Home | History | Annotate | Line # | Download | only in net80211
ieee80211_node.c revision 1.32.2.10
      1  1.32.2.10  christos /*	$NetBSD: ieee80211_node.c,v 1.32.2.10 2005/12/11 10:29:22 christos Exp $	*/
      2   1.32.2.2     skrll /*-
      3   1.32.2.2     skrll  * Copyright (c) 2001 Atsushi Onoe
      4   1.32.2.9     skrll  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
      5   1.32.2.2     skrll  * All rights reserved.
      6   1.32.2.2     skrll  *
      7   1.32.2.2     skrll  * Redistribution and use in source and binary forms, with or without
      8   1.32.2.2     skrll  * modification, are permitted provided that the following conditions
      9   1.32.2.2     skrll  * are met:
     10   1.32.2.2     skrll  * 1. Redistributions of source code must retain the above copyright
     11   1.32.2.2     skrll  *    notice, this list of conditions and the following disclaimer.
     12   1.32.2.2     skrll  * 2. Redistributions in binary form must reproduce the above copyright
     13   1.32.2.2     skrll  *    notice, this list of conditions and the following disclaimer in the
     14   1.32.2.2     skrll  *    documentation and/or other materials provided with the distribution.
     15   1.32.2.2     skrll  * 3. The name of the author may not be used to endorse or promote products
     16   1.32.2.2     skrll  *    derived from this software without specific prior written permission.
     17   1.32.2.2     skrll  *
     18   1.32.2.2     skrll  * Alternatively, this software may be distributed under the terms of the
     19   1.32.2.2     skrll  * GNU General Public License ("GPL") version 2 as published by the Free
     20   1.32.2.2     skrll  * Software Foundation.
     21   1.32.2.2     skrll  *
     22   1.32.2.2     skrll  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     23   1.32.2.2     skrll  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     24   1.32.2.2     skrll  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     25   1.32.2.2     skrll  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     26   1.32.2.2     skrll  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     27   1.32.2.2     skrll  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     28   1.32.2.2     skrll  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     29   1.32.2.2     skrll  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     30   1.32.2.2     skrll  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     31   1.32.2.2     skrll  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     32   1.32.2.2     skrll  */
     33   1.32.2.2     skrll 
     34   1.32.2.2     skrll #include <sys/cdefs.h>
     35   1.32.2.2     skrll #ifdef __FreeBSD__
     36  1.32.2.10  christos __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_node.c,v 1.65 2005/08/13 17:50:21 sam Exp $");
     37   1.32.2.9     skrll #endif
     38   1.32.2.9     skrll #ifdef __NetBSD__
     39  1.32.2.10  christos __KERNEL_RCSID(0, "$NetBSD: ieee80211_node.c,v 1.32.2.10 2005/12/11 10:29:22 christos Exp $");
     40   1.32.2.2     skrll #endif
     41   1.32.2.2     skrll 
     42   1.32.2.2     skrll #include "opt_inet.h"
     43   1.32.2.2     skrll 
     44   1.32.2.2     skrll #include <sys/param.h>
     45   1.32.2.9     skrll #include <sys/systm.h>
     46   1.32.2.9     skrll #include <sys/mbuf.h>
     47   1.32.2.2     skrll #include <sys/malloc.h>
     48   1.32.2.2     skrll #include <sys/kernel.h>
     49   1.32.2.9     skrll 
     50   1.32.2.2     skrll #include <sys/socket.h>
     51   1.32.2.2     skrll #include <sys/sockio.h>
     52   1.32.2.2     skrll #include <sys/endian.h>
     53   1.32.2.2     skrll #include <sys/errno.h>
     54   1.32.2.2     skrll #include <sys/proc.h>
     55   1.32.2.2     skrll #include <sys/sysctl.h>
     56   1.32.2.2     skrll 
     57   1.32.2.2     skrll #include <net/if.h>
     58   1.32.2.2     skrll #include <net/if_media.h>
     59   1.32.2.2     skrll #include <net/if_arp.h>
     60   1.32.2.2     skrll #include <net/if_ether.h>
     61   1.32.2.2     skrll #include <net/if_llc.h>
     62   1.32.2.2     skrll 
     63   1.32.2.9     skrll #include <net80211/ieee80211_netbsd.h>
     64   1.32.2.2     skrll #include <net80211/ieee80211_var.h>
     65   1.32.2.2     skrll 
     66   1.32.2.2     skrll #include <net/bpf.h>
     67   1.32.2.2     skrll 
     68   1.32.2.2     skrll #ifdef INET
     69   1.32.2.9     skrll #include <netinet/in.h>
     70   1.32.2.2     skrll #include <net/if_ether.h>
     71   1.32.2.2     skrll #endif
     72   1.32.2.2     skrll 
     73   1.32.2.9     skrll /*
     74   1.32.2.9     skrll  * Association id's are managed with a bit vector.
     75   1.32.2.9     skrll  */
     76   1.32.2.9     skrll #define	IEEE80211_AID_SET(b, w) \
     77   1.32.2.9     skrll 	((w)[IEEE80211_AID(b) / 32] |= (1 << (IEEE80211_AID(b) % 32)))
     78   1.32.2.9     skrll #define	IEEE80211_AID_CLR(b, w) \
     79   1.32.2.9     skrll 	((w)[IEEE80211_AID(b) / 32] &= ~(1 << (IEEE80211_AID(b) % 32)))
     80   1.32.2.9     skrll #define	IEEE80211_AID_ISSET(b, w) \
     81   1.32.2.9     skrll 	((w)[IEEE80211_AID(b) / 32] & (1 << (IEEE80211_AID(b) % 32)))
     82   1.32.2.9     skrll 
     83   1.32.2.9     skrll static struct ieee80211_node *node_alloc(struct ieee80211_node_table *);
     84   1.32.2.9     skrll static void node_cleanup(struct ieee80211_node *);
     85   1.32.2.9     skrll static void node_free(struct ieee80211_node *);
     86   1.32.2.9     skrll static u_int8_t node_getrssi(const struct ieee80211_node *);
     87   1.32.2.9     skrll 
     88   1.32.2.9     skrll static void ieee80211_setup_node(struct ieee80211_node_table *,
     89   1.32.2.9     skrll 		struct ieee80211_node *, const u_int8_t *);
     90   1.32.2.9     skrll static void _ieee80211_free_node(struct ieee80211_node *);
     91   1.32.2.9     skrll static void ieee80211_free_allnodes(struct ieee80211_node_table *);
     92   1.32.2.9     skrll 
     93   1.32.2.9     skrll static void ieee80211_timeout_scan_candidates(struct ieee80211_node_table *);
     94   1.32.2.9     skrll static void ieee80211_timeout_stations(struct ieee80211_node_table *);
     95   1.32.2.9     skrll 
     96  1.32.2.10  christos static void ieee80211_set_tim(struct ieee80211_node *, int set);
     97   1.32.2.9     skrll 
     98   1.32.2.9     skrll static void ieee80211_node_table_init(struct ieee80211com *ic,
     99  1.32.2.10  christos 	struct ieee80211_node_table *nt, const char *name,
    100  1.32.2.10  christos 	int inact, int keyixmax,
    101   1.32.2.9     skrll 	void (*timeout)(struct ieee80211_node_table *));
    102   1.32.2.9     skrll static void ieee80211_node_table_cleanup(struct ieee80211_node_table *nt);
    103   1.32.2.2     skrll 
    104   1.32.2.2     skrll MALLOC_DEFINE(M_80211_NODE, "80211node", "802.11 node state");
    105   1.32.2.2     skrll 
    106   1.32.2.2     skrll void
    107   1.32.2.2     skrll ieee80211_node_attach(struct ieee80211com *ic)
    108   1.32.2.2     skrll {
    109   1.32.2.2     skrll 
    110   1.32.2.9     skrll 	ic->ic_node_alloc = node_alloc;
    111   1.32.2.9     skrll 	ic->ic_node_free = node_free;
    112   1.32.2.9     skrll 	ic->ic_node_cleanup = node_cleanup;
    113   1.32.2.9     skrll 	ic->ic_node_getrssi = node_getrssi;
    114   1.32.2.9     skrll 
    115   1.32.2.9     skrll 	/* default station inactivity timer setings */
    116   1.32.2.9     skrll 	ic->ic_inact_init = IEEE80211_INACT_INIT;
    117   1.32.2.9     skrll 	ic->ic_inact_auth = IEEE80211_INACT_AUTH;
    118   1.32.2.9     skrll 	ic->ic_inact_run = IEEE80211_INACT_RUN;
    119   1.32.2.9     skrll 	ic->ic_inact_probe = IEEE80211_INACT_PROBE;
    120   1.32.2.2     skrll 
    121  1.32.2.10  christos 	/* NB: driver should override */
    122  1.32.2.10  christos 	ic->ic_max_aid = IEEE80211_AID_DEF;
    123  1.32.2.10  christos 	ic->ic_set_tim = ieee80211_set_tim;
    124  1.32.2.10  christos }
    125  1.32.2.10  christos 
    126  1.32.2.10  christos void
    127  1.32.2.10  christos ieee80211_node_lateattach(struct ieee80211com *ic)
    128  1.32.2.10  christos {
    129  1.32.2.10  christos 	struct ieee80211_rsnparms *rsn;
    130  1.32.2.10  christos 
    131  1.32.2.10  christos 	if (ic->ic_max_aid > IEEE80211_AID_MAX)
    132   1.32.2.2     skrll 		ic->ic_max_aid = IEEE80211_AID_MAX;
    133   1.32.2.2     skrll 	MALLOC(ic->ic_aid_bitmap, u_int32_t *,
    134   1.32.2.2     skrll 		howmany(ic->ic_max_aid, 32) * sizeof(u_int32_t),
    135   1.32.2.2     skrll 		M_DEVBUF, M_NOWAIT | M_ZERO);
    136   1.32.2.2     skrll 	if (ic->ic_aid_bitmap == NULL) {
    137   1.32.2.2     skrll 		/* XXX no way to recover */
    138   1.32.2.2     skrll 		printf("%s: no memory for AID bitmap!\n", __func__);
    139   1.32.2.2     skrll 		ic->ic_max_aid = 0;
    140   1.32.2.2     skrll 	}
    141   1.32.2.2     skrll 
    142   1.32.2.9     skrll 	/* XXX defer until using hostap/ibss mode */
    143   1.32.2.9     skrll 	ic->ic_tim_len = howmany(ic->ic_max_aid, 8) * sizeof(u_int8_t);
    144   1.32.2.9     skrll 	MALLOC(ic->ic_tim_bitmap, u_int8_t *, ic->ic_tim_len,
    145   1.32.2.9     skrll 		M_DEVBUF, M_NOWAIT | M_ZERO);
    146   1.32.2.9     skrll 	if (ic->ic_tim_bitmap == NULL) {
    147   1.32.2.9     skrll 		/* XXX no way to recover */
    148   1.32.2.9     skrll 		printf("%s: no memory for TIM bitmap!\n", __func__);
    149   1.32.2.9     skrll 	}
    150   1.32.2.3     skrll 
    151  1.32.2.10  christos 	ieee80211_node_table_init(ic, &ic->ic_sta, "station",
    152  1.32.2.10  christos 		IEEE80211_INACT_INIT, ic->ic_crypto.cs_max_keyix,
    153  1.32.2.10  christos 		ieee80211_timeout_stations);
    154  1.32.2.10  christos 	ieee80211_node_table_init(ic, &ic->ic_scan, "scan",
    155  1.32.2.10  christos 		IEEE80211_INACT_SCAN, 0,
    156  1.32.2.10  christos 		ieee80211_timeout_scan_candidates);
    157   1.32.2.2     skrll 
    158  1.32.2.10  christos 	ieee80211_reset_bss(ic);
    159   1.32.2.9     skrll 	/*
    160   1.32.2.9     skrll 	 * Setup "global settings" in the bss node so that
    161   1.32.2.9     skrll 	 * each new station automatically inherits them.
    162   1.32.2.9     skrll 	 */
    163  1.32.2.10  christos 	rsn = &ic->ic_bss->ni_rsn;
    164   1.32.2.9     skrll 	/* WEP, TKIP, and AES-CCM are always supported */
    165   1.32.2.9     skrll 	rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_WEP;
    166   1.32.2.9     skrll 	rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_TKIP;
    167   1.32.2.9     skrll 	rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_AES_CCM;
    168   1.32.2.9     skrll 	if (ic->ic_caps & IEEE80211_C_AES)
    169   1.32.2.9     skrll 		rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_AES_OCB;
    170   1.32.2.9     skrll 	if (ic->ic_caps & IEEE80211_C_CKIP)
    171   1.32.2.9     skrll 		rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_CKIP;
    172   1.32.2.9     skrll 	/*
    173   1.32.2.9     skrll 	 * Default unicast cipher to WEP for 802.1x use.  If
    174   1.32.2.9     skrll 	 * WPA is enabled the management code will set these
    175   1.32.2.9     skrll 	 * values to reflect.
    176   1.32.2.9     skrll 	 */
    177   1.32.2.9     skrll 	rsn->rsn_ucastcipher = IEEE80211_CIPHER_WEP;
    178   1.32.2.9     skrll 	rsn->rsn_ucastkeylen = 104 / NBBY;
    179   1.32.2.9     skrll 	/*
    180   1.32.2.9     skrll 	 * WPA says the multicast cipher is the lowest unicast
    181   1.32.2.9     skrll 	 * cipher supported.  But we skip WEP which would
    182   1.32.2.9     skrll 	 * otherwise be used based on this criteria.
    183   1.32.2.9     skrll 	 */
    184   1.32.2.9     skrll 	rsn->rsn_mcastcipher = IEEE80211_CIPHER_TKIP;
    185   1.32.2.9     skrll 	rsn->rsn_mcastkeylen = 128 / NBBY;
    186   1.32.2.9     skrll 
    187   1.32.2.9     skrll 	/*
    188   1.32.2.9     skrll 	 * We support both WPA-PSK and 802.1x; the one used
    189   1.32.2.9     skrll 	 * is determined by the authentication mode and the
    190   1.32.2.9     skrll 	 * setting of the PSK state.
    191   1.32.2.9     skrll 	 */
    192   1.32.2.9     skrll 	rsn->rsn_keymgmtset = WPA_ASE_8021X_UNSPEC | WPA_ASE_8021X_PSK;
    193   1.32.2.9     skrll 	rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
    194   1.32.2.9     skrll 
    195  1.32.2.10  christos 	ic->ic_auth = ieee80211_authenticator_get(ic->ic_bss->ni_authmode);
    196   1.32.2.2     skrll }
    197   1.32.2.2     skrll 
    198   1.32.2.2     skrll void
    199   1.32.2.2     skrll ieee80211_node_detach(struct ieee80211com *ic)
    200   1.32.2.2     skrll {
    201   1.32.2.2     skrll 
    202   1.32.2.2     skrll 	if (ic->ic_bss != NULL) {
    203   1.32.2.9     skrll 		ieee80211_free_node(ic->ic_bss);
    204   1.32.2.2     skrll 		ic->ic_bss = NULL;
    205   1.32.2.2     skrll 	}
    206   1.32.2.9     skrll 	ieee80211_node_table_cleanup(&ic->ic_scan);
    207   1.32.2.9     skrll 	ieee80211_node_table_cleanup(&ic->ic_sta);
    208   1.32.2.9     skrll 	if (ic->ic_aid_bitmap != NULL) {
    209   1.32.2.9     skrll 		FREE(ic->ic_aid_bitmap, M_DEVBUF);
    210   1.32.2.9     skrll 		ic->ic_aid_bitmap = NULL;
    211   1.32.2.9     skrll 	}
    212   1.32.2.9     skrll 	if (ic->ic_tim_bitmap != NULL) {
    213   1.32.2.9     skrll 		FREE(ic->ic_tim_bitmap, M_DEVBUF);
    214   1.32.2.9     skrll 		ic->ic_tim_bitmap = NULL;
    215   1.32.2.9     skrll 	}
    216   1.32.2.9     skrll }
    217   1.32.2.9     skrll 
    218   1.32.2.9     skrll /*
    219   1.32.2.9     skrll  * Port authorize/unauthorize interfaces for use by an authenticator.
    220   1.32.2.9     skrll  */
    221   1.32.2.9     skrll 
    222   1.32.2.9     skrll void
    223  1.32.2.10  christos ieee80211_node_authorize(struct ieee80211_node *ni)
    224   1.32.2.9     skrll {
    225  1.32.2.10  christos 	struct ieee80211com *ic = ni->ni_ic;
    226  1.32.2.10  christos 
    227   1.32.2.9     skrll 	ni->ni_flags |= IEEE80211_NODE_AUTH;
    228   1.32.2.9     skrll 	ni->ni_inact_reload = ic->ic_inact_run;
    229   1.32.2.9     skrll }
    230   1.32.2.9     skrll 
    231   1.32.2.9     skrll void
    232  1.32.2.10  christos ieee80211_node_unauthorize(struct ieee80211_node *ni)
    233   1.32.2.9     skrll {
    234   1.32.2.9     skrll 	ni->ni_flags &= ~IEEE80211_NODE_AUTH;
    235   1.32.2.9     skrll }
    236   1.32.2.9     skrll 
    237   1.32.2.9     skrll /*
    238   1.32.2.9     skrll  * Set/change the channel.  The rate set is also updated as
    239   1.32.2.9     skrll  * to insure a consistent view by drivers.
    240   1.32.2.9     skrll  */
    241   1.32.2.9     skrll static __inline void
    242   1.32.2.9     skrll ieee80211_set_chan(struct ieee80211com *ic,
    243   1.32.2.9     skrll 	struct ieee80211_node *ni, struct ieee80211_channel *chan)
    244   1.32.2.9     skrll {
    245   1.32.2.9     skrll 	ni->ni_chan = chan;
    246   1.32.2.9     skrll 	ni->ni_rates = ic->ic_sup_rates[ieee80211_chan2mode(ic, chan)];
    247   1.32.2.2     skrll }
    248   1.32.2.2     skrll 
    249   1.32.2.2     skrll /*
    250   1.32.2.2     skrll  * AP scanning support.
    251   1.32.2.2     skrll  */
    252   1.32.2.2     skrll 
    253   1.32.2.9     skrll #ifdef IEEE80211_DEBUG
    254   1.32.2.9     skrll static void
    255   1.32.2.9     skrll dump_chanlist(const u_char chans[])
    256   1.32.2.9     skrll {
    257   1.32.2.9     skrll 	const char *sep;
    258   1.32.2.9     skrll 	int i;
    259   1.32.2.9     skrll 
    260   1.32.2.9     skrll 	sep = " ";
    261   1.32.2.9     skrll 	for (i = 0; i < IEEE80211_CHAN_MAX; i++)
    262   1.32.2.9     skrll 		if (isset(chans, i)) {
    263   1.32.2.9     skrll 			printf("%s%u", sep, i);
    264   1.32.2.9     skrll 			sep = ", ";
    265   1.32.2.9     skrll 		}
    266   1.32.2.9     skrll }
    267   1.32.2.9     skrll #endif /* IEEE80211_DEBUG */
    268   1.32.2.9     skrll 
    269   1.32.2.2     skrll /*
    270   1.32.2.9     skrll  * Initialize the channel set to scan based on the
    271   1.32.2.2     skrll  * of available channels and the current PHY mode.
    272   1.32.2.2     skrll  */
    273   1.32.2.2     skrll static void
    274   1.32.2.2     skrll ieee80211_reset_scan(struct ieee80211com *ic)
    275   1.32.2.2     skrll {
    276   1.32.2.2     skrll 
    277   1.32.2.9     skrll 	/* XXX ic_des_chan should be handled with ic_chan_active */
    278   1.32.2.9     skrll 	if (ic->ic_des_chan != IEEE80211_CHAN_ANYC) {
    279   1.32.2.9     skrll 		memset(ic->ic_chan_scan, 0, sizeof(ic->ic_chan_scan));
    280   1.32.2.9     skrll 		setbit(ic->ic_chan_scan,
    281   1.32.2.9     skrll 			ieee80211_chan2ieee(ic, ic->ic_des_chan));
    282   1.32.2.9     skrll 	} else
    283   1.32.2.9     skrll 		memcpy(ic->ic_chan_scan, ic->ic_chan_active,
    284   1.32.2.9     skrll 			sizeof(ic->ic_chan_active));
    285   1.32.2.9     skrll #ifdef IEEE80211_DEBUG
    286   1.32.2.9     skrll 	if (ieee80211_msg_scan(ic)) {
    287   1.32.2.9     skrll 		printf("%s: scan set:", __func__);
    288   1.32.2.9     skrll 		dump_chanlist(ic->ic_chan_scan);
    289   1.32.2.9     skrll 		printf(" start chan %u\n",
    290  1.32.2.10  christos 			ieee80211_chan2ieee(ic, ic->ic_curchan));
    291   1.32.2.9     skrll 	}
    292   1.32.2.9     skrll #endif /* IEEE80211_DEBUG */
    293   1.32.2.2     skrll }
    294   1.32.2.2     skrll 
    295   1.32.2.2     skrll /*
    296   1.32.2.2     skrll  * Begin an active scan.
