xref: /freebsd/sys/net80211/ieee80211_sta.c (revision 0b3105a37d7adcadcb720112fed4dc4e8040be99)
1 /*-
2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 #ifdef __FreeBSD__
28 __FBSDID("$FreeBSD$");
29 #endif
30 
31 /*
32  * IEEE 802.11 Station mode support.
33  */
34 #include "opt_inet.h"
35 #include "opt_wlan.h"
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/mbuf.h>
40 #include <sys/malloc.h>
41 #include <sys/kernel.h>
42 
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
47 #include <sys/proc.h>
48 #include <sys/sysctl.h>
49 
50 #include <net/if.h>
51 #include <net/if_media.h>
52 #include <net/if_llc.h>
53 #include <net/if_dl.h>
54 #include <net/if_var.h>
55 #include <net/ethernet.h>
56 
57 #include <net/bpf.h>
58 
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_sta.h>
61 #include <net80211/ieee80211_input.h>
62 #ifdef IEEE80211_SUPPORT_SUPERG
63 #include <net80211/ieee80211_superg.h>
64 #endif
65 #include <net80211/ieee80211_ratectl.h>
66 #include <net80211/ieee80211_sta.h>
67 
68 #define	IEEE80211_RATE2MBS(r)	(((r) & IEEE80211_RATE_VAL) / 2)
69 
70 static	void sta_vattach(struct ieee80211vap *);
71 static	void sta_beacon_miss(struct ieee80211vap *);
72 static	int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
73 static	int sta_input(struct ieee80211_node *, struct mbuf *,
74 	    const struct ieee80211_rx_stats *, int, int);
75 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
76 	    int subtype, const struct ieee80211_rx_stats *, int rssi, int nf);
77 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
78 
79 void
80 ieee80211_sta_attach(struct ieee80211com *ic)
81 {
82 	ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
83 }
84 
85 void
86 ieee80211_sta_detach(struct ieee80211com *ic)
87 {
88 }
89 
90 static void
91 sta_vdetach(struct ieee80211vap *vap)
92 {
93 }
94 
95 static void
96 sta_vattach(struct ieee80211vap *vap)
97 {
98 	vap->iv_newstate = sta_newstate;
99 	vap->iv_input = sta_input;
100 	vap->iv_recv_mgmt = sta_recv_mgmt;
101 	vap->iv_recv_ctl = sta_recv_ctl;
102 	vap->iv_opdetach = sta_vdetach;
103 	vap->iv_bmiss = sta_beacon_miss;
104 }
105 
106 /*
107  * Handle a beacon miss event.  The common code filters out
108  * spurious events that can happen when scanning and/or before
109  * reaching RUN state.
110  */
111 static void
112 sta_beacon_miss(struct ieee80211vap *vap)
113 {
114 	struct ieee80211com *ic = vap->iv_ic;
115 
116 	IEEE80211_LOCK_ASSERT(ic);
117 
118 	KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
119 	KASSERT(vap->iv_state >= IEEE80211_S_RUN,
120 	    ("wrong state %s", ieee80211_state_name[vap->iv_state]));
121 
122 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
123 	    "beacon miss, mode %s state %s\n",
124 	    ieee80211_opmode_name[vap->iv_opmode],
125 	    ieee80211_state_name[vap->iv_state]);
126 
127 	if (vap->iv_state == IEEE80211_S_CSA) {
128 		/*
129 		 * A Channel Switch is pending; assume we missed the
130 		 * beacon that would've completed the process and just
131 		 * force the switch.  If we made a mistake we'll not
132 		 * find the AP on the new channel and fall back to a
133 		 * normal scan.
134 		 */
135 		ieee80211_csa_completeswitch(ic);
136 		return;
137 	}
138 	if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
139 		/*
140 		 * Send a directed probe req before falling back to a
141 		 * scan; if we receive a response ic_bmiss_count will
142 		 * be reset.  Some cards mistakenly report beacon miss
143 		 * so this avoids the expensive scan if the ap is
144 		 * still there.
145 		 */
146 		ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
147 			vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
148 			vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
149 		return;
150 	}
151 
152 	callout_stop(&vap->iv_swbmiss);
153 	vap->iv_bmiss_count = 0;
154 	vap->iv_stats.is_beacon_miss++;
155 	if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
156 #ifdef IEEE80211_SUPPORT_SUPERG
157 		struct ieee80211com *ic = vap->iv_ic;
158 
159 		/*
160 		 * If we receive a beacon miss interrupt when using
161 		 * dynamic turbo, attempt to switch modes before
162 		 * reassociating.
163 		 */
164 		if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
165 			ieee80211_dturbo_switch(vap,
166 			    ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
167 #endif
168 		/*
169 		 * Try to reassociate before scanning for a new ap.
170 		 */
171 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
172 	} else {
173 		/*
174 		 * Somebody else is controlling state changes (e.g.
175 		 * a user-mode app) don't do anything that would
176 		 * confuse them; just drop into scan mode so they'll
177 		 * notified of the state change and given control.
178 		 */
179 		ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
180 	}
181 }
182 
183 /*
184  * Handle deauth with reason.  We retry only for
185  * the cases where we might succeed.  Otherwise
186  * we downgrade the ap and scan.
187  */
188 static void
189 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
190 {
191 	switch (reason) {
192 	case IEEE80211_STATUS_SUCCESS:		/* NB: MLME assoc */
193 	case IEEE80211_STATUS_TIMEOUT:
194 	case IEEE80211_REASON_ASSOC_EXPIRE:
195 	case IEEE80211_REASON_NOT_AUTHED:
196 	case IEEE80211_REASON_NOT_ASSOCED:
197 	case IEEE80211_REASON_ASSOC_LEAVE:
198 	case IEEE80211_REASON_ASSOC_NOT_AUTHED:
199 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
200 		break;
201 	default:
202 		ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
203 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
204 			ieee80211_check_scan_current(vap);
205 		break;
206 	}
207 }
208 
209 /*
210  * IEEE80211_M_STA vap state machine handler.
211  * This routine handles the main states in the 802.11 protocol.
212  */
213 static int
214 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
215 {
216 	struct ieee80211com *ic = vap->iv_ic;
217 	struct ieee80211_node *ni;
218 	enum ieee80211_state ostate;
219 
220 	IEEE80211_LOCK_ASSERT(ic);
221 
222 	ostate = vap->iv_state;
223 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
224 	    __func__, ieee80211_state_name[ostate],
225 	    ieee80211_state_name[nstate], arg);
226 	vap->iv_state = nstate;			/* state transition */
227 	callout_stop(&vap->iv_mgtsend);		/* XXX callout_drain */
228 	if (ostate != IEEE80211_S_SCAN)
229 		ieee80211_cancel_scan(vap);	/* background scan */
230 	ni = vap->iv_bss;			/* NB: no reference held */
231 	if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
232 		callout_stop(&vap->iv_swbmiss);
233 	switch (nstate) {
234 	case IEEE80211_S_INIT:
235 		switch (ostate) {
236 		case IEEE80211_S_SLEEP:
237 			/* XXX wakeup */
238 			/* XXX driver hook to wakeup the hardware? */
239 		case IEEE80211_S_RUN:
240 			IEEE80211_SEND_MGMT(ni,
241 			    IEEE80211_FC0_SUBTYPE_DISASSOC,
242 			    IEEE80211_REASON_ASSOC_LEAVE);
243 			ieee80211_sta_leave(ni);
244 			break;
245 		case IEEE80211_S_ASSOC:
246 			IEEE80211_SEND_MGMT(ni,
247 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
248 			    IEEE80211_REASON_AUTH_LEAVE);
249 			break;
250 		case IEEE80211_S_SCAN:
251 			ieee80211_cancel_scan(vap);
252 			break;
253 		default:
254 			goto invalid;
255 		}
256 		if (ostate != IEEE80211_S_INIT) {
257 			/* NB: optimize INIT -> INIT case */
258 			ieee80211_reset_bss(vap);
259 		}
260 		if (vap->iv_auth->ia_detach != NULL)
261 			vap->iv_auth->ia_detach(vap);
262 		break;
263 	case IEEE80211_S_SCAN:
264 		switch (ostate) {
265 		case IEEE80211_S_INIT:
266 			/*
267 			 * Initiate a scan.  We can come here as a result
268 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
269 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
270 			 * and the scan request parameters will be present
271 			 * in iv_scanreq.  Otherwise we do the default.
