The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_sta.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  *
   16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   26  */
   27 
   28 #include <sys/cdefs.h>
   29 #ifdef __FreeBSD__
   30 __FBSDID("$FreeBSD$");
   31 #endif
   32 
   33 /*
   34  * IEEE 802.11 Station mode support.
   35  */
   36 #include "opt_inet.h"
   37 #include "opt_wlan.h"
   38 
   39 #include <sys/param.h>
   40 #include <sys/systm.h> 
   41 #include <sys/mbuf.h>   
   42 #include <sys/malloc.h>
   43 #include <sys/kernel.h>
   44 
   45 #include <sys/socket.h>
   46 #include <sys/sockio.h>
   47 #include <sys/endian.h>
   48 #include <sys/errno.h>
   49 #include <sys/proc.h>
   50 #include <sys/sysctl.h>
   51 
   52 #include <net/if.h>
   53 #include <net/if_media.h>
   54 #include <net/if_llc.h>
   55 #include <net/if_dl.h>
   56 #include <net/if_var.h>
   57 #include <net/ethernet.h>
   58 
   59 #include <net/bpf.h>
   60 
   61 #include <net80211/ieee80211_var.h>
   62 #include <net80211/ieee80211_sta.h>
   63 #include <net80211/ieee80211_input.h>
   64 #ifdef IEEE80211_SUPPORT_SUPERG
   65 #include <net80211/ieee80211_superg.h>
   66 #endif
   67 #include <net80211/ieee80211_ratectl.h>
   68 #include <net80211/ieee80211_sta.h>
   69 #include <net80211/ieee80211_vht.h>
   70 
   71 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
   72 
   73 static  void sta_vattach(struct ieee80211vap *);
   74 static  void sta_beacon_miss(struct ieee80211vap *);
   75 static  int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
   76 static  int sta_input(struct ieee80211_node *, struct mbuf *,
   77             const struct ieee80211_rx_stats *, int, int);
   78 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   79             int subtype, const struct ieee80211_rx_stats *, int rssi, int nf);
   80 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
   81 
   82 void
   83 ieee80211_sta_attach(struct ieee80211com *ic)
   84 {
   85         ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
   86 }
   87 
   88 void
   89 ieee80211_sta_detach(struct ieee80211com *ic)
   90 {
   91 }
   92 
   93 static void
   94 sta_vdetach(struct ieee80211vap *vap)
   95 {
   96 }
   97 
   98 static void
   99 sta_vattach(struct ieee80211vap *vap)
  100 {
  101         vap->iv_newstate = sta_newstate;
  102         vap->iv_input = sta_input;
  103         vap->iv_recv_mgmt = sta_recv_mgmt;
  104         vap->iv_recv_ctl = sta_recv_ctl;
  105         vap->iv_opdetach = sta_vdetach;
  106         vap->iv_bmiss = sta_beacon_miss;
  107 }
  108 
  109 /*
  110  * Handle a beacon miss event.  The common code filters out
  111  * spurious events that can happen when scanning and/or before
  112  * reaching RUN state.
  113  */
  114 static void
  115 sta_beacon_miss(struct ieee80211vap *vap)
  116 {
  117         struct ieee80211com *ic = vap->iv_ic;
  118 
  119         IEEE80211_LOCK_ASSERT(ic);
  120 
  121         KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
  122         KASSERT(vap->iv_state >= IEEE80211_S_RUN,
  123             ("wrong state %s", ieee80211_state_name[vap->iv_state]));
  124 
  125         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
  126             "beacon miss, mode %s state %s\n",
  127             ieee80211_opmode_name[vap->iv_opmode],
  128             ieee80211_state_name[vap->iv_state]);
  129 
  130         if (vap->iv_state == IEEE80211_S_CSA) {
  131                 /*
  132                  * A Channel Switch is pending; assume we missed the
  133                  * beacon that would've completed the process and just
  134                  * force the switch.  If we made a mistake we'll not
  135                  * find the AP on the new channel and fall back to a
  136                  * normal scan.
  137                  */
  138                 ieee80211_csa_completeswitch(ic);
  139                 return;
  140         }
  141         if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
  142                 /*
  143                  * Send a directed probe req before falling back to a
  144                  * scan; if we receive a response ic_bmiss_count will
  145                  * be reset.  Some cards mistakenly report beacon miss
  146                  * so this avoids the expensive scan if the ap is
  147                  * still there.
  148                  */
  149                 ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
  150                         vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
  151                         vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
  152                 return;
  153         }
  154 
  155         callout_stop(&vap->iv_swbmiss);
  156         vap->iv_bmiss_count = 0;
  157         vap->iv_stats.is_beacon_miss++;
  158         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
  159 #ifdef IEEE80211_SUPPORT_SUPERG
  160 
  161                 /*
  162                  * If we receive a beacon miss interrupt when using
  163                  * dynamic turbo, attempt to switch modes before
  164                  * reassociating.
  165                  */
  166                 if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
  167                         ieee80211_dturbo_switch(vap,
  168                             ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
  169 #endif
  170                 /*
  171                  * Try to reassociate before scanning for a new ap.
  172                  */
  173                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
  174         } else {
  175                 /*
  176                  * Somebody else is controlling state changes (e.g.
  177                  * a user-mode app) don't do anything that would
  178                  * confuse them; just drop into scan mode so they'll
  179                  * notified of the state change and given control.
  180                  */
  181                 ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
  182         }
  183 }
  184 
  185 /*
  186  * Handle deauth with reason.  We retry only for
  187  * the cases where we might succeed.  Otherwise
  188  * we downgrade the ap and scan.
  189  */
  190 static void
  191 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
  192 {
  193         switch (reason) {
  194         case IEEE80211_STATUS_SUCCESS:          /* NB: MLME assoc */
  195         case IEEE80211_STATUS_TIMEOUT:
  196         case IEEE80211_REASON_ASSOC_EXPIRE:
  197         case IEEE80211_REASON_NOT_AUTHED:
  198         case IEEE80211_REASON_NOT_ASSOCED:
  199         case IEEE80211_REASON_ASSOC_LEAVE:
  200         case IEEE80211_REASON_ASSOC_NOT_AUTHED:
  201                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
  202                 break;
  203         default:
  204                 ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
  205                 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  206                         ieee80211_check_scan_current(vap);
  207                 break;
  208         }
  209 }
  210 
  211 static void
  212 sta_swbmiss_start(struct ieee80211vap *vap)
  213 {
  214 
  215         if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) {
  216                 /*
  217                  * Start s/w beacon miss timer for devices w/o
  218                  * hardware support.  We fudge a bit here since
  219                  * we're doing this in software.
  220                  */
  221                 vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
  222                     2 * vap->iv_bmissthreshold * vap->iv_bss->ni_intval);
  223                 vap->iv_swbmiss_count = 0;
  224                 callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
  225                     ieee80211_swbmiss, vap);
  226         }
  227 }
  228 
  229 /*
  230  * IEEE80211_M_STA vap state machine handler.
  231  * This routine handles the main states in the 802.11 protocol.
  232  */
  233 static int
  234 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  235 {
  236         struct ieee80211com *ic = vap->iv_ic;
  237         struct ieee80211_node *ni;
  238         enum ieee80211_state ostate;
  239 
  240         IEEE80211_LOCK_ASSERT(ic);
  241 
  242         ostate = vap->iv_state;
  243         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
  244             __func__, ieee80211_state_name[ostate],
  245             ieee80211_state_name[nstate], arg);
  246         vap->iv_state = nstate;                 /* state transition */
  247         callout_stop(&vap->iv_mgtsend);         /* XXX callout_drain */
  248         if (ostate != IEEE80211_S_SCAN)
  249                 ieee80211_cancel_scan(vap);     /* background scan */
  250         ni = vap->iv_bss;                       /* NB: no reference held */
  251         if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
  252                 callout_stop(&vap->iv_swbmiss);
  253         switch (nstate) {
  254         case IEEE80211_S_INIT:
  255                 switch (ostate) {
  256                 case IEEE80211_S_SLEEP:
  257                         /* XXX wakeup */
  258                         /* XXX driver hook to wakeup the hardware? */
  259                 case IEEE80211_S_RUN:
  260                         IEEE80211_SEND_MGMT(ni,
  261                             IEEE80211_FC0_SUBTYPE_DISASSOC,
  262                             IEEE80211_REASON_ASSOC_LEAVE);
  263                         ieee80211_sta_leave(ni);
  264                         break;
  265                 case IEEE80211_S_ASSOC:
  266                         IEEE80211_SEND_MGMT(ni,
  267                             IEEE80211_FC0_SUBTYPE_DEAUTH,
  268                             IEEE80211_REASON_AUTH_LEAVE);
  269                         break;
  270                 case IEEE80211_S_SCAN:
  271                         ieee80211_cancel_scan(vap);
  272                         break;
  273                 default:
  274                         break;
  275                 }
  276                 if (ostate != IEEE80211_S_INIT) {
  277                         /* NB: optimize INIT -> INIT case */
  278                         ieee80211_reset_bss(vap);
  279                 }
  280                 if (vap->iv_auth->ia_detach != NULL)
  281                         vap->iv_auth->ia_detach(vap);
  282                 break;
  283         case IEEE80211_S_SCAN:
  284                 switch (ostate) {
  285                 case IEEE80211_S_INIT:
  286                         /*
  287                          * Initiate a scan.  We can come here as a result
  288                          * of an IEEE80211_IOC_SCAN_REQ too in which case
  289                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
  290                          * and the scan request parameters will be present
  291                          * in iv_scanreq.  Otherwise we do the default.
