xref: /dflybsd-src/sys/netproto/802_11/wlan/ieee80211_sta.c (revision 9e1c08804a46f1c1a9cd11e190ddba7d2bc4abed)
1 /*-
2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  * $FreeBSD: head/sys/net80211/ieee80211_sta.c 203422 2010-02-03 10:07:43Z rpaulo $
26  */
27 
28 /*
29  * IEEE 802.11 Station mode support.
30  */
31 #include "opt_inet.h"
32 #include "opt_wlan.h"
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/mbuf.h>
37 #include <sys/malloc.h>
38 #include <sys/kernel.h>
39 
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/endian.h>
43 #include <sys/errno.h>
44 #include <sys/proc.h>
45 #include <sys/sysctl.h>
46 
47 #include <net/if.h>
48 #include <net/if_media.h>
49 #include <net/if_llc.h>
50 #include <net/ethernet.h>
51 #include <net/route.h>
52 
53 #include <net/bpf.h>
54 
55 #include <netproto/802_11/ieee80211_var.h>
56 #include <netproto/802_11/ieee80211_sta.h>
57 #include <netproto/802_11/ieee80211_input.h>
58 #include <netproto/802_11/ieee80211_ratectl.h>
59 #ifdef IEEE80211_SUPPORT_SUPERG
60 #include <netproto/802_11/ieee80211_superg.h>
61 #endif
62 
63 #define	IEEE80211_RATE2MBS(r)	(((r) & IEEE80211_RATE_VAL) / 2)
64 
65 static	void sta_vattach(struct ieee80211vap *);
66 static	void sta_beacon_miss(struct ieee80211vap *);
67 static	int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
68 static	int sta_input(struct ieee80211_node *, struct mbuf *, int, int);
69 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
70 	    int subtype, int rssi, int nf);
71 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
72 
73 void
74 ieee80211_sta_attach(struct ieee80211com *ic)
75 {
76 	ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
77 }
78 
79 void
80 ieee80211_sta_detach(struct ieee80211com *ic)
81 {
82 }
83 
84 static void
85 sta_vdetach(struct ieee80211vap *vap)
86 {
87 }
88 
89 static void
90 sta_vattach(struct ieee80211vap *vap)
91 {
92 	vap->iv_newstate = sta_newstate;
93 	vap->iv_input = sta_input;
94 	vap->iv_recv_mgmt = sta_recv_mgmt;
95 	vap->iv_recv_ctl = sta_recv_ctl;
96 	vap->iv_opdetach = sta_vdetach;
97 	vap->iv_bmiss = sta_beacon_miss;
98 }
99 
100 /*
101  * Handle a beacon miss event.  The common code filters out
102  * spurious events that can happen when scanning and/or before
103  * reaching RUN state.
104  */
105 static void
106 sta_beacon_miss(struct ieee80211vap *vap)
107 {
108 	struct ieee80211com *ic = vap->iv_ic;
109 
110 	KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
111 	KASSERT(vap->iv_state >= IEEE80211_S_RUN,
112 	    ("wrong state %s", ieee80211_state_name[vap->iv_state]));
113 
114 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
115 	    "beacon miss, mode %s state %s\n",
116 	    ieee80211_opmode_name[vap->iv_opmode],
117 	    ieee80211_state_name[vap->iv_state]);
118 
119 	if (vap->iv_state == IEEE80211_S_CSA) {
120 		/*
121 		 * A Channel Switch is pending; assume we missed the
122 		 * beacon that would've completed the process and just
123 		 * force the switch.  If we made a mistake we'll not
124 		 * find the AP on the new channel and fall back to a
125 		 * normal scan.
126 		 */
127 		ieee80211_csa_completeswitch(ic);
128 		return;
129 	}
130 	if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
131 		/*
132 		 * Send a directed probe req before falling back to a
133 		 * scan; if we receive a response ic_bmiss_count will
134 		 * be reset.  Some cards mistakenly report beacon miss
135 		 * so this avoids the expensive scan if the ap is
136 		 * still there.
137 		 */
138 		ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
139 			vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
140 			vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
141 		return;
142 	}
143 	vap->iv_bmiss_count = 0;
144 	vap->iv_stats.is_beacon_miss++;
145 	if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
146 #ifdef IEEE80211_SUPPORT_SUPERG
147 		struct ieee80211com *ic = vap->iv_ic;
148 
149 		/*
150 		 * If we receive a beacon miss interrupt when using
151 		 * dynamic turbo, attempt to switch modes before
152 		 * reassociating.
153 		 */
154 		if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
155 			ieee80211_dturbo_switch(vap,
156 			    ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
157 #endif
158 		/*
159 		 * Try to reassociate before scanning for a new ap.
160 		 */
161 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
162 	} else {
163 		/*
164 		 * Somebody else is controlling state changes (e.g.
165 		 * a user-mode app) don't do anything that would
166 		 * confuse them; just drop into scan mode so they'll
167 		 * notified of the state change and given control.
168 		 */
169 		ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
170 	}
171 }
172 
173 /*
174  * Handle deauth with reason.  We retry only for
175  * the cases where we might succeed.  Otherwise
176  * we downgrade the ap and scan.
177  */
178 static void
179 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
180 {
181 	switch (reason) {
182 	case IEEE80211_STATUS_SUCCESS:		/* NB: MLME assoc */
183 	case IEEE80211_STATUS_TIMEOUT:
184 	case IEEE80211_REASON_ASSOC_EXPIRE:
185 	case IEEE80211_REASON_NOT_AUTHED:
186 	case IEEE80211_REASON_NOT_ASSOCED:
187 	case IEEE80211_REASON_ASSOC_LEAVE:
188 	case IEEE80211_REASON_ASSOC_NOT_AUTHED:
189 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
190 		break;
191 	default:
192 		ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
193 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
194 			ieee80211_check_scan_current(vap);
195 		break;
196 	}
197 }
198 
199 /*
200  * IEEE80211_M_STA vap state machine handler.
201  * This routine handles the main states in the 802.11 protocol.
202  */
203 static int
204 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
205 {
206 	struct ieee80211com *ic = vap->iv_ic;
207 	struct ieee80211_node *ni;
208 	enum ieee80211_state ostate;
209 #ifdef IEEE80211_DEBUG
210 	char ethstr[ETHER_ADDRSTRLEN + 1];
211 #endif
212 	ostate = vap->iv_state;
213 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
214 	    __func__, ieee80211_state_name[ostate],
215 	    ieee80211_state_name[nstate], arg);
216 	vap->iv_state = nstate;			/* state transition */
217 	callout_stop(&vap->iv_mgtsend);
218 	if (ostate != IEEE80211_S_SCAN)
219 		ieee80211_cancel_scan(vap);	/* background scan */
220 	ni = vap->iv_bss;			/* NB: no reference held */
221 	if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
222 		callout_stop(&vap->iv_swbmiss);
223 	switch (nstate) {
224 	case IEEE80211_S_INIT:
225 		switch (ostate) {
226 		case IEEE80211_S_SLEEP:
227 			/* XXX wakeup */
228 		case IEEE80211_S_RUN:
229 			IEEE80211_SEND_MGMT(ni,
230 			    IEEE80211_FC0_SUBTYPE_DISASSOC,
231 			    IEEE80211_REASON_ASSOC_LEAVE);
232 			ieee80211_sta_leave(ni);
233 			break;
234 		case IEEE80211_S_ASSOC:
235 			IEEE80211_SEND_MGMT(ni,
236 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
237 			    IEEE80211_REASON_AUTH_LEAVE);
238 			break;
239 		case IEEE80211_S_SCAN:
240 			ieee80211_cancel_scan(vap);
241 			break;
242 		default:
243 			goto invalid;
244 		}
245 		if (ostate != IEEE80211_S_INIT) {
246 			/* NB: optimize INIT -> INIT case */
247 			ieee80211_reset_bss(vap);
248 		}
249 		if (vap->iv_auth->ia_detach != NULL)
250 			vap->iv_auth->ia_detach(vap);
251 		break;
252 	case IEEE80211_S_SCAN:
253 		switch (ostate) {
254 		case IEEE80211_S_INIT:
255 			/*
256 			 * Initiate a scan.  We can come here as a result
257 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
258 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
259 			 * and the scan request parameters will be present
260 			 * in iv_scanreq.  Otherwise we do the default.