272 			 */
273 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
274 				ieee80211_check_scan(vap,
275 				    vap->iv_scanreq_flags,
276 				    vap->iv_scanreq_duration,
277 				    vap->iv_scanreq_mindwell,
278 				    vap->iv_scanreq_maxdwell,
279 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
280 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
281 			} else
282 				ieee80211_check_scan_current(vap);
283 			break;
284 		case IEEE80211_S_SCAN:
285 		case IEEE80211_S_AUTH:
286 		case IEEE80211_S_ASSOC:
287 			/*
288 			 * These can happen either because of a timeout
289 			 * on an assoc/auth response or because of a
290 			 * change in state that requires a reset.  For
291 			 * the former we're called with a non-zero arg
292 			 * that is the cause for the failure; pass this
293 			 * to the scan code so it can update state.
294 			 * Otherwise trigger a new scan unless we're in
295 			 * manual roaming mode in which case an application
296 			 * must issue an explicit scan request.
297 			 */
298 			if (arg != 0)
299 				ieee80211_scan_assoc_fail(vap,
300 					vap->iv_bss->ni_macaddr, arg);
301 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
302 				ieee80211_check_scan_current(vap);
303 			break;
304 		case IEEE80211_S_SLEEP:		/* beacon miss */
305 			/*
306 			 * XXX if in sleep we need to wakeup the hardware.
307 			 */
308 			/* FALLTHROUGH */
309 		case IEEE80211_S_RUN:		/* beacon miss */
310 			/*
311 			 * Beacon miss.  Notify user space and if not
312 			 * under control of a user application (roaming
313 			 * manual) kick off a scan to re-connect.
314 			 */
315 
316 			ieee80211_sta_leave(ni);
317 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
318 				ieee80211_check_scan_current(vap);
319 			break;
320 		default:
321 			goto invalid;
322 		}
323 		break;
324 	case IEEE80211_S_AUTH:
325 		switch (ostate) {
326 		case IEEE80211_S_INIT:
327 		case IEEE80211_S_SCAN:
328 			IEEE80211_SEND_MGMT(ni,
329 			    IEEE80211_FC0_SUBTYPE_AUTH, 1);
330 			break;
331 		case IEEE80211_S_AUTH:
332 		case IEEE80211_S_ASSOC:
333 			switch (arg & 0xff) {
334 			case IEEE80211_FC0_SUBTYPE_AUTH:
335 				/* ??? */
336 				IEEE80211_SEND_MGMT(ni,
337 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
338 				break;
339 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
340 				sta_authretry(vap, ni, arg>>8);
341 				break;
342 			}
343 			break;
344 		case IEEE80211_S_RUN:
345 			switch (arg & 0xff) {
346 			case IEEE80211_FC0_SUBTYPE_AUTH:
347 				IEEE80211_SEND_MGMT(ni,
348 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
349 				vap->iv_state = ostate;	/* stay RUN */
350 				break;
351 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
352 				ieee80211_sta_leave(ni);
353 				if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
354 					/* try to reauth */
355 					IEEE80211_SEND_MGMT(ni,
356 					    IEEE80211_FC0_SUBTYPE_AUTH, 1);
357 				}
358 				break;
359 			}
360 			break;
361 		default:
362 			goto invalid;
363 		}
364 		break;
365 	case IEEE80211_S_ASSOC:
366 		switch (ostate) {
367 		case IEEE80211_S_AUTH:
368 		case IEEE80211_S_ASSOC:
369 			IEEE80211_SEND_MGMT(ni,
370 			    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
371 			break;
372 		case IEEE80211_S_SLEEP:		/* cannot happen */
373 		case IEEE80211_S_RUN:
374 			ieee80211_sta_leave(ni);
375 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
376 				IEEE80211_SEND_MGMT(ni, arg ?
377 				    IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
378 				    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
379 			}
380 			break;
381 		default:
382 			goto invalid;
383 		}
384 		break;
385 	case IEEE80211_S_RUN:
386 		if (vap->iv_flags & IEEE80211_F_WPA) {
387 			/* XXX validate prerequisites */
388 		}
389 		switch (ostate) {
390 		case IEEE80211_S_RUN:
391 		case IEEE80211_S_CSA:
392 			break;
393 		case IEEE80211_S_AUTH:		/* when join is done in fw */
394 		case IEEE80211_S_ASSOC:
395 #ifdef IEEE80211_DEBUG
396 			if (ieee80211_msg_debug(vap)) {
397 				ieee80211_note(vap, "%s with %s ssid ",
398 				    (vap->iv_opmode == IEEE80211_M_STA ?
399 				    "associated" : "synchronized"),
400 				    ether_sprintf(ni->ni_bssid));
401 				ieee80211_print_essid(vap->iv_bss->ni_essid,
402 				    ni->ni_esslen);
403 				/* XXX MCS/HT */
404 				printf(" channel %d start %uMb\n",
405 				    ieee80211_chan2ieee(ic, ic->ic_curchan),
406 				    IEEE80211_RATE2MBS(ni->ni_txrate));
407 			}
408 #endif
409 			ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
410 			ieee80211_notify_node_join(ni,
411 			    arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
412 			break;
413 		case IEEE80211_S_SLEEP:
414 			/* Wake up from sleep */
415 			vap->iv_sta_ps(vap, 0);
416 			break;
417 		default:
418 			goto invalid;
419 		}
420 		ieee80211_sync_curchan(ic);
421 		if (ostate != IEEE80211_S_RUN &&
422 		    (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)) {
423 			/*
424 			 * Start s/w beacon miss timer for devices w/o
425 			 * hardware support.  We fudge a bit here since
426 			 * we're doing this in software.
427 			 */
428 			vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
429 				2 * vap->iv_bmissthreshold * ni->ni_intval);
430 			vap->iv_swbmiss_count = 0;
431 			callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
432 				ieee80211_swbmiss, vap);
433 		}
434 		/*
435 		 * When 802.1x is not in use mark the port authorized
436 		 * at this point so traffic can flow.
437 		 */
438 		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
439 			ieee80211_node_authorize(ni);
440 		/*
441 		 * Fake association when joining an existing bss.
442 		 *
443 		 * Don't do this if we're doing SLEEP->RUN.
444 		 */
445 		if (ic->ic_newassoc != NULL && ostate != IEEE80211_S_SLEEP)
446 			ic->ic_newassoc(vap->iv_bss, (ostate != IEEE80211_S_RUN));
447 		break;
448 	case IEEE80211_S_CSA:
449 		if (ostate != IEEE80211_S_RUN)
450 			goto invalid;
451 		break;
452 	case IEEE80211_S_SLEEP:
453 		vap->iv_sta_ps(vap, 1);
454 		break;
455 	default:
456 	invalid:
457 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
458 		    "%s: unexpected state transition %s -> %s\n", __func__,
459 		    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
460 		break;
461 	}
462 	return 0;
463 }
464 
465 /*
466  * Return non-zero if the frame is an echo of a multicast
467  * frame sent by ourself.  The dir is known to be DSTODS.
468  */
469 static __inline int
470 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
471 {
472 #define	QWH4(wh)	((const struct ieee80211_qosframe_addr4 *)wh)
473 #define	WH4(wh)		((const struct ieee80211_frame_addr4 *)wh)
474 	const uint8_t *sa;
475 
476 	KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
477 
478 	if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
479 		return 0;
480 	sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
481 	return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
482 #undef WH4
483 #undef QWH4
484 }
485 
486 /*
487  * Return non-zero if the frame is an echo of a multicast
488  * frame sent by ourself.  The dir is known to be FROMDS.
489  */
490 static __inline int
491 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
492 {
493 	KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
494 
495 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
496 		return 0;
497 	return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
498 }
499 
500 /*
501  * Decide if a received management frame should be
502  * printed when debugging is enabled.  This filters some
503  * of the less interesting frames that come frequently
504  * (e.g. beacons).
505  */
506 static __inline int
507 doprint(struct ieee80211vap *vap, int subtype)
508 {
509 	switch (subtype) {
510 	case IEEE80211_FC0_SUBTYPE_BEACON:
511 		return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
512 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
513 		return 0;
514 	}
515 	return 1;
516 }
517 
518 /*
519  * Process a received frame.  The node associated with the sender
520  * should be supplied.  If nothing was found in the node table then
521  * the caller is assumed to supply a reference to iv_bss instead.
522  * The RSSI and a timestamp are also supplied.  The RSSI data is used
523  * during AP scanning to select a AP to associate with; it can have
524  * any units so long as values have consistent units and higher values
525  * mean ``better signal''.  The receive timestamp is currently not used
526  * by the 802.11 layer.
