xref: /freebsd/sys/net80211/ieee80211_node.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2007 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/mbuf.h>
33 #include <sys/malloc.h>
34 #include <sys/kernel.h>
35 
36 #include <sys/socket.h>
37 
38 #include <net/if.h>
39 #include <net/if_media.h>
40 #include <net/ethernet.h>
41 
42 #include <net80211/ieee80211_var.h>
43 
44 #include <net/bpf.h>
45 
46 /*
47  * Association id's are managed with a bit vector.
48  */
49 #define	IEEE80211_AID_SET(b, w) \
50 	((w)[IEEE80211_AID(b) / 32] |= (1 << (IEEE80211_AID(b) % 32)))
51 #define	IEEE80211_AID_CLR(b, w) \
52 	((w)[IEEE80211_AID(b) / 32] &= ~(1 << (IEEE80211_AID(b) % 32)))
53 #define	IEEE80211_AID_ISSET(b, w) \
54 	((w)[IEEE80211_AID(b) / 32] & (1 << (IEEE80211_AID(b) % 32)))
55 
56 #ifdef IEEE80211_DEBUG_REFCNT
57 #define REFCNT_LOC "%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line
58 #else
59 #define REFCNT_LOC "%s %p<%s> refcnt %d\n", __func__
60 #endif
61 
62 static int ieee80211_sta_join1(struct ieee80211_node *);
63 
64 static struct ieee80211_node *node_alloc(struct ieee80211_node_table *);
65 static void node_cleanup(struct ieee80211_node *);
66 static void node_free(struct ieee80211_node *);
67 static int8_t node_getrssi(const struct ieee80211_node *);
68 static void node_getsignal(const struct ieee80211_node *, int8_t *, int8_t *);
69 
70 static void ieee80211_setup_node(struct ieee80211_node_table *,
71 		struct ieee80211_node *, const uint8_t *);
72 static void _ieee80211_free_node(struct ieee80211_node *);
73 
74 static void ieee80211_node_table_init(struct ieee80211com *ic,
75 	struct ieee80211_node_table *nt, const char *name,
76 	int inact, int keymaxix);
77 static void ieee80211_node_table_reset(struct ieee80211_node_table *);
78 static void ieee80211_node_table_cleanup(struct ieee80211_node_table *nt);
79 static void ieee80211_erp_timeout(struct ieee80211com *);
80 
81 MALLOC_DEFINE(M_80211_NODE, "80211node", "802.11 node state");
82 
83 void
84 ieee80211_node_attach(struct ieee80211com *ic)
85 {
86 
87 	ic->ic_node_alloc = node_alloc;
88 	ic->ic_node_free = node_free;
89 	ic->ic_node_cleanup = node_cleanup;
90 	ic->ic_node_getrssi = node_getrssi;
91 	ic->ic_node_getsignal = node_getsignal;
92 
93 	/* default station inactivity timer setings */
94 	ic->ic_inact_init = IEEE80211_INACT_INIT;
95 	ic->ic_inact_auth = IEEE80211_INACT_AUTH;
96 	ic->ic_inact_run = IEEE80211_INACT_RUN;
97 	ic->ic_inact_probe = IEEE80211_INACT_PROBE;
98 
99 	callout_init(&ic->ic_inact, CALLOUT_MPSAFE);
100 
101 	/* NB: driver should override */
102 	ic->ic_max_aid = IEEE80211_AID_DEF;
103 
104 	ic->ic_flags_ext |= IEEE80211_FEXT_INACT; /* inactivity processing */
105 }
106 
107 void
108 ieee80211_node_lateattach(struct ieee80211com *ic)
109 {
110 	struct ieee80211_rsnparms *rsn;
111 
112 	if (ic->ic_max_aid > IEEE80211_AID_MAX)
113 		ic->ic_max_aid = IEEE80211_AID_MAX;
114 	MALLOC(ic->ic_aid_bitmap, uint32_t *,
115 		howmany(ic->ic_max_aid, 32) * sizeof(uint32_t),
116 		M_80211_NODE, M_NOWAIT | M_ZERO);
117 	if (ic->ic_aid_bitmap == NULL) {
118 		/* XXX no way to recover */
119 		printf("%s: no memory for AID bitmap!\n", __func__);
120 		ic->ic_max_aid = 0;
121 	}
122 
123 	ieee80211_node_table_init(ic, &ic->ic_sta, "station",
124 		IEEE80211_INACT_INIT, ic->ic_crypto.cs_max_keyix);
125 
126 	ieee80211_reset_bss(ic);
127 	/*
128 	 * Setup "global settings" in the bss node so that
129 	 * each new station automatically inherits them.