261 			 */
262 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
263 				ieee80211_check_scan(vap,
264 				    vap->iv_scanreq_flags,
265 				    vap->iv_scanreq_duration,
266 				    vap->iv_scanreq_mindwell,
267 				    vap->iv_scanreq_maxdwell,
268 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
269 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
270 			} else
271 				ieee80211_check_scan_current(vap);
272 			break;
273 		case IEEE80211_S_SCAN:
274 		case IEEE80211_S_AUTH:
275 		case IEEE80211_S_ASSOC:
276 			/*
277 			 * These can happen either because of a timeout
278 			 * on an assoc/auth response or because of a
279 			 * change in state that requires a reset.  For
280 			 * the former we're called with a non-zero arg
281 			 * that is the cause for the failure; pass this
282 			 * to the scan code so it can update state.
283 			 * Otherwise trigger a new scan unless we're in
284 			 * manual roaming mode in which case an application
285 			 * must issue an explicit scan request.
286 			 */
287 			if (arg != 0)
288 				ieee80211_scan_assoc_fail(vap,
289 					vap->iv_bss->ni_macaddr, arg);
290 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
291 				ieee80211_check_scan_current(vap);
292 			break;
293 		case IEEE80211_S_RUN:		/* beacon miss */
294 			/*
295 			 * Beacon miss.  Notify user space and if not
296 			 * under control of a user application (roaming
297 			 * manual) kick off a scan to re-connect.
298 			 */
299 			ieee80211_sta_leave(ni);
300 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
301 				ieee80211_check_scan_current(vap);
302 			break;
303 		default:
304 			goto invalid;
305 		}
306 		break;
307 	case IEEE80211_S_AUTH:
308 		switch (ostate) {
309 		case IEEE80211_S_INIT:
310 		case IEEE80211_S_SCAN:
311 			IEEE80211_SEND_MGMT(ni,
312 			    IEEE80211_FC0_SUBTYPE_AUTH, 1);
313 			break;
314 		case IEEE80211_S_AUTH:
315 		case IEEE80211_S_ASSOC:
316 			switch (arg & 0xff) {
317 			case IEEE80211_FC0_SUBTYPE_AUTH:
318 				/* ??? */
319 				IEEE80211_SEND_MGMT(ni,
320 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
321 				break;
322 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
323 				sta_authretry(vap, ni, arg>>8);
324 				break;
325 			}
326 			break;
327 		case IEEE80211_S_RUN:
328 			switch (arg & 0xff) {
329 			case IEEE80211_FC0_SUBTYPE_AUTH:
330 				IEEE80211_SEND_MGMT(ni,
331 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
332 				vap->iv_state = ostate;	/* stay RUN */
333 				break;
334 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
335 				ieee80211_sta_leave(ni);
336 				if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
337 					/* try to reauth */
338 					IEEE80211_SEND_MGMT(ni,
339 					    IEEE80211_FC0_SUBTYPE_AUTH, 1);
340 				}
341 				break;
342 			}
343 			break;
344 		default:
345 			goto invalid;
346 		}
347 		break;
348 	case IEEE80211_S_ASSOC:
349 		switch (ostate) {
350 		case IEEE80211_S_AUTH:
351 		case IEEE80211_S_ASSOC:
352 			IEEE80211_SEND_MGMT(ni,
353 			    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
354 			break;
355 		case IEEE80211_S_SLEEP:		/* cannot happen */
356 		case IEEE80211_S_RUN:
357 			ieee80211_sta_leave(ni);
358 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
359 				IEEE80211_SEND_MGMT(ni, arg ?
360 				    IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
361 				    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
362 			}
363 			break;
364 		default:
365 			goto invalid;
366 		}
367 		break;
368 	case IEEE80211_S_RUN:
369 		if (vap->iv_flags & IEEE80211_F_WPA) {
370 			/* XXX validate prerequisites */
371 		}
372 		switch (ostate) {
373 		case IEEE80211_S_RUN:
374 		case IEEE80211_S_CSA:
375 			break;
376 		case IEEE80211_S_AUTH:		/* when join is done in fw */
377 		case IEEE80211_S_ASSOC:
378 #ifdef IEEE80211_DEBUG
379 			if (ieee80211_msg_debug(vap)) {
380 				ieee80211_note(vap, "%s with %s ssid ",
381 				    (vap->iv_opmode == IEEE80211_M_STA ?
382 				    "associated" : "synchronized"),
383 				    kether_ntoa(ni->ni_bssid, ethstr));
384 				ieee80211_print_essid(vap->iv_bss->ni_essid,
385 				    ni->ni_esslen);
386 				/* XXX MCS/HT */
387 				kprintf(" channel %d start %uMb\n",
388 				    ieee80211_chan2ieee(ic, ic->ic_curchan),
389 				    IEEE80211_RATE2MBS(ni->ni_txrate));
390 			}
391 #endif
392 			ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
393 			ieee80211_notify_node_join(ni,
394 			    arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
395 			break;
396 		case IEEE80211_S_SLEEP:
397 			ieee80211_sta_pwrsave(vap, 0);
398 			break;
399 		default:
400 			goto invalid;
401 		}
402 		ieee80211_sync_curchan(ic);
403 		if (ostate != IEEE80211_S_RUN &&
404 		    (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)) {
405 			/*
406 			 * Start s/w beacon miss timer for devices w/o
407 			 * hardware support.  We fudge a bit here since
408 			 * we're doing this in software.
409 			 */
410 			vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
411 				2 * vap->iv_bmissthreshold * ni->ni_intval);
412 			vap->iv_swbmiss_count = 0;
413 			callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
414 				      ieee80211_swbmiss_callout, vap);
415 		}
416 		/*
417 		 * When 802.1x is not in use mark the port authorized
418 		 * at this point so traffic can flow.
419 		 */
420 		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
421 			ieee80211_node_authorize(ni);
422 		/*
423 		 * Fake association when joining an existing bss.
424 		 */
425 		if (ic->ic_newassoc != NULL)
426 			ic->ic_newassoc(vap->iv_bss, ostate != IEEE80211_S_RUN);
427 		break;
428 	case IEEE80211_S_CSA:
429 		if (ostate != IEEE80211_S_RUN)
430 			goto invalid;
431 		break;
432 	case IEEE80211_S_SLEEP:
433 		ieee80211_sta_pwrsave(vap, 1);
434 		break;
435 	default:
436 	invalid:
437 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
438 		    "%s: unexpected state transition %s -> %s\n", __func__,
439 		    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
440 		break;
441 	}
442 	return 0;
443 }
444 
445 /*
446  * Return non-zero if the frame is an echo of a multicast
447  * frame sent by ourself.  The dir is known to be DSTODS.
448  */
449 static __inline int
450 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
451 {
452 #define	QWH4(wh)	((const struct ieee80211_qosframe_addr4 *)wh)
453 #define	WH4(wh)		((const struct ieee80211_frame_addr4 *)wh)
454 	const uint8_t *sa;
455 
456 	KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
457 
458 	if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
459 		return 0;
460 	sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
461 	return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
462 #undef WH4
463 #undef QWH4
464 }
465 
466 /*
467  * Return non-zero if the frame is an echo of a multicast
468  * frame sent by ourself.  The dir is known to be FROMDS.
