xref: /freebsd/sys/net80211/ieee80211_node.c (revision 5b16c28c42e1a6521f4b4cbea5ef810f46a9515f)
11a1e1d21SSam Leffler /*-
27535e66aSSam Leffler  * Copyright (c) 2001 Atsushi Onoe
310ad9a77SSam Leffler  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
41a1e1d21SSam Leffler  * All rights reserved.
51a1e1d21SSam Leffler  *
61a1e1d21SSam Leffler  * Redistribution and use in source and binary forms, with or without
71a1e1d21SSam Leffler  * modification, are permitted provided that the following conditions
81a1e1d21SSam Leffler  * are met:
91a1e1d21SSam Leffler  * 1. Redistributions of source code must retain the above copyright
107535e66aSSam Leffler  *    notice, this list of conditions and the following disclaimer.
117535e66aSSam Leffler  * 2. Redistributions in binary form must reproduce the above copyright
127535e66aSSam Leffler  *    notice, this list of conditions and the following disclaimer in the
137535e66aSSam Leffler  *    documentation and/or other materials provided with the distribution.
141a1e1d21SSam Leffler  *
157535e66aSSam Leffler  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
167535e66aSSam Leffler  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
177535e66aSSam Leffler  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
187535e66aSSam Leffler  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
197535e66aSSam Leffler  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
207535e66aSSam Leffler  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
217535e66aSSam Leffler  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
227535e66aSSam Leffler  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
237535e66aSSam Leffler  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
247535e66aSSam Leffler  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
251a1e1d21SSam Leffler  */
261a1e1d21SSam Leffler 
271a1e1d21SSam Leffler #include <sys/cdefs.h>
281a1e1d21SSam Leffler __FBSDID("$FreeBSD$");
291a1e1d21SSam Leffler 
30b032f27cSSam Leffler #include "opt_wlan.h"
31b032f27cSSam Leffler 
321a1e1d21SSam Leffler #include <sys/param.h>
331a1e1d21SSam Leffler #include <sys/systm.h>
341a1e1d21SSam Leffler #include <sys/mbuf.h>
351a1e1d21SSam Leffler #include <sys/malloc.h>
361a1e1d21SSam Leffler #include <sys/kernel.h>
371a1e1d21SSam Leffler 
388a1b9b6aSSam Leffler #include <sys/socket.h>
391a1e1d21SSam Leffler 
401a1e1d21SSam Leffler #include <net/if.h>
411a1e1d21SSam Leffler #include <net/if_media.h>
421a1e1d21SSam Leffler #include <net/ethernet.h>
431a1e1d21SSam Leffler 
441a1e1d21SSam Leffler #include <net80211/ieee80211_var.h>
45b032f27cSSam Leffler #include <net80211/ieee80211_input.h>
46616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
47616190d0SSam Leffler #include <net80211/ieee80211_superg.h>
48616190d0SSam Leffler #endif
4910ad9a77SSam Leffler #ifdef IEEE80211_SUPPORT_TDMA
5010ad9a77SSam Leffler #include <net80211/ieee80211_tdma.h>
5110ad9a77SSam Leffler #endif
52b032f27cSSam Leffler #include <net80211/ieee80211_wds.h>
531a1e1d21SSam Leffler 
541a1e1d21SSam Leffler #include <net/bpf.h>
551a1e1d21SSam Leffler 
567268fa64SSam Leffler /*
577268fa64SSam Leffler  * Association id's are managed with a bit vector.
587268fa64SSam Leffler  */
59b032f27cSSam Leffler #define	IEEE80211_AID_SET(_vap, b) \
60b032f27cSSam Leffler 	((_vap)->iv_aid_bitmap[IEEE80211_AID(b) / 32] |= \
61b032f27cSSam Leffler 		(1 << (IEEE80211_AID(b) % 32)))
62b032f27cSSam Leffler #define	IEEE80211_AID_CLR(_vap, b) \
63b032f27cSSam Leffler 	((_vap)->iv_aid_bitmap[IEEE80211_AID(b) / 32] &= \
64b032f27cSSam Leffler 		~(1 << (IEEE80211_AID(b) % 32)))
65b032f27cSSam Leffler #define	IEEE80211_AID_ISSET(_vap, b) \
66b032f27cSSam Leffler 	((_vap)->iv_aid_bitmap[IEEE80211_AID(b) / 32] & (1 << (IEEE80211_AID(b) % 32)))
677268fa64SSam Leffler 
68132142c5SDiomidis Spinellis #ifdef IEEE80211_DEBUG_REFCNT
69132142c5SDiomidis Spinellis #define REFCNT_LOC "%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line
70132142c5SDiomidis Spinellis #else
71132142c5SDiomidis Spinellis #define REFCNT_LOC "%s %p<%s> refcnt %d\n", __func__
72132142c5SDiomidis Spinellis #endif
73132142c5SDiomidis Spinellis 
7468e8e04eSSam Leffler static int ieee80211_sta_join1(struct ieee80211_node *);
7568e8e04eSSam Leffler 
7638c208f8SSam Leffler static struct ieee80211_node *node_alloc(struct ieee80211vap *,
7738c208f8SSam Leffler 	const uint8_t [IEEE80211_ADDR_LEN]);
788a1b9b6aSSam Leffler static void node_cleanup(struct ieee80211_node *);
798a1b9b6aSSam Leffler static void node_free(struct ieee80211_node *);
80b032f27cSSam Leffler static void node_age(struct ieee80211_node *);
8168e8e04eSSam Leffler static int8_t node_getrssi(const struct ieee80211_node *);
8268e8e04eSSam Leffler static void node_getsignal(const struct ieee80211_node *, int8_t *, int8_t *);
83b032f27cSSam Leffler static void node_getmimoinfo(const struct ieee80211_node *,
84b032f27cSSam Leffler 	struct ieee80211_mimo_info *);
851a1e1d21SSam Leffler 
868a1b9b6aSSam Leffler static void _ieee80211_free_node(struct ieee80211_node *);
878a1b9b6aSSam Leffler 
888a1b9b6aSSam Leffler static void ieee80211_node_table_init(struct ieee80211com *ic,
89c1225b52SSam Leffler 	struct ieee80211_node_table *nt, const char *name,
9068e8e04eSSam Leffler 	int inact, int keymaxix);
91b032f27cSSam Leffler static void ieee80211_node_table_reset(struct ieee80211_node_table *,
92b032f27cSSam Leffler 	struct ieee80211vap *);
938a1b9b6aSSam Leffler static void ieee80211_node_table_cleanup(struct ieee80211_node_table *nt);
94b105a069SSam Leffler static void ieee80211_erp_timeout(struct ieee80211com *);
951a1e1d21SSam Leffler 
9632346d60SSam Leffler MALLOC_DEFINE(M_80211_NODE, "80211node", "802.11 node state");
97b032f27cSSam Leffler MALLOC_DEFINE(M_80211_NODE_IE, "80211nodeie", "802.11 node ie");
9837c150c4SSam Leffler 
991a1e1d21SSam Leffler void
1008a1b9b6aSSam Leffler ieee80211_node_attach(struct ieee80211com *ic)
1011a1e1d21SSam Leffler {
1025b16c28cSSam Leffler 	/* XXX really want maxlen enforced per-sta */
1035b16c28cSSam Leffler 	ieee80211_ageq_init(&ic->ic_stageq, ic->ic_max_keyix * 8,
1045b16c28cSSam Leffler 	    "802.11 staging q");
105b032f27cSSam Leffler 	ieee80211_node_table_init(ic, &ic->ic_sta, "station",
106b032f27cSSam Leffler 		IEEE80211_INACT_INIT, ic->ic_max_keyix);
107b032f27cSSam Leffler 	callout_init(&ic->ic_inact, CALLOUT_MPSAFE);
108b032f27cSSam Leffler 	callout_reset(&ic->ic_inact, IEEE80211_INACT_WAIT*hz,
109b032f27cSSam Leffler 		ieee80211_node_timeout, ic);
1101a1e1d21SSam Leffler 
1118a1b9b6aSSam Leffler 	ic->ic_node_alloc = node_alloc;
1128a1b9b6aSSam Leffler 	ic->ic_node_free = node_free;
1138a1b9b6aSSam Leffler 	ic->ic_node_cleanup = node_cleanup;
114b032f27cSSam Leffler 	ic->ic_node_age = node_age;
115b032f27cSSam Leffler 	ic->ic_node_drain = node_age;		/* NB: same as age */
1168a1b9b6aSSam Leffler 	ic->ic_node_getrssi = node_getrssi;
11768e8e04eSSam Leffler 	ic->ic_node_getsignal = node_getsignal;
118b032f27cSSam Leffler 	ic->ic_node_getmimoinfo = node_getmimoinfo;
1198a1b9b6aSSam Leffler 
120b032f27cSSam Leffler 	/*
121b032f27cSSam Leffler 	 * Set flags to be propagated to all vap's;
122b032f27cSSam Leffler 	 * these define default behaviour/configuration.
123b032f27cSSam Leffler 	 */
124c066143cSSam Leffler 	ic->ic_flags_ext |= IEEE80211_FEXT_INACT; /* inactivity processing */
125c1225b52SSam Leffler }
126c1225b52SSam Leffler 
127c1225b52SSam Leffler void
1288a1b9b6aSSam Leffler ieee80211_node_detach(struct ieee80211com *ic)
1291a1e1d21SSam Leffler {
1301a1e1d21SSam Leffler 
131b032f27cSSam Leffler 	callout_drain(&ic->ic_inact);
132acc4f7f5SSam Leffler 	ieee80211_node_table_cleanup(&ic->ic_sta);
1335b16c28cSSam Leffler 	ieee80211_ageq_cleanup(&ic->ic_stageq);
134b032f27cSSam Leffler }
135b032f27cSSam Leffler 
136b032f27cSSam Leffler void
137b032f27cSSam Leffler ieee80211_node_vattach(struct ieee80211vap *vap)
138b032f27cSSam Leffler {
139b032f27cSSam Leffler 	/* NB: driver can override */
140b032f27cSSam Leffler 	vap->iv_max_aid = IEEE80211_AID_DEF;
141b032f27cSSam Leffler 
142b032f27cSSam Leffler 	/* default station inactivity timer setings */
143b032f27cSSam Leffler 	vap->iv_inact_init = IEEE80211_INACT_INIT;
144b032f27cSSam Leffler 	vap->iv_inact_auth = IEEE80211_INACT_AUTH;
145b032f27cSSam Leffler 	vap->iv_inact_run = IEEE80211_INACT_RUN;
146b032f27cSSam Leffler 	vap->iv_inact_probe = IEEE80211_INACT_PROBE;
147be1054edSSam Leffler 
148be1054edSSam Leffler 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_INACT,
149be1054edSSam Leffler 	    "%s: init %u auth %u run %u probe %u\n", __func__,
150be1054edSSam Leffler 	    vap->iv_inact_init, vap->iv_inact_auth,
151be1054edSSam Leffler 	    vap->iv_inact_run, vap->iv_inact_probe);
152b032f27cSSam Leffler }
153b032f27cSSam Leffler 
154b032f27cSSam Leffler void
155b032f27cSSam Leffler ieee80211_node_latevattach(struct ieee80211vap *vap)
156b032f27cSSam Leffler {
157b032f27cSSam Leffler 	if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
158b032f27cSSam Leffler 		/* XXX should we allow max aid to be zero? */
159b032f27cSSam Leffler 		if (vap->iv_max_aid < IEEE80211_AID_MIN) {
160b032f27cSSam Leffler 			vap->iv_max_aid = IEEE80211_AID_MIN;
161b032f27cSSam Leffler 			if_printf(vap->iv_ifp,
162b032f27cSSam Leffler 			    "WARNING: max aid too small, changed to %d\n",
163b032f27cSSam Leffler 			    vap->iv_max_aid);
164b032f27cSSam Leffler 		}
165e2126decSSam Leffler 		vap->iv_aid_bitmap = (uint32_t *) malloc(
166c5abbba3SDag-Erling Smørgrav 			howmany(vap->iv_max_aid, 32) * sizeof(uint32_t),
167b032f27cSSam Leffler 			M_80211_NODE, M_NOWAIT | M_ZERO);
168b032f27cSSam Leffler 		if (vap->iv_aid_bitmap == NULL) {
169b032f27cSSam Leffler 			/* XXX no way to recover */
170b032f27cSSam Leffler 			printf("%s: no memory for AID bitmap, max aid %d!\n",
171b032f27cSSam Leffler 			    __func__, vap->iv_max_aid);
172b032f27cSSam Leffler 			vap->iv_max_aid = 0;
173b032f27cSSam Leffler 		}
174b032f27cSSam Leffler 	}
175b032f27cSSam Leffler 
176b032f27cSSam Leffler 	ieee80211_reset_bss(vap);
177b032f27cSSam Leffler 
178b032f27cSSam Leffler 	vap->iv_auth = ieee80211_authenticator_get(vap->iv_bss->ni_authmode);
179b032f27cSSam Leffler }
180b032f27cSSam Leffler 
181b032f27cSSam Leffler void
182b032f27cSSam Leffler ieee80211_node_vdetach(struct ieee80211vap *vap)
183b032f27cSSam Leffler {
184b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
185b032f27cSSam Leffler 
186b032f27cSSam Leffler 	ieee80211_node_table_reset(&ic->ic_sta, vap);
187b032f27cSSam Leffler 	if (vap->iv_bss != NULL) {
188b032f27cSSam Leffler 		ieee80211_free_node(vap->iv_bss);
189b032f27cSSam Leffler 		vap->iv_bss = NULL;
190b032f27cSSam Leffler 	}
191b032f27cSSam Leffler 	if (vap->iv_aid_bitmap != NULL) {
192e2126decSSam Leffler 		free(vap->iv_aid_bitmap, M_80211_NODE);
193b032f27cSSam Leffler 		vap->iv_aid_bitmap = NULL;
1948a1b9b6aSSam Leffler 	}
1958a1b9b6aSSam Leffler }
1968a1b9b6aSSam Leffler 
1978a1b9b6aSSam Leffler /*
1988a1b9b6aSSam Leffler  * Port authorize/unauthorize interfaces for use by an authenticator.
1998a1b9b6aSSam Leffler  */
2008a1b9b6aSSam Leffler 
2018a1b9b6aSSam Leffler void
202e4918ecdSSam Leffler ieee80211_node_authorize(struct ieee80211_node *ni)
2038a1b9b6aSSam Leffler {
204be1054edSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
205be1054edSSam Leffler 
2068a1b9b6aSSam Leffler 	ni->ni_flags |= IEEE80211_NODE_AUTH;
207be1054edSSam Leffler 	ni->ni_inact_reload = vap->iv_inact_run;
208c066143cSSam Leffler 	ni->ni_inact = ni->ni_inact_reload;
209be1054edSSam Leffler 
210be1054edSSam Leffler 	IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
211be1054edSSam Leffler 	    "%s: inact_reload %u", __func__, ni->ni_inact_reload);
2128a1b9b6aSSam Leffler }
2138a1b9b6aSSam Leffler 
2148a1b9b6aSSam Leffler void
215e4918ecdSSam Leffler ieee80211_node_unauthorize(struct ieee80211_node *ni)
2168a1b9b6aSSam Leffler {
217be1054edSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
218be1054edSSam Leffler 
2198a1b9b6aSSam Leffler 	ni->ni_flags &= ~IEEE80211_NODE_AUTH;
220be1054edSSam Leffler 	ni->ni_inact_reload = vap->iv_inact_auth;
221c066143cSSam Leffler 	if (ni->ni_inact > ni->ni_inact_reload)
222c066143cSSam Leffler 		ni->ni_inact = ni->ni_inact_reload;
223be1054edSSam Leffler 
224be1054edSSam Leffler 	IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
225be1054edSSam Leffler 	    "%s: inact_reload %u inact %u", __func__,
226be1054edSSam Leffler 	    ni->ni_inact_reload, ni->ni_inact);
2278a1b9b6aSSam Leffler }
2288a1b9b6aSSam Leffler 
2298a1b9b6aSSam Leffler /*
23001a03542SSam Leffler  * Fix tx parameters for a node according to ``association state''.
23101a03542SSam Leffler  */
232d77148fbSSam Leffler void
233d77148fbSSam Leffler ieee80211_node_setuptxparms(struct ieee80211_node *ni)
23401a03542SSam Leffler {
23501a03542SSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
236f76cde95SSam Leffler 	enum ieee80211_phymode mode;
23701a03542SSam Leffler 
23801a03542SSam Leffler 	if (ni->ni_flags & IEEE80211_NODE_HT) {
23901a03542SSam Leffler 		if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan))
240f76cde95SSam Leffler 			mode = IEEE80211_MODE_11NA;
24101a03542SSam Leffler 		else
242f76cde95SSam Leffler 			mode = IEEE80211_MODE_11NG;
24301a03542SSam Leffler 	} else {				/* legacy rate handling */
244f76cde95SSam Leffler 		if (IEEE80211_IS_CHAN_ST(ni->ni_chan))
245f76cde95SSam Leffler 			mode = IEEE80211_MODE_STURBO_A;
2466a76ae21SSam Leffler 		else if (IEEE80211_IS_CHAN_HALF(ni->ni_chan))
2476a76ae21SSam Leffler 			mode = IEEE80211_MODE_HALF;
2486a76ae21SSam Leffler 		else if (IEEE80211_IS_CHAN_QUARTER(ni->ni_chan))
2496a76ae21SSam Leffler 			mode = IEEE80211_MODE_QUARTER;
250c5262b82SSam Leffler 		/* NB: 108A should be handled as 11a */
251f76cde95SSam Leffler 		else if (IEEE80211_IS_CHAN_A(ni->ni_chan))
252f76cde95SSam Leffler 			mode = IEEE80211_MODE_11A;
253c5262b82SSam Leffler 		else if (IEEE80211_IS_CHAN_108G(ni->ni_chan) ||
254c5262b82SSam Leffler 		    (ni->ni_flags & IEEE80211_NODE_ERP))
255f76cde95SSam Leffler 			mode = IEEE80211_MODE_11G;
25601a03542SSam Leffler 		else
257f76cde95SSam Leffler 			mode = IEEE80211_MODE_11B;
25801a03542SSam Leffler 	}
259f76cde95SSam Leffler 	ni->ni_txparms = &vap->iv_txparms[mode];
26001a03542SSam Leffler }
26101a03542SSam Leffler 
26201a03542SSam Leffler /*
2638a1b9b6aSSam Leffler  * Set/change the channel.  The rate set is also updated as
2648a1b9b6aSSam Leffler  * to insure a consistent view by drivers.
265b032f27cSSam Leffler  * XXX should be private but hostap needs it to deal with CSA
2668a1b9b6aSSam Leffler  */
267b032f27cSSam Leffler void
268b032f27cSSam Leffler ieee80211_node_set_chan(struct ieee80211_node *ni,
269b032f27cSSam Leffler 	struct ieee80211_channel *chan)
2708a1b9b6aSSam Leffler {
271b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
27201a03542SSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
27301a03542SSam Leffler 	enum ieee80211_phymode mode;
27468e8e04eSSam Leffler 
275b032f27cSSam Leffler 	KASSERT(chan != IEEE80211_CHAN_ANYC, ("no channel"));
276b032f27cSSam Leffler 
2778a1b9b6aSSam Leffler 	ni->ni_chan = chan;
27801a03542SSam Leffler 	mode = ieee80211_chan2mode(chan);
27968e8e04eSSam Leffler 	if (IEEE80211_IS_CHAN_HT(chan)) {
28068e8e04eSSam Leffler 		/*
28168e8e04eSSam Leffler 		 * XXX Gotta be careful here; the rate set returned by
28268e8e04eSSam Leffler 		 * ieee80211_get_suprates is actually any HT rate
28368e8e04eSSam Leffler 		 * set so blindly copying it will be bad.  We must
28468e8e04eSSam Leffler 		 * install the legacy rate est in ni_rates and the
28568e8e04eSSam Leffler 		 * HT rate set in ni_htrates.
28668e8e04eSSam Leffler 		 */
28768e8e04eSSam Leffler 		ni->ni_htrates = *ieee80211_get_suphtrates(ic, chan);
28801a03542SSam Leffler 		/*
28901a03542SSam Leffler 		 * Setup bss tx parameters based on operating mode.  We
29001a03542SSam Leffler 		 * use legacy rates when operating in a mixed HT+non-HT bss
29101a03542SSam Leffler 		 * and non-ERP rates in 11g for mixed ERP+non-ERP bss.