  292                          */
  293                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
  294                                 ieee80211_check_scan(vap,
  295                                     vap->iv_scanreq_flags,
  296                                     vap->iv_scanreq_duration,
  297                                     vap->iv_scanreq_mindwell,
  298                                     vap->iv_scanreq_maxdwell,
  299                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
  300                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
  301                         } else
  302                                 ieee80211_check_scan_current(vap);
  303                         break;
  304                 case IEEE80211_S_SCAN:
  305                 case IEEE80211_S_AUTH:
  306                 case IEEE80211_S_ASSOC:
  307                         /*
  308                          * These can happen either because of a timeout
  309                          * on an assoc/auth response or because of a
  310                          * change in state that requires a reset.  For
  311                          * the former we're called with a non-zero arg
  312                          * that is the cause for the failure; pass this
  313                          * to the scan code so it can update state.
  314                          * Otherwise trigger a new scan unless we're in
  315                          * manual roaming mode in which case an application
  316                          * must issue an explicit scan request.
  317                          */
  318                         if (arg != 0)
  319                                 ieee80211_scan_assoc_fail(vap,
  320                                         vap->iv_bss->ni_macaddr, arg);
  321                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  322                                 ieee80211_check_scan_current(vap);
  323                         break;
  324                 case IEEE80211_S_SLEEP:         /* beacon miss */
  325                         /*
  326                          * XXX if in sleep we need to wakeup the hardware.
  327                          */
  328                         /* FALLTHROUGH */
  329                 case IEEE80211_S_RUN:           /* beacon miss */
  330                         /*
  331                          * Beacon miss.  Notify user space and if not
  332                          * under control of a user application (roaming
  333                          * manual) kick off a scan to re-connect.
  334                          */
  335 
  336                         ieee80211_sta_leave(ni);
  337                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  338                                 ieee80211_check_scan_current(vap);
  339                         break;
  340                 default:
  341                         goto invalid;
  342                 }
  343                 break;
  344         case IEEE80211_S_AUTH:
  345                 switch (ostate) {
  346                 case IEEE80211_S_INIT:
  347                 case IEEE80211_S_SCAN:
  348                         IEEE80211_SEND_MGMT(ni,
  349                             IEEE80211_FC0_SUBTYPE_AUTH, 1);
  350                         break;
  351                 case IEEE80211_S_AUTH:
  352                 case IEEE80211_S_ASSOC:
  353                         switch (arg & 0xff) {
  354                         case IEEE80211_FC0_SUBTYPE_AUTH:
  355                                 /* ??? */
  356                                 IEEE80211_SEND_MGMT(ni,
  357                                     IEEE80211_FC0_SUBTYPE_AUTH, 2);
  358                                 break;
  359                         case IEEE80211_FC0_SUBTYPE_DEAUTH:
  360                                 sta_authretry(vap, ni, arg>>8);
  361                                 break;
  362                         }
  363                         break;
  364                 case IEEE80211_S_SLEEP:
  365                 case IEEE80211_S_RUN:
  366                         switch (arg & 0xff) {
  367                         case IEEE80211_FC0_SUBTYPE_AUTH:
  368                                 IEEE80211_SEND_MGMT(ni,
  369                                     IEEE80211_FC0_SUBTYPE_AUTH, 2);
  370                                 vap->iv_state = IEEE80211_S_RUN; /* stay RUN */
  371                                 break;
  372                         case IEEE80211_FC0_SUBTYPE_DEAUTH:
  373                                 ieee80211_sta_leave(ni);
  374                                 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
  375                                         /* try to reauth */
  376                                         IEEE80211_SEND_MGMT(ni,
  377                                             IEEE80211_FC0_SUBTYPE_AUTH, 1);
  378                                 }
  379                                 break;
  380                         }
  381                         break;
  382                 default:
  383                         goto invalid;
  384                 }
  385                 break;
  386         case IEEE80211_S_ASSOC:
  387                 switch (ostate) {
  388                 case IEEE80211_S_AUTH:
  389                 case IEEE80211_S_ASSOC:
  390                         IEEE80211_SEND_MGMT(ni,
  391                             IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
  392                         break;
  393                 case IEEE80211_S_SLEEP:         /* cannot happen */
  394                 case IEEE80211_S_RUN:
  395                         ieee80211_sta_leave(ni);
  396                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
  397                                 IEEE80211_SEND_MGMT(ni, arg ?
  398                                     IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
  399                                     IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
  400                         }
  401                         break;
  402                 default:
  403                         goto invalid;
  404                 }
  405                 break;
  406         case IEEE80211_S_RUN:
  407                 if (vap->iv_flags & IEEE80211_F_WPA) {
  408                         /* XXX validate prerequisites */
  409                 }
  410                 switch (ostate) {
  411                 case IEEE80211_S_RUN:
  412                 case IEEE80211_S_CSA:
  413                         break;
  414                 case IEEE80211_S_AUTH:          /* when join is done in fw */
  415                 case IEEE80211_S_ASSOC:
  416 #ifdef IEEE80211_DEBUG
  417                         if (ieee80211_msg_debug(vap)) {
  418                                 ieee80211_note(vap, "%s with %s ssid ",
  419                                     (vap->iv_opmode == IEEE80211_M_STA ?
  420                                     "associated" : "synchronized"),
  421                                     ether_sprintf(ni->ni_bssid));
  422                                 ieee80211_print_essid(vap->iv_bss->ni_essid,
  423                                     ni->ni_esslen);
  424                                 /* XXX MCS/HT */
  425                                 printf(" channel %d start %uMb\n",
  426                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
  427                                     IEEE80211_RATE2MBS(ni->ni_txrate));
  428                         }
  429 #endif
  430                         ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
  431                         ieee80211_notify_node_join(ni, 
  432                             arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
  433                         break;
  434                 case IEEE80211_S_SLEEP:
  435                         /* Wake up from sleep */
  436                         vap->iv_sta_ps(vap, 0);
  437                         break;
  438                 default:
  439                         goto invalid;
  440                 }
  441                 ieee80211_sync_curchan(ic);
  442                 if (ostate != IEEE80211_S_RUN)
  443                         sta_swbmiss_start(vap);
  444                 /*
  445                  * When 802.1x is not in use mark the port authorized
  446                  * at this point so traffic can flow.
  447                  */
  448                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  449                         ieee80211_node_authorize(ni);
  450                 /*
  451                  * Fake association when joining an existing bss.
  452                  *
  453                  * Don't do this if we're doing SLEEP->RUN.
  454                  */
  455                 if (ic->ic_newassoc != NULL && ostate != IEEE80211_S_SLEEP)
  456                         ic->ic_newassoc(vap->iv_bss, (ostate != IEEE80211_S_RUN));
  457                 break;
  458         case IEEE80211_S_CSA:
  459                 if (ostate != IEEE80211_S_RUN)
  460                         goto invalid;
  461                 break;
  462         case IEEE80211_S_SLEEP:
  463                 sta_swbmiss_start(vap);
  464                 vap->iv_sta_ps(vap, 1);
  465                 break;
  466         default:
  467         invalid:
  468                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
  469                     "%s: unexpected state transition %s -> %s\n", __func__,
  470                     ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
  471                 break;
  472         }
  473         return 0;
  474 }
  475 
  476 /*
  477  * Return non-zero if the frame is an echo of a multicast
  478  * frame sent by ourself.  The dir is known to be DSTODS.
  479  */
  480 static __inline int
  481 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
  482 {
  483 #define QWH4(wh)        ((const struct ieee80211_qosframe_addr4 *)wh)
  484 #define WH4(wh)         ((const struct ieee80211_frame_addr4 *)wh)
  485         const uint8_t *sa;
  486 
  487         KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
  488 
  489         if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
  490                 return 0;
  491         sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
  492         return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
  493 #undef WH4
  494 #undef QWH4
  495 }
  496 
  497 /*
  498  * Return non-zero if the frame is an echo of a multicast
  499  * frame sent by ourself.  The dir is known to be FROMDS.
  500  */
  501 static __inline int
  502 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
  503 {
  504         KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
  505 
  506         if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
  507                 return 0;
  508         return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
  509 }
  510 
  511 /*
  512  * Decide if a received management frame should be
  513  * printed when debugging is enabled.  This filters some
  514  * of the less interesting frames that come frequently
  515  * (e.g. beacons).
  516  */
  517 static __inline int
  518 doprint(struct ieee80211vap *vap, int subtype)
  519 {
  520         switch (subtype) {
  521         case IEEE80211_FC0_SUBTYPE_BEACON:
  522                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
  523         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  524                 return 0;
  525         }
  526         return 1;
  527 }
  528 
  529 /*
  530  * Process a received frame.  The node associated with the sender
  531  * should be supplied.  If nothing was found in the node table then
  532  * the caller is assumed to supply a reference to iv_bss instead.
  533  * The RSSI and a timestamp are also supplied.  The RSSI data is used
  534  * during AP scanning to select a AP to associate with; it can have
  535  * any units so long as values have consistent units and higher values
  536  * mean ``better signal''.  The receive timestamp is currently not used
  537  * by the 802.11 layer.
  538  */
  539 static int
  540 sta_input(struct ieee80211_node *ni, struct mbuf *m,
  541     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
  542 {
  543         struct ieee80211vap *vap = ni->ni_vap;
  544         struct ieee80211com *ic = ni->ni_ic;
  545         struct ifnet *ifp = vap->iv_ifp;
  546         struct ieee80211_frame *wh;
  547         struct ieee80211_key *key;
  548         struct ether_header *eh;
  549         int hdrspace, need_tap = 1;     /* mbuf need to be tapped. */
  550         uint8_t dir, type, subtype, qos;
  551         uint8_t *bssid;
  552         int is_hw_decrypted = 0;
  553         int has_decrypted = 0;
  554 
  555         /*
  556          * Some devices do hardware decryption all the way through
  557          * to pretending the frame wasn't encrypted in the first place.
  558          * So, tag it appropriately so it isn't discarded inappropriately.
  559          */
  560         if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_DECRYPTED))
  561                 is_hw_decrypted = 1;
  562 
  563         if (m->m_flags & M_AMPDU_MPDU) {
  564                 /*
  565                  * Fastpath for A-MPDU reorder q resubmission.  Frames
  566                  * w/ M_AMPDU_MPDU marked have already passed through
  567                  * here but were received out of order and been held on
  568                  * the reorder queue.  When resubmitted they are marked
  569                  * with the M_AMPDU_MPDU flag and we can bypass most of
  570                  * the normal processing.