    297   1.32.2.2     skrll  */
    298   1.32.2.2     skrll void
    299   1.32.2.9     skrll ieee80211_begin_scan(struct ieee80211com *ic, int reset)
    300   1.32.2.2     skrll {
    301   1.32.2.2     skrll 
    302   1.32.2.9     skrll 	ic->ic_scan.nt_scangen++;
    303   1.32.2.2     skrll 	/*
    304   1.32.2.2     skrll 	 * In all but hostap mode scanning starts off in
    305   1.32.2.2     skrll 	 * an active mode before switching to passive.
    306   1.32.2.2     skrll 	 */
    307   1.32.2.2     skrll 	if (ic->ic_opmode != IEEE80211_M_HOSTAP) {
    308   1.32.2.2     skrll 		ic->ic_flags |= IEEE80211_F_ASCAN;
    309   1.32.2.2     skrll 		ic->ic_stats.is_scan_active++;
    310   1.32.2.2     skrll 	} else
    311   1.32.2.2     skrll 		ic->ic_stats.is_scan_passive++;
    312   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
    313   1.32.2.9     skrll 		"begin %s scan in %s mode, scangen %u\n",
    314   1.32.2.9     skrll 		(ic->ic_flags & IEEE80211_F_ASCAN) ?  "active" : "passive",
    315   1.32.2.9     skrll 		ieee80211_phymode_name[ic->ic_curmode], ic->ic_scan.nt_scangen);
    316   1.32.2.2     skrll 	/*
    317   1.32.2.9     skrll 	 * Clear scan state and flush any previously seen AP's.
    318   1.32.2.2     skrll 	 */
    319   1.32.2.2     skrll 	ieee80211_reset_scan(ic);
    320   1.32.2.9     skrll 	if (reset)
    321   1.32.2.9     skrll 		ieee80211_free_allnodes(&ic->ic_scan);
    322   1.32.2.9     skrll 
    323   1.32.2.9     skrll 	ic->ic_flags |= IEEE80211_F_SCAN;
    324   1.32.2.2     skrll 
    325   1.32.2.2     skrll 	/* Scan the next channel. */
    326   1.32.2.2     skrll 	ieee80211_next_scan(ic);
    327   1.32.2.2     skrll }
    328   1.32.2.2     skrll 
    329   1.32.2.2     skrll /*
    330   1.32.2.2     skrll  * Switch to the next channel marked for scanning.
    331   1.32.2.2     skrll  */
    332   1.32.2.9     skrll int
    333   1.32.2.2     skrll ieee80211_next_scan(struct ieee80211com *ic)
    334   1.32.2.2     skrll {
    335   1.32.2.2     skrll 	struct ieee80211_channel *chan;
    336   1.32.2.2     skrll 
    337   1.32.2.9     skrll 	/*
    338   1.32.2.9     skrll 	 * Insure any previous mgt frame timeouts don't fire.
    339   1.32.2.9     skrll 	 * This assumes the driver does the right thing in
    340   1.32.2.9     skrll 	 * flushing anything queued in the driver and below.
    341   1.32.2.9     skrll 	 */
    342   1.32.2.9     skrll 	ic->ic_mgt_timer = 0;
    343   1.32.2.9     skrll 
    344  1.32.2.10  christos 	chan = ic->ic_curchan;
    345   1.32.2.9     skrll 	do {
    346   1.32.2.2     skrll 		if (++chan > &ic->ic_channels[IEEE80211_CHAN_MAX])
    347   1.32.2.2     skrll 			chan = &ic->ic_channels[0];
    348   1.32.2.2     skrll 		if (isset(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan))) {
    349   1.32.2.9     skrll 			clrbit(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan));
    350   1.32.2.9     skrll 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
    351   1.32.2.9     skrll 			    "%s: chan %d->%d\n", __func__,
    352  1.32.2.10  christos 			    ieee80211_chan2ieee(ic, ic->ic_curchan),
    353   1.32.2.9     skrll 			    ieee80211_chan2ieee(ic, chan));
    354  1.32.2.10  christos 			ic->ic_curchan = chan;
    355   1.32.2.2     skrll 			/*
    356  1.32.2.10  christos 			 * XXX drivers should do this as needed,
    357  1.32.2.10  christos 			 * XXX for now maintain compatibility
    358   1.32.2.2     skrll 			 */
    359  1.32.2.10  christos 			ic->ic_bss->ni_rates =
    360  1.32.2.10  christos 				ic->ic_sup_rates[ieee80211_chan2mode(ic, chan)];
    361   1.32.2.9     skrll 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    362   1.32.2.9     skrll 			return 1;
    363   1.32.2.2     skrll 		}
    364  1.32.2.10  christos 	} while (chan != ic->ic_curchan);
    365   1.32.2.9     skrll 	ieee80211_end_scan(ic);
    366   1.32.2.9     skrll 	return 0;
    367   1.32.2.9     skrll }
    368   1.32.2.9     skrll 
    369   1.32.2.9     skrll static __inline void
    370   1.32.2.9     skrll copy_bss(struct ieee80211_node *nbss, const struct ieee80211_node *obss)
    371   1.32.2.9     skrll {
    372   1.32.2.9     skrll 	/* propagate useful state */
    373   1.32.2.9     skrll 	nbss->ni_authmode = obss->ni_authmode;
    374   1.32.2.9     skrll 	nbss->ni_txpower = obss->ni_txpower;
    375   1.32.2.9     skrll 	nbss->ni_vlan = obss->ni_vlan;
    376   1.32.2.9     skrll 	nbss->ni_rsn = obss->ni_rsn;
    377   1.32.2.9     skrll 	/* XXX statistics? */
    378   1.32.2.2     skrll }
    379   1.32.2.2     skrll 
    380   1.32.2.2     skrll void
    381   1.32.2.2     skrll ieee80211_create_ibss(struct ieee80211com* ic, struct ieee80211_channel *chan)
    382   1.32.2.2     skrll {
    383   1.32.2.9     skrll 	struct ieee80211_node_table *nt;
    384   1.32.2.2     skrll 	struct ieee80211_node *ni;
    385   1.32.2.2     skrll 
    386   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
    387   1.32.2.9     skrll 		"%s: creating ibss\n", __func__);
    388   1.32.2.9     skrll 
    389   1.32.2.9     skrll 	/*
    390   1.32.2.9     skrll 	 * Create the station/neighbor table.  Note that for adhoc
    391   1.32.2.9     skrll 	 * mode we make the initial inactivity timer longer since
    392   1.32.2.9     skrll 	 * we create nodes only through discovery and they typically
    393   1.32.2.9     skrll 	 * are long-lived associations.
    394   1.32.2.9     skrll 	 */
    395   1.32.2.9     skrll 	nt = &ic->ic_sta;
    396   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
    397   1.32.2.9     skrll 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
    398   1.32.2.9     skrll 		nt->nt_name = "station";
    399   1.32.2.9     skrll 		nt->nt_inact_init = ic->ic_inact_init;
    400   1.32.2.9     skrll 	} else {
    401   1.32.2.9     skrll 		nt->nt_name = "neighbor";
    402   1.32.2.9     skrll 		nt->nt_inact_init = ic->ic_inact_run;
    403   1.32.2.9     skrll 	}
    404   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
    405   1.32.2.9     skrll 
    406  1.32.2.10  christos 	ni = ieee80211_alloc_node(&ic->ic_sta, ic->ic_myaddr);
    407   1.32.2.9     skrll 	if (ni == NULL) {
    408   1.32.2.9     skrll 		/* XXX recovery? */
    409   1.32.2.9     skrll 		return;
    410   1.32.2.2     skrll 	}
    411   1.32.2.9     skrll 	IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_myaddr);
    412   1.32.2.2     skrll 	ni->ni_esslen = ic->ic_des_esslen;
    413   1.32.2.2     skrll 	memcpy(ni->ni_essid, ic->ic_des_essid, ni->ni_esslen);
    414   1.32.2.9     skrll 	copy_bss(ni, ic->ic_bss);
    415  1.32.2.10  christos 	ni->ni_intval = ic->ic_bintval;
    416   1.32.2.2     skrll 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
    417   1.32.2.2     skrll 		ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY;
    418   1.32.2.2     skrll 	if (ic->ic_phytype == IEEE80211_T_FH) {
    419   1.32.2.2     skrll 		ni->ni_fhdwell = 200;	/* XXX */
    420   1.32.2.2     skrll 		ni->ni_fhindex = 1;
    421   1.32.2.2     skrll 	}
    422   1.32.2.9     skrll 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
    423   1.32.2.9     skrll 		ic->ic_flags |= IEEE80211_F_SIBSS;
    424   1.32.2.9     skrll 		ni->ni_capinfo |= IEEE80211_CAPINFO_IBSS;	/* XXX */
    425   1.32.2.9     skrll 		if (ic->ic_flags & IEEE80211_F_DESBSSID)
    426   1.32.2.9     skrll 			IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_des_bssid);
    427   1.32.2.9     skrll 		else
    428   1.32.2.9     skrll 			ni->ni_bssid[0] |= 0x02;	/* local bit for IBSS */
    429   1.32.2.9     skrll 	}
    430   1.32.2.9     skrll 	/*
    431   1.32.2.9     skrll 	 * Fix the channel and related attributes.
    432   1.32.2.9     skrll 	 */
    433   1.32.2.9     skrll 	ieee80211_set_chan(ic, ni, chan);
    434  1.32.2.10  christos 	ic->ic_curchan = chan;
    435   1.32.2.9     skrll 	ic->ic_curmode = ieee80211_chan2mode(ic, chan);
    436   1.32.2.9     skrll 	/*
    437   1.32.2.9     skrll 	 * Do mode-specific rate setup.
    438   1.32.2.9     skrll 	 */
    439   1.32.2.9     skrll 	if (ic->ic_curmode == IEEE80211_MODE_11G) {
    440   1.32.2.9     skrll 		/*
    441   1.32.2.9     skrll 		 * Use a mixed 11b/11g rate set.
    442   1.32.2.9     skrll 		 */
    443   1.32.2.9     skrll 		ieee80211_set11gbasicrates(&ni->ni_rates, IEEE80211_MODE_11G);
    444   1.32.2.9     skrll 	} else if (ic->ic_curmode == IEEE80211_MODE_11B) {
    445   1.32.2.9     skrll 		/*
    446   1.32.2.9     skrll 		 * Force pure 11b rate set.
    447   1.32.2.9     skrll 		 */
    448   1.32.2.9     skrll 		ieee80211_set11gbasicrates(&ni->ni_rates, IEEE80211_MODE_11B);
    449   1.32.2.9     skrll 	}
    450   1.32.2.9     skrll 
    451   1.32.2.9     skrll 	(void) ieee80211_sta_join(ic, ieee80211_ref_node(ni));
    452   1.32.2.2     skrll }
    453   1.32.2.2     skrll 
    454   1.32.2.9     skrll void
    455   1.32.2.9     skrll ieee80211_reset_bss(struct ieee80211com *ic)
    456   1.32.2.9     skrll {
    457   1.32.2.9     skrll 	struct ieee80211_node *ni, *obss;
    458   1.32.2.9     skrll 
    459   1.32.2.9     skrll 	ieee80211_node_table_reset(&ic->ic_scan);
    460   1.32.2.9     skrll 	ieee80211_node_table_reset(&ic->ic_sta);
    461   1.32.2.9     skrll 
    462   1.32.2.9     skrll 	ni = ieee80211_alloc_node(&ic->ic_scan, ic->ic_myaddr);
    463   1.32.2.9     skrll 	IASSERT(ni != NULL, ("unable to setup inital BSS node"));
    464   1.32.2.9     skrll 	obss = ic->ic_bss;
    465   1.32.2.9     skrll 	ic->ic_bss = ieee80211_ref_node(ni);
    466   1.32.2.9     skrll 	if (obss != NULL) {
    467   1.32.2.9     skrll 		copy_bss(ni, obss);
    468  1.32.2.10  christos 		ni->ni_intval = ic->ic_bintval;
    469   1.32.2.9     skrll 		ieee80211_free_node(obss);
    470   1.32.2.9     skrll 	}
    471   1.32.2.9     skrll }
    472   1.32.2.9     skrll 
    473  1.32.2.10  christos /* XXX tunable */
    474  1.32.2.10  christos #define	STA_FAILS_MAX	2		/* assoc failures before ignored */
    475  1.32.2.10  christos 
    476   1.32.2.9     skrll static int
    477   1.32.2.2     skrll ieee80211_match_bss(struct ieee80211com *ic, struct ieee80211_node *ni)
    478   1.32.2.2     skrll {
    479   1.32.2.2     skrll         u_int8_t rate;
    480   1.32.2.2     skrll         int fail;
    481   1.32.2.2     skrll 
    482   1.32.2.2     skrll 	fail = 0;
    483   1.32.2.2     skrll 	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan)))
    484   1.32.2.2     skrll 		fail |= 0x01;
    485   1.32.2.2     skrll 	if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
    486   1.32.2.2     skrll 	    ni->ni_chan != ic->ic_des_chan)
    487   1.32.2.2     skrll 		fail |= 0x01;
    488   1.32.2.2     skrll 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
    489   1.32.2.2     skrll 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
    490   1.32.2.2     skrll 			fail |= 0x02;
    491   1.32.2.2     skrll 	} else {
    492   1.32.2.2     skrll 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0)
    493   1.32.2.2     skrll 			fail |= 0x02;
    494   1.32.2.2     skrll 	}
    495   1.32.2.2     skrll 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
    496   1.32.2.2     skrll 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
    497   1.32.2.2     skrll 			fail |= 0x04;
    498   1.32.2.2     skrll 	} else {
    499   1.32.2.2     skrll 		/* XXX does this mean privacy is supported or required? */
    500   1.32.2.2     skrll 		if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
    501   1.32.2.2     skrll 			fail |= 0x04;
    502   1.32.2.2     skrll 	}
    503  1.32.2.10  christos 	rate = ieee80211_fix_rate(ni, IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE);
    504   1.32.2.2     skrll 	if (rate & IEEE80211_RATE_BASIC)
    505   1.32.2.2     skrll 		fail |= 0x08;
    506   1.32.2.2     skrll 	if (ic->ic_des_esslen != 0 &&
    507   1.32.2.2     skrll 	    (ni->ni_esslen != ic->ic_des_esslen ||
    508   1.32.2.2     skrll 	     memcmp(ni->ni_essid, ic->ic_des_essid, ic->ic_des_esslen) != 0))
    509   1.32.2.2     skrll 		fail |= 0x10;
    510   1.32.2.2     skrll 	if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
    511   1.32.2.2     skrll 	    !IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid))
    512   1.32.2.2     skrll 		fail |= 0x20;
    513  1.32.2.10  christos 	if (ni->ni_fails >= STA_FAILS_MAX)
    514  1.32.2.10  christos 		fail |= 0x40;
    515   1.32.2.2     skrll #ifdef IEEE80211_DEBUG
    516   1.32.2.9     skrll 	if (ieee80211_msg_scan(ic)) {
    517  1.32.2.10  christos 		printf(" %c %s",
    518  1.32.2.10  christos 		    fail & 0x40 ? '=' : fail & 0x80 ? '^' : fail ? '-' : '+',
    519   1.32.2.2     skrll 		    ether_sprintf(ni->ni_macaddr));
    520   1.32.2.2     skrll 		printf(" %s%c", ether_sprintf(ni->ni_bssid),
    521   1.32.2.2     skrll 		    fail & 0x20 ? '!' : ' ');
    522   1.32.2.2     skrll 		printf(" %3d%c", ieee80211_chan2ieee(ic, ni->ni_chan),
    523   1.32.2.2     skrll 			fail & 0x01 ? '!' : ' ');
    524   1.32.2.2     skrll 		printf(" %+4d", ni->ni_rssi);
    525   1.32.2.2     skrll 		printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
    526   1.32.2.2     skrll 		    fail & 0x08 ? '!' : ' ');
    527   1.32.2.2     skrll 		printf(" %4s%c",
    528   1.32.2.2     skrll 		    (ni->ni_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
    529   1.32.2.2     skrll 		    (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
    530   1.32.2.2     skrll 		    "????",
    531   1.32.2.2     skrll 		    fail & 0x02 ? '!' : ' ');
    532   1.32.2.2     skrll 		printf(" %3s%c ",
    533   1.32.2.2     skrll 		    (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) ?
    534   1.32.2.2     skrll 		    "wep" : "no",
    535   1.32.2.2     skrll 		    fail & 0x04 ? '!' : ' ');
    536   1.32.2.2     skrll 		ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
    537   1.32.2.2     skrll 		printf("%s\n", fail & 0x10 ? "!" : "");
    538   1.32.2.2     skrll 	}
    539   1.32.2.2     skrll #endif
    540   1.32.2.2     skrll 	return fail;
    541   1.32.2.2     skrll }
    542   1.32.2.2     skrll 
    543   1.32.2.9     skrll static __inline u_int8_t
    544   1.32.2.9     skrll maxrate(const struct ieee80211_node *ni)
    545   1.32.2.9     skrll {
    546   1.32.2.9     skrll 	const struct ieee80211_rateset *rs = &ni->ni_rates;
    547   1.32.2.9     skrll 	/* NB: assumes rate set is sorted (happens on frame receive) */
    548   1.32.2.9     skrll 	return rs->rs_rates[rs->rs_nrates-1] & IEEE80211_RATE_VAL;
    549   1.32.2.9     skrll }
    550   1.32.2.9     skrll 
    551   1.32.2.9     skrll /*
    552   1.32.2.9     skrll  * Compare the capabilities of two nodes and decide which is
    553   1.32.2.9     skrll  * more desirable (return >0 if a is considered better).  Note
    554   1.32.2.9     skrll  * that we assume compatibility/usability has already been checked
    555   1.32.2.9     skrll  * so we don't need to (e.g. validate whether privacy is supported).
    556   1.32.2.9     skrll  * Used to select the best scan candidate for association in a BSS.
    557   1.32.2.9     skrll  */
    558   1.32.2.9     skrll static int
    559   1.32.2.9     skrll ieee80211_node_compare(struct ieee80211com *ic,
    560   1.32.2.9     skrll 		       const struct ieee80211_node *a,
    561   1.32.2.9     skrll 		       const struct ieee80211_node *b)
    562   1.32.2.9     skrll {
    563   1.32.2.9     skrll 	u_int8_t maxa, maxb;
    564   1.32.2.9     skrll 	u_int8_t rssia, rssib;
    565  1.32.2.10  christos 	int weight;
    566   1.32.2.9     skrll 
    567   1.32.2.9     skrll 	/* privacy support preferred */
    568   1.32.2.9     skrll 	if ((a->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) &&
    569   1.32.2.9     skrll 	    (b->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
    570   1.32.2.9     skrll 		return 1;
    571   1.32.2.9     skrll 	if ((a->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0 &&
    572   1.32.2.9     skrll 	    (b->ni_capinfo & IEEE80211_CAPINFO_PRIVACY))
    573   1.32.2.9     skrll 		return -1;
    574   1.32.2.9     skrll 
    575  1.32.2.10  christos 	/* compare count of previous failures */
    576  1.32.2.10  christos 	weight = b->ni_fails - a->ni_fails;
    577  1.32.2.10  christos 	if (abs(weight) > 1)
    578  1.32.2.10  christos 		return weight;
    579  1.32.2.10  christos 
    580   1.32.2.9     skrll 	rssia = ic->ic_node_getrssi(a);
    581   1.32.2.9     skrll 	rssib = ic->ic_node_getrssi(b);
    582   1.32.2.9     skrll 	if (abs(rssib - rssia) < 5) {
    583   1.32.2.9     skrll 		/* best/max rate preferred if signal level close enough XXX */
    584   1.32.2.9     skrll 		maxa = maxrate(a);
    585   1.32.2.9     skrll 		maxb = maxrate(b);
    586   1.32.2.9     skrll 		if (maxa != maxb)
    587   1.32.2.9     skrll 			return maxa - maxb;
    588   1.32.2.9     skrll 		/* XXX use freq for channel preference */
    589   1.32.2.9     skrll 		/* for now just prefer 5Ghz band to all other bands */
    590   1.32.2.9     skrll 		if (IEEE80211_IS_CHAN_5GHZ(a->ni_chan) &&
    591   1.32.2.9     skrll 		   !IEEE80211_IS_CHAN_5GHZ(b->ni_chan))
    592   1.32.2.9     skrll 			return 1;
    593   1.32.2.9     skrll 		if (!IEEE80211_IS_CHAN_5GHZ(a->ni_chan) &&
    594   1.32.2.9     skrll 		     IEEE80211_IS_CHAN_5GHZ(b->ni_chan))
    595   1.32.2.9     skrll 			return -1;
    596   1.32.2.9     skrll 	}
    597   1.32.2.9     skrll 	/* all things being equal, use signal level */
    598   1.32.2.9     skrll 	return rssia - rssib;
    599   1.32.2.9     skrll }
    600   1.32.2.9     skrll 
    601   1.32.2.9     skrll /*
    602   1.32.2.9     skrll  * Mark an ongoing scan stopped.