29201a03542SSam Leffler 		 */
29301a03542SSam Leffler 		if (mode == IEEE80211_MODE_11NA &&
2942bfc8a91SSam Leffler 		    (vap->iv_flags_ht & IEEE80211_FHT_PUREN) == 0)
29501a03542SSam Leffler 			mode = IEEE80211_MODE_11A;
29601a03542SSam Leffler 		else if (mode == IEEE80211_MODE_11NG &&
2972bfc8a91SSam Leffler 		    (vap->iv_flags_ht & IEEE80211_FHT_PUREN) == 0)
29801a03542SSam Leffler 			mode = IEEE80211_MODE_11G;
29901a03542SSam Leffler 		if (mode == IEEE80211_MODE_11G &&
30001a03542SSam Leffler 		    (vap->iv_flags & IEEE80211_F_PUREG) == 0)
30101a03542SSam Leffler 			mode = IEEE80211_MODE_11B;
30268e8e04eSSam Leffler 	}
30301a03542SSam Leffler 	ni->ni_txparms = &vap->iv_txparms[mode];
30441b3c790SSam Leffler 	ni->ni_rates = *ieee80211_get_suprates(ic, chan);
3051a1e1d21SSam Leffler }
3061a1e1d21SSam Leffler 
307f9cd9174SSam Leffler static __inline void
308f9cd9174SSam Leffler copy_bss(struct ieee80211_node *nbss, const struct ieee80211_node *obss)
309f9cd9174SSam Leffler {
310f9cd9174SSam Leffler 	/* propagate useful state */
311f9cd9174SSam Leffler 	nbss->ni_authmode = obss->ni_authmode;
312f9cd9174SSam Leffler 	nbss->ni_txpower = obss->ni_txpower;
313f9cd9174SSam Leffler 	nbss->ni_vlan = obss->ni_vlan;
314f9cd9174SSam Leffler 	/* XXX statistics? */
315b032f27cSSam Leffler 	/* XXX legacy WDS bssid? */
316f9cd9174SSam Leffler }
317f9cd9174SSam Leffler 
3181a1e1d21SSam Leffler void
319b032f27cSSam Leffler ieee80211_create_ibss(struct ieee80211vap* vap, struct ieee80211_channel *chan)
3201a1e1d21SSam Leffler {
321b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
3221a1e1d21SSam Leffler 	struct ieee80211_node *ni;
3238a1b9b6aSSam Leffler 
324b032f27cSSam Leffler 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
325b032f27cSSam Leffler 		"%s: creating ibss on channel %u\n", __func__,
326b032f27cSSam Leffler 		ieee80211_chan2ieee(ic, chan));
3278a1b9b6aSSam Leffler 
328b032f27cSSam Leffler 	ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr);
329acc4f7f5SSam Leffler 	if (ni == NULL) {
330acc4f7f5SSam Leffler 		/* XXX recovery? */
3318a1b9b6aSSam Leffler 		return;
3328a1b9b6aSSam Leffler 	}
333b032f27cSSam Leffler 	IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_myaddr);
334b032f27cSSam Leffler 	ni->ni_esslen = vap->iv_des_ssid[0].len;
335b032f27cSSam Leffler 	memcpy(ni->ni_essid, vap->iv_des_ssid[0].ssid, ni->ni_esslen);
336b032f27cSSam Leffler 	if (vap->iv_bss != NULL)
337b032f27cSSam Leffler 		copy_bss(ni, vap->iv_bss);
338d365f9c7SSam Leffler 	ni->ni_intval = ic->ic_bintval;
339b032f27cSSam Leffler 	if (vap->iv_flags & IEEE80211_F_PRIVACY)
3401a1e1d21SSam Leffler 		ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY;
3411a1e1d21SSam Leffler 	if (ic->ic_phytype == IEEE80211_T_FH) {
3421a1e1d21SSam Leffler 		ni->ni_fhdwell = 200;	/* XXX */
3431a1e1d21SSam Leffler 		ni->ni_fhindex = 1;
3441a1e1d21SSam Leffler 	}
345b032f27cSSam Leffler 	if (vap->iv_opmode == IEEE80211_M_IBSS) {
346b032f27cSSam Leffler 		vap->iv_flags |= IEEE80211_F_SIBSS;
3478a1b9b6aSSam Leffler 		ni->ni_capinfo |= IEEE80211_CAPINFO_IBSS;	/* XXX */
348b032f27cSSam Leffler 		if (vap->iv_flags & IEEE80211_F_DESBSSID)
349b032f27cSSam Leffler 			IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_des_bssid);
350fe49f061SSam Leffler 		else {
351fe49f061SSam Leffler 			get_random_bytes(ni->ni_bssid, IEEE80211_ADDR_LEN);
352fe49f061SSam Leffler 			/* clear group bit, add local bit */
353fe49f061SSam Leffler 			ni->ni_bssid[0] = (ni->ni_bssid[0] &~ 0x01) | 0x02;
354fe49f061SSam Leffler 		}
355b032f27cSSam Leffler 	} else if (vap->iv_opmode == IEEE80211_M_AHDEMO) {
356b032f27cSSam Leffler 		if (vap->iv_flags & IEEE80211_F_DESBSSID)
357b032f27cSSam Leffler 			IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_des_bssid);
35850d8b493SSam Leffler 		else
35910ad9a77SSam Leffler #ifdef IEEE80211_SUPPORT_TDMA
36010ad9a77SSam Leffler 		if ((vap->iv_caps & IEEE80211_C_TDMA) == 0)
36110ad9a77SSam Leffler #endif
36250d8b493SSam Leffler 			memset(ni->ni_bssid, 0, IEEE80211_ADDR_LEN);
3638a1b9b6aSSam Leffler 	}
3648a1b9b6aSSam Leffler 	/*
3658a1b9b6aSSam Leffler 	 * Fix the channel and related attributes.
3668a1b9b6aSSam Leffler 	 */
367b032f27cSSam Leffler 	/* clear DFS CAC state on previous channel */
368b032f27cSSam Leffler 	if (ic->ic_bsschan != IEEE80211_CHAN_ANYC &&
369b032f27cSSam Leffler 	    ic->ic_bsschan->ic_freq != chan->ic_freq &&
370b032f27cSSam Leffler 	    IEEE80211_IS_CHAN_CACDONE(ic->ic_bsschan))
371b032f27cSSam Leffler 		ieee80211_dfs_cac_clear(ic, ic->ic_bsschan);
37268e8e04eSSam Leffler 	ic->ic_bsschan = chan;
373b032f27cSSam Leffler 	ieee80211_node_set_chan(ni, chan);
37468e8e04eSSam Leffler 	ic->ic_curmode = ieee80211_chan2mode(chan);
3758a1b9b6aSSam Leffler 	/*
376b032f27cSSam Leffler 	 * Do mode-specific setup.
3778a1b9b6aSSam Leffler 	 */
37868e8e04eSSam Leffler 	if (IEEE80211_IS_CHAN_FULL(chan)) {
37968e8e04eSSam Leffler 		if (IEEE80211_IS_CHAN_ANYG(chan)) {
38068e8e04eSSam Leffler 			/*
381b032f27cSSam Leffler 			 * Use a mixed 11b/11g basic rate set.
38268e8e04eSSam Leffler 			 */
383b032f27cSSam Leffler 			ieee80211_setbasicrates(&ni->ni_rates,
38468e8e04eSSam Leffler 			    IEEE80211_MODE_11G);
385b032f27cSSam Leffler 			if (vap->iv_flags & IEEE80211_F_PUREG) {
386b032f27cSSam Leffler 				/*
387b032f27cSSam Leffler 				 * Also mark OFDM rates basic so 11b
388b032f27cSSam Leffler 				 * stations do not join (WiFi compliance).
389b032f27cSSam Leffler 				 */
390b032f27cSSam Leffler 				ieee80211_addbasicrates(&ni->ni_rates,
391b032f27cSSam Leffler 				    IEEE80211_MODE_11A);
392b032f27cSSam Leffler 			}
39368e8e04eSSam Leffler 		} else if (IEEE80211_IS_CHAN_B(chan)) {
39468e8e04eSSam Leffler 			/*
39568e8e04eSSam Leffler 			 * Force pure 11b rate set.
39668e8e04eSSam Leffler 			 */
397b032f27cSSam Leffler 			ieee80211_setbasicrates(&ni->ni_rates,
39868e8e04eSSam Leffler 				IEEE80211_MODE_11B);
39968e8e04eSSam Leffler 		}
4001a1e1d21SSam Leffler 	}
4011a1e1d21SSam Leffler 
40268e8e04eSSam Leffler 	(void) ieee80211_sta_join1(ieee80211_ref_node(ni));
40368e8e04eSSam Leffler }
40468e8e04eSSam Leffler 
40568e8e04eSSam Leffler /*
40668e8e04eSSam Leffler  * Reset bss state on transition to the INIT state.
40768e8e04eSSam Leffler  * Clear any stations from the table (they have been
40868e8e04eSSam Leffler  * deauth'd) and reset the bss node (clears key, rate
40968e8e04eSSam Leffler  * etc. state).
41068e8e04eSSam Leffler  */
4118a1b9b6aSSam Leffler void
412b032f27cSSam Leffler ieee80211_reset_bss(struct ieee80211vap *vap)
413b4c5a90fSSam Leffler {
414b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
4158a1b9b6aSSam Leffler 	struct ieee80211_node *ni, *obss;
4168a1b9b6aSSam Leffler 
417b032f27cSSam Leffler 	ieee80211_node_table_reset(&ic->ic_sta, vap);
418b032f27cSSam Leffler 	/* XXX multi-bss: wrong */
41968e8e04eSSam Leffler 	ieee80211_reset_erp(ic);
420acc4f7f5SSam Leffler 
421b032f27cSSam Leffler 	ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr);
4228a1b9b6aSSam Leffler 	KASSERT(ni != NULL, ("unable to setup inital BSS node"));
423b032f27cSSam Leffler 	obss = vap->iv_bss;
424b032f27cSSam Leffler 	vap->iv_bss = ieee80211_ref_node(ni);
425f9cd9174SSam Leffler 	if (obss != NULL) {
426f9cd9174SSam Leffler 		copy_bss(ni, obss);
427d365f9c7SSam Leffler 		ni->ni_intval = ic->ic_bintval;
4288a1b9b6aSSam Leffler 		ieee80211_free_node(obss);
429b032f27cSSam Leffler 	} else
430b032f27cSSam Leffler 		IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_myaddr);
431f9cd9174SSam Leffler }
4328a1b9b6aSSam Leffler 
4338a1b9b6aSSam Leffler static int
43468e8e04eSSam Leffler match_ssid(const struct ieee80211_node *ni,
43568e8e04eSSam Leffler 	int nssid, const struct ieee80211_scan_ssid ssids[])
4368a1b9b6aSSam Leffler {
43768e8e04eSSam Leffler 	int i;
43868e8e04eSSam Leffler 
43968e8e04eSSam Leffler 	for (i = 0; i < nssid; i++) {
44068e8e04eSSam Leffler 		if (ni->ni_esslen == ssids[i].len &&
44168e8e04eSSam Leffler 		     memcmp(ni->ni_essid, ssids[i].ssid, ni->ni_esslen) == 0)
44268e8e04eSSam Leffler 			return 1;
44368e8e04eSSam Leffler 	}
44468e8e04eSSam Leffler 	return 0;
44568e8e04eSSam Leffler }
44668e8e04eSSam Leffler 
44768e8e04eSSam Leffler /*
44868e8e04eSSam Leffler  * Test a node for suitability/compatibility.
44968e8e04eSSam Leffler  */
45068e8e04eSSam Leffler static int
451b032f27cSSam Leffler check_bss(struct ieee80211vap *vap, struct ieee80211_node *ni)
45268e8e04eSSam Leffler {
453b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
45468e8e04eSSam Leffler         uint8_t rate;
45568e8e04eSSam Leffler 
45668e8e04eSSam Leffler 	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan)))
45768e8e04eSSam Leffler 		return 0;
458b032f27cSSam Leffler 	if (vap->iv_opmode == IEEE80211_M_IBSS) {
45968e8e04eSSam Leffler 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
46068e8e04eSSam Leffler 			return 0;
46168e8e04eSSam Leffler 	} else {
46268e8e04eSSam Leffler 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0)
46368e8e04eSSam Leffler 			return 0;
46468e8e04eSSam Leffler 	}
465b032f27cSSam Leffler 	if (vap->iv_flags & IEEE80211_F_PRIVACY) {
46668e8e04eSSam Leffler 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
46768e8e04eSSam Leffler 			return 0;
46868e8e04eSSam Leffler 	} else {
46968e8e04eSSam Leffler 		/* XXX does this mean privacy is supported or required? */
47068e8e04eSSam Leffler 		if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
47168e8e04eSSam Leffler 			return 0;
47268e8e04eSSam Leffler 	}
47368e8e04eSSam Leffler 	rate = ieee80211_fix_rate(ni, &ni->ni_rates,
47468e8e04eSSam Leffler 	    IEEE80211_F_JOIN | IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE);
47568e8e04eSSam Leffler 	if (rate & IEEE80211_RATE_BASIC)
47668e8e04eSSam Leffler 		return 0;
477b032f27cSSam Leffler 	if (vap->iv_des_nssid != 0 &&
478b032f27cSSam Leffler 	    !match_ssid(ni, vap->iv_des_nssid, vap->iv_des_ssid))
47968e8e04eSSam Leffler 		return 0;
480b032f27cSSam Leffler 	if ((vap->iv_flags & IEEE80211_F_DESBSSID) &&
481b032f27cSSam Leffler 	    !IEEE80211_ADDR_EQ(vap->iv_des_bssid, ni->ni_bssid))
48268e8e04eSSam Leffler 		return 0;
48368e8e04eSSam Leffler 	return 1;
48468e8e04eSSam Leffler }
48568e8e04eSSam Leffler 
48668e8e04eSSam Leffler #ifdef IEEE80211_DEBUG
48768e8e04eSSam Leffler /*
48868e8e04eSSam Leffler  * Display node suitability/compatibility.
48968e8e04eSSam Leffler  */
49068e8e04eSSam Leffler static void
491b032f27cSSam Leffler check_bss_debug(struct ieee80211vap *vap, struct ieee80211_node *ni)
49268e8e04eSSam Leffler {
493b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
49468e8e04eSSam Leffler         uint8_t rate;
495b4c5a90fSSam Leffler         int fail;
496b4c5a90fSSam Leffler 
497b4c5a90fSSam Leffler 	fail = 0;
498b4c5a90fSSam Leffler 	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan)))
499b4c5a90fSSam Leffler 		fail |= 0x01;
500b032f27cSSam Leffler 	if (vap->iv_opmode == IEEE80211_M_IBSS) {
501b4c5a90fSSam Leffler 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
502b4c5a90fSSam Leffler 			fail |= 0x02;
503b4c5a90fSSam Leffler 	} else {
504b4c5a90fSSam Leffler 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0)
505b4c5a90fSSam Leffler 			fail |= 0x02;
506b4c5a90fSSam Leffler 	}
507b032f27cSSam Leffler 	if (vap->iv_flags & IEEE80211_F_PRIVACY) {
508b4c5a90fSSam Leffler 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
509b4c5a90fSSam Leffler 			fail |= 0x04;
510b4c5a90fSSam Leffler 	} else {
511b4c5a90fSSam Leffler 		/* XXX does this mean privacy is supported or required? */
512b4c5a90fSSam Leffler 		if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
513b4c5a90fSSam Leffler 			fail |= 0x04;
514b4c5a90fSSam Leffler 	}
51570e28b9aSSam Leffler 	rate = ieee80211_fix_rate(ni, &ni->ni_rates,
51679edaebfSSam Leffler 	     IEEE80211_F_JOIN | IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE);
517b4c5a90fSSam Leffler 	if (rate & IEEE80211_RATE_BASIC)
518b4c5a90fSSam Leffler 		fail |= 0x08;
519b032f27cSSam Leffler 	if (vap->iv_des_nssid != 0 &&
520b032f27cSSam Leffler 	    !match_ssid(ni, vap->iv_des_nssid, vap->iv_des_ssid))
521b4c5a90fSSam Leffler 		fail |= 0x10;
522b032f27cSSam Leffler 	if ((vap->iv_flags & IEEE80211_F_DESBSSID) &&
523b032f27cSSam Leffler 	    !IEEE80211_ADDR_EQ(vap->iv_des_bssid, ni->ni_bssid))
524b4c5a90fSSam Leffler 		fail |= 0x20;
52568e8e04eSSam Leffler 
52668e8e04eSSam Leffler 	printf(" %c %s", fail ? '-' : '+', ether_sprintf(ni->ni_macaddr));
52768e8e04eSSam Leffler 	printf(" %s%c", ether_sprintf(ni->ni_bssid), fail & 0x20 ? '!' : ' ');
52868e8e04eSSam Leffler 	printf(" %3d%c",
52968e8e04eSSam Leffler 	    ieee80211_chan2ieee(ic, ni->ni_chan), fail & 0x01 ? '!' : ' ');
530b4c5a90fSSam Leffler 	printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
531b4c5a90fSSam Leffler 	    fail & 0x08 ? '!' : ' ');
532b4c5a90fSSam Leffler 	printf(" %4s%c",
533b4c5a90fSSam Leffler 	    (ni->ni_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
534b4c5a90fSSam Leffler 	    (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
535b4c5a90fSSam Leffler 	    "????",
536b4c5a90fSSam Leffler 	    fail & 0x02 ? '!' : ' ');
537b4c5a90fSSam Leffler 	printf(" %3s%c ",
53868e8e04eSSam Leffler 	    (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) ?  "wep" : "no",
539b4c5a90fSSam Leffler 	    fail & 0x04 ? '!' : ' ');
540b4c5a90fSSam Leffler 	ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
541b4c5a90fSSam Leffler 	printf("%s\n", fail & 0x10 ? "!" : "");
542b4c5a90fSSam Leffler }
54368e8e04eSSam Leffler #endif /* IEEE80211_DEBUG */
5448a1b9b6aSSam Leffler 
545750d6d0cSSam Leffler /*
5468a1b9b6aSSam Leffler  * Handle 802.11 ad hoc network merge.  The
5478a1b9b6aSSam Leffler  * convention, set by the Wireless Ethernet Compatibility Alliance
5488a1b9b6aSSam Leffler  * (WECA), is that an 802.11 station will change its BSSID to match
5498a1b9b6aSSam Leffler  * the "oldest" 802.11 ad hoc network, on the same channel, that
5508a1b9b6aSSam Leffler  * has the station's desired SSID.  The "oldest" 802.11 network
5518a1b9b6aSSam Leffler  * sends beacons with the greatest TSF timestamp.
5528a1b9b6aSSam Leffler  *
5538a1b9b6aSSam Leffler  * The caller is assumed to validate TSF's before attempting a merge.
5548a1b9b6aSSam Leffler  *
5558a1b9b6aSSam Leffler  * Return !0 if the BSSID changed, 0 otherwise.
556750d6d0cSSam Leffler  */
5578a1b9b6aSSam Leffler int
558641b4d0bSSam Leffler ieee80211_ibss_merge(struct ieee80211_node *ni)
5598a1b9b6aSSam Leffler {
560b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
561b032f27cSSam Leffler #ifdef IEEE80211_DEBUG
562641b4d0bSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
563b032f27cSSam Leffler #endif
5648a1b9b6aSSam Leffler 
565b032f27cSSam Leffler 	if (ni == vap->iv_bss ||
566b032f27cSSam Leffler 	    IEEE80211_ADDR_EQ(ni->ni_bssid, vap->iv_bss->ni_bssid)) {
5678a1b9b6aSSam Leffler 		/* unchanged, nothing to do */
5688a1b9b6aSSam Leffler 		return 0;
5698a1b9b6aSSam Leffler 	}
570b032f27cSSam Leffler 	if (!check_bss(vap, ni)) {
57168e8e04eSSam Leffler 		/* capabilities mismatch */
572b032f27cSSam Leffler 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC,
5738a1b9b6aSSam Leffler 		    "%s: merge failed, capabilities mismatch\n", __func__);
57468e8e04eSSam Leffler #ifdef IEEE80211_DEBUG
575b032f27cSSam Leffler 		if (ieee80211_msg_assoc(vap))
576b032f27cSSam Leffler 			check_bss_debug(vap, ni);
57768e8e04eSSam Leffler #endif
578b032f27cSSam Leffler 		vap->iv_stats.is_ibss_capmismatch++;
5798a1b9b6aSSam Leffler 		return 0;
5808a1b9b6aSSam Leffler 	}
581b032f27cSSam Leffler 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC,
5828a1b9b6aSSam Leffler 		"%s: new bssid %s: %s preamble, %s slot time%s\n", __func__,
5838a1b9b6aSSam Leffler 		ether_sprintf(ni->ni_bssid),
5848a1b9b6aSSam Leffler 		ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
5858a1b9b6aSSam Leffler 		ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
5868a1b9b6aSSam Leffler 		ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : ""
5878a1b9b6aSSam Leffler 	);
58868e8e04eSSam Leffler 	return ieee80211_sta_join1(ieee80211_ref_node(ni));
5898a1b9b6aSSam Leffler }
5908a1b9b6aSSam Leffler 
5918a1b9b6aSSam Leffler /*
592b032f27cSSam Leffler  * Calculate HT channel promotion flags for all vaps.
593b032f27cSSam Leffler  * This assumes ni_chan have been setup for each vap.
594b032f27cSSam Leffler  */
595b032f27cSSam Leffler static int
596b032f27cSSam Leffler gethtadjustflags(struct ieee80211com *ic)
597b032f27cSSam Leffler {
598b032f27cSSam Leffler 	struct ieee80211vap *vap;
599b032f27cSSam Leffler 	int flags;
600b032f27cSSam Leffler 
601b032f27cSSam Leffler 	flags = 0;
602b032f27cSSam Leffler 	/* XXX locking */
603b032f27cSSam Leffler 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
604b032f27cSSam Leffler 		if (vap->iv_state < IEEE80211_S_RUN)
605b032f27cSSam Leffler 			continue;
606b032f27cSSam Leffler 		switch (vap->iv_opmode) {
607b032f27cSSam Leffler 		case IEEE80211_M_WDS:
608b032f27cSSam Leffler 		case IEEE80211_M_STA:
609b032f27cSSam Leffler 		case IEEE80211_M_AHDEMO:
610b032f27cSSam Leffler 		case IEEE80211_M_HOSTAP:
611b032f27cSSam Leffler 		case IEEE80211_M_IBSS:
612b032f27cSSam Leffler 			flags |= ieee80211_htchanflags(vap->iv_bss->ni_chan);
613b032f27cSSam Leffler 			break;
614b032f27cSSam Leffler 		default:
615b032f27cSSam Leffler 			break;
616b032f27cSSam Leffler 		}
617b032f27cSSam Leffler 	}
618b032f27cSSam Leffler 	return flags;
619b032f27cSSam Leffler }
620b032f27cSSam Leffler 
621b032f27cSSam Leffler /*
622b032f27cSSam Leffler  * Check if the current channel needs to change based on whether
6235d44f8c0SSam Leffler  * any vap's are using HT20/HT40.  This is used to sync the state
6245d44f8c0SSam Leffler  * of ic_curchan after a channel width change on a running vap.
6251b6167d2SSam Leffler  */
6261b6167d2SSam Leffler void
627b032f27cSSam Leffler ieee80211_sync_curchan(struct ieee80211com *ic)
6281b6167d2SSam Leffler {
629b032f27cSSam Leffler 	struct ieee80211_channel *c;
630b032f27cSSam Leffler 
631b032f27cSSam Leffler 	c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan, gethtadjustflags(ic));
632b032f27cSSam Leffler 	if (c != ic->ic_curchan) {
633b032f27cSSam Leffler 		ic->ic_curchan = c;
634b032f27cSSam Leffler 		ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan);
63526d39e2cSSam Leffler 		ic->ic_rt = ieee80211_get_ratetable(ic->ic_curchan);
6365efea30fSAndrew Thompson 		IEEE80211_UNLOCK(ic);
637b032f27cSSam Leffler 		ic->ic_set_channel(ic);
6385463c4a4SSam Leffler 		ieee80211_radiotap_chan_change(ic);
6395efea30fSAndrew Thompson 		IEEE80211_LOCK(ic);
640b032f27cSSam Leffler 	}
641b032f27cSSam Leffler }
642b032f27cSSam Leffler 
643b032f27cSSam Leffler /*
6445efea30fSAndrew Thompson  * Setup the current channel.  The request channel may be
645b032f27cSSam Leffler  * promoted if other vap's are operating with HT20/HT40.