527  */
528 static int
529 sta_input(struct ieee80211_node *ni, struct mbuf *m,
530     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
531 {
532 	struct ieee80211vap *vap = ni->ni_vap;
533 	struct ieee80211com *ic = ni->ni_ic;
534 	struct ifnet *ifp = vap->iv_ifp;
535 	struct ieee80211_frame *wh;
536 	struct ieee80211_key *key;
537 	struct ether_header *eh;
538 	int hdrspace, need_tap = 1;	/* mbuf need to be tapped. */
539 	uint8_t dir, type, subtype, qos;
540 	uint8_t *bssid;
541 	uint16_t rxseq;
542 
543 	if (m->m_flags & M_AMPDU_MPDU) {
544 		/*
545 		 * Fastpath for A-MPDU reorder q resubmission.  Frames
546 		 * w/ M_AMPDU_MPDU marked have already passed through
547 		 * here but were received out of order and been held on
548 		 * the reorder queue.  When resubmitted they are marked
549 		 * with the M_AMPDU_MPDU flag and we can bypass most of
550 		 * the normal processing.
551 		 */
552 		wh = mtod(m, struct ieee80211_frame *);
553 		type = IEEE80211_FC0_TYPE_DATA;
554 		dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
555 		subtype = IEEE80211_FC0_SUBTYPE_QOS;
556 		hdrspace = ieee80211_hdrspace(ic, wh);	/* XXX optimize? */
557 		goto resubmit_ampdu;
558 	}
559 
560 	KASSERT(ni != NULL, ("null node"));
561 	ni->ni_inact = ni->ni_inact_reload;
562 
563 	type = -1;			/* undefined */
564 
565 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
566 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
567 		    ni->ni_macaddr, NULL,
568 		    "too short (1): len %u", m->m_pkthdr.len);
569 		vap->iv_stats.is_rx_tooshort++;
570 		goto out;
571 	}
572 	/*
573 	 * Bit of a cheat here, we use a pointer for a 3-address
574 	 * frame format but don't reference fields past outside
575 	 * ieee80211_frame_min w/o first validating the data is
576 	 * present.
577 	 */
578 	wh = mtod(m, struct ieee80211_frame *);
579 
580 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
581 	    IEEE80211_FC0_VERSION_0) {
582 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
583 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
584 		    wh->i_fc[0], wh->i_fc[1]);
585 		vap->iv_stats.is_rx_badversion++;
586 		goto err;
587 	}
588 
589 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
590 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
591 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
592 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
593 		bssid = wh->i_addr2;
594 		if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
595 			/* not interested in */
596 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
597 			    bssid, NULL, "%s", "not to bss");
598 			vap->iv_stats.is_rx_wrongbss++;
599 			goto out;
600 		}
601 
602 		/*
603 		 * Some devices may be in a promiscuous mode
604 		 * where they receive frames for multiple station
605 		 * addresses.
606 		 *
607 		 * If we receive a data frame that isn't
608 		 * destined to our VAP MAC, drop it.
609 		 *
610 		 * XXX TODO: This is only enforced when not scanning;
611 		 * XXX it assumes a software-driven scan will put the NIC
612 		 * XXX into a "no data frames" mode before setting this
613 		 * XXX flag. Otherwise it may be possible that we'll still
614 		 * XXX process data frames whilst scanning.
615 		 */
616 		if ((! IEEE80211_IS_MULTICAST(wh->i_addr1))
617 		    && (! IEEE80211_ADDR_EQ(wh->i_addr1, IF_LLADDR(ifp)))) {
618 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
619 			    bssid, NULL, "not to cur sta: lladdr=%6D, addr1=%6D",
620 			    IF_LLADDR(ifp), ":", wh->i_addr1, ":");
621 			vap->iv_stats.is_rx_wrongbss++;
622 			goto out;
623 		}
624 
625 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
626 		ni->ni_noise = nf;
627 		if ( IEEE80211_HAS_SEQ(type, subtype) &&
628 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
629 			uint8_t tid = ieee80211_gettid(wh);
630 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
631 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
632 				ic->ic_wme.wme_hipri_traffic++;
633 			rxseq = le16toh(*(uint16_t *)wh->i_seq);
634 			if (! ieee80211_check_rxseq(ni, wh)) {
635 				/* duplicate, discard */
636 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
637 				    bssid, "duplicate",
638 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
639 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
640 				    ni->ni_rxseqs[tid] >>
641 					IEEE80211_SEQ_SEQ_SHIFT,
642 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
643 				    ni->ni_rxseqs[tid] &
644 					IEEE80211_SEQ_FRAG_MASK,
645 				    tid);
646 				vap->iv_stats.is_rx_dup++;
647 				IEEE80211_NODE_STAT(ni, rx_dup);
648 				goto out;
649 			}
650 			ni->ni_rxseqs[tid] = rxseq;
651 		}
652 	}
653 
654 	switch (type) {
655 	case IEEE80211_FC0_TYPE_DATA:
656 		hdrspace = ieee80211_hdrspace(ic, wh);
657 		if (m->m_len < hdrspace &&
658 		    (m = m_pullup(m, hdrspace)) == NULL) {
659 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
660 			    ni->ni_macaddr, NULL,
661 			    "data too short: expecting %u", hdrspace);
662 			vap->iv_stats.is_rx_tooshort++;
663 			goto out;		/* XXX */
664 		}
665 		/*
666 		 * Handle A-MPDU re-ordering.  If the frame is to be
667 		 * processed directly then ieee80211_ampdu_reorder
668 		 * will return 0; otherwise it has consumed the mbuf
669 		 * and we should do nothing more with it.
670 		 */
671 		if ((m->m_flags & M_AMPDU) &&
672 		    (dir == IEEE80211_FC1_DIR_FROMDS ||
673 		     dir == IEEE80211_FC1_DIR_DSTODS) &&
674 		    ieee80211_ampdu_reorder(ni, m) != 0) {
675 			m = NULL;
676 			goto out;
677 		}
678 	resubmit_ampdu:
679 		if (dir == IEEE80211_FC1_DIR_FROMDS) {
680 			if ((ifp->if_flags & IFF_SIMPLEX) &&
681 			    isfromds_mcastecho(vap, wh)) {
682 				/*
683 				 * In IEEE802.11 network, multicast
684 				 * packets sent from "me" are broadcast
685 				 * from the AP; silently discard for
686 				 * SIMPLEX interface.
687 				 */
688 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
689 				    wh, "data", "%s", "multicast echo");
690 				vap->iv_stats.is_rx_mcastecho++;
691 				goto out;
692 			}
693 			if ((vap->iv_flags & IEEE80211_F_DWDS) &&
694 			    IEEE80211_IS_MULTICAST(wh->i_addr1)) {
695 				/*
696 				 * DWDS sta's must drop 3-address mcast frames
697 				 * as they will be sent separately as a 4-addr
698 				 * frame.  Accepting the 3-addr frame will
699 				 * confuse the bridge into thinking the sending
700 				 * sta is located at the end of WDS link.
701 				 */
702 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
703 				    "3-address data", "%s", "DWDS enabled");
704 				vap->iv_stats.is_rx_mcastecho++;
705 				goto out;
706 			}
707 		} else if (dir == IEEE80211_FC1_DIR_DSTODS) {
708 			if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
709 				IEEE80211_DISCARD(vap,
710 				    IEEE80211_MSG_INPUT, wh, "4-address data",
711 				    "%s", "DWDS not enabled");
712 				vap->iv_stats.is_rx_wrongdir++;
713 				goto out;
714 			}
715 			if ((ifp->if_flags & IFF_SIMPLEX) &&
716 			    isdstods_mcastecho(vap, wh)) {
717 				/*
718 				 * In IEEE802.11 network, multicast
719 				 * packets sent from "me" are broadcast
720 				 * from the AP; silently discard for
721 				 * SIMPLEX interface.
722 				 */
723 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
724 				    "4-address data", "%s", "multicast echo");
725 				vap->iv_stats.is_rx_mcastecho++;
726 				goto out;
727 			}
728 		} else {
729 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
730 			    "data", "incorrect dir 0x%x", dir);
731 			vap->iv_stats.is_rx_wrongdir++;
732 			goto out;
733 		}
734 
735 		/*
736 		 * Handle privacy requirements.  Note that we
737 		 * must not be preempted from here until after
738 		 * we (potentially) call ieee80211_crypto_demic;
739 		 * otherwise we may violate assumptions in the
740 		 * crypto cipher modules used to do delayed update
741 		 * of replay sequence numbers.
