/* find first non-zero octet in the virtual bit map */
763 	for (i = 0; i < ic->ic_tim_len && ic->ic_tim_bitmap[i] == 0; i++);
764 
765 	/* clear the lsb as it is reserved for the broadcast indication bit */
766 	if (i < ic->ic_tim_len)
767 		offset = i & ~1;
768 
769 	/* find last non-zero octet in the virtual bit map */
770 	for (i = ic->ic_tim_len - 1; i > 0 && ic->ic_tim_bitmap[i] == 0; i--);
771 
772 	len = i - offset + 1;
773 
774 	*frm++ = IEEE80211_ELEMID_TIM;
775 	*frm++ = len + 3;		/* length */
776 	*frm++ = ic->ic_dtim_count;	/* DTIM count */
777 	*frm++ = ic->ic_dtim_period;	/* DTIM period */
778 
779 	/* Bitmap Control */
780 	*frm = offset;
781 	/* set broadcast/multicast indication bit if necessary */
782 	if (ic->ic_dtim_count == 0 && ic->ic_tim_mcast_pending)
783 		*frm |= 0x01;
784 	frm++;
785 
786 	/* Partial Virtual Bitmap */
787 	memcpy(frm, &ic->ic_tim_bitmap[offset], len);
788 	return frm + len;
789 }
790 
791 /*
792  * Add an IBSS Parameter Set element to a frame (see 7.3.2.7).
793  */
794 u_int8_t *
795 ieee80211_add_ibss_params(u_int8_t *frm, const struct ieee80211_node *ni)
796 {
797 	*frm++ = IEEE80211_ELEMID_IBSSPARMS;
798 	*frm++ = 2;
799 	LE_WRITE_2(frm, 0);	/* TODO: ATIM window */
800 	return frm + 2;
801 }
802 
803 /*
804  * Add an EDCA Parameter Set element to a frame (see 7.3.2.29).
805  */
806 u_int8_t *
807 ieee80211_add_edca_params(u_int8_t *frm, struct ieee80211com *ic)
808 {
809 	const struct ieee80211_edca_ac_params *edca;
810 	int aci;
811 
812 	*frm++ = IEEE80211_ELEMID_EDCAPARMS;
813 	*frm++ = 18;	/* length */
814 	*frm++ = 0;	/* QoS Info */
815 	*frm++ = 0;	/* reserved */
816 
817 	/* setup AC Parameter Records */
818 	edca = ieee80211_edca_table[ic->ic_curmode];
819 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
820 		const struct ieee80211_edca_ac_params *ac = &edca[aci];
821 
822 		*frm++ = (aci << 5) | ((ac->ac_acm & 0x1) << 4) |
823 			 (ac->ac_aifsn & 0xf);
824 		*frm++ = (ac->ac_ecwmax << 4) |
825 			 (ac->ac_ecwmin & 0xf);
826 		LE_WRITE_2(frm, ac->ac_txoplimit); frm += 2;
827 	}
828 	return frm;
829 }
830 
831 /*
832  * Add an ERP element to a frame (see 7.3.2.13).
833  */
834 u_int8_t *
835 ieee80211_add_erp(u_int8_t *frm, struct ieee80211com *ic)
836 {
837 	u_int8_t erp;
838 	int nonerpsta = 0;
839 
840 	*frm++ = IEEE80211_ELEMID_ERP;
841 	*frm++ = 1;
842 	erp = 0;
843 	/*
844 	 * The NonERP_Present bit shall be set to 1 when a NonERP STA
845 	 * is associated with the BSS.
846 	 */
847 	ieee80211_iterate_nodes(ic, ieee80211_count_nonerpsta, &nonerpsta);
848 	if (nonerpsta != 0)
849 		erp |= IEEE80211_ERP_NON_ERP_PRESENT;
850 	/*
851 	 * If one or more NonERP STAs are associated in the BSS, the
852 	 * Use_Protection bit shall be set to 1 in transmitted ERP
853 	 * Information Elements.
854 	 */
855 	if (ic->ic_flags & IEEE80211_F_USEPROT)
856 		erp |= IEEE80211_ERP_USE_PROTECTION;
857 	/*
858 	 * The Barker_Preamble_Mode bit shall be set to 1 by the ERP
859 	 * Information Element sender if one or more associated NonERP
860 	 * STAs are not short preamble capable.
861 	 */
862 	if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE))
863 		erp |= IEEE80211_ERP_BARKER_MODE;
864 	*frm++ = erp;
865 	return frm;
866 }
867 #endif	/* IEEE80211_STA_ONLY */
868 
869 /*
870  * Add a QoS Capability element to a frame (see 7.3.2.35).
871  */
872 u_int8_t *
873 ieee80211_add_qos_capability(u_int8_t *frm, struct ieee80211com *ic)
874 {
875 	*frm++ = IEEE80211_ELEMID_QOS_CAP;
876 	*frm++ = 1;
877 	*frm++ = 0;	/* QoS Info */
878 	return frm;
879 }
880 
881 /*
882  * Add a Wifi-Alliance WME (aka WMM) info element to a frame.
883  * WME is a requirement for Wifi-Alliance compliance and some
884  * 11n APs will not negotiate HT if this element is missing.
885  */
886 uint8_t *
887 ieee80211_add_wme_info(uint8_t *frm, struct ieee80211com *ic)
888 {
889 	*frm++ = IEEE80211_ELEMID_VENDOR;
890 	*frm++ = 7;
891 	memcpy(frm, MICROSOFT_OUI, 3); frm += 3;
892 	*frm++ = 2; /* OUI type */
893 	*frm++ = 0; /* OUI subtype */
894 	*frm++ = 1; /* version */
895 	*frm++ = 0; /* info */
896 
897 	return frm;
898 }
899 
900 #ifndef IEEE80211_STA_ONLY
901 /*
902  * Add a Wifi-Alliance WMM (aka WME) parameter element to a frame.