646b032f27cSSam Leffler  */
647b032f27cSSam Leffler void
6485efea30fSAndrew Thompson ieee80211_setupcurchan(struct ieee80211com *ic, struct ieee80211_channel *c)
649b032f27cSSam Leffler {
650b032f27cSSam Leffler 	if (ic->ic_htcaps & IEEE80211_HTC_HT) {
651b032f27cSSam Leffler 		int flags = gethtadjustflags(ic);
652b032f27cSSam Leffler 		/*
653b032f27cSSam Leffler 		 * Check for channel promotion required to support the
654b032f27cSSam Leffler 		 * set of running vap's.  This assumes we are called
655b032f27cSSam Leffler 		 * after ni_chan is setup for each vap.
656b032f27cSSam Leffler 		 */
6572bfc8a91SSam Leffler 		/* NB: this assumes IEEE80211_FHT_USEHT40 > IEEE80211_FHT_HT */
658b032f27cSSam Leffler 		if (flags > ieee80211_htchanflags(c))
659b032f27cSSam Leffler 			c = ieee80211_ht_adjust_channel(ic, c, flags);
660b032f27cSSam Leffler 	}
661b032f27cSSam Leffler 	ic->ic_bsschan = ic->ic_curchan = c;
6621b6167d2SSam Leffler 	ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan);
66326d39e2cSSam Leffler 	ic->ic_rt = ieee80211_get_ratetable(ic->ic_curchan);
6645efea30fSAndrew Thompson }
6655efea30fSAndrew Thompson 
6665efea30fSAndrew Thompson /*
6675efea30fSAndrew Thompson  * Change the current channel.  The channel change is guaranteed to have
6685efea30fSAndrew Thompson  * happened before the next state change.
6695efea30fSAndrew Thompson  */
6705efea30fSAndrew Thompson void
6715efea30fSAndrew Thompson ieee80211_setcurchan(struct ieee80211com *ic, struct ieee80211_channel *c)
6725efea30fSAndrew Thompson {
6735efea30fSAndrew Thompson 	ieee80211_setupcurchan(ic, c);
6745efea30fSAndrew Thompson 	ieee80211_runtask(ic, &ic->ic_chan_task);
6751b6167d2SSam Leffler }
6761b6167d2SSam Leffler 
6771b6167d2SSam Leffler /*
6788a1b9b6aSSam Leffler  * Join the specified IBSS/BSS network.  The node is assumed to
6798a1b9b6aSSam Leffler  * be passed in with a held reference.
6808a1b9b6aSSam Leffler  */
68168e8e04eSSam Leffler static int
68268e8e04eSSam Leffler ieee80211_sta_join1(struct ieee80211_node *selbs)
6838a1b9b6aSSam Leffler {
684b032f27cSSam Leffler 	struct ieee80211vap *vap = selbs->ni_vap;
68568e8e04eSSam Leffler 	struct ieee80211com *ic = selbs->ni_ic;
6868a1b9b6aSSam Leffler 	struct ieee80211_node *obss;
68768e8e04eSSam Leffler 	int canreassoc;
6888a1b9b6aSSam Leffler 
6898a1b9b6aSSam Leffler 	/*
6908a1b9b6aSSam Leffler 	 * Committed to selbs, setup state.
6918a1b9b6aSSam Leffler 	 */
692b032f27cSSam Leffler 	obss = vap->iv_bss;
69368e8e04eSSam Leffler 	/*
69468e8e04eSSam Leffler 	 * Check if old+new node have the same address in which
69568e8e04eSSam Leffler 	 * case we can reassociate when operating in sta mode.
69668e8e04eSSam Leffler 	 */
69768e8e04eSSam Leffler 	canreassoc = (obss != NULL &&
698b032f27cSSam Leffler 		vap->iv_state == IEEE80211_S_RUN &&
69968e8e04eSSam Leffler 		IEEE80211_ADDR_EQ(obss->ni_macaddr, selbs->ni_macaddr));
700b032f27cSSam Leffler 	vap->iv_bss = selbs;		/* NB: caller assumed to bump refcnt */
7011fd2349dSSam Leffler 	if (obss != NULL) {
7021fd2349dSSam Leffler 		copy_bss(selbs, obss);
70347a7b0faSSam Leffler 		ieee80211_node_decref(obss);	/* iv_bss reference */
70447a7b0faSSam Leffler 		ieee80211_free_node(obss);	/* station table reference */
705b032f27cSSam Leffler 		obss = NULL;		/* NB: guard against later use */
7061fd2349dSSam Leffler 	}
70779edaebfSSam Leffler 
70879edaebfSSam Leffler 	/*
70979edaebfSSam Leffler 	 * Delete unusable rates; we've already checked
71079edaebfSSam Leffler 	 * that the negotiated rate set is acceptable.
71179edaebfSSam Leffler 	 */
712b032f27cSSam Leffler 	ieee80211_fix_rate(vap->iv_bss, &vap->iv_bss->ni_rates,
71370e28b9aSSam Leffler 		IEEE80211_F_DODEL | IEEE80211_F_JOIN);
71479edaebfSSam Leffler 
715b032f27cSSam Leffler 	ieee80211_setcurchan(ic, selbs->ni_chan);
7168a1b9b6aSSam Leffler 	/*
7178a1b9b6aSSam Leffler 	 * Set the erp state (mostly the slot time) to deal with
7188a1b9b6aSSam Leffler 	 * the auto-select case; this should be redundant if the
7198a1b9b6aSSam Leffler 	 * mode is locked.
7208a1b9b6aSSam Leffler 	 */
7218a1b9b6aSSam Leffler 	ieee80211_reset_erp(ic);
722b032f27cSSam Leffler 	ieee80211_wme_initparams(vap);
723acc4f7f5SSam Leffler 
724b032f27cSSam Leffler 	if (vap->iv_opmode == IEEE80211_M_STA) {
72568e8e04eSSam Leffler 		if (canreassoc) {
72668e8e04eSSam Leffler 			/* Reassociate */
727b032f27cSSam Leffler 			ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
72868e8e04eSSam Leffler 		} else {
72968e8e04eSSam Leffler 			/*
73068e8e04eSSam Leffler 			 * Act as if we received a DEAUTH frame in case we
73168e8e04eSSam Leffler 			 * are invoked from the RUN state.  This will cause
73268e8e04eSSam Leffler 			 * us to try to re-authenticate if we are operating
73368e8e04eSSam Leffler 			 * as a station.
73468e8e04eSSam Leffler 			 */
735b032f27cSSam Leffler 			ieee80211_new_state(vap, IEEE80211_S_AUTH,
73668e8e04eSSam Leffler 				IEEE80211_FC0_SUBTYPE_DEAUTH);
73768e8e04eSSam Leffler 		}
73868e8e04eSSam Leffler 	} else
739b032f27cSSam Leffler 		ieee80211_new_state(vap, IEEE80211_S_RUN, -1);
7408a1b9b6aSSam Leffler 	return 1;
7418a1b9b6aSSam Leffler }
7428a1b9b6aSSam Leffler 
74368e8e04eSSam Leffler int
74410959256SSam Leffler ieee80211_sta_join(struct ieee80211vap *vap, struct ieee80211_channel *chan,
74568e8e04eSSam Leffler 	const struct ieee80211_scan_entry *se)
74668e8e04eSSam Leffler {
747b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
74868e8e04eSSam Leffler 	struct ieee80211_node *ni;
74968e8e04eSSam Leffler 
750b032f27cSSam Leffler 	ni = ieee80211_alloc_node(&ic->ic_sta, vap, se->se_macaddr);
75168e8e04eSSam Leffler 	if (ni == NULL) {
75268e8e04eSSam Leffler 		/* XXX msg */
75368e8e04eSSam Leffler 		return 0;
75468e8e04eSSam Leffler 	}
75568e8e04eSSam Leffler 	/*
75668e8e04eSSam Leffler 	 * Expand scan state into node's format.
75768e8e04eSSam Leffler 	 * XXX may not need all this stuff
75868e8e04eSSam Leffler 	 */
75968e8e04eSSam Leffler 	IEEE80211_ADDR_COPY(ni->ni_bssid, se->se_bssid);
76068e8e04eSSam Leffler 	ni->ni_esslen = se->se_ssid[1];
76168e8e04eSSam Leffler 	memcpy(ni->ni_essid, se->se_ssid+2, ni->ni_esslen);
76268e8e04eSSam Leffler 	ni->ni_tstamp.tsf = se->se_tstamp.tsf;
76368e8e04eSSam Leffler 	ni->ni_intval = se->se_intval;
76468e8e04eSSam Leffler 	ni->ni_capinfo = se->se_capinfo;
76510959256SSam Leffler 	ni->ni_chan = chan;
76668e8e04eSSam Leffler 	ni->ni_timoff = se->se_timoff;
76768e8e04eSSam Leffler 	ni->ni_fhdwell = se->se_fhdwell;
76868e8e04eSSam Leffler 	ni->ni_fhindex = se->se_fhindex;
76968e8e04eSSam Leffler 	ni->ni_erp = se->se_erp;
770b032f27cSSam Leffler 	IEEE80211_RSSI_LPF(ni->ni_avgrssi, se->se_rssi);
77168e8e04eSSam Leffler 	ni->ni_noise = se->se_noise;
7726ca74c40SSam Leffler 	if (vap->iv_opmode == IEEE80211_M_STA) {
7736ca74c40SSam Leffler 		/* NB: only infrastructure mode requires an associd */
7741b999d64SSam Leffler 		ni->ni_flags |= IEEE80211_NODE_ASSOCID;
7756ca74c40SSam Leffler 	}
77668e8e04eSSam Leffler 
777b032f27cSSam Leffler 	if (ieee80211_ies_init(&ni->ni_ies, se->se_ies.data, se->se_ies.len)) {
778b032f27cSSam Leffler 		ieee80211_ies_expand(&ni->ni_ies);
779616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
780b032f27cSSam Leffler 		if (ni->ni_ies.ath_ie != NULL)
781b032f27cSSam Leffler 			ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
782616190d0SSam Leffler #endif
783b032f27cSSam Leffler 		if (ni->ni_ies.htcap_ie != NULL)
784b032f27cSSam Leffler 			ieee80211_parse_htcap(ni, ni->ni_ies.htcap_ie);
785b032f27cSSam Leffler 		if (ni->ni_ies.htinfo_ie != NULL)
786b032f27cSSam Leffler 			ieee80211_parse_htinfo(ni, ni->ni_ies.htinfo_ie);
78710ad9a77SSam Leffler #ifdef IEEE80211_SUPPORT_TDMA
78810ad9a77SSam Leffler 		if (ni->ni_ies.tdma_ie != NULL)
78910ad9a77SSam Leffler 			ieee80211_parse_tdma(ni, ni->ni_ies.tdma_ie);
79010ad9a77SSam Leffler #endif
791b032f27cSSam Leffler 	}
792b032f27cSSam Leffler 
793b032f27cSSam Leffler 	vap->iv_dtim_period = se->se_dtimperiod;
794b032f27cSSam Leffler 	vap->iv_dtim_count = 0;
79568e8e04eSSam Leffler 
79668e8e04eSSam Leffler 	/* NB: must be after ni_chan is setup */
79768e8e04eSSam Leffler 	ieee80211_setup_rates(ni, se->se_rates, se->se_xrates,
79868e8e04eSSam Leffler 		IEEE80211_F_DOSORT);
799dfcd1f4dSSam Leffler 	if (ieee80211_iserp_rateset(&ni->ni_rates))
800dfcd1f4dSSam Leffler 		ni->ni_flags |= IEEE80211_NODE_ERP;
801d77148fbSSam Leffler 	ieee80211_node_setuptxparms(ni);
80268e8e04eSSam Leffler 
80368e8e04eSSam Leffler 	return ieee80211_sta_join1(ieee80211_ref_node(ni));
80468e8e04eSSam Leffler }
80568e8e04eSSam Leffler 
8068a1b9b6aSSam Leffler /*
8078a1b9b6aSSam Leffler  * Leave the specified IBSS/BSS network.  The node is assumed to
8088a1b9b6aSSam Leffler  * be passed in with a held reference.
8098a1b9b6aSSam Leffler  */
8108a1b9b6aSSam Leffler void
811b032f27cSSam Leffler ieee80211_sta_leave(struct ieee80211_node *ni)
8128a1b9b6aSSam Leffler {
813b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
814b032f27cSSam Leffler 
8158a1b9b6aSSam Leffler 	ic->ic_node_cleanup(ni);
816b032f27cSSam Leffler 	ieee80211_notify_node_leave(ni);
817b032f27cSSam Leffler }
818b032f27cSSam Leffler 
819b032f27cSSam Leffler /*
820b032f27cSSam Leffler  * Send a deauthenticate frame and drop the station.
821b032f27cSSam Leffler  */
822b032f27cSSam Leffler void
823b032f27cSSam Leffler ieee80211_node_deauth(struct ieee80211_node *ni, int reason)
824b032f27cSSam Leffler {
825b032f27cSSam Leffler 	/* NB: bump the refcnt to be sure temporay nodes are not reclaimed */
826b032f27cSSam Leffler 	ieee80211_ref_node(ni);
827b032f27cSSam Leffler 	if (ni->ni_associd != 0)
828b032f27cSSam Leffler 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
829b032f27cSSam Leffler 	ieee80211_node_leave(ni);
830b032f27cSSam Leffler 	ieee80211_free_node(ni);
8318a1b9b6aSSam Leffler }
8328a1b9b6aSSam Leffler 
8331a1e1d21SSam Leffler static struct ieee80211_node *
83438c208f8SSam Leffler node_alloc(struct ieee80211vap *vap, const uint8_t macaddr[IEEE80211_ADDR_LEN])
8351a1e1d21SSam Leffler {
836410ca74bSSam Leffler 	struct ieee80211_node *ni;
8378a1b9b6aSSam Leffler 
838e2126decSSam Leffler 	ni = (struct ieee80211_node *) malloc(sizeof(struct ieee80211_node),
839410ca74bSSam Leffler 		M_80211_NODE, M_NOWAIT | M_ZERO);
840410ca74bSSam Leffler 	return ni;
8411a1e1d21SSam Leffler }
8421a1e1d21SSam Leffler 
8438a1b9b6aSSam Leffler /*
844b032f27cSSam Leffler  * Initialize an ie blob with the specified data.  If previous
845b032f27cSSam Leffler  * data exists re-use the data block.  As a side effect we clear
846b032f27cSSam Leffler  * all references to specific ie's; the caller is required to
847b032f27cSSam Leffler  * recalculate them.
848b032f27cSSam Leffler  */
849b032f27cSSam Leffler int
850b032f27cSSam Leffler ieee80211_ies_init(struct ieee80211_ies *ies, const uint8_t *data, int len)
851b032f27cSSam Leffler {
852b032f27cSSam Leffler 	/* NB: assumes data+len are the last fields */
853b032f27cSSam Leffler 	memset(ies, 0, offsetof(struct ieee80211_ies, data));
854b032f27cSSam Leffler 	if (ies->data != NULL && ies->len != len) {
855b032f27cSSam Leffler 		/* data size changed */
856e2126decSSam Leffler 		free(ies->data, M_80211_NODE_IE);
857b032f27cSSam Leffler 		ies->data = NULL;
858b032f27cSSam Leffler 	}
859b032f27cSSam Leffler 	if (ies->data == NULL) {
860e2126decSSam Leffler 		ies->data = (uint8_t *) malloc(len, M_80211_NODE_IE, M_NOWAIT);
861b032f27cSSam Leffler 		if (ies->data == NULL) {
862b032f27cSSam Leffler 			ies->len = 0;
863b032f27cSSam Leffler 			/* NB: pointers have already been zero'd above */
864b032f27cSSam Leffler 			return 0;
865b032f27cSSam Leffler 		}
866b032f27cSSam Leffler 	}
867b032f27cSSam Leffler 	memcpy(ies->data, data, len);
868b032f27cSSam Leffler 	ies->len = len;
869b032f27cSSam Leffler 	return 1;
870b032f27cSSam Leffler }
871b032f27cSSam Leffler 
872b032f27cSSam Leffler /*
873b032f27cSSam Leffler  * Reclaim storage for an ie blob.
874b032f27cSSam Leffler  */
875b032f27cSSam Leffler void
876b032f27cSSam Leffler ieee80211_ies_cleanup(struct ieee80211_ies *ies)
877b032f27cSSam Leffler {
878b032f27cSSam Leffler 	if (ies->data != NULL)
879e2126decSSam Leffler 		free(ies->data, M_80211_NODE_IE);
880b032f27cSSam Leffler }
881b032f27cSSam Leffler 
882b032f27cSSam Leffler /*
883b032f27cSSam Leffler  * Expand an ie blob data contents and to fillin individual
884b032f27cSSam Leffler  * ie pointers.  The data blob is assumed to be well-formed;
885b032f27cSSam Leffler  * we don't do any validity checking of ie lengths.
886b032f27cSSam Leffler  */
887b032f27cSSam Leffler void
888b032f27cSSam Leffler ieee80211_ies_expand(struct ieee80211_ies *ies)
889b032f27cSSam Leffler {
890b032f27cSSam Leffler 	uint8_t *ie;
891b032f27cSSam Leffler 	int ielen;
892b032f27cSSam Leffler 
893b032f27cSSam Leffler 	ie = ies->data;
894b032f27cSSam Leffler 	ielen = ies->len;
895b032f27cSSam Leffler 	while (ielen > 0) {
896b032f27cSSam Leffler 		switch (ie[0]) {
897b032f27cSSam Leffler 		case IEEE80211_ELEMID_VENDOR:
898b032f27cSSam Leffler 			if (iswpaoui(ie))
899b032f27cSSam Leffler 				ies->wpa_ie = ie;
900b032f27cSSam Leffler 			else if (iswmeoui(ie))
901b032f27cSSam Leffler 				ies->wme_ie = ie;
902616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
903b032f27cSSam Leffler 			else if (isatherosoui(ie))
904b032f27cSSam Leffler 				ies->ath_ie = ie;
905616190d0SSam Leffler #endif
90610ad9a77SSam Leffler #ifdef IEEE80211_SUPPORT_TDMA
90710ad9a77SSam Leffler 			else if (istdmaoui(ie))
90810ad9a77SSam Leffler 				ies->tdma_ie = ie;
90910ad9a77SSam Leffler #endif
910b032f27cSSam Leffler 			break;
911b032f27cSSam Leffler 		case IEEE80211_ELEMID_RSN:
912b032f27cSSam Leffler 			ies->rsn_ie = ie;
913b032f27cSSam Leffler 			break;
914b032f27cSSam Leffler 		case IEEE80211_ELEMID_HTCAP:
915b032f27cSSam Leffler 			ies->htcap_ie = ie;
916b032f27cSSam Leffler 			break;
917b032f27cSSam Leffler 		}
918b032f27cSSam Leffler 		ielen -= 2 + ie[1];
919b032f27cSSam Leffler 		ie += 2 + ie[1];
920b032f27cSSam Leffler 	}
921b032f27cSSam Leffler }
922b032f27cSSam Leffler 
923b032f27cSSam Leffler /*
9248a1b9b6aSSam Leffler  * Reclaim any resources in a node and reset any critical
9258a1b9b6aSSam Leffler  * state.  Typically nodes are free'd immediately after,
9268a1b9b6aSSam Leffler  * but in some cases the storage may be reused so we need
9278a1b9b6aSSam Leffler  * to insure consistent state (should probably fix that).
9288a1b9b6aSSam Leffler  */
9291a1e1d21SSam Leffler static void
9308a1b9b6aSSam Leffler node_cleanup(struct ieee80211_node *ni)
9311a1e1d21SSam Leffler {
9328a1b9b6aSSam Leffler #define	N(a)	(sizeof(a)/sizeof(a[0]))
933b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
9345b16c28cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
93568e8e04eSSam Leffler 	int i;
9368a1b9b6aSSam Leffler 
9378a1b9b6aSSam Leffler 	/* NB: preserve ni_table */
9388a1b9b6aSSam Leffler 	if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) {
939b032f27cSSam Leffler 		if (vap->iv_opmode != IEEE80211_M_STA)
940b032f27cSSam Leffler 			vap->iv_ps_sta--;
9418a1b9b6aSSam Leffler 		ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
942b032f27cSSam Leffler 		IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
943b032f27cSSam Leffler 		    "power save mode off, %u sta's in ps mode", vap->iv_ps_sta);
9448a1b9b6aSSam Leffler 	}
945ebdda46cSSam Leffler 	/*
9461b6167d2SSam Leffler 	 * Cleanup any HT-related state.
9471b6167d2SSam Leffler 	 */
9481b6167d2SSam Leffler 	if (ni->ni_flags & IEEE80211_NODE_HT)
9491b6167d2SSam Leffler 		ieee80211_ht_node_cleanup(ni);
950339ccfb3SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
951339ccfb3SSam Leffler 	else if (ni->ni_ath_flags & IEEE80211_NODE_ATH)
952339ccfb3SSam Leffler 		ieee80211_ff_node_cleanup(ni);
953339ccfb3SSam Leffler #endif
9541b6167d2SSam Leffler 	/*
9555b16c28cSSam Leffler 	 * Clear any staging queue entries.
9565b16c28cSSam Leffler 	 */
9575b16c28cSSam Leffler 	ieee80211_ageq_drain_node(&ic->ic_stageq, ni);
9585b16c28cSSam Leffler 
9595b16c28cSSam Leffler 	/*
960ebdda46cSSam Leffler 	 * Clear AREF flag that marks the authorization refcnt bump
961ebdda46cSSam Leffler 	 * has happened.  This is probably not needed as the node
962ebdda46cSSam Leffler 	 * should always be removed from the table so not found but
963ebdda46cSSam Leffler 	 * do it just in case.
9641b999d64SSam Leffler 	 * Likewise clear the ASSOCID flag as these flags are intended
9651b999d64SSam Leffler 	 * to be managed in tandem.