469  */
470 static __inline int
471 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
472 {
473 	KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
474 
475 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
476 		return 0;
477 	return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
478 }
479 
480 /*
481  * Decide if a received management frame should be
482  * printed when debugging is enabled.  This filters some
483  * of the less interesting frames that come frequently
484  * (e.g. beacons).
485  */
486 static __inline int
487 doprint(struct ieee80211vap *vap, int subtype)
488 {
489 	switch (subtype) {
490 	case IEEE80211_FC0_SUBTYPE_BEACON:
491 		return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
492 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
493 		return 0;
494 	}
495 	return 1;
496 }
497 
498 /*
499  * Process a received frame.  The node associated with the sender
500  * should be supplied.  If nothing was found in the node table then
501  * the caller is assumed to supply a reference to iv_bss instead.
502  * The RSSI and a timestamp are also supplied.  The RSSI data is used
503  * during AP scanning to select a AP to associate with; it can have
504  * any units so long as values have consistent units and higher values
505  * mean ``better signal''.  The receive timestamp is currently not used
506  * by the 802.11 layer.
507  */
508 static int
509 sta_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
510 {
511 #define	SEQ_LEQ(a,b)	((int)((a)-(b)) <= 0)
512 #define	HAS_SEQ(type)	((type & 0x4) == 0)
513 	struct ieee80211vap *vap = ni->ni_vap;
514 	struct ieee80211com *ic = ni->ni_ic;
515 	struct ifnet *ifp = vap->iv_ifp;
516 	struct ieee80211_frame *wh;
517 	struct ieee80211_key *key;
518 	struct ether_header *eh;
519 	int hdrspace, need_tap = 1;	/* mbuf need to be tapped. */
520 	uint8_t dir, type, subtype, qos;
521 	uint8_t *bssid;
522 	uint16_t rxseq;
523 #ifdef IEEE80211_DEBUG
524 	char ethstr[ETHER_ADDRSTRLEN + 1];
525 #endif
526 
527 	if (m->m_flags & M_AMPDU_MPDU) {
528 		/*
529 		 * Fastpath for A-MPDU reorder q resubmission.  Frames
530 		 * w/ M_AMPDU_MPDU marked have already passed through
531 		 * here but were received out of order and been held on
532 		 * the reorder queue.  When resubmitted they are marked
533 		 * with the M_AMPDU_MPDU flag and we can bypass most of
534 		 * the normal processing.
535 		 */
536 		wh = mtod(m, struct ieee80211_frame *);
537 		type = IEEE80211_FC0_TYPE_DATA;
538 		dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
539 		subtype = IEEE80211_FC0_SUBTYPE_QOS;
540 		hdrspace = ieee80211_hdrspace(ic, wh);	/* XXX optimize? */
541 		goto resubmit_ampdu;
542 	}
543 
544 	KASSERT(ni != NULL, ("null node"));
545 	ni->ni_inact = ni->ni_inact_reload;
546 
547 	type = -1;			/* undefined */
548 
549 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
550 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
551 		    ni->ni_macaddr, NULL,
552 		    "too short (1): len %u", m->m_pkthdr.len);
553 		vap->iv_stats.is_rx_tooshort++;
554 		goto out;
555 	}
556 	/*
557 	 * Bit of a cheat here, we use a pointer for a 3-address
558 	 * frame format but don't reference fields past outside
559 	 * ieee80211_frame_min w/o first validating the data is
560 	 * present.
561 	 */
562 	wh = mtod(m, struct ieee80211_frame *);
563 
564 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
565 	    IEEE80211_FC0_VERSION_0) {
566 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
567 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
568 		    wh->i_fc[0], wh->i_fc[1]);
569 		vap->iv_stats.is_rx_badversion++;
570 		goto err;
571 	}
572 
573 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
574 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
575 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
576 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
577 		bssid = wh->i_addr2;
578 		if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
579 			/* not interested in */
580 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
581 			    bssid, NULL, "%s", "not to bss");
582 			vap->iv_stats.is_rx_wrongbss++;
583 			goto out;
584 		}
585 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
586 		ni->ni_noise = nf;
587 		if (HAS_SEQ(type) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
588 			uint8_t tid = ieee80211_gettid(wh);
589 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
590 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
591 				ic->ic_wme.wme_hipri_traffic++;
592 			rxseq = le16toh(*(uint16_t *)wh->i_seq);
593 			if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
594 			    (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
595 			    SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
596 				/* duplicate, discard */
597 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
598 				    bssid, "duplicate",
599 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
600 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
601 				    ni->ni_rxseqs[tid] >>
602 					IEEE80211_SEQ_SEQ_SHIFT,
603 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
604 				    ni->ni_rxseqs[tid] &
605 					IEEE80211_SEQ_FRAG_MASK,
606 				    tid);
607 				vap->iv_stats.is_rx_dup++;
608 				IEEE80211_NODE_STAT(ni, rx_dup);
609 				goto out;
610 			}
611 			ni->ni_rxseqs[tid] = rxseq;
612 		}
613 	}
614 
615 	switch (type) {
616 	case IEEE80211_FC0_TYPE_DATA:
617 		hdrspace = ieee80211_hdrspace(ic, wh);
618 		if (m->m_len < hdrspace &&
619 		    (m = m_pullup(m, hdrspace)) == NULL) {
620 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
621 			    ni->ni_macaddr, NULL,
622 			    "data too short: expecting %u", hdrspace);
623 			vap->iv_stats.is_rx_tooshort++;
624 			goto out;		/* XXX */
625 		}
626 		/*
627 		 * Handle A-MPDU re-ordering.  If the frame is to be
628 		 * processed directly then ieee80211_ampdu_reorder
629 		 * will return 0; otherwise it has consumed the mbuf
630 		 * and we should do nothing more with it.
631 		 */
632 		if ((m->m_flags & M_AMPDU) &&
633 		    (dir == IEEE80211_FC1_DIR_FROMDS ||
634 		     dir == IEEE80211_FC1_DIR_DSTODS) &&
635 		    ieee80211_ampdu_reorder(ni, m) != 0) {
636 			m = NULL;
637 			goto out;
638 		}
639 	resubmit_ampdu:
640 		if (dir == IEEE80211_FC1_DIR_FROMDS) {
641 			if ((ifp->if_flags & IFF_SIMPLEX) &&
642 			    isfromds_mcastecho(vap, wh)) {
643 				/*
644 				 * In IEEE802.11 network, multicast
645 				 * packets sent from "me" are broadcast
646 				 * from the AP; silently discard for
647 				 * SIMPLEX interface.
648 				 */
649 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
650 				    wh, "data", "%s", "multicast echo");
651 				vap->iv_stats.is_rx_mcastecho++;
652 				goto out;
653 			}
654 			if ((vap->iv_flags & IEEE80211_F_DWDS) &&
655 			    IEEE80211_IS_MULTICAST(wh->i_addr1)) {
656 				/*
657 				 * DWDS sta's must drop 3-address mcast frames
658 				 * as they will be sent separately as a 4-addr
659 				 * frame.  Accepting the 3-addr frame will
660 				 * confuse the bridge into thinking the sending
661 				 * sta is located at the end of WDS link.
662 				 */
663 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
664 				    "3-address data", "%s", "DWDS enabled");
665 				vap->iv_stats.is_rx_mcastecho++;
666 				goto out;
667 			}
668 		} else if (dir == IEEE80211_FC1_DIR_DSTODS) {
669 			if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
670 				IEEE80211_DISCARD(vap,
671 				    IEEE80211_MSG_INPUT, wh, "4-address data",
672 				    "%s", "DWDS not enabled");
673 				vap->iv_stats.is_rx_wrongdir++;
674 				goto out;
675 			}
676 			if ((ifp->if_flags & IFF_SIMPLEX) &&
677 			    isdstods_mcastecho(vap, wh)) {
678 				/*
679 				 * In IEEE802.11 network, multicast
680 				 * packets sent from "me" are broadcast
681 				 * from the AP; silently discard for
682 				 * SIMPLEX interface.