  571                  */
  572                 wh = mtod(m, struct ieee80211_frame *);
  573                 type = IEEE80211_FC0_TYPE_DATA;
  574                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  575                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
  576                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
  577                 goto resubmit_ampdu;
  578         }
  579 
  580         KASSERT(ni != NULL, ("null node"));
  581         ni->ni_inact = ni->ni_inact_reload;
  582 
  583         type = -1;                      /* undefined */
  584 
  585         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
  586                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  587                     ni->ni_macaddr, NULL,
  588                     "too short (1): len %u", m->m_pkthdr.len);
  589                 vap->iv_stats.is_rx_tooshort++;
  590                 goto out;
  591         }
  592         /*
  593          * Bit of a cheat here, we use a pointer for a 3-address
  594          * frame format but don't reference fields past outside
  595          * ieee80211_frame_min w/o first validating the data is
  596          * present.
  597          */
  598         wh = mtod(m, struct ieee80211_frame *);
  599 
  600         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
  601             IEEE80211_FC0_VERSION_0) {
  602                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  603                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
  604                     wh->i_fc[0], wh->i_fc[1]);
  605                 vap->iv_stats.is_rx_badversion++;
  606                 goto err;
  607         }
  608 
  609         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  610         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
  611         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
  612         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
  613                 bssid = wh->i_addr2;
  614                 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
  615                         /* not interested in */
  616                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  617                             bssid, NULL, "%s", "not to bss");
  618                         vap->iv_stats.is_rx_wrongbss++;
  619                         goto out;
  620                 }
  621 
  622                 /*
  623                  * Some devices may be in a promiscuous mode
  624                  * where they receive frames for multiple station
  625                  * addresses.
  626                  *
  627                  * If we receive a data frame that isn't
  628                  * destined to our VAP MAC, drop it.
  629                  *
  630                  * XXX TODO: This is only enforced when not scanning;
  631                  * XXX it assumes a software-driven scan will put the NIC
  632                  * XXX into a "no data frames" mode before setting this
  633                  * XXX flag. Otherwise it may be possible that we'll still
  634                  * XXX process data frames whilst scanning.
  635                  */
  636                 if ((! IEEE80211_IS_MULTICAST(wh->i_addr1))
  637                     && (! IEEE80211_ADDR_EQ(wh->i_addr1, IF_LLADDR(ifp)))) {
  638                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  639                             bssid, NULL, "not to cur sta: lladdr=%6D, addr1=%6D",
  640                             IF_LLADDR(ifp), ":", wh->i_addr1, ":");
  641                         vap->iv_stats.is_rx_wrongbss++;
  642                         goto out;
  643                 }
  644 
  645                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  646                 ni->ni_noise = nf;
  647                 if ( IEEE80211_HAS_SEQ(type, subtype) &&
  648                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  649                         uint8_t tid = ieee80211_gettid(wh);
  650                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
  651                             TID_TO_WME_AC(tid) >= WME_AC_VI)
  652                                 ic->ic_wme.wme_hipri_traffic++;
  653                         if (! ieee80211_check_rxseq(ni, wh, bssid, rxs))
  654                                 goto out;
  655                 }
  656         }
  657 
  658         switch (type) {
  659         case IEEE80211_FC0_TYPE_DATA:
  660                 hdrspace = ieee80211_hdrspace(ic, wh);
  661                 if (m->m_len < hdrspace &&
  662                     (m = m_pullup(m, hdrspace)) == NULL) {
  663                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  664                             ni->ni_macaddr, NULL,
  665                             "data too short: expecting %u", hdrspace);
  666                         vap->iv_stats.is_rx_tooshort++;
  667                         goto out;               /* XXX */
  668                 }
  669                 /*
  670                  * Handle A-MPDU re-ordering.  If the frame is to be
  671                  * processed directly then ieee80211_ampdu_reorder
  672                  * will return 0; otherwise it has consumed the mbuf
  673                  * and we should do nothing more with it.
  674                  */
  675                 if ((m->m_flags & M_AMPDU) &&
  676                     (dir == IEEE80211_FC1_DIR_FROMDS ||
  677                      dir == IEEE80211_FC1_DIR_DSTODS) &&
  678                     ieee80211_ampdu_reorder(ni, m, rxs) != 0) {
  679                         m = NULL;
  680                         goto out;
  681                 }
  682         resubmit_ampdu:
  683                 if (dir == IEEE80211_FC1_DIR_FROMDS) {
  684                         if ((ifp->if_flags & IFF_SIMPLEX) &&
  685                             isfromds_mcastecho(vap, wh)) {
  686                                 /*
  687                                  * In IEEE802.11 network, multicast
  688                                  * packets sent from "me" are broadcast
  689                                  * from the AP; silently discard for
  690                                  * SIMPLEX interface.
  691                                  */
  692                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  693                                     wh, "data", "%s", "multicast echo");
  694                                 vap->iv_stats.is_rx_mcastecho++;
  695                                 goto out;
  696                         }
  697                         if ((vap->iv_flags & IEEE80211_F_DWDS) &&
  698                             IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  699                                 /*
  700                                  * DWDS sta's must drop 3-address mcast frames
  701                                  * as they will be sent separately as a 4-addr
  702                                  * frame.  Accepting the 3-addr frame will
  703                                  * confuse the bridge into thinking the sending
  704                                  * sta is located at the end of WDS link.
  705                                  */
  706                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
  707                                     "3-address data", "%s", "DWDS enabled");
  708                                 vap->iv_stats.is_rx_mcastecho++;
  709                                 goto out;
  710                         }
  711                 } else if (dir == IEEE80211_FC1_DIR_DSTODS) {
  712                         if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
  713                                 IEEE80211_DISCARD(vap,
  714                                     IEEE80211_MSG_INPUT, wh, "4-address data",
  715                                     "%s", "DWDS not enabled");
  716                                 vap->iv_stats.is_rx_wrongdir++;
  717                                 goto out;
  718                         }
  719                         if ((ifp->if_flags & IFF_SIMPLEX) &&
  720                             isdstods_mcastecho(vap, wh)) {
  721                                 /*
  722                                  * In IEEE802.11 network, multicast
  723                                  * packets sent from "me" are broadcast
  724                                  * from the AP; silently discard for
  725                                  * SIMPLEX interface.
  726                                  */
  727                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
  728                                     "4-address data", "%s", "multicast echo");
  729                                 vap->iv_stats.is_rx_mcastecho++;
  730                                 goto out;
  731                         }
  732                 } else {
  733                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
  734                             "data", "incorrect dir 0x%x", dir);
  735                         vap->iv_stats.is_rx_wrongdir++;
  736                         goto out;
  737                 }
  738 
  739                 /*
  740                  * Handle privacy requirements for hardware decryption
  741                  * devices.
  742                  *
  743                  * For those devices, a handful of things happen.
  744                  *
  745                  * + If IV has been stripped, then we can't run
  746                  *   ieee80211_crypto_decap() - none of the key
  747                  * + If MIC has been stripped, we can't validate
  748                  *   MIC here.
  749                  * + If MIC fails, then we need to communicate a
  750                  *   MIC failure up to the stack - but we don't know
  751                  *   which key was used.
  752                  */
  753 
  754                 /*
  755                  * Handle privacy requirements.  Note that we
  756                  * must not be preempted from here until after
  757                  * we (potentially) call ieee80211_crypto_demic;
  758                  * otherwise we may violate assumptions in the
  759                  * crypto cipher modules used to do delayed update
  760                  * of replay sequence numbers.
  761                  */
  762                 if (is_hw_decrypted || wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
  763                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  764                                 /*
  765                                  * Discard encrypted frames when privacy is off.
  766                                  */
  767                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  768                                     wh, "WEP", "%s", "PRIVACY off");
  769                                 vap->iv_stats.is_rx_noprivacy++;
  770                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
  771                                 goto out;
  772                         }
  773                         if (ieee80211_crypto_decap(ni, m, hdrspace, &key) == 0) {
  774                                 /* NB: stats+msgs handled in crypto_decap */
  775                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
  776                                 goto out;
  777                         }
  778                         wh = mtod(m, struct ieee80211_frame *);
  779                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
  780                         has_decrypted = 1;
  781                 } else {
  782                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
  783                         key = NULL;
  784                 }
  785 
  786                 /*
  787                  * Save QoS bits for use below--before we strip the header.
  788                  */
  789                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS)
  790                         qos = ieee80211_getqos(wh)[0];
  791                 else
  792                         qos = 0;
  793 
  794                 /*
  795                  * Next up, any fragmentation.
  796                  */
  797                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  798                         m = ieee80211_defrag(ni, m, hdrspace, has_decrypted);
  799                         if (m == NULL) {
  800                                 /* Fragment dropped or frame not complete yet */
  801                                 goto out;
  802                         }
  803                 }
  804                 wh = NULL;              /* no longer valid, catch any uses */
  805 
  806                 /*
  807                  * Next strip any MSDU crypto bits.
  808                  *
  809                  * Note: we can't do MIC stripping/verification if the
  810                  * upper layer has stripped it.  We have to check MIC
  811                  * ourselves.  So, key may be NULL, but we have to check
  812                  * the RX status.
  813                  */
  814                 if (!ieee80211_crypto_demic(vap, key, m, 0)) {
  815                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  816                             ni->ni_macaddr, "data", "%s", "demic error");
  817                         vap->iv_stats.is_rx_demicfail++;
  818                         IEEE80211_NODE_STAT(ni, rx_demicfail);
  819                         goto out;
  820                 }
  821 
  822                 /* copy to listener after decrypt */
  823                 if (ieee80211_radiotap_active_vap(vap))
  824                         ieee80211_radiotap_rx(vap, m);
  825                 need_tap = 0;
  826 
  827                 /*
  828                  * Finally, strip the 802.11 header.