742 		 */
743 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
744 			if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
745 				/*
746 				 * Discard encrypted frames when privacy is off.
747 				 */
748 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
749 				    wh, "WEP", "%s", "PRIVACY off");
750 				vap->iv_stats.is_rx_noprivacy++;
751 				IEEE80211_NODE_STAT(ni, rx_noprivacy);
752 				goto out;
753 			}
754 			key = ieee80211_crypto_decap(ni, m, hdrspace);
755 			if (key == NULL) {
756 				/* NB: stats+msgs handled in crypto_decap */
757 				IEEE80211_NODE_STAT(ni, rx_wepfail);
758 				goto out;
759 			}
760 			wh = mtod(m, struct ieee80211_frame *);
761 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
762 		} else {
763 			/* XXX M_WEP and IEEE80211_F_PRIVACY */
764 			key = NULL;
765 		}
766 
767 		/*
768 		 * Save QoS bits for use below--before we strip the header.
769 		 */
770 		if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
771 			qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
772 			    ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
773 			    ((struct ieee80211_qosframe *)wh)->i_qos[0];
774 		} else
775 			qos = 0;
776 
777 		/*
778 		 * Next up, any fragmentation.
779 		 */
780 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
781 			m = ieee80211_defrag(ni, m, hdrspace);
782 			if (m == NULL) {
783 				/* Fragment dropped or frame not complete yet */
784 				goto out;
785 			}
786 		}
787 		wh = NULL;		/* no longer valid, catch any uses */
788 
789 		/*
790 		 * Next strip any MSDU crypto bits.
791 		 */
792 		if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
793 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
794 			    ni->ni_macaddr, "data", "%s", "demic error");
795 			vap->iv_stats.is_rx_demicfail++;
796 			IEEE80211_NODE_STAT(ni, rx_demicfail);
797 			goto out;
798 		}
799 
800 		/* copy to listener after decrypt */
801 		if (ieee80211_radiotap_active_vap(vap))
802 			ieee80211_radiotap_rx(vap, m);
803 		need_tap = 0;
804 
805 		/*
806 		 * Finally, strip the 802.11 header.
807 		 */
808 		m = ieee80211_decap(vap, m, hdrspace);
809 		if (m == NULL) {
810 			/* XXX mask bit to check for both */
811 			/* don't count Null data frames as errors */
812 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
813 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
814 				goto out;
815 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
816 			    ni->ni_macaddr, "data", "%s", "decap error");
817 			vap->iv_stats.is_rx_decap++;
818 			IEEE80211_NODE_STAT(ni, rx_decap);
819 			goto err;
820 		}
821 		eh = mtod(m, struct ether_header *);
822 		if (!ieee80211_node_is_authorized(ni)) {
823 			/*
824 			 * Deny any non-PAE frames received prior to
825 			 * authorization.  For open/shared-key
826 			 * authentication the port is mark authorized
827 			 * after authentication completes.  For 802.1x
828 			 * the port is not marked authorized by the
829 			 * authenticator until the handshake has completed.
830 			 */
831 			if (eh->ether_type != htons(ETHERTYPE_PAE)) {
832 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
833 				    eh->ether_shost, "data",
834 				    "unauthorized port: ether type 0x%x len %u",
835 				    eh->ether_type, m->m_pkthdr.len);
836 				vap->iv_stats.is_rx_unauth++;
837 				IEEE80211_NODE_STAT(ni, rx_unauth);
838 				goto err;
839 			}
840 		} else {
841 			/*
842 			 * When denying unencrypted frames, discard
843 			 * any non-PAE frames received without encryption.
844 			 */
845 			if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
846 			    (key == NULL && (m->m_flags & M_WEP) == 0) &&
847 			    eh->ether_type != htons(ETHERTYPE_PAE)) {
848 				/*
849 				 * Drop unencrypted frames.
850 				 */
851 				vap->iv_stats.is_rx_unencrypted++;
852 				IEEE80211_NODE_STAT(ni, rx_unencrypted);
853 				goto out;
854 			}
855 		}
856 		/* XXX require HT? */
857 		if (qos & IEEE80211_QOS_AMSDU) {
858 			m = ieee80211_decap_amsdu(ni, m);
859 			if (m == NULL)
860 				return IEEE80211_FC0_TYPE_DATA;
861 		} else {
862 #ifdef IEEE80211_SUPPORT_SUPERG
863 			m = ieee80211_decap_fastframe(vap, ni, m);
864 			if (m == NULL)
865 				return IEEE80211_FC0_TYPE_DATA;
866 #endif
867 		}
868 		ieee80211_deliver_data(vap, ni, m);
869 		return IEEE80211_FC0_TYPE_DATA;
870 
871 	case IEEE80211_FC0_TYPE_MGT:
872 		vap->iv_stats.is_rx_mgmt++;
873 		IEEE80211_NODE_STAT(ni, rx_mgmt);
874 		if (dir != IEEE80211_FC1_DIR_NODS) {
875 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
876 			    wh, "data", "incorrect dir 0x%x", dir);
877 			vap->iv_stats.is_rx_wrongdir++;
878 			goto err;
879 		}
880 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
881 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
882 			    ni->ni_macaddr, "mgt", "too short: len %u",
883 			    m->m_pkthdr.len);
884 			vap->iv_stats.is_rx_tooshort++;
885 			goto out;
886 		}
887 #ifdef IEEE80211_DEBUG
888 		if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
889 		    ieee80211_msg_dumppkts(vap)) {
890 			if_printf(ifp, "received %s from %s rssi %d\n",
891 			    ieee80211_mgt_subtype_name[subtype >>
892 				IEEE80211_FC0_SUBTYPE_SHIFT],
893 			    ether_sprintf(wh->i_addr2), rssi);
894 		}
895 #endif
896 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
897 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
898 				/*
899 				 * Only shared key auth frames with a challenge
900 				 * should be encrypted, discard all others.
901 				 */
902 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
903 				    wh, ieee80211_mgt_subtype_name[subtype >>
904 					IEEE80211_FC0_SUBTYPE_SHIFT],
905 				    "%s", "WEP set but not permitted");
906 				vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
907 				goto out;
908 			}
909 			if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
910 				/*
911 				 * Discard encrypted frames when privacy is off.
912 				 */
913 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
914 				    wh, "mgt", "%s", "WEP set but PRIVACY off");
915 				vap->iv_stats.is_rx_noprivacy++;
916 				goto out;
917 			}
918 			hdrspace = ieee80211_hdrspace(ic, wh);
919 			key = ieee80211_crypto_decap(ni, m, hdrspace);
920 			if (key == NULL) {
921 				/* NB: stats+msgs handled in crypto_decap */
922 				goto out;
923 			}
924 			wh = mtod(m, struct ieee80211_frame *);
925 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
926 		}
927 		vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
928 		goto out;
929 
930 	case IEEE80211_FC0_TYPE_CTL:
931 		vap->iv_stats.is_rx_ctl++;
932 		IEEE80211_NODE_STAT(ni, rx_ctrl);
933 		vap->iv_recv_ctl(ni, m, subtype);
934 		goto out;
935 
936 	default:
937 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
938 		    wh, NULL, "bad frame type 0x%x", type);
939 		/* should not come here */
940 		break;
941 	}
942 err:
943 	if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
944 out:
945 	if (m != NULL) {
946 		if (need_tap && ieee80211_radiotap_active_vap(vap))
947 			ieee80211_radiotap_rx(vap, m);
948 		m_freem(m);
949 	}
950 	return type;
951 }
952 
953 static void
954 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
955     int rssi, int nf, uint16_t seq, uint16_t status)
956 {
957 	struct ieee80211vap *vap = ni->ni_vap;
958 
959 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
960 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
961 		    ni->ni_macaddr, "open auth",
962 		    "bad sta auth mode %u", ni->ni_authmode);
963 		vap->iv_stats.is_rx_bad_auth++;	/* XXX */
964 		return;
965 	}
966 	if (vap->iv_state != IEEE80211_S_AUTH ||
967 	    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
968 		vap->iv_stats.is_rx_bad_auth++;
969 		return;
970 	}
971 	if (status != 0) {
972 		IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
973 		    ni, "open auth failed (reason %d)", status);
974 		vap->iv_stats.is_rx_auth_fail++;
975 		vap->iv_stats.is_rx_authfail_code = status;
976 		ieee80211_new_state(vap, IEEE80211_S_SCAN,
977 		    IEEE80211_SCAN_FAIL_STATUS);
978 	} else
979 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
980 }
981 
982 static void
983 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
984     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
985     uint16_t seq, uint16_t status)
986 {
987 	struct ieee80211vap *vap = ni->ni_vap;
988 	uint8_t *challenge;
989 	int estatus;
990 
991 	/*
992 	 * NB: this can happen as we allow pre-shared key
993 	 * authentication to be enabled w/o wep being turned
994 	 * on so that configuration of these can be done
995 	 * in any order.  It may be better to enforce the
996 	 * ordering in which case this check would just be
997 	 * for sanity/consistency.