683 				 */
684 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
685 				    "4-address data", "%s", "multicast echo");
686 				vap->iv_stats.is_rx_mcastecho++;
687 				goto out;
688 			}
689 		} else {
690 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
691 			    "data", "incorrect dir 0x%x", dir);
692 			vap->iv_stats.is_rx_wrongdir++;
693 			goto out;
694 		}
695 
696 		/*
697 		 * Handle privacy requirements.  Note that we
698 		 * must not be preempted from here until after
699 		 * we (potentially) call ieee80211_crypto_demic;
700 		 * otherwise we may violate assumptions in the
701 		 * crypto cipher modules used to do delayed update
702 		 * of replay sequence numbers.
703 		 */
704 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
705 			if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
706 				/*
707 				 * Discard encrypted frames when privacy is off.
708 				 */
709 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
710 				    wh, "WEP", "%s", "PRIVACY off");
711 				vap->iv_stats.is_rx_noprivacy++;
712 				IEEE80211_NODE_STAT(ni, rx_noprivacy);
713 				goto out;
714 			}
715 			key = ieee80211_crypto_decap(ni, m, hdrspace);
716 			if (key == NULL) {
717 				/* NB: stats+msgs handled in crypto_decap */
718 				IEEE80211_NODE_STAT(ni, rx_wepfail);
719 				goto out;
720 			}
721 			wh = mtod(m, struct ieee80211_frame *);
722 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
723 		} else {
724 			/* XXX M_WEP and IEEE80211_F_PRIVACY */
725 			key = NULL;
726 		}
727 
728 		/*
729 		 * Save QoS bits for use below--before we strip the header.
730 		 */
731 		if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
732 			qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
733 			    ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
734 			    ((struct ieee80211_qosframe *)wh)->i_qos[0];
735 		} else
736 			qos = 0;
737 
738 		/*
739 		 * Next up, any fragmentation.
740 		 */
741 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
742 			m = ieee80211_defrag(ni, m, hdrspace);
743 			if (m == NULL) {
744 				/* Fragment dropped or frame not complete yet */
745 				goto out;
746 			}
747 		}
748 		wh = NULL;		/* no longer valid, catch any uses */
749 
750 		/*
751 		 * Next strip any MSDU crypto bits.
752 		 */
753 		if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
754 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
755 			    ni->ni_macaddr, "data", "%s", "demic error");
756 			vap->iv_stats.is_rx_demicfail++;
757 			IEEE80211_NODE_STAT(ni, rx_demicfail);
758 			goto out;
759 		}
760 
761 		/* copy to listener after decrypt */
762 		if (ieee80211_radiotap_active_vap(vap))
763 			ieee80211_radiotap_rx(vap, m);
764 		need_tap = 0;
765 
766 		/*
767 		 * Finally, strip the 802.11 header.
768 		 */
769 		m = ieee80211_decap(vap, m, hdrspace);
770 		if (m == NULL) {
771 			/* XXX mask bit to check for both */
772 			/* don't count Null data frames as errors */
773 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
774 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
775 				goto out;
776 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
777 			    ni->ni_macaddr, "data", "%s", "decap error");
778 			vap->iv_stats.is_rx_decap++;
779 			IEEE80211_NODE_STAT(ni, rx_decap);
780 			goto err;
781 		}
782 		eh = mtod(m, struct ether_header *);
783 		if (!ieee80211_node_is_authorized(ni)) {
784 			/*
785 			 * Deny any non-PAE frames received prior to
786 			 * authorization.  For open/shared-key
787 			 * authentication the port is mark authorized
788 			 * after authentication completes.  For 802.1x
789 			 * the port is not marked authorized by the
790 			 * authenticator until the handshake has completed.
791 			 */
792 			if (eh->ether_type != htons(ETHERTYPE_PAE)) {
793 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
794 				    eh->ether_shost, "data",
795 				    "unauthorized port: ether type 0x%x len %u",
796 				    eh->ether_type, m->m_pkthdr.len);
797 				vap->iv_stats.is_rx_unauth++;
798 				IEEE80211_NODE_STAT(ni, rx_unauth);
799 				goto err;
800 			}
801 		} else {
802 			/*
803 			 * When denying unencrypted frames, discard
804 			 * any non-PAE frames received without encryption.
805 			 */
806 			if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
807 			    (key == NULL && (m->m_flags & M_WEP) == 0) &&
808 			    eh->ether_type != htons(ETHERTYPE_PAE)) {
809 				/*
810 				 * Drop unencrypted frames.
811 				 */
812 				vap->iv_stats.is_rx_unencrypted++;
813 				IEEE80211_NODE_STAT(ni, rx_unencrypted);
814 				goto out;
815 			}
816 		}
817 		/* XXX require HT? */
818 		if (qos & IEEE80211_QOS_AMSDU) {
819 			m = ieee80211_decap_amsdu(ni, m);
820 			if (m == NULL)
821 				return IEEE80211_FC0_TYPE_DATA;
822 		} else {
823 #ifdef IEEE80211_SUPPORT_SUPERG
824 			m = ieee80211_decap_fastframe(vap, ni, m);
825 			if (m == NULL)
826 				return IEEE80211_FC0_TYPE_DATA;
827 #endif
828 		}
829 		ieee80211_deliver_data(vap, ni, m);
830 		return IEEE80211_FC0_TYPE_DATA;
831 
832 	case IEEE80211_FC0_TYPE_MGT:
833 		vap->iv_stats.is_rx_mgmt++;
834 		IEEE80211_NODE_STAT(ni, rx_mgmt);
835 		if (dir != IEEE80211_FC1_DIR_NODS) {
836 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
837 			    wh, "data", "incorrect dir 0x%x", dir);
838 			vap->iv_stats.is_rx_wrongdir++;
839 			goto err;
840 		}
841 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
842 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
843 			    ni->ni_macaddr, "mgt", "too short: len %u",
844 			    m->m_pkthdr.len);
845 			vap->iv_stats.is_rx_tooshort++;
846 			goto out;
847 		}
848 #ifdef IEEE80211_DEBUG
849 		if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
850 		    ieee80211_msg_dumppkts(vap)) {
851 			if_printf(ifp, "received %s from %s rssi %d\n",
852 			    ieee80211_mgt_subtype_name[subtype >>
853 				IEEE80211_FC0_SUBTYPE_SHIFT],
854 			    kether_ntoa(wh->i_addr2, ethstr), rssi);
855 		}
856 #endif
857 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
858 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
859 				/*
860 				 * Only shared key auth frames with a challenge
861 				 * should be encrypted, discard all others.
862 				 */
863 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
864 				    wh, ieee80211_mgt_subtype_name[subtype >>
865 					IEEE80211_FC0_SUBTYPE_SHIFT],
866 				    "%s", "WEP set but not permitted");
867 				vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
868 				goto out;
869 			}
870 			if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
871 				/*
872 				 * Discard encrypted frames when privacy is off.