966ebdda46cSSam Leffler 	 */
9671b999d64SSam Leffler 	ni->ni_flags &= ~(IEEE80211_NODE_AREF | IEEE80211_NODE_ASSOCID);
9688a1b9b6aSSam Leffler 
9698a1b9b6aSSam Leffler 	/*
9708a1b9b6aSSam Leffler 	 * Drain power save queue and, if needed, clear TIM.
9718a1b9b6aSSam Leffler 	 */
97263092fceSSam Leffler 	if (ieee80211_node_psq_drain(ni) != 0 && vap->iv_set_tim != NULL)
973b032f27cSSam Leffler 		vap->iv_set_tim(ni, 0);
9748a1b9b6aSSam Leffler 
9758a1b9b6aSSam Leffler 	ni->ni_associd = 0;
9768a1b9b6aSSam Leffler 	if (ni->ni_challenge != NULL) {
977e2126decSSam Leffler 		free(ni->ni_challenge, M_80211_NODE);
9788a1b9b6aSSam Leffler 		ni->ni_challenge = NULL;
9798a1b9b6aSSam Leffler 	}
9808a1b9b6aSSam Leffler 	/*
9818a1b9b6aSSam Leffler 	 * Preserve SSID, WPA, and WME ie's so the bss node is
9828a1b9b6aSSam Leffler 	 * reusable during a re-auth/re-assoc state transition.
9838a1b9b6aSSam Leffler 	 * If we remove these data they will not be recreated
9848a1b9b6aSSam Leffler 	 * because they come from a probe-response or beacon frame
9858a1b9b6aSSam Leffler 	 * which cannot be expected prior to the association-response.
9868a1b9b6aSSam Leffler 	 * This should not be an issue when operating in other modes
9878a1b9b6aSSam Leffler 	 * as stations leaving always go through a full state transition
9888a1b9b6aSSam Leffler 	 * which will rebuild this state.
9898a1b9b6aSSam Leffler 	 *
9908a1b9b6aSSam Leffler 	 * XXX does this leave us open to inheriting old state?
9918a1b9b6aSSam Leffler 	 */
9928a1b9b6aSSam Leffler 	for (i = 0; i < N(ni->ni_rxfrag); i++)
9938a1b9b6aSSam Leffler 		if (ni->ni_rxfrag[i] != NULL) {
9948a1b9b6aSSam Leffler 			m_freem(ni->ni_rxfrag[i]);
9958a1b9b6aSSam Leffler 			ni->ni_rxfrag[i] = NULL;
9968a1b9b6aSSam Leffler 		}
997c1225b52SSam Leffler 	/*
998c1225b52SSam Leffler 	 * Must be careful here to remove any key map entry w/o a LOR.
999c1225b52SSam Leffler 	 */
1000c1225b52SSam Leffler 	ieee80211_node_delucastkey(ni);
10018a1b9b6aSSam Leffler #undef N
10028a1b9b6aSSam Leffler }
10038a1b9b6aSSam Leffler 
10048a1b9b6aSSam Leffler static void
10058a1b9b6aSSam Leffler node_free(struct ieee80211_node *ni)
10068a1b9b6aSSam Leffler {
10078a1b9b6aSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
10088a1b9b6aSSam Leffler 
10098a1b9b6aSSam Leffler 	ic->ic_node_cleanup(ni);
1010b032f27cSSam Leffler 	ieee80211_ies_cleanup(&ni->ni_ies);
101163092fceSSam Leffler 	ieee80211_psq_cleanup(&ni->ni_psq);
1012e2126decSSam Leffler 	free(ni, M_80211_NODE);
10131a1e1d21SSam Leffler }
10141a1e1d21SSam Leffler 
1015b032f27cSSam Leffler static void
1016b032f27cSSam Leffler node_age(struct ieee80211_node *ni)
1017b032f27cSSam Leffler {
1018b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
10195d44f8c0SSam Leffler 
10205d44f8c0SSam Leffler 	IEEE80211_NODE_LOCK_ASSERT(&vap->iv_ic->ic_sta);
10215d44f8c0SSam Leffler 
1022b032f27cSSam Leffler 	/*
1023b032f27cSSam Leffler 	 * Age frames on the power save queue.
1024b032f27cSSam Leffler 	 */
102563092fceSSam Leffler 	if (ieee80211_node_psq_age(ni) != 0 &&
102663092fceSSam Leffler 	    ni->ni_psq.psq_len == 0 && vap->iv_set_tim != NULL)
1027b032f27cSSam Leffler 		vap->iv_set_tim(ni, 0);
1028b032f27cSSam Leffler 	/*
1029b032f27cSSam Leffler 	 * Age out HT resources (e.g. frames on the
1030b032f27cSSam Leffler 	 * A-MPDU reorder queues).
1031b032f27cSSam Leffler 	 */
1032b032f27cSSam Leffler 	if (ni->ni_associd != 0 && (ni->ni_flags & IEEE80211_NODE_HT))
1033b032f27cSSam Leffler 		ieee80211_ht_node_age(ni);
1034b032f27cSSam Leffler }
1035b032f27cSSam Leffler 
103668e8e04eSSam Leffler static int8_t
10378a1b9b6aSSam Leffler node_getrssi(const struct ieee80211_node *ni)
1038d1e61976SSam Leffler {
1039b032f27cSSam Leffler 	uint32_t avgrssi = ni->ni_avgrssi;
1040b032f27cSSam Leffler 	int32_t rssi;
1041b032f27cSSam Leffler 
1042b032f27cSSam Leffler 	if (avgrssi == IEEE80211_RSSI_DUMMY_MARKER)
1043b032f27cSSam Leffler 		return 0;
1044b032f27cSSam Leffler 	rssi = IEEE80211_RSSI_GET(avgrssi);
1045b032f27cSSam Leffler 	return rssi < 0 ? 0 : rssi > 127 ? 127 : rssi;
1046d1e61976SSam Leffler }
1047d1e61976SSam Leffler 
10481a1e1d21SSam Leffler static void
104968e8e04eSSam Leffler node_getsignal(const struct ieee80211_node *ni, int8_t *rssi, int8_t *noise)
105068e8e04eSSam Leffler {
1051b032f27cSSam Leffler 	*rssi = node_getrssi(ni);
105268e8e04eSSam Leffler 	*noise = ni->ni_noise;
105368e8e04eSSam Leffler }
105468e8e04eSSam Leffler 
105568e8e04eSSam Leffler static void
1056b032f27cSSam Leffler node_getmimoinfo(const struct ieee80211_node *ni,
1057b032f27cSSam Leffler 	struct ieee80211_mimo_info *info)
1058b032f27cSSam Leffler {
1059b032f27cSSam Leffler 	/* XXX zero data? */
1060b032f27cSSam Leffler }
1061b032f27cSSam Leffler 
1062b032f27cSSam Leffler struct ieee80211_node *
1063b032f27cSSam Leffler ieee80211_alloc_node(struct ieee80211_node_table *nt,
1064b032f27cSSam Leffler 	struct ieee80211vap *vap, const uint8_t macaddr[IEEE80211_ADDR_LEN])
10651a1e1d21SSam Leffler {
10668a1b9b6aSSam Leffler 	struct ieee80211com *ic = nt->nt_ic;
1067b032f27cSSam Leffler 	struct ieee80211_node *ni;
10681a1e1d21SSam Leffler 	int hash;
10691a1e1d21SSam Leffler 
107038c208f8SSam Leffler 	ni = ic->ic_node_alloc(vap, macaddr);
1071b032f27cSSam Leffler 	if (ni == NULL) {
1072b032f27cSSam Leffler 		vap->iv_stats.is_rx_nodealloc++;
1073b032f27cSSam Leffler 		return NULL;
1074b032f27cSSam Leffler 	}
1075b032f27cSSam Leffler 
1076b032f27cSSam Leffler 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
107749a15236SSam Leffler 		"%s %p<%s> in %s table\n", __func__, ni,
10788a1b9b6aSSam Leffler 		ether_sprintf(macaddr), nt->nt_name);
10798a1b9b6aSSam Leffler 
10801a1e1d21SSam Leffler 	IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
10811a1e1d21SSam Leffler 	hash = IEEE80211_NODE_HASH(macaddr);
10828a1b9b6aSSam Leffler 	ieee80211_node_initref(ni);		/* mark referenced */
10838a1b9b6aSSam Leffler 	ni->ni_chan = IEEE80211_CHAN_ANYC;
10848a1b9b6aSSam Leffler 	ni->ni_authmode = IEEE80211_AUTH_OPEN;
10858a1b9b6aSSam Leffler 	ni->ni_txpower = ic->ic_txpowlimit;	/* max power */
108601a03542SSam Leffler 	ni->ni_txparms = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1087b032f27cSSam Leffler 	ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE);
1088b032f27cSSam Leffler 	ni->ni_avgrssi = IEEE80211_RSSI_DUMMY_MARKER;
10892045f699SSam Leffler 	ni->ni_inact_reload = nt->nt_inact_init;
10902045f699SSam Leffler 	ni->ni_inact = ni->ni_inact_reload;
109168e8e04eSSam Leffler 	ni->ni_ath_defkeyix = 0x7fff;
109263092fceSSam Leffler 	ieee80211_psq_init(&ni->ni_psq, "unknown");
10938a1b9b6aSSam Leffler 
10948a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK(nt);
10958a1b9b6aSSam Leffler 	TAILQ_INSERT_TAIL(&nt->nt_node, ni, ni_list);
10968a1b9b6aSSam Leffler 	LIST_INSERT_HEAD(&nt->nt_hash[hash], ni, ni_hash);
10978a1b9b6aSSam Leffler 	ni->ni_table = nt;
1098b032f27cSSam Leffler 	ni->ni_vap = vap;
10998a1b9b6aSSam Leffler 	ni->ni_ic = ic;
11008a1b9b6aSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
11011a1e1d21SSam Leffler 
1102be1054edSSam Leffler 	IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
1103be1054edSSam Leffler 	    "%s: inact_reload %u", __func__, ni->ni_inact_reload);
1104be1054edSSam Leffler 
11051a1e1d21SSam Leffler 	return ni;
11061a1e1d21SSam Leffler }
11071a1e1d21SSam Leffler 
110897c973adSSam Leffler /*
110997c973adSSam Leffler  * Craft a temporary node suitable for sending a management frame
111097c973adSSam Leffler  * to the specified station.  We craft only as much state as we
111197c973adSSam Leffler  * need to do the work since the node will be immediately reclaimed
111297c973adSSam Leffler  * once the send completes.
111397c973adSSam Leffler  */
111497c973adSSam Leffler struct ieee80211_node *
1115b032f27cSSam Leffler ieee80211_tmp_node(struct ieee80211vap *vap,
1116b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
111797c973adSSam Leffler {
1118b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
111997c973adSSam Leffler 	struct ieee80211_node *ni;
112097c973adSSam Leffler 
112138c208f8SSam Leffler 	ni = ic->ic_node_alloc(vap, macaddr);
112297c973adSSam Leffler 	if (ni != NULL) {
1123b9b5f07dSSam Leffler 		struct ieee80211_node *bss = vap->iv_bss;
1124b9b5f07dSSam Leffler 
1125b032f27cSSam Leffler 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
112697c973adSSam Leffler 			"%s %p<%s>\n", __func__, ni, ether_sprintf(macaddr));
112797c973adSSam Leffler 
1128b032f27cSSam Leffler 		ni->ni_table = NULL;		/* NB: pedantic */
1129b032f27cSSam Leffler 		ni->ni_ic = ic;			/* NB: needed to set channel */
1130b032f27cSSam Leffler 		ni->ni_vap = vap;
1131b032f27cSSam Leffler 
113297c973adSSam Leffler 		IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
1133b9b5f07dSSam Leffler 		IEEE80211_ADDR_COPY(ni->ni_bssid, bss->ni_bssid);
113497c973adSSam Leffler 		ieee80211_node_initref(ni);		/* mark referenced */
113597c973adSSam Leffler 		/* NB: required by ieee80211_fix_rate */
1136b9b5f07dSSam Leffler 		ieee80211_node_set_chan(ni, bss->ni_chan);
1137b032f27cSSam Leffler 		ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey,
113897c973adSSam Leffler 			IEEE80211_KEYIX_NONE);
1139b9b5f07dSSam Leffler 		ni->ni_txpower = bss->ni_txpower;
114097c973adSSam Leffler 		/* XXX optimize away */
114163092fceSSam Leffler 		ieee80211_psq_init(&ni->ni_psq, "unknown");
114297c973adSSam Leffler 	} else {
114397c973adSSam Leffler 		/* XXX msg */
1144b032f27cSSam Leffler 		vap->iv_stats.is_rx_nodealloc++;
114597c973adSSam Leffler 	}
114697c973adSSam Leffler 	return ni;
114797c973adSSam Leffler }
114897c973adSSam Leffler 
11491a1e1d21SSam Leffler struct ieee80211_node *
1150b032f27cSSam Leffler ieee80211_dup_bss(struct ieee80211vap *vap,
1151b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
11521a1e1d21SSam Leffler {
1153b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
11548a1b9b6aSSam Leffler 	struct ieee80211_node *ni;
11558a1b9b6aSSam Leffler 
1156b032f27cSSam Leffler 	ni = ieee80211_alloc_node(&ic->ic_sta, vap, macaddr);
11571a1e1d21SSam Leffler 	if (ni != NULL) {
1158b9b5f07dSSam Leffler 		struct ieee80211_node *bss = vap->iv_bss;
1159694dca64SSam Leffler 		/*
1160b032f27cSSam Leffler 		 * Inherit from iv_bss.
1161694dca64SSam Leffler 		 */
1162b9b5f07dSSam Leffler 		copy_bss(ni, bss);
1163b9b5f07dSSam Leffler 		IEEE80211_ADDR_COPY(ni->ni_bssid, bss->ni_bssid);
1164b9b5f07dSSam Leffler 		ieee80211_node_set_chan(ni, bss->ni_chan);
1165b032f27cSSam Leffler 	}
11661a1e1d21SSam Leffler 	return ni;
11671a1e1d21SSam Leffler }
11681a1e1d21SSam Leffler 
1169b032f27cSSam Leffler /*
1170b032f27cSSam Leffler  * Create a bss node for a legacy WDS vap.  The far end does
1171b032f27cSSam Leffler  * not associate so we just create create a new node and
1172b032f27cSSam Leffler  * simulate an association.  The caller is responsible for
1173b032f27cSSam Leffler  * installing the node as the bss node and handling any further
1174b032f27cSSam Leffler  * setup work like authorizing the port.
1175b032f27cSSam Leffler  */
1176b032f27cSSam Leffler struct ieee80211_node *
1177b032f27cSSam Leffler ieee80211_node_create_wds(struct ieee80211vap *vap,
1178b032f27cSSam Leffler 	const uint8_t bssid[IEEE80211_ADDR_LEN], struct ieee80211_channel *chan)
1179b032f27cSSam Leffler {
1180b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
1181b032f27cSSam Leffler 	struct ieee80211_node *ni;
1182b032f27cSSam Leffler 
1183b032f27cSSam Leffler 	/* XXX check if node already in sta table? */
1184b032f27cSSam Leffler 	ni = ieee80211_alloc_node(&ic->ic_sta, vap, bssid);
1185b032f27cSSam Leffler 	if (ni != NULL) {
1186b032f27cSSam Leffler 		ni->ni_wdsvap = vap;
1187b032f27cSSam Leffler 		IEEE80211_ADDR_COPY(ni->ni_bssid, bssid);
1188b032f27cSSam Leffler 		/*
1189b032f27cSSam Leffler 		 * Inherit any manually configured settings.
1190b032f27cSSam Leffler 		 */
1191b9b5f07dSSam Leffler 		copy_bss(ni, vap->iv_bss);
1192b032f27cSSam Leffler 		ieee80211_node_set_chan(ni, chan);
1193b032f27cSSam Leffler 		/* NB: propagate ssid so available to WPA supplicant */
1194b032f27cSSam Leffler 		ni->ni_esslen = vap->iv_des_ssid[0].len;
1195b032f27cSSam Leffler 		memcpy(ni->ni_essid, vap->iv_des_ssid[0].ssid, ni->ni_esslen);
1196b032f27cSSam Leffler 		/* NB: no associd for peer */
1197b032f27cSSam Leffler 		/*
1198b032f27cSSam Leffler 		 * There are no management frames to use to
1199b032f27cSSam Leffler 		 * discover neighbor capabilities, so blindly
1200b032f27cSSam Leffler 		 * propagate the local configuration.
1201b032f27cSSam Leffler 		 */
1202b032f27cSSam Leffler 		if (vap->iv_flags & IEEE80211_F_WME)
1203b032f27cSSam Leffler 			ni->ni_flags |= IEEE80211_NODE_QOS;
1204616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
1205b032f27cSSam Leffler 		if (vap->iv_flags & IEEE80211_F_FF)
1206b032f27cSSam Leffler 			ni->ni_flags |= IEEE80211_NODE_FF;
1207616190d0SSam Leffler #endif
1208b032f27cSSam Leffler 		if ((ic->ic_htcaps & IEEE80211_HTC_HT) &&
12092bfc8a91SSam Leffler 		    (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1210b032f27cSSam Leffler 			/*
1211b032f27cSSam Leffler 			 * Device is HT-capable and HT is enabled for
1212b032f27cSSam Leffler 			 * the vap; setup HT operation.  On return
1213b032f27cSSam Leffler 			 * ni_chan will be adjusted to an HT channel.
1214b032f27cSSam Leffler 			 */
1215b032f27cSSam Leffler 			ieee80211_ht_wds_init(ni);
1216b032f27cSSam Leffler 		} else {
1217b032f27cSSam Leffler 			struct ieee80211_channel *c = ni->ni_chan;
1218b032f27cSSam Leffler 			/*
1219b032f27cSSam Leffler 			 * Force a legacy channel to be used.
1220b032f27cSSam Leffler 			 */
1221b032f27cSSam Leffler 			c = ieee80211_find_channel(ic,
1222b032f27cSSam Leffler 			    c->ic_freq, c->ic_flags &~ IEEE80211_CHAN_HT);
1223b032f27cSSam Leffler 			KASSERT(c != NULL, ("no legacy channel, %u/%x",
1224b032f27cSSam Leffler 			    ni->ni_chan->ic_freq, ni->ni_chan->ic_flags));
1225b032f27cSSam Leffler 			ni->ni_chan = c;
1226b032f27cSSam Leffler 		}
1227b032f27cSSam Leffler 	}
1228b032f27cSSam Leffler 	return ni;
1229b032f27cSSam Leffler }
1230b032f27cSSam Leffler 
1231b032f27cSSam Leffler struct ieee80211_node *
12328a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1233b032f27cSSam Leffler ieee80211_find_node_locked_debug(struct ieee80211_node_table *nt,
1234b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN], const char *func, int line)
12358a1b9b6aSSam Leffler #else
1236b032f27cSSam Leffler ieee80211_find_node_locked(struct ieee80211_node_table *nt,
1237b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
12388a1b9b6aSSam Leffler #endif
12391a1e1d21SSam Leffler {
12401a1e1d21SSam Leffler 	struct ieee80211_node *ni;
12411a1e1d21SSam Leffler 	int hash;
12421a1e1d21SSam Leffler 
12438a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK_ASSERT(nt);
1244750d6d0cSSam Leffler 
12451a1e1d21SSam Leffler 	hash = IEEE80211_NODE_HASH(macaddr);
12468a1b9b6aSSam Leffler 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
12471a1e1d21SSam Leffler 		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
12488a1b9b6aSSam Leffler 			ieee80211_ref_node(ni);	/* mark referenced */
12498a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1250b032f27cSSam Leffler 			IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
125149a15236SSam Leffler 			    "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
125249a15236SSam Leffler 			    func, line,
125349a15236SSam Leffler 			    ni, ether_sprintf(ni->ni_macaddr),
12548a1b9b6aSSam Leffler 			    ieee80211_node_refcnt(ni));
12558a1b9b6aSSam Leffler #endif
1256750d6d0cSSam Leffler 			return ni;
12571a1e1d21SSam Leffler 		}
12581a1e1d21SSam Leffler 	}
1259750d6d0cSSam Leffler 	return NULL;
1260750d6d0cSSam Leffler }
1261750d6d0cSSam Leffler 
1262750d6d0cSSam Leffler struct ieee80211_node *
12638a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
12648a1b9b6aSSam Leffler ieee80211_find_node_debug(struct ieee80211_node_table *nt,
1265b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN], const char *func, int line)
12668a1b9b6aSSam Leffler #else
1267b032f27cSSam Leffler ieee80211_find_node(struct ieee80211_node_table *nt,
1268b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
12698a1b9b6aSSam Leffler #endif
1270750d6d0cSSam Leffler {
1271750d6d0cSSam Leffler 	struct ieee80211_node *ni;
1272750d6d0cSSam Leffler 
12738a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK(nt);
1274b032f27cSSam Leffler 	ni = ieee80211_find_node_locked(nt, macaddr);
1275b032f27cSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
1276b032f27cSSam Leffler 	return ni;
1277b032f27cSSam Leffler }
1278b032f27cSSam Leffler 
1279b032f27cSSam Leffler struct ieee80211_node *
1280b032f27cSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1281b032f27cSSam Leffler ieee80211_find_vap_node_locked_debug(struct ieee80211_node_table *nt,
1282b032f27cSSam Leffler 	const struct ieee80211vap *vap,
1283b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN], const char *func, int line)
1284b032f27cSSam Leffler #else
1285b032f27cSSam Leffler ieee80211_find_vap_node_locked(struct ieee80211_node_table *nt,
1286b032f27cSSam Leffler 	const struct ieee80211vap *vap,
1287b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
1288b032f27cSSam Leffler #endif
1289b032f27cSSam Leffler {
1290b032f27cSSam Leffler 	struct ieee80211_node *ni;
1291b032f27cSSam Leffler 	int hash;
1292b032f27cSSam Leffler 
1293b032f27cSSam Leffler 	IEEE80211_NODE_LOCK_ASSERT(nt);
1294b032f27cSSam Leffler 
1295b032f27cSSam Leffler 	hash = IEEE80211_NODE_HASH(macaddr);
1296b032f27cSSam Leffler 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
1297b032f27cSSam Leffler 		if (ni->ni_vap == vap &&
1298b032f27cSSam Leffler 		    IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
1299b032f27cSSam Leffler 			ieee80211_ref_node(ni);	/* mark referenced */
1300b032f27cSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1301b032f27cSSam Leffler 			IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
1302b032f27cSSam Leffler 			    "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
1303b032f27cSSam Leffler 			    func, line,
1304b032f27cSSam Leffler 			    ni, ether_sprintf(ni->ni_macaddr),
1305b032f27cSSam Leffler 			    ieee80211_node_refcnt(ni));
1306b032f27cSSam Leffler #endif
1307b032f27cSSam Leffler 			return ni;
1308b032f27cSSam Leffler 		}
1309b032f27cSSam Leffler 	}
1310b032f27cSSam Leffler 	return NULL;
1311b032f27cSSam Leffler }
1312b032f27cSSam Leffler 
1313b032f27cSSam Leffler struct ieee80211_node *
1314b032f27cSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1315b032f27cSSam Leffler ieee80211_find_vap_node_debug(struct ieee80211_node_table *nt,
1316b032f27cSSam Leffler 	const struct ieee80211vap *vap,
1317b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN], const char *func, int line)
1318b032f27cSSam Leffler #else
1319b032f27cSSam Leffler ieee80211_find_vap_node(struct ieee80211_node_table *nt,
1320b032f27cSSam Leffler 	const struct ieee80211vap *vap,
1321b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
1322b032f27cSSam Leffler #endif
1323b032f27cSSam Leffler {
1324b032f27cSSam Leffler 	struct ieee80211_node *ni;
1325b032f27cSSam Leffler 
1326b032f27cSSam Leffler 	IEEE80211_NODE_LOCK(nt);
1327b032f27cSSam Leffler 	ni = ieee80211_find_vap_node_locked(nt, vap, macaddr);
13288a1b9b6aSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
13291a1e1d21SSam Leffler 	return ni;
13301a1e1d21SSam Leffler }
13311a1e1d21SSam Leffler 
13321a1e1d21SSam Leffler /*
13338a1b9b6aSSam Leffler  * Fake up a node; this handles node discovery in adhoc mode.