130 	 */
131 	rsn = &ic->ic_bss->ni_rsn;
132 	/* WEP, TKIP, and AES-CCM are always supported */
133 	rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_WEP;
134 	rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_TKIP;
135 	rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_AES_CCM;
136 	if (ic->ic_caps & IEEE80211_C_AES)
137 		rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_AES_OCB;
138 	if (ic->ic_caps & IEEE80211_C_CKIP)
139 		rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_CKIP;
140 	/*
141 	 * Default unicast cipher to WEP for 802.1x use.  If
142 	 * WPA is enabled the management code will set these
143 	 * values to reflect.
144 	 */
145 	rsn->rsn_ucastcipher = IEEE80211_CIPHER_WEP;
146 	rsn->rsn_ucastkeylen = 104 / NBBY;
147 	/*
148 	 * WPA says the multicast cipher is the lowest unicast
149 	 * cipher supported.  But we skip WEP which would
150 	 * otherwise be used based on this criteria.
151 	 */
152 	rsn->rsn_mcastcipher = IEEE80211_CIPHER_TKIP;
153 	rsn->rsn_mcastkeylen = 128 / NBBY;
154 
155 	/*
156 	 * We support both WPA-PSK and 802.1x; the one used
157 	 * is determined by the authentication mode and the
158 	 * setting of the PSK state.
159 	 */
160 	rsn->rsn_keymgmtset = WPA_ASE_8021X_UNSPEC | WPA_ASE_8021X_PSK;
161 	rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
162 
163 	ic->ic_auth = ieee80211_authenticator_get(ic->ic_bss->ni_authmode);
164 }
165 
166 void
167 ieee80211_node_detach(struct ieee80211com *ic)
168 {
169 
170 	if (ic->ic_bss != NULL) {
171 		ieee80211_free_node(ic->ic_bss);
172 		ic->ic_bss = NULL;
173 	}
174 	ieee80211_node_table_cleanup(&ic->ic_sta);
175 	if (ic->ic_aid_bitmap != NULL) {
176 		FREE(ic->ic_aid_bitmap, M_80211_NODE);
177 		ic->ic_aid_bitmap = NULL;
178 	}
179 }
180 
181 /*
182  * Port authorize/unauthorize interfaces for use by an authenticator.
183  */
184 
185 void
186 ieee80211_node_authorize(struct ieee80211_node *ni)
187 {
188 	struct ieee80211com *ic = ni->ni_ic;
189 
190 	ni->ni_flags |= IEEE80211_NODE_AUTH;
191 	ni->ni_inact_reload = ic->ic_inact_run;
192 	ni->ni_inact = ni->ni_inact_reload;
193 }
194 
195 void
196 ieee80211_node_unauthorize(struct ieee80211_node *ni)
197 {
198 	struct ieee80211com *ic = ni->ni_ic;
199 
200 	ni->ni_flags &= ~IEEE80211_NODE_AUTH;
201 	ni->ni_inact_reload = ic->ic_inact_auth;
202 	if (ni->ni_inact > ni->ni_inact_reload)
203 		ni->ni_inact = ni->ni_inact_reload;
204 }
205 
206 /*
207  * Set/change the channel.  The rate set is also updated as
208  * to insure a consistent view by drivers.
209  */
210 static void
211 ieee80211_node_set_chan(struct ieee80211com *ic, struct ieee80211_node *ni)
212 {
213 	struct ieee80211_channel *chan = ic->ic_bsschan;
214 
215 #if 0
216 	KASSERT(chan != IEEE80211_CHAN_ANYC, ("bss channel not setup"));
217 #else
218 	if (chan == IEEE80211_CHAN_ANYC)	/* XXX while scanning */
219 		chan = ic->ic_curchan;
220 #endif
221 	ni->ni_chan = chan;
222 	if (IEEE80211_IS_CHAN_HT(chan)) {
223 		/*
224 		 * XXX Gotta be careful here; the rate set returned by
225 		 * ieee80211_get_suprates is actually any HT rate
226 		 * set so blindly copying it will be bad.  We must
227 		 * install the legacy rate est in ni_rates and the
228 		 * HT rate set in ni_htrates.