903  */
904 uint8_t *
905 ieee80211_add_wme_param(uint8_t *frm, struct ieee80211com *ic)
906 {
907 	const struct ieee80211_edca_ac_params *edca;
908 	int aci;
909 
910 	*frm++ = IEEE80211_ELEMID_VENDOR;
911 	*frm++ = 24;
912 	memcpy(frm, MICROSOFT_OUI, 3); frm += 3;
913 	*frm++ = 2; /* OUI type */
914 	*frm++ = 1; /* OUI subtype */
915 	*frm++ = 1; /* version */
916 	*frm++ = 0; /* info */
917 	*frm++ = 0; /* reserved */
918 
919 	/* setup AC Parameter Records */
920 	edca = ieee80211_edca_table[ic->ic_curmode];
921 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
922 		const struct ieee80211_edca_ac_params *ac = &edca[aci];
923 
924 		*frm++ = (aci << 5) | ((ac->ac_acm & 0x1) << 4) |
925 			 (ac->ac_aifsn & 0xf);
926 		*frm++ = (ac->ac_ecwmax << 4) |
927 			 (ac->ac_ecwmin & 0xf);
928 		LE_WRITE_2(frm, ac->ac_txoplimit); frm += 2;
929 	}
930 
931 	return frm;
932 }
933 #endif
934 
935 /*
936  * Add an RSN element to a frame (see 802.11-2012 8.4.2.27)
937  */
938 u_int8_t *
939 ieee80211_add_rsn_body(u_int8_t *frm, struct ieee80211com *ic,
940     const struct ieee80211_node *ni, int wpa)
941 {
942 	const u_int8_t *oui = wpa ? MICROSOFT_OUI : IEEE80211_OUI;
943 	u_int8_t *pcount;
944 	u_int16_t count, rsncaps;
945 
946 	/* write Version field */
947 	LE_WRITE_2(frm, 1); frm += 2;
948 
949 	/* write Group Data Cipher Suite field (see 802.11-2012 Table 8-99) */
950 	memcpy(frm, oui, 3); frm += 3;
951 	switch (ni->ni_rsngroupcipher) {
952 	case IEEE80211_CIPHER_WEP40:
953 		*frm++ = 1;
954 		break;
955 	case IEEE80211_CIPHER_TKIP:
956 		*frm++ = 2;
957 		break;
958 	case IEEE80211_CIPHER_CCMP:
959 		*frm++ = 4;
960 		break;
961 	case IEEE80211_CIPHER_WEP104:
962 		*frm++ = 5;
963 		break;
964 	default:
965 		/* can't get there */
966 		panic("invalid group data cipher!");
967 	}
968 
969 	pcount = frm; frm += 2;
970 	count = 0;
971 	/* write Pairwise Cipher Suite List */
972 	if (ni->ni_rsnciphers & IEEE80211_CIPHER_USEGROUP) {
973 		memcpy(frm, oui, 3); frm += 3;
974 		*frm++ = 0;
975 		count++;
976 	}
977 	if (ni->ni_rsnciphers & IEEE80211_CIPHER_TKIP) {
978 		memcpy(frm, oui, 3); frm += 3;
979 		*frm++ = 2;
980 		count++;
981 	}
982 	if (ni->ni_rsnciphers & IEEE80211_CIPHER_CCMP) {
983 		memcpy(frm, oui, 3); frm += 3;
984 		*frm++ = 4;
985 		count++;
986 	}
987 	/* write Pairwise Cipher Suite Count field */
988 	LE_WRITE_2(pcount, count);
989 
990 	pcount = frm; frm += 2;
991 	count = 0;
992 	/* write AKM Suite List (see Table 20dc) */
993 	if (ni->ni_rsnakms & IEEE80211_AKM_8021X) {
994 		memcpy(frm, oui, 3); frm += 3;
995 		*frm++ = 1;
996 		count++;
997 	}
998 	if (ni->ni_rsnakms & IEEE80211_AKM_PSK) {
999 		memcpy(frm, oui, 3); frm += 3;
1000 		*frm++ = 2;
1001 		count++;
1002 	}
1003 	if (!wpa && (ni->ni_rsnakms & IEEE80211_AKM_SHA256_8021X)) {
1004 		memcpy(frm, oui, 3); frm += 3;
1005 		*frm++ = 5;
1006 		count++;
1007 	}
1008 	if (!wpa && (ni->ni_rsnakms & IEEE80211_AKM_SHA256_PSK)) {
1009 		memcpy(frm, oui, 3); frm += 3;
1010 		*frm++ = 6;
1011 		count++;
1012 	}
1013 	/* write AKM Suite List Count field */
1014 	LE_WRITE_2(pcount, count);
1015 
1016 	if (wpa)
1017 		return frm;
1018 
1019 	/* write RSN Capabilities field */
1020 	rsncaps = (ni->ni_rsncaps & (IEEE80211_RSNCAP_PTKSA_RCNT_MASK |
1021 	    IEEE80211_RSNCAP_GTKSA_RCNT_MASK));
1022 	if (ic->ic_caps & IEEE80211_C_MFP) {
1023 		rsncaps |= IEEE80211_RSNCAP_MFPC;
1024 		if (ic->ic_flags & IEEE80211_F_MFPR)
1025 			rsncaps |= IEEE80211_RSNCAP_MFPR;
1026 	}
1027 	if (ic->ic_flags & IEEE80211_F_PBAR)
1028 		rsncaps |= IEEE80211_RSNCAP_PBAC;
1029 	LE_WRITE_2(frm, rsncaps); frm += 2;
1030 
1031 	if (ni->ni_flags & IEEE80211_NODE_PMKID) {
1032 		/* write PMKID Count field */
1033 		LE_WRITE_2(frm, 1); frm += 2;
1034 		/* write PMKID List (only 1) */
1035 		memcpy(frm, ni->ni_pmkid, IEEE80211_PMKID_LEN);
1036 		frm += IEEE80211_PMKID_LEN;
1037 	}
1038 
1039 	if (!(ic->ic_caps & IEEE80211_C_MFP))
1040 		return frm;
1041 
1042 	if ((ni->ni_flags & IEEE80211_NODE_PMKID) == 0) {
1043 		/* no PMKID (PMKID Count=0) */
1044 		LE_WRITE_2(frm, 0); frm += 2;
1045 	}
1046 
1047 	/* write Group Integrity Cipher Suite field */
1048 	memcpy(frm, oui, 3); frm += 3;
1049 	switch (ic->ic_rsngroupmgmtcipher) {
1050 	case IEEE80211_CIPHER_BIP:
1051 		*frm++ = 6;
1052 		break;
1053 	default:
1054 		/* can't get there */
1055 		panic("invalid integrity group cipher!");
1056 	}
1057 	return frm;
1058 }
1059 
1060 u_int8_t *
1061 ieee80211_add_rsn(u_int8_t *frm, struct ieee80211com *ic,
1062     const struct ieee80211_node *ni)
1063 {
1064 	u_int8_t *plen;
1065 
1066 	*frm++ = IEEE80211_ELEMID_RSN;
1067 	plen = frm++;	/* length filled in later */
1068 	frm = ieee80211_add_rsn_body(frm, ic, ni, 0);
1069 
1070 	/* write length field */
1071 	*plen = frm - plen - 1;
1072 	return frm;
1073 }
1074 
1075 /*
1076  * Add a vendor-specific WPA element to a frame.
1077  * This is required for compatibility with Wi-Fi Alliance WPA.
1078  */
1079 u_int8_t *
1080 ieee80211_add_wpa(u_int8_t *frm, struct ieee80211com *ic,
1081     const struct ieee80211_node *ni)
1082 {
1083 	u_int8_t *plen;
1084 
1085 	*frm++ = IEEE80211_ELEMID_VENDOR;
1086 	plen = frm++;	/* length filled in later */
1087 	memcpy(frm, MICROSOFT_OUI, 3); frm += 3;
1088 	*frm++ = 1;	/* WPA */
1089 	frm = ieee80211_add_rsn_body(frm, ic, ni, 1);
1090 
1091 	/* write length field */
1092 	*plen = frm - plen - 1;
1093 	return frm;
1094 }
1095 
1096 /*
1097  * Add an extended supported rates element to a frame (see 7.3.2.14).