13348a1b9b6aSSam Leffler  * Note that for the driver's benefit we we treat this like
13358a1b9b6aSSam Leffler  * an association so the driver has an opportunity to setup
13368a1b9b6aSSam Leffler  * it's private state.
13378a1b9b6aSSam Leffler  */
13388a1b9b6aSSam Leffler struct ieee80211_node *
1339b032f27cSSam Leffler ieee80211_fakeup_adhoc_node(struct ieee80211vap *vap,
134068e8e04eSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
13418a1b9b6aSSam Leffler {
13428a1b9b6aSSam Leffler 	struct ieee80211_node *ni;
13438a1b9b6aSSam Leffler 
1344b032f27cSSam Leffler 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1345be425a0fSSam Leffler 	    "%s: mac<%s>\n", __func__, ether_sprintf(macaddr));
1346b032f27cSSam Leffler 	ni = ieee80211_dup_bss(vap, macaddr);
13478a1b9b6aSSam Leffler 	if (ni != NULL) {
1348b032f27cSSam Leffler 		struct ieee80211com *ic = vap->iv_ic;
1349b032f27cSSam Leffler 
13508a1b9b6aSSam Leffler 		/* XXX no rate negotiation; just dup */
1351b032f27cSSam Leffler 		ni->ni_rates = vap->iv_bss->ni_rates;
1352aa68c24fSSam Leffler 		if (ieee80211_iserp_rateset(&ni->ni_rates))
1353aa68c24fSSam Leffler 			ni->ni_flags |= IEEE80211_NODE_ERP;
1354b032f27cSSam Leffler 		if (vap->iv_opmode == IEEE80211_M_AHDEMO) {
13558e292e8eSSam Leffler 			/*
135668e8e04eSSam Leffler 			 * In adhoc demo mode there are no management
135768e8e04eSSam Leffler 			 * frames to use to discover neighbor capabilities,
135868e8e04eSSam Leffler 			 * so blindly propagate the local configuration
135968e8e04eSSam Leffler 			 * so we can do interesting things (e.g. use
136068e8e04eSSam Leffler 			 * WME to disable ACK's).
13618e292e8eSSam Leffler 			 */
1362b032f27cSSam Leffler 			if (vap->iv_flags & IEEE80211_F_WME)
13638e292e8eSSam Leffler 				ni->ni_flags |= IEEE80211_NODE_QOS;
1364616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
1365b032f27cSSam Leffler 			if (vap->iv_flags & IEEE80211_F_FF)
136668e8e04eSSam Leffler 				ni->ni_flags |= IEEE80211_NODE_FF;
1367616190d0SSam Leffler #endif
13688e292e8eSSam Leffler 		}
1369d77148fbSSam Leffler 		ieee80211_node_setuptxparms(ni);
1370b032f27cSSam Leffler 		if (ic->ic_newassoc != NULL)
1371b032f27cSSam Leffler 			ic->ic_newassoc(ni, 1);
137268e8e04eSSam Leffler 		/* XXX not right for 802.1x/WPA */
137368e8e04eSSam Leffler 		ieee80211_node_authorize(ni);
13748a1b9b6aSSam Leffler 	}
13758a1b9b6aSSam Leffler 	return ni;
13768a1b9b6aSSam Leffler }
13778a1b9b6aSSam Leffler 
1378be425a0fSSam Leffler void
1379be425a0fSSam Leffler ieee80211_init_neighbor(struct ieee80211_node *ni,
1380be425a0fSSam Leffler 	const struct ieee80211_frame *wh,
1381be425a0fSSam Leffler 	const struct ieee80211_scanparams *sp)
1382be425a0fSSam Leffler {
1383be425a0fSSam Leffler 	ni->ni_esslen = sp->ssid[1];
1384be425a0fSSam Leffler 	memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
1385be425a0fSSam Leffler 	IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
1386be425a0fSSam Leffler 	memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
1387be425a0fSSam Leffler 	ni->ni_intval = sp->bintval;
1388be425a0fSSam Leffler 	ni->ni_capinfo = sp->capinfo;
1389be425a0fSSam Leffler 	ni->ni_chan = ni->ni_ic->ic_curchan;
1390be425a0fSSam Leffler 	ni->ni_fhdwell = sp->fhdwell;
1391be425a0fSSam Leffler 	ni->ni_fhindex = sp->fhindex;
1392be425a0fSSam Leffler 	ni->ni_erp = sp->erp;
1393be425a0fSSam Leffler 	ni->ni_timoff = sp->timoff;
1394b032f27cSSam Leffler 
1395b032f27cSSam Leffler 	if (ieee80211_ies_init(&ni->ni_ies, sp->ies, sp->ies_len)) {
1396b032f27cSSam Leffler 		ieee80211_ies_expand(&ni->ni_ies);
13979094ffdfSSam Leffler 		if (ni->ni_ies.wme_ie != NULL)
13989094ffdfSSam Leffler 			ni->ni_flags |= IEEE80211_NODE_QOS;
13999094ffdfSSam Leffler 		else
14009094ffdfSSam Leffler 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
1401616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
1402b032f27cSSam Leffler 		if (ni->ni_ies.ath_ie != NULL)
1403b032f27cSSam Leffler 			ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
1404616190d0SSam Leffler #endif
1405b032f27cSSam Leffler 	}
1406be425a0fSSam Leffler 
1407be425a0fSSam Leffler 	/* NB: must be after ni_chan is setup */
140879edaebfSSam Leffler 	ieee80211_setup_rates(ni, sp->rates, sp->xrates,
140979edaebfSSam Leffler 		IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
141079edaebfSSam Leffler 		IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1411be425a0fSSam Leffler }
1412be425a0fSSam Leffler 
1413b5c99415SSam Leffler /*
1414b5c99415SSam Leffler  * Do node discovery in adhoc mode on receipt of a beacon
1415b5c99415SSam Leffler  * or probe response frame.  Note that for the driver's
1416b5c99415SSam Leffler  * benefit we we treat this like an association so the
1417b5c99415SSam Leffler  * driver has an opportunity to setup it's private state.
1418b5c99415SSam Leffler  */
1419b5c99415SSam Leffler struct ieee80211_node *
1420b032f27cSSam Leffler ieee80211_add_neighbor(struct ieee80211vap *vap,
1421b5c99415SSam Leffler 	const struct ieee80211_frame *wh,
1422b5c99415SSam Leffler 	const struct ieee80211_scanparams *sp)
1423b5c99415SSam Leffler {
1424b5c99415SSam Leffler 	struct ieee80211_node *ni;
1425b5c99415SSam Leffler 
1426b032f27cSSam Leffler 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1427be425a0fSSam Leffler 	    "%s: mac<%s>\n", __func__, ether_sprintf(wh->i_addr2));
1428b032f27cSSam Leffler 	ni = ieee80211_dup_bss(vap, wh->i_addr2);/* XXX alloc_node? */
1429b5c99415SSam Leffler 	if (ni != NULL) {
1430b032f27cSSam Leffler 		struct ieee80211com *ic = vap->iv_ic;
1431b032f27cSSam Leffler 
1432be425a0fSSam Leffler 		ieee80211_init_neighbor(ni, wh, sp);
1433aa68c24fSSam Leffler 		if (ieee80211_iserp_rateset(&ni->ni_rates))
1434aa68c24fSSam Leffler 			ni->ni_flags |= IEEE80211_NODE_ERP;
1435d77148fbSSam Leffler 		ieee80211_node_setuptxparms(ni);
1436b5c99415SSam Leffler 		if (ic->ic_newassoc != NULL)
1437b5c99415SSam Leffler 			ic->ic_newassoc(ni, 1);
1438b5c99415SSam Leffler 		/* XXX not right for 802.1x/WPA */
1439b5c99415SSam Leffler 		ieee80211_node_authorize(ni);
1440b5c99415SSam Leffler 	}
1441b5c99415SSam Leffler 	return ni;
1442b5c99415SSam Leffler }
1443b5c99415SSam Leffler 
1444a2cfa5b7SSam Leffler #define	IS_PROBEREQ(wh) \
1445a2cfa5b7SSam Leffler 	((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK|IEEE80211_FC0_SUBTYPE_MASK)) \
1446a2cfa5b7SSam Leffler 	    == (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ))
1447a2cfa5b7SSam Leffler #define	IS_BCAST_PROBEREQ(wh) \
1448a2cfa5b7SSam Leffler 	(IS_PROBEREQ(wh) && IEEE80211_IS_MULTICAST( \
1449a2cfa5b7SSam Leffler 	    ((const struct ieee80211_frame *)(wh))->i_addr3))
1450a2cfa5b7SSam Leffler 
1451a2cfa5b7SSam Leffler static __inline struct ieee80211_node *
1452a2cfa5b7SSam Leffler _find_rxnode(struct ieee80211_node_table *nt,
1453a2cfa5b7SSam Leffler     const struct ieee80211_frame_min *wh)
1454a2cfa5b7SSam Leffler {
1455a2cfa5b7SSam Leffler 	if (IS_BCAST_PROBEREQ(wh))
1456a2cfa5b7SSam Leffler 		return NULL;		/* spam bcast probe req to all vap's */
1457a2cfa5b7SSam Leffler 	return ieee80211_find_node_locked(nt, wh->i_addr2);
1458a2cfa5b7SSam Leffler }
145968e8e04eSSam Leffler 
14608a1b9b6aSSam Leffler /*
14618a1b9b6aSSam Leffler  * Locate the node for sender, track state, and then pass the
1462a2cfa5b7SSam Leffler  * (referenced) node up to the 802.11 layer for its use.  Note
1463a2cfa5b7SSam Leffler  * we can return NULL if the sender is not in the table.
14648a1b9b6aSSam Leffler  */
14658a1b9b6aSSam Leffler struct ieee80211_node *
14668a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
14678a1b9b6aSSam Leffler ieee80211_find_rxnode_debug(struct ieee80211com *ic,
14688a1b9b6aSSam Leffler 	const struct ieee80211_frame_min *wh, const char *func, int line)
14698a1b9b6aSSam Leffler #else
14708a1b9b6aSSam Leffler ieee80211_find_rxnode(struct ieee80211com *ic,
14718a1b9b6aSSam Leffler 	const struct ieee80211_frame_min *wh)
14728a1b9b6aSSam Leffler #endif
14738a1b9b6aSSam Leffler {
14748a1b9b6aSSam Leffler 	struct ieee80211_node_table *nt;
14758a1b9b6aSSam Leffler 	struct ieee80211_node *ni;
14768a1b9b6aSSam Leffler 
147768e8e04eSSam Leffler 	nt = &ic->ic_sta;
14788a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK(nt);
1479a2cfa5b7SSam Leffler 	ni = _find_rxnode(nt, wh);
14808a1b9b6aSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
14818a1b9b6aSSam Leffler 
1482c1225b52SSam Leffler 	return ni;
1483c1225b52SSam Leffler }
1484c1225b52SSam Leffler 
1485c1225b52SSam Leffler /*
1486c1225b52SSam Leffler  * Like ieee80211_find_rxnode but use the supplied h/w
1487c1225b52SSam Leffler  * key index as a hint to locate the node in the key
1488c1225b52SSam Leffler  * mapping table.  If an entry is present at the key
1489c1225b52SSam Leffler  * index we return it; otherwise do a normal lookup and
1490c1225b52SSam Leffler  * update the mapping table if the station has a unicast
1491c1225b52SSam Leffler  * key assigned to it.
1492c1225b52SSam Leffler  */
1493c1225b52SSam Leffler struct ieee80211_node *
1494c1225b52SSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1495c1225b52SSam Leffler ieee80211_find_rxnode_withkey_debug(struct ieee80211com *ic,
1496c1225b52SSam Leffler 	const struct ieee80211_frame_min *wh, ieee80211_keyix keyix,
1497c1225b52SSam Leffler 	const char *func, int line)
1498c1225b52SSam Leffler #else
1499c1225b52SSam Leffler ieee80211_find_rxnode_withkey(struct ieee80211com *ic,
1500c1225b52SSam Leffler 	const struct ieee80211_frame_min *wh, ieee80211_keyix keyix)
1501c1225b52SSam Leffler #endif
1502c1225b52SSam Leffler {
1503c1225b52SSam Leffler 	struct ieee80211_node_table *nt;
1504c1225b52SSam Leffler 	struct ieee80211_node *ni;
1505c1225b52SSam Leffler 
1506c1225b52SSam Leffler 	nt = &ic->ic_sta;
1507c1225b52SSam Leffler 	IEEE80211_NODE_LOCK(nt);
1508c1225b52SSam Leffler 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax)
1509c1225b52SSam Leffler 		ni = nt->nt_keyixmap[keyix];
1510c1225b52SSam Leffler 	else
1511c1225b52SSam Leffler 		ni = NULL;
1512c1225b52SSam Leffler 	if (ni == NULL) {
1513a2cfa5b7SSam Leffler 		ni = _find_rxnode(nt, wh);
1514b032f27cSSam Leffler 		if (ni != NULL && nt->nt_keyixmap != NULL) {
1515c1225b52SSam Leffler 			/*
1516c1225b52SSam Leffler 			 * If the station has a unicast key cache slot
1517c1225b52SSam Leffler 			 * assigned update the key->node mapping table.
1518c1225b52SSam Leffler 			 */
1519c1225b52SSam Leffler 			keyix = ni->ni_ucastkey.wk_rxkeyix;
1520c1225b52SSam Leffler 			/* XXX can keyixmap[keyix] != NULL? */
1521c1225b52SSam Leffler 			if (keyix < nt->nt_keyixmax &&
1522c1225b52SSam Leffler 			    nt->nt_keyixmap[keyix] == NULL) {
1523b032f27cSSam Leffler 				IEEE80211_DPRINTF(ni->ni_vap,
1524b032f27cSSam Leffler 				    IEEE80211_MSG_NODE,
1525c1225b52SSam Leffler 				    "%s: add key map entry %p<%s> refcnt %d\n",
1526c1225b52SSam Leffler 				    __func__, ni, ether_sprintf(ni->ni_macaddr),
1527c1225b52SSam Leffler 				    ieee80211_node_refcnt(ni)+1);
1528c1225b52SSam Leffler 				nt->nt_keyixmap[keyix] = ieee80211_ref_node(ni);
1529c1225b52SSam Leffler 			}
1530c1225b52SSam Leffler 		}
1531a2cfa5b7SSam Leffler 	} else {
1532a2cfa5b7SSam Leffler 		if (IS_BCAST_PROBEREQ(wh))
1533a2cfa5b7SSam Leffler 			ni = NULL;	/* spam bcast probe req to all vap's */
1534a2cfa5b7SSam Leffler 		else
1535c1225b52SSam Leffler 			ieee80211_ref_node(ni);
1536a2cfa5b7SSam Leffler 	}
1537c1225b52SSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
1538c1225b52SSam Leffler 
1539c1225b52SSam Leffler 	return ni;
1540c1225b52SSam Leffler }
1541a2cfa5b7SSam Leffler #undef IS_BCAST_PROBEREQ
1542a2cfa5b7SSam Leffler #undef IS_PROBEREQ
15438a1b9b6aSSam Leffler 
15448a1b9b6aSSam Leffler /*
1545750d6d0cSSam Leffler  * Return a reference to the appropriate node for sending
1546750d6d0cSSam Leffler  * a data frame.  This handles node discovery in adhoc networks.
1547750d6d0cSSam Leffler  */
1548750d6d0cSSam Leffler struct ieee80211_node *
15498a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1550b032f27cSSam Leffler ieee80211_find_txnode_debug(struct ieee80211vap *vap,
1551b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN],
15528a1b9b6aSSam Leffler 	const char *func, int line)
15538a1b9b6aSSam Leffler #else
1554b032f27cSSam Leffler ieee80211_find_txnode(struct ieee80211vap *vap,
1555b032f27cSSam Leffler 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
15568a1b9b6aSSam Leffler #endif
1557750d6d0cSSam Leffler {
1558b032f27cSSam Leffler 	struct ieee80211_node_table *nt = &vap->iv_ic->ic_sta;
1559750d6d0cSSam Leffler 	struct ieee80211_node *ni;
1560750d6d0cSSam Leffler 
1561750d6d0cSSam Leffler 	/*
1562750d6d0cSSam Leffler 	 * The destination address should be in the node table
1563c1225b52SSam Leffler 	 * unless this is a multicast/broadcast frame.  We can
1564c1225b52SSam Leffler 	 * also optimize station mode operation, all frames go
1565c1225b52SSam Leffler 	 * to the bss node.
1566750d6d0cSSam Leffler 	 */
1567750d6d0cSSam Leffler 	/* XXX can't hold lock across dup_bss 'cuz of recursive locking */
15688a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK(nt);
1569b032f27cSSam Leffler 	if (vap->iv_opmode == IEEE80211_M_STA ||
1570b032f27cSSam Leffler 	    vap->iv_opmode == IEEE80211_M_WDS ||
1571b032f27cSSam Leffler 	    IEEE80211_IS_MULTICAST(macaddr))
1572b032f27cSSam Leffler 		ni = ieee80211_ref_node(vap->iv_bss);
15731b999d64SSam Leffler 	else
1574b032f27cSSam Leffler 		ni = ieee80211_find_node_locked(nt, macaddr);
15758a1b9b6aSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
15768a1b9b6aSSam Leffler 
15778a1b9b6aSSam Leffler 	if (ni == NULL) {
1578b032f27cSSam Leffler 		if (vap->iv_opmode == IEEE80211_M_IBSS ||
1579b032f27cSSam Leffler 		    vap->iv_opmode == IEEE80211_M_AHDEMO) {
158090d0d036SSam Leffler 			/*
158190d0d036SSam Leffler 			 * In adhoc mode cons up a node for the destination.
158290d0d036SSam Leffler 			 * Note that we need an additional reference for the
1583b032f27cSSam Leffler 			 * caller to be consistent with
1584b032f27cSSam Leffler 			 * ieee80211_find_node_locked.
158590d0d036SSam Leffler 			 */
1586b032f27cSSam Leffler 			ni = ieee80211_fakeup_adhoc_node(vap, macaddr);
158790d0d036SSam Leffler 			if (ni != NULL)
158890d0d036SSam Leffler 				(void) ieee80211_ref_node(ni);
158990d0d036SSam Leffler 		} else {
1590b032f27cSSam Leffler 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT, macaddr,
1591b032f27cSSam Leffler 			    "no node, discard frame (%s)", __func__);
1592b032f27cSSam Leffler 			vap->iv_stats.is_tx_nonode++;
1593750d6d0cSSam Leffler 		}
1594750d6d0cSSam Leffler 	}
1595750d6d0cSSam Leffler 	return ni;
1596750d6d0cSSam Leffler }
1597750d6d0cSSam Leffler 
15988a1b9b6aSSam Leffler static void
15998a1b9b6aSSam Leffler _ieee80211_free_node(struct ieee80211_node *ni)
16008a1b9b6aSSam Leffler {
16018a1b9b6aSSam Leffler 	struct ieee80211_node_table *nt = ni->ni_table;
16028a1b9b6aSSam Leffler 
160337e9743aSSam Leffler 	/*
160437e9743aSSam Leffler 	 * NB: careful about referencing the vap as it may be
160537e9743aSSam Leffler 	 * gone if the last reference was held by a driver.
160637e9743aSSam Leffler 	 * We know the com will always be present so it's safe
160737e9743aSSam Leffler 	 * to use ni_ic below to reclaim resources.