229 		 */
230 		ni->ni_htrates = *ieee80211_get_suphtrates(ic, chan);
231 	}
232 	ni->ni_rates = *ieee80211_get_suprates(ic, chan);
233 }
234 
235 /*
236  * Probe the curent channel, if allowed, while scanning.
237  * If the channel is not marked passive-only then send
238  * a probe request immediately.  Otherwise mark state and
239  * listen for beacons on the channel; if we receive something
240  * then we'll transmit a probe request.
241  */
242 void
243 ieee80211_probe_curchan(struct ieee80211com *ic, int force)
244 {
245 	struct ifnet *ifp = ic->ic_ifp;
246 
247 	if ((ic->ic_curchan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 || force) {
248 		/*
249 		 * XXX send both broadcast+directed probe request
250 		 */
251 		ieee80211_send_probereq(ic->ic_bss,
252 			ic->ic_myaddr, ifp->if_broadcastaddr,
253 			ifp->if_broadcastaddr,
254 			ic->ic_des_ssid[0].ssid, ic->ic_des_ssid[0].len,
255 			ic->ic_opt_ie, ic->ic_opt_ie_len);
256 	} else
257 		ic->ic_flags_ext |= IEEE80211_FEXT_PROBECHAN;
258 }
259 
260 static __inline void
261 copy_bss(struct ieee80211_node *nbss, const struct ieee80211_node *obss)
262 {
263 	/* propagate useful state */
264 	nbss->ni_authmode = obss->ni_authmode;
265 	nbss->ni_txpower = obss->ni_txpower;
266 	nbss->ni_vlan = obss->ni_vlan;
267 	nbss->ni_rsn = obss->ni_rsn;
268 	/* XXX statistics? */
269 }
270 
271 void
272 ieee80211_create_ibss(struct ieee80211com* ic, struct ieee80211_channel *chan)
273 {
274 	struct ieee80211_node_table *nt;
275 	struct ieee80211_node *ni;
276 
277 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
278 		"%s: creating ibss\n", __func__);
279 
280 	/*
281 	 * Create the station/neighbor table.  Note that for adhoc
282 	 * mode we make the initial inactivity timer longer since
283 	 * we create nodes only through discovery and they typically
284 	 * are long-lived associations.
285 	 */
286 	nt = &ic->ic_sta;
287 	IEEE80211_NODE_LOCK(nt);
288 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
289 		nt->nt_name = "station";
290 		nt->nt_inact_init = ic->ic_inact_init;
291 	} else {
292 		nt->nt_name = "neighbor";
293 		nt->nt_inact_init = ic->ic_inact_run;
294 	}
295 	IEEE80211_NODE_UNLOCK(nt);
296 
297 	ni = ieee80211_alloc_node(&ic->ic_sta, ic->ic_myaddr);
298 	if (ni == NULL) {
299 		/* XXX recovery? */
300 		return;
301 	}
302 	IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_myaddr);
303 	ni->ni_esslen = ic->ic_des_ssid[0].len;
304 	memcpy(ni->ni_essid, ic->ic_des_ssid[0].ssid, ni->ni_esslen);
305 	if (ic->ic_bss != NULL)
306 		copy_bss(ni, ic->ic_bss);
307 	ni->ni_intval = ic->ic_bintval;
308 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
309 		ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY;
310 	if (ic->ic_phytype == IEEE80211_T_FH) {
311 		ni->ni_fhdwell = 200;	/* XXX */
312 		ni->ni_fhindex = 1;
313 	}
314 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
315 		ic->ic_flags |= IEEE80211_F_SIBSS;
316 		ni->ni_capinfo |= IEEE80211_CAPINFO_IBSS;	/* XXX */
317 		if (ic->ic_flags & IEEE80211_F_DESBSSID)
318 			IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_des_bssid);
319 		else {
320 			get_random_bytes(ni->ni_bssid, IEEE80211_ADDR_LEN);
321 			/* clear group bit, add local bit */
322 			ni->ni_bssid[0] = (ni->ni_bssid[0] &~ 0x01) | 0x02;
323 		}
324 	} else if (ic->ic_opmode == IEEE80211_M_AHDEMO) {
325 		if (ic->ic_flags & IEEE80211_F_DESBSSID)
326 			IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_des_bssid);
327 		else
328 			memset(ni->ni_bssid, 0, IEEE80211_ADDR_LEN);
329 	}
330 	/*
331 	 * Fix the channel and related attributes.