1098  */
1099 u_int8_t *
1100 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
1101 {
1102 	int nrates;
1103 
1104 	KASSERT(rs->rs_nrates > IEEE80211_RATE_SIZE);
1105 
1106 	*frm++ = IEEE80211_ELEMID_XRATES;
1107 	nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
1108 	*frm++ = nrates;
1109 	memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
1110 	return frm + nrates;
1111 }
1112 
1113 /*
1114  * Add an HT Capabilities element to a frame (see 7.3.2.57).
1115  */
1116 u_int8_t *
1117 ieee80211_add_htcaps(u_int8_t *frm, struct ieee80211com *ic)
1118 {
1119 	*frm++ = IEEE80211_ELEMID_HTCAPS;
1120 	*frm++ = 26;
1121 	LE_WRITE_2(frm, ic->ic_htcaps); frm += 2;
1122 	*frm++ = ic->ic_ampdu_params;
1123 	memcpy(frm, ic->ic_sup_mcs, 10); frm += 10;
1124 	LE_WRITE_2(frm, (ic->ic_max_rxrate & IEEE80211_MCS_RX_RATE_HIGH));
1125 	frm += 2;
1126 	*frm++ = ic->ic_tx_mcs_set;
1127 	*frm++ = 0; /* reserved */
1128 	*frm++ = 0; /* reserved */
1129 	*frm++ = 0; /* reserved */
1130 	LE_WRITE_2(frm, ic->ic_htxcaps); frm += 2;
1131 	LE_WRITE_4(frm, ic->ic_txbfcaps); frm += 4;
1132 	*frm++ = ic->ic_aselcaps;
1133 	return frm;
1134 }
1135 
1136 #ifndef IEEE80211_STA_ONLY
1137 /*
1138  * Add an HT Operation element to a frame (see 7.3.2.58).
1139  */
1140 u_int8_t *
1141 ieee80211_add_htop(u_int8_t *frm, struct ieee80211com *ic)
1142 {
1143 	*frm++ = IEEE80211_ELEMID_HTOP;
1144 	*frm++ = 22;
1145 	*frm++ = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1146 	*frm++ = ic->ic_bss->ni_htop0;
1147 	LE_WRITE_2(frm, ic->ic_bss->ni_htop1); frm += 2;
1148 	LE_WRITE_2(frm, ic->ic_bss->ni_htop2); frm += 2;
1149 	memset(frm, 0, 16); frm += 16;
1150 	return frm;
1151 }
1152 #endif	/* !IEEE80211_STA_ONLY */
1153 
1154 #ifndef IEEE80211_STA_ONLY
1155 /*
1156  * Add a Timeout Interval element to a frame (see 7.3.2.49).
1157  */
1158 u_int8_t *
1159 ieee80211_add_tie(u_int8_t *frm, u_int8_t type, u_int32_t value)
1160 {
1161 	*frm++ = IEEE80211_ELEMID_TIE;
1162 	*frm++ = 5;	/* length */
1163 	*frm++ = type;	/* Timeout Interval type */
1164 	LE_WRITE_4(frm, value);
1165 	return frm + 4;
1166 }
1167 #endif
1168 
1169 struct mbuf *
1170 ieee80211_getmgmt(int flags, int type, u_int pktlen)
1171 {
1172 	struct mbuf *m;
1173 
1174 	/* reserve space for 802.11 header */
1175 	pktlen += sizeof(struct ieee80211_frame);
1176 
1177 	if (pktlen > MCLBYTES)
1178 		panic("management frame too large: %u", pktlen);
1179 	MGETHDR(m, flags, type);
1180 	if (m == NULL)
1181 		return NULL;
1182 	if (pktlen > MHLEN) {
1183 		MCLGET(m, flags);
1184 		if (!(m->m_flags & M_EXT))
1185 			return m_free(m);
1186 	}
1187 	m->m_data += sizeof(struct ieee80211_frame);
1188 	return m;
1189 }
1190 
1191 /*-
1192  * Probe request frame format:
1193  * [tlv] SSID
1194  * [tlv] Supported rates
1195  * [tlv] Extended Supported Rates (802.11g)
1196  * [tlv] HT Capabilities (802.11n)
1197  */
1198 struct mbuf *
1199 ieee80211_get_probe_req(struct ieee80211com *ic, struct ieee80211_node *ni)
1200 {
1201 	const struct ieee80211_rateset *rs =
1202 	    &ic->ic_sup_rates[ieee80211_chan2mode(ic, ni->ni_chan)];
1203 	struct mbuf *m;
1204 	u_int8_t *frm;
1205 
1206 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA,
1207 	    2 + ic->ic_des_esslen +
1208 	    2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
1209 	    ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
1210 		2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
1211 	    ((ic->ic_flags & IEEE80211_F_HTON) ? 28 + 9 : 0));
1212 	if (m == NULL)
1213 		return NULL;
1214 
1215 	frm = mtod(m, u_int8_t *);
1216 	frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
1217 	frm = ieee80211_add_rates(frm, rs);
1218 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
1219 		frm = ieee80211_add_xrates(frm, rs);
1220 	if (ic->ic_flags & IEEE80211_F_HTON) {
1221 		frm = ieee80211_add_htcaps(frm, ic);
1222 		frm = ieee80211_add_wme_info(frm, ic);
1223 	}
1224 
1225 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1226 
1227 	return m;
1228 }
1229 
1230 #ifndef IEEE80211_STA_ONLY
1231 /*-
1232  * Probe response frame format:
1233  * [8]   Timestamp
1234  * [2]   Beacon interval
1235  * [2]   Capability
1236  * [tlv] Service Set Identifier (SSID)
1237  * [tlv] Supported rates
1238  * [tlv] DS Parameter Set (802.11g)
1239  * [tlv] ERP Information (802.11g)
1240  * [tlv] Extended Supported Rates (802.11g)
1241  * [tlv] RSN (802.11i)
1242  * [tlv] EDCA Parameter Set (802.11e)
1243  * [tlv] HT Capabilities (802.11n)
1244  * [tlv] HT Operation (802.11n)
1245  */
1246 struct mbuf *
1247 ieee80211_get_probe_resp(struct ieee80211com *ic)
1248 {
1249 	const struct ieee80211_rateset *rs = &ic->ic_bss->ni_rates;
1250 	struct mbuf *m;
1251 	u_int8_t *frm;
1252 
1253 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA,
1254 	    8 + 2 + 2 +
1255 	    2 + ic->ic_bss->ni_esslen +
1256 	    2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
1257 	    2 + 1 +
1258 	    ((ic->ic_opmode == IEEE80211_M_IBSS) ? 2 + 2 : 0) +
1259 	    ((ic->ic_curmode == IEEE80211_MODE_11G) ? 2 + 1 : 0) +
1260 	    ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
1261 		2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
1262 	    (((ic->ic_flags & IEEE80211_F_RSNON) &&
1263 	      (ic->ic_bss->ni_rsnprotos & IEEE80211_PROTO_RSN)) ?