  829                  */
  830                 m = ieee80211_decap(vap, m, hdrspace, qos);
  831                 if (m == NULL) {
  832                         /* XXX mask bit to check for both */
  833                         /* don't count Null data frames as errors */
  834                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
  835                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
  836                                 goto out;
  837                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  838                             ni->ni_macaddr, "data", "%s", "decap error");
  839                         vap->iv_stats.is_rx_decap++;
  840                         IEEE80211_NODE_STAT(ni, rx_decap);
  841                         goto err;
  842                 }
  843                 if (!(qos & IEEE80211_QOS_AMSDU))
  844                         eh = mtod(m, struct ether_header *);
  845                 else
  846                         eh = NULL;
  847                 if (!ieee80211_node_is_authorized(ni)) {
  848                         /*
  849                          * Deny any non-PAE frames received prior to
  850                          * authorization.  For open/shared-key
  851                          * authentication the port is mark authorized
  852                          * after authentication completes.  For 802.1x
  853                          * the port is not marked authorized by the
  854                          * authenticator until the handshake has completed.
  855                          */
  856                         if (eh == NULL ||
  857                             eh->ether_type != htons(ETHERTYPE_PAE)) {
  858                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  859                                     ni->ni_macaddr, "data", "unauthorized or "
  860                                     "unknown port: ether type 0x%x len %u",
  861                                     eh == NULL ? -1 : eh->ether_type,
  862                                     m->m_pkthdr.len);
  863                                 vap->iv_stats.is_rx_unauth++;
  864                                 IEEE80211_NODE_STAT(ni, rx_unauth);
  865                                 goto err;
  866                         }
  867                 } else {
  868                         /*
  869                          * When denying unencrypted frames, discard
  870                          * any non-PAE frames received without encryption.
  871                          */
  872                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
  873                             ((has_decrypted == 0) && (m->m_flags & M_WEP) == 0) &&
  874                             (is_hw_decrypted == 0) &&
  875                             (eh == NULL ||
  876                              eh->ether_type != htons(ETHERTYPE_PAE))) {
  877                                 /*
  878                                  * Drop unencrypted frames.
  879                                  */
  880                                 vap->iv_stats.is_rx_unencrypted++;
  881                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
  882                                 goto out;
  883                         }
  884                 }
  885                 /* XXX require HT? */
  886                 if (qos & IEEE80211_QOS_AMSDU) {
  887                         m = ieee80211_decap_amsdu(ni, m);
  888                         if (m == NULL)
  889                                 return IEEE80211_FC0_TYPE_DATA;
  890                 } else {
  891 #ifdef IEEE80211_SUPPORT_SUPERG
  892                         m = ieee80211_decap_fastframe(vap, ni, m);
  893                         if (m == NULL)
  894                                 return IEEE80211_FC0_TYPE_DATA;
  895 #endif
  896                 }
  897                 ieee80211_deliver_data(vap, ni, m);
  898                 return IEEE80211_FC0_TYPE_DATA;
  899 
  900         case IEEE80211_FC0_TYPE_MGT:
  901                 vap->iv_stats.is_rx_mgmt++;
  902                 IEEE80211_NODE_STAT(ni, rx_mgmt);
  903                 if (dir != IEEE80211_FC1_DIR_NODS) {
  904                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  905                             wh, "data", "incorrect dir 0x%x", dir);
  906                         vap->iv_stats.is_rx_wrongdir++;
  907                         goto err;
  908                 }
  909                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  910                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  911                             ni->ni_macaddr, "mgt", "too short: len %u",
  912                             m->m_pkthdr.len);
  913                         vap->iv_stats.is_rx_tooshort++;
  914                         goto out;
  915                 }
  916 #ifdef IEEE80211_DEBUG
  917                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
  918                     ieee80211_msg_dumppkts(vap)) {
  919                         if_printf(ifp, "received %s from %s rssi %d\n",
  920                             ieee80211_mgt_subtype_name(subtype),
  921                             ether_sprintf(wh->i_addr2), rssi);
  922                 }
  923 #endif
  924 
  925                 /*
  926                  * Note: See above for hardware offload privacy requirements.
  927                  *       It also applies here.
  928                  */
  929 
  930                 /*
  931                  * Again, having encrypted flag set check would be good, but
  932                  * then we have to also handle crypto_decap() like above.
  933                  */
  934                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
  935                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
  936                                 /*
  937                                  * Only shared key auth frames with a challenge
  938                                  * should be encrypted, discard all others.
  939                                  */
  940                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  941                                     wh, ieee80211_mgt_subtype_name(subtype),
  942                                     "%s", "WEP set but not permitted");
  943                                 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
  944                                 goto out;
  945                         }
  946                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  947                                 /*
  948                                  * Discard encrypted frames when privacy is off.
  949                                  */
  950                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  951                                     wh, "mgt", "%s", "WEP set but PRIVACY off");
  952                                 vap->iv_stats.is_rx_noprivacy++;
  953                                 goto out;
  954                         }
  955                         hdrspace = ieee80211_hdrspace(ic, wh);
  956 
  957                         /*
  958                          * Again, if IV/MIC was stripped, then this whole
  959                          * setup will fail.  That's going to need some poking.
  960                          */
  961                         if (ieee80211_crypto_decap(ni, m, hdrspace, &key) == 0) {
  962                                 /* NB: stats+msgs handled in crypto_decap */
  963                                 goto out;
  964                         }
  965                         has_decrypted = 1;
  966                         wh = mtod(m, struct ieee80211_frame *);
  967                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
  968                 }
  969                 vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
  970                 goto out;
  971 
  972         case IEEE80211_FC0_TYPE_CTL:
  973                 vap->iv_stats.is_rx_ctl++;
  974                 IEEE80211_NODE_STAT(ni, rx_ctrl);
  975                 vap->iv_recv_ctl(ni, m, subtype);
  976                 goto out;
  977 
  978         default:
  979                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  980                     wh, NULL, "bad frame type 0x%x", type);
  981                 /* should not come here */
  982                 break;
  983         }
  984 err:
  985         if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
  986 out:
  987         if (m != NULL) {
  988                 if (need_tap && ieee80211_radiotap_active_vap(vap))
  989                         ieee80211_radiotap_rx(vap, m);
  990                 m_freem(m);
  991         }
  992         return type;
  993 }
  994 
  995 static void
  996 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
  997     int rssi, int nf, uint16_t seq, uint16_t status)
  998 {
  999         struct ieee80211vap *vap = ni->ni_vap;
 1000 
 1001         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
 1002                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1003                     ni->ni_macaddr, "open auth",
 1004                     "bad sta auth mode %u", ni->ni_authmode);
 1005                 vap->iv_stats.is_rx_bad_auth++; /* XXX */
 1006                 return;
 1007         }
 1008         if (vap->iv_state != IEEE80211_S_AUTH ||
 1009             seq != IEEE80211_AUTH_OPEN_RESPONSE) {
 1010                 vap->iv_stats.is_rx_bad_auth++;
 1011                 return;
 1012         }
 1013         if (status != 0) {
 1014                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 1015                     ni, "open auth failed (reason %d)", status);
 1016                 vap->iv_stats.is_rx_auth_fail++;
 1017                 vap->iv_stats.is_rx_authfail_code = status;
 1018                 ieee80211_new_state(vap, IEEE80211_S_SCAN,
 1019                     IEEE80211_SCAN_FAIL_STATUS);
 1020         } else
 1021                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
 1022 }
 1023 
 1024 static void
 1025 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
 1026     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
 1027     uint16_t seq, uint16_t status)
 1028 {
 1029         struct ieee80211vap *vap = ni->ni_vap;
 1030         uint8_t *challenge;
 1031 
 1032         /*
 1033          * NB: this can happen as we allow pre-shared key
 1034          * authentication to be enabled w/o wep being turned
 1035          * on so that configuration of these can be done
 1036          * in any order.  It may be better to enforce the
 1037          * ordering in which case this check would just be
 1038          * for sanity/consistency.
 1039          */
 1040         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 1041                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1042                     ni->ni_macaddr, "shared key auth",
 1043                     "%s", " PRIVACY is disabled");
 1044                 goto bad;
 1045         }
 1046         /*
 1047          * Pre-shared key authentication is evil; accept
 1048          * it only if explicitly configured (it is supported
 1049          * mainly for compatibility with clients like OS X).
 1050          */
 1051         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
 1052             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
 1053                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1054                     ni->ni_macaddr, "shared key auth",
 1055                     "bad sta auth mode %u", ni->ni_authmode);
 1056                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
 1057                 goto bad;
 1058         }
 1059 
 1060         challenge = NULL;
 1061         if (frm + 1 < efrm) {
 1062                 if ((frm[1] + 2) > (efrm - frm)) {
 1063                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1064                             ni->ni_macaddr, "shared key auth",
 1065                             "ie %d/%d too long",
 1066                             frm[0], (frm[1] + 2) - (efrm - frm));
 1067                         vap->iv_stats.is_rx_bad_auth++;
 1068                         goto bad;
 1069                 }
 1070                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
 1071                         challenge = frm;
 1072                 frm += frm[1] + 2;
 1073         }
 1074         switch (seq) {
 1075         case IEEE80211_AUTH_SHARED_CHALLENGE:
 1076         case IEEE80211_AUTH_SHARED_RESPONSE:
 1077                 if (challenge == NULL) {
 1078                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1079                             ni->ni_macaddr, "shared key auth",
 1080                             "%s", "no challenge");
 1081                         vap->iv_stats.is_rx_bad_auth++;
 1082                         goto bad;
 1083                 }
 1084                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
 1085                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1086                             ni->ni_macaddr, "shared key auth",
 1087                             "bad challenge len %d", challenge[1]);
 1088                         vap->iv_stats.is_rx_bad_auth++;
 1089                         goto bad;
 1090                 }
 1091         default:
 1092                 break;
 1093         }
 1094         if (vap->iv_state != IEEE80211_S_AUTH)
 1095                 return;
 1096         switch (seq) {
 1097         case IEEE80211_AUTH_SHARED_PASS:
 1098                 if (ni->ni_challenge != NULL) {
 1099                         IEEE80211_FREE(ni->ni_challenge, M_80211_NODE);
 1100                         ni->ni_challenge = NULL;
 1101                 }
 1102                 if (status != 0) {
 1103                         IEEE80211_NOTE_FRAME(vap,
 1104                             IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
 1105                             "shared key auth failed (reason %d)", status);
 1106                         vap->iv_stats.is_rx_auth_fail++;
 1107                         vap->iv_stats.is_rx_authfail_code = status;
 1108                         return;
 1109                 }
 1110                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
 1111                 break;
 1112         case IEEE80211_AUTH_SHARED_CHALLENGE:
 1113                 if (!ieee80211_alloc_challenge(ni))
 1114                         return;
 1115                 /* XXX could optimize by passing recvd challenge */
 1116                 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
 1117                 IEEE80211_SEND_MGMT(ni,
 1118                         IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
 1119                 break;
 1120         default:
 1121                 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
 1122                     wh, "shared key auth", "bad seq %d", seq);
 1123                 vap->iv_stats.is_rx_bad_auth++;
 1124                 return;
 1125         }
 1126         return;
 1127 bad:
 1128         /*
 1129          * Kick the state machine.  This short-circuits
 1130          * using the mgt frame timeout to trigger the
 1131          * state transition.