    603   1.32.2.9     skrll  */
    604   1.32.2.9     skrll void
    605   1.32.2.9     skrll ieee80211_cancel_scan(struct ieee80211com *ic)
    606   1.32.2.9     skrll {
    607   1.32.2.9     skrll 
    608   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN, "%s: end %s scan\n",
    609   1.32.2.9     skrll 		__func__,
    610   1.32.2.9     skrll 		(ic->ic_flags & IEEE80211_F_ASCAN) ?  "active" : "passive");
    611   1.32.2.9     skrll 
    612   1.32.2.9     skrll 	ic->ic_flags &= ~(IEEE80211_F_SCAN | IEEE80211_F_ASCAN);
    613   1.32.2.9     skrll }
    614   1.32.2.9     skrll 
    615   1.32.2.2     skrll /*
    616   1.32.2.2     skrll  * Complete a scan of potential channels.
    617   1.32.2.2     skrll  */
    618   1.32.2.2     skrll void
    619   1.32.2.2     skrll ieee80211_end_scan(struct ieee80211com *ic)
    620   1.32.2.2     skrll {
    621   1.32.2.9     skrll 	struct ieee80211_node_table *nt = &ic->ic_scan;
    622   1.32.2.9     skrll 	struct ieee80211_node *ni, *selbs;
    623   1.32.2.2     skrll 
    624   1.32.2.9     skrll 	ieee80211_cancel_scan(ic);
    625   1.32.2.9     skrll 	ieee80211_notify_scan_done(ic);
    626   1.32.2.2     skrll 
    627   1.32.2.9     skrll #ifndef IEEE80211_NO_HOSTAP
    628   1.32.2.2     skrll 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
    629   1.32.2.9     skrll 		u_int8_t maxrssi[IEEE80211_CHAN_MAX];	/* XXX off stack? */
    630   1.32.2.9     skrll 		int i, bestchan;
    631   1.32.2.9     skrll 		u_int8_t rssi;
    632   1.32.2.9     skrll 
    633   1.32.2.2     skrll 		/*
    634   1.32.2.2     skrll 		 * The passive scan to look for existing AP's completed,
    635   1.32.2.2     skrll 		 * select a channel to camp on.  Identify the channels
    636   1.32.2.2     skrll 		 * that already have one or more AP's and try to locate
    637   1.32.2.9     skrll 		 * an unoccupied one.  If that fails, pick a channel that
    638   1.32.2.9     skrll 		 * looks to be quietest.
    639   1.32.2.2     skrll 		 */
    640   1.32.2.9     skrll 		memset(maxrssi, 0, sizeof(maxrssi));
    641   1.32.2.9     skrll 		IEEE80211_NODE_LOCK(nt);
    642   1.32.2.9     skrll 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
    643   1.32.2.9     skrll 			rssi = ic->ic_node_getrssi(ni);
    644   1.32.2.9     skrll 			i = ieee80211_chan2ieee(ic, ni->ni_chan);
    645   1.32.2.9     skrll 			if (rssi > maxrssi[i])
    646   1.32.2.9     skrll 				maxrssi[i] = rssi;
    647   1.32.2.2     skrll 		}
    648   1.32.2.9     skrll 		IEEE80211_NODE_UNLOCK(nt);
    649   1.32.2.9     skrll 		/* XXX select channel more intelligently */
    650   1.32.2.9     skrll 		bestchan = -1;
    651   1.32.2.2     skrll 		for (i = 0; i < IEEE80211_CHAN_MAX; i++)
    652   1.32.2.9     skrll 			if (isset(ic->ic_chan_active, i)) {
    653   1.32.2.9     skrll 				/*
    654   1.32.2.9     skrll 				 * If the channel is unoccupied the max rssi
    655   1.32.2.9     skrll 				 * should be zero; just take it.  Otherwise
    656   1.32.2.9     skrll 				 * track the channel with the lowest rssi and
    657   1.32.2.9     skrll 				 * use that when all channels appear occupied.
    658   1.32.2.9     skrll 				 */
    659   1.32.2.9     skrll 				if (maxrssi[i] == 0) {
    660   1.32.2.9     skrll 					bestchan = i;
    661   1.32.2.2     skrll 					break;
    662   1.32.2.9     skrll 				}
    663   1.32.2.9     skrll 				if (bestchan == -1 ||
    664   1.32.2.9     skrll 				    maxrssi[i] < maxrssi[bestchan])
    665   1.32.2.9     skrll 					bestchan = i;
    666   1.32.2.9     skrll 			}
    667   1.32.2.9     skrll 		if (bestchan != -1) {
    668   1.32.2.9     skrll 			ieee80211_create_ibss(ic, &ic->ic_channels[bestchan]);
    669   1.32.2.9     skrll 			return;
    670   1.32.2.2     skrll 		}
    671   1.32.2.9     skrll 		/* no suitable channel, should not happen */
    672   1.32.2.2     skrll 	}
    673   1.32.2.9     skrll #endif /* !IEEE80211_NO_HOSTAP */
    674   1.32.2.9     skrll 
    675   1.32.2.9     skrll 	/*
    676   1.32.2.9     skrll 	 * When manually sequencing the state machine; scan just once
    677   1.32.2.9     skrll 	 * regardless of whether we have a candidate or not.  The
    678   1.32.2.9     skrll 	 * controlling application is expected to setup state and
    679   1.32.2.9     skrll 	 * initiate an association.
    680   1.32.2.9     skrll 	 */
    681   1.32.2.9     skrll 	if (ic->ic_roaming == IEEE80211_ROAMING_MANUAL)
    682   1.32.2.9     skrll 		return;
    683   1.32.2.9     skrll 	/*
    684   1.32.2.9     skrll 	 * Automatic sequencing; look for a candidate and
    685   1.32.2.9     skrll 	 * if found join the network.
    686   1.32.2.9     skrll 	 */
    687   1.32.2.9     skrll 	/* NB: unlocked read should be ok */
    688   1.32.2.9     skrll 	if (TAILQ_FIRST(&nt->nt_node) == NULL) {
    689   1.32.2.2     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
    690   1.32.2.9     skrll 			"%s: no scan candidate\n", __func__);
    691   1.32.2.2     skrll   notfound:
    692   1.32.2.2     skrll 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
    693   1.32.2.2     skrll 		    (ic->ic_flags & IEEE80211_F_IBSSON) &&
    694   1.32.2.2     skrll 		    ic->ic_des_esslen != 0) {
    695   1.32.2.2     skrll 			ieee80211_create_ibss(ic, ic->ic_ibss_chan);
    696   1.32.2.2     skrll 			return;
    697   1.32.2.2     skrll 		}
    698   1.32.2.2     skrll 		/*
    699  1.32.2.10  christos 		 * Decrement the failure counts so entries will be
    700  1.32.2.10  christos 		 * reconsidered the next time around.  We really want
    701  1.32.2.10  christos 		 * to do this only for sta's where we've previously
    702  1.32.2.10  christos 		 had some success.
    703  1.32.2.10  christos 		 */
    704  1.32.2.10  christos 		IEEE80211_NODE_LOCK(nt);
    705  1.32.2.10  christos 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list)
    706  1.32.2.10  christos 			if (ni->ni_fails)
    707  1.32.2.10  christos 				ni->ni_fails--;
    708  1.32.2.10  christos 		IEEE80211_NODE_UNLOCK(nt);
    709  1.32.2.10  christos 		/*
    710   1.32.2.2     skrll 		 * Reset the list of channels to scan and start again.
    711   1.32.2.2     skrll 		 */
    712   1.32.2.2     skrll 		ieee80211_reset_scan(ic);
    713   1.32.2.9     skrll 		ic->ic_flags |= IEEE80211_F_SCAN;
    714   1.32.2.2     skrll 		ieee80211_next_scan(ic);
    715   1.32.2.2     skrll 		return;
    716   1.32.2.2     skrll 	}
    717   1.32.2.2     skrll 	selbs = NULL;
    718   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN, "\t%s\n",
    719   1.32.2.9     skrll 	    "macaddr          bssid         chan  rssi rate flag  wep  essid");
    720   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
    721   1.32.2.9     skrll 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
    722   1.32.2.2     skrll 		if (ieee80211_match_bss(ic, ni) == 0) {
    723   1.32.2.2     skrll 			if (selbs == NULL)
    724   1.32.2.2     skrll 				selbs = ni;
    725   1.32.2.9     skrll 			else if (ieee80211_node_compare(ic, ni, selbs) > 0)
    726   1.32.2.2     skrll 				selbs = ni;
    727   1.32.2.2     skrll 		}
    728   1.32.2.2     skrll 	}
    729   1.32.2.9     skrll 	if (selbs != NULL)		/* NB: grab ref while dropping lock */
    730   1.32.2.9     skrll 		(void) ieee80211_ref_node(selbs);
    731   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
    732   1.32.2.2     skrll 	if (selbs == NULL)
    733   1.32.2.2     skrll 		goto notfound;
    734   1.32.2.9     skrll 	if (!ieee80211_sta_join(ic, selbs)) {
    735   1.32.2.9     skrll 		ieee80211_free_node(selbs);
    736   1.32.2.9     skrll 		goto notfound;
    737   1.32.2.9     skrll 	}
    738   1.32.2.9     skrll }
    739   1.32.2.9     skrll 
    740   1.32.2.9     skrll /*
    741   1.32.2.9     skrll  * Handle 802.11 ad hoc network merge.  The
    742   1.32.2.9     skrll  * convention, set by the Wireless Ethernet Compatibility Alliance
    743   1.32.2.9     skrll  * (WECA), is that an 802.11 station will change its BSSID to match
    744   1.32.2.9     skrll  * the "oldest" 802.11 ad hoc network, on the same channel, that
    745   1.32.2.9     skrll  * has the station's desired SSID.  The "oldest" 802.11 network
    746   1.32.2.9     skrll  * sends beacons with the greatest TSF timestamp.
    747   1.32.2.9     skrll  *
    748   1.32.2.9     skrll  * The caller is assumed to validate TSF's before attempting a merge.
    749   1.32.2.9     skrll  *
    750   1.32.2.9     skrll  * Return !0 if the BSSID changed, 0 otherwise.
    751   1.32.2.9     skrll  */
    752   1.32.2.9     skrll int
    753  1.32.2.10  christos ieee80211_ibss_merge(struct ieee80211_node *ni)
    754   1.32.2.9     skrll {
    755  1.32.2.10  christos 	struct ieee80211com *ic = ni->ni_ic;
    756   1.32.2.9     skrll 
    757   1.32.2.9     skrll 	if (ni == ic->ic_bss ||
    758   1.32.2.9     skrll 	    IEEE80211_ADDR_EQ(ni->ni_bssid, ic->ic_bss->ni_bssid)) {
    759   1.32.2.9     skrll 		/* unchanged, nothing to do */
    760   1.32.2.9     skrll 		return 0;
    761   1.32.2.9     skrll 	}
    762   1.32.2.9     skrll 	if (ieee80211_match_bss(ic, ni) != 0) {	/* capabilities mismatch */
    763   1.32.2.9     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
    764   1.32.2.9     skrll 		    "%s: merge failed, capabilities mismatch\n", __func__);
    765   1.32.2.9     skrll 		ic->ic_stats.is_ibss_capmismatch++;
    766   1.32.2.9     skrll 		return 0;
    767   1.32.2.9     skrll 	}
    768   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
    769   1.32.2.9     skrll 		"%s: new bssid %s: %s preamble, %s slot time%s\n", __func__,
    770   1.32.2.9     skrll 		ether_sprintf(ni->ni_bssid),
    771   1.32.2.9     skrll 		ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
    772   1.32.2.9     skrll 		ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
    773   1.32.2.9     skrll 		ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : ""
    774   1.32.2.9     skrll 	);
    775   1.32.2.9     skrll 	return ieee80211_sta_join(ic, ieee80211_ref_node(ni));
    776   1.32.2.9     skrll }
    777   1.32.2.9     skrll 
    778   1.32.2.9     skrll /*
    779   1.32.2.9     skrll  * Join the specified IBSS/BSS network.  The node is assumed to
    780   1.32.2.9     skrll  * be passed in with a held reference.
    781   1.32.2.9     skrll  */
    782   1.32.2.9     skrll int
    783   1.32.2.9     skrll ieee80211_sta_join(struct ieee80211com *ic, struct ieee80211_node *selbs)
    784   1.32.2.9     skrll {
    785   1.32.2.9     skrll 	struct ieee80211_node *obss;
    786   1.32.2.9     skrll 
    787   1.32.2.2     skrll 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
    788   1.32.2.9     skrll 		struct ieee80211_node_table *nt;
    789   1.32.2.9     skrll 		/*
    790   1.32.2.9     skrll 		 * Delete unusable rates; we've already checked
    791   1.32.2.9     skrll 		 * that the negotiated rate set is acceptable.
    792   1.32.2.9     skrll 		 */
    793  1.32.2.10  christos 		ieee80211_fix_rate(selbs, IEEE80211_F_DODEL);
    794   1.32.2.9     skrll 		/*
    795   1.32.2.9     skrll 		 * Fillin the neighbor table; it will already
    796   1.32.2.9     skrll 		 * exist if we are simply switching mastership.
    797   1.32.2.9     skrll 		 * XXX ic_sta always setup so this is unnecessary?
    798   1.32.2.9     skrll 		 */
    799   1.32.2.9     skrll 		nt = &ic->ic_sta;
    800   1.32.2.9     skrll 		IEEE80211_NODE_LOCK(nt);
    801   1.32.2.9     skrll 		nt->nt_name = "neighbor";
    802   1.32.2.9     skrll 		nt->nt_inact_init = ic->ic_inact_run;
    803   1.32.2.9     skrll 		IEEE80211_NODE_UNLOCK(nt);
    804   1.32.2.2     skrll 	}
    805   1.32.2.9     skrll 
    806   1.32.2.9     skrll 	/*
    807   1.32.2.9     skrll 	 * Committed to selbs, setup state.
    808   1.32.2.9     skrll 	 */
    809   1.32.2.9     skrll 	obss = ic->ic_bss;
    810   1.32.2.9     skrll 	ic->ic_bss = selbs;		/* NB: caller assumed to bump refcnt */
    811   1.32.2.9     skrll 	if (obss != NULL)
    812   1.32.2.9     skrll 		ieee80211_free_node(obss);
    813   1.32.2.9     skrll 	/*
    814   1.32.2.9     skrll 	 * Set the erp state (mostly the slot time) to deal with
    815   1.32.2.9     skrll 	 * the auto-select case; this should be redundant if the
    816   1.32.2.9     skrll 	 * mode is locked.
    817   1.32.2.9     skrll 	 */
    818   1.32.2.9     skrll 	ic->ic_curmode = ieee80211_chan2mode(ic, selbs->ni_chan);
    819  1.32.2.10  christos 	ic->ic_curchan = selbs->ni_chan;
    820   1.32.2.9     skrll 	ieee80211_reset_erp(ic);
    821   1.32.2.9     skrll 	ieee80211_wme_initparams(ic);
    822   1.32.2.9     skrll 
    823   1.32.2.9     skrll 	if (ic->ic_opmode == IEEE80211_M_STA)
    824   1.32.2.9     skrll 		ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
    825   1.32.2.9     skrll 	else
    826   1.32.2.9     skrll 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
    827   1.32.2.9     skrll 	return 1;
    828   1.32.2.9     skrll }
    829   1.32.2.9     skrll 
    830   1.32.2.9     skrll /*
    831   1.32.2.9     skrll  * Leave the specified IBSS/BSS network.  The node is assumed to
    832   1.32.2.9     skrll  * be passed in with a held reference.
    833   1.32.2.9     skrll  */
    834   1.32.2.9     skrll void
    835   1.32.2.9     skrll ieee80211_sta_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
    836   1.32.2.9     skrll {
    837   1.32.2.9     skrll 	ic->ic_node_cleanup(ni);
    838   1.32.2.9     skrll 	ieee80211_notify_node_leave(ic, ni);
    839   1.32.2.2     skrll }
    840   1.32.2.2     skrll 
    841   1.32.2.2     skrll int
    842   1.32.2.2     skrll ieee80211_get_rate(struct ieee80211com *ic)
    843   1.32.2.2     skrll {
    844   1.32.2.2     skrll 	u_int8_t (*rates)[IEEE80211_RATE_MAXSIZE];
    845   1.32.2.2     skrll 	int rate;
    846   1.32.2.2     skrll 
    847   1.32.2.2     skrll 	rates = &ic->ic_bss->ni_rates.rs_rates;
    848   1.32.2.2     skrll 
    849   1.32.2.2     skrll 	if (ic->ic_fixed_rate != -1)
    850   1.32.2.2     skrll 		rate = (*rates)[ic->ic_fixed_rate];
    851   1.32.2.2     skrll 	else if (ic->ic_state == IEEE80211_S_RUN)
    852   1.32.2.2     skrll 		rate = (*rates)[ic->ic_bss->ni_txrate];
    853   1.32.2.2     skrll 	else
    854   1.32.2.2     skrll 		rate = 0;
    855   1.32.2.2     skrll 
    856   1.32.2.2     skrll 	return rate & IEEE80211_RATE_VAL;
    857   1.32.2.2     skrll }
    858   1.32.2.2     skrll 
    859   1.32.2.2     skrll static struct ieee80211_node *
    860   1.32.2.9     skrll node_alloc(struct ieee80211_node_table *nt)
    861   1.32.2.2     skrll {
    862   1.32.2.2     skrll 	struct ieee80211_node *ni;
    863   1.32.2.9     skrll 
    864   1.32.2.2     skrll 	MALLOC(ni, struct ieee80211_node *, sizeof(struct ieee80211_node),
    865   1.32.2.2     skrll 		M_80211_NODE, M_NOWAIT | M_ZERO);
    866   1.32.2.2     skrll 	return ni;
    867   1.32.2.2     skrll }
    868   1.32.2.2     skrll 
    869   1.32.2.9     skrll /*
    870   1.32.2.9     skrll  * Reclaim any resources in a node and reset any critical
    871   1.32.2.9     skrll  * state.  Typically nodes are free'd immediately after,
    872   1.32.2.9     skrll  * but in some cases the storage may be reused so we need
    873   1.32.2.9     skrll  * to insure consistent state (should probably fix that).
    874   1.32.2.9     skrll  */
    875   1.32.2.2     skrll static void
    876   1.32.2.9     skrll node_cleanup(struct ieee80211_node *ni)
    877   1.32.2.2     skrll {
    878   1.32.2.9     skrll #define	N(a)	(sizeof(a)/sizeof(a[0]))
    879   1.32.2.9     skrll 	struct ieee80211com *ic = ni->ni_ic;
    880   1.32.2.9     skrll 	int i, qlen;
    881   1.32.2.9     skrll 
    882   1.32.2.9     skrll 	/* NB: preserve ni_table */
    883   1.32.2.9     skrll 	if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) {
    884   1.32.2.9     skrll 		ic->ic_ps_sta--;
    885   1.32.2.9     skrll 		ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
    886   1.32.2.9     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
    887   1.32.2.9     skrll 		    "[%s] power save mode off, %u sta's in ps mode\n",
    888   1.32.2.9     skrll 		    ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta);
    889   1.32.2.9     skrll 	}
    890   1.32.2.9     skrll 	/*
    891   1.32.2.9     skrll 	 * Clear AREF flag that marks the authorization refcnt bump
    892   1.32.2.9     skrll 	 * has happened.  This is probably not needed as the node
    893   1.32.2.9     skrll 	 * should always be removed from the table so not found but
    894   1.32.2.9     skrll 	 * do it just in case.
    895   1.32.2.9     skrll 	 */
    896   1.32.2.9     skrll 	ni->ni_flags &= ~IEEE80211_NODE_AREF;
    897   1.32.2.2     skrll 
    898   1.32.2.9     skrll 	/*
    899   1.32.2.9     skrll 	 * Drain power save queue and, if needed, clear TIM.
    900   1.32.2.9     skrll 	 */
    901   1.32.2.9     skrll 	IEEE80211_NODE_SAVEQ_DRAIN(ni, qlen);
    902   1.32.2.9     skrll 	if (qlen != 0 && ic->ic_set_tim != NULL)
    903  1.32.2.10  christos 		ic->ic_set_tim(ni, 0);
    904   1.32.2.9     skrll 
    905   1.32.2.9     skrll 	ni->ni_associd = 0;
    906   1.32.2.9     skrll 	if (ni->ni_challenge != NULL) {
    907   1.32.2.9     skrll 		FREE(ni->ni_challenge, M_DEVBUF);
    908   1.32.2.9     skrll 		ni->ni_challenge = NULL;
    909   1.32.2.9     skrll 	}
    910   1.32.2.9     skrll 	/*
    911   1.32.2.9     skrll 	 * Preserve SSID, WPA, and WME ie's so the bss node is
    912   1.32.2.9     skrll 	 * reusable during a re-auth/re-assoc state transition.
    913   1.32.2.9     skrll 	 * If we remove these data they will not be recreated
    914   1.32.2.9     skrll 	 * because they come from a probe-response or beacon frame
    915   1.32.2.9     skrll 	 * which cannot be expected prior to the association-response.
    916   1.32.2.9     skrll 	 * This should not be an issue when operating in other modes
    917   1.32.2.9     skrll 	 * as stations leaving always go through a full state transition
    918   1.32.2.9     skrll 	 * which will rebuild this state.