1264 		2 + IEEE80211_RSNIE_MAXLEN : 0) +
1265 	    ((ic->ic_flags & IEEE80211_F_QOS) ? 2 + 18 : 0) +
1266 	    (((ic->ic_flags & IEEE80211_F_RSNON) &&
1267 	      (ic->ic_bss->ni_rsnprotos & IEEE80211_PROTO_WPA)) ?
1268 		2 + IEEE80211_WPAIE_MAXLEN : 0) +
1269 	    ((ic->ic_flags & IEEE80211_F_HTON) ? 28 + 24 + 26 : 0));
1270 	if (m == NULL)
1271 		return NULL;
1272 
1273 	frm = mtod(m, u_int8_t *);
1274 	memset(frm, 0, 8); frm += 8;	/* timestamp is set by hardware */
1275 	LE_WRITE_2(frm, ic->ic_bss->ni_intval); frm += 2;
1276 	frm = ieee80211_add_capinfo(frm, ic, ic->ic_bss);
1277 	frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
1278 	    ic->ic_bss->ni_esslen);
1279 	frm = ieee80211_add_rates(frm, rs);
1280 	frm = ieee80211_add_ds_params(frm, ic, ic->ic_bss);
1281 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1282 		frm = ieee80211_add_ibss_params(frm, ic->ic_bss);
1283 	if (ic->ic_curmode == IEEE80211_MODE_11G)
1284 		frm = ieee80211_add_erp(frm, ic);
1285 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
1286 		frm = ieee80211_add_xrates(frm, rs);
1287 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
1288 	    (ic->ic_bss->ni_rsnprotos & IEEE80211_PROTO_RSN))
1289 		frm = ieee80211_add_rsn(frm, ic, ic->ic_bss);
1290 	if (ic->ic_flags & IEEE80211_F_QOS)
1291 		frm = ieee80211_add_edca_params(frm, ic);
1292 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
1293 	    (ic->ic_bss->ni_rsnprotos & IEEE80211_PROTO_WPA))
1294 		frm = ieee80211_add_wpa(frm, ic, ic->ic_bss);
1295 	if (ic->ic_flags & IEEE80211_F_HTON) {
1296 		frm = ieee80211_add_htcaps(frm, ic);
1297 		frm = ieee80211_add_htop(frm, ic);
1298 		frm = ieee80211_add_wme_param(frm, ic);
1299 	}
1300 
1301 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1302 
1303 	return m;
1304 }
1305 #endif	/* IEEE80211_STA_ONLY */
1306 
1307 /*-
1308  * Authentication frame format:
1309  * [2] Authentication algorithm number
1310  * [2] Authentication transaction sequence number
1311  * [2] Status code
1312  */
1313 struct mbuf *
1314 ieee80211_get_auth(struct ieee80211com *ic, struct ieee80211_node *ni,
1315     u_int16_t status, u_int16_t seq)
1316 {
1317 	struct mbuf *m;
1318 	u_int8_t *frm;
1319 
1320 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1321 	if (m == NULL)
1322 		return NULL;
1323 	m_align(m, 2 * 3);
1324 	m->m_pkthdr.len = m->m_len = 2 * 3;
1325 
1326 	frm = mtod(m, u_int8_t *);
1327 	LE_WRITE_2(frm, IEEE80211_AUTH_ALG_OPEN); frm += 2;
1328 	LE_WRITE_2(frm, seq); frm += 2;
1329 	LE_WRITE_2(frm, status);
1330 
1331 	return m;
1332 }
1333 
1334 /*-
1335  * Deauthentication frame format:
1336  * [2] Reason code
1337  */
1338 struct mbuf *
1339 ieee80211_get_deauth(struct ieee80211com *ic, struct ieee80211_node *ni,
1340     u_int16_t reason)
1341 {
1342 	struct mbuf *m;
1343 
1344 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1345 	if (m == NULL)
1346 		return NULL;
1347 	m_align(m, 2);
1348 	m->m_pkthdr.len = m->m_len = 2;
1349 
1350 	*mtod(m, u_int16_t *) = htole16(reason);
1351 
1352 	return m;
1353 }
1354 
1355 /*-
1356  * (Re)Association request frame format:
1357  * [2]   Capability information
1358  * [2]   Listen interval
1359  * [6*]  Current AP address (Reassociation only)
1360  * [tlv] SSID
1361  * [tlv] Supported rates
1362  * [tlv] Extended Supported Rates (802.11g)
1363  * [tlv] RSN (802.11i)
1364  * [tlv] QoS Capability (802.11e)
1365  * [tlv] HT Capabilities (802.11n)
1366  */
1367 struct mbuf *
1368 ieee80211_get_assoc_req(struct ieee80211com *ic, struct ieee80211_node *ni,
1369     int type)
1370 {
1371 	const struct ieee80211_rateset *rs = &ni->ni_rates;
1372 	struct mbuf *m;
1373 	u_int8_t *frm;
1374 	u_int16_t capinfo;
1375 
1376 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA,
1377 	    2 + 2 +
1378 	    ((type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) ?
1379 		IEEE80211_ADDR_LEN : 0) +
1380 	    2 + ni->ni_esslen +
1381 	    2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
1382 	    ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
1383 		2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
1384 	    (((ic->ic_flags & IEEE80211_F_RSNON) &&
1385 	      (ni->ni_rsnprotos & IEEE80211_PROTO_RSN)) ?
1386 		2 + IEEE80211_RSNIE_MAXLEN : 0) +
1387 	    ((ni->ni_flags & IEEE80211_NODE_QOS) ? 2 + 1 : 0) +
1388 	    (((ic->ic_flags & IEEE80211_F_RSNON) &&
1389 	      (ni->ni_rsnprotos & IEEE80211_PROTO_WPA)) ?