 1132          */
 1133         if (vap->iv_state == IEEE80211_S_AUTH)
 1134                 ieee80211_new_state(vap, IEEE80211_S_SCAN,
 1135                     IEEE80211_SCAN_FAIL_STATUS);
 1136 }
 1137 
 1138 /*
 1139  * Parse the WME IE for QoS and U-APSD information.
 1140  *
 1141  * Returns -1 if the IE isn't found, 1 if it's found.
 1142  */
 1143 int
 1144 ieee80211_parse_wmeie(uint8_t *frm, const struct ieee80211_frame *wh,
 1145     struct ieee80211_node *ni)
 1146 {
 1147         u_int len = frm[1];
 1148 
 1149         ni->ni_uapsd = 0;
 1150 
 1151         if (len < sizeof(struct ieee80211_wme_param)-2) {
 1152                 IEEE80211_DISCARD_IE(ni->ni_vap,
 1153                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
 1154                     wh, "WME", "too short, len %u", len);
 1155                 return -1;
 1156         }
 1157 
 1158         ni->ni_uapsd = frm[WME_CAPINFO_IE_OFFSET];
 1159 
 1160         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_POWER | IEEE80211_MSG_ASSOC,
 1161             ni, "U-APSD settings from STA: 0x%02x", ni->ni_uapsd);
 1162 
 1163         return 1;
 1164 }
 1165 
 1166 int
 1167 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
 1168         const struct ieee80211_frame *wh, uint8_t *qosinfo)
 1169 {
 1170         struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
 1171         u_int len = frm[1], qosinfo_count;
 1172         int i;
 1173 
 1174         *qosinfo = 0;
 1175 
 1176         if (len < sizeof(struct ieee80211_wme_param)-2) {
 1177                 IEEE80211_DISCARD_IE(vap,
 1178                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
 1179                     wh, "WME", "too short, len %u", len);
 1180                 return -1;
 1181         }
 1182         *qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
 1183         qosinfo_count = *qosinfo & WME_QOSINFO_COUNT;
 1184 
 1185         /* XXX do proper check for wraparound */
 1186         if (qosinfo_count == wme->wme_wmeChanParams.cap_info)
 1187                 return 0;
 1188         frm += __offsetof(struct ieee80211_wme_param, params_acParams);
 1189         for (i = 0; i < WME_NUM_AC; i++) {
 1190                 struct wmeParams *wmep =
 1191                         &wme->wme_wmeChanParams.cap_wmeParams[i];
 1192                 /* NB: ACI not used */
 1193                 wmep->wmep_acm = _IEEE80211_MASKSHIFT(frm[0], WME_PARAM_ACM);
 1194                 wmep->wmep_aifsn =
 1195                     _IEEE80211_MASKSHIFT(frm[0], WME_PARAM_AIFSN);
 1196                 wmep->wmep_logcwmin =
 1197                      _IEEE80211_MASKSHIFT(frm[1], WME_PARAM_LOGCWMIN);
 1198                 wmep->wmep_logcwmax =
 1199                      _IEEE80211_MASKSHIFT(frm[1], WME_PARAM_LOGCWMAX);
 1200                 wmep->wmep_txopLimit = le16dec(frm+2);
 1201                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
 1202                     "%s: WME: %d: acm=%d aifsn=%d logcwmin=%d logcwmax=%d txopLimit=%d\n",
 1203                     __func__,
 1204                     i,
 1205                     wmep->wmep_acm,
 1206                     wmep->wmep_aifsn,
 1207                     wmep->wmep_logcwmin,
 1208                     wmep->wmep_logcwmax,
 1209                     wmep->wmep_txopLimit);
 1210                 frm += 4;
 1211         }
 1212         wme->wme_wmeChanParams.cap_info = qosinfo_count;
 1213         return 1;
 1214 }
 1215 
 1216 /*
 1217  * Process 11h Channel Switch Announcement (CSA) ie.  If this
 1218  * is the first CSA then initiate the switch.  Otherwise we
 1219  * track state and trigger completion and/or cancel of the switch.
 1220  * XXX should be public for IBSS use
 1221  */
 1222 static void
 1223 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
 1224         const struct ieee80211_frame *wh)
 1225 {
 1226         struct ieee80211com *ic = vap->iv_ic;
 1227         const struct ieee80211_csa_ie *csa =
 1228             (const struct ieee80211_csa_ie *) frm;
 1229 
 1230         KASSERT(vap->iv_state >= IEEE80211_S_RUN,
 1231             ("state %s", ieee80211_state_name[vap->iv_state]));
 1232 
 1233         if (csa->csa_mode > 1) {
 1234                 IEEE80211_DISCARD_IE(vap,
 1235                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
 1236                     wh, "CSA", "invalid mode %u", csa->csa_mode);
 1237                 return;
 1238         }
 1239         IEEE80211_LOCK(ic);
 1240         if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
 1241                 /*
 1242                  * Convert the channel number to a channel reference.  We
 1243                  * try first to preserve turbo attribute of the current
 1244                  * channel then fallback.  Note this will not work if the
 1245                  * CSA specifies a channel that requires a band switch (e.g.
 1246                  * 11a => 11g).  This is intentional as 11h is defined only
 1247                  * for 5GHz/11a and because the switch does not involve a
 1248                  * reassociation, protocol state (capabilities, negotated
 1249                  * rates, etc) may/will be wrong.
 1250                  */
 1251                 struct ieee80211_channel *c =
 1252                     ieee80211_find_channel_byieee(ic, csa->csa_newchan,
 1253                         (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
 1254                 if (c == NULL) {
 1255                         c = ieee80211_find_channel_byieee(ic,
 1256                             csa->csa_newchan,
 1257                             (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
 1258                         if (c == NULL) {
 1259                                 IEEE80211_DISCARD_IE(vap,
 1260                                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
 1261                                     wh, "CSA", "invalid channel %u",
 1262                                     csa->csa_newchan);
 1263                                 goto done;
 1264                         }
 1265                 }
 1266 #if IEEE80211_CSA_COUNT_MIN > 0
 1267                 if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
 1268                         /*
 1269                          * Require at least IEEE80211_CSA_COUNT_MIN count to
 1270                          * reduce the risk of being redirected by a fabricated
 1271                          * CSA.  If a valid CSA is dropped we'll still get a
 1272                          * beacon miss when the AP leaves the channel so we'll
 1273                          * eventually follow to the new channel.
 1274                          *
 1275                          * NOTE: this violates the 11h spec that states that
 1276                          * count may be any value and if 0 then a switch
 1277                          * should happen asap.
 1278                          */
 1279                         IEEE80211_DISCARD_IE(vap,
 1280                             IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
 1281                             wh, "CSA", "count %u too small, must be >= %u",
 1282                             csa->csa_count, IEEE80211_CSA_COUNT_MIN);
 1283                         goto done;
 1284                 }
 1285 #endif
 1286                 ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
 1287         } else {
 1288                 /*
 1289                  * Validate this ie against the initial CSA.  We require
 1290                  * mode and channel not change and the count must be
 1291                  * monotonically decreasing.  This may be pointless and
 1292                  * canceling the switch as a result may be too paranoid but
 1293                  * in the worst case if we drop out of CSA because of this
 1294                  * and the AP does move then we'll just end up taking a
 1295                  * beacon miss and scan to find the AP.
 1296                  *
 1297                  * XXX may want <= on count as we also process ProbeResp
 1298                  * frames and those may come in w/ the same count as the
 1299                  * previous beacon; but doing so leaves us open to a stuck
 1300                  * count until we add a dead-man timer
 1301                  */
 1302                 if (!(csa->csa_count < ic->ic_csa_count &&
 1303                       csa->csa_mode == ic->ic_csa_mode &&
 1304                       csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
 1305                         IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
 1306                             "CSA ie mismatch, initial ie <%d,%d,%d>, "
 1307                             "this ie <%d,%d,%d>", ic->ic_csa_mode,
 1308                             ic->ic_csa_newchan, ic->ic_csa_count,
 1309                             csa->csa_mode, csa->csa_newchan, csa->csa_count);
 1310                         ieee80211_csa_cancelswitch(ic);
 1311                 } else {
 1312                         if (csa->csa_count <= 1)
 1313                                 ieee80211_csa_completeswitch(ic);
 1314                         else
 1315                                 ic->ic_csa_count = csa->csa_count;
 1316                 }
 1317         }
 1318 done:
 1319         IEEE80211_UNLOCK(ic);
 1320 }
 1321 
 1322 /*
 1323  * Return non-zero if a background scan may be continued:
 1324  * o bg scan is active
 1325  * o no channel switch is pending
 1326  * o there has not been any traffic recently
 1327  * o no full-offload scan support (no need for explicitly continuing scan then)
 1328  *
 1329  * Note we do not check if there is an administrative enable;
 1330  * this is only done to start the scan.  We assume that any
 1331  * change in state will be accompanied by a request to cancel
 1332  * active scans which will otherwise cause this test to fail.