332 	 */
333 	ic->ic_bsschan = chan;
334 	ieee80211_node_set_chan(ic, ni);
335 	ic->ic_curmode = ieee80211_chan2mode(chan);
336 	/*
337 	 * Do mode-specific rate setup.
338 	 */
339 	if (IEEE80211_IS_CHAN_FULL(chan)) {
340 		if (IEEE80211_IS_CHAN_ANYG(chan)) {
341 			/*
342 			 * Use a mixed 11b/11g rate set.
343 			 */
344 			ieee80211_set11gbasicrates(&ni->ni_rates,
345 				IEEE80211_MODE_11G);
346 		} else if (IEEE80211_IS_CHAN_B(chan)) {
347 			/*
348 			 * Force pure 11b rate set.
349 			 */
350 			ieee80211_set11gbasicrates(&ni->ni_rates,
351 				IEEE80211_MODE_11B);
352 		}
353 	}
354 
355 	(void) ieee80211_sta_join1(ieee80211_ref_node(ni));
356 }
357 
358 /*
359  * Reset bss state on transition to the INIT state.
360  * Clear any stations from the table (they have been
361  * deauth'd) and reset the bss node (clears key, rate
362  * etc. state).
363  */
364 void
365 ieee80211_reset_bss(struct ieee80211com *ic)
366 {
367 	struct ieee80211_node *ni, *obss;
368 
369 	callout_drain(&ic->ic_inact);
370 	ieee80211_node_table_reset(&ic->ic_sta);
371 	ieee80211_reset_erp(ic);
372 
373 	ni = ieee80211_alloc_node(&ic->ic_sta, ic->ic_myaddr);
374 	KASSERT(ni != NULL, ("unable to setup inital BSS node"));
375 	obss = ic->ic_bss;
376 	ic->ic_bss = ieee80211_ref_node(ni);
377 	if (obss != NULL) {
378 		copy_bss(ni, obss);
379 		ni->ni_intval = ic->ic_bintval;
380 		ieee80211_free_node(obss);
381 	}
382 }
383 
384 static int
385 match_ssid(const struct ieee80211_node *ni,
386 	int nssid, const struct ieee80211_scan_ssid ssids[])
387 {
388 	int i;
389 
390 	for (i = 0; i < nssid; i++) {
391 		if (ni->ni_esslen == ssids[i].len &&
392 		     memcmp(ni->ni_essid, ssids[i].ssid, ni->ni_esslen) == 0)
393 			return 1;
394 	}
395 	return 0;
396 }
397 
398 /*
399  * Test a node for suitability/compatibility.
400  */
401 static int
402 check_bss(struct ieee80211com *ic, struct ieee80211_node *ni)
403 {
404         uint8_t rate;
405 
406 	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan)))
407 		return 0;
408 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
409 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
410 			return 0;
411 	} else {
412 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0)
413 			return 0;
414 	}
415 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
416 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
417 			return 0;
418 	} else {
419 		/* XXX does this mean privacy is supported or required? */
420 		if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
421 			return 0;
422 	}
423 	rate = ieee80211_fix_rate(ni, &ni->ni_rates,
424 	    IEEE80211_F_JOIN | IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE);
425 	if (rate & IEEE80211_RATE_BASIC)
426 		return 0;
427 	if (ic->ic_des_nssid != 0 &&
428 	    !match_ssid(ni, ic->ic_des_nssid, ic->ic_des_ssid))
429 		return 0;
430 	if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
431 	    !IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid))
432 		return 0;
433 	return 1;
434 }
435 
436 #ifdef IEEE80211_DEBUG
437 /*
438  * Display node suitability/compatibility.