873 				 */
874 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
875 				    wh, "mgt", "%s", "WEP set but PRIVACY off");
876 				vap->iv_stats.is_rx_noprivacy++;
877 				goto out;
878 			}
879 			hdrspace = ieee80211_hdrspace(ic, wh);
880 			key = ieee80211_crypto_decap(ni, m, hdrspace);
881 			if (key == NULL) {
882 				/* NB: stats+msgs handled in crypto_decap */
883 				goto out;
884 			}
885 			wh = mtod(m, struct ieee80211_frame *);
886 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
887 		}
888 		vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
889 		goto out;
890 
891 	case IEEE80211_FC0_TYPE_CTL:
892 		vap->iv_stats.is_rx_ctl++;
893 		IEEE80211_NODE_STAT(ni, rx_ctrl);
894 		vap->iv_recv_ctl(ni, m, subtype);
895 		goto out;
896 
897 	default:
898 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
899 		    wh, NULL, "bad frame type 0x%x", type);
900 		/* should not come here */
901 		break;
902 	}
903 err:
904 	IFNET_STAT_INC(ifp, ierrors, 1);
905 out:
906 	if (m != NULL) {
907 		if (need_tap && ieee80211_radiotap_active_vap(vap))
908 			ieee80211_radiotap_rx(vap, m);
909 		m_freem(m);
910 	}
911 	return type;
912 #undef SEQ_LEQ
913 }
914 
915 static void
916 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
917     int rssi, int nf, uint16_t seq, uint16_t status)
918 {
919 	struct ieee80211vap *vap = ni->ni_vap;
920 
921 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
922 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
923 		    ni->ni_macaddr, "open auth",
924 		    "bad sta auth mode %u", ni->ni_authmode);
925 		vap->iv_stats.is_rx_bad_auth++;	/* XXX */
926 		return;
927 	}
928 	if (vap->iv_state != IEEE80211_S_AUTH ||
929 	    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
930 		vap->iv_stats.is_rx_bad_auth++;
931 		return;
932 	}
933 	if (status != 0) {
934 		IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
935 		    ni, "open auth failed (reason %d)", status);
936 		vap->iv_stats.is_rx_auth_fail++;
937 		vap->iv_stats.is_rx_authfail_code = status;
938 		ieee80211_new_state(vap, IEEE80211_S_SCAN,
939 		    IEEE80211_SCAN_FAIL_STATUS);
940 	} else
941 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
942 }
943 
944 static void
945 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
946     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
947     uint16_t seq, uint16_t status)
948 {
949 	struct ieee80211vap *vap = ni->ni_vap;
950 	uint8_t *challenge;
951 
952 	/*
953 	 * NB: this can happen as we allow pre-shared key
954 	 * authentication to be enabled w/o wep being turned
955 	 * on so that configuration of these can be done
956 	 * in any order.  It may be better to enforce the
957 	 * ordering in which case this check would just be
958 	 * for sanity/consistency.
959 	 */
960 	if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
961 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
962 		    ni->ni_macaddr, "shared key auth",
963 		    "%s", " PRIVACY is disabled");
964 		goto bad;
965 	}
966 	/*
967 	 * Pre-shared key authentication is evil; accept
968 	 * it only if explicitly configured (it is supported
969 	 * mainly for compatibility with clients like OS X).
970 	 */
971 	if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
972 	    ni->ni_authmode != IEEE80211_AUTH_SHARED) {
973 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
974 		    ni->ni_macaddr, "shared key auth",
975 		    "bad sta auth mode %u", ni->ni_authmode);
976 		vap->iv_stats.is_rx_bad_auth++;	/* XXX maybe a unique error? */
977 		goto bad;
978 	}
979 
980 	challenge = NULL;
981 	if (frm + 1 < efrm) {
982 		if ((frm[1] + 2) > (efrm - frm)) {
983 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
984 			    ni->ni_macaddr, "shared key auth",
985 			    "ie %d/%d too long",
986 			    frm[0], (int)((frm[1] + 2) - (efrm - frm)));
987 			vap->iv_stats.is_rx_bad_auth++;
988 			goto bad;
989 		}
990 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
991 			challenge = frm;
992 		frm += frm[1] + 2;
993 	}
994 	switch (seq) {
995 	case IEEE80211_AUTH_SHARED_CHALLENGE:
996 	case IEEE80211_AUTH_SHARED_RESPONSE:
997 		if (challenge == NULL) {
998 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
999 			    ni->ni_macaddr, "shared key auth",
1000 			    "%s", "no challenge");
1001 			vap->iv_stats.is_rx_bad_auth++;
1002 			goto bad;
1003 		}
1004 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1005 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1006 			    ni->ni_macaddr, "shared key auth",
1007 			    "bad challenge len %d", challenge[1]);
1008 			vap->iv_stats.is_rx_bad_auth++;
1009 			goto bad;
1010 		}
1011 	default:
1012 		break;
1013 	}
1014 	if (vap->iv_state != IEEE80211_S_AUTH)
1015 		return;
1016 	switch (seq) {
1017 	case IEEE80211_AUTH_SHARED_PASS:
1018 		if (ni->ni_challenge != NULL) {
1019 			kfree(ni->ni_challenge, M_80211_NODE);
1020 			ni->ni_challenge = NULL;
1021 		}
1022 		if (status != 0) {
1023 			IEEE80211_NOTE_FRAME(vap,
1024 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
1025 			    "shared key auth failed (reason %d)", status);
1026 			vap->iv_stats.is_rx_auth_fail++;
1027 			vap->iv_stats.is_rx_authfail_code = status;
1028 			return;
1029 		}
1030 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1031 		break;
1032 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1033 		if (!ieee80211_alloc_challenge(ni))
1034 			return;
1035 		/* XXX could optimize by passing recvd challenge */
1036 		memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1037 		IEEE80211_SEND_MGMT(ni,
1038 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1039 		break;
1040 	default:
1041 		IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1042 		    wh, "shared key auth", "bad seq %d", seq);
1043 		vap->iv_stats.is_rx_bad_auth++;
1044 		return;
1045 	}
1046 	return;
1047 bad:
1048 	/*
1049 	 * Kick the state machine.  This short-circuits
1050 	 * using the mgt frame timeout to trigger the
1051 	 * state transition.
1052 	 */
1053 	if (vap->iv_state == IEEE80211_S_AUTH)
1054 		ieee80211_new_state(vap, IEEE80211_S_SCAN,
1055 		    IEEE80211_SCAN_FAIL_STATUS);
1056 }
1057 
1058 static int
1059 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
1060 	const struct ieee80211_frame *wh)
1061 {
1062 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1063 	struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
1064 	u_int len = frm[1], qosinfo;
1065 	int i;
1066 
1067 	if (len < sizeof(struct ieee80211_wme_param)-2) {
1068 		IEEE80211_DISCARD_IE(vap,
1069 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1070 		    wh, "WME", "too short, len %u", len);
1071 		return -1;
1072 	}
1073 	qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1074 	qosinfo &= WME_QOSINFO_COUNT;
1075 	/* XXX do proper check for wraparound */
1076 	if (qosinfo == wme->wme_wmeChanParams.cap_info)
1077 		return 0;
1078 	frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1079 	for (i = 0; i < WME_NUM_AC; i++) {
1080 		struct wmeParams *wmep =
1081 			&wme->wme_wmeChanParams.cap_wmeParams[i];
1082 		/* NB: ACI not used */
1083 		wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1084 		wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1085 		wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1086 		wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1087 		wmep->wmep_txopLimit = LE_READ_2(frm+2);
1088 		frm += 4;
1089 	}
1090 	wme->wme_wmeChanParams.cap_info = qosinfo;
1091 	return 1;
1092 #undef MS
1093 }
1094 
1095 /*
1096  * Process 11h Channel Switch Announcement (CSA) ie.  If this
1097  * is the first CSA then initiate the switch.  Otherwise we
1098  * track state and trigger completion and/or cancel of the switch.
1099  * XXX should be public for IBSS use
1100  */
1101 static void
1102 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
1103 	const struct ieee80211_frame *wh)
1104 {
1105 	struct ieee80211com *ic = vap->iv_ic;
1106 	const struct ieee80211_csa_ie *csa =
1107 	    (const struct ieee80211_csa_ie *) frm;
1108 
1109 	KASSERT(vap->iv_state >= IEEE80211_S_RUN,
1110 	    ("state %s", ieee80211_state_name[vap->iv_state]));
1111 
1112 	if (csa->csa_mode > 1) {
1113 		IEEE80211_DISCARD_IE(vap,
1114 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1115 		    wh, "CSA", "invalid mode %u", csa->csa_mode);
1116 		return;
1117 	}
1118 	if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
1119 		/*
1120 		 * Convert the channel number to a channel reference.  We
1121 		 * try first to preserve turbo attribute of the current
1122 		 * channel then fallback.  Note this will not work if the
1123 		 * CSA specifies a channel that requires a band switch (e.g.