998 	 */
999 	if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1000 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1001 		    ni->ni_macaddr, "shared key auth",
1002 		    "%s", " PRIVACY is disabled");
1003 		estatus = IEEE80211_STATUS_ALG;
1004 		goto bad;
1005 	}
1006 	/*
1007 	 * Pre-shared key authentication is evil; accept
1008 	 * it only if explicitly configured (it is supported
1009 	 * mainly for compatibility with clients like OS X).
1010 	 */
1011 	if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1012 	    ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1013 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1014 		    ni->ni_macaddr, "shared key auth",
1015 		    "bad sta auth mode %u", ni->ni_authmode);
1016 		vap->iv_stats.is_rx_bad_auth++;	/* XXX maybe a unique error? */
1017 		estatus = IEEE80211_STATUS_ALG;
1018 		goto bad;
1019 	}
1020 
1021 	challenge = NULL;
1022 	if (frm + 1 < efrm) {
1023 		if ((frm[1] + 2) > (efrm - frm)) {
1024 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1025 			    ni->ni_macaddr, "shared key auth",
1026 			    "ie %d/%d too long",
1027 			    frm[0], (frm[1] + 2) - (efrm - frm));
1028 			vap->iv_stats.is_rx_bad_auth++;
1029 			estatus = IEEE80211_STATUS_CHALLENGE;
1030 			goto bad;
1031 		}
1032 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
1033 			challenge = frm;
1034 		frm += frm[1] + 2;
1035 	}
1036 	switch (seq) {
1037 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1038 	case IEEE80211_AUTH_SHARED_RESPONSE:
1039 		if (challenge == NULL) {
1040 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1041 			    ni->ni_macaddr, "shared key auth",
1042 			    "%s", "no challenge");
1043 			vap->iv_stats.is_rx_bad_auth++;
1044 			estatus = IEEE80211_STATUS_CHALLENGE;
1045 			goto bad;
1046 		}
1047 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1048 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1049 			    ni->ni_macaddr, "shared key auth",
1050 			    "bad challenge len %d", challenge[1]);
1051 			vap->iv_stats.is_rx_bad_auth++;
1052 			estatus = IEEE80211_STATUS_CHALLENGE;
1053 			goto bad;
1054 		}
1055 	default:
1056 		break;
1057 	}
1058 	if (vap->iv_state != IEEE80211_S_AUTH)
1059 		return;
1060 	switch (seq) {
1061 	case IEEE80211_AUTH_SHARED_PASS:
1062 		if (ni->ni_challenge != NULL) {
1063 			IEEE80211_FREE(ni->ni_challenge, M_80211_NODE);
1064 			ni->ni_challenge = NULL;
1065 		}
1066 		if (status != 0) {
1067 			IEEE80211_NOTE_FRAME(vap,
1068 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
1069 			    "shared key auth failed (reason %d)", status);
1070 			vap->iv_stats.is_rx_auth_fail++;
1071 			vap->iv_stats.is_rx_authfail_code = status;
1072 			return;
1073 		}
1074 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1075 		break;
1076 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1077 		if (!ieee80211_alloc_challenge(ni))
1078 			return;
1079 		/* XXX could optimize by passing recvd challenge */
1080 		memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1081 		IEEE80211_SEND_MGMT(ni,
1082 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1083 		break;
1084 	default:
1085 		IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1086 		    wh, "shared key auth", "bad seq %d", seq);
1087 		vap->iv_stats.is_rx_bad_auth++;
1088 		return;
1089 	}
1090 	return;
1091 bad:
1092 	/*
1093 	 * Kick the state machine.  This short-circuits
1094 	 * using the mgt frame timeout to trigger the
1095 	 * state transition.
1096 	 */
1097 	if (vap->iv_state == IEEE80211_S_AUTH)
1098 		ieee80211_new_state(vap, IEEE80211_S_SCAN,
1099 		    IEEE80211_SCAN_FAIL_STATUS);
1100 }
1101 
1102 int
1103 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
1104 	const struct ieee80211_frame *wh)
1105 {
1106 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1107 	struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
1108 	u_int len = frm[1], qosinfo;
1109 	int i;
1110 
1111 	if (len < sizeof(struct ieee80211_wme_param)-2) {
1112 		IEEE80211_DISCARD_IE(vap,
1113 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1114 		    wh, "WME", "too short, len %u", len);
1115 		return -1;
1116 	}
1117 	qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1118 	qosinfo &= WME_QOSINFO_COUNT;
1119 	/* XXX do proper check for wraparound */
1120 	if (qosinfo == wme->wme_wmeChanParams.cap_info)
1121 		return 0;
1122 	frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1123 	for (i = 0; i < WME_NUM_AC; i++) {
1124 		struct wmeParams *wmep =
1125 			&wme->wme_wmeChanParams.cap_wmeParams[i];
1126 		/* NB: ACI not used */
1127 		wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1128 		wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1129 		wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1130 		wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1131 		wmep->wmep_txopLimit = LE_READ_2(frm+2);
1132 		frm += 4;
1133 	}
1134 	wme->wme_wmeChanParams.cap_info = qosinfo;
1135 	return 1;
1136 #undef MS
1137 }
1138 
1139 /*
1140  * Process 11h Channel Switch Announcement (CSA) ie.  If this
1141  * is the first CSA then initiate the switch.  Otherwise we
1142  * track state and trigger completion and/or cancel of the switch.
1143  * XXX should be public for IBSS use
1144  */
1145 static void
1146 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
1147 	const struct ieee80211_frame *wh)
1148 {
1149 	struct ieee80211com *ic = vap->iv_ic;
1150 	const struct ieee80211_csa_ie *csa =
1151 	    (const struct ieee80211_csa_ie *) frm;
1152 
1153 	KASSERT(vap->iv_state >= IEEE80211_S_RUN,
1154 	    ("state %s", ieee80211_state_name[vap->iv_state]));
1155 
1156 	if (csa->csa_mode > 1) {
1157 		IEEE80211_DISCARD_IE(vap,
1158 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1159 		    wh, "CSA", "invalid mode %u", csa->csa_mode);
1160 		return;
1161 	}
1162 	IEEE80211_LOCK(ic);
1163 	if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
1164 		/*
1165 		 * Convert the channel number to a channel reference.  We
1166 		 * try first to preserve turbo attribute of the current
1167 		 * channel then fallback.  Note this will not work if the
1168 		 * CSA specifies a channel that requires a band switch (e.g.
1169 		 * 11a => 11g).  This is intentional as 11h is defined only
1170 		 * for 5GHz/11a and because the switch does not involve a
1171 		 * reassociation, protocol state (capabilities, negotated
1172 		 * rates, etc) may/will be wrong.
1173 		 */
1174 		struct ieee80211_channel *c =
1175 		    ieee80211_find_channel_byieee(ic, csa->csa_newchan,
1176 			(ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
1177 		if (c == NULL) {
1178 			c = ieee80211_find_channel_byieee(ic,
1179 			    csa->csa_newchan,
1180 			    (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
1181 			if (c == NULL) {
1182 				IEEE80211_DISCARD_IE(vap,
1183 				    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1184 				    wh, "CSA", "invalid channel %u",
1185 				    csa->csa_newchan);
1186 				goto done;
1187 			}
1188 		}
1189 #if IEEE80211_CSA_COUNT_MIN > 0
1190 		if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
1191 			/*
1192 			 * Require at least IEEE80211_CSA_COUNT_MIN count to
1193 			 * reduce the risk of being redirected by a fabricated
1194 			 * CSA.  If a valid CSA is dropped we'll still get a
1195 			 * beacon miss when the AP leaves the channel so we'll
1196 			 * eventually follow to the new channel.