439  */
440 static void
441 check_bss_debug(struct ieee80211com *ic, struct ieee80211_node *ni)
442 {
443         uint8_t rate;
444         int fail;
445 
446 	fail = 0;
447 	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan)))
448 		fail |= 0x01;
449 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
450 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
451 			fail |= 0x02;
452 	} else {
453 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0)
454 			fail |= 0x02;
455 	}
456 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
457 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
458 			fail |= 0x04;
459 	} else {
460 		/* XXX does this mean privacy is supported or required? */
461 		if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
462 			fail |= 0x04;
463 	}
464 	rate = ieee80211_fix_rate(ni, &ni->ni_rates,
465 	     IEEE80211_F_JOIN | IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE);
466 	if (rate & IEEE80211_RATE_BASIC)
467 		fail |= 0x08;
468 	if (ic->ic_des_nssid != 0 &&
469 	    !match_ssid(ni, ic->ic_des_nssid, ic->ic_des_ssid))
470 		fail |= 0x10;
471 	if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
472 	    !IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid))
473 		fail |= 0x20;
474 
475 	printf(" %c %s", fail ? '-' : '+', ether_sprintf(ni->ni_macaddr));
476 	printf(" %s%c", ether_sprintf(ni->ni_bssid), fail & 0x20 ? '!' : ' ');
477 	printf(" %3d%c",
478 	    ieee80211_chan2ieee(ic, ni->ni_chan), fail & 0x01 ? '!' : ' ');
479 	printf(" %+4d", ni->ni_rssi);
480 	printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
481 	    fail & 0x08 ? '!' : ' ');
482 	printf(" %4s%c",
483 	    (ni->ni_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
484 	    (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
485 	    "????",
486 	    fail & 0x02 ? '!' : ' ');
487 	printf(" %3s%c ",
488 	    (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) ?  "wep" : "no",
489 	    fail & 0x04 ? '!' : ' ');
490 	ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
491 	printf("%s\n", fail & 0x10 ? "!" : "");
492 }
493 #endif /* IEEE80211_DEBUG */
494 
495 /*
496  * Handle 802.11 ad hoc network merge.  The
497  * convention, set by the Wireless Ethernet Compatibility Alliance
498  * (WECA), is that an 802.11 station will change its BSSID to match
499  * the "oldest" 802.11 ad hoc network, on the same channel, that
500  * has the station's desired SSID.  The "oldest" 802.11 network
501  * sends beacons with the greatest TSF timestamp.
502  *
503  * The caller is assumed to validate TSF's before attempting a merge.
504  *
505  * Return !0 if the BSSID changed, 0 otherwise.
506  */
507 int
508 ieee80211_ibss_merge(struct ieee80211_node *ni)
509 {
510 	struct ieee80211com *ic = ni->ni_ic;
511 
512 	if (ni == ic->ic_bss ||
513 	    IEEE80211_ADDR_EQ(ni->ni_bssid, ic->ic_bss->ni_bssid)) {
514 		/* unchanged, nothing to do */
515 		return 0;
516 	}
517 	if (!check_bss(ic, ni)) {
518 		/* capabilities mismatch */
519 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
520 		    "%s: merge failed, capabilities mismatch\n", __func__);
521 #ifdef IEEE80211_DEBUG
522 		if (ieee80211_msg_assoc(ic))
523 			check_bss_debug(ic, ni);
524 #endif
525 		ic->ic_stats.is_ibss_capmismatch++;
526 		return 0;
527 	}
528 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
529 		"%s: new bssid %s: %s preamble, %s slot time%s\n", __func__,
530 		ether_sprintf(ni->ni_bssid),
531 		ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
532 		ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
533 		ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : ""
534 	);
535 	return ieee80211_sta_join1(ieee80211_ref_node(ni));
536 }
537 
538 /*
539  * Change the bss channel.
540  */
541 void
542 ieee80211_setbsschan(struct ieee80211com *ic, struct ieee80211_channel *c)
543 {
544 	ic->ic_bsschan = c;
545 	ic->ic_curchan = ic->ic_bsschan;
546 	ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan);
547 	ic->ic_set_channel(ic);
548 }
549 
550 /*
551  * Join the specified IBSS/BSS network.  The node is assumed to
552  * be passed in with a held reference.
553  */
554 static int
555 ieee80211_sta_join1(struct ieee80211_node *selbs)
556 {
557 	struct ieee80211com *ic = selbs->ni_ic;
558 	struct ieee80211_node *obss;
559 	int canreassoc;
560 
561 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
562 		struct ieee80211_node_table *nt;
563 		/*
564 		 * Fillin the neighbor table; it will already
565 		 * exist if we are simply switching mastership.
566 		 * XXX ic_sta always setup so this is unnecessary?
567 		 */
568 		nt = &ic->ic_sta;
569 		IEEE80211_NODE_LOCK(nt);
570 		nt->nt_name = "neighbor";
571 		nt->nt_inact_init = ic->ic_inact_run;
572 		IEEE80211_NODE_UNLOCK(nt);
573 	}
574 
575 	/*
576 	 * Committed to selbs, setup state.