 1333  */
 1334 static __inline int
 1335 contbgscan(struct ieee80211vap *vap)
 1336 {
 1337         struct ieee80211com *ic = vap->iv_ic;
 1338 
 1339         return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
 1340             (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
 1341             !(vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) &&
 1342             vap->iv_state == IEEE80211_S_RUN &&         /* XXX? */
 1343             ieee80211_time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
 1344 }
 1345 
 1346 /*
 1347  * Return non-zero if a backgrond scan may be started:
 1348  * o bg scanning is administratively enabled
 1349  * o no channel switch is pending
 1350  * o we are not boosted on a dynamic turbo channel
 1351  * o there has not been a scan recently
 1352  * o there has not been any traffic recently (don't check if full-offload scan)
 1353  */
 1354 static __inline int
 1355 startbgscan(struct ieee80211vap *vap)
 1356 {
 1357         struct ieee80211com *ic = vap->iv_ic;
 1358 
 1359         return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
 1360             (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
 1361 #ifdef IEEE80211_SUPPORT_SUPERG
 1362             !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
 1363 #endif
 1364             ieee80211_time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
 1365             ((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) ||
 1366              ieee80211_time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle)));
 1367 }
 1368 
 1369 #ifdef  notyet
 1370 /*
 1371  * Compare two quiet IEs and return if they are equivalent.
 1372  *
 1373  * The tbttcount isnt checked - that's not part of the configuration.
 1374  */
 1375 static int
 1376 compare_quiet_ie(const struct ieee80211_quiet_ie *q1,
 1377     const struct ieee80211_quiet_ie *q2)
 1378 {
 1379 
 1380         if (q1->period != q2->period)
 1381                 return (0);
 1382         if (le16dec(&q1->duration) != le16dec(&q2->duration))
 1383                 return (0);
 1384         if (le16dec(&q1->offset) != le16dec(&q2->offset))
 1385                 return (0);
 1386         return (1);
 1387 }
 1388 #endif
 1389 
 1390 static void
 1391 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
 1392     const struct ieee80211_rx_stats *rxs,
 1393     int rssi, int nf)
 1394 {
 1395 #define ISREASSOC(_st)  ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
 1396         struct ieee80211vap *vap = ni->ni_vap;
 1397         struct ieee80211com *ic = ni->ni_ic;
 1398         struct ieee80211_channel *rxchan = ic->ic_curchan;
 1399         struct ieee80211_frame *wh;
 1400         int ht_state_change = 0, do_ht = 0;
 1401         uint8_t *frm, *efrm;
 1402         uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
 1403         uint8_t *vhtcap, *vhtopmode;
 1404         uint8_t rate;
 1405         uint8_t qosinfo;
 1406 
 1407         wh = mtod(m0, struct ieee80211_frame *);
 1408         frm = (uint8_t *)&wh[1];
 1409         efrm = mtod(m0, uint8_t *) + m0->m_len;
 1410         switch (subtype) {
 1411         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 1412         case IEEE80211_FC0_SUBTYPE_BEACON: {
 1413                 struct ieee80211_scanparams scan;
 1414                 struct ieee80211_channel *c;
 1415                 /*
 1416                  * We process beacon/probe response frames:
 1417                  *    o when scanning, or
 1418                  *    o station mode when associated (to collect state
 1419                  *      updates such as 802.11g slot time)
 1420                  * Frames otherwise received are discarded.
 1421                  */ 
 1422                 if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
 1423                         vap->iv_stats.is_rx_mgtdiscard++;
 1424                         return;
 1425                 }
 1426 
 1427                 /* Override RX channel as appropriate */
 1428                 if (rxs != NULL) {
 1429                         c = ieee80211_lookup_channel_rxstatus(vap, rxs);
 1430                         if (c != NULL)
 1431                                 rxchan = c;
 1432                 }
 1433 
 1434                 /* XXX probe response in sta mode when !scanning? */
 1435                 if (ieee80211_parse_beacon(ni, m0, rxchan, &scan) != 0) {
 1436                         if (! (ic->ic_flags & IEEE80211_F_SCAN))
 1437                                 vap->iv_stats.is_beacon_bad++;
 1438                         return;
 1439                 }
 1440 
 1441                 /*
 1442                  * Count frame now that we know it's to be processed.
 1443                  */
 1444                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
 1445                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
 1446                         IEEE80211_NODE_STAT(ni, rx_beacons);
 1447                 } else
 1448                         IEEE80211_NODE_STAT(ni, rx_proberesp);
 1449                 /*
 1450                  * When operating in station mode, check for state updates.
 1451                  * Be careful to ignore beacons received while doing a
 1452                  * background scan.  We consider only 11g/WMM stuff right now.
 1453                  */
 1454                 if (ni->ni_associd != 0 &&
 1455                     ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
 1456                      IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
 1457                         /* record tsf of last beacon */
 1458                         memcpy(ni->ni_tstamp.data, scan.tstamp,
 1459                                 sizeof(ni->ni_tstamp));
 1460                         /* count beacon frame for s/w bmiss handling */
 1461                         vap->iv_swbmiss_count++;
 1462                         vap->iv_bmiss_count = 0;
 1463                         if (ni->ni_erp != scan.erp) {
 1464                                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1465                                     wh->i_addr2,
 1466                                     "erp change: was 0x%x, now 0x%x",
 1467                                     ni->ni_erp, scan.erp);
 1468                                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
 1469                                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
 1470                                         vap->iv_flags |= IEEE80211_F_USEPROT;
 1471                                 else
 1472                                         vap->iv_flags &= ~IEEE80211_F_USEPROT;
 1473                                 ni->ni_erp = scan.erp;
 1474                                 /* XXX statistic */
 1475                                 /* driver notification */
 1476                                 ieee80211_vap_update_erp_protmode(vap);
 1477                         }
 1478                         if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
 1479                                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1480                                     wh->i_addr2,
 1481                                     "capabilities change: was 0x%x, now 0x%x",
 1482                                     ni->ni_capinfo, scan.capinfo);
 1483                                 /*
 1484                                  * NB: we assume short preamble doesn't
 1485                                  *     change dynamically
 1486                                  */
 1487                                 ieee80211_vap_set_shortslottime(vap,
 1488                                         IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
 1489                                         (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
 1490                                 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
 1491                                                | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
 1492                                 /* XXX statistic */
 1493                         }
 1494                         if (scan.wme != NULL &&
 1495                             (ni->ni_flags & IEEE80211_NODE_QOS)) {
 1496                                 int _retval;
 1497                                 if ((_retval = ieee80211_parse_wmeparams(vap,
 1498                                     scan.wme, wh, &qosinfo)) >= 0) {
 1499                                         if (qosinfo & WME_CAPINFO_UAPSD_EN)
 1500                                                 ni->ni_flags |=
 1501                                                     IEEE80211_NODE_UAPSD;
 1502                                         if (_retval > 0)
 1503                                                 ieee80211_wme_updateparams(vap);
 1504                                 }
 1505                         } else
 1506                                 ni->ni_flags &= ~IEEE80211_NODE_UAPSD;
 1507 #ifdef IEEE80211_SUPPORT_SUPERG
 1508                         if (scan.ath != NULL)
 1509                                 ieee80211_parse_athparams(ni, scan.ath, wh);
 1510 #endif
 1511                         if (scan.htcap != NULL && scan.htinfo != NULL &&
 1512                             (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
 1513                                 /* XXX state changes? */
 1514                                 ieee80211_ht_updateparams(ni,
 1515                                     scan.htcap, scan.htinfo);
 1516                                 do_ht = 1;
 1517                         }
 1518                         if (scan.vhtcap != NULL && scan.vhtopmode != NULL &&
 1519                             (vap->iv_flags_vht & IEEE80211_FVHT_VHT)) {
 1520                                 /* XXX state changes? */
 1521                                 ieee80211_vht_updateparams(ni,
 1522                                     scan.vhtcap, scan.vhtopmode);
 1523                                 do_ht = 1;
 1524                         }
 1525                         if (do_ht) {
 1526                                 if (ieee80211_ht_updateparams_final(ni,
 1527                                     scan.htcap, scan.htinfo))
 1528                                         ht_state_change = 1;
 1529                         }
 1530 
 1531                         /*
 1532                          * If we have a quiet time IE then report it up to
 1533                          * the driver.
 1534                          *
 1535                          * Otherwise, inform the driver that the quiet time
 1536                          * IE has disappeared - only do that once rather than
 1537                          * spamming it each time.
 1538                          */
 1539                         if (scan.quiet) {
 1540                                 ic->ic_set_quiet(ni, scan.quiet);
 1541                                 ni->ni_quiet_ie_set = 1;
 1542                                 memcpy(&ni->ni_quiet_ie, scan.quiet,
 1543                                     sizeof(struct ieee80211_quiet_ie));
 1544                         } else {
 1545                                 if (ni->ni_quiet_ie_set == 1)
 1546                                         ic->ic_set_quiet(ni, NULL);
 1547                                 ni->ni_quiet_ie_set = 0;
 1548                                 bzero(&ni->ni_quiet_ie,
 1549                                     sizeof(struct ieee80211_quiet_ie));
 1550                         }
 1551 
 1552                         if (scan.tim != NULL) {
 1553                                 struct ieee80211_tim_ie *tim =
 1554                                     (struct ieee80211_tim_ie *) scan.tim;
 1555                                 /*
 1556                                  * XXX Check/debug this code; see if it's about
 1557                                  * the right time to force the VAP awake if we
 1558                                  * receive a frame destined for us?