1390 		2 + IEEE80211_WPAIE_MAXLEN : 0) +
1391 	    ((ic->ic_flags & IEEE80211_F_HTON) ? 28 + 9 : 0));
1392 	if (m == NULL)
1393 		return NULL;
1394 
1395 	frm = mtod(m, u_int8_t *);
1396 	capinfo = IEEE80211_CAPINFO_ESS;
1397 	if (ic->ic_flags & IEEE80211_F_WEPON)
1398 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1399 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1400 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1401 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1402 	if (ic->ic_caps & IEEE80211_C_SHSLOT)
1403 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1404 	LE_WRITE_2(frm, capinfo); frm += 2;
1405 	LE_WRITE_2(frm, ic->ic_lintval); frm += 2;
1406 	if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1407 		IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
1408 		frm += IEEE80211_ADDR_LEN;
1409 	}
1410 	frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
1411 	frm = ieee80211_add_rates(frm, rs);
1412 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
1413 		frm = ieee80211_add_xrates(frm, rs);
1414 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
1415 	    (ni->ni_rsnprotos & IEEE80211_PROTO_RSN))
1416 		frm = ieee80211_add_rsn(frm, ic, ni);
1417 	if (ni->ni_flags & IEEE80211_NODE_QOS)
1418 		frm = ieee80211_add_qos_capability(frm, ic);
1419 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
1420 	    (ni->ni_rsnprotos & IEEE80211_PROTO_WPA))
1421 		frm = ieee80211_add_wpa(frm, ic, ni);
1422 	if (ic->ic_flags & IEEE80211_F_HTON) {
1423 		frm = ieee80211_add_htcaps(frm, ic);
1424 		frm = ieee80211_add_wme_info(frm, ic);
1425 	}
1426 
1427 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1428 
1429 	return m;
1430 }
1431 
1432 #ifndef IEEE80211_STA_ONLY
1433 /*-
1434  * (Re)Association response frame format:
1435  * [2]   Capability information
1436  * [2]   Status code
1437  * [2]   Association ID (AID)
1438  * [tlv] Supported rates
1439  * [tlv] Extended Supported Rates (802.11g)
1440  * [tlv] EDCA Parameter Set (802.11e)
1441  * [tlv] Timeout Interval (802.11w)
1442  * [tlv] HT Capabilities (802.11n)
1443  * [tlv] HT Operation (802.11n)
1444  */
1445 struct mbuf *
1446 ieee80211_get_assoc_resp(struct ieee80211com *ic, struct ieee80211_node *ni,
1447     u_int16_t status)
1448 {
1449 	const struct ieee80211_rateset *rs = &ni->ni_rates;
1450 	struct mbuf *m;
1451 	u_int8_t *frm;
1452 
1453 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA,
1454 	    2 + 2 + 2 +
1455 	    2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
1456 	    ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
1457 		2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
1458 	    ((ni->ni_flags & IEEE80211_NODE_QOS) ? 2 + 18 : 0) +
1459 	    ((status == IEEE80211_STATUS_TRY_AGAIN_LATER) ? 2 + 7 : 0) +
1460 	    ((ic->ic_flags & IEEE80211_F_HTON) ? 28 + 24 + 26 : 0));
1461 	if (m == NULL)
1462 		return NULL;
1463 
1464 	frm = mtod(m, u_int8_t *);
1465 	frm = ieee80211_add_capinfo(frm, ic, ni);
1466 	LE_WRITE_2(frm, status); frm += 2;
1467 	if (status == IEEE80211_STATUS_SUCCESS)
1468 		LE_WRITE_2(frm, ni->ni_associd);
1469 	else
1470 		LE_WRITE_2(frm, 0);
1471 	frm += 2;
1472 	frm = ieee80211_add_rates(frm, rs);
1473 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
1474 		frm = ieee80211_add_xrates(frm, rs);
1475 	if (ni->ni_flags & IEEE80211_NODE_QOS)
1476 		frm = ieee80211_add_edca_params(frm, ic);
1477 	if ((ni->ni_flags & IEEE80211_NODE_MFP) &&
1478 	    status == IEEE80211_STATUS_TRY_AGAIN_LATER) {
1479 		/* Association Comeback Time */
1480 		frm = ieee80211_add_tie(frm, 3, 1000 /* XXX */);
1481 	}
1482 	if (ic->ic_flags & IEEE80211_F_HTON) {
1483 		frm = ieee80211_add_htcaps(frm, ic);
1484 		frm = ieee80211_add_htop(frm, ic);
1485 		frm = ieee80211_add_wme_param(frm, ic);
1486 	}
1487 
1488 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1489 
1490 	return m;
1491 }
1492 #endif	/* IEEE80211_STA_ONLY */
1493 
1494 /*-
1495  * Disassociation frame format:
1496  * [2] Reason code
1497  */
1498 struct mbuf *
1499 ieee80211_get_disassoc(struct ieee80211com *ic, struct ieee80211_node *ni,
1500     u_int16_t reason)
1501 {
1502 	struct mbuf *m;
1503 
1504 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1505 	if (m == NULL)
1506 		return NULL;
1507 	m_align(m, 2);
1508 	m->m_pkthdr.len = m->m_len = 2;
1509 
1510 	*mtod(m, u_int16_t *) = htole16(reason);
1511 
1512 	return m;
1513 }
1514 
1515 /*-
1516  * ADDBA Request frame format:
1517  * [1] Category
1518  * [1] Action
1519  * [1] Dialog Token
1520  * [2] Block Ack Parameter Set
1521  * [2] Block Ack Timeout Value
1522  * [2] Block Ack Starting Sequence Control
1523  */
1524 struct mbuf *
1525 ieee80211_get_addba_req(struct ieee80211com *ic, struct ieee80211_node *ni,
1526     u_int8_t tid)
1527 {
1528 	struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
1529 	struct mbuf *m;
1530 	u_int8_t *frm;
1531 
1532 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA, 9);
1533 	if (m == NULL)
1534 		return m;
1535 
1536 	frm = mtod(m, u_int8_t *);
1537 	*frm++ = IEEE80211_CATEG_BA;
1538 	*frm++ = IEEE80211_ACTION_ADDBA_REQ;
1539 	*frm++ = ba->ba_token;
1540 	LE_WRITE_2(frm, ba->ba_params); frm += 2;
1541 	LE_WRITE_2(frm, ba->ba_timeout_val / IEEE80211_DUR_TU); frm += 2;
1542 	LE_WRITE_2(frm, ba->ba_winstart << IEEE80211_SEQ_SEQ_SHIFT); frm += 2;
1543 
1544 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1545 
1546 	return m;
1547 }
1548 
1549 /* Move Tx BA window forward to the specified SSN. */
1550 void
1551 ieee80211_output_ba_move_window(struct ieee80211com *ic,
1552     struct ieee80211_node *ni, uint8_t tid, uint16_t ssn)
1553 {
1554 	struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
1555 	uint16_t s = ba->ba_winstart;
1556 
1557 	while (SEQ_LT(s, ssn) && ba->ba_bitmap) {
1558 		s = (s + 1) % 0xfff;
1559 		ba->ba_bitmap >>= 1;
1560 	}
1561 
1562 	ba->ba_winstart = (ssn & 0xfff);
1563 	ba->ba_winend = (ba->ba_winstart + ba->ba_winsize - 1) & 0xfff;
1564 }
1565 
1566 /*
1567  * Move Tx BA window forward up to the first hole in the bitmap
1568  * or up to the specified SSN, whichever comes first.
1569  * After calling this function, frames before the start of the
1570  * potentially changed BA window should be discarded.