1124 		 * 11a => 11g).  This is intentional as 11h is defined only
1125 		 * for 5GHz/11a and because the switch does not involve a
1126 		 * reassociation, protocol state (capabilities, negotated
1127 		 * rates, etc) may/will be wrong.
1128 		 */
1129 		struct ieee80211_channel *c =
1130 		    ieee80211_find_channel_byieee(ic, csa->csa_newchan,
1131 			(ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
1132 		if (c == NULL) {
1133 			c = ieee80211_find_channel_byieee(ic,
1134 			    csa->csa_newchan,
1135 			    (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
1136 			if (c == NULL) {
1137 				IEEE80211_DISCARD_IE(vap,
1138 				    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1139 				    wh, "CSA", "invalid channel %u",
1140 				    csa->csa_newchan);
1141 				goto done;
1142 			}
1143 		}
1144 #if IEEE80211_CSA_COUNT_MIN > 0
1145 		if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
1146 			/*
1147 			 * Require at least IEEE80211_CSA_COUNT_MIN count to
1148 			 * reduce the risk of being redirected by a fabricated
1149 			 * CSA.  If a valid CSA is dropped we'll still get a
1150 			 * beacon miss when the AP leaves the channel so we'll
1151 			 * eventually follow to the new channel.
1152 			 *
1153 			 * NOTE: this violates the 11h spec that states that
1154 			 * count may be any value and if 0 then a switch
1155 			 * should happen asap.
1156 			 */
1157 			IEEE80211_DISCARD_IE(vap,
1158 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1159 			    wh, "CSA", "count %u too small, must be >= %u",
1160 			    csa->csa_count, IEEE80211_CSA_COUNT_MIN);
1161 			goto done;
1162 		}
1163 #endif
1164 		ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
1165 	} else {
1166 		/*
1167 		 * Validate this ie against the initial CSA.  We require
1168 		 * mode and channel not change and the count must be
1169 		 * monotonically decreasing.  This may be pointless and
1170 		 * canceling the switch as a result may be too paranoid but
1171 		 * in the worst case if we drop out of CSA because of this
1172 		 * and the AP does move then we'll just end up taking a
1173 		 * beacon miss and scan to find the AP.
1174 		 *
1175 		 * XXX may want <= on count as we also process ProbeResp
1176 		 * frames and those may come in w/ the same count as the
1177 		 * previous beacon; but doing so leaves us open to a stuck
1178 		 * count until we add a dead-man timer
1179 		 */
1180 		if (!(csa->csa_count < ic->ic_csa_count &&
1181 		      csa->csa_mode == ic->ic_csa_mode &&
1182 		      csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
1183 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
1184 			    "CSA ie mismatch, initial ie <%d,%d,%d>, "
1185 			    "this ie <%d,%d,%d>", ic->ic_csa_mode,
1186 			    ic->ic_csa_newchan->ic_ieee, ic->ic_csa_count,
1187 			    csa->csa_mode, csa->csa_newchan, csa->csa_count);
1188 			ieee80211_csa_cancelswitch(ic);
1189 		} else {
1190 			if (csa->csa_count <= 1)
1191 				ieee80211_csa_completeswitch(ic);
1192 			else
1193 				ic->ic_csa_count = csa->csa_count;
1194 		}
1195 	}
1196 done:
1197 	;
1198 }
1199 
1200 /*
1201  * Return non-zero if a background scan may be continued:
1202  * o bg scan is active
1203  * o no channel switch is pending
1204  * o there has not been any traffic recently
1205  *
1206  * Note we do not check if there is an administrative enable;
1207  * this is only done to start the scan.  We assume that any
1208  * change in state will be accompanied by a request to cancel
1209  * active scans which will otherwise cause this test to fail.
1210  */
1211 static __inline int
1212 contbgscan(struct ieee80211vap *vap)
1213 {
1214 	struct ieee80211com *ic = vap->iv_ic;
1215 
1216 	return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1217 	    (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1218 	    vap->iv_state == IEEE80211_S_RUN &&		/* XXX? */
1219 	    time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1220 }
1221 
1222 /*
1223  * Return non-zero if a backgrond scan may be started:
1224  * o bg scanning is administratively enabled
1225  * o no channel switch is pending
1226  * o we are not boosted on a dynamic turbo channel
1227  * o there has not been a scan recently
1228  * o there has not been any traffic recently
1229  */
1230 static __inline int
1231 startbgscan(struct ieee80211vap *vap)
1232 {
1233 	struct ieee80211com *ic = vap->iv_ic;
1234 
1235 	return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
1236 	    (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1237 #ifdef IEEE80211_SUPPORT_SUPERG
1238 	    !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1239 #endif
1240 	    time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
1241 	    time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1242 }
1243 
1244 static void
1245 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1246 	int subtype, int rssi, int nf)
1247 {
1248 #define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1249 #define	ISREASSOC(_st)	((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1250 	struct ieee80211vap *vap = ni->ni_vap;
1251 	struct ieee80211com *ic = ni->ni_ic;
1252 	struct ieee80211_frame *wh;
1253 	uint8_t *frm, *efrm;
1254 	uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
1255 	uint8_t rate;
1256 
1257 	wh = mtod(m0, struct ieee80211_frame *);
1258 	frm = (uint8_t *)&wh[1];
1259 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1260 	switch (subtype) {
1261 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1262 	case IEEE80211_FC0_SUBTYPE_BEACON: {
1263 		struct ieee80211_scanparams scan;
1264 		/*
1265 		 * We process beacon/probe response frames:
1266 		 *    o when scanning, or
1267 		 *    o station mode when associated (to collect state
1268 		 *      updates such as 802.11g slot time)
1269 		 * Frames otherwise received are discarded.
1270 		 */
1271 		if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
1272 			vap->iv_stats.is_rx_mgtdiscard++;
1273 			return;
1274 		}
1275 		/* XXX probe response in sta mode when !scanning? */
1276 		if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
1277 			return;
1278 		/*
1279 		 * Count frame now that we know it's to be processed.
1280 		 */
1281 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1282 			vap->iv_stats.is_rx_beacon++;		/* XXX remove */
1283 			IEEE80211_NODE_STAT(ni, rx_beacons);
1284 		} else
1285 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1286 		/*
1287 		 * When operating in station mode, check for state updates.
1288 		 * Be careful to ignore beacons received while doing a
1289 		 * background scan.  We consider only 11g/WMM stuff right now.