160837e9743aSSam Leffler 	 */
160937e9743aSSam Leffler #if 0
1610b032f27cSSam Leffler 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
161149a15236SSam Leffler 		"%s %p<%s> in %s table\n", __func__, ni,
161249a15236SSam Leffler 		ether_sprintf(ni->ni_macaddr),
16138a1b9b6aSSam Leffler 		nt != NULL ? nt->nt_name : "<gone>");
161437e9743aSSam Leffler #endif
161537e9743aSSam Leffler 	if (ni->ni_associd != 0) {
161637e9743aSSam Leffler 		struct ieee80211vap *vap = ni->ni_vap;
1617b032f27cSSam Leffler 		if (vap->iv_aid_bitmap != NULL)
1618b032f27cSSam Leffler 			IEEE80211_AID_CLR(vap, ni->ni_associd);
161937e9743aSSam Leffler 	}
16208a1b9b6aSSam Leffler 	if (nt != NULL) {
16218a1b9b6aSSam Leffler 		TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
16228a1b9b6aSSam Leffler 		LIST_REMOVE(ni, ni_hash);
16238a1b9b6aSSam Leffler 	}
162437e9743aSSam Leffler 	ni->ni_ic->ic_node_free(ni);
16258a1b9b6aSSam Leffler }
16268a1b9b6aSSam Leffler 
16278a1b9b6aSSam Leffler void
16288a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
16298a1b9b6aSSam Leffler ieee80211_free_node_debug(struct ieee80211_node *ni, const char *func, int line)
16308a1b9b6aSSam Leffler #else
16318a1b9b6aSSam Leffler ieee80211_free_node(struct ieee80211_node *ni)
16328a1b9b6aSSam Leffler #endif
16338a1b9b6aSSam Leffler {
16348a1b9b6aSSam Leffler 	struct ieee80211_node_table *nt = ni->ni_table;
16358a1b9b6aSSam Leffler 
16368a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG_REFCNT
1637b032f27cSSam Leffler 	IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
163849a15236SSam Leffler 		"%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni,
16398a1b9b6aSSam Leffler 		 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)-1);
16408a1b9b6aSSam Leffler #endif
1641c1225b52SSam Leffler 	if (nt != NULL) {
1642c1225b52SSam Leffler 		IEEE80211_NODE_LOCK(nt);
16438a1b9b6aSSam Leffler 		if (ieee80211_node_dectestref(ni)) {
16448a1b9b6aSSam Leffler 			/*
1645c1225b52SSam Leffler 			 * Last reference, reclaim state.
16468a1b9b6aSSam Leffler 			 */
16478a1b9b6aSSam Leffler 			_ieee80211_free_node(ni);
1648c1225b52SSam Leffler 		} else if (ieee80211_node_refcnt(ni) == 1 &&
1649c1225b52SSam Leffler 		    nt->nt_keyixmap != NULL) {
1650c1225b52SSam Leffler 			ieee80211_keyix keyix;
1651c1225b52SSam Leffler 			/*
1652c1225b52SSam Leffler 			 * Check for a last reference in the key mapping table.
1653c1225b52SSam Leffler 			 */
1654c1225b52SSam Leffler 			keyix = ni->ni_ucastkey.wk_rxkeyix;
1655c1225b52SSam Leffler 			if (keyix < nt->nt_keyixmax &&
1656c1225b52SSam Leffler 			    nt->nt_keyixmap[keyix] == ni) {
1657b032f27cSSam Leffler 				IEEE80211_DPRINTF(ni->ni_vap,
1658b032f27cSSam Leffler 				    IEEE80211_MSG_NODE,
1659c1225b52SSam Leffler 				    "%s: %p<%s> clear key map entry", __func__,
1660c1225b52SSam Leffler 				    ni, ether_sprintf(ni->ni_macaddr));
1661c1225b52SSam Leffler 				nt->nt_keyixmap[keyix] = NULL;
1662c1225b52SSam Leffler 				ieee80211_node_decref(ni); /* XXX needed? */
16638a1b9b6aSSam Leffler 				_ieee80211_free_node(ni);
16648a1b9b6aSSam Leffler 			}
16651a1e1d21SSam Leffler 		}
1666c1225b52SSam Leffler 		IEEE80211_NODE_UNLOCK(nt);
1667c1225b52SSam Leffler 	} else {
1668c1225b52SSam Leffler 		if (ieee80211_node_dectestref(ni))
1669c1225b52SSam Leffler 			_ieee80211_free_node(ni);
1670c1225b52SSam Leffler 	}
1671c1225b52SSam Leffler }
1672c1225b52SSam Leffler 
1673c1225b52SSam Leffler /*
1674c1225b52SSam Leffler  * Reclaim a unicast key and clear any key cache state.
1675c1225b52SSam Leffler  */
1676c1225b52SSam Leffler int
1677c1225b52SSam Leffler ieee80211_node_delucastkey(struct ieee80211_node *ni)
1678c1225b52SSam Leffler {
167937e9743aSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
168037e9743aSSam Leffler 	struct ieee80211_node_table *nt = &ic->ic_sta;
1681c1225b52SSam Leffler 	struct ieee80211_node *nikey;
1682c1225b52SSam Leffler 	ieee80211_keyix keyix;
1683c1225b52SSam Leffler 	int isowned, status;
1684c1225b52SSam Leffler 
1685c1225b52SSam Leffler 	/*
1686c1225b52SSam Leffler 	 * NB: We must beware of LOR here; deleting the key
1687c1225b52SSam Leffler 	 * can cause the crypto layer to block traffic updates
1688c1225b52SSam Leffler 	 * which can generate a LOR against the node table lock;
1689c1225b52SSam Leffler 	 * grab it here and stash the key index for our use below.
1690c1225b52SSam Leffler 	 *
1691c1225b52SSam Leffler 	 * Must also beware of recursion on the node table lock.
1692c1225b52SSam Leffler 	 * When called from node_cleanup we may already have
1693c1225b52SSam Leffler 	 * the node table lock held.  Unfortunately there's no
1694c1225b52SSam Leffler 	 * way to separate out this path so we must do this
1695c1225b52SSam Leffler 	 * conditionally.
1696c1225b52SSam Leffler 	 */
1697c1225b52SSam Leffler 	isowned = IEEE80211_NODE_IS_LOCKED(nt);
1698c1225b52SSam Leffler 	if (!isowned)
1699c1225b52SSam Leffler 		IEEE80211_NODE_LOCK(nt);
170037e9743aSSam Leffler 	nikey = NULL;
170137e9743aSSam Leffler 	status = 1;		/* NB: success */
1702ca92652aSSam Leffler 	if (ni->ni_ucastkey.wk_keyix != IEEE80211_KEYIX_NONE) {
1703c1225b52SSam Leffler 		keyix = ni->ni_ucastkey.wk_rxkeyix;
170437e9743aSSam Leffler 		status = ieee80211_crypto_delkey(ni->ni_vap, &ni->ni_ucastkey);
1705c1225b52SSam Leffler 		if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax) {
1706c1225b52SSam Leffler 			nikey = nt->nt_keyixmap[keyix];
1707c1225b52SSam Leffler 			nt->nt_keyixmap[keyix] = NULL;;
170837e9743aSSam Leffler 		}
170937e9743aSSam Leffler 	}
1710c1225b52SSam Leffler 	if (!isowned)
1711b032f27cSSam Leffler 		IEEE80211_NODE_UNLOCK(nt);
1712c1225b52SSam Leffler 
1713c1225b52SSam Leffler 	if (nikey != NULL) {
1714c1225b52SSam Leffler 		KASSERT(nikey == ni,
1715c1225b52SSam Leffler 			("key map out of sync, ni %p nikey %p", ni, nikey));
171637e9743aSSam Leffler 		IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
1717c1225b52SSam Leffler 			"%s: delete key map entry %p<%s> refcnt %d\n",
1718c1225b52SSam Leffler 			__func__, ni, ether_sprintf(ni->ni_macaddr),
1719c1225b52SSam Leffler 			ieee80211_node_refcnt(ni)-1);
1720c1225b52SSam Leffler 		ieee80211_free_node(ni);
1721c1225b52SSam Leffler 	}
1722c1225b52SSam Leffler 	return status;
1723c1225b52SSam Leffler }
17241a1e1d21SSam Leffler 
1725303ebc3cSSam Leffler /*
17268a1b9b6aSSam Leffler  * Reclaim a node.  If this is the last reference count then
17278a1b9b6aSSam Leffler  * do the normal free work.  Otherwise remove it from the node
17288a1b9b6aSSam Leffler  * table and mark it gone by clearing the back-reference.
17298a1b9b6aSSam Leffler  */
17308a1b9b6aSSam Leffler static void
17318a1b9b6aSSam Leffler node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
17328a1b9b6aSSam Leffler {
1733c1225b52SSam Leffler 	ieee80211_keyix keyix;
1734c1225b52SSam Leffler 
1735c1225b52SSam Leffler 	IEEE80211_NODE_LOCK_ASSERT(nt);
17368a1b9b6aSSam Leffler 
1737b032f27cSSam Leffler 	IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
173849a15236SSam Leffler 		"%s: remove %p<%s> from %s table, refcnt %d\n",
173949a15236SSam Leffler 		__func__, ni, ether_sprintf(ni->ni_macaddr),
174049a15236SSam Leffler 		nt->nt_name, ieee80211_node_refcnt(ni)-1);
1741c1225b52SSam Leffler 	/*
1742c1225b52SSam Leffler 	 * Clear any entry in the unicast key mapping table.
1743c1225b52SSam Leffler 	 * We need to do it here so rx lookups don't find it
1744c1225b52SSam Leffler 	 * in the mapping table even if it's not in the hash
1745c1225b52SSam Leffler 	 * table.  We cannot depend on the mapping table entry
1746c1225b52SSam Leffler 	 * being cleared because the node may not be free'd.
1747c1225b52SSam Leffler 	 */
1748c1225b52SSam Leffler 	keyix = ni->ni_ucastkey.wk_rxkeyix;
1749c1225b52SSam Leffler 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
1750c1225b52SSam Leffler 	    nt->nt_keyixmap[keyix] == ni) {
1751b032f27cSSam Leffler 		IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
175273bac36fSSam Leffler 			"%s: %p<%s> clear key map entry %u\n",
175373bac36fSSam Leffler 			__func__, ni, ether_sprintf(ni->ni_macaddr), keyix);
1754c1225b52SSam Leffler 		nt->nt_keyixmap[keyix] = NULL;
1755c1225b52SSam Leffler 		ieee80211_node_decref(ni);	/* NB: don't need free */
1756c1225b52SSam Leffler 	}
17578a1b9b6aSSam Leffler 	if (!ieee80211_node_dectestref(ni)) {
17588a1b9b6aSSam Leffler 		/*
17598a1b9b6aSSam Leffler 		 * Other references are present, just remove the
17608a1b9b6aSSam Leffler 		 * node from the table so it cannot be found.  When
17618a1b9b6aSSam Leffler 		 * the references are dropped storage will be
1762acc4f7f5SSam Leffler 		 * reclaimed.
17638a1b9b6aSSam Leffler 		 */
17648a1b9b6aSSam Leffler 		TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
17658a1b9b6aSSam Leffler 		LIST_REMOVE(ni, ni_hash);
17668a1b9b6aSSam Leffler 		ni->ni_table = NULL;		/* clear reference */
17678a1b9b6aSSam Leffler 	} else
17688a1b9b6aSSam Leffler 		_ieee80211_free_node(ni);
17698a1b9b6aSSam Leffler }
17708a1b9b6aSSam Leffler 
1771b032f27cSSam Leffler /*
1772b032f27cSSam Leffler  * Node table support.
1773b032f27cSSam Leffler  */
1774b032f27cSSam Leffler 
1775b032f27cSSam Leffler static void
1776b032f27cSSam Leffler ieee80211_node_table_init(struct ieee80211com *ic,
1777b032f27cSSam Leffler 	struct ieee80211_node_table *nt,
1778b032f27cSSam Leffler 	const char *name, int inact, int keyixmax)
1779b032f27cSSam Leffler {
1780b032f27cSSam Leffler 	struct ifnet *ifp = ic->ic_ifp;
1781b032f27cSSam Leffler 
1782b032f27cSSam Leffler 	nt->nt_ic = ic;
1783b032f27cSSam Leffler 	IEEE80211_NODE_LOCK_INIT(nt, ifp->if_xname);
1784b032f27cSSam Leffler 	IEEE80211_NODE_ITERATE_LOCK_INIT(nt, ifp->if_xname);
1785b032f27cSSam Leffler 	TAILQ_INIT(&nt->nt_node);
1786b032f27cSSam Leffler 	nt->nt_name = name;
1787b032f27cSSam Leffler 	nt->nt_scangen = 1;
1788b032f27cSSam Leffler 	nt->nt_inact_init = inact;
1789b032f27cSSam Leffler 	nt->nt_keyixmax = keyixmax;
1790b032f27cSSam Leffler 	if (nt->nt_keyixmax > 0) {
1791e2126decSSam Leffler 		nt->nt_keyixmap = (struct ieee80211_node **) malloc(
1792c5abbba3SDag-Erling Smørgrav 			keyixmax * sizeof(struct ieee80211_node *),
1793b032f27cSSam Leffler 			M_80211_NODE, M_NOWAIT | M_ZERO);
1794b032f27cSSam Leffler 		if (nt->nt_keyixmap == NULL)
1795b032f27cSSam Leffler 			if_printf(ic->ic_ifp,
1796b032f27cSSam Leffler 			    "Cannot allocate key index map with %u entries\n",
1797b032f27cSSam Leffler 			    keyixmax);
1798b032f27cSSam Leffler 	} else
1799b032f27cSSam Leffler 		nt->nt_keyixmap = NULL;
1800b032f27cSSam Leffler }
1801b032f27cSSam Leffler 
1802b032f27cSSam Leffler static void
1803b032f27cSSam Leffler ieee80211_node_table_reset(struct ieee80211_node_table *nt,
1804b032f27cSSam Leffler 	struct ieee80211vap *match)
1805b032f27cSSam Leffler {
1806b032f27cSSam Leffler 	struct ieee80211_node *ni, *next;
1807b032f27cSSam Leffler 
1808b032f27cSSam Leffler 	IEEE80211_NODE_LOCK(nt);
1809b032f27cSSam Leffler 	TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next) {
1810b032f27cSSam Leffler 		if (match != NULL && ni->ni_vap != match)
1811b032f27cSSam Leffler 			continue;
1812b032f27cSSam Leffler 		/* XXX can this happen?  if so need's work */
1813b032f27cSSam Leffler 		if (ni->ni_associd != 0) {
1814b032f27cSSam Leffler 			struct ieee80211vap *vap = ni->ni_vap;
1815b032f27cSSam Leffler 
1816b032f27cSSam Leffler 			if (vap->iv_auth->ia_node_leave != NULL)
1817b032f27cSSam Leffler 				vap->iv_auth->ia_node_leave(ni);
1818b032f27cSSam Leffler 			if (vap->iv_aid_bitmap != NULL)
1819b032f27cSSam Leffler 				IEEE80211_AID_CLR(vap, ni->ni_associd);
1820b032f27cSSam Leffler 		}
1821b032f27cSSam Leffler 		ni->ni_wdsvap = NULL;		/* clear reference */
18228a1b9b6aSSam Leffler 		node_reclaim(nt, ni);
18238a1b9b6aSSam Leffler 	}
1824b032f27cSSam Leffler 	if (match != NULL && match->iv_opmode == IEEE80211_M_WDS) {
1825b032f27cSSam Leffler 		/*
1826b032f27cSSam Leffler 		 * Make a separate pass to clear references to this vap
1827b032f27cSSam Leffler 		 * held by DWDS entries.  They will not be matched above
1828b032f27cSSam Leffler 		 * because ni_vap will point to the ap vap but we still
1829b032f27cSSam Leffler 		 * need to clear ni_wdsvap when the WDS vap is destroyed
1830b032f27cSSam Leffler 		 * and/or reset.
1831b032f27cSSam Leffler 		 */
1832b032f27cSSam Leffler 		TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next)
1833b032f27cSSam Leffler 			if (ni->ni_wdsvap == match)
1834b032f27cSSam Leffler 				ni->ni_wdsvap = NULL;
1835b032f27cSSam Leffler 	}
1836b032f27cSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
1837b032f27cSSam Leffler }
1838b032f27cSSam Leffler 
1839b032f27cSSam Leffler static void
1840b032f27cSSam Leffler ieee80211_node_table_cleanup(struct ieee80211_node_table *nt)
1841b032f27cSSam Leffler {
1842b032f27cSSam Leffler 	ieee80211_node_table_reset(nt, NULL);
1843b032f27cSSam Leffler 	if (nt->nt_keyixmap != NULL) {
1844b032f27cSSam Leffler #ifdef DIAGNOSTIC
1845b032f27cSSam Leffler 		/* XXX verify all entries are NULL */
1846b032f27cSSam Leffler 		int i;
1847b032f27cSSam Leffler 		for (i = 0; i < nt->nt_keyixmax; i++)
1848b032f27cSSam Leffler 			if (nt->nt_keyixmap[i] != NULL)
1849b032f27cSSam Leffler 				printf("%s: %s[%u] still active\n", __func__,
1850b032f27cSSam Leffler 					nt->nt_name, i);
1851b032f27cSSam Leffler #endif
1852e2126decSSam Leffler 		free(nt->nt_keyixmap, M_80211_NODE);
1853b032f27cSSam Leffler 		nt->nt_keyixmap = NULL;
1854b032f27cSSam Leffler 	}
1855b032f27cSSam Leffler 	IEEE80211_NODE_ITERATE_LOCK_DESTROY(nt);
1856b032f27cSSam Leffler 	IEEE80211_NODE_LOCK_DESTROY(nt);
18578a1b9b6aSSam Leffler }
18588a1b9b6aSSam Leffler 
18598a1b9b6aSSam Leffler /*
18608a1b9b6aSSam Leffler  * Timeout inactive stations and do related housekeeping.
18618a1b9b6aSSam Leffler  * Note that we cannot hold the node lock while sending a
18628a1b9b6aSSam Leffler  * frame as this would lead to a LOR.  Instead we use a
18638a1b9b6aSSam Leffler  * generation number to mark nodes that we've scanned and
18648a1b9b6aSSam Leffler  * drop the lock and restart a scan if we have to time out
18658a1b9b6aSSam Leffler  * a node.  Since we are single-threaded by virtue of
1866303ebc3cSSam Leffler  * controlling the inactivity timer we can be sure this will
1867303ebc3cSSam Leffler  * process each node only once.
1868303ebc3cSSam Leffler  */
18698a1b9b6aSSam Leffler static void
1870b032f27cSSam Leffler ieee80211_timeout_stations(struct ieee80211com *ic)
18711a1e1d21SSam Leffler {
1872b032f27cSSam Leffler 	struct ieee80211_node_table *nt = &ic->ic_sta;
1873b032f27cSSam Leffler 	struct ieee80211vap *vap;
1874303ebc3cSSam Leffler 	struct ieee80211_node *ni;
1875b032f27cSSam Leffler 	int gen = 0;
18761a1e1d21SSam Leffler 
1877b032f27cSSam Leffler 	IEEE80211_NODE_ITERATE_LOCK(nt);
1878a1a50502SSam Leffler 	gen = ++nt->nt_scangen;
1879303ebc3cSSam Leffler restart:
18808a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK(nt);
18818a1b9b6aSSam Leffler 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1882303ebc3cSSam Leffler 		if (ni->ni_scangen == gen)	/* previously handled */
1883303ebc3cSSam Leffler 			continue;
1884303ebc3cSSam Leffler 		ni->ni_scangen = gen;
18850a915fadSSam Leffler 		/*
1886ebdda46cSSam Leffler 		 * Ignore entries for which have yet to receive an
1887ebdda46cSSam Leffler 		 * authentication frame.  These are transient and
1888ebdda46cSSam Leffler 		 * will be reclaimed when the last reference to them
1889ebdda46cSSam Leffler 		 * goes away (when frame xmits complete).
1890ebdda46cSSam Leffler 		 */
1891b032f27cSSam Leffler 		vap = ni->ni_vap;
1892b032f27cSSam Leffler 		/*
1893b032f27cSSam Leffler 		 * Only process stations when in RUN state.  This
1894b032f27cSSam Leffler 		 * insures, for example, that we don't timeout an
1895b032f27cSSam Leffler 		 * inactive station during CAC.  Note that CSA state
1896b032f27cSSam Leffler 		 * is actually handled in ieee80211_node_timeout as
1897b032f27cSSam Leffler 		 * it applies to more than timeout processing.
1898b032f27cSSam Leffler 		 */
1899b032f27cSSam Leffler 		if (vap->iv_state != IEEE80211_S_RUN)
1900b032f27cSSam Leffler 			continue;
1901b032f27cSSam Leffler 		/* XXX can vap be NULL? */
1902b032f27cSSam Leffler 		if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
1903b032f27cSSam Leffler 		     vap->iv_opmode == IEEE80211_M_STA) &&
190444b666cdSSam Leffler 		    (ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1905ebdda46cSSam Leffler 			continue;
1906ebdda46cSSam Leffler 		/*
19078a1b9b6aSSam Leffler 		 * Free fragment if not needed anymore
19088a1b9b6aSSam Leffler 		 * (last fragment older than 1s).
1909b032f27cSSam Leffler 		 * XXX doesn't belong here, move to node_age
19100a915fadSSam Leffler 		 */
19118a1b9b6aSSam Leffler 		if (ni->ni_rxfrag[0] != NULL &&
19128a1b9b6aSSam Leffler 		    ticks > ni->ni_rxfragstamp + hz) {
19138a1b9b6aSSam Leffler 			m_freem(ni->ni_rxfrag[0]);
19148a1b9b6aSSam Leffler 			ni->ni_rxfrag[0] = NULL;
19158a1b9b6aSSam Leffler 		}
1916be1054edSSam Leffler 		if (ni->ni_inact > 0) {
1917c066143cSSam Leffler 			ni->ni_inact--;
1918be1054edSSam Leffler 			IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
1919be1054edSSam Leffler 			    "%s: inact %u inact_reload %u nrates %u",
1920be1054edSSam Leffler 			    __func__, ni->ni_inact, ni->ni_inact_reload,
1921be1054edSSam Leffler 			    ni->ni_rates.rs_nrates);
1922be1054edSSam Leffler 		}
1923ce647032SSam Leffler 		/*
1924ce647032SSam Leffler 		 * Special case ourself; we may be idle for extended periods
1925ce647032SSam Leffler 		 * of time and regardless reclaiming our state is wrong.
1926b032f27cSSam Leffler 		 * XXX run ic_node_age
1927ce647032SSam Leffler 		 */
1928b032f27cSSam Leffler 		if (ni == vap->iv_bss)
1929ce647032SSam Leffler 			continue;
1930b032f27cSSam Leffler 		if (ni->ni_associd != 0 ||
1931b032f27cSSam Leffler 		    (vap->iv_opmode == IEEE80211_M_IBSS ||
1932b032f27cSSam Leffler 		     vap->iv_opmode == IEEE80211_M_AHDEMO)) {
19338a1b9b6aSSam Leffler 			/*
1934b032f27cSSam Leffler 			 * Age/drain resources held by the station.