1571  */
1572 void
1573 ieee80211_output_ba_move_window_to_first_unacked(struct ieee80211com *ic,
1574     struct ieee80211_node *ni, uint8_t tid, uint16_t ssn)
1575 {
1576 	struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
1577 	uint16_t s = ba->ba_winstart;
1578 	uint64_t bitmap = ba->ba_bitmap;
1579 	int can_move_window = 0;
1580 
1581 	while (bitmap && SEQ_LT(s, ssn)) {
1582 		if ((bitmap & 1) == 0)
1583 			break;
1584 		s = (s + 1) % 0xfff;
1585 		bitmap >>= 1;
1586 		can_move_window = 1;
1587 	}
1588 
1589 	if (can_move_window)
1590 		ieee80211_output_ba_move_window(ic, ni, tid, s);
1591 }
1592 
1593 /* Record an ACK for a frame with a given SSN within the Tx BA window. */
1594 void
1595 ieee80211_output_ba_record_ack(struct ieee80211com *ic,
1596     struct ieee80211_node *ni, uint8_t tid, uint16_t ssn)
1597 {
1598 	struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
1599 	int i = 0;
1600 	uint16_t s = ba->ba_winstart;
1601 
1602 	KASSERT(!SEQ_LT(ssn, ba->ba_winstart));
1603 	KASSERT(!SEQ_LT(ba->ba_winend, ssn));
1604 
1605 	while (SEQ_LT(s, ssn)) {
1606 		s = (s + 1) % 0xfff;
1607 		i++;
1608 	}
1609 	if (i < ba->ba_winsize)
1610 		ba->ba_bitmap |= (1 << i);
1611 }
1612 
1613 /*-
1614  * ADDBA Response frame format:
1615  * [1] Category
1616  * [1] Action
1617  * [1] Dialog Token
1618  * [2] Status Code
1619  * [2] Block Ack Parameter Set
1620  * [2] Block Ack Timeout Value
1621  */
1622 struct mbuf *
1623 ieee80211_get_addba_resp(struct ieee80211com *ic, struct ieee80211_node *ni,
1624     u_int8_t tid, u_int8_t token, u_int16_t status)
1625 {
1626 	struct ieee80211_rx_ba *ba = &ni->ni_rx_ba[tid];
1627 	struct mbuf *m;
1628 	u_int8_t *frm;
1629 	u_int16_t params;
1630 
1631 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA, 9);
1632 	if (m == NULL)
1633 		return m;
1634 
1635 	frm = mtod(m, u_int8_t *);
1636 	*frm++ = IEEE80211_CATEG_BA;
1637 	*frm++ = IEEE80211_ACTION_ADDBA_RESP;
1638 	*frm++ = token;
1639 	LE_WRITE_2(frm, status); frm += 2;
1640 	if (status == 0)
1641 		params = ba->ba_params;
1642 	else
1643 		params = tid << IEEE80211_ADDBA_TID_SHIFT;
1644 	LE_WRITE_2(frm, params); frm += 2;
1645 	if (status == 0)
1646 		LE_WRITE_2(frm, ba->ba_timeout_val / IEEE80211_DUR_TU);
1647 	else
1648 		LE_WRITE_2(frm, 0);
1649 	frm += 2;
1650 
1651 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1652 
1653 	return m;
1654 }
1655 
1656 /*-
1657  * DELBA frame format:
1658  * [1] Category
1659  * [1] Action
1660  * [2] DELBA Parameter Set
1661  * [2] Reason Code
1662  */
1663 struct mbuf *
1664 ieee80211_get_delba(struct ieee80211com *ic, struct ieee80211_node *ni,
1665     u_int8_t tid, u_int8_t dir, u_int16_t reason)
1666 {
1667 	struct mbuf *m;
1668 	u_int8_t *frm;
1669 	u_int16_t params;
1670 
1671 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA, 6);
1672 	if (m == NULL)
1673 		return m;
1674 
1675 	frm = mtod(m, u_int8_t *);
1676 	*frm++ = IEEE80211_CATEG_BA;
1677 	*frm++ = IEEE80211_ACTION_DELBA;
1678 	params = tid << 12;
1679 	if (dir)
1680 		params |= IEEE80211_DELBA_INITIATOR;
1681 	LE_WRITE_2(frm, params); frm += 2;
1682 	LE_WRITE_2(frm, reason); frm += 2;
1683 
1684 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1685 
1686 	return m;
1687 }
1688 
1689 /*-
1690  * SA Query Request/Reponse frame format:
1691  * [1]  Category
1692  * [1]  Action
1693  * [16] Transaction Identifier
1694  */
1695 struct mbuf *
1696 ieee80211_get_sa_query(struct ieee80211com *ic, struct ieee80211_node *ni,
1697     u_int8_t action)
1698 {
1699 	struct mbuf *m;
1700 	u_int8_t *frm;
1701 
1702 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA, 4);
1703 	if (m == NULL)
1704 		return NULL;
1705 
1706 	frm = mtod(m, u_int8_t *);
1707 	*frm++ = IEEE80211_CATEG_SA_QUERY;
1708 	*frm++ = action;	/* ACTION_SA_QUERY_REQ/RESP */
1709 	LE_WRITE_2(frm, ni->ni_sa_query_trid); frm += 2;
1710 
1711 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1712 
1713 	return m;
1714 }
1715 
1716 struct mbuf *
1717 ieee80211_get_action(struct ieee80211com *ic, struct ieee80211_node *ni,
1718     u_int8_t categ, u_int8_t action, int arg)
1719 {
1720 	struct mbuf *m = NULL;
1721 
1722 	switch (categ) {
1723 	case IEEE80211_CATEG_BA:
1724 		switch (action) {
1725 		case IEEE80211_ACTION_ADDBA_REQ:
1726 			m = ieee80211_get_addba_req(ic, ni, arg & 0xffff);
1727 			break;
1728 		case IEEE80211_ACTION_ADDBA_RESP:
1729 			m = ieee80211_get_addba_resp(ic, ni, arg & 0xff,
1730 			    arg >> 8, arg >> 16);
1731 			break;
1732 		case IEEE80211_ACTION_DELBA:
1733 			m = ieee80211_get_delba(ic, ni, arg & 0xff, arg >> 8,
1734 			    arg >> 16);
1735 			break;
1736 		}
1737 		break;
1738 	case IEEE80211_CATEG_SA_QUERY:
1739 		switch (action) {
1740 #ifndef IEEE80211_STA_ONLY
1741 		case IEEE80211_ACTION_SA_QUERY_REQ:
1742 #endif
1743 		case IEEE80211_ACTION_SA_QUERY_RESP:
1744 			m = ieee80211_get_sa_query(ic, ni, action);
1745 			break;
1746 		}
1747 		break;
1748 	}
1749 	return m;
1750 }
1751 
1752 /*
1753  * Send a management frame.  The node is for the destination (or ic_bss
1754  * when in station mode).  Nodes other than ic_bss have their reference
1755  * count bumped to reflect our use for an indeterminant time.
1756  */
1757 int
1758 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
1759     int type, int arg1, int arg2)
1760 {
1761 #define	senderr(_x, _v)	do { ic->ic_stats._v++; ret = _x; goto bad; } while (0)
1762 	struct ifnet *ifp = &ic->ic_if;
1763 	struct mbuf *m;
1764 	int ret, timer;
1765 
1766 	if (ni == NULL)
1767 		panic("null node");
1768 
1769 	/*
1770 	 * Hold a reference on the node so it doesn't go away until after
1771 	 * the xmit is complete all the way in the driver.  On error we
1772 	 * will remove our reference.