577 	 */
578 	obss = ic->ic_bss;
579 	/*
580 	 * Check if old+new node have the same address in which
581 	 * case we can reassociate when operating in sta mode.
582 	 */
583 	canreassoc = (obss != NULL &&
584 		ic->ic_state == IEEE80211_S_RUN &&
585 		IEEE80211_ADDR_EQ(obss->ni_macaddr, selbs->ni_macaddr));
586 	ic->ic_bss = selbs;		/* NB: caller assumed to bump refcnt */
587 	if (obss != NULL) {
588 		copy_bss(selbs, obss);
589 		ieee80211_free_node(obss);
590 	}
591 
592 	/*
593 	 * Delete unusable rates; we've already checked
594 	 * that the negotiated rate set is acceptable.
595 	 */
596 	ieee80211_fix_rate(ic->ic_bss, &ic->ic_bss->ni_rates,
597 		IEEE80211_F_DODEL | IEEE80211_F_JOIN);
598 
599 	ieee80211_setbsschan(ic, selbs->ni_chan);
600 	/*
601 	 * Set the erp state (mostly the slot time) to deal with
602 	 * the auto-select case; this should be redundant if the
603 	 * mode is locked.
604 	 */
605 	ieee80211_reset_erp(ic);
606 	ieee80211_wme_initparams(ic);
607 
608 	if (ic->ic_opmode == IEEE80211_M_STA) {
609 		if (canreassoc) {
610 			/* Reassociate */
611 			ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1);
612 		} else {
613 			/*
614 			 * Act as if we received a DEAUTH frame in case we
615 			 * are invoked from the RUN state.  This will cause
616 			 * us to try to re-authenticate if we are operating
617 			 * as a station.
618 			 */
619 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
620 				IEEE80211_FC0_SUBTYPE_DEAUTH);
621 		}
622 	} else
623 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
624 	return 1;
625 }
626 
627 int
628 ieee80211_sta_join(struct ieee80211com *ic,
629 	const struct ieee80211_scan_entry *se)
630 {
631 	struct ieee80211_node *ni;
632 
633 	ni = ieee80211_alloc_node(&ic->ic_sta, se->se_macaddr);
634 	if (ni == NULL) {
635 		/* XXX msg */
636 		return 0;
637 	}
638 	/*
639 	 * Expand scan state into node's format.
640 	 * XXX may not need all this stuff
641 	 */
642 	IEEE80211_ADDR_COPY(ni->ni_bssid, se->se_bssid);
643 	ni->ni_esslen = se->se_ssid[1];
644 	memcpy(ni->ni_essid, se->se_ssid+2, ni->ni_esslen);
645 	ni->ni_rstamp = se->se_rstamp;
646 	ni->ni_tstamp.tsf = se->se_tstamp.tsf;
647 	ni->ni_intval = se->se_intval;
648 	ni->ni_capinfo = se->se_capinfo;
649 	ni->ni_chan = se->se_chan;
650 	ni->ni_timoff = se->se_timoff;
651 	ni->ni_fhdwell = se->se_fhdwell;
652 	ni->ni_fhindex = se->se_fhindex;
653 	ni->ni_erp = se->se_erp;
654 	ni->ni_rssi = se->se_rssi;
655 	ni->ni_noise = se->se_noise;
656 	if (se->se_htcap_ie != NULL) {
657 		ieee80211_saveie(&ni->ni_htcap_ie, se->se_htcap_ie);
658 		ieee80211_parse_htcap(ni, ni->ni_htcap_ie);
659 	}
660 	if (se->se_wpa_ie != NULL)
661 		ieee80211_saveie(&ni->ni_wpa_ie, se->se_wpa_ie);
662 	if (se->se_rsn_ie != NULL)
663 		ieee80211_saveie(&ni->ni_rsn_ie, se->se_rsn_ie);
664 	if (se->se_wme_ie != NULL)
665 		ieee80211_saveie(&ni->ni_wme_ie, se->se_wme_ie);
666 	if (se->se_ath_ie != NULL)
667 		ieee80211_saveath(ni, se->se_ath_ie);
668 
669 	ic->ic_dtim_period = se->se_dtimperiod;
670 	ic->ic_dtim_count = 0;
671 
672 	/* NB: must be after ni_chan is setup */
673 	ieee80211_setup_rates(ni, se->se_rates, se->se_xrates,
674 		IEEE80211_F_DOSORT);
675 
676 	return ieee80211_sta_join1(ieee80211_ref_node(ni));
677 }
678 
679 /*
680  * Leave the specified IBSS/BSS network.  The node is assumed to
681  * be passed in with a held reference.