1197 			 *
1198 			 * NOTE: this violates the 11h spec that states that
1199 			 * count may be any value and if 0 then a switch
1200 			 * should happen asap.
1201 			 */
1202 			IEEE80211_DISCARD_IE(vap,
1203 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1204 			    wh, "CSA", "count %u too small, must be >= %u",
1205 			    csa->csa_count, IEEE80211_CSA_COUNT_MIN);
1206 			goto done;
1207 		}
1208 #endif
1209 		ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
1210 	} else {
1211 		/*
1212 		 * Validate this ie against the initial CSA.  We require
1213 		 * mode and channel not change and the count must be
1214 		 * monotonically decreasing.  This may be pointless and
1215 		 * canceling the switch as a result may be too paranoid but
1216 		 * in the worst case if we drop out of CSA because of this
1217 		 * and the AP does move then we'll just end up taking a
1218 		 * beacon miss and scan to find the AP.
1219 		 *
1220 		 * XXX may want <= on count as we also process ProbeResp
1221 		 * frames and those may come in w/ the same count as the
1222 		 * previous beacon; but doing so leaves us open to a stuck
1223 		 * count until we add a dead-man timer
1224 		 */
1225 		if (!(csa->csa_count < ic->ic_csa_count &&
1226 		      csa->csa_mode == ic->ic_csa_mode &&
1227 		      csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
1228 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
1229 			    "CSA ie mismatch, initial ie <%d,%d,%d>, "
1230 			    "this ie <%d,%d,%d>", ic->ic_csa_mode,
1231 			    ic->ic_csa_newchan, ic->ic_csa_count,
1232 			    csa->csa_mode, csa->csa_newchan, csa->csa_count);
1233 			ieee80211_csa_cancelswitch(ic);
1234 		} else {
1235 			if (csa->csa_count <= 1)
1236 				ieee80211_csa_completeswitch(ic);
1237 			else
1238 				ic->ic_csa_count = csa->csa_count;
1239 		}
1240 	}
1241 done:
1242 	IEEE80211_UNLOCK(ic);
1243 }
1244 
1245 /*
1246  * Return non-zero if a background scan may be continued:
1247  * o bg scan is active
1248  * o no channel switch is pending
1249  * o there has not been any traffic recently
1250  *
1251  * Note we do not check if there is an administrative enable;
1252  * this is only done to start the scan.  We assume that any
1253  * change in state will be accompanied by a request to cancel
1254  * active scans which will otherwise cause this test to fail.
1255  */
1256 static __inline int
1257 contbgscan(struct ieee80211vap *vap)
1258 {
1259 	struct ieee80211com *ic = vap->iv_ic;
1260 
1261 	return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1262 	    (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1263 	    vap->iv_state == IEEE80211_S_RUN &&		/* XXX? */
1264 	    time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1265 }
1266 
1267 /*
1268  * Return non-zero if a backgrond scan may be started:
1269  * o bg scanning is administratively enabled
1270  * o no channel switch is pending
1271  * o we are not boosted on a dynamic turbo channel
1272  * o there has not been a scan recently
1273  * o there has not been any traffic recently
1274  */
1275 static __inline int
1276 startbgscan(struct ieee80211vap *vap)
1277 {
1278 	struct ieee80211com *ic = vap->iv_ic;
1279 
1280 	return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
1281 	    (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1282 #ifdef IEEE80211_SUPPORT_SUPERG
1283 	    !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1284 #endif
1285 	    time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
1286 	    time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1287 }
1288 
1289 static void
1290 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1291     const struct ieee80211_rx_stats *rxs,
1292     int rssi, int nf)
1293 {
1294 #define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1295 #define	ISREASSOC(_st)	((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1296 	struct ieee80211vap *vap = ni->ni_vap;
1297 	struct ieee80211com *ic = ni->ni_ic;
1298 	struct ieee80211_channel *rxchan = ic->ic_curchan;
1299 	struct ieee80211_frame *wh;
1300 	uint8_t *frm, *efrm;
1301 	uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
1302 	uint8_t rate;
1303 	int ht_state_change = 0;
1304 
1305 	wh = mtod(m0, struct ieee80211_frame *);
1306 	frm = (uint8_t *)&wh[1];
1307 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1308 	switch (subtype) {
1309 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1310 	case IEEE80211_FC0_SUBTYPE_BEACON: {
1311 		struct ieee80211_scanparams scan;
1312 		struct ieee80211_channel *c;
1313 		/*
1314 		 * We process beacon/probe response frames:
1315 		 *    o when scanning, or
1316 		 *    o station mode when associated (to collect state
1317 		 *      updates such as 802.11g slot time)
1318 		 * Frames otherwise received are discarded.
1319 		 */
1320 		if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
1321 			vap->iv_stats.is_rx_mgtdiscard++;
1322 			return;
1323 		}
1324 
1325 		/* Override RX channel as appropriate */
1326 		if (rxs != NULL) {
1327 			c = ieee80211_lookup_channel_rxstatus(vap, rxs);
1328 			if (c != NULL)
1329 				rxchan = c;
1330 		}
1331 
1332 		/* XXX probe response in sta mode when !scanning? */
1333 		if (ieee80211_parse_beacon(ni, m0, rxchan, &scan) != 0) {
1334 			if (! (ic->ic_flags & IEEE80211_F_SCAN))
1335 				vap->iv_stats.is_beacon_bad++;
1336 			return;
1337 		}
1338 
1339 		/*
1340 		 * Count frame now that we know it's to be processed.
1341 		 */
1342 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1343 			vap->iv_stats.is_rx_beacon++;		/* XXX remove */
1344 			IEEE80211_NODE_STAT(ni, rx_beacons);
1345 		} else
1346 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1347 		/*
1348 		 * When operating in station mode, check for state updates.
1349 		 * Be careful to ignore beacons received while doing a
1350 		 * background scan.  We consider only 11g/WMM stuff right now.
1351 		 */
1352 		if (ni->ni_associd != 0 &&
1353 		    ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1354 		     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1355 			/* record tsf of last beacon */
1356 			memcpy(ni->ni_tstamp.data, scan.tstamp,
1357 				sizeof(ni->ni_tstamp));
1358 			/* count beacon frame for s/w bmiss handling */
1359 			vap->iv_swbmiss_count++;
1360 			vap->iv_bmiss_count = 0;
1361 			if (ni->ni_erp != scan.erp) {
1362 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1363 				    wh->i_addr2,
1364 				    "erp change: was 0x%x, now 0x%x",
1365 				    ni->ni_erp, scan.erp);
1366 				if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1367 				    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1368 					ic->ic_flags |= IEEE80211_F_USEPROT;
1369 				else
1370 					ic->ic_flags &= ~IEEE80211_F_USEPROT;
1371 				ni->ni_erp = scan.erp;
1372 				/* XXX statistic */
1373 				/* XXX driver notification */
1374 			}
1375 			if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1376 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1377 				    wh->i_addr2,
1378 				    "capabilities change: was 0x%x, now 0x%x",
1379 				    ni->ni_capinfo, scan.capinfo);
1380 				/*
1381 				 * NB: we assume short preamble doesn't
1382 				 *     change dynamically
1383 				 */
1384 				ieee80211_set_shortslottime(ic,
1385 					IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
1386 					(scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1387 				ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
1388 					       | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
1389 				/* XXX statistic */
1390 			}
1391 			if (scan.wme != NULL &&
1392 			    (ni->ni_flags & IEEE80211_NODE_QOS) &&
1393 			    ieee80211_parse_wmeparams(vap, scan.wme, wh) > 0)
1394 				ieee80211_wme_updateparams(vap);
1395 #ifdef IEEE80211_SUPPORT_SUPERG
1396 			if (scan.ath != NULL)
1397 				ieee80211_parse_athparams(ni, scan.ath, wh);
1398 #endif
1399 			if (scan.htcap != NULL && scan.htinfo != NULL &&
1400 			    (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1401 				/* XXX state changes? */
1402 				if (ieee80211_ht_updateparams(ni,
1403 				    scan.htcap, scan.htinfo))
1404 					ht_state_change = 1;
1405 			}
1406 			if (scan.quiet)
1407 				ic->ic_set_quiet(ni, scan.quiet);
1408 
1409 			if (scan.tim != NULL) {
1410 				struct ieee80211_tim_ie *tim =
1411 				    (struct ieee80211_tim_ie *) scan.tim;
1412 				/*
1413 				 * XXX Check/debug this code; see if it's about
1414 				 * the right time to force the VAP awake if we
1415 				 * receive a frame destined for us?