    919   1.32.2.9     skrll 	 *
    920   1.32.2.9     skrll 	 * XXX does this leave us open to inheriting old state?
    921   1.32.2.9     skrll 	 */
    922   1.32.2.9     skrll 	for (i = 0; i < N(ni->ni_rxfrag); i++)
    923   1.32.2.9     skrll 		if (ni->ni_rxfrag[i] != NULL) {
    924   1.32.2.9     skrll 			m_freem(ni->ni_rxfrag[i]);
    925   1.32.2.9     skrll 			ni->ni_rxfrag[i] = NULL;
    926   1.32.2.9     skrll 		}
    927  1.32.2.10  christos 	/*
    928  1.32.2.10  christos 	 * Must be careful here to remove any key map entry w/o a LOR.
    929  1.32.2.10  christos 	 */
    930  1.32.2.10  christos 	ieee80211_node_delucastkey(ni);
    931   1.32.2.9     skrll #undef N
    932   1.32.2.2     skrll }
    933   1.32.2.2     skrll 
    934   1.32.2.2     skrll static void
    935   1.32.2.9     skrll node_free(struct ieee80211_node *ni)
    936   1.32.2.2     skrll {
    937   1.32.2.9     skrll 	struct ieee80211com *ic = ni->ni_ic;
    938   1.32.2.9     skrll 
    939   1.32.2.9     skrll 	ic->ic_node_cleanup(ni);
    940   1.32.2.9     skrll 	if (ni->ni_wpa_ie != NULL)
    941   1.32.2.9     skrll 		FREE(ni->ni_wpa_ie, M_DEVBUF);
    942   1.32.2.9     skrll 	if (ni->ni_wme_ie != NULL)
    943   1.32.2.9     skrll 		FREE(ni->ni_wme_ie, M_DEVBUF);
    944   1.32.2.9     skrll 	IEEE80211_NODE_SAVEQ_DESTROY(ni);
    945   1.32.2.9     skrll 	FREE(ni, M_80211_NODE);
    946   1.32.2.2     skrll }
    947   1.32.2.2     skrll 
    948   1.32.2.2     skrll static u_int8_t
    949   1.32.2.9     skrll node_getrssi(const struct ieee80211_node *ni)
    950   1.32.2.2     skrll {
    951   1.32.2.2     skrll 	return ni->ni_rssi;
    952   1.32.2.2     skrll }
    953   1.32.2.2     skrll 
    954   1.32.2.2     skrll static void
    955   1.32.2.9     skrll ieee80211_setup_node(struct ieee80211_node_table *nt,
    956   1.32.2.9     skrll 	struct ieee80211_node *ni, const u_int8_t *macaddr)
    957   1.32.2.2     skrll {
    958   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
    959   1.32.2.2     skrll 	int hash;
    960   1.32.2.2     skrll 
    961   1.32.2.2     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
    962   1.32.2.9     skrll 		"%s %p<%s> in %s table\n", __func__, ni,
    963   1.32.2.9     skrll 		ether_sprintf(macaddr), nt->nt_name);
    964   1.32.2.9     skrll 
    965   1.32.2.2     skrll 	IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
    966   1.32.2.2     skrll 	hash = IEEE80211_NODE_HASH(macaddr);
    967   1.32.2.9     skrll 	ieee80211_node_initref(ni);		/* mark referenced */
    968   1.32.2.9     skrll 	ni->ni_chan = IEEE80211_CHAN_ANYC;
    969   1.32.2.9     skrll 	ni->ni_authmode = IEEE80211_AUTH_OPEN;
    970   1.32.2.9     skrll 	ni->ni_txpower = ic->ic_txpowlimit;	/* max power */
    971   1.32.2.9     skrll 	ieee80211_crypto_resetkey(ic, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE);
    972   1.32.2.9     skrll 	ni->ni_inact_reload = nt->nt_inact_init;
    973   1.32.2.9     skrll 	ni->ni_inact = ni->ni_inact_reload;
    974   1.32.2.9     skrll 	IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
    975   1.32.2.9     skrll 
    976   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
    977   1.32.2.9     skrll 	TAILQ_INSERT_TAIL(&nt->nt_node, ni, ni_list);
    978   1.32.2.9     skrll 	LIST_INSERT_HEAD(&nt->nt_hash[hash], ni, ni_hash);
    979   1.32.2.9     skrll 	ni->ni_table = nt;
    980   1.32.2.9     skrll 	ni->ni_ic = ic;
    981   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
    982   1.32.2.2     skrll }
    983   1.32.2.2     skrll 
    984   1.32.2.2     skrll struct ieee80211_node *
    985   1.32.2.9     skrll ieee80211_alloc_node(struct ieee80211_node_table *nt, const u_int8_t *macaddr)
    986   1.32.2.2     skrll {
    987   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
    988   1.32.2.9     skrll 	struct ieee80211_node *ni;
    989   1.32.2.9     skrll 
    990   1.32.2.9     skrll 	ni = ic->ic_node_alloc(nt);
    991   1.32.2.9     skrll 	if (ni != NULL)
    992   1.32.2.9     skrll 		ieee80211_setup_node(nt, ni, macaddr);
    993   1.32.2.9     skrll 	else
    994   1.32.2.2     skrll 		ic->ic_stats.is_rx_nodealloc++;
    995   1.32.2.2     skrll 	return ni;
    996   1.32.2.2     skrll }
    997   1.32.2.2     skrll 
    998  1.32.2.10  christos /*
    999  1.32.2.10  christos  * Craft a temporary node suitable for sending a management frame
   1000  1.32.2.10  christos  * to the specified station.  We craft only as much state as we
   1001  1.32.2.10  christos  * need to do the work since the node will be immediately reclaimed
   1002  1.32.2.10  christos  * once the send completes.
   1003  1.32.2.10  christos  */
   1004  1.32.2.10  christos struct ieee80211_node *
   1005  1.32.2.10  christos ieee80211_tmp_node(struct ieee80211com *ic, const u_int8_t *macaddr)
   1006  1.32.2.10  christos {
   1007  1.32.2.10  christos 	struct ieee80211_node *ni;
   1008  1.32.2.10  christos 
   1009  1.32.2.10  christos 	ni = ic->ic_node_alloc(&ic->ic_sta);
   1010  1.32.2.10  christos 	if (ni != NULL) {
   1011  1.32.2.10  christos 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
   1012  1.32.2.10  christos 			"%s %p<%s>\n", __func__, ni, ether_sprintf(macaddr));
   1013  1.32.2.10  christos 
   1014  1.32.2.10  christos 		IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
   1015  1.32.2.10  christos 		IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
   1016  1.32.2.10  christos 		ieee80211_node_initref(ni);		/* mark referenced */
   1017  1.32.2.10  christos 		ni->ni_txpower = ic->ic_bss->ni_txpower;
   1018  1.32.2.10  christos 		/* NB: required by ieee80211_fix_rate */
   1019  1.32.2.10  christos 		ieee80211_set_chan(ic, ni, ic->ic_bss->ni_chan);
   1020  1.32.2.10  christos 		ieee80211_crypto_resetkey(ic, &ni->ni_ucastkey,
   1021  1.32.2.10  christos 			IEEE80211_KEYIX_NONE);
   1022  1.32.2.10  christos 		/* XXX optimize away */
   1023  1.32.2.10  christos 		IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
   1024  1.32.2.10  christos 
   1025  1.32.2.10  christos 		ni->ni_table = NULL;		/* NB: pedantic */
   1026  1.32.2.10  christos 		ni->ni_ic = ic;
   1027  1.32.2.10  christos 	} else {
   1028  1.32.2.10  christos 		/* XXX msg */
   1029  1.32.2.10  christos 		ic->ic_stats.is_rx_nodealloc++;
   1030  1.32.2.10  christos 	}
   1031  1.32.2.10  christos 	return ni;
   1032  1.32.2.10  christos }
   1033  1.32.2.10  christos 
   1034   1.32.2.2     skrll struct ieee80211_node *
   1035   1.32.2.9     skrll ieee80211_dup_bss(struct ieee80211_node_table *nt, const u_int8_t *macaddr)
   1036   1.32.2.2     skrll {
   1037   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
   1038   1.32.2.9     skrll 	struct ieee80211_node *ni;
   1039   1.32.2.9     skrll 
   1040   1.32.2.9     skrll 	ni = ic->ic_node_alloc(nt);
   1041   1.32.2.2     skrll 	if (ni != NULL) {
   1042   1.32.2.9     skrll 		ieee80211_setup_node(nt, ni, macaddr);
   1043   1.32.2.2     skrll 		/*
   1044   1.32.2.2     skrll 		 * Inherit from ic_bss.
   1045   1.32.2.2     skrll 		 */
   1046   1.32.2.9     skrll 		ni->ni_authmode = ic->ic_bss->ni_authmode;
   1047   1.32.2.9     skrll 		ni->ni_txpower = ic->ic_bss->ni_txpower;
   1048   1.32.2.9     skrll 		ni->ni_vlan = ic->ic_bss->ni_vlan;	/* XXX?? */
   1049   1.32.2.2     skrll 		IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
   1050   1.32.2.9     skrll 		ieee80211_set_chan(ic, ni, ic->ic_bss->ni_chan);
   1051   1.32.2.9     skrll 		ni->ni_rsn = ic->ic_bss->ni_rsn;
   1052   1.32.2.2     skrll 	} else
   1053   1.32.2.2     skrll 		ic->ic_stats.is_rx_nodealloc++;
   1054   1.32.2.2     skrll 	return ni;
   1055   1.32.2.2     skrll }
   1056   1.32.2.2     skrll 
   1057   1.32.2.2     skrll static struct ieee80211_node *
   1058   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1059   1.32.2.9     skrll _ieee80211_find_node_debug(struct ieee80211_node_table *nt,
   1060   1.32.2.9     skrll 	const u_int8_t *macaddr, const char *func, int line)
   1061   1.32.2.9     skrll #else
   1062   1.32.2.9     skrll _ieee80211_find_node(struct ieee80211_node_table *nt,
   1063   1.32.2.9     skrll 	const u_int8_t *macaddr)
   1064   1.32.2.9     skrll #endif
   1065   1.32.2.2     skrll {
   1066   1.32.2.2     skrll 	struct ieee80211_node *ni;
   1067   1.32.2.2     skrll 	int hash;
   1068   1.32.2.2     skrll 
   1069   1.32.2.9     skrll 	IEEE80211_NODE_LOCK_ASSERT(nt);
   1070   1.32.2.2     skrll 
   1071   1.32.2.2     skrll 	hash = IEEE80211_NODE_HASH(macaddr);
   1072   1.32.2.9     skrll 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
   1073   1.32.2.2     skrll 		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
   1074   1.32.2.9     skrll 			ieee80211_ref_node(ni);	/* mark referenced */
   1075   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1076   1.32.2.9     skrll 			IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
   1077   1.32.2.9     skrll 			    "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
   1078   1.32.2.9     skrll 			    func, line,
   1079   1.32.2.9     skrll 			    ni, ether_sprintf(ni->ni_macaddr),
   1080   1.32.2.9     skrll 			    ieee80211_node_refcnt(ni));
   1081   1.32.2.9     skrll #endif
   1082   1.32.2.2     skrll 			return ni;
   1083   1.32.2.2     skrll 		}
   1084   1.32.2.2     skrll 	}
   1085   1.32.2.2     skrll 	return NULL;
   1086   1.32.2.2     skrll }
   1087   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1088   1.32.2.9     skrll #define	_ieee80211_find_node(nt, mac) \
   1089   1.32.2.9     skrll 	_ieee80211_find_node_debug(nt, mac, func, line)
   1090   1.32.2.9     skrll #endif
   1091   1.32.2.2     skrll 
   1092   1.32.2.2     skrll struct ieee80211_node *
   1093   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1094   1.32.2.9     skrll ieee80211_find_node_debug(struct ieee80211_node_table *nt,
   1095   1.32.2.9     skrll 	const u_int8_t *macaddr, const char *func, int line)
   1096   1.32.2.9     skrll #else
   1097   1.32.2.9     skrll ieee80211_find_node(struct ieee80211_node_table *nt, const u_int8_t *macaddr)
   1098   1.32.2.9     skrll #endif
   1099   1.32.2.2     skrll {
   1100   1.32.2.2     skrll 	struct ieee80211_node *ni;
   1101   1.32.2.2     skrll 
   1102   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1103   1.32.2.9     skrll 	ni = _ieee80211_find_node(nt, macaddr);
   1104   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1105   1.32.2.2     skrll 	return ni;
   1106   1.32.2.2     skrll }
   1107   1.32.2.2     skrll 
   1108   1.32.2.2     skrll /*
   1109   1.32.2.9     skrll  * Fake up a node; this handles node discovery in adhoc mode.
   1110   1.32.2.9     skrll  * Note that for the driver's benefit we we treat this like
   1111   1.32.2.9     skrll  * an association so the driver has an opportunity to setup
   1112   1.32.2.9     skrll  * it's private state.
   1113   1.32.2.2     skrll  */
   1114   1.32.2.2     skrll struct ieee80211_node *
   1115   1.32.2.9     skrll ieee80211_fakeup_adhoc_node(struct ieee80211_node_table *nt,
   1116   1.32.2.9     skrll 	const u_int8_t macaddr[IEEE80211_ADDR_LEN])
   1117   1.32.2.2     skrll {
   1118   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
   1119   1.32.2.2     skrll 	struct ieee80211_node *ni;
   1120   1.32.2.2     skrll 
   1121   1.32.2.9     skrll 	ni = ieee80211_dup_bss(nt, macaddr);
   1122   1.32.2.9     skrll 	if (ni != NULL) {
   1123   1.32.2.6     skrll 		/* XXX no rate negotiation; just dup */
   1124   1.32.2.6     skrll 		ni->ni_rates = ic->ic_bss->ni_rates;
   1125   1.32.2.9     skrll 		if (ic->ic_newassoc != NULL)
   1126  1.32.2.10  christos 			ic->ic_newassoc(ni, 1);
   1127  1.32.2.10  christos 		/* XXX not right for 802.1x/WPA */
   1128  1.32.2.10  christos 		ieee80211_node_authorize(ni);
   1129  1.32.2.10  christos 	}
   1130  1.32.2.10  christos 	return ni;
   1131  1.32.2.10  christos }
   1132  1.32.2.10  christos 
   1133  1.32.2.10  christos #ifdef IEEE80211_DEBUG
   1134  1.32.2.10  christos static void
   1135  1.32.2.10  christos dump_probe_beacon(u_int8_t subtype, int isnew,
   1136  1.32.2.10  christos 	const u_int8_t mac[IEEE80211_ADDR_LEN],
   1137  1.32.2.10  christos 	const struct ieee80211_scanparams *sp)
   1138  1.32.2.10  christos {
   1139  1.32.2.10  christos 
   1140  1.32.2.10  christos 	printf("[%s] %s%s on chan %u (bss chan %u) ",
   1141  1.32.2.10  christos 	    ether_sprintf(mac), isnew ? "new " : "",
   1142  1.32.2.10  christos 	    ieee80211_mgt_subtype_name[subtype >> IEEE80211_FC0_SUBTYPE_SHIFT],
   1143  1.32.2.10  christos 	    sp->chan, sp->bchan);
   1144  1.32.2.10  christos 	ieee80211_print_essid(sp->ssid + 2, sp->ssid[1]);
   1145  1.32.2.10  christos 	printf("\n");
   1146  1.32.2.10  christos 
   1147  1.32.2.10  christos 	if (isnew) {
   1148  1.32.2.10  christos 		printf("[%s] caps 0x%x bintval %u erp 0x%x",
   1149  1.32.2.10  christos 			ether_sprintf(mac), sp->capinfo, sp->bintval, sp->erp);
   1150  1.32.2.10  christos 		if (sp->country != NULL) {
   1151  1.32.2.10  christos #ifdef __FreeBSD__
   1152  1.32.2.10  christos 			printf(" country info %*D",
   1153  1.32.2.10  christos 				sp->country[1], sp->country+2, " ");
   1154  1.32.2.10  christos #else
   1155  1.32.2.10  christos 			int i;
   1156  1.32.2.10  christos 			printf(" country info");
   1157  1.32.2.10  christos 			for (i = 0; i < sp->country[1]; i++)
   1158  1.32.2.10  christos 				printf(" %02x", sp->country[i+2]);
   1159  1.32.2.10  christos #endif
   1160  1.32.2.10  christos 		}
   1161  1.32.2.10  christos 		printf("\n");
   1162  1.32.2.10  christos 	}
   1163  1.32.2.10  christos }
   1164  1.32.2.10  christos #endif /* IEEE80211_DEBUG */
   1165  1.32.2.10  christos 
   1166  1.32.2.10  christos static void
   1167  1.32.2.10  christos saveie(u_int8_t **iep, const u_int8_t *ie)
   1168  1.32.2.10  christos {
   1169  1.32.2.10  christos 
   1170  1.32.2.10  christos 	if (ie == NULL)
   1171  1.32.2.10  christos 		*iep = NULL;
   1172  1.32.2.10  christos 	else
   1173  1.32.2.10  christos 		ieee80211_saveie(iep, ie);
   1174  1.32.2.10  christos }
   1175  1.32.2.10  christos 
   1176  1.32.2.10  christos /*
   1177  1.32.2.10  christos  * Process a beacon or probe response frame.
   1178  1.32.2.10  christos  */
   1179  1.32.2.10  christos void
   1180  1.32.2.10  christos ieee80211_add_scan(struct ieee80211com *ic,
   1181  1.32.2.10  christos 	const struct ieee80211_scanparams *sp,
   1182  1.32.2.10  christos 	const struct ieee80211_frame *wh,
   1183  1.32.2.10  christos 	int subtype, int rssi, int rstamp)
   1184  1.32.2.10  christos {
   1185  1.32.2.10  christos #define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
   1186  1.32.2.10  christos 	struct ieee80211_node_table *nt = &ic->ic_scan;
   1187  1.32.2.10  christos 	struct ieee80211_node *ni;
   1188  1.32.2.10  christos 	int newnode = 0;
   1189  1.32.2.10  christos 
   1190  1.32.2.10  christos 	ni = ieee80211_find_node(nt, wh->i_addr2);
   1191  1.32.2.10  christos 	if (ni == NULL) {
   1192  1.32.2.10  christos 		/*
   1193  1.32.2.10  christos 		 * Create a new entry.
   1194  1.32.2.10  christos 		 */
   1195  1.32.2.10  christos 		ni = ic->ic_node_alloc(nt);
   1196  1.32.2.10  christos 		if (ni == NULL) {
   1197  1.32.2.10  christos 			ic->ic_stats.is_rx_nodealloc++;
   1198  1.32.2.10  christos 			return;
   1199  1.32.2.10  christos 		}
   1200  1.32.2.10  christos 		ieee80211_setup_node(nt, ni, wh->i_addr2);
   1201  1.32.2.10  christos 		/*
   1202  1.32.2.10  christos 		 * XXX inherit from ic_bss.
   1203  1.32.2.10  christos 		 */
   1204  1.32.2.10  christos 		ni->ni_authmode = ic->ic_bss->ni_authmode;
   1205  1.32.2.10  christos 		ni->ni_txpower = ic->ic_bss->ni_txpower;
   1206  1.32.2.10  christos 		ni->ni_vlan = ic->ic_bss->ni_vlan;	/* XXX?? */
   1207  1.32.2.10  christos 		ieee80211_set_chan(ic, ni, ic->ic_curchan);
   1208  1.32.2.10  christos 		ni->ni_rsn = ic->ic_bss->ni_rsn;
   1209  1.32.2.10  christos 		newnode = 1;
   1210  1.32.2.10  christos 	}
   1211  1.32.2.10  christos #ifdef IEEE80211_DEBUG
   1212  1.32.2.10  christos 	if (ieee80211_msg_scan(ic) && (ic->ic_flags & IEEE80211_F_SCAN))
   1213  1.32.2.10  christos 		dump_probe_beacon(subtype, newnode, wh->i_addr2, sp);
   1214  1.32.2.10  christos #endif
   1215  1.32.2.10  christos 	/* XXX ap beaconing multiple ssid w/ same bssid */
   1216  1.32.2.10  christos 	if (sp->ssid[1] != 0 &&
   1217  1.32.2.10  christos 	    (ISPROBE(subtype) || ni->ni_esslen == 0)) {
   1218  1.32.2.10  christos 		ni->ni_esslen = sp->ssid[1];
   1219  1.32.2.10  christos 		memset(ni->ni_essid, 0, sizeof(ni->ni_essid));
   1220  1.32.2.10  christos 		memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
   1221  1.32.2.10  christos 	}
   1222  1.32.2.10  christos 	ni->ni_scangen = ic->ic_scan.nt_scangen;
   1223  1.32.2.10  christos 	IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
   1224  1.32.2.10  christos 	ni->ni_rssi = rssi;
   1225  1.32.2.10  christos 	ni->ni_rstamp = rstamp;
   1226  1.32.2.10  christos 	memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
   1227  1.32.2.10  christos 	ni->ni_intval = sp->bintval;
   1228  1.32.2.10  christos 	ni->ni_capinfo = sp->capinfo;
   1229  1.32.2.10  christos 	ni->ni_chan = &ic->ic_channels[sp->chan];
   1230  1.32.2.10  christos 	ni->ni_fhdwell = sp->fhdwell;
   1231  1.32.2.10  christos 	ni->ni_fhindex = sp->fhindex;
   1232  1.32.2.10  christos 	ni->ni_erp = sp->erp;
   1233  1.32.2.10  christos 	if (sp->tim != NULL) {
   1234  1.32.2.10  christos 		struct ieee80211_tim_ie *ie =
   1235  1.32.2.10  christos 		    (struct ieee80211_tim_ie *) sp->tim;
   1236  1.32.2.10  christos 
   1237  1.32.2.10  christos 		ni->ni_dtim_count = ie->tim_count;
   1238  1.32.2.10  christos 		ni->ni_dtim_period = ie->tim_period;
   1239  1.32.2.10  christos 	}
   1240  1.32.2.10  christos 	/*
   1241  1.32.2.10  christos 	 * Record the byte offset from the mac header to
   1242  1.32.2.10  christos 	 * the start of the TIM information element for
   1243  1.32.2.10  christos 	 * use by hardware and/or to speedup software
   1244  1.32.2.10  christos 	 * processing of beacon frames.