1290 		 */
1291 		if (ni->ni_associd != 0 &&
1292 		    ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1293 		     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1294 			/* record tsf of last beacon */
1295 			memcpy(ni->ni_tstamp.data, scan.tstamp,
1296 				sizeof(ni->ni_tstamp));
1297 			/* count beacon frame for s/w bmiss handling */
1298 			vap->iv_swbmiss_count++;
1299 			vap->iv_bmiss_count = 0;
1300 			if (ni->ni_erp != scan.erp) {
1301 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1302 				    wh->i_addr2,
1303 				    "erp change: was 0x%x, now 0x%x",
1304 				    ni->ni_erp, scan.erp);
1305 				if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1306 				    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1307 					ic->ic_flags |= IEEE80211_F_USEPROT;
1308 				else
1309 					ic->ic_flags &= ~IEEE80211_F_USEPROT;
1310 				ni->ni_erp = scan.erp;
1311 				/* XXX statistic */
1312 				/* XXX driver notification */
1313 			}
1314 			if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1315 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1316 				    wh->i_addr2,
1317 				    "capabilities change: was 0x%x, now 0x%x",
1318 				    ni->ni_capinfo, scan.capinfo);
1319 				/*
1320 				 * NB: we assume short preamble doesn't
1321 				 *     change dynamically
1322 				 */
1323 				ieee80211_set_shortslottime(ic,
1324 					IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
1325 					(scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1326 				ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
1327 					       | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
1328 				/* XXX statistic */
1329 			}
1330 			if (scan.wme != NULL &&
1331 			    (ni->ni_flags & IEEE80211_NODE_QOS) &&
1332 			    ieee80211_parse_wmeparams(vap, scan.wme, wh) > 0)
1333 				ieee80211_wme_updateparams(vap);
1334 #ifdef IEEE80211_SUPPORT_SUPERG
1335 			if (scan.ath != NULL)
1336 				ieee80211_parse_athparams(ni, scan.ath, wh);
1337 #endif
1338 			if (scan.htcap != NULL && scan.htinfo != NULL &&
1339 			    (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1340 				ieee80211_ht_updateparams(ni,
1341 				    scan.htcap, scan.htinfo);
1342 				/* XXX state changes? */
1343 			}
1344 			if (scan.tim != NULL) {
1345 				struct ieee80211_tim_ie *tim =
1346 				    (struct ieee80211_tim_ie *) scan.tim;
1347 #if 0
1348 				int aid = IEEE80211_AID(ni->ni_associd);
1349 				int ix = aid / NBBY;
1350 				int min = tim->tim_bitctl &~ 1;
1351 				int max = tim->tim_len + min - 4;
1352 				if ((tim->tim_bitctl&1) ||
1353 				    (min <= ix && ix <= max &&
1354 				     isset(tim->tim_bitmap - min, aid))) {
1355 					/*
1356 					 * XXX Do not let bg scan kick off
1357 					 * we are expecting data.
1358 					 */
1359 					ic->ic_lastdata = ticks;
1360 					ieee80211_sta_pwrsave(vap, 0);
1361 				}
1362 #endif
1363 				ni->ni_dtim_count = tim->tim_count;
1364 				ni->ni_dtim_period = tim->tim_period;
1365 			}
1366 			if (scan.csa != NULL &&
1367 			    (vap->iv_flags & IEEE80211_F_DOTH))
1368 				ieee80211_parse_csaparams(vap, scan.csa, wh);
1369 			else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
1370 				/*
1371 				 * No CSA ie or 11h disabled, but a channel
1372 				 * switch is pending; drop out so we aren't
1373 				 * stuck in CSA state.  If the AP really is
1374 				 * moving we'll get a beacon miss and scan.
1375 				 */
1376 				ieee80211_csa_cancelswitch(ic);
1377 			}
1378 			/*
1379 			 * If scanning, pass the info to the scan module.
1380 			 * Otherwise, check if it's the right time to do
1381 			 * a background scan.  Background scanning must
1382 			 * be enabled and we must not be operating in the
1383 			 * turbo phase of dynamic turbo mode.  Then,
1384 			 * it's been a while since the last background
1385 			 * scan and if no data frames have come through
1386 			 * recently, kick off a scan.  Note that this
1387 			 * is the mechanism by which a background scan
1388 			 * is started _and_ continued each time we
1389 			 * return on-channel to receive a beacon from
1390 			 * our ap.
1391 			 */
1392 			if (ic->ic_flags & IEEE80211_F_SCAN) {
1393 				ieee80211_add_scan(vap, &scan, wh,
1394 					subtype, rssi, nf);
1395 			} else if (contbgscan(vap)) {
1396 				ieee80211_bg_scan(vap, 0);
1397 			} else if (startbgscan(vap)) {
1398 				vap->iv_stats.is_scan_bg++;
1399 #if 0
1400 				/* wakeup if we are sleeing */
1401 				ieee80211_set_pwrsave(vap, 0);
1402 #endif
1403 				ieee80211_bg_scan(vap, 0);
1404 			}
1405 			return;
1406 		}
1407 		/*
1408 		 * If scanning, just pass information to the scan module.
1409 		 */
1410 		if (ic->ic_flags & IEEE80211_F_SCAN) {
1411 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1412 				/*
1413 				 * Actively scanning a channel marked passive;
1414 				 * send a probe request now that we know there
1415 				 * is 802.11 traffic present.
1416 				 *
1417 				 * XXX check if the beacon we recv'd gives
1418 				 * us what we need and suppress the probe req
1419 				 */
1420 				ieee80211_probe_curchan(vap, 1);
1421 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1422 			}
1423 			ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1424 			return;
1425 		}
1426 		break;
1427 	}
1428 
1429 	case IEEE80211_FC0_SUBTYPE_AUTH: {
1430 		uint16_t algo, seq, status;
1431 		/*
1432 		 * auth frame format
1433 		 *	[2] algorithm
1434 		 *	[2] sequence
1435 		 *	[2] status
1436 		 *	[tlv*] challenge
1437 		 */
1438 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1439 		algo   = le16toh(*(uint16_t *)frm);
1440 		seq    = le16toh(*(uint16_t *)(frm + 2));
1441 		status = le16toh(*(uint16_t *)(frm + 4));
1442 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1443 		    "recv auth frame with algorithm %d seq %d", algo, seq);
1444 
1445 		if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1446 			IEEE80211_DISCARD(vap,
1447 			    IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1448 			    wh, "auth", "%s", "TKIP countermeasures enabled");
1449 			vap->iv_stats.is_rx_auth_countermeasures++;
1450 			if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1451 				ieee80211_send_error(ni, wh->i_addr2,
1452 					IEEE80211_FC0_SUBTYPE_AUTH,
1453 					IEEE80211_REASON_MIC_FAILURE);
1454 			}
1455 			return;
1456 		}
1457 		if (algo == IEEE80211_AUTH_ALG_SHARED)
1458 			sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1459 			    seq, status);
1460 		else if (algo == IEEE80211_AUTH_ALG_OPEN)
1461 			sta_auth_open(ni, wh, rssi, nf, seq, status);
1462 		else {
1463 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1464 			    wh, "auth", "unsupported alg %d", algo);
1465 			vap->iv_stats.is_rx_auth_unsupported++;
1466 			return;
1467 		}
1468 		break;
1469 	}
1470 
1471 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1472 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
1473 		uint16_t capinfo, associd;
1474 		uint16_t status;
1475 
1476 		if (vap->iv_state != IEEE80211_S_ASSOC) {
1477 			vap->iv_stats.is_rx_mgtdiscard++;
1478 			return;
1479 		}
1480 
1481 		/*
1482 		 * asresp frame format
1483 		 *	[2] capability information
1484 		 *	[2] status
1485 		 *	[2] association ID
1486 		 *	[tlv] supported rates
1487 		 *	[tlv] extended supported rates
1488 		 *	[tlv] WME
1489 		 *	[tlv] HT capabilities
1490 		 *	[tlv] HT info
1491 		 */
1492 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1493 		ni = vap->iv_bss;
1494 		capinfo = le16toh(*(uint16_t *)frm);
1495 		frm += 2;
1496 		status = le16toh(*(uint16_t *)frm);
1497 		frm += 2;
1498 		if (status != 0) {
1499 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1500 			    wh->i_addr2, "%sassoc failed (reason %d)",
1501 			    ISREASSOC(subtype) ?  "re" : "", status);
1502 			vap->iv_stats.is_rx_auth_fail++;	/* XXX */
1503 			return;
1504 		}
1505 		associd = le16toh(*(uint16_t *)frm);
1506 		frm += 2;
1507 
1508 		rates = xrates = wme = htcap = htinfo = NULL;
1509 		while (efrm - frm > 1) {
1510 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1511 			switch (*frm) {
1512 			case IEEE80211_ELEMID_RATES:
1513 				rates = frm;
1514 				break;
1515 			case IEEE80211_ELEMID_XRATES:
1516 				xrates = frm;
1517 				break;
1518 			case IEEE80211_ELEMID_HTCAP:
1519 				htcap = frm;
1520 				break;
1521 			case IEEE80211_ELEMID_HTINFO:
1522 				htinfo = frm;
1523 				break;
1524 			case IEEE80211_ELEMID_VENDOR:
1525 				if (iswmeoui(frm))
1526 					wme = frm;
1527 				else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1528 					/*
1529 					 * Accept pre-draft HT ie's if the
1530 					 * standard ones have not been seen.