1773 	 */
1774 	ieee80211_ref_node(ni);
1775 	timer = 0;
1776 	switch (type) {
1777 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1778 		if ((m = ieee80211_get_probe_req(ic, ni)) == NULL)
1779 			senderr(ENOMEM, is_tx_nombuf);
1780 
1781 		timer = IEEE80211_TRANS_WAIT;
1782 		break;
1783 #ifndef IEEE80211_STA_ONLY
1784 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1785 		if ((m = ieee80211_get_probe_resp(ic)) == NULL)
1786 			senderr(ENOMEM, is_tx_nombuf);
1787 		break;
1788 #endif
1789 	case IEEE80211_FC0_SUBTYPE_AUTH:
1790 		m = ieee80211_get_auth(ic, ni, arg1 >> 16, arg1 & 0xffff);
1791 		if (m == NULL)
1792 			senderr(ENOMEM, is_tx_nombuf);
1793 
1794 		if (ic->ic_opmode == IEEE80211_M_STA)
1795 			timer = IEEE80211_TRANS_WAIT;
1796 		break;
1797 
1798 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1799 		if ((m = ieee80211_get_deauth(ic, ni, arg1)) == NULL)
1800 			senderr(ENOMEM, is_tx_nombuf);
1801 #ifndef IEEE80211_STA_ONLY
1802 		if ((ifp->if_flags & IFF_DEBUG) &&
1803 		    (ic->ic_opmode == IEEE80211_M_HOSTAP ||
1804 		    ic->ic_opmode == IEEE80211_M_IBSS))
1805 			printf("%s: station %s deauthenticate (reason %d)\n",
1806 			    ifp->if_xname, ether_sprintf(ni->ni_macaddr),
1807 			    arg1);
1808 #endif
1809 		break;
1810 
1811 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1812 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1813 		if ((m = ieee80211_get_assoc_req(ic, ni, type)) == NULL)
1814 			senderr(ENOMEM, is_tx_nombuf);
1815 
1816 		timer = IEEE80211_TRANS_WAIT;
1817 		break;
1818 #ifndef IEEE80211_STA_ONLY
1819 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1820 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1821 		if ((m = ieee80211_get_assoc_resp(ic, ni, arg1)) == NULL)
1822 			senderr(ENOMEM, is_tx_nombuf);
1823 		break;
1824 #endif
1825 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1826 		if ((m = ieee80211_get_disassoc(ic, ni, arg1)) == NULL)
1827 			senderr(ENOMEM, is_tx_nombuf);
1828 #ifndef IEEE80211_STA_ONLY
1829 		if ((ifp->if_flags & IFF_DEBUG) &&
1830 		    (ic->ic_opmode == IEEE80211_M_HOSTAP ||
1831 		    ic->ic_opmode == IEEE80211_M_IBSS))
1832 			printf("%s: station %s disassociate (reason %d)\n",
1833 			    ifp->if_xname, ether_sprintf(ni->ni_macaddr),
1834 			    arg1);
1835 #endif
1836 		break;
1837 
1838 	case IEEE80211_FC0_SUBTYPE_ACTION:
1839 		m = ieee80211_get_action(ic, ni, arg1 >> 16, arg1 & 0xffff,
1840 		    arg2);
1841 		if (m == NULL)
1842 			senderr(ENOMEM, is_tx_nombuf);
1843 		break;
1844 
1845 	default:
1846 		DPRINTF(("invalid mgmt frame type %u\n", type));
1847 		senderr(EINVAL, is_tx_unknownmgt);
1848 		/* NOTREACHED */
1849 	}
1850 
1851 	ret = ieee80211_mgmt_output(ifp, ni, m, type);
1852 	if (ret == 0) {
1853 		if (timer)
1854 			ic->ic_mgt_timer = timer;
1855 	} else {
1856 bad:
1857 		ieee80211_release_node(ic, ni);
1858 	}
1859 	return ret;
1860 #undef senderr
1861 }
1862 
1863 /*
1864  * Build a RTS (Request To Send) control frame (see 7.2.1.1).
1865  */
1866 struct mbuf *
1867 ieee80211_get_rts(struct ieee80211com *ic, const struct ieee80211_frame *wh,
1868     u_int16_t dur)
1869 {
1870 	struct ieee80211_frame_rts *rts;
1871 	struct mbuf *m;
1872 
1873 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1874 	if (m == NULL)
1875 		return NULL;
1876 
1877 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_rts);
1878 
1879 	rts = mtod(m, struct ieee80211_frame_rts *);
1880 	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1881 	    IEEE80211_FC0_SUBTYPE_RTS;
1882 	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1883 	*(u_int16_t *)rts->i_dur = htole16(dur);
1884 	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1885 	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1886 
1887 	return m;
1888 }
1889 
1890 /*
1891  * Build a CTS-to-self (Clear To Send) control frame (see 7.2.1.2).
1892  */
1893 struct mbuf *
1894 ieee80211_get_cts_to_self(struct ieee80211com *ic, u_int16_t dur)
1895 {
1896 	struct ieee80211_frame_cts *cts;
1897 	struct mbuf *m;
1898 
1899 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1900 	if (m == NULL)
1901 		return NULL;
1902 
1903 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_cts);
1904 
1905 	cts = mtod(m, struct ieee80211_frame_cts *);
1906 	cts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1907 	    IEEE80211_FC0_SUBTYPE_CTS;
1908 	cts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1909 	*(u_int16_t *)cts->i_dur = htole16(dur);
1910 	IEEE80211_ADDR_COPY(cts->i_ra, ic->ic_myaddr);
1911 
1912 	return m;
1913 }
1914 
1915 /*
1916  * Build a compressed Block Ack Request control frame.
1917  */
1918 struct mbuf *
1919 ieee80211_get_compressed_bar(struct ieee80211com *ic,
1920     struct ieee80211_node *ni, int tid, uint16_t ssn)
1921 {
1922 	struct ieee80211_frame_min *wh;
1923 	uint8_t *frm;
1924 	uint16_t ctl;
1925 	struct mbuf *m;
1926 
1927 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1928 	if (m == NULL)
1929 		return NULL;
1930 
1931 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame_min) +
1932 	    sizeof(ctl) + sizeof(ssn);
1933 
1934 	wh = mtod(m, struct ieee80211_frame_min *);
1935 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1936 	    IEEE80211_FC0_SUBTYPE_BAR;
1937 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1938 	*(u_int16_t *)wh->i_dur = 0;
1939 	IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
1940 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
1941 	frm = (uint8_t *)&wh[1];
1942 
1943 	ctl = IEEE80211_BA_COMPRESSED | (tid << IEEE80211_BA_TID_INFO_SHIFT);
1944 	LE_WRITE_2(frm, ctl);
1945 	frm += 2;
1946 
1947 	LE_WRITE_2(frm, ssn << IEEE80211_SEQ_SEQ_SHIFT);
1948 	frm += 2;
1949 
1950 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1951 	m->m_pkthdr.ph_cookie = ni;
1952 
1953 	return m;
1954 }
1955 
1956 #ifndef IEEE80211_STA_ONLY
1957 /*-
1958  * Beacon frame format:
1959  * [8]   Timestamp
1960  * [2]   Beacon interval
1961  * [2]   Capability
1962  * [tlv] Service Set Identifier (SSID)
1963  * [tlv] Supported rates
1964  * [tlv] DS Parameter Set (802.11g)
1965  * [tlv] IBSS Parameter Set
1966  * [tlv] Traffic Indication Map (TIM)
1967  * [tlv] ERP Information (802.11g)
1968  * [tlv] Extended Supported Rates (802.11g)
1969  * [tlv] RSN (802.11i)
1970  * [tlv] EDCA Parameter Set (802.11e)
1971  * [tlv] HT Capabilities (802.11n)
1972  * [tlv] HT Operation (802.11n)
1973  */
1974 struct mbuf *
1975 ieee80211_beacon_alloc(struct ieee80211com *ic, struct ieee80211_node *ni)
1976 {
1977 	const struct ieee80211_rateset *rs = &ni->ni_rates;
1978 	struct ieee80211_frame *wh;
1979 	struct mbuf *m;
1980 	u_int8_t *frm;
1981 
1982 	m = ieee80211_getmgmt(M_DONTWAIT, MT_DATA,
1983 	    8 + 2 + 2 +
1984 	    2 + ((ic->ic_userflags & IEEE80211_F_HIDENWID) ?