   1245  1.32.2.10  christos 	 */
   1246  1.32.2.10  christos 	ni->ni_timoff = sp->timoff;
   1247  1.32.2.10  christos 	/*
   1248  1.32.2.10  christos 	 * Record optional information elements that might be
   1249  1.32.2.10  christos 	 * used by applications or drivers.
   1250  1.32.2.10  christos 	 */
   1251  1.32.2.10  christos 	saveie(&ni->ni_wme_ie, sp->wme);
   1252  1.32.2.10  christos 	saveie(&ni->ni_wpa_ie, sp->wpa);
   1253  1.32.2.10  christos 
   1254  1.32.2.10  christos 	/* NB: must be after ni_chan is setup */
   1255  1.32.2.10  christos 	ieee80211_setup_rates(ni, sp->rates, sp->xrates, IEEE80211_F_DOSORT);
   1256  1.32.2.10  christos 
   1257  1.32.2.10  christos 	if (!newnode)
   1258  1.32.2.10  christos 		ieee80211_free_node(ni);
   1259  1.32.2.10  christos #undef ISPROBE
   1260  1.32.2.10  christos }
   1261  1.32.2.10  christos 
   1262  1.32.2.10  christos void
   1263  1.32.2.10  christos ieee80211_init_neighbor(struct ieee80211com *ic, struct ieee80211_node *ni,
   1264  1.32.2.10  christos     const struct ieee80211_frame *wh, const struct ieee80211_scanparams *sp,
   1265  1.32.2.10  christos     int isnew)
   1266  1.32.2.10  christos {
   1267  1.32.2.10  christos 	ni->ni_esslen = sp->ssid[1];
   1268  1.32.2.10  christos 	memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
   1269  1.32.2.10  christos 	IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
   1270  1.32.2.10  christos 	memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
   1271  1.32.2.10  christos 	ni->ni_intval = sp->bintval;
   1272  1.32.2.10  christos 	ni->ni_capinfo = sp->capinfo;
   1273  1.32.2.10  christos 	ni->ni_chan = ic->ic_bss->ni_chan;
   1274  1.32.2.10  christos 	ni->ni_fhdwell = sp->fhdwell;
   1275  1.32.2.10  christos 	ni->ni_fhindex = sp->fhindex;
   1276  1.32.2.10  christos 	ni->ni_erp = sp->erp;
   1277  1.32.2.10  christos 	ni->ni_timoff = sp->timoff;
   1278  1.32.2.10  christos 	if (sp->wme != NULL)
   1279  1.32.2.10  christos 		ieee80211_saveie(&ni->ni_wme_ie, sp->wme);
   1280  1.32.2.10  christos 	if (sp->wpa != NULL)
   1281  1.32.2.10  christos 		ieee80211_saveie(&ni->ni_wpa_ie, sp->wpa);
   1282  1.32.2.10  christos 
   1283  1.32.2.10  christos 	/* NB: must be after ni_chan is setup */
   1284  1.32.2.10  christos 	ieee80211_setup_rates(ni, sp->rates, sp->xrates,
   1285  1.32.2.10  christos 	    IEEE80211_F_DODEL | IEEE80211_F_DONEGO | IEEE80211_F_DOSORT);
   1286  1.32.2.10  christos 
   1287  1.32.2.10  christos 	if (ic->ic_newassoc != NULL)
   1288  1.32.2.10  christos 		ic->ic_newassoc(ni, isnew);
   1289  1.32.2.10  christos }
   1290  1.32.2.10  christos 
   1291  1.32.2.10  christos /*
   1292  1.32.2.10  christos  * Do node discovery in adhoc mode on receipt of a beacon
   1293  1.32.2.10  christos  * or probe response frame.  Note that for the driver's
   1294  1.32.2.10  christos  * benefit we we treat this like an association so the
   1295  1.32.2.10  christos  * driver has an opportunity to setup it's private state.
   1296  1.32.2.10  christos  */
   1297  1.32.2.10  christos struct ieee80211_node *
   1298  1.32.2.10  christos ieee80211_add_neighbor(struct ieee80211com *ic,
   1299  1.32.2.10  christos 	const struct ieee80211_frame *wh,
   1300  1.32.2.10  christos 	const struct ieee80211_scanparams *sp)
   1301  1.32.2.10  christos {
   1302  1.32.2.10  christos 	struct ieee80211_node *ni;
   1303  1.32.2.10  christos 
   1304  1.32.2.10  christos 	ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);/* XXX alloc_node? */
   1305  1.32.2.10  christos 	if (ni != NULL) {
   1306  1.32.2.10  christos 		ieee80211_init_neighbor(ic, ni, wh, sp, 1);
   1307   1.32.2.9     skrll 		/* XXX not right for 802.1x/WPA */
   1308  1.32.2.10  christos 		ieee80211_node_authorize(ni);
   1309   1.32.2.2     skrll 	}
   1310   1.32.2.9     skrll 	return ni;
   1311   1.32.2.2     skrll }
   1312   1.32.2.2     skrll 
   1313  1.32.2.10  christos #define	IS_CTL(wh) \
   1314  1.32.2.10  christos 	((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
   1315  1.32.2.10  christos #define	IS_PSPOLL(wh) \
   1316  1.32.2.10  christos 	((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
   1317   1.32.2.2     skrll /*
   1318   1.32.2.9     skrll  * Locate the node for sender, track state, and then pass the
   1319   1.32.2.9     skrll  * (referenced) node up to the 802.11 layer for its use.  We
   1320   1.32.2.9     skrll  * are required to pass some node so we fall back to ic_bss
   1321   1.32.2.9     skrll  * when this frame is from an unknown sender.  The 802.11 layer
   1322   1.32.2.9     skrll  * knows this means the sender wasn't in the node table and
   1323   1.32.2.9     skrll  * acts accordingly.
   1324   1.32.2.2     skrll  */
   1325   1.32.2.9     skrll struct ieee80211_node *
   1326   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1327   1.32.2.9     skrll ieee80211_find_rxnode_debug(struct ieee80211com *ic,
   1328   1.32.2.9     skrll 	const struct ieee80211_frame_min *wh, const char *func, int line)
   1329   1.32.2.9     skrll #else
   1330   1.32.2.9     skrll ieee80211_find_rxnode(struct ieee80211com *ic,
   1331   1.32.2.9     skrll 	const struct ieee80211_frame_min *wh)
   1332   1.32.2.9     skrll #endif
   1333   1.32.2.9     skrll {
   1334   1.32.2.9     skrll 	struct ieee80211_node_table *nt;
   1335   1.32.2.9     skrll 	struct ieee80211_node *ni;
   1336   1.32.2.2     skrll 
   1337   1.32.2.9     skrll 	/* XXX may want scanned nodes in the neighbor table for adhoc */
   1338   1.32.2.9     skrll 	if (ic->ic_opmode == IEEE80211_M_STA ||
   1339   1.32.2.9     skrll 	    ic->ic_opmode == IEEE80211_M_MONITOR ||
   1340   1.32.2.9     skrll 	    (ic->ic_flags & IEEE80211_F_SCAN))
   1341   1.32.2.9     skrll 		nt = &ic->ic_scan;
   1342   1.32.2.9     skrll 	else
   1343   1.32.2.9     skrll 		nt = &ic->ic_sta;
   1344   1.32.2.9     skrll 	/* XXX check ic_bss first in station mode */
   1345   1.32.2.9     skrll 	/* XXX 4-address frames? */
   1346   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1347   1.32.2.9     skrll 	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
   1348   1.32.2.9     skrll 		ni = _ieee80211_find_node(nt, wh->i_addr1);
   1349   1.32.2.9     skrll 	else
   1350   1.32.2.9     skrll 		ni = _ieee80211_find_node(nt, wh->i_addr2);
   1351  1.32.2.10  christos 	if (ni == NULL)
   1352  1.32.2.10  christos 		ni = ieee80211_ref_node(ic->ic_bss);
   1353  1.32.2.10  christos 	IEEE80211_NODE_UNLOCK(nt);
   1354  1.32.2.10  christos 
   1355  1.32.2.10  christos 	return ni;
   1356  1.32.2.10  christos }
   1357  1.32.2.10  christos 
   1358  1.32.2.10  christos /*
   1359  1.32.2.10  christos  * Like ieee80211_find_rxnode but use the supplied h/w
   1360  1.32.2.10  christos  * key index as a hint to locate the node in the key
   1361  1.32.2.10  christos  * mapping table.  If an entry is present at the key
   1362  1.32.2.10  christos  * index we return it; otherwise do a normal lookup and
   1363  1.32.2.10  christos  * update the mapping table if the station has a unicast
   1364  1.32.2.10  christos  * key assigned to it.
   1365  1.32.2.10  christos  */
   1366  1.32.2.10  christos struct ieee80211_node *
   1367  1.32.2.10  christos #ifdef IEEE80211_DEBUG_REFCNT
   1368  1.32.2.10  christos ieee80211_find_rxnode_withkey_debug(struct ieee80211com *ic,
   1369  1.32.2.10  christos 	const struct ieee80211_frame_min *wh, ieee80211_keyix keyix,
   1370  1.32.2.10  christos 	const char *func, int line)
   1371  1.32.2.10  christos #else
   1372  1.32.2.10  christos ieee80211_find_rxnode_withkey(struct ieee80211com *ic,
   1373  1.32.2.10  christos 	const struct ieee80211_frame_min *wh, ieee80211_keyix keyix)
   1374  1.32.2.10  christos #endif
   1375  1.32.2.10  christos {
   1376  1.32.2.10  christos 	struct ieee80211_node_table *nt;
   1377  1.32.2.10  christos 	struct ieee80211_node *ni;
   1378  1.32.2.10  christos 
   1379  1.32.2.10  christos 	if (ic->ic_opmode == IEEE80211_M_STA ||
   1380  1.32.2.10  christos 	    ic->ic_opmode == IEEE80211_M_MONITOR ||
   1381  1.32.2.10  christos 	    (ic->ic_flags & IEEE80211_F_SCAN))
   1382  1.32.2.10  christos 		nt = &ic->ic_scan;
   1383  1.32.2.10  christos 	else
   1384  1.32.2.10  christos 		nt = &ic->ic_sta;
   1385  1.32.2.10  christos 	IEEE80211_NODE_LOCK(nt);
   1386  1.32.2.10  christos 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax)
   1387  1.32.2.10  christos 		ni = nt->nt_keyixmap[keyix];
   1388  1.32.2.10  christos 	else
   1389  1.32.2.10  christos 		ni = NULL;
   1390  1.32.2.10  christos 	if (ni == NULL) {
   1391  1.32.2.10  christos 		if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
   1392  1.32.2.10  christos 			ni = _ieee80211_find_node(nt, wh->i_addr1);
   1393  1.32.2.10  christos 		else
   1394  1.32.2.10  christos 			ni = _ieee80211_find_node(nt, wh->i_addr2);
   1395  1.32.2.10  christos 		if (ni == NULL)
   1396  1.32.2.10  christos 			ni = ieee80211_ref_node(ic->ic_bss);
   1397  1.32.2.10  christos 		if (nt->nt_keyixmap != NULL) {
   1398  1.32.2.10  christos 			/*
   1399  1.32.2.10  christos 			 * If the station has a unicast key cache slot
   1400  1.32.2.10  christos 			 * assigned update the key->node mapping table.
   1401  1.32.2.10  christos 			 */
   1402  1.32.2.10  christos 			keyix = ni->ni_ucastkey.wk_rxkeyix;
   1403  1.32.2.10  christos 			/* XXX can keyixmap[keyix] != NULL? */
   1404  1.32.2.10  christos 			if (keyix < nt->nt_keyixmax &&
   1405  1.32.2.10  christos 			    nt->nt_keyixmap[keyix] == NULL) {
   1406  1.32.2.10  christos 				IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
   1407  1.32.2.10  christos 				    "%s: add key map entry %p<%s> refcnt %d\n",
   1408  1.32.2.10  christos 				    __func__, ni, ether_sprintf(ni->ni_macaddr),
   1409  1.32.2.10  christos 				    ieee80211_node_refcnt(ni)+1);
   1410  1.32.2.10  christos 				nt->nt_keyixmap[keyix] = ieee80211_ref_node(ni);
   1411  1.32.2.10  christos 			}
   1412  1.32.2.10  christos 		}
   1413  1.32.2.10  christos 	} else {
   1414  1.32.2.10  christos 		ieee80211_ref_node(ni);
   1415  1.32.2.10  christos 	}
   1416   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1417   1.32.2.2     skrll 
   1418  1.32.2.10  christos 	return ni;
   1419  1.32.2.10  christos }
   1420   1.32.2.9     skrll #undef IS_PSPOLL
   1421   1.32.2.9     skrll #undef IS_CTL
   1422   1.32.2.2     skrll 
   1423   1.32.2.9     skrll /*
   1424   1.32.2.9     skrll  * Return a reference to the appropriate node for sending
   1425   1.32.2.9     skrll  * a data frame.  This handles node discovery in adhoc networks.
   1426   1.32.2.3     skrll  */
   1427   1.32.2.2     skrll struct ieee80211_node *
   1428   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1429   1.32.2.9     skrll ieee80211_find_txnode_debug(struct ieee80211com *ic, const u_int8_t *macaddr,
   1430   1.32.2.9     skrll 	const char *func, int line)
   1431   1.32.2.9     skrll #else
   1432   1.32.2.9     skrll ieee80211_find_txnode(struct ieee80211com *ic, const u_int8_t *macaddr)
   1433   1.32.2.9     skrll #endif
   1434   1.32.2.2     skrll {
   1435   1.32.2.9     skrll 	struct ieee80211_node_table *nt = &ic->ic_sta;
   1436   1.32.2.2     skrll 	struct ieee80211_node *ni;
   1437   1.32.2.2     skrll 
   1438   1.32.2.9     skrll 	/*
   1439   1.32.2.9     skrll 	 * The destination address should be in the node table
   1440  1.32.2.10  christos 	 * unless this is a multicast/broadcast frame.  We can
   1441  1.32.2.10  christos 	 * also optimize station mode operation, all frames go
   1442  1.32.2.10  christos 	 * to the bss node.
   1443   1.32.2.9     skrll 	 */
   1444   1.32.2.9     skrll 	/* XXX can't hold lock across dup_bss 'cuz of recursive locking */
   1445   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1446  1.32.2.10  christos 	if (ic->ic_opmode == IEEE80211_M_STA || IEEE80211_IS_MULTICAST(macaddr))
   1447  1.32.2.10  christos 		ni = ieee80211_ref_node(ic->ic_bss);
   1448  1.32.2.10  christos 	else
   1449  1.32.2.10  christos 		ni = _ieee80211_find_node(nt, macaddr);
   1450   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1451   1.32.2.2     skrll 
   1452   1.32.2.9     skrll 	if (ni == NULL) {
   1453   1.32.2.9     skrll 		if (ic->ic_opmode == IEEE80211_M_IBSS ||
   1454   1.32.2.9     skrll 		    ic->ic_opmode == IEEE80211_M_AHDEMO) {
   1455   1.32.2.9     skrll 			/*
   1456   1.32.2.9     skrll 			 * In adhoc mode cons up a node for the destination.
   1457   1.32.2.9     skrll 			 * Note that we need an additional reference for the
   1458   1.32.2.9     skrll 			 * caller to be consistent with _ieee80211_find_node.
   1459   1.32.2.9     skrll 			 */
   1460   1.32.2.9     skrll 			ni = ieee80211_fakeup_adhoc_node(nt, macaddr);
   1461   1.32.2.9     skrll 			if (ni != NULL)
   1462   1.32.2.9     skrll 				(void) ieee80211_ref_node(ni);
   1463   1.32.2.9     skrll 		} else {
   1464   1.32.2.9     skrll 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
   1465   1.32.2.9     skrll 				"[%s] no node, discard frame (%s)\n",
   1466   1.32.2.9     skrll 				ether_sprintf(macaddr), __func__);
   1467   1.32.2.9     skrll 			ic->ic_stats.is_tx_nonode++;
   1468   1.32.2.9     skrll 		}
   1469   1.32.2.9     skrll 	}
   1470   1.32.2.9     skrll 	return ni;
   1471   1.32.2.2     skrll }
   1472   1.32.2.2     skrll 
   1473   1.32.2.2     skrll /*
   1474   1.32.2.2     skrll  * Like find but search based on the channel too.
   1475   1.32.2.2     skrll  */
   1476   1.32.2.2     skrll struct ieee80211_node *
   1477   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1478   1.32.2.9     skrll ieee80211_find_node_with_channel_debug(struct ieee80211_node_table *nt,
   1479   1.32.2.9     skrll 	const u_int8_t *macaddr, struct ieee80211_channel *chan,
   1480   1.32.2.9     skrll 	const char *func, int line)
   1481   1.32.2.9     skrll #else
   1482   1.32.2.9     skrll ieee80211_find_node_with_channel(struct ieee80211_node_table *nt,
   1483   1.32.2.9     skrll 	const u_int8_t *macaddr, struct ieee80211_channel *chan)
   1484   1.32.2.9     skrll #endif
   1485   1.32.2.2     skrll {
   1486   1.32.2.9     skrll 	struct ieee80211_node *ni;
   1487   1.32.2.2     skrll 	int hash;
   1488   1.32.2.2     skrll 
   1489   1.32.2.2     skrll 	hash = IEEE80211_NODE_HASH(macaddr);
   1490   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1491   1.32.2.9     skrll 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
   1492   1.32.2.9     skrll 		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) &&
   1493   1.32.2.9     skrll 		    ni->ni_chan == chan) {
   1494   1.32.2.9     skrll 			ieee80211_ref_node(ni);		/* mark referenced */
   1495   1.32.2.9     skrll 			IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
   1496   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1497   1.32.2.9     skrll 			    "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
   1498   1.32.2.9     skrll 			    func, line,
   1499   1.32.2.9     skrll #else
   1500   1.32.2.9     skrll 			    "%s %p<%s> refcnt %d\n", __func__,
   1501   1.32.2.9     skrll #endif
   1502   1.32.2.9     skrll 			    ni, ether_sprintf(ni->ni_macaddr),
   1503   1.32.2.9     skrll 			    ieee80211_node_refcnt(ni));
   1504   1.32.2.9     skrll 			break;
   1505   1.32.2.9     skrll 		}
   1506   1.32.2.9     skrll 	}
   1507   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1508   1.32.2.9     skrll 	return ni;
   1509   1.32.2.9     skrll }
   1510   1.32.2.9     skrll 
   1511   1.32.2.9     skrll struct ieee80211_node *
   1512   1.32.2.9     skrll ieee80211_refine_node_for_beacon(struct ieee80211com *ic,
   1513   1.32.2.9     skrll 	struct ieee80211_node *ni0, struct ieee80211_channel *chan,
   1514   1.32.2.9     skrll 	const u_int8_t *ssid)
   1515   1.32.2.9     skrll {
   1516   1.32.2.9     skrll 	struct ieee80211_node_table *nt = ni0->ni_table;
   1517   1.32.2.9     skrll 	struct ieee80211_node *best, *ni;
   1518   1.32.2.9     skrll 	int best_score = 0, score;
   1519   1.32.2.9     skrll 
   1520   1.32.2.9     skrll 	if (nt == NULL)
   1521   1.32.2.9     skrll 		return ni0;
   1522   1.32.2.9     skrll 
   1523   1.32.2.9     skrll 	best = ni0;
   1524   1.32.2.9     skrll 	if (ssid[1] == 0 || best->ni_esslen == 0)
   1525   1.32.2.9     skrll 		best_score = 1;
   1526   1.32.2.9     skrll 	else if (ssid[1] == best->ni_esslen &&
   1527   1.32.2.9     skrll 		 memcmp(ssid + 2, best->ni_essid, ssid[1]) == 0)
   1528   1.32.2.9     skrll 		best_score = 2;
   1529   1.32.2.9     skrll 	else
   1530   1.32.2.9     skrll 		best_score = 0;
   1531   1.32.2.3     skrll 
   1532   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1533   1.32.2.9     skrll 	for (ni = LIST_NEXT(ni0, ni_hash); ni != NULL;
   1534   1.32.2.9     skrll 	     ni = LIST_NEXT(ni, ni_hash)) {
   1535   1.32.2.9     skrll 		if (!IEEE80211_ADDR_EQ(ni->ni_macaddr, best->ni_macaddr) ||
   1536   1.32.2.9     skrll 		    ni->ni_ic != best->ni_ic || ni->ni_chan != chan)
   1537   1.32.2.9     skrll 			continue;
   1538   1.32.2.3     skrll 
   1539   1.32.2.3     skrll 		if (ssid[1] == 0 || ni->ni_esslen == 0)
   1540   1.32.2.9     skrll 			score = 1;
   1541   1.32.2.9     skrll 		else if (ssid[1] == ni->ni_esslen &&
   1542   1.32.2.9     skrll 			 memcmp(ssid + 2, ni->ni_essid, ssid[1]) == 0)
   1543   1.32.2.9     skrll 			score = 2;
   1544   1.32.2.9     skrll 		else
   1545   1.32.2.3     skrll 			continue;
   1546   1.32.2.3     skrll 
   1547   1.32.2.3     skrll 		if (score > best_score) {
   1548   1.32.2.6     skrll 			best = ni;
   1549   1.32.2.3     skrll 			best_score = score;
   1550   1.32.2.2     skrll 		}
   1551   1.32.2.2     skrll 	}
   1552   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1553   1.32.2.3     skrll 	return best;
   1554   1.32.2.2     skrll }
   1555   1.32.2.2     skrll 
   1556   1.32.2.9     skrll /*
   1557   1.32.2.9     skrll  * Like find but search based on the ssid too.