 1559                                  */
 1560                                 int aid = IEEE80211_AID(ni->ni_associd);
 1561                                 int ix = aid / NBBY;
 1562                                 int min = tim->tim_bitctl &~ 1;
 1563                                 int max = tim->tim_len + min - 4;
 1564                                 int tim_ucast = 0, tim_mcast = 0;
 1565 
 1566                                 /*
 1567                                  * Only do this for unicast traffic in the TIM
 1568                                  * The multicast traffic notification for
 1569                                  * the scan notification stuff should occur
 1570                                  * differently.
 1571                                  */
 1572                                 if (min <= ix && ix <= max &&
 1573                                      isset(tim->tim_bitmap - min, aid)) {
 1574                                         tim_ucast = 1;
 1575                                 }
 1576 
 1577                                 /*
 1578                                  * Do a separate notification
 1579                                  * for the multicast bit being set.
 1580                                  */
 1581                                 if (tim->tim_bitctl & 1) {
 1582                                         tim_mcast = 1;
 1583                                 }
 1584 
 1585                                 /*
 1586                                  * If the TIM indicates there's traffic for
 1587                                  * us then get us out of STA mode powersave.
 1588                                  */
 1589                                 if (tim_ucast == 1) {
 1590                                         /*
 1591                                          * Wake us out of SLEEP state if we're
 1592                                          * in it; and if we're doing bgscan
 1593                                          * then wake us out of STA powersave.
 1594                                          */
 1595                                         ieee80211_sta_tim_notify(vap, 1);
 1596 
 1597                                         /*
 1598                                          * This is preventing us from
 1599                                          * continuing a bgscan; because it
 1600                                          * tricks the contbgscan()
 1601                                          * routine to think there's always
 1602                                          * traffic for us.
 1603                                          *
 1604                                          * I think we need both an RX and
 1605                                          * TX ic_lastdata field.
 1606                                          */
 1607                                         ic->ic_lastdata = ticks;
 1608                                 }
 1609 
 1610                                 ni->ni_dtim_count = tim->tim_count;
 1611                                 ni->ni_dtim_period = tim->tim_period;
 1612                         }
 1613                         if (scan.csa != NULL &&
 1614                             (vap->iv_flags & IEEE80211_F_DOTH))
 1615                                 ieee80211_parse_csaparams(vap, scan.csa, wh);
 1616                         else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
 1617                                 /*
 1618                                  * No CSA ie or 11h disabled, but a channel
 1619                                  * switch is pending; drop out so we aren't
 1620                                  * stuck in CSA state.  If the AP really is
 1621                                  * moving we'll get a beacon miss and scan.
 1622                                  */
 1623                                 IEEE80211_LOCK(ic);
 1624                                 ieee80211_csa_cancelswitch(ic);
 1625                                 IEEE80211_UNLOCK(ic);
 1626                         }
 1627                         /*
 1628                          * If scanning, pass the info to the scan module.
 1629                          * Otherwise, check if it's the right time to do
 1630                          * a background scan.  Background scanning must
 1631                          * be enabled and we must not be operating in the
 1632                          * turbo phase of dynamic turbo mode.  Then,
 1633                          * it's been a while since the last background
 1634                          * scan and if no data frames have come through
 1635                          * recently, kick off a scan.  Note that this
 1636                          * is the mechanism by which a background scan
 1637                          * is started _and_ continued each time we
 1638                          * return on-channel to receive a beacon from
 1639                          * our ap.
 1640                          */
 1641                         if (ic->ic_flags & IEEE80211_F_SCAN) {
 1642                                 ieee80211_add_scan(vap, rxchan,
 1643                                     &scan, wh, subtype, rssi, nf);
 1644                         } else if (contbgscan(vap)) {
 1645                                 ieee80211_bg_scan(vap, 0);
 1646                         } else if (startbgscan(vap)) {
 1647                                 vap->iv_stats.is_scan_bg++;
 1648 #if 0
 1649                                 /* wakeup if we are sleeing */
 1650                                 ieee80211_set_pwrsave(vap, 0);
 1651 #endif
 1652                                 ieee80211_bg_scan(vap, 0);
 1653                         }
 1654 
 1655                         /*
 1656                          * Put the station to sleep if we haven't seen
 1657                          * traffic in a while.
 1658                          */
 1659                         IEEE80211_LOCK(ic);
 1660                         ieee80211_sta_ps_timer_check(vap);
 1661                         IEEE80211_UNLOCK(ic);
 1662 
 1663                         /*
 1664                          * If we've had a channel width change (eg HT20<->HT40)
 1665                          * then schedule a delayed driver notification.
 1666                          */
 1667                         if (ht_state_change)
 1668                                 ieee80211_update_chw(ic);
 1669                         return;
 1670                 }
 1671                 /*
 1672                  * If scanning, just pass information to the scan module.
 1673                  */
 1674                 if (ic->ic_flags & IEEE80211_F_SCAN) {
 1675                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
 1676                                 /*
 1677                                  * Actively scanning a channel marked passive;
 1678                                  * send a probe request now that we know there
 1679                                  * is 802.11 traffic present.
 1680                                  *
 1681                                  * XXX check if the beacon we recv'd gives
 1682                                  * us what we need and suppress the probe req
 1683                                  */
 1684                                 ieee80211_probe_curchan(vap, 1);
 1685                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 1686                         }
 1687                         ieee80211_add_scan(vap, rxchan, &scan, wh,
 1688                             subtype, rssi, nf);
 1689                         return;
 1690                 }
 1691                 break;
 1692         }
 1693 
 1694         case IEEE80211_FC0_SUBTYPE_AUTH: {
 1695                 uint16_t algo, seq, status;
 1696                 /*
 1697                  * auth frame format
 1698                  *      [2] algorithm
 1699                  *      [2] sequence
 1700                  *      [2] status
 1701                  *      [tlv*] challenge
 1702                  */
 1703                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
 1704                 algo   = le16toh(*(uint16_t *)frm);
 1705                 seq    = le16toh(*(uint16_t *)(frm + 2));
 1706                 status = le16toh(*(uint16_t *)(frm + 4));
 1707                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
 1708                     "recv auth frame with algorithm %d seq %d", algo, seq);
 1709 
 1710                 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
 1711                         IEEE80211_DISCARD(vap,
 1712                             IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
 1713                             wh, "auth", "%s", "TKIP countermeasures enabled");
 1714                         vap->iv_stats.is_rx_auth_countermeasures++;
 1715                         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
 1716                                 ieee80211_send_error(ni, wh->i_addr2,
 1717                                         IEEE80211_FC0_SUBTYPE_AUTH,
 1718                                         IEEE80211_REASON_MIC_FAILURE);
 1719                         }
 1720                         return;
 1721                 }
 1722                 if (algo == IEEE80211_AUTH_ALG_SHARED)
 1723                         sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
 1724                             seq, status);
 1725                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
 1726                         sta_auth_open(ni, wh, rssi, nf, seq, status);
 1727                 else {
 1728                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 1729                             wh, "auth", "unsupported alg %d", algo);
 1730                         vap->iv_stats.is_rx_auth_unsupported++;
 1731                         return;
 1732                 } 
 1733                 break;
 1734         }
 1735 
 1736         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
 1737         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
 1738                 uint16_t capinfo, associd;
 1739                 uint16_t status;
 1740 
 1741                 if (vap->iv_state != IEEE80211_S_ASSOC) {
 1742                         vap->iv_stats.is_rx_mgtdiscard++;
 1743                         return;
 1744                 }
 1745 
 1746                 /*
 1747                  * asresp frame format
 1748                  *      [2] capability information
 1749                  *      [2] status
 1750                  *      [2] association ID
 1751                  *      [tlv] supported rates
 1752                  *      [tlv] extended supported rates
 1753                  *      [tlv] WME
 1754                  *      [tlv] HT capabilities
 1755                  *      [tlv] HT info
 1756                  */
 1757                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
 1758                 ni = vap->iv_bss;
 1759                 capinfo = le16toh(*(uint16_t *)frm);
 1760                 frm += 2;
 1761                 status = le16toh(*(uint16_t *)frm);
 1762                 frm += 2;
 1763                 if (status != 0) {
 1764                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1765                             wh->i_addr2, "%sassoc failed (reason %d)",
 1766                             ISREASSOC(subtype) ?  "re" : "", status);
 1767                         vap->iv_stats.is_rx_auth_fail++;        /* XXX */
 1768                         return;
 1769                 }
 1770                 associd = le16toh(*(uint16_t *)frm);
 1771                 frm += 2;
 1772 
 1773                 rates = xrates = wme = htcap = htinfo = NULL;
 1774                 vhtcap = vhtopmode = NULL;
 1775                 while (efrm - frm > 1) {
 1776                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 1777                         switch (*frm) {
 1778                         case IEEE80211_ELEMID_RATES:
 1779                                 rates = frm;
 1780                                 break;
 1781                         case IEEE80211_ELEMID_XRATES:
 1782                                 xrates = frm;
 1783                                 break;
 1784                         case IEEE80211_ELEMID_HTCAP:
 1785                                 htcap = frm;
 1786                                 break;
 1787                         case IEEE80211_ELEMID_HTINFO:
 1788                                 htinfo = frm;
 1789                                 break;
 1790                         case IEEE80211_ELEMID_VENDOR:
 1791                                 if (iswmeoui(frm))
 1792                                         wme = frm;
 1793                                 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
 1794                                         /*
 1795                                          * Accept pre-draft HT ie's if the
 1796                                          * standard ones have not been seen.