1985 	    0 : ni->ni_esslen) +
1986 	    2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
1987 	    2 + 1 +
1988 	    2 + ((ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 254) +
1989 	    ((ic->ic_curmode == IEEE80211_MODE_11G) ? 2 + 1 : 0) +
1990 	    ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
1991 		2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
1992 	    (((ic->ic_flags & IEEE80211_F_RSNON) &&
1993 	      (ni->ni_rsnprotos & IEEE80211_PROTO_RSN)) ?
1994 		2 + IEEE80211_RSNIE_MAXLEN : 0) +
1995 	    ((ic->ic_flags & IEEE80211_F_QOS) ? 2 + 18 : 0) +
1996 	    (((ic->ic_flags & IEEE80211_F_RSNON) &&
1997 	      (ni->ni_rsnprotos & IEEE80211_PROTO_WPA)) ?
1998 		2 + IEEE80211_WPAIE_MAXLEN : 0) +
1999 	    ((ic->ic_flags & IEEE80211_F_HTON) ? 28 + 24 + 26 : 0));
2000 	if (m == NULL)
2001 		return NULL;
2002 
2003 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
2004 	if (m == NULL)
2005 		return NULL;
2006 	wh = mtod(m, struct ieee80211_frame *);
2007 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2008 	    IEEE80211_FC0_SUBTYPE_BEACON;
2009 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2010 	*(u_int16_t *)wh->i_dur = 0;
2011 	IEEE80211_ADDR_COPY(wh->i_addr1, etherbroadcastaddr);
2012 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
2013 	IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
2014 	*(u_int16_t *)wh->i_seq = 0;
2015 
2016 	frm = (u_int8_t *)&wh[1];
2017 	memset(frm, 0, 8); frm += 8;	/* timestamp is set by hardware */
2018 	LE_WRITE_2(frm, ni->ni_intval); frm += 2;
2019 	frm = ieee80211_add_capinfo(frm, ic, ni);
2020 	if (ic->ic_userflags & IEEE80211_F_HIDENWID)
2021 		frm = ieee80211_add_ssid(frm, NULL, 0);
2022 	else
2023 		frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
2024 	frm = ieee80211_add_rates(frm, rs);
2025 	frm = ieee80211_add_ds_params(frm, ic, ni);
2026 	if (ic->ic_opmode == IEEE80211_M_IBSS)
2027 		frm = ieee80211_add_ibss_params(frm, ni);
2028 	else
2029 		frm = ieee80211_add_tim(frm, ic);
2030 	if (ic->ic_curmode == IEEE80211_MODE_11G)
2031 		frm = ieee80211_add_erp(frm, ic);
2032 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
2033 		frm = ieee80211_add_xrates(frm, rs);
2034 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
2035 	    (ni->ni_rsnprotos & IEEE80211_PROTO_RSN))
2036 		frm = ieee80211_add_rsn(frm, ic, ni);
2037 	if (ic->ic_flags & IEEE80211_F_QOS)
2038 		frm = ieee80211_add_edca_params(frm, ic);
2039 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
2040 	    (ni->ni_rsnprotos & IEEE80211_PROTO_WPA))
2041 		frm = ieee80211_add_wpa(frm, ic, ni);
2042 	if (ic->ic_flags & IEEE80211_F_HTON) {
2043 		frm = ieee80211_add_htcaps(frm, ic);
2044 		frm = ieee80211_add_htop(frm, ic);
2045 		frm = ieee80211_add_wme_param(frm, ic);
2046 	}
2047 
2048 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
2049 	m->m_pkthdr.ph_cookie = ni;
2050 
2051 	return m;
2052 }
2053 
2054 /*
2055  * Check if an outgoing MSDU or management frame should be buffered into
2056  * the AP for power management.  Return 1 if the frame was buffered into
2057  * the AP, or 0 if the frame shall be transmitted immediately.
2058  */
2059 int
2060 ieee80211_pwrsave(struct ieee80211com *ic, struct mbuf *m,
2061     struct ieee80211_node *ni)
2062 {
2063 	const struct ieee80211_frame *wh;
2064 	int pssta = 0;
2065 
2066 	KASSERT(ic->ic_opmode == IEEE80211_M_HOSTAP);
2067 	if (!(ic->ic_caps & IEEE80211_C_APPMGT))
2068 		return 0;
2069 
2070 	wh = mtod(m, struct ieee80211_frame *);
2071 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2072 		/*
2073 		 * Buffer group addressed MSDUs with the Order bit clear
2074 		 * if any associated STAs are in PS mode.
2075 		 */
2076 		ieee80211_iterate_nodes(ic, ieee80211_count_pssta, &pssta);
2077 		if ((wh->i_fc[1] & IEEE80211_FC1_ORDER) || pssta == 0)
2078 			return 0;
2079 		ic->ic_tim_mcast_pending = 1;
2080 	} else {
2081 		/*
2082 		 * Buffer MSDUs, A-MSDUs or management frames destined for
2083 		 * PS STAs.
2084 		 */
2085 		if (ni->ni_pwrsave == IEEE80211_PS_AWAKE ||
2086 		    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2087 		    IEEE80211_FC0_TYPE_CTL)
2088 			return 0;
2089 		if (mq_empty(&ni->ni_savedq))
2090 			(*ic->ic_set_tim)(ic, ni->ni_associd, 1);
2091 	}
2092 	/* NB: ni == ic->ic_bss for broadcast/multicast */
2093 	/*
2094 	 * Similar to ieee80211_mgmt_output, store the node in a
2095 	 * special pkthdr field.
2096 	 */
2097 	m->m_pkthdr.ph_cookie = ni;
2098 	mq_enqueue(&ni->ni_savedq, m);
2099 	return 1;
2100 }
2101 #endif	/* IEEE80211_STA_ONLY */
2102