   1558   1.32.2.9     skrll  */
   1559   1.32.2.9     skrll struct ieee80211_node *
   1560   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1561   1.32.2.9     skrll ieee80211_find_node_with_ssid_debug(struct ieee80211_node_table *nt,
   1562   1.32.2.9     skrll 	const u_int8_t *macaddr, u_int ssidlen, const u_int8_t *ssid,
   1563   1.32.2.9     skrll 	const char *func, int line)
   1564   1.32.2.9     skrll #else
   1565   1.32.2.9     skrll ieee80211_find_node_with_ssid(struct ieee80211_node_table *nt,
   1566   1.32.2.9     skrll 	const u_int8_t *macaddr, u_int ssidlen, const u_int8_t *ssid)
   1567   1.32.2.9     skrll #endif
   1568   1.32.2.9     skrll {
   1569   1.32.2.9     skrll #define	MATCH_SSID(ni, ssid, ssidlen) \
   1570   1.32.2.9     skrll 	(ni->ni_esslen == ssidlen && memcmp(ni->ni_essid, ssid, ssidlen) == 0)
   1571   1.32.2.9     skrll 	static const u_int8_t zeromac[IEEE80211_ADDR_LEN];
   1572   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
   1573   1.32.2.9     skrll 	struct ieee80211_node *ni;
   1574   1.32.2.9     skrll 	int hash;
   1575   1.32.2.9     skrll 
   1576   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1577   1.32.2.9     skrll 	/*
   1578   1.32.2.9     skrll 	 * A mac address that is all zero means match only the ssid;
   1579   1.32.2.9     skrll 	 * otherwise we must match both.
   1580   1.32.2.9     skrll 	 */
   1581   1.32.2.9     skrll 	if (IEEE80211_ADDR_EQ(macaddr, zeromac)) {
   1582   1.32.2.9     skrll 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
   1583   1.32.2.9     skrll 			if (MATCH_SSID(ni, ssid, ssidlen))
   1584   1.32.2.9     skrll 				break;
   1585   1.32.2.9     skrll 		}
   1586   1.32.2.9     skrll 	} else {
   1587   1.32.2.9     skrll 		hash = IEEE80211_NODE_HASH(macaddr);
   1588   1.32.2.9     skrll 		LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
   1589   1.32.2.9     skrll 			if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) &&
   1590   1.32.2.9     skrll 			    MATCH_SSID(ni, ssid, ssidlen))
   1591   1.32.2.9     skrll 				break;
   1592   1.32.2.9     skrll 		}
   1593   1.32.2.9     skrll 	}
   1594   1.32.2.9     skrll 	if (ni != NULL) {
   1595   1.32.2.9     skrll 		ieee80211_ref_node(ni);	/* mark referenced */
   1596   1.32.2.9     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
   1597   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1598   1.32.2.9     skrll 		    "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
   1599   1.32.2.9     skrll 		    func, line,
   1600   1.32.2.9     skrll #else
   1601   1.32.2.9     skrll 		    "%s %p<%s> refcnt %d\n", __func__,
   1602   1.32.2.9     skrll #endif
   1603   1.32.2.9     skrll 		     ni, ether_sprintf(ni->ni_macaddr),
   1604   1.32.2.9     skrll 		     ieee80211_node_refcnt(ni));
   1605   1.32.2.9     skrll 	}
   1606   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1607   1.32.2.9     skrll 	return ni;
   1608   1.32.2.9     skrll #undef MATCH_SSID
   1609   1.32.2.9     skrll }
   1610   1.32.2.9     skrll 
   1611   1.32.2.2     skrll static void
   1612   1.32.2.9     skrll _ieee80211_free_node(struct ieee80211_node *ni)
   1613   1.32.2.2     skrll {
   1614   1.32.2.9     skrll 	struct ieee80211com *ic = ni->ni_ic;
   1615   1.32.2.9     skrll 	struct ieee80211_node_table *nt = ni->ni_table;
   1616   1.32.2.2     skrll 
   1617   1.32.2.2     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
   1618   1.32.2.9     skrll 		"%s %p<%s> in %s table\n", __func__, ni,
   1619   1.32.2.9     skrll 		ether_sprintf(ni->ni_macaddr),
   1620   1.32.2.9     skrll 		nt != NULL ? nt->nt_name : "<gone>");
   1621   1.32.2.9     skrll 
   1622   1.32.2.2     skrll 	IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
   1623   1.32.2.9     skrll 	if (nt != NULL) {
   1624   1.32.2.9     skrll 		TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
   1625   1.32.2.9     skrll 		LIST_REMOVE(ni, ni_hash);
   1626   1.32.2.9     skrll 	}
   1627   1.32.2.9     skrll 	ic->ic_node_free(ni);
   1628   1.32.2.2     skrll }
   1629   1.32.2.2     skrll 
   1630   1.32.2.2     skrll void
   1631   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1632   1.32.2.9     skrll ieee80211_free_node_debug(struct ieee80211_node *ni, const char *func, int line)
   1633   1.32.2.9     skrll #else
   1634   1.32.2.9     skrll ieee80211_free_node(struct ieee80211_node *ni)
   1635   1.32.2.9     skrll #endif
   1636   1.32.2.2     skrll {
   1637   1.32.2.9     skrll 	struct ieee80211_node_table *nt = ni->ni_table;
   1638   1.32.2.9     skrll 
   1639   1.32.2.9     skrll #ifdef IEEE80211_DEBUG_REFCNT
   1640   1.32.2.9     skrll 	IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
   1641   1.32.2.9     skrll 		"%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni,
   1642   1.32.2.9     skrll 		 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)-1);
   1643   1.32.2.9     skrll #endif
   1644  1.32.2.10  christos 	if (nt != NULL) {
   1645  1.32.2.10  christos 		IEEE80211_NODE_LOCK(nt);
   1646  1.32.2.10  christos 		if (ieee80211_node_dectestref(ni)) {
   1647  1.32.2.10  christos 			/*
   1648  1.32.2.10  christos 			 * Last reference, reclaim state.
   1649  1.32.2.10  christos 			 */
   1650   1.32.2.9     skrll 			_ieee80211_free_node(ni);
   1651  1.32.2.10  christos 		} else if (ieee80211_node_refcnt(ni) == 1 &&
   1652  1.32.2.10  christos 		    nt->nt_keyixmap != NULL) {
   1653  1.32.2.10  christos 			ieee80211_keyix keyix;
   1654  1.32.2.10  christos 			/*
   1655  1.32.2.10  christos 			 * Check for a last reference in the key mapping table.
   1656  1.32.2.10  christos 			 */
   1657  1.32.2.10  christos 			keyix = ni->ni_ucastkey.wk_rxkeyix;
   1658  1.32.2.10  christos 			if (keyix < nt->nt_keyixmax &&
   1659  1.32.2.10  christos 			    nt->nt_keyixmap[keyix] == ni) {
   1660  1.32.2.10  christos 				IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
   1661  1.32.2.10  christos 				    "%s: %p<%s> clear key map entry", __func__,
   1662  1.32.2.10  christos 				    ni, ether_sprintf(ni->ni_macaddr));
   1663  1.32.2.10  christos 				nt->nt_keyixmap[keyix] = NULL;
   1664  1.32.2.10  christos 				ieee80211_node_decref(ni); /* XXX needed? */
   1665  1.32.2.10  christos 				_ieee80211_free_node(ni);
   1666  1.32.2.10  christos 			}
   1667  1.32.2.10  christos 		}
   1668  1.32.2.10  christos 		IEEE80211_NODE_UNLOCK(nt);
   1669  1.32.2.10  christos 	} else {
   1670  1.32.2.10  christos 		if (ieee80211_node_dectestref(ni))
   1671   1.32.2.9     skrll 			_ieee80211_free_node(ni);
   1672   1.32.2.2     skrll 	}
   1673   1.32.2.2     skrll }
   1674   1.32.2.2     skrll 
   1675   1.32.2.9     skrll /*
   1676  1.32.2.10  christos  * Reclaim a unicast key and clear any key cache state.
   1677  1.32.2.10  christos  */
   1678  1.32.2.10  christos int
   1679  1.32.2.10  christos ieee80211_node_delucastkey(struct ieee80211_node *ni)
   1680  1.32.2.10  christos {
   1681  1.32.2.10  christos 	struct ieee80211com *ic = ni->ni_ic;
   1682  1.32.2.10  christos 	struct ieee80211_node_table *nt = &ic->ic_sta;
   1683  1.32.2.10  christos 	struct ieee80211_node *nikey;
   1684  1.32.2.10  christos 	ieee80211_keyix keyix;
   1685  1.32.2.10  christos 	int isowned, status;
   1686  1.32.2.10  christos 
   1687  1.32.2.10  christos 	/*
   1688  1.32.2.10  christos 	 * NB: We must beware of LOR here; deleting the key
   1689  1.32.2.10  christos 	 * can cause the crypto layer to block traffic updates
   1690  1.32.2.10  christos 	 * which can generate a LOR against the node table lock;
   1691  1.32.2.10  christos 	 * grab it here and stash the key index for our use below.
   1692  1.32.2.10  christos 	 *
   1693  1.32.2.10  christos 	 * Must also beware of recursion on the node table lock.
   1694  1.32.2.10  christos 	 * When called from node_cleanup we may already have
   1695  1.32.2.10  christos 	 * the node table lock held.  Unfortunately there's no
   1696  1.32.2.10  christos 	 * way to separate out this path so we must do this
   1697  1.32.2.10  christos 	 * conditionally.
   1698  1.32.2.10  christos 	 */
   1699  1.32.2.10  christos 	isowned = IEEE80211_NODE_IS_LOCKED(nt);
   1700  1.32.2.10  christos 	if (!isowned)
   1701  1.32.2.10  christos 		IEEE80211_NODE_LOCK(nt);
   1702  1.32.2.10  christos 	keyix = ni->ni_ucastkey.wk_rxkeyix;
   1703  1.32.2.10  christos 	status = ieee80211_crypto_delkey(ic, &ni->ni_ucastkey);
   1704  1.32.2.10  christos 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax) {
   1705  1.32.2.10  christos 		nikey = nt->nt_keyixmap[keyix];
   1706  1.32.2.10  christos 		nt->nt_keyixmap[keyix] = NULL;;
   1707  1.32.2.10  christos 	} else
   1708  1.32.2.10  christos 		nikey = NULL;
   1709  1.32.2.10  christos 	if (!isowned)
   1710  1.32.2.10  christos 		IEEE80211_NODE_UNLOCK(&ic->ic_sta);
   1711  1.32.2.10  christos 
   1712  1.32.2.10  christos 	if (nikey != NULL) {
   1713  1.32.2.10  christos 		IASSERT(nikey == ni,
   1714  1.32.2.10  christos 			("key map out of sync, ni %p nikey %p", ni, nikey));
   1715  1.32.2.10  christos 		IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
   1716  1.32.2.10  christos 			"%s: delete key map entry %p<%s> refcnt %d\n",
   1717  1.32.2.10  christos 			__func__, ni, ether_sprintf(ni->ni_macaddr),
   1718  1.32.2.10  christos 			ieee80211_node_refcnt(ni)-1);
   1719  1.32.2.10  christos 		ieee80211_free_node(ni);
   1720  1.32.2.10  christos 	}
   1721  1.32.2.10  christos 	return status;
   1722  1.32.2.10  christos }
   1723  1.32.2.10  christos 
   1724  1.32.2.10  christos /*
   1725   1.32.2.9     skrll  * Reclaim a node.  If this is the last reference count then
   1726   1.32.2.9     skrll  * do the normal free work.  Otherwise remove it from the node
   1727   1.32.2.9     skrll  * table and mark it gone by clearing the back-reference.
   1728   1.32.2.9     skrll  */
   1729   1.32.2.9     skrll static void
   1730   1.32.2.9     skrll node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
   1731   1.32.2.9     skrll {
   1732  1.32.2.10  christos 	ieee80211_keyix keyix;
   1733  1.32.2.10  christos 
   1734  1.32.2.10  christos 	IEEE80211_NODE_LOCK_ASSERT(nt);
   1735   1.32.2.9     skrll 
   1736   1.32.2.9     skrll 	IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
   1737   1.32.2.9     skrll 		"%s: remove %p<%s> from %s table, refcnt %d\n",
   1738   1.32.2.9     skrll 		__func__, ni, ether_sprintf(ni->ni_macaddr),
   1739   1.32.2.9     skrll 		nt->nt_name, ieee80211_node_refcnt(ni)-1);
   1740  1.32.2.10  christos 	/*
   1741  1.32.2.10  christos 	 * Clear any entry in the unicast key mapping table.
   1742  1.32.2.10  christos 	 * We need to do it here so rx lookups don't find it
   1743  1.32.2.10  christos 	 * in the mapping table even if it's not in the hash
   1744  1.32.2.10  christos 	 * table.  We cannot depend on the mapping table entry
   1745  1.32.2.10  christos 	 * being cleared because the node may not be free'd.
   1746  1.32.2.10  christos 	 */
   1747  1.32.2.10  christos 	keyix = ni->ni_ucastkey.wk_rxkeyix;
   1748  1.32.2.10  christos 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
   1749  1.32.2.10  christos 	    nt->nt_keyixmap[keyix] == ni) {
   1750  1.32.2.10  christos 		IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
   1751  1.32.2.10  christos 			"%s: %p<%s> clear key map entry\n",
   1752  1.32.2.10  christos 			__func__, ni, ether_sprintf(ni->ni_macaddr));
   1753  1.32.2.10  christos 		nt->nt_keyixmap[keyix] = NULL;
   1754  1.32.2.10  christos 		ieee80211_node_decref(ni);	/* NB: don't need free */
   1755  1.32.2.10  christos 	}
   1756   1.32.2.9     skrll 	if (!ieee80211_node_dectestref(ni)) {
   1757   1.32.2.9     skrll 		/*
   1758   1.32.2.9     skrll 		 * Other references are present, just remove the
   1759   1.32.2.9     skrll 		 * node from the table so it cannot be found.  When
   1760   1.32.2.9     skrll 		 * the references are dropped storage will be
   1761   1.32.2.9     skrll 		 * reclaimed.
   1762   1.32.2.9     skrll 		 */
   1763   1.32.2.9     skrll 		TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
   1764   1.32.2.9     skrll 		LIST_REMOVE(ni, ni_hash);
   1765   1.32.2.9     skrll 		ni->ni_table = NULL;		/* clear reference */
   1766   1.32.2.9     skrll 	} else
   1767   1.32.2.9     skrll 		_ieee80211_free_node(ni);
   1768   1.32.2.9     skrll }
   1769   1.32.2.9     skrll 
   1770   1.32.2.9     skrll static void
   1771   1.32.2.9     skrll ieee80211_free_allnodes_locked(struct ieee80211_node_table *nt)
   1772   1.32.2.2     skrll {
   1773   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
   1774   1.32.2.2     skrll 	struct ieee80211_node *ni;
   1775   1.32.2.2     skrll 
   1776   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
   1777   1.32.2.9     skrll 		"%s: free all nodes in %s table\n", __func__, nt->nt_name);
   1778   1.32.2.9     skrll 
   1779   1.32.2.9     skrll 	while ((ni = TAILQ_FIRST(&nt->nt_node)) != NULL) {
   1780   1.32.2.9     skrll 		if (ni->ni_associd != 0) {
   1781   1.32.2.9     skrll 			if (ic->ic_auth->ia_node_leave != NULL)
   1782   1.32.2.9     skrll 				ic->ic_auth->ia_node_leave(ic, ni);
   1783   1.32.2.9     skrll 			IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
   1784   1.32.2.9     skrll 		}
   1785   1.32.2.9     skrll 		node_reclaim(nt, ni);
   1786   1.32.2.9     skrll 	}
   1787   1.32.2.9     skrll 	ieee80211_reset_erp(ic);
   1788   1.32.2.9     skrll }
   1789   1.32.2.9     skrll 
   1790   1.32.2.9     skrll static void
   1791   1.32.2.9     skrll ieee80211_free_allnodes(struct ieee80211_node_table *nt)
   1792   1.32.2.9     skrll {
   1793   1.32.2.2     skrll 
   1794   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1795   1.32.2.9     skrll 	ieee80211_free_allnodes_locked(nt);
   1796   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1797   1.32.2.2     skrll }
   1798   1.32.2.2     skrll 
   1799   1.32.2.2     skrll /*
   1800   1.32.2.9     skrll  * Timeout entries in the scan cache.
   1801   1.32.2.9     skrll  */
   1802   1.32.2.9     skrll static void
   1803   1.32.2.9     skrll ieee80211_timeout_scan_candidates(struct ieee80211_node_table *nt)
   1804   1.32.2.9     skrll {
   1805   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
   1806   1.32.2.9     skrll 	struct ieee80211_node *ni, *tni;
   1807   1.32.2.9     skrll 
   1808   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1809   1.32.2.9     skrll 	ni = ic->ic_bss;
   1810   1.32.2.9     skrll 	/* XXX belongs elsewhere */
   1811   1.32.2.9     skrll 	if (ni->ni_rxfrag[0] != NULL && ticks > ni->ni_rxfragstamp + hz) {
   1812   1.32.2.9     skrll 		m_freem(ni->ni_rxfrag[0]);
   1813   1.32.2.9     skrll 		ni->ni_rxfrag[0] = NULL;
   1814   1.32.2.9     skrll 	}
   1815   1.32.2.9     skrll 	TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, tni) {
   1816   1.32.2.9     skrll 		if (ni->ni_inact && --ni->ni_inact == 0) {
   1817   1.32.2.9     skrll 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
   1818   1.32.2.9     skrll 			    "[%s] scan candidate purged from cache "
   1819   1.32.2.9     skrll 			    "(refcnt %u)\n", ether_sprintf(ni->ni_macaddr),
   1820   1.32.2.9     skrll 			    ieee80211_node_refcnt(ni));
   1821   1.32.2.9     skrll 			node_reclaim(nt, ni);
   1822   1.32.2.9     skrll 		}
   1823   1.32.2.9     skrll 	}
   1824   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1825   1.32.2.9     skrll 
   1826   1.32.2.9     skrll 	nt->nt_inact_timer = IEEE80211_INACT_WAIT;
   1827   1.32.2.9     skrll }
   1828   1.32.2.9     skrll 
   1829   1.32.2.9     skrll /*
   1830   1.32.2.9     skrll  * Timeout inactive stations and do related housekeeping.
   1831   1.32.2.9     skrll  * Note that we cannot hold the node lock while sending a
   1832   1.32.2.9     skrll  * frame as this would lead to a LOR.  Instead we use a
   1833   1.32.2.9     skrll  * generation number to mark nodes that we've scanned and
   1834   1.32.2.9     skrll  * drop the lock and restart a scan if we have to time out
   1835   1.32.2.9     skrll  * a node.  Since we are single-threaded by virtue of
   1836   1.32.2.2     skrll  * controlling the inactivity timer we can be sure this will
   1837   1.32.2.2     skrll  * process each node only once.