19358a1b9b6aSSam Leffler 			 */
1936b032f27cSSam Leffler 			ic->ic_node_age(ni);
19378a1b9b6aSSam Leffler 			/*
19388a1b9b6aSSam Leffler 			 * Probe the station before time it out.  We
19398a1b9b6aSSam Leffler 			 * send a null data frame which may not be
19408a1b9b6aSSam Leffler 			 * universally supported by drivers (need it
19418a1b9b6aSSam Leffler 			 * for ps-poll support so it should be...).
194268e8e04eSSam Leffler 			 *
194368e8e04eSSam Leffler 			 * XXX don't probe the station unless we've
194468e8e04eSSam Leffler 			 *     received a frame from them (and have
194568e8e04eSSam Leffler 			 *     some idea of the rates they are capable
194668e8e04eSSam Leffler 			 *     of); this will get fixed more properly
194768e8e04eSSam Leffler 			 *     soon with better handling of the rate set.
19488a1b9b6aSSam Leffler 			 */
1949b032f27cSSam Leffler 			if ((vap->iv_flags_ext & IEEE80211_FEXT_INACT) &&
1950c066143cSSam Leffler 			    (0 < ni->ni_inact &&
1951b032f27cSSam Leffler 			     ni->ni_inact <= vap->iv_inact_probe) &&
195268e8e04eSSam Leffler 			    ni->ni_rates.rs_nrates != 0) {
1953b032f27cSSam Leffler 				IEEE80211_NOTE(vap,
1954f66d97f6SSam Leffler 				    IEEE80211_MSG_INACT | IEEE80211_MSG_NODE,
1955f66d97f6SSam Leffler 				    ni, "%s",
1956f66d97f6SSam Leffler 				    "probe station due to inactivity");
195719ad2dd7SSam Leffler 				/*
195819ad2dd7SSam Leffler 				 * Grab a reference before unlocking the table
195919ad2dd7SSam Leffler 				 * so the node cannot be reclaimed before we
196019ad2dd7SSam Leffler 				 * send the frame. ieee80211_send_nulldata
196119ad2dd7SSam Leffler 				 * understands we've done this and reclaims the
196219ad2dd7SSam Leffler 				 * ref for us as needed.
196319ad2dd7SSam Leffler 				 */
196419ad2dd7SSam Leffler 				ieee80211_ref_node(ni);
19658a1b9b6aSSam Leffler 				IEEE80211_NODE_UNLOCK(nt);
1966f62121ceSSam Leffler 				ieee80211_send_nulldata(ni);
19678a1b9b6aSSam Leffler 				/* XXX stat? */
19688a1b9b6aSSam Leffler 				goto restart;
19698a1b9b6aSSam Leffler 			}
19708a1b9b6aSSam Leffler 		}
1971b032f27cSSam Leffler 		if ((vap->iv_flags_ext & IEEE80211_FEXT_INACT) &&
1972c066143cSSam Leffler 		    ni->ni_inact <= 0) {
1973b032f27cSSam Leffler 			IEEE80211_NOTE(vap,
1974f66d97f6SSam Leffler 			    IEEE80211_MSG_INACT | IEEE80211_MSG_NODE, ni,
1975f66d97f6SSam Leffler 			    "station timed out due to inactivity "
1976f66d97f6SSam Leffler 			    "(refcnt %u)", ieee80211_node_refcnt(ni));
19778a1b9b6aSSam Leffler 			/*
19788a1b9b6aSSam Leffler 			 * Send a deauthenticate frame and drop the station.
19798a1b9b6aSSam Leffler 			 * This is somewhat complicated due to reference counts
19808a1b9b6aSSam Leffler 			 * and locking.  At this point a station will typically
19818a1b9b6aSSam Leffler 			 * have a reference count of 1.  ieee80211_node_leave
19828a1b9b6aSSam Leffler 			 * will do a "free" of the node which will drop the
19838a1b9b6aSSam Leffler 			 * reference count.  But in the meantime a reference
19848a1b9b6aSSam Leffler 			 * wil be held by the deauth frame.  The actual reclaim
19858a1b9b6aSSam Leffler 			 * of the node will happen either after the tx is
19868a1b9b6aSSam Leffler 			 * completed or by ieee80211_node_leave.
19878a1b9b6aSSam Leffler 			 *
19888a1b9b6aSSam Leffler 			 * Separately we must drop the node lock before sending
198968e8e04eSSam Leffler 			 * in case the driver takes a lock, as this can result
199068e8e04eSSam Leffler 			 * in a LOR between the node lock and the driver lock.
19918a1b9b6aSSam Leffler 			 */
19925698ab1aSSam Leffler 			ieee80211_ref_node(ni);
19938a1b9b6aSSam Leffler 			IEEE80211_NODE_UNLOCK(nt);
19948a1b9b6aSSam Leffler 			if (ni->ni_associd != 0) {
1995b032f27cSSam Leffler 				IEEE80211_SEND_MGMT(ni,
19961a1e1d21SSam Leffler 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
19971a1e1d21SSam Leffler 				    IEEE80211_REASON_AUTH_EXPIRE);
19988a1b9b6aSSam Leffler 			}
1999b032f27cSSam Leffler 			ieee80211_node_leave(ni);
20005698ab1aSSam Leffler 			ieee80211_free_node(ni);
2001b032f27cSSam Leffler 			vap->iv_stats.is_node_timeout++;
2002303ebc3cSSam Leffler 			goto restart;
2003303ebc3cSSam Leffler 		}
20041a1e1d21SSam Leffler 	}
20058a1b9b6aSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
20068a1b9b6aSSam Leffler 
2007b032f27cSSam Leffler 	IEEE80211_NODE_ITERATE_UNLOCK(nt);
200868e8e04eSSam Leffler }
20098a1b9b6aSSam Leffler 
2010b032f27cSSam Leffler /*
2011b032f27cSSam Leffler  * Aggressively reclaim resources.  This should be used
2012b032f27cSSam Leffler  * only in a critical situation to reclaim mbuf resources.
2013b032f27cSSam Leffler  */
2014b032f27cSSam Leffler void
2015b032f27cSSam Leffler ieee80211_drain(struct ieee80211com *ic)
2016b032f27cSSam Leffler {
2017b032f27cSSam Leffler 	struct ieee80211_node_table *nt = &ic->ic_sta;
2018b032f27cSSam Leffler 	struct ieee80211vap *vap;
2019b032f27cSSam Leffler 	struct ieee80211_node *ni;
2020b032f27cSSam Leffler 
2021b032f27cSSam Leffler 	IEEE80211_NODE_LOCK(nt);
2022b032f27cSSam Leffler 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
2023b032f27cSSam Leffler 		/*
2024b032f27cSSam Leffler 		 * Ignore entries for which have yet to receive an
2025b032f27cSSam Leffler 		 * authentication frame.  These are transient and
2026b032f27cSSam Leffler 		 * will be reclaimed when the last reference to them
2027b032f27cSSam Leffler 		 * goes away (when frame xmits complete).
2028b032f27cSSam Leffler 		 */
2029b032f27cSSam Leffler 		vap = ni->ni_vap;
2030b032f27cSSam Leffler 		/*
2031b032f27cSSam Leffler 		 * Only process stations when in RUN state.  This
2032b032f27cSSam Leffler 		 * insures, for example, that we don't timeout an
2033b032f27cSSam Leffler 		 * inactive station during CAC.  Note that CSA state
2034b032f27cSSam Leffler 		 * is actually handled in ieee80211_node_timeout as
2035b032f27cSSam Leffler 		 * it applies to more than timeout processing.
2036b032f27cSSam Leffler 		 */
2037b032f27cSSam Leffler 		if (vap->iv_state != IEEE80211_S_RUN)
2038b032f27cSSam Leffler 			continue;
2039b032f27cSSam Leffler 		/* XXX can vap be NULL? */
2040b032f27cSSam Leffler 		if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
2041b032f27cSSam Leffler 		     vap->iv_opmode == IEEE80211_M_STA) &&
2042b032f27cSSam Leffler 		    (ni->ni_flags & IEEE80211_NODE_AREF) == 0)
2043b032f27cSSam Leffler 			continue;
2044b032f27cSSam Leffler 		/*
2045b032f27cSSam Leffler 		 * Free fragments.
2046b032f27cSSam Leffler 		 * XXX doesn't belong here, move to node_drain
2047b032f27cSSam Leffler 		 */
2048b032f27cSSam Leffler 		if (ni->ni_rxfrag[0] != NULL) {
2049b032f27cSSam Leffler 			m_freem(ni->ni_rxfrag[0]);
2050b032f27cSSam Leffler 			ni->ni_rxfrag[0] = NULL;
2051b032f27cSSam Leffler 		}
2052b032f27cSSam Leffler 		/*
2053b032f27cSSam Leffler 		 * Drain resources held by the station.
2054b032f27cSSam Leffler 		 */
2055b032f27cSSam Leffler 		ic->ic_node_drain(ni);
2056b032f27cSSam Leffler 	}
2057b032f27cSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
2058b032f27cSSam Leffler }
2059b032f27cSSam Leffler 
2060b032f27cSSam Leffler /*
2061b032f27cSSam Leffler  * Per-ieee80211com inactivity timer callback.
2062b032f27cSSam Leffler  */
206368e8e04eSSam Leffler void
206468e8e04eSSam Leffler ieee80211_node_timeout(void *arg)
206568e8e04eSSam Leffler {
206668e8e04eSSam Leffler 	struct ieee80211com *ic = arg;
206768e8e04eSSam Leffler 
2068b032f27cSSam Leffler 	/*
2069b032f27cSSam Leffler 	 * Defer timeout processing if a channel switch is pending.
2070b032f27cSSam Leffler 	 * We typically need to be mute so not doing things that
2071b032f27cSSam Leffler 	 * might generate frames is good to handle in one place.
2072b032f27cSSam Leffler 	 * Supressing the station timeout processing may extend the
2073b032f27cSSam Leffler 	 * lifetime of inactive stations (by not decrementing their
2074b032f27cSSam Leffler 	 * idle counters) but this should be ok unless the CSA is
2075b032f27cSSam Leffler 	 * active for an unusually long time.
2076b032f27cSSam Leffler 	 */
2077b032f27cSSam Leffler 	if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
207868e8e04eSSam Leffler 		ieee80211_scan_timeout(ic);
2079b032f27cSSam Leffler 		ieee80211_timeout_stations(ic);
20805b16c28cSSam Leffler 		ieee80211_ageq_age(&ic->ic_stageq, IEEE80211_INACT_WAIT);
208168e8e04eSSam Leffler 
2082b105a069SSam Leffler 		IEEE80211_LOCK(ic);
2083b105a069SSam Leffler 		ieee80211_erp_timeout(ic);
20841b6167d2SSam Leffler 		ieee80211_ht_timeout(ic);
2085b105a069SSam Leffler 		IEEE80211_UNLOCK(ic);
2086b032f27cSSam Leffler 	}
208768e8e04eSSam Leffler 	callout_reset(&ic->ic_inact, IEEE80211_INACT_WAIT*hz,
208868e8e04eSSam Leffler 		ieee80211_node_timeout, ic);
20891a1e1d21SSam Leffler }
20901a1e1d21SSam Leffler 
20911a1e1d21SSam Leffler void
2092b032f27cSSam Leffler ieee80211_iterate_nodes(struct ieee80211_node_table *nt,
2093b032f27cSSam Leffler 	ieee80211_iter_func *f, void *arg)
20941a1e1d21SSam Leffler {
20951a1e1d21SSam Leffler 	struct ieee80211_node *ni;
20968a1b9b6aSSam Leffler 	u_int gen;
20971a1e1d21SSam Leffler 
2098b032f27cSSam Leffler 	IEEE80211_NODE_ITERATE_LOCK(nt);
2099a1a50502SSam Leffler 	gen = ++nt->nt_scangen;
21008a1b9b6aSSam Leffler restart:
21018a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK(nt);
21028a1b9b6aSSam Leffler 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
21038a1b9b6aSSam Leffler 		if (ni->ni_scangen != gen) {
21048a1b9b6aSSam Leffler 			ni->ni_scangen = gen;
21058a1b9b6aSSam Leffler 			(void) ieee80211_ref_node(ni);
21068a1b9b6aSSam Leffler 			IEEE80211_NODE_UNLOCK(nt);
21071a1e1d21SSam Leffler 			(*f)(arg, ni);
21088a1b9b6aSSam Leffler 			ieee80211_free_node(ni);
21098a1b9b6aSSam Leffler 			goto restart;
21108a1b9b6aSSam Leffler 		}
21118a1b9b6aSSam Leffler 	}
21128a1b9b6aSSam Leffler 	IEEE80211_NODE_UNLOCK(nt);
21138a1b9b6aSSam Leffler 
2114b032f27cSSam Leffler 	IEEE80211_NODE_ITERATE_UNLOCK(nt);
21158a1b9b6aSSam Leffler }
21168a1b9b6aSSam Leffler 
21178a1b9b6aSSam Leffler void
21188a1b9b6aSSam Leffler ieee80211_dump_node(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
21198a1b9b6aSSam Leffler {
21208a1b9b6aSSam Leffler 	printf("0x%p: mac %s refcnt %d\n", ni,
21218a1b9b6aSSam Leffler 		ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni));
21228a1b9b6aSSam Leffler 	printf("\tscangen %u authmode %u flags 0x%x\n",
21238a1b9b6aSSam Leffler 		ni->ni_scangen, ni->ni_authmode, ni->ni_flags);
21248a1b9b6aSSam Leffler 	printf("\tassocid 0x%x txpower %u vlan %u\n",
21258a1b9b6aSSam Leffler 		ni->ni_associd, ni->ni_txpower, ni->ni_vlan);
21268a1b9b6aSSam Leffler 	printf("\ttxseq %u rxseq %u fragno %u rxfragstamp %u\n",
2127801df4a5SSam Leffler 		ni->ni_txseqs[IEEE80211_NONQOS_TID],
2128801df4a5SSam Leffler 		ni->ni_rxseqs[IEEE80211_NONQOS_TID] >> IEEE80211_SEQ_SEQ_SHIFT,
2129801df4a5SSam Leffler 		ni->ni_rxseqs[IEEE80211_NONQOS_TID] & IEEE80211_SEQ_FRAG_MASK,
21308a1b9b6aSSam Leffler 		ni->ni_rxfragstamp);
21315463c4a4SSam Leffler 	printf("\trssi %d noise %d intval %u capinfo 0x%x\n",
21325463c4a4SSam Leffler 		node_getrssi(ni), ni->ni_noise,
213368e8e04eSSam Leffler 		ni->ni_intval, ni->ni_capinfo);
21348a1b9b6aSSam Leffler 	printf("\tbssid %s essid \"%.*s\" channel %u:0x%x\n",
21358a1b9b6aSSam Leffler 		ether_sprintf(ni->ni_bssid),
21368a1b9b6aSSam Leffler 		ni->ni_esslen, ni->ni_essid,
21378a1b9b6aSSam Leffler 		ni->ni_chan->ic_freq, ni->ni_chan->ic_flags);
2138be1054edSSam Leffler 	printf("\tinact %u inact_reload %u txrate %u\n",
2139be1054edSSam Leffler 		ni->ni_inact, ni->ni_inact_reload, ni->ni_txrate);
214068e8e04eSSam Leffler 	printf("\thtcap %x htparam %x htctlchan %u ht2ndchan %u\n",
214168e8e04eSSam Leffler 		ni->ni_htcap, ni->ni_htparam,
214268e8e04eSSam Leffler 		ni->ni_htctlchan, ni->ni_ht2ndchan);
214368e8e04eSSam Leffler 	printf("\thtopmode %x htstbc %x chw %u\n",
214468e8e04eSSam Leffler 		ni->ni_htopmode, ni->ni_htstbc, ni->ni_chw);
21458a1b9b6aSSam Leffler }
21468a1b9b6aSSam Leffler 
21478a1b9b6aSSam Leffler void
21488a1b9b6aSSam Leffler ieee80211_dump_nodes(struct ieee80211_node_table *nt)
21498a1b9b6aSSam Leffler {
21508a1b9b6aSSam Leffler 	ieee80211_iterate_nodes(nt,
21518a1b9b6aSSam Leffler 		(ieee80211_iter_func *) ieee80211_dump_node, nt);
21528a1b9b6aSSam Leffler }
21538a1b9b6aSSam Leffler 
21542dc4d8dcSSam Leffler static void
21552dc4d8dcSSam Leffler ieee80211_notify_erp_locked(struct ieee80211com *ic)
2156b105a069SSam Leffler {
2157b032f27cSSam Leffler 	struct ieee80211vap *vap;
2158b032f27cSSam Leffler 
2159b032f27cSSam Leffler 	IEEE80211_LOCK_ASSERT(ic);
2160b032f27cSSam Leffler 
2161b032f27cSSam Leffler 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
2162b032f27cSSam Leffler 		if (vap->iv_opmode == IEEE80211_M_HOSTAP)
2163b032f27cSSam Leffler 			ieee80211_beacon_notify(vap, IEEE80211_BEACON_ERP);
2164b105a069SSam Leffler }
2165b105a069SSam Leffler 
21662dc4d8dcSSam Leffler void
21672dc4d8dcSSam Leffler ieee80211_notify_erp(struct ieee80211com *ic)
21682dc4d8dcSSam Leffler {
21692dc4d8dcSSam Leffler 	IEEE80211_LOCK(ic);
21702dc4d8dcSSam Leffler 	ieee80211_notify_erp_locked(ic);
21712dc4d8dcSSam Leffler 	IEEE80211_UNLOCK(ic);
21722dc4d8dcSSam Leffler }
21732dc4d8dcSSam Leffler 
21748a1b9b6aSSam Leffler /*
21758a1b9b6aSSam Leffler  * Handle a station joining an 11g network.
21768a1b9b6aSSam Leffler  */
21778a1b9b6aSSam Leffler static void
2178b032f27cSSam Leffler ieee80211_node_join_11g(struct ieee80211_node *ni)
21798a1b9b6aSSam Leffler {
2180b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
21818a1b9b6aSSam Leffler 
21821b6167d2SSam Leffler 	IEEE80211_LOCK_ASSERT(ic);
21831b6167d2SSam Leffler 
21848a1b9b6aSSam Leffler 	/*
21858a1b9b6aSSam Leffler 	 * Station isn't capable of short slot time.  Bump
21868a1b9b6aSSam Leffler 	 * the count of long slot time stations and disable
21878a1b9b6aSSam Leffler 	 * use of short slot time.  Note that the actual switch
21888a1b9b6aSSam Leffler 	 * over to long slot time use may not occur until the
21898a1b9b6aSSam Leffler 	 * next beacon transmission (per sec. 7.3.1.4 of 11g).
21908a1b9b6aSSam Leffler 	 */
21918a1b9b6aSSam Leffler 	if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
21928a1b9b6aSSam Leffler 		ic->ic_longslotsta++;
2193b032f27cSSam Leffler 		IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni,
2194b105a069SSam Leffler 		    "station needs long slot time, count %d",
2195b105a069SSam Leffler 		    ic->ic_longslotsta);
21968a1b9b6aSSam Leffler 		/* XXX vap's w/ conflicting needs won't work */
219768e8e04eSSam Leffler 		if (!IEEE80211_IS_CHAN_108G(ic->ic_bsschan)) {
219868e8e04eSSam Leffler 			/*
219968e8e04eSSam Leffler 			 * Don't force slot time when switched to turbo
220068e8e04eSSam Leffler 			 * mode as non-ERP stations won't be present; this
220168e8e04eSSam Leffler 			 * need only be done when on the normal G channel.
220268e8e04eSSam Leffler 			 */
22038a1b9b6aSSam Leffler 			ieee80211_set_shortslottime(ic, 0);
22048a1b9b6aSSam Leffler 		}
220568e8e04eSSam Leffler 	}
22068a1b9b6aSSam Leffler 	/*
22078a1b9b6aSSam Leffler 	 * If the new station is not an ERP station
22088a1b9b6aSSam Leffler 	 * then bump the counter and enable protection
22098a1b9b6aSSam Leffler 	 * if configured.
22108a1b9b6aSSam Leffler 	 */
2211b032f27cSSam Leffler 	if (!ieee80211_iserp_rateset(&ni->ni_rates)) {
22128a1b9b6aSSam Leffler 		ic->ic_nonerpsta++;
2213b032f27cSSam Leffler 		IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni,
2214b105a069SSam Leffler 		    "station is !ERP, %d non-ERP stations associated",
2215b105a069SSam Leffler 		    ic->ic_nonerpsta);
22168a1b9b6aSSam Leffler 		/*
22178a1b9b6aSSam Leffler 		 * If station does not support short preamble
22188a1b9b6aSSam Leffler 		 * then we must enable use of Barker preamble.
22198a1b9b6aSSam Leffler 		 */
22208a1b9b6aSSam Leffler 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) == 0) {
2221b032f27cSSam Leffler 			IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni,
2222b105a069SSam Leffler 			    "%s", "station needs long preamble");
22238a1b9b6aSSam Leffler 			ic->ic_flags |= IEEE80211_F_USEBARKER;
22248a1b9b6aSSam Leffler 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
22258a1b9b6aSSam Leffler 		}
2226b105a069SSam Leffler 		/*
2227b032f27cSSam Leffler 		 * If protection is configured and this is the first
2228b032f27cSSam Leffler 		 * indication we should use protection, enable it.
2229b105a069SSam Leffler 		 */
2230b105a069SSam Leffler 		if (ic->ic_protmode != IEEE80211_PROT_NONE &&
2231b105a069SSam Leffler 		    ic->ic_nonerpsta == 1 &&
2232b105a069SSam Leffler 		    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0) {
2233b032f27cSSam Leffler 			IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_ASSOC,
2234b105a069SSam Leffler 			    "%s: enable use of protection\n", __func__);
2235b105a069SSam Leffler 			ic->ic_flags |= IEEE80211_F_USEPROT;
22362dc4d8dcSSam Leffler 			ieee80211_notify_erp_locked(ic);
2237b105a069SSam Leffler 		}
22388a1b9b6aSSam Leffler 	} else
22398a1b9b6aSSam Leffler 		ni->ni_flags |= IEEE80211_NODE_ERP;
22408a1b9b6aSSam Leffler }
22418a1b9b6aSSam Leffler 
22428a1b9b6aSSam Leffler void
2243b032f27cSSam Leffler ieee80211_node_join(struct ieee80211_node *ni, int resp)
22448a1b9b6aSSam Leffler {
2245b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
2246b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
22478a1b9b6aSSam Leffler 	int newassoc;
22488a1b9b6aSSam Leffler 
22498a1b9b6aSSam Leffler 	if (ni->ni_associd == 0) {
225068e8e04eSSam Leffler 		uint16_t aid;
22518a1b9b6aSSam Leffler 
2252b032f27cSSam Leffler 		KASSERT(vap->iv_aid_bitmap != NULL, ("no aid bitmap"));
22538a1b9b6aSSam Leffler 		/*
22548a1b9b6aSSam Leffler 		 * It would be good to search the bitmap
22558a1b9b6aSSam Leffler 		 * more efficiently, but this will do for now.