 1797                                          */
 1798                                         if (ishtcapoui(frm)) {
 1799                                                 if (htcap == NULL)
 1800                                                         htcap = frm;
 1801                                         } else if (ishtinfooui(frm)) {
 1802                                                 if (htinfo == NULL)
 1803                                                         htinfo = frm;
 1804                                         }
 1805                                 }
 1806                                 /* XXX Atheros OUI support */
 1807                                 break;
 1808                         case IEEE80211_ELEMID_VHT_CAP:
 1809                                 vhtcap = frm;
 1810                                 break;
 1811                         case IEEE80211_ELEMID_VHT_OPMODE:
 1812                                 vhtopmode = frm;
 1813                                 break;
 1814                         }
 1815                         frm += frm[1] + 2;
 1816                 }
 1817 
 1818                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
 1819                 if (xrates != NULL)
 1820                         IEEE80211_VERIFY_ELEMENT(xrates,
 1821                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
 1822                 rate = ieee80211_setup_rates(ni, rates, xrates,
 1823                                 IEEE80211_F_JOIN |
 1824                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
 1825                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
 1826                 if (rate & IEEE80211_RATE_BASIC) {
 1827                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1828                             wh->i_addr2,
 1829                             "%sassoc failed (rate set mismatch)",
 1830                             ISREASSOC(subtype) ?  "re" : "");
 1831                         vap->iv_stats.is_rx_assoc_norate++;
 1832                         ieee80211_new_state(vap, IEEE80211_S_SCAN,
 1833                             IEEE80211_SCAN_FAIL_STATUS);
 1834                         return;
 1835                 }
 1836 
 1837                 ni->ni_capinfo = capinfo;
 1838                 ni->ni_associd = associd;
 1839                 if (ni->ni_jointime == 0)
 1840                         ni->ni_jointime = time_uptime;
 1841                 if (wme != NULL &&
 1842                     ieee80211_parse_wmeparams(vap, wme, wh, &qosinfo) >= 0) {
 1843                         ni->ni_flags |= IEEE80211_NODE_QOS;
 1844                         ieee80211_wme_updateparams(vap);
 1845                 } else
 1846                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
 1847                 /*
 1848                  * Setup HT state according to the negotiation.
 1849                  *
 1850                  * NB: shouldn't need to check if HT use is enabled but some
 1851                  *     ap's send back HT ie's even when we don't indicate we
 1852                  *     are HT capable in our AssocReq.
 1853                  */
 1854                 if (htcap != NULL && htinfo != NULL &&
 1855                     (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
 1856                         ieee80211_ht_node_init(ni);
 1857                         ieee80211_ht_updateparams(ni, htcap, htinfo);
 1858 
 1859                         if ((vhtcap != NULL) && (vhtopmode != NULL) &
 1860                             (vap->iv_flags_vht & IEEE80211_FVHT_VHT)) {
 1861                                 /*
 1862                                  * Log if we get a VHT assoc/reassoc response.
 1863                                  * We aren't ready for 2GHz VHT support.
 1864                                  */
 1865                                 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
 1866                                         printf("%s: peer %6D: VHT on 2GHz, ignoring\n",
 1867                                             __func__,
 1868                                             ni->ni_macaddr,
 1869                                             ":");
 1870                                 } else {
 1871                                         ieee80211_vht_node_init(ni);
 1872                                         ieee80211_vht_updateparams(ni, vhtcap, vhtopmode);
 1873                                         ieee80211_setup_vht_rates(ni, vhtcap, vhtopmode);
 1874                                 }
 1875                         }
 1876 
 1877                         ieee80211_ht_updateparams_final(ni, htcap, htinfo);
 1878                         ieee80211_setup_htrates(ni, htcap,
 1879                              IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
 1880                         ieee80211_setup_basic_htrates(ni, htinfo);
 1881 
 1882                         ieee80211_node_setuptxparms(ni);
 1883                         ieee80211_ratectl_node_init(ni);
 1884                 }
 1885 
 1886                 /*
 1887                  * Always initialise FF/superg state; we can use this
 1888                  * for doing A-MSDU encapsulation as well.
 1889                  */
 1890 #ifdef  IEEE80211_SUPPORT_SUPERG
 1891                 ieee80211_ff_node_init(ni);
 1892 #endif
 1893 
 1894                 /*
 1895                  * Configure state now that we are associated.
 1896                  *
 1897                  * XXX may need different/additional driver callbacks?
 1898                  */
 1899                 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
 1900                     (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
 1901                         vap->iv_flags |= IEEE80211_F_SHPREAMBLE;
 1902                         vap->iv_flags &= ~IEEE80211_F_USEBARKER;
 1903                 } else {
 1904                         vap->iv_flags &= ~IEEE80211_F_SHPREAMBLE;
 1905                         vap->iv_flags |= IEEE80211_F_USEBARKER;
 1906                 }
 1907                 ieee80211_vap_set_shortslottime(vap,
 1908                         IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
 1909                         (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
 1910                 ieee80211_vap_update_preamble(vap);
 1911                 /*
 1912                  * Honor ERP protection.
 1913                  *
 1914                  * NB: ni_erp should zero for non-11g operation.
 1915                  */
 1916                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
 1917                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
 1918                         vap->iv_flags |= IEEE80211_F_USEPROT;
 1919                 else
 1920                         vap->iv_flags &= ~IEEE80211_F_USEPROT;
 1921                 ieee80211_vap_update_erp_protmode(vap);
 1922                 IEEE80211_NOTE_MAC(vap,
 1923                     IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
 1924                     "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s%s",
 1925                     ISREASSOC(subtype) ? "re" : "",
 1926                     IEEE80211_NODE_AID(ni),
 1927                     vap->iv_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
 1928                     vap->iv_flags&IEEE80211_F_SHSLOT ? "short" : "long",
 1929                     vap->iv_flags&IEEE80211_F_USEPROT ? ", protection" : "",
 1930                     ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
 1931                     ni->ni_flags & IEEE80211_NODE_HT ?
 1932                         (ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
 1933                     ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
 1934                     ni->ni_flags & IEEE80211_NODE_AMSDU ? " (+AMSDU)" : "",
 1935                     ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
 1936                         ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
 1937                     ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
 1938                     IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
 1939                         ", fast-frames" : "",
 1940                     IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
 1941                         ", turbo" : ""
 1942                 );
 1943                 ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
 1944                 break;
 1945         }
 1946 
 1947         case IEEE80211_FC0_SUBTYPE_DEAUTH: {
 1948                 uint16_t reason;
 1949 
 1950                 if (vap->iv_state == IEEE80211_S_SCAN) {
 1951                         vap->iv_stats.is_rx_mgtdiscard++;
 1952                         return;
 1953                 }
 1954                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
 1955                         /* NB: can happen when in promiscuous mode */
 1956                         vap->iv_stats.is_rx_mgtdiscard++;
 1957                         break;
 1958                 }
 1959 
 1960                 /*
 1961                  * deauth frame format
 1962                  *      [2] reason
 1963                  */
 1964                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
 1965                 reason = le16toh(*(uint16_t *)frm);
 1966 
 1967                 vap->iv_stats.is_rx_deauth++;
 1968                 vap->iv_stats.is_rx_deauth_code = reason;
 1969                 IEEE80211_NODE_STAT(ni, rx_deauth);
 1970 
 1971                 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
 1972                     "recv deauthenticate (reason: %d (%s))", reason,
 1973                     ieee80211_reason_to_string(reason));
 1974                 ieee80211_new_state(vap, IEEE80211_S_AUTH,
 1975                     (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
 1976                 break;
 1977         }
 1978 
 1979         case IEEE80211_FC0_SUBTYPE_DISASSOC: {
 1980                 uint16_t reason;
 1981 
 1982                 if (vap->iv_state != IEEE80211_S_RUN &&
 1983                     vap->iv_state != IEEE80211_S_ASSOC &&
 1984                     vap->iv_state != IEEE80211_S_AUTH) {
 1985                         vap->iv_stats.is_rx_mgtdiscard++;
 1986                         return;
 1987                 }
 1988                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
 1989                         /* NB: can happen when in promiscuous mode */
 1990                         vap->iv_stats.is_rx_mgtdiscard++;
 1991                         break;
 1992                 }
 1993 
 1994                 /*
 1995                  * disassoc frame format
 1996                  *      [2] reason
 1997                  */
 1998                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
 1999                 reason = le16toh(*(uint16_t *)frm);
 2000 
 2001                 vap->iv_stats.is_rx_disassoc++;
 2002                 vap->iv_stats.is_rx_disassoc_code = reason;
 2003                 IEEE80211_NODE_STAT(ni, rx_disassoc);
 2004 
 2005                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
 2006                     "recv disassociate (reason: %d (%s))", reason,
 2007                     ieee80211_reason_to_string(reason));
 2008                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
 2009                 break;
 2010         }
 2011 
 2012         case IEEE80211_FC0_SUBTYPE_ACTION:
 2013         case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
 2014                 if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
 2015                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 2016                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 2017                             wh, NULL, "%s", "not for us");
 2018                         vap->iv_stats.is_rx_mgtdiscard++;
 2019                 } else if (vap->iv_state != IEEE80211_S_RUN) {
 2020                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 2021                             wh, NULL, "wrong state %s",
 2022                             ieee80211_state_name[vap->iv_state]);
 2023                         vap->iv_stats.is_rx_mgtdiscard++;
 2024                 } else {
 2025                         if (ieee80211_parse_action(ni, m0) == 0)
 2026                                 (void)ic->ic_recv_action(ni, wh, frm, efrm);
 2027                 }
 2028                 break;
 2029 
 2030         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
 2031         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
 2032         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 2033         case IEEE80211_FC0_SUBTYPE_TIMING_ADV:
 2034         case IEEE80211_FC0_SUBTYPE_ATIM:
 2035                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 2036                     wh, NULL, "%s", "not handled");
 2037                 vap->iv_stats.is_rx_mgtdiscard++;
 2038                 break;
 2039 
 2040         default:
 2041                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 2042                     wh, "mgt", "subtype 0x%x not handled", subtype);
 2043                 vap->iv_stats.is_rx_badsubtype++;
 2044                 break;
 2045         }
 2046 #undef ISREASSOC
 2047 }
 2048 
 2049 static void
 2050 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
 2051 {
 2052         switch (subtype) {
 2053         case IEEE80211_FC0_SUBTYPE_BAR:
 2054                 ieee80211_recv_bar(ni, m);
 2055                 break;
 2056         }
 2057 }

Cache object: cb7d3f962b134ab1ee4af1fe2a178bab


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.