   1838   1.32.2.2     skrll  */
   1839   1.32.2.9     skrll static void
   1840   1.32.2.9     skrll ieee80211_timeout_stations(struct ieee80211_node_table *nt)
   1841   1.32.2.2     skrll {
   1842   1.32.2.9     skrll 	struct ieee80211com *ic = nt->nt_ic;
   1843   1.32.2.2     skrll 	struct ieee80211_node *ni;
   1844   1.32.2.9     skrll 	u_int gen;
   1845  1.32.2.10  christos 	int isadhoc;
   1846   1.32.2.2     skrll 
   1847  1.32.2.10  christos 	isadhoc = (ic->ic_opmode == IEEE80211_M_IBSS ||
   1848  1.32.2.10  christos 		   ic->ic_opmode == IEEE80211_M_AHDEMO);
   1849   1.32.2.9     skrll 	IEEE80211_SCAN_LOCK(nt);
   1850   1.32.2.9     skrll 	gen = nt->nt_scangen++;
   1851   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
   1852   1.32.2.9     skrll 		"%s: %s scangen %u\n", __func__, nt->nt_name, gen);
   1853   1.32.2.2     skrll restart:
   1854   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1855   1.32.2.9     skrll 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
   1856   1.32.2.2     skrll 		if (ni->ni_scangen == gen)	/* previously handled */
   1857   1.32.2.2     skrll 			continue;
   1858   1.32.2.2     skrll 		ni->ni_scangen = gen;
   1859   1.32.2.9     skrll 		/*
   1860   1.32.2.9     skrll 		 * Ignore entries for which have yet to receive an
   1861   1.32.2.9     skrll 		 * authentication frame.  These are transient and
   1862   1.32.2.9     skrll 		 * will be reclaimed when the last reference to them
   1863   1.32.2.9     skrll 		 * goes away (when frame xmits complete).
   1864   1.32.2.9     skrll 		 */
   1865  1.32.2.10  christos 		if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
   1866  1.32.2.10  christos 		    (ni->ni_flags & IEEE80211_NODE_AREF) == 0)
   1867   1.32.2.3     skrll 			continue;
   1868   1.32.2.3     skrll 		/*
   1869   1.32.2.9     skrll 		 * Free fragment if not needed anymore
   1870   1.32.2.9     skrll 		 * (last fragment older than 1s).
   1871   1.32.2.9     skrll 		 * XXX doesn't belong here
   1872   1.32.2.9     skrll 		 */
   1873   1.32.2.9     skrll 		if (ni->ni_rxfrag[0] != NULL &&
   1874   1.32.2.9     skrll 		    ticks > ni->ni_rxfragstamp + hz) {
   1875   1.32.2.9     skrll 			m_freem(ni->ni_rxfrag[0]);
   1876   1.32.2.9     skrll 			ni->ni_rxfrag[0] = NULL;
   1877   1.32.2.9     skrll 		}
   1878   1.32.2.9     skrll 		/*
   1879   1.32.2.9     skrll 		 * Special case ourself; we may be idle for extended periods
   1880   1.32.2.9     skrll 		 * of time and regardless reclaiming our state is wrong.
   1881   1.32.2.9     skrll 		 */
   1882   1.32.2.9     skrll 		if (ni == ic->ic_bss)
   1883   1.32.2.9     skrll 			continue;
   1884   1.32.2.9     skrll 		ni->ni_inact--;
   1885  1.32.2.10  christos 		if (ni->ni_associd != 0 || isadhoc) {
   1886   1.32.2.9     skrll 			/*
   1887   1.32.2.9     skrll 			 * Age frames on the power save queue. The
   1888   1.32.2.9     skrll 			 * aging interval is 4 times the listen
   1889   1.32.2.9     skrll 			 * interval specified by the station.  This
   1890   1.32.2.9     skrll 			 * number is factored into the age calculations
   1891   1.32.2.9     skrll 			 * when the frame is placed on the queue.  We
   1892   1.32.2.9     skrll 			 * store ages as time differences we can check
   1893   1.32.2.9     skrll 			 * and/or adjust only the head of the list.
   1894   1.32.2.9     skrll 			 */
   1895   1.32.2.9     skrll 			if (IEEE80211_NODE_SAVEQ_QLEN(ni) != 0) {
   1896   1.32.2.9     skrll 				struct mbuf *m;
   1897   1.32.2.9     skrll 				int discard = 0;
   1898   1.32.2.9     skrll 
   1899   1.32.2.9     skrll 				IEEE80211_NODE_SAVEQ_LOCK(ni);
   1900   1.32.2.9     skrll 				while (IF_POLL(&ni->ni_savedq, m) != NULL &&
   1901   1.32.2.9     skrll 				     M_AGE_GET(m) < IEEE80211_INACT_WAIT) {
   1902   1.32.2.9     skrll IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, "[%s] discard frame, age %u\n", ether_sprintf(ni->ni_macaddr), M_AGE_GET(m));/*XXX*/
   1903   1.32.2.9     skrll 					_IEEE80211_NODE_SAVEQ_DEQUEUE_HEAD(ni, m);
   1904   1.32.2.9     skrll 					m_freem(m);
   1905   1.32.2.9     skrll 					discard++;
   1906   1.32.2.9     skrll 				}
   1907   1.32.2.9     skrll 				if (m != NULL)
   1908   1.32.2.9     skrll 					M_AGE_SUB(m, IEEE80211_INACT_WAIT);
   1909   1.32.2.9     skrll 				IEEE80211_NODE_SAVEQ_UNLOCK(ni);
   1910   1.32.2.9     skrll 
   1911   1.32.2.9     skrll 				if (discard != 0) {
   1912   1.32.2.9     skrll 					IEEE80211_DPRINTF(ic,
   1913   1.32.2.9     skrll 					    IEEE80211_MSG_POWER,
   1914   1.32.2.9     skrll 					    "[%s] discard %u frames for age\n",
   1915   1.32.2.9     skrll 					    ether_sprintf(ni->ni_macaddr),
   1916   1.32.2.9     skrll 					    discard);
   1917   1.32.2.9     skrll 					IEEE80211_NODE_STAT_ADD(ni,
   1918   1.32.2.9     skrll 						ps_discard, discard);
   1919   1.32.2.9     skrll 					if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0)
   1920  1.32.2.10  christos 						ic->ic_set_tim(ni, 0);
   1921   1.32.2.9     skrll 				}
   1922   1.32.2.9     skrll 			}
   1923   1.32.2.9     skrll 			/*
   1924   1.32.2.9     skrll 			 * Probe the station before time it out.  We
   1925   1.32.2.9     skrll 			 * send a null data frame which may not be
   1926   1.32.2.9     skrll 			 * universally supported by drivers (need it
   1927   1.32.2.9     skrll 			 * for ps-poll support so it should be...).
   1928   1.32.2.9     skrll 			 */
   1929   1.32.2.9     skrll 			if (0 < ni->ni_inact &&
   1930   1.32.2.9     skrll 			    ni->ni_inact <= ic->ic_inact_probe) {
   1931  1.32.2.10  christos 				IEEE80211_NOTE(ic,
   1932  1.32.2.10  christos 				    IEEE80211_MSG_INACT | IEEE80211_MSG_NODE,
   1933  1.32.2.10  christos 				    ni, "%s",
   1934  1.32.2.10  christos 				    "probe station due to inactivity");
   1935  1.32.2.10  christos 				/*
   1936  1.32.2.10  christos 				 * Grab a reference before unlocking the table
   1937  1.32.2.10  christos 				 * so the node cannot be reclaimed before we
   1938  1.32.2.10  christos 				 * send the frame. ieee80211_send_nulldata
   1939  1.32.2.10  christos 				 * understands we've done this and reclaims the
   1940  1.32.2.10  christos 				 * ref for us as needed.
   1941  1.32.2.10  christos 				 */
   1942  1.32.2.10  christos 				ieee80211_ref_node(ni);
   1943   1.32.2.9     skrll 				IEEE80211_NODE_UNLOCK(nt);
   1944  1.32.2.10  christos 				ieee80211_send_nulldata(ni);
   1945   1.32.2.9     skrll 				/* XXX stat? */
   1946   1.32.2.9     skrll 				goto restart;
   1947   1.32.2.9     skrll 			}
   1948   1.32.2.9     skrll 		}
   1949   1.32.2.9     skrll 		if (ni->ni_inact <= 0) {
   1950  1.32.2.10  christos 			IEEE80211_NOTE(ic,
   1951  1.32.2.10  christos 			    IEEE80211_MSG_INACT | IEEE80211_MSG_NODE, ni,
   1952  1.32.2.10  christos 			    "station timed out due to inactivity "
   1953  1.32.2.10  christos 			    "(refcnt %u)", ieee80211_node_refcnt(ni));
   1954   1.32.2.9     skrll 			/*
   1955   1.32.2.9     skrll 			 * Send a deauthenticate frame and drop the station.
   1956   1.32.2.9     skrll 			 * This is somewhat complicated due to reference counts
   1957   1.32.2.9     skrll 			 * and locking.  At this point a station will typically
   1958   1.32.2.9     skrll 			 * have a reference count of 1.  ieee80211_node_leave
   1959   1.32.2.9     skrll 			 * will do a "free" of the node which will drop the
   1960   1.32.2.9     skrll 			 * reference count.  But in the meantime a reference
   1961   1.32.2.9     skrll 			 * wil be held by the deauth frame.  The actual reclaim
   1962   1.32.2.9     skrll 			 * of the node will happen either after the tx is
   1963   1.32.2.9     skrll 			 * completed or by ieee80211_node_leave.
   1964   1.32.2.9     skrll 			 *
   1965   1.32.2.9     skrll 			 * Separately we must drop the node lock before sending
   1966   1.32.2.9     skrll 			 * in case the driver takes a lock, as this will result
   1967   1.32.2.9     skrll 			 * in  LOR between the node lock and the driver lock.
   1968   1.32.2.9     skrll 			 */
   1969   1.32.2.9     skrll 			IEEE80211_NODE_UNLOCK(nt);
   1970   1.32.2.9     skrll 			if (ni->ni_associd != 0) {
   1971   1.32.2.9     skrll 				IEEE80211_SEND_MGMT(ic, ni,
   1972   1.32.2.9     skrll 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
   1973   1.32.2.9     skrll 				    IEEE80211_REASON_AUTH_EXPIRE);
   1974   1.32.2.9     skrll 			}
   1975   1.32.2.3     skrll 			ieee80211_node_leave(ic, ni);
   1976   1.32.2.9     skrll 			ic->ic_stats.is_node_timeout++;
   1977   1.32.2.9     skrll 			goto restart;
   1978   1.32.2.9     skrll 		}
   1979   1.32.2.2     skrll 	}
   1980   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   1981   1.32.2.9     skrll 
   1982   1.32.2.9     skrll 	IEEE80211_SCAN_UNLOCK(nt);
   1983   1.32.2.9     skrll 
   1984   1.32.2.9     skrll 	nt->nt_inact_timer = IEEE80211_INACT_WAIT;
   1985   1.32.2.2     skrll }
   1986   1.32.2.2     skrll 
   1987   1.32.2.2     skrll void
   1988   1.32.2.9     skrll ieee80211_iterate_nodes(struct ieee80211_node_table *nt, ieee80211_iter_func *f, void *arg)
   1989   1.32.2.2     skrll {
   1990   1.32.2.2     skrll 	struct ieee80211_node *ni;
   1991   1.32.2.9     skrll 	u_int gen;
   1992   1.32.2.2     skrll 
   1993   1.32.2.9     skrll 	IEEE80211_SCAN_LOCK(nt);
   1994   1.32.2.9     skrll 	gen = nt->nt_scangen++;
   1995   1.32.2.9     skrll restart:
   1996   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   1997   1.32.2.9     skrll 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
   1998   1.32.2.9     skrll 		if (ni->ni_scangen != gen) {
   1999   1.32.2.9     skrll 			ni->ni_scangen = gen;
   2000   1.32.2.9     skrll 			(void) ieee80211_ref_node(ni);
   2001   1.32.2.9     skrll 			IEEE80211_NODE_UNLOCK(nt);
   2002   1.32.2.9     skrll 			(*f)(arg, ni);
   2003   1.32.2.9     skrll 			ieee80211_free_node(ni);
   2004   1.32.2.9     skrll 			goto restart;
   2005   1.32.2.9     skrll 		}
   2006   1.32.2.9     skrll 	}
   2007   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   2008   1.32.2.9     skrll 
   2009   1.32.2.9     skrll 	IEEE80211_SCAN_UNLOCK(nt);
   2010   1.32.2.9     skrll }
   2011   1.32.2.9     skrll 
   2012   1.32.2.9     skrll void
   2013   1.32.2.9     skrll ieee80211_dump_node(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
   2014   1.32.2.9     skrll {
   2015   1.32.2.9     skrll 	printf("0x%p: mac %s refcnt %d\n", ni,
   2016   1.32.2.9     skrll 		ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni));
   2017   1.32.2.9     skrll 	printf("\tscangen %u authmode %u flags 0x%x\n",
   2018   1.32.2.9     skrll 		ni->ni_scangen, ni->ni_authmode, ni->ni_flags);
   2019   1.32.2.9     skrll 	printf("\tassocid 0x%x txpower %u vlan %u\n",
   2020   1.32.2.9     skrll 		ni->ni_associd, ni->ni_txpower, ni->ni_vlan);
   2021   1.32.2.9     skrll 	printf("\ttxseq %u rxseq %u fragno %u rxfragstamp %u\n",
   2022   1.32.2.9     skrll 		ni->ni_txseqs[0],
   2023   1.32.2.9     skrll 		ni->ni_rxseqs[0] >> IEEE80211_SEQ_SEQ_SHIFT,
   2024   1.32.2.9     skrll 		ni->ni_rxseqs[0] & IEEE80211_SEQ_FRAG_MASK,
   2025   1.32.2.9     skrll 		ni->ni_rxfragstamp);
   2026   1.32.2.9     skrll 	printf("\trstamp %u rssi %u intval %u capinfo 0x%x\n",
   2027   1.32.2.9     skrll 		ni->ni_rstamp, ni->ni_rssi, ni->ni_intval, ni->ni_capinfo);
   2028   1.32.2.9     skrll 	printf("\tbssid %s essid \"%.*s\" channel %u:0x%x\n",
   2029   1.32.2.9     skrll 		ether_sprintf(ni->ni_bssid),
   2030   1.32.2.9     skrll 		ni->ni_esslen, ni->ni_essid,
   2031   1.32.2.9     skrll 		ni->ni_chan->ic_freq, ni->ni_chan->ic_flags);
   2032   1.32.2.9     skrll 	printf("\tfails %u inact %u txrate %u\n",
   2033   1.32.2.9     skrll 		ni->ni_fails, ni->ni_inact, ni->ni_txrate);
   2034   1.32.2.9     skrll }
   2035   1.32.2.9     skrll 
   2036   1.32.2.9     skrll void
   2037   1.32.2.9     skrll ieee80211_dump_nodes(struct ieee80211_node_table *nt)
   2038   1.32.2.9     skrll {
   2039   1.32.2.9     skrll 	ieee80211_iterate_nodes(nt,
   2040   1.32.2.9     skrll 		(ieee80211_iter_func *) ieee80211_dump_node, nt);
   2041   1.32.2.9     skrll }
   2042   1.32.2.9     skrll 
   2043   1.32.2.9     skrll /*
   2044   1.32.2.9     skrll  * Handle a station joining an 11g network.
   2045   1.32.2.9     skrll  */
   2046   1.32.2.9     skrll static void
   2047   1.32.2.9     skrll ieee80211_node_join_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
   2048   1.32.2.9     skrll {
   2049   1.32.2.9     skrll 
   2050   1.32.2.9     skrll 	/*
   2051   1.32.2.9     skrll 	 * Station isn't capable of short slot time.  Bump
   2052   1.32.2.9     skrll 	 * the count of long slot time stations and disable
   2053   1.32.2.9     skrll 	 * use of short slot time.  Note that the actual switch
   2054   1.32.2.9     skrll 	 * over to long slot time use may not occur until the
   2055   1.32.2.9     skrll 	 * next beacon transmission (per sec. 7.3.1.4 of 11g).
   2056   1.32.2.9     skrll 	 */
   2057   1.32.2.9     skrll 	if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
   2058   1.32.2.9     skrll 		ic->ic_longslotsta++;
   2059   1.32.2.9     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2060   1.32.2.9     skrll 		    "[%s] station needs long slot time, count %d\n",
   2061   1.32.2.9     skrll 		    ether_sprintf(ni->ni_macaddr), ic->ic_longslotsta);
   2062   1.32.2.9     skrll 		/* XXX vap's w/ conflicting needs won't work */
   2063   1.32.2.9     skrll 		ieee80211_set_shortslottime(ic, 0);
   2064   1.32.2.9     skrll 	}
   2065   1.32.2.9     skrll 	/*
   2066   1.32.2.9     skrll 	 * If the new station is not an ERP station
   2067   1.32.2.9     skrll 	 * then bump the counter and enable protection
   2068   1.32.2.9     skrll 	 * if configured.
   2069   1.32.2.9     skrll 	 */
   2070   1.32.2.9     skrll 	if (!ieee80211_iserp_rateset(ic, &ni->ni_rates)) {
   2071   1.32.2.9     skrll 		ic->ic_nonerpsta++;
   2072   1.32.2.9     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2073   1.32.2.9     skrll 		    "[%s] station is !ERP, %d non-ERP stations associated\n",
   2074   1.32.2.9     skrll 		    ether_sprintf(ni->ni_macaddr), ic->ic_nonerpsta);
   2075   1.32.2.9     skrll 		/*
   2076   1.32.2.9     skrll 		 * If protection is configured, enable it.
   2077   1.32.2.9     skrll 		 */
   2078   1.32.2.9     skrll 		if (ic->ic_protmode != IEEE80211_PROT_NONE) {
   2079   1.32.2.9     skrll 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2080   1.32.2.9     skrll 			    "%s: enable use of protection\n", __func__);
   2081   1.32.2.9     skrll 			ic->ic_flags |= IEEE80211_F_USEPROT;
   2082   1.32.2.9     skrll 		}
   2083   1.32.2.9     skrll 		/*
   2084   1.32.2.9     skrll 		 * If station does not support short preamble
   2085   1.32.2.9     skrll 		 * then we must enable use of Barker preamble.
   2086   1.32.2.9     skrll 		 */
   2087   1.32.2.9     skrll 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) == 0) {
   2088   1.32.2.9     skrll 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2089   1.32.2.9     skrll 			    "[%s] station needs long preamble\n",
   2090   1.32.2.9     skrll 			    ether_sprintf(ni->ni_macaddr));
   2091   1.32.2.9     skrll 			ic->ic_flags |= IEEE80211_F_USEBARKER;
   2092   1.32.2.9     skrll 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
   2093   1.32.2.9     skrll 		}
   2094   1.32.2.9     skrll 	} else
   2095   1.32.2.9     skrll 		ni->ni_flags |= IEEE80211_NODE_ERP;
   2096   1.32.2.2     skrll }
   2097   1.32.2.2     skrll 
   2098   1.32.2.2     skrll void
   2099   1.32.2.2     skrll ieee80211_node_join(struct ieee80211com *ic, struct ieee80211_node *ni, int resp)
   2100   1.32.2.2     skrll {
   2101   1.32.2.2     skrll 	int newassoc;
   2102   1.32.2.2     skrll 
   2103   1.32.2.2     skrll 	if (ni->ni_associd == 0) {
   2104   1.32.2.2     skrll 		u_int16_t aid;
   2105   1.32.2.2     skrll 
   2106   1.32.2.2     skrll 		/*
   2107   1.32.2.9     skrll 		 * It would be good to search the bitmap
   2108   1.32.2.2     skrll 		 * more efficiently, but this will do for now.
   2109   1.32.2.2     skrll 		 */
   2110   1.32.2.2     skrll 		for (aid = 1; aid < ic->ic_max_aid; aid++) {
   2111   1.32.2.2     skrll 			if (!IEEE80211_AID_ISSET(aid,
   2112   1.32.2.2     skrll 			    ic->ic_aid_bitmap))
   2113   1.32.2.2     skrll 				break;
   2114   1.32.2.2     skrll 		}
   2115   1.32.2.2     skrll 		if (aid >= ic->ic_max_aid) {
   2116   1.32.2.2     skrll 			IEEE80211_SEND_MGMT(ic, ni, resp,
   2117   1.32.2.2     skrll 			    IEEE80211_REASON_ASSOC_TOOMANY);
   2118   1.32.2.2     skrll 			ieee80211_node_leave(ic, ni);
   2119   1.32.2.2     skrll 			return;
   2120   1.32.2.2     skrll 		}
   2121   1.32.2.2     skrll 		ni->ni_associd = aid | 0xc000;
   2122   1.32.2.2     skrll 		IEEE80211_AID_SET(ni->ni_associd, ic->ic_aid_bitmap);
   2123   1.32.2.9     skrll 		ic->ic_sta_assoc++;
   2124   1.32.2.2     skrll 		newassoc = 1;
   2125  1.32.2.10  christos 		if (ic->ic_curmode == IEEE80211_MODE_11G)
   2126   1.32.2.9     skrll 			ieee80211_node_join_11g(ic, ni);
   2127   1.32.2.2     skrll 	} else
   2128   1.32.2.2     skrll 		newassoc = 0;
   2129   1.32.2.2     skrll 
   2130   1.32.2.2     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG,
   2131   1.32.2.9     skrll 	    "[%s] station %sassociated at aid %d: %s preamble, %s slot time%s%s\n",
   2132   1.32.2.9     skrll 	    ether_sprintf(ni->ni_macaddr), newassoc ? "" : "re",
   2133   1.32.2.9     skrll 	    IEEE80211_NODE_AID(ni),
   2134   1.32.2.9     skrll 	    ic->ic_flags & IEEE80211_F_SHPREAMBLE ? "short" : "long",
   2135   1.32.2.9     skrll 	    ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long",
   2136   1.32.2.9     skrll 	    ic->ic_flags & IEEE80211_F_USEPROT ? ", protection" : "",
   2137   1.32.2.9     skrll 	    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : ""
   2138   1.32.2.9     skrll 	);
   2139   1.32.2.2     skrll 
   2140   1.32.2.2     skrll 	/* give driver a chance to setup state like ni_txrate */
   2141   1.32.2.9     skrll 	if (ic->ic_newassoc != NULL)
   2142  1.32.2.10  christos 		ic->ic_newassoc(ni, newassoc);
   2143   1.32.2.9     skrll 	ni->ni_inact_reload = ic->ic_inact_auth;
   2144   1.32.2.9     skrll 	ni->ni_inact = ni->ni_inact_reload;
   2145   1.32.2.2     skrll 	IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_SUCCESS);
   2146   1.32.2.9     skrll 	/* tell the authenticator about new station */
   2147   1.32.2.9     skrll 	if (ic->ic_auth->ia_node_join != NULL)
   2148   1.32.2.9     skrll 		ic->ic_auth->ia_node_join(ic, ni);
   2149   1.32.2.9     skrll 	ieee80211_notify_node_join(ic, ni, newassoc);
   2150   1.32.2.9     skrll }
   2151   1.32.2.9     skrll 
   2152   1.32.2.9     skrll /*
   2153   1.32.2.9     skrll  * Handle a station leaving an 11g network.