682  */
683 void
684 ieee80211_sta_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
685 {
686 	ic->ic_node_cleanup(ni);
687 	ieee80211_notify_node_leave(ic, ni);
688 }
689 
690 static struct ieee80211_node *
691 node_alloc(struct ieee80211_node_table *nt)
692 {
693 	struct ieee80211_node *ni;
694 
695 	MALLOC(ni, struct ieee80211_node *, sizeof(struct ieee80211_node),
696 		M_80211_NODE, M_NOWAIT | M_ZERO);
697 	return ni;
698 }
699 
700 /*
701  * Reclaim any resources in a node and reset any critical
702  * state.  Typically nodes are free'd immediately after,
703  * but in some cases the storage may be reused so we need
704  * to insure consistent state (should probably fix that).
705  */
706 static void
707 node_cleanup(struct ieee80211_node *ni)
708 {
709 #define	N(a)	(sizeof(a)/sizeof(a[0]))
710 	struct ieee80211com *ic = ni->ni_ic;
711 	int i;
712 
713 	/* NB: preserve ni_table */
714 	if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) {
715 		if (ic->ic_opmode != IEEE80211_M_STA)
716 			ic->ic_ps_sta--;
717 		ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
718 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
719 		    "[%s] power save mode off, %u sta's in ps mode\n",
720 		    ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta);
721 	}
722 	/*
723 	 * Cleanup any HT-related state.
724 	 */
725 	if (ni->ni_flags & IEEE80211_NODE_HT)
726 		ieee80211_ht_node_cleanup(ni);
727 	/*
728 	 * Clear AREF flag that marks the authorization refcnt bump
729 	 * has happened.  This is probably not needed as the node
730 	 * should always be removed from the table so not found but
731 	 * do it just in case.
732 	 */
733 	ni->ni_flags &= ~IEEE80211_NODE_AREF;
734 
735 	/*
736 	 * Drain power save queue and, if needed, clear TIM.
737 	 */
738 	if (ieee80211_node_saveq_drain(ni) != 0 && ic->ic_set_tim != NULL)
739 		ic->ic_set_tim(ni, 0);
740 
741 	ni->ni_associd = 0;
742 	if (ni->ni_challenge != NULL) {
743 		FREE(ni->ni_challenge, M_80211_NODE);
744 		ni->ni_challenge = NULL;
745 	}
746 	/*
747 	 * Preserve SSID, WPA, and WME ie's so the bss node is
748 	 * reusable during a re-auth/re-assoc state transition.
749 	 * If we remove these data they will not be recreated
750 	 * because they come from a probe-response or beacon frame
751 	 * which cannot be expected prior to the association-response.
752 	 * This should not be an issue when operating in other modes
753 	 * as stations leaving always go through a full state transition
754 	 * which will rebuild this state.
755 	 *
756 	 * XXX does this leave us open to inheriting old state?
757 	 */
758 	for (i = 0; i < N(ni->ni_rxfrag); i++)
759 		if (ni->ni_rxfrag[i] != NULL) {
760 			m_freem(ni->ni_rxfrag[i]);
761 			ni->ni_rxfrag[i] = NULL;
762 		}
763 	/*
764 	 * Must be careful here to remove any key map entry w/o a LOR.
765 	 */
766 	ieee80211_node_delucastkey(ni);
767 #undef N
768 }
769 
770 static void
771 node_free(struct ieee80211_node *ni)
772 {
773 	struct ieee80211com *ic = ni->ni_ic;
774 
775 	ic->ic_node_cleanup(ni);
776 	if (ni->ni_wpa_ie != NULL)
777 		FREE(ni->ni_wpa_ie, M_80211_NODE);
778 	if (ni->ni_rsn_ie != NULL)
779 		FREE(ni->ni_rsn_ie, M_80211_NODE);
780 	if (ni->ni_wme_ie != NULL)
781 		FREE(ni->ni_wme_ie, M_80211_NODE);
782 	if (ni->ni_ath_ie != NULL)
783 