1531 					 */
1532 					if (ishtcapoui(frm)) {
1533 						if (htcap == NULL)
1534 							htcap = frm;
1535 					} else if (ishtinfooui(frm)) {
1536 						if (htinfo == NULL)
1537 							htcap = frm;
1538 					}
1539 				}
1540 				/* XXX Atheros OUI support */
1541 				break;
1542 			}
1543 			frm += frm[1] + 2;
1544 		}
1545 
1546 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1547 		if (xrates != NULL)
1548 			IEEE80211_VERIFY_ELEMENT(xrates,
1549 				IEEE80211_RATE_MAXSIZE - rates[1], return);
1550 		rate = ieee80211_setup_rates(ni, rates, xrates,
1551 				IEEE80211_F_JOIN |
1552 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1553 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1554 		if (rate & IEEE80211_RATE_BASIC) {
1555 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1556 			    wh->i_addr2,
1557 			    "%sassoc failed (rate set mismatch)",
1558 			    ISREASSOC(subtype) ?  "re" : "");
1559 			vap->iv_stats.is_rx_assoc_norate++;
1560 			ieee80211_new_state(vap, IEEE80211_S_SCAN,
1561 			    IEEE80211_SCAN_FAIL_STATUS);
1562 			return;
1563 		}
1564 
1565 		ni->ni_capinfo = capinfo;
1566 		ni->ni_associd = associd;
1567 		if (ni->ni_jointime == 0)
1568 			ni->ni_jointime = time_uptime;
1569 		if (wme != NULL &&
1570 		    ieee80211_parse_wmeparams(vap, wme, wh) >= 0) {
1571 			ni->ni_flags |= IEEE80211_NODE_QOS;
1572 			ieee80211_wme_updateparams(vap);
1573 		} else
1574 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
1575 		/*
1576 		 * Setup HT state according to the negotiation.
1577 		 *
1578 		 * NB: shouldn't need to check if HT use is enabled but some
1579 		 *     ap's send back HT ie's even when we don't indicate we
1580 		 *     are HT capable in our AssocReq.
1581 		 */
1582 		if (htcap != NULL && htinfo != NULL &&
1583 		    (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1584 			ieee80211_ht_node_init(ni);
1585 			ieee80211_ht_updateparams(ni, htcap, htinfo);
1586 			ieee80211_setup_htrates(ni, htcap,
1587 			     IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1588 			ieee80211_setup_basic_htrates(ni, htinfo);
1589 			ieee80211_node_setuptxparms(ni);
1590 			ieee80211_ratectl_node_init(ni);
1591 		} else {
1592 #ifdef IEEE80211_SUPPORT_SUPERG
1593 			if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
1594 				ieee80211_ff_node_init(ni);
1595 #endif
1596 		}
1597 		/*
1598 		 * Configure state now that we are associated.
1599 		 *
1600 		 * XXX may need different/additional driver callbacks?
1601 		 */
1602 		if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1603 		    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1604 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1605 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1606 		} else {
1607 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1608 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1609 		}
1610 		ieee80211_set_shortslottime(ic,
1611 			IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1612 			(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1613 		/*
1614 		 * Honor ERP protection.
1615 		 *
1616 		 * NB: ni_erp should zero for non-11g operation.
1617 		 */
1618 		if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1619 		    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1620 			ic->ic_flags |= IEEE80211_F_USEPROT;
1621 		else
1622 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1623 		IEEE80211_NOTE_MAC(vap,
1624 		    IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
1625 		    "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
1626 		    ISREASSOC(subtype) ? "re" : "",
1627 		    IEEE80211_NODE_AID(ni),
1628 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1629 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1630 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1631 		    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1632 		    ni->ni_flags & IEEE80211_NODE_HT ?
1633 			(ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
1634 		    ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1635 		    ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
1636 			ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
1637 		    ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
1638 		    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
1639 			", fast-frames" : "",
1640 		    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
1641 			", turbo" : ""
1642 		);
1643 		ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
1644 		break;
1645 	}
1646 
1647 	case IEEE80211_FC0_SUBTYPE_DEAUTH: {
1648 		uint16_t reason;
1649 
1650 		if (vap->iv_state == IEEE80211_S_SCAN) {
1651 			vap->iv_stats.is_rx_mgtdiscard++;
1652 			return;
1653 		}
1654 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1655 			/* NB: can happen when in promiscuous mode */
1656 			vap->iv_stats.is_rx_mgtdiscard++;
1657 			break;
1658 		}
1659 
1660 		/*
1661 		 * deauth frame format
1662 		 *	[2] reason
1663 		 */
1664 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1665 		reason = le16toh(*(uint16_t *)frm);
1666 
1667 		vap->iv_stats.is_rx_deauth++;
1668 		vap->iv_stats.is_rx_deauth_code = reason;
1669 		IEEE80211_NODE_STAT(ni, rx_deauth);
1670 
1671 		IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1672 		    "recv deauthenticate (reason %d)", reason);
1673 		ieee80211_new_state(vap, IEEE80211_S_AUTH,
1674 		    (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
1675 		break;
1676 	}
1677 
1678 	case IEEE80211_FC0_SUBTYPE_DISASSOC: {
1679 		uint16_t reason;
1680 
1681 		if (vap->iv_state != IEEE80211_S_RUN &&
1682 		    vap->iv_state != IEEE80211_S_ASSOC &&
1683 		    vap->iv_state != IEEE80211_S_AUTH) {
1684 			vap->iv_stats.is_rx_mgtdiscard++;
1685 			return;
1686 		}
1687 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1688 			/* NB: can happen when in promiscuous mode */
1689 			vap->iv_stats.is_rx_mgtdiscard++;
1690 			break;
1691 		}
1692 
1693 		/*
1694 		 * disassoc frame format
1695 		 *	[2] reason
1696 		 */
1697 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1698 		reason = le16toh(*(uint16_t *)frm);
1699 
1700 		vap->iv_stats.is_rx_disassoc++;
1701 		vap->iv_stats.is_rx_disassoc_code = reason;
1702 		IEEE80211_NODE_STAT(ni, rx_disassoc);
1703 
1704 		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1705 		    "recv disassociate (reason %d)", reason);
1706 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1707 		break;
1708 	}
1709 
1710 	case IEEE80211_FC0_SUBTYPE_ACTION:
1711 		if (vap->iv_state == IEEE80211_S_RUN) {
1712 			if (ieee80211_parse_action(ni, m0) == 0)
1713 				ic->ic_recv_action(ni, wh, frm, efrm);
1714 		} else
1715 			vap->iv_stats.is_rx_mgtdiscard++;
1716 		break;
1717 
1718 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1719 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1720 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1721 		vap->iv_stats.is_rx_mgtdiscard++;
1722 		return;
1723 	default:
1724 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1725 		     wh, "mgt", "subtype 0x%x not handled", subtype);
1726 		vap->iv_stats.is_rx_badsubtype++;
1727 		break;
1728 	}
1729 #undef ISREASSOC
1730 #undef ISPROBE
1731 }
1732 
1733 static void
1734 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m0, int subtype)
1735 {
1736 }
1737