   2154   1.32.2.9     skrll  */
   2155   1.32.2.9     skrll static void
   2156   1.32.2.9     skrll ieee80211_node_leave_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
   2157   1.32.2.9     skrll {
   2158   1.32.2.9     skrll 
   2159  1.32.2.10  christos 	IASSERT(ic->ic_curmode == IEEE80211_MODE_11G,
   2160  1.32.2.10  christos 	     ("not in 11g, bss %u:0x%x, curmode %u", ni->ni_chan->ic_freq,
   2161  1.32.2.10  christos 	      ni->ni_chan->ic_flags, ic->ic_curmode));
   2162   1.32.2.9     skrll 
   2163   1.32.2.9     skrll 	/*
   2164   1.32.2.9     skrll 	 * If a long slot station do the slot time bookkeeping.
   2165   1.32.2.9     skrll 	 */
   2166   1.32.2.9     skrll 	if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
   2167   1.32.2.9     skrll 		IASSERT(ic->ic_longslotsta > 0,
   2168   1.32.2.9     skrll 		    ("bogus long slot station count %d", ic->ic_longslotsta));
   2169   1.32.2.9     skrll 		ic->ic_longslotsta--;
   2170   1.32.2.9     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2171   1.32.2.9     skrll 		    "[%s] long slot time station leaves, count now %d\n",
   2172   1.32.2.9     skrll 		    ether_sprintf(ni->ni_macaddr), ic->ic_longslotsta);
   2173   1.32.2.9     skrll 		if (ic->ic_longslotsta == 0) {
   2174   1.32.2.9     skrll 			/*
   2175   1.32.2.9     skrll 			 * Re-enable use of short slot time if supported
   2176   1.32.2.9     skrll 			 * and not operating in IBSS mode (per spec).
   2177   1.32.2.9     skrll 			 */
   2178   1.32.2.9     skrll 			if ((ic->ic_caps & IEEE80211_C_SHSLOT) &&
   2179   1.32.2.9     skrll 			    ic->ic_opmode != IEEE80211_M_IBSS) {
   2180   1.32.2.9     skrll 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2181   1.32.2.9     skrll 				    "%s: re-enable use of short slot time\n",
   2182   1.32.2.9     skrll 				    __func__);
   2183   1.32.2.9     skrll 				ieee80211_set_shortslottime(ic, 1);
   2184   1.32.2.9     skrll 			}
   2185   1.32.2.9     skrll 		}
   2186   1.32.2.9     skrll 	}
   2187   1.32.2.9     skrll 	/*
   2188   1.32.2.9     skrll 	 * If a non-ERP station do the protection-related bookkeeping.
   2189   1.32.2.9     skrll 	 */
   2190   1.32.2.9     skrll 	if ((ni->ni_flags & IEEE80211_NODE_ERP) == 0) {
   2191   1.32.2.9     skrll 		IASSERT(ic->ic_nonerpsta > 0,
   2192   1.32.2.9     skrll 		    ("bogus non-ERP station count %d", ic->ic_nonerpsta));
   2193   1.32.2.9     skrll 		ic->ic_nonerpsta--;
   2194   1.32.2.9     skrll 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2195   1.32.2.9     skrll 		    "[%s] non-ERP station leaves, count now %d\n",
   2196   1.32.2.9     skrll 		    ether_sprintf(ni->ni_macaddr), ic->ic_nonerpsta);
   2197   1.32.2.9     skrll 		if (ic->ic_nonerpsta == 0) {
   2198   1.32.2.9     skrll 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2199   1.32.2.9     skrll 				"%s: disable use of protection\n", __func__);
   2200   1.32.2.9     skrll 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
   2201   1.32.2.9     skrll 			/* XXX verify mode? */
   2202   1.32.2.9     skrll 			if (ic->ic_caps & IEEE80211_C_SHPREAMBLE) {
   2203   1.32.2.9     skrll 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
   2204   1.32.2.9     skrll 				    "%s: re-enable use of short preamble\n",
   2205   1.32.2.9     skrll 				    __func__);
   2206   1.32.2.9     skrll 				ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
   2207   1.32.2.9     skrll 				ic->ic_flags &= ~IEEE80211_F_USEBARKER;
   2208   1.32.2.9     skrll 			}
   2209   1.32.2.9     skrll 		}
   2210   1.32.2.9     skrll 	}
   2211   1.32.2.2     skrll }
   2212   1.32.2.2     skrll 
   2213   1.32.2.2     skrll /*
   2214   1.32.2.2     skrll  * Handle bookkeeping for station deauthentication/disassociation
   2215   1.32.2.2     skrll  * when operating as an ap.
   2216   1.32.2.2     skrll  */
   2217   1.32.2.2     skrll void
   2218   1.32.2.2     skrll ieee80211_node_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
   2219   1.32.2.2     skrll {
   2220   1.32.2.9     skrll 	struct ieee80211_node_table *nt = ni->ni_table;
   2221   1.32.2.9     skrll 
   2222   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG,
   2223   1.32.2.9     skrll 	    "[%s] station with aid %d leaves\n",
   2224   1.32.2.9     skrll 	    ether_sprintf(ni->ni_macaddr), IEEE80211_NODE_AID(ni));
   2225   1.32.2.2     skrll 
   2226   1.32.2.9     skrll 	IASSERT(ic->ic_opmode == IEEE80211_M_HOSTAP ||
   2227   1.32.2.9     skrll 		ic->ic_opmode == IEEE80211_M_IBSS ||
   2228   1.32.2.9     skrll 		ic->ic_opmode == IEEE80211_M_AHDEMO,
   2229   1.32.2.9     skrll 		("unexpected operating mode %u", ic->ic_opmode));
   2230   1.32.2.2     skrll 	/*
   2231   1.32.2.2     skrll 	 * If node wasn't previously associated all
   2232   1.32.2.2     skrll 	 * we need to do is reclaim the reference.
   2233   1.32.2.2     skrll 	 */
   2234   1.32.2.9     skrll 	/* XXX ibss mode bypasses 11g and notification */
   2235   1.32.2.2     skrll 	if (ni->ni_associd == 0)
   2236   1.32.2.9     skrll 		goto done;
   2237   1.32.2.9     skrll 	/*
   2238   1.32.2.9     skrll 	 * Tell the authenticator the station is leaving.
   2239   1.32.2.9     skrll 	 * Note that we must do this before yanking the
   2240   1.32.2.9     skrll 	 * association id as the authenticator uses the
   2241   1.32.2.9     skrll 	 * associd to locate it's state block.
   2242   1.32.2.9     skrll 	 */
   2243   1.32.2.9     skrll 	if (ic->ic_auth->ia_node_leave != NULL)
   2244   1.32.2.9     skrll 		ic->ic_auth->ia_node_leave(ic, ni);
   2245   1.32.2.2     skrll 	IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
   2246   1.32.2.2     skrll 	ni->ni_associd = 0;
   2247   1.32.2.9     skrll 	ic->ic_sta_assoc--;
   2248   1.32.2.9     skrll 
   2249  1.32.2.10  christos 	if (ic->ic_curmode == IEEE80211_MODE_11G)
   2250   1.32.2.9     skrll 		ieee80211_node_leave_11g(ic, ni);
   2251   1.32.2.9     skrll 	/*
   2252   1.32.2.9     skrll 	 * Cleanup station state.  In particular clear various
   2253   1.32.2.9     skrll 	 * state that might otherwise be reused if the node
   2254   1.32.2.9     skrll 	 * is reused before the reference count goes to zero
   2255   1.32.2.9     skrll 	 * (and memory is reclaimed).
   2256   1.32.2.9     skrll 	 */
   2257   1.32.2.9     skrll 	ieee80211_sta_leave(ic, ni);
   2258   1.32.2.9     skrll done:
   2259   1.32.2.9     skrll 	/*
   2260   1.32.2.9     skrll 	 * Remove the node from any table it's recorded in and
   2261   1.32.2.9     skrll 	 * drop the caller's reference.  Removal from the table
   2262   1.32.2.9     skrll 	 * is important to insure the node is not reprocessed
   2263   1.32.2.9     skrll 	 * for inactivity.
   2264   1.32.2.9     skrll 	 */
   2265   1.32.2.9     skrll 	if (nt != NULL) {
   2266   1.32.2.9     skrll 		IEEE80211_NODE_LOCK(nt);
   2267   1.32.2.9     skrll 		node_reclaim(nt, ni);
   2268   1.32.2.9     skrll 		IEEE80211_NODE_UNLOCK(nt);
   2269   1.32.2.9     skrll 	} else
   2270   1.32.2.9     skrll 		ieee80211_free_node(ni);
   2271   1.32.2.9     skrll }
   2272   1.32.2.9     skrll 
   2273   1.32.2.9     skrll u_int8_t
   2274   1.32.2.9     skrll ieee80211_getrssi(struct ieee80211com *ic)
   2275   1.32.2.9     skrll {
   2276   1.32.2.9     skrll #define	NZ(x)	((x) == 0 ? 1 : (x))
   2277   1.32.2.9     skrll 	struct ieee80211_node_table *nt = &ic->ic_sta;
   2278   1.32.2.9     skrll 	u_int32_t rssi_samples, rssi_total;
   2279   1.32.2.9     skrll 	struct ieee80211_node *ni;
   2280   1.32.2.9     skrll 
   2281   1.32.2.9     skrll 	rssi_total = 0;
   2282   1.32.2.9     skrll 	rssi_samples = 0;
   2283   1.32.2.9     skrll 	switch (ic->ic_opmode) {
   2284   1.32.2.9     skrll 	case IEEE80211_M_IBSS:		/* average of all ibss neighbors */
   2285   1.32.2.9     skrll 		/* XXX locking */
   2286   1.32.2.9     skrll 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list)
   2287   1.32.2.9     skrll 			if (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) {
   2288   1.32.2.9     skrll 				rssi_samples++;
   2289   1.32.2.9     skrll 				rssi_total += ic->ic_node_getrssi(ni);
   2290   1.32.2.9     skrll 			}
   2291   1.32.2.9     skrll 		break;
   2292   1.32.2.9     skrll 	case IEEE80211_M_AHDEMO:	/* average of all neighbors */
   2293   1.32.2.9     skrll 		/* XXX locking */
   2294   1.32.2.9     skrll 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
   2295   1.32.2.9     skrll 			rssi_samples++;
   2296   1.32.2.9     skrll 			rssi_total += ic->ic_node_getrssi(ni);
   2297   1.32.2.9     skrll 		}
   2298   1.32.2.9     skrll 		break;
   2299   1.32.2.9     skrll 	case IEEE80211_M_HOSTAP:	/* average of all associated stations */
   2300   1.32.2.9     skrll #ifndef IEEE80211_NO_HOSTAP
   2301   1.32.2.9     skrll 		/* XXX locking */
   2302   1.32.2.9     skrll 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list)
   2303   1.32.2.9     skrll 			if (IEEE80211_AID(ni->ni_associd) != 0) {
   2304   1.32.2.9     skrll 				rssi_samples++;
   2305   1.32.2.9     skrll 				rssi_total += ic->ic_node_getrssi(ni);
   2306   1.32.2.9     skrll 			}
   2307   1.32.2.9     skrll #endif /* !IEEE80211_NO_HOSTAP */
   2308   1.32.2.9     skrll 		break;
   2309   1.32.2.9     skrll 	case IEEE80211_M_MONITOR:	/* XXX */
   2310   1.32.2.9     skrll 	case IEEE80211_M_STA:		/* use stats from associated ap */
   2311   1.32.2.9     skrll 	default:
   2312   1.32.2.9     skrll 		if (ic->ic_bss != NULL)
   2313   1.32.2.9     skrll 			rssi_total = ic->ic_node_getrssi(ic->ic_bss);
   2314   1.32.2.9     skrll 		rssi_samples = 1;
   2315   1.32.2.9     skrll 		break;
   2316   1.32.2.9     skrll 	}
   2317   1.32.2.9     skrll 	return rssi_total / NZ(rssi_samples);
   2318   1.32.2.9     skrll #undef NZ
   2319   1.32.2.9     skrll }
   2320   1.32.2.9     skrll 
   2321   1.32.2.9     skrll /*
   2322   1.32.2.9     skrll  * Indicate whether there are frames queued for a station in power-save mode.
   2323   1.32.2.9     skrll  */
   2324   1.32.2.9     skrll static void
   2325  1.32.2.10  christos ieee80211_set_tim(struct ieee80211_node *ni, int set)
   2326   1.32.2.9     skrll {
   2327  1.32.2.10  christos 	struct ieee80211com *ic = ni->ni_ic;
   2328   1.32.2.9     skrll 	u_int16_t aid;
   2329   1.32.2.9     skrll 
   2330   1.32.2.9     skrll 	IASSERT(ic->ic_opmode == IEEE80211_M_HOSTAP ||
   2331   1.32.2.9     skrll 		ic->ic_opmode == IEEE80211_M_IBSS,
   2332   1.32.2.9     skrll 		("operating mode %u", ic->ic_opmode));
   2333   1.32.2.9     skrll 
   2334   1.32.2.9     skrll 	aid = IEEE80211_AID(ni->ni_associd);
   2335   1.32.2.9     skrll 	IASSERT(aid < ic->ic_max_aid,
   2336   1.32.2.9     skrll 		("bogus aid %u, max %u", aid, ic->ic_max_aid));
   2337   1.32.2.9     skrll 
   2338   1.32.2.9     skrll 	IEEE80211_BEACON_LOCK(ic);
   2339   1.32.2.9     skrll 	if (set != (isset(ic->ic_tim_bitmap, aid) != 0)) {
   2340   1.32.2.9     skrll 		if (set) {
   2341   1.32.2.9     skrll 			setbit(ic->ic_tim_bitmap, aid);
   2342   1.32.2.9     skrll 			ic->ic_ps_pending++;
   2343   1.32.2.9     skrll 		} else {
   2344   1.32.2.9     skrll 			clrbit(ic->ic_tim_bitmap, aid);
   2345   1.32.2.9     skrll 			ic->ic_ps_pending--;
   2346   1.32.2.9     skrll 		}
   2347   1.32.2.9     skrll 		ic->ic_flags |= IEEE80211_F_TIMUPDATE;
   2348   1.32.2.9     skrll 	}
   2349   1.32.2.9     skrll 	IEEE80211_BEACON_UNLOCK(ic);
   2350   1.32.2.9     skrll }
   2351   1.32.2.9     skrll 
   2352   1.32.2.9     skrll /*
   2353   1.32.2.9     skrll  * Node table support.
   2354   1.32.2.9     skrll  */
   2355   1.32.2.9     skrll 
   2356   1.32.2.9     skrll static void
   2357   1.32.2.9     skrll ieee80211_node_table_init(struct ieee80211com *ic,
   2358   1.32.2.9     skrll 	struct ieee80211_node_table *nt,
   2359  1.32.2.10  christos 	const char *name, int inact, int keyixmax,
   2360   1.32.2.9     skrll 	void (*timeout)(struct ieee80211_node_table *))
   2361   1.32.2.9     skrll {
   2362   1.32.2.9     skrll 
   2363   1.32.2.9     skrll 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
   2364   1.32.2.9     skrll 		"%s %s table, inact %u\n", __func__, name, inact);
   2365   1.32.2.9     skrll 
   2366   1.32.2.9     skrll 	nt->nt_ic = ic;
   2367   1.32.2.9     skrll 	/* XXX need unit */
   2368   1.32.2.9     skrll 	IEEE80211_NODE_LOCK_INIT(nt, ic->ic_ifp->if_xname);
   2369   1.32.2.9     skrll 	IEEE80211_SCAN_LOCK_INIT(nt, ic->ic_ifp->if_xname);
   2370   1.32.2.9     skrll 	TAILQ_INIT(&nt->nt_node);
   2371   1.32.2.9     skrll 	nt->nt_name = name;
   2372   1.32.2.9     skrll 	nt->nt_scangen = 1;
   2373   1.32.2.9     skrll 	nt->nt_inact_init = inact;
   2374   1.32.2.9     skrll 	nt->nt_timeout = timeout;
   2375  1.32.2.10  christos 	nt->nt_keyixmax = keyixmax;
   2376  1.32.2.10  christos 	if (nt->nt_keyixmax > 0) {
   2377  1.32.2.10  christos 		MALLOC(nt->nt_keyixmap, struct ieee80211_node **,
   2378  1.32.2.10  christos 			keyixmax * sizeof(struct ieee80211_node *),
   2379  1.32.2.10  christos 			M_80211_NODE, M_NOWAIT | M_ZERO);
   2380  1.32.2.10  christos 		if (nt->nt_keyixmap == NULL)
   2381  1.32.2.10  christos 			if_printf(ic->ic_ifp,
   2382  1.32.2.10  christos 			    "Cannot allocate key index map with %u entries\n",
   2383  1.32.2.10  christos 			    keyixmax);
   2384  1.32.2.10  christos 	} else
   2385  1.32.2.10  christos 		nt->nt_keyixmap = NULL;
   2386   1.32.2.9     skrll }
   2387   1.32.2.9     skrll 
   2388   1.32.2.9     skrll void
   2389   1.32.2.9     skrll ieee80211_node_table_reset(struct ieee80211_node_table *nt)
   2390   1.32.2.9     skrll {
   2391   1.32.2.9     skrll 
   2392   1.32.2.9     skrll 	IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
   2393   1.32.2.9     skrll 		"%s %s table\n", __func__, nt->nt_name);
   2394   1.32.2.9     skrll 
   2395   1.32.2.9     skrll 	IEEE80211_NODE_LOCK(nt);
   2396   1.32.2.9     skrll 	nt->nt_inact_timer = 0;
   2397   1.32.2.9     skrll 	ieee80211_free_allnodes_locked(nt);
   2398   1.32.2.9     skrll 	IEEE80211_NODE_UNLOCK(nt);
   2399   1.32.2.9     skrll }
   2400   1.32.2.9     skrll 
   2401   1.32.2.9     skrll static void
   2402   1.32.2.9     skrll ieee80211_node_table_cleanup(struct ieee80211_node_table *nt)
   2403   1.32.2.9     skrll {
   2404   1.32.2.9     skrll 
   2405   1.32.2.9     skrll 	IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
   2406   1.32.2.9     skrll 		"%s %s table\n", __func__, nt->nt_name);
   2407   1.32.2.9     skrll 
   2408  1.32.2.10  christos 	IEEE80211_NODE_LOCK(nt);
   2409   1.32.2.9     skrll 	ieee80211_free_allnodes_locked(nt);
   2410  1.32.2.10  christos 	if (nt->nt_keyixmap != NULL) {
   2411  1.32.2.10  christos 		/* XXX verify all entries are NULL */
   2412  1.32.2.10  christos 		int i;
   2413  1.32.2.10  christos 		for (i = 0; i < nt->nt_keyixmax; i++)
   2414  1.32.2.10  christos 			if (nt->nt_keyixmap[i] != NULL)
   2415  1.32.2.10  christos 				printf("%s: %s[%u] still active\n", __func__,
   2416  1.32.2.10  christos 					nt->nt_name, i);
   2417  1.32.2.10  christos 		FREE(nt->nt_keyixmap, M_80211_NODE);
   2418  1.32.2.10  christos 		nt->nt_keyixmap = NULL;
   2419  1.32.2.10  christos 	}
   2420   1.32.2.9     skrll 	IEEE80211_SCAN_LOCK_DESTROY(nt);
   2421   1.32.2.9     skrll 	IEEE80211_NODE_LOCK_DESTROY(nt);
   2422   1.32.2.2     skrll }
   2423