1416 				 */
1417 				int aid = IEEE80211_AID(ni->ni_associd);
1418 				int ix = aid / NBBY;
1419 				int min = tim->tim_bitctl &~ 1;
1420 				int max = tim->tim_len + min - 4;
1421 				int tim_ucast = 0, tim_mcast = 0;
1422 
1423 				/*
1424 				 * Only do this for unicast traffic in the TIM
1425 				 * The multicast traffic notification for
1426 				 * the scan notification stuff should occur
1427 				 * differently.
1428 				 */
1429 				if (min <= ix && ix <= max &&
1430 				     isset(tim->tim_bitmap - min, aid)) {
1431 					tim_ucast = 1;
1432 				}
1433 
1434 				/*
1435 				 * Do a separate notification
1436 				 * for the multicast bit being set.
1437 				 */
1438 				if (tim->tim_bitctl & 1) {
1439 					tim_mcast = 1;
1440 				}
1441 
1442 				/*
1443 				 * If the TIM indicates there's traffic for
1444 				 * us then get us out of STA mode powersave.
1445 				 */
1446 				if (tim_ucast == 1) {
1447 
1448 					/*
1449 					 * Wake us out of SLEEP state if we're
1450 					 * in it; and if we're doing bgscan
1451 					 * then wake us out of STA powersave.
1452 					 */
1453 					ieee80211_sta_tim_notify(vap, 1);
1454 
1455 					/*
1456 					 * This is preventing us from
1457 					 * continuing a bgscan; because it
1458 					 * tricks the contbgscan()
1459 					 * routine to think there's always
1460 					 * traffic for us.
1461 					 *
1462 					 * I think we need both an RX and
1463 					 * TX ic_lastdata field.
1464 					 */
1465 					ic->ic_lastdata = ticks;
1466 				}
1467 
1468 				ni->ni_dtim_count = tim->tim_count;
1469 				ni->ni_dtim_period = tim->tim_period;
1470 			}
1471 			if (scan.csa != NULL &&
1472 			    (vap->iv_flags & IEEE80211_F_DOTH))
1473 				ieee80211_parse_csaparams(vap, scan.csa, wh);
1474 			else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
1475 				/*
1476 				 * No CSA ie or 11h disabled, but a channel
1477 				 * switch is pending; drop out so we aren't
1478 				 * stuck in CSA state.  If the AP really is
1479 				 * moving we'll get a beacon miss and scan.
1480 				 */
1481 				IEEE80211_LOCK(ic);
1482 				ieee80211_csa_cancelswitch(ic);
1483 				IEEE80211_UNLOCK(ic);
1484 			}
1485 			/*
1486 			 * If scanning, pass the info to the scan module.
1487 			 * Otherwise, check if it's the right time to do
1488 			 * a background scan.  Background scanning must
1489 			 * be enabled and we must not be operating in the
1490 			 * turbo phase of dynamic turbo mode.  Then,
1491 			 * it's been a while since the last background
1492 			 * scan and if no data frames have come through
1493 			 * recently, kick off a scan.  Note that this
1494 			 * is the mechanism by which a background scan
1495 			 * is started _and_ continued each time we
1496 			 * return on-channel to receive a beacon from
1497 			 * our ap.
1498 			 */
1499 			if (ic->ic_flags & IEEE80211_F_SCAN) {
1500 				ieee80211_add_scan(vap, rxchan,
1501 				    &scan, wh, subtype, rssi, nf);
1502 			} else if (contbgscan(vap)) {
1503 				ieee80211_bg_scan(vap, 0);
1504 			} else if (startbgscan(vap)) {
1505 				vap->iv_stats.is_scan_bg++;
1506 #if 0
1507 				/* wakeup if we are sleeing */
1508 				ieee80211_set_pwrsave(vap, 0);
1509 #endif
1510 				ieee80211_bg_scan(vap, 0);
1511 			}
1512 
1513 			/*
1514 			 * Put the station to sleep if we haven't seen
1515 			 * traffic in a while.
1516 			 */
1517 			IEEE80211_LOCK(ic);
1518 			ieee80211_sta_ps_timer_check(vap);
1519 			IEEE80211_UNLOCK(ic);
1520 
1521 			/*
1522 			 * If we've had a channel width change (eg HT20<->HT40)
1523 			 * then schedule a delayed driver notification.
1524 			 */
1525 			if (ht_state_change)
1526 				ieee80211_update_chw(ic);
1527 			return;
1528 		}
1529 		/*
1530 		 * If scanning, just pass information to the scan module.
1531 		 */
1532 		if (ic->ic_flags & IEEE80211_F_SCAN) {
1533 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1534 				/*
1535 				 * Actively scanning a channel marked passive;
1536 				 * send a probe request now that we know there
1537 				 * is 802.11 traffic present.
1538 				 *
1539 				 * XXX check if the beacon we recv'd gives
1540 				 * us what we need and suppress the probe req
1541 				 */
1542 				ieee80211_probe_curchan(vap, 1);
1543 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1544 			}
1545 			ieee80211_add_scan(vap, rxchan, &scan, wh,
1546 			    subtype, rssi, nf);
1547 			return;
1548 		}
1549 		break;
1550 	}
1551 
1552 	case IEEE80211_FC0_SUBTYPE_AUTH: {
1553 		uint16_t algo, seq, status;
1554 		/*
1555 		 * auth frame format
1556 		 *	[2] algorithm
1557 		 *	[2] sequence
1558 		 *	[2] status
1559 		 *	[tlv*] challenge
1560 		 */
1561 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1562 		algo   = le16toh(*(uint16_t *)frm);
1563 		seq    = le16toh(*(uint16_t *)(frm + 2));
1564 		status = le16toh(*(uint16_t *)(frm + 4));
1565 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1566 		    "recv auth frame with algorithm %d seq %d", algo, seq);
1567 
1568 		if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1569 			IEEE80211_DISCARD(vap,
1570 			    IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1571 			    wh, "auth", "%s", "TKIP countermeasures enabled");
1572 			vap->iv_stats.is_rx_auth_countermeasures++;
1573 			if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1574 				ieee80211_send_error(ni, wh->i_addr2,
1575 					IEEE80211_FC0_SUBTYPE_AUTH,
1576 					IEEE80211_REASON_MIC_FAILURE);
1577 			}
1578 			return;
1579 		}
1580 		if (algo == IEEE80211_AUTH_ALG_SHARED)
1581 			sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1582 			    seq, status);
1583 		else if (algo == IEEE80211_AUTH_ALG_OPEN)
1584 			sta_auth_open(ni, wh, rssi, nf, seq, status);
1585 		else {
1586 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1587 			    wh, "auth", "unsupported alg %d", algo);
1588 			vap->iv_stats.is_rx_auth_unsupported++;
1589 			return;
1590 		}
1591 		break;
1592 	}
1593 
1594 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1595 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
1596 		uint16_t capinfo, associd;
1597 		uint16_t status;
1598 
1599 		if (vap->iv_state != IEEE80211_S_ASSOC) {
1600 			vap->iv_stats.is_rx_mgtdiscard++;
1601 			return;
1602 		}
1603 
1604 		/*
1605 		 * asresp frame format
1606 		 *	[2] capability information
1607 		 *	[2] status
1608 		 *	[2] association ID
1609 		 *	[tlv] supported rates
1610 		 *	[tlv] extended supported rates
1611 		 *	[tlv] WME
1612 		 *	[tlv] HT capabilities
1613 		 *	[tlv] HT info
1614 		 */
1615 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1616 		ni = vap->iv_bss;
1617 		capinfo = le16toh(*(uint16_t *)frm);
1618 		frm += 2;
1619 		status = le16toh(*(uint16_t *)frm);
1620 		frm += 2;
1621 		if (status != 0) {
1622 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1623 			    wh->i_addr2, "%sassoc failed (reason %d)",
1624 			    ISREASSOC(subtype) ?  "re" : "", status);
1625 			vap->iv_stats.is_rx_auth_fail++;	/* XXX */
1626 			return;
1627 		}
1628 		associd = le16toh(*(uint16_t *)frm);
1629 		frm += 2;
1630 
1631 		rates = xrates = wme = htcap = htinfo = NULL;
1632 		while (efrm - frm > 1) {
1633 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1634 			switch (*frm) {
1635 			case IEEE80211_ELEMID_RATES:
1636 				rates = frm;
1637 				break;
1638 			case IEEE80211_ELEMID_XRATES:
1639 				xrates = frm;
1640 				break;
1641 			case IEEE80211_ELEMID_HTCAP:
1642 				htcap = frm;
1643 				break;
1644 			case IEEE80211_ELEMID_HTINFO:
1645 				htinfo = frm;
1646 				break;
1647 			case IEEE80211_ELEMID_VENDOR:
1648 				if (iswmeoui(frm))
1649 					wme = frm;
1650 				else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1651 					/*
1652 					 * Accept pre-draft HT ie's if the
1653 					 * standard ones have not been seen.