22568a1b9b6aSSam Leffler 		 */
2257b032f27cSSam Leffler 		for (aid = 1; aid < vap->iv_max_aid; aid++) {
2258b032f27cSSam Leffler 			if (!IEEE80211_AID_ISSET(vap, aid))
22598a1b9b6aSSam Leffler 				break;
22608a1b9b6aSSam Leffler 		}
2261b032f27cSSam Leffler 		if (aid >= vap->iv_max_aid) {
226213f91245SSam Leffler 			IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_TOOMANY);
2263b032f27cSSam Leffler 			ieee80211_node_leave(ni);
22648a1b9b6aSSam Leffler 			return;
22658a1b9b6aSSam Leffler 		}
22668a1b9b6aSSam Leffler 		ni->ni_associd = aid | 0xc000;
22671b6167d2SSam Leffler 		ni->ni_jointime = time_uptime;
2268b032f27cSSam Leffler 		IEEE80211_LOCK(ic);
2269b032f27cSSam Leffler 		IEEE80211_AID_SET(vap, ni->ni_associd);
2270b032f27cSSam Leffler 		vap->iv_sta_assoc++;
22718a1b9b6aSSam Leffler 		ic->ic_sta_assoc++;
22721b6167d2SSam Leffler 
22731b6167d2SSam Leffler 		if (IEEE80211_IS_CHAN_HT(ic->ic_bsschan))
22741b6167d2SSam Leffler 			ieee80211_ht_node_join(ni);
227568e8e04eSSam Leffler 		if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
227668e8e04eSSam Leffler 		    IEEE80211_IS_CHAN_FULL(ic->ic_bsschan))
2277b032f27cSSam Leffler 			ieee80211_node_join_11g(ni);
22781b6167d2SSam Leffler 		IEEE80211_UNLOCK(ic);
22791b6167d2SSam Leffler 
22801b6167d2SSam Leffler 		newassoc = 1;
22818a1b9b6aSSam Leffler 	} else
22828a1b9b6aSSam Leffler 		newassoc = 0;
22838a1b9b6aSSam Leffler 
2284b032f27cSSam Leffler 	IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, ni,
228544f7a6edSSam Leffler 	    "station associated at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
2286b8fcf546SSam Leffler 	    IEEE80211_NODE_AID(ni),
2287b8fcf546SSam Leffler 	    ic->ic_flags & IEEE80211_F_SHPREAMBLE ? "short" : "long",
2288b8fcf546SSam Leffler 	    ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long",
2289b8fcf546SSam Leffler 	    ic->ic_flags & IEEE80211_F_USEPROT ? ", protection" : "",
229068e8e04eSSam Leffler 	    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
229168e8e04eSSam Leffler 	    ni->ni_flags & IEEE80211_NODE_HT ?
22920f52b1c4SSam Leffler 		(ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
22931b6167d2SSam Leffler 	    ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
22948c070d69SSam Leffler 	    ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
22958c070d69SSam Leffler 	        ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
229644f7a6edSSam Leffler 	    ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
2297b032f27cSSam Leffler 	    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
229868e8e04eSSam Leffler 		", fast-frames" : "",
2299b032f27cSSam Leffler 	    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
230068e8e04eSSam Leffler 		", turbo" : ""
2301b8fcf546SSam Leffler 	);
23028a1b9b6aSSam Leffler 
2303d77148fbSSam Leffler 	ieee80211_node_setuptxparms(ni);
23048a1b9b6aSSam Leffler 	/* give driver a chance to setup state like ni_txrate */
2305736b3dc3SSam Leffler 	if (ic->ic_newassoc != NULL)
2306e9962332SSam Leffler 		ic->ic_newassoc(ni, newassoc);
2307b032f27cSSam Leffler 	IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_SUCCESS);
23088a1b9b6aSSam Leffler 	/* tell the authenticator about new station */
2309b032f27cSSam Leffler 	if (vap->iv_auth->ia_node_join != NULL)
2310b032f27cSSam Leffler 		vap->iv_auth->ia_node_join(ni);
2311b032f27cSSam Leffler 	ieee80211_notify_node_join(ni,
2312ce8977dfSSam Leffler 	    resp == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
23138a1b9b6aSSam Leffler }
23148a1b9b6aSSam Leffler 
2315b105a069SSam Leffler static void
2316b105a069SSam Leffler disable_protection(struct ieee80211com *ic)
2317b105a069SSam Leffler {
2318b105a069SSam Leffler 	KASSERT(ic->ic_nonerpsta == 0 &&
2319b105a069SSam Leffler 	    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0,
2320b105a069SSam Leffler 	   ("%d non ERP stations, flags 0x%x", ic->ic_nonerpsta,
2321b105a069SSam Leffler 	   ic->ic_flags_ext));
2322b105a069SSam Leffler 
2323b105a069SSam Leffler 	ic->ic_flags &= ~IEEE80211_F_USEPROT;
2324b105a069SSam Leffler 	/* XXX verify mode? */
2325b105a069SSam Leffler 	if (ic->ic_caps & IEEE80211_C_SHPREAMBLE) {
2326b105a069SSam Leffler 		ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
2327b105a069SSam Leffler 		ic->ic_flags &= ~IEEE80211_F_USEBARKER;
2328b105a069SSam Leffler 	}
23292dc4d8dcSSam Leffler 	ieee80211_notify_erp_locked(ic);
2330b105a069SSam Leffler }
2331b105a069SSam Leffler 
23328a1b9b6aSSam Leffler /*
23338a1b9b6aSSam Leffler  * Handle a station leaving an 11g network.
23348a1b9b6aSSam Leffler  */
23358a1b9b6aSSam Leffler static void
2336b032f27cSSam Leffler ieee80211_node_leave_11g(struct ieee80211_node *ni)
23378a1b9b6aSSam Leffler {
2338b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
23398a1b9b6aSSam Leffler 
23401b6167d2SSam Leffler 	IEEE80211_LOCK_ASSERT(ic);
23411b6167d2SSam Leffler 
234268e8e04eSSam Leffler 	KASSERT(IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan),
2343b032f27cSSam Leffler 	     ("not in 11g, bss %u:0x%x", ic->ic_bsschan->ic_freq,
2344b032f27cSSam Leffler 	      ic->ic_bsschan->ic_flags));
23458a1b9b6aSSam Leffler 
23468a1b9b6aSSam Leffler 	/*
23478a1b9b6aSSam Leffler 	 * If a long slot station do the slot time bookkeeping.
23488a1b9b6aSSam Leffler 	 */
23498a1b9b6aSSam Leffler 	if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
23508a1b9b6aSSam Leffler 		KASSERT(ic->ic_longslotsta > 0,
23518a1b9b6aSSam Leffler 		    ("bogus long slot station count %d", ic->ic_longslotsta));
23528a1b9b6aSSam Leffler 		ic->ic_longslotsta--;
2353b032f27cSSam Leffler 		IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni,
2354b105a069SSam Leffler 		    "long slot time station leaves, count now %d",
2355b105a069SSam Leffler 		    ic->ic_longslotsta);
23568a1b9b6aSSam Leffler 		if (ic->ic_longslotsta == 0) {
23578a1b9b6aSSam Leffler 			/*
23588a1b9b6aSSam Leffler 			 * Re-enable use of short slot time if supported
23598a1b9b6aSSam Leffler 			 * and not operating in IBSS mode (per spec).
23608a1b9b6aSSam Leffler 			 */
23618a1b9b6aSSam Leffler 			if ((ic->ic_caps & IEEE80211_C_SHSLOT) &&
23628a1b9b6aSSam Leffler 			    ic->ic_opmode != IEEE80211_M_IBSS) {
2363b032f27cSSam Leffler 				IEEE80211_DPRINTF(ni->ni_vap,
2364b032f27cSSam Leffler 				    IEEE80211_MSG_ASSOC,
23658a1b9b6aSSam Leffler 				    "%s: re-enable use of short slot time\n",
23668a1b9b6aSSam Leffler 				    __func__);
23678a1b9b6aSSam Leffler 				ieee80211_set_shortslottime(ic, 1);
23688a1b9b6aSSam Leffler 			}
23698a1b9b6aSSam Leffler 		}
23708a1b9b6aSSam Leffler 	}
23718a1b9b6aSSam Leffler 	/*
23728a1b9b6aSSam Leffler 	 * If a non-ERP station do the protection-related bookkeeping.
23738a1b9b6aSSam Leffler 	 */
23748a1b9b6aSSam Leffler 	if ((ni->ni_flags & IEEE80211_NODE_ERP) == 0) {
23758a1b9b6aSSam Leffler 		KASSERT(ic->ic_nonerpsta > 0,
23768a1b9b6aSSam Leffler 		    ("bogus non-ERP station count %d", ic->ic_nonerpsta));
23778a1b9b6aSSam Leffler 		ic->ic_nonerpsta--;
2378b032f27cSSam Leffler 		IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni,
2379b105a069SSam Leffler 		    "non-ERP station leaves, count now %d%s", ic->ic_nonerpsta,
2380b105a069SSam Leffler 		    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) ?
2381b105a069SSam Leffler 			" (non-ERP sta present)" : "");
2382b105a069SSam Leffler 		if (ic->ic_nonerpsta == 0 &&
2383b105a069SSam Leffler 		    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0) {
2384b032f27cSSam Leffler 			IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_ASSOC,
23858a1b9b6aSSam Leffler 				"%s: disable use of protection\n", __func__);
2386b105a069SSam Leffler 			disable_protection(ic);
2387b105a069SSam Leffler 		}
2388b105a069SSam Leffler 	}
2389b105a069SSam Leffler }
2390b105a069SSam Leffler 
2391b105a069SSam Leffler /*
2392b105a069SSam Leffler  * Time out presence of an overlapping bss with non-ERP
2393b105a069SSam Leffler  * stations.  When operating in hostap mode we listen for
2394b105a069SSam Leffler  * beacons from other stations and if we identify a non-ERP
2395b105a069SSam Leffler  * station is present we enable protection.  To identify
2396b105a069SSam Leffler  * when all non-ERP stations are gone we time out this
2397b105a069SSam Leffler  * condition.
2398b105a069SSam Leffler  */
2399b105a069SSam Leffler static void
2400b105a069SSam Leffler ieee80211_erp_timeout(struct ieee80211com *ic)
2401b105a069SSam Leffler {
2402b105a069SSam Leffler 
2403b105a069SSam Leffler 	IEEE80211_LOCK_ASSERT(ic);
2404b105a069SSam Leffler 
2405b105a069SSam Leffler 	if ((ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) &&
2406b105a069SSam Leffler 	    time_after(ticks, ic->ic_lastnonerp + IEEE80211_NONERP_PRESENT_AGE)) {
2407b032f27cSSam Leffler #if 0
2408b032f27cSSam Leffler 		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2409b032f27cSSam Leffler 		    "%s", "age out non-ERP sta present on channel");
2410b032f27cSSam Leffler #endif
2411b105a069SSam Leffler 		ic->ic_flags_ext &= ~IEEE80211_FEXT_NONERP_PR;
2412b105a069SSam Leffler 		if (ic->ic_nonerpsta == 0)
2413b105a069SSam Leffler 			disable_protection(ic);
24148a1b9b6aSSam Leffler 	}
24158a1b9b6aSSam Leffler }
24168a1b9b6aSSam Leffler 
24178a1b9b6aSSam Leffler /*
24188a1b9b6aSSam Leffler  * Handle bookkeeping for station deauthentication/disassociation
24198a1b9b6aSSam Leffler  * when operating as an ap.
24208a1b9b6aSSam Leffler  */
24218a1b9b6aSSam Leffler void
2422b032f27cSSam Leffler ieee80211_node_leave(struct ieee80211_node *ni)
24238a1b9b6aSSam Leffler {
2424b032f27cSSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
2425b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
242644acc00dSSam Leffler 	struct ieee80211_node_table *nt = ni->ni_table;
24278a1b9b6aSSam Leffler 
2428b032f27cSSam Leffler 	IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, ni,
2429b105a069SSam Leffler 	    "station with aid %d leaves", IEEE80211_NODE_AID(ni));
24308a1b9b6aSSam Leffler 
2431b032f27cSSam Leffler 	KASSERT(vap->iv_opmode != IEEE80211_M_STA,
2432b032f27cSSam Leffler 		("unexpected operating mode %u", vap->iv_opmode));
24338a1b9b6aSSam Leffler 	/*
24348a1b9b6aSSam Leffler 	 * If node wasn't previously associated all
24358a1b9b6aSSam Leffler 	 * we need to do is reclaim the reference.
24368a1b9b6aSSam Leffler 	 */
24378a1b9b6aSSam Leffler 	/* XXX ibss mode bypasses 11g and notification */
24388a1b9b6aSSam Leffler 	if (ni->ni_associd == 0)
24398a1b9b6aSSam Leffler 		goto done;
24408a1b9b6aSSam Leffler 	/*
24418a1b9b6aSSam Leffler 	 * Tell the authenticator the station is leaving.
24428a1b9b6aSSam Leffler 	 * Note that we must do this before yanking the
24438a1b9b6aSSam Leffler 	 * association id as the authenticator uses the
24448a1b9b6aSSam Leffler 	 * associd to locate it's state block.
24458a1b9b6aSSam Leffler 	 */
2446b032f27cSSam Leffler 	if (vap->iv_auth->ia_node_leave != NULL)
2447b032f27cSSam Leffler 		vap->iv_auth->ia_node_leave(ni);
24481b6167d2SSam Leffler 
24491b6167d2SSam Leffler 	IEEE80211_LOCK(ic);
2450b032f27cSSam Leffler 	IEEE80211_AID_CLR(vap, ni->ni_associd);
24518a1b9b6aSSam Leffler 	ni->ni_associd = 0;
2452b032f27cSSam Leffler 	vap->iv_sta_assoc--;
24538a1b9b6aSSam Leffler 	ic->ic_sta_assoc--;
24548a1b9b6aSSam Leffler 
24551b6167d2SSam Leffler 	if (IEEE80211_IS_CHAN_HT(ic->ic_bsschan))
24561b6167d2SSam Leffler 		ieee80211_ht_node_leave(ni);
245768e8e04eSSam Leffler 	if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
245868e8e04eSSam Leffler 	    IEEE80211_IS_CHAN_FULL(ic->ic_bsschan))
2459b032f27cSSam Leffler 		ieee80211_node_leave_11g(ni);
24601b6167d2SSam Leffler 	IEEE80211_UNLOCK(ic);
24618a1b9b6aSSam Leffler 	/*
24628a1b9b6aSSam Leffler 	 * Cleanup station state.  In particular clear various
24638a1b9b6aSSam Leffler 	 * state that might otherwise be reused if the node
24648a1b9b6aSSam Leffler 	 * is reused before the reference count goes to zero
24658a1b9b6aSSam Leffler 	 * (and memory is reclaimed).
24668a1b9b6aSSam Leffler 	 */
2467b032f27cSSam Leffler 	ieee80211_sta_leave(ni);
24688a1b9b6aSSam Leffler done:
246944acc00dSSam Leffler 	/*
247044acc00dSSam Leffler 	 * Remove the node from any table it's recorded in and
247144acc00dSSam Leffler 	 * drop the caller's reference.  Removal from the table
247244acc00dSSam Leffler 	 * is important to insure the node is not reprocessed
247344acc00dSSam Leffler 	 * for inactivity.
247444acc00dSSam Leffler 	 */
247544acc00dSSam Leffler 	if (nt != NULL) {
247644acc00dSSam Leffler 		IEEE80211_NODE_LOCK(nt);
247744acc00dSSam Leffler 		node_reclaim(nt, ni);
247844acc00dSSam Leffler 		IEEE80211_NODE_UNLOCK(nt);
247944acc00dSSam Leffler 	} else
24808a1b9b6aSSam Leffler 		ieee80211_free_node(ni);
24818a1b9b6aSSam Leffler }
24828a1b9b6aSSam Leffler 
2483b032f27cSSam Leffler struct rssiinfo {
2484b032f27cSSam Leffler 	struct ieee80211vap *vap;
2485b032f27cSSam Leffler 	int	rssi_samples;
2486b032f27cSSam Leffler 	uint32_t rssi_total;
2487b032f27cSSam Leffler };
2488b032f27cSSam Leffler 
2489b032f27cSSam Leffler static void
2490b032f27cSSam Leffler get_hostap_rssi(void *arg, struct ieee80211_node *ni)
2491b032f27cSSam Leffler {
2492b032f27cSSam Leffler 	struct rssiinfo *info = arg;
2493b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
2494b032f27cSSam Leffler 	int8_t rssi;
2495b032f27cSSam Leffler 
2496b032f27cSSam Leffler 	if (info->vap != vap)
2497b032f27cSSam Leffler 		return;
2498b032f27cSSam Leffler 	/* only associated stations */
2499b032f27cSSam Leffler 	if (ni->ni_associd == 0)
2500b032f27cSSam Leffler 		return;
2501b032f27cSSam Leffler 	rssi = vap->iv_ic->ic_node_getrssi(ni);
2502b032f27cSSam Leffler 	if (rssi != 0) {
2503b032f27cSSam Leffler 		info->rssi_samples++;
2504b032f27cSSam Leffler 		info->rssi_total += rssi;
2505b032f27cSSam Leffler 	}
2506b032f27cSSam Leffler }
2507b032f27cSSam Leffler 
2508b032f27cSSam Leffler static void
2509b032f27cSSam Leffler get_adhoc_rssi(void *arg, struct ieee80211_node *ni)
2510b032f27cSSam Leffler {
2511b032f27cSSam Leffler 	struct rssiinfo *info = arg;
2512b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
2513b032f27cSSam Leffler 	int8_t rssi;
2514b032f27cSSam Leffler 
2515b032f27cSSam Leffler 	if (info->vap != vap)
2516b032f27cSSam Leffler 		return;
2517b032f27cSSam Leffler 	/* only neighbors */
2518b032f27cSSam Leffler 	/* XXX check bssid */
2519b032f27cSSam Leffler 	if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
2520b032f27cSSam Leffler 		return;
2521b032f27cSSam Leffler 	rssi = vap->iv_ic->ic_node_getrssi(ni);
2522b032f27cSSam Leffler 	if (rssi != 0) {
2523b032f27cSSam Leffler 		info->rssi_samples++;
2524b032f27cSSam Leffler 		info->rssi_total += rssi;
2525b032f27cSSam Leffler 	}
2526b032f27cSSam Leffler }
2527b032f27cSSam Leffler 
252868e8e04eSSam Leffler int8_t
2529b032f27cSSam Leffler ieee80211_getrssi(struct ieee80211vap *vap)
25308a1b9b6aSSam Leffler {
25318a1b9b6aSSam Leffler #define	NZ(x)	((x) == 0 ? 1 : (x))
2532b032f27cSSam Leffler 	struct ieee80211com *ic = vap->iv_ic;
2533b032f27cSSam Leffler 	struct rssiinfo info;
25348a1b9b6aSSam Leffler 
2535b032f27cSSam Leffler 	info.rssi_total = 0;
2536b032f27cSSam Leffler 	info.rssi_samples = 0;
2537b032f27cSSam Leffler 	info.vap = vap;
2538b032f27cSSam Leffler 	switch (vap->iv_opmode) {
25398a1b9b6aSSam Leffler 	case IEEE80211_M_IBSS:		/* average of all ibss neighbors */
25408a1b9b6aSSam Leffler 	case IEEE80211_M_AHDEMO:	/* average of all neighbors */
2541b032f27cSSam Leffler 		ieee80211_iterate_nodes(&ic->ic_sta, get_adhoc_rssi, &info);
2542b032f27cSSam Leffler 		break;
25438a1b9b6aSSam Leffler 	case IEEE80211_M_HOSTAP:	/* average of all associated stations */
2544b032f27cSSam Leffler 		ieee80211_iterate_nodes(&ic->ic_sta, get_hostap_rssi, &info);
25458a1b9b6aSSam Leffler 		break;
25468a1b9b6aSSam Leffler 	case IEEE80211_M_MONITOR:	/* XXX */
25478a1b9b6aSSam Leffler 	case IEEE80211_M_STA:		/* use stats from associated ap */
25488a1b9b6aSSam Leffler 	default:
2549b032f27cSSam Leffler 		if (vap->iv_bss != NULL)
2550b032f27cSSam Leffler 			info.rssi_total = ic->ic_node_getrssi(vap->iv_bss);
2551b032f27cSSam Leffler 		info.rssi_samples = 1;
25528a1b9b6aSSam Leffler 		break;
25538a1b9b6aSSam Leffler 	}
2554b032f27cSSam Leffler 	return info.rssi_total / NZ(info.rssi_samples);
25558a1b9b6aSSam Leffler #undef NZ
25568a1b9b6aSSam Leffler }
25578a1b9b6aSSam Leffler 
255868e8e04eSSam Leffler void
2559b032f27cSSam Leffler ieee80211_getsignal(struct ieee80211vap *vap, int8_t *rssi, int8_t *noise)
25608a1b9b6aSSam Leffler {
25618a1b9b6aSSam Leffler 
2562b032f27cSSam Leffler 	if (vap->iv_bss == NULL)		/* NB: shouldn't happen */
256368e8e04eSSam Leffler 		return;
2564b032f27cSSam Leffler 	vap->iv_ic->ic_node_getsignal(vap->iv_bss, rssi, noise);
256568e8e04eSSam Leffler 	/* for non-station mode return avg'd rssi accounting */
2566b032f27cSSam Leffler 	if (vap->iv_opmode != IEEE80211_M_STA)
2567b032f27cSSam Leffler 		*rssi = ieee80211_getrssi(vap);
25688a1b9b6aSSam Leffler }
2569