1654 					 */
1655 					if (ishtcapoui(frm)) {
1656 						if (htcap == NULL)
1657 							htcap = frm;
1658 					} else if (ishtinfooui(frm)) {
1659 						if (htinfo == NULL)
1660 							htinfo = frm;
1661 					}
1662 				}
1663 				/* XXX Atheros OUI support */
1664 				break;
1665 			}
1666 			frm += frm[1] + 2;
1667 		}
1668 
1669 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1670 		if (xrates != NULL)
1671 			IEEE80211_VERIFY_ELEMENT(xrates,
1672 				IEEE80211_RATE_MAXSIZE - rates[1], return);
1673 		rate = ieee80211_setup_rates(ni, rates, xrates,
1674 				IEEE80211_F_JOIN |
1675 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1676 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1677 		if (rate & IEEE80211_RATE_BASIC) {
1678 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1679 			    wh->i_addr2,
1680 			    "%sassoc failed (rate set mismatch)",
1681 			    ISREASSOC(subtype) ?  "re" : "");
1682 			vap->iv_stats.is_rx_assoc_norate++;
1683 			ieee80211_new_state(vap, IEEE80211_S_SCAN,
1684 			    IEEE80211_SCAN_FAIL_STATUS);
1685 			return;
1686 		}
1687 
1688 		ni->ni_capinfo = capinfo;
1689 		ni->ni_associd = associd;
1690 		if (ni->ni_jointime == 0)
1691 			ni->ni_jointime = time_uptime;
1692 		if (wme != NULL &&
1693 		    ieee80211_parse_wmeparams(vap, wme, wh) >= 0) {
1694 			ni->ni_flags |= IEEE80211_NODE_QOS;
1695 			ieee80211_wme_updateparams(vap);
1696 		} else
1697 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
1698 		/*
1699 		 * Setup HT state according to the negotiation.
1700 		 *
1701 		 * NB: shouldn't need to check if HT use is enabled but some
1702 		 *     ap's send back HT ie's even when we don't indicate we
1703 		 *     are HT capable in our AssocReq.
1704 		 */
1705 		if (htcap != NULL && htinfo != NULL &&
1706 		    (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1707 			ieee80211_ht_node_init(ni);
1708 			ieee80211_ht_updateparams(ni, htcap, htinfo);
1709 			ieee80211_setup_htrates(ni, htcap,
1710 			     IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1711 			ieee80211_setup_basic_htrates(ni, htinfo);
1712 			ieee80211_node_setuptxparms(ni);
1713 			ieee80211_ratectl_node_init(ni);
1714 		} else {
1715 #ifdef IEEE80211_SUPPORT_SUPERG
1716 			if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
1717 				ieee80211_ff_node_init(ni);
1718 #endif
1719 		}
1720 		/*
1721 		 * Configure state now that we are associated.
1722 		 *
1723 		 * XXX may need different/additional driver callbacks?
1724 		 */
1725 		if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1726 		    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1727 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1728 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1729 		} else {
1730 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1731 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1732 		}
1733 		ieee80211_set_shortslottime(ic,
1734 			IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1735 			(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1736 		/*
1737 		 * Honor ERP protection.
1738 		 *
1739 		 * NB: ni_erp should zero for non-11g operation.
1740 		 */
1741 		if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1742 		    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1743 			ic->ic_flags |= IEEE80211_F_USEPROT;
1744 		else
1745 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1746 		IEEE80211_NOTE_MAC(vap,
1747 		    IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
1748 		    "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
1749 		    ISREASSOC(subtype) ? "re" : "",
1750 		    IEEE80211_NODE_AID(ni),
1751 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1752 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1753 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1754 		    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1755 		    ni->ni_flags & IEEE80211_NODE_HT ?
1756 			(ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
1757 		    ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1758 		    ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
1759 			ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
1760 		    ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
1761 		    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
1762 			", fast-frames" : "",
1763 		    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
1764 			", turbo" : ""
1765 		);
1766 		ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
1767 		break;
1768 	}
1769 
1770 	case IEEE80211_FC0_SUBTYPE_DEAUTH: {
1771 		uint16_t reason;
1772 
1773 		if (vap->iv_state == IEEE80211_S_SCAN) {
1774 			vap->iv_stats.is_rx_mgtdiscard++;
1775 			return;
1776 		}
1777 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1778 			/* NB: can happen when in promiscuous mode */
1779 			vap->iv_stats.is_rx_mgtdiscard++;
1780 			break;
1781 		}
1782 
1783 		/*
1784 		 * deauth frame format
1785 		 *	[2] reason
1786 		 */
1787 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1788 		reason = le16toh(*(uint16_t *)frm);
1789 
1790 		vap->iv_stats.is_rx_deauth++;
1791 		vap->iv_stats.is_rx_deauth_code = reason;
1792 		IEEE80211_NODE_STAT(ni, rx_deauth);
1793 
1794 		IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1795 		    "recv deauthenticate (reason %d)", reason);
1796 		ieee80211_new_state(vap, IEEE80211_S_AUTH,
1797 		    (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
1798 		break;
1799 	}
1800 
1801 	case IEEE80211_FC0_SUBTYPE_DISASSOC: {
1802 		uint16_t reason;
1803 
1804 		if (vap->iv_state != IEEE80211_S_RUN &&
1805 		    vap->iv_state != IEEE80211_S_ASSOC &&
1806 		    vap->iv_state != IEEE80211_S_AUTH) {
1807 			vap->iv_stats.is_rx_mgtdiscard++;
1808 			return;
1809 		}
1810 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1811 			/* NB: can happen when in promiscuous mode */
1812 			vap->iv_stats.is_rx_mgtdiscard++;
1813 			break;
1814 		}
1815 
1816 		/*
1817 		 * disassoc frame format
1818 		 *	[2] reason
1819 		 */
1820 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1821 		reason = le16toh(*(uint16_t *)frm);
1822 
1823 		vap->iv_stats.is_rx_disassoc++;
1824 		vap->iv_stats.is_rx_disassoc_code = reason;
1825 		IEEE80211_NODE_STAT(ni, rx_disassoc);
1826 
1827 		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1828 		    "recv disassociate (reason %d)", reason);
1829 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1830 		break;
1831 	}
1832 
1833 	case IEEE80211_FC0_SUBTYPE_ACTION:
1834 	case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
1835 		if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
1836 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1837 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1838 			    wh, NULL, "%s", "not for us");
1839 			vap->iv_stats.is_rx_mgtdiscard++;
1840 		} else if (vap->iv_state != IEEE80211_S_RUN) {
1841 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1842 			    wh, NULL, "wrong state %s",
1843 			    ieee80211_state_name[vap->iv_state]);
1844 			vap->iv_stats.is_rx_mgtdiscard++;
1845 		} else {
1846 			if (ieee80211_parse_action(ni, m0) == 0)
1847 				(void)ic->ic_recv_action(ni, wh, frm, efrm);
1848 		}
1849 		break;
1850 
1851 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1852 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1853 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1854 	case IEEE80211_FC0_SUBTYPE_TIMING_ADV:
1855 	case IEEE80211_FC0_SUBTYPE_ATIM:
1856 		IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1857 		    wh, NULL, "%s", "not handled");
1858 		vap->iv_stats.is_rx_mgtdiscard++;
1859 		break;
1860 
1861 	default:
1862 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1863 		    wh, "mgt", "subtype 0x%x not handled", subtype);
1864 		vap->iv_stats.is_rx_badsubtype++;
1865 		break;
1866 	}
1867 #undef ISREASSOC
1868 #undef ISPROBE
1869 }
1870 
1871 static void
1872 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
1873 {
1874 	switch (subtype) {
1875 	case IEEE80211_FC0_SUBTYPE_BAR:
1876 		ieee80211_recv_bar(ni, m);
1877 		break;
1878 	}
1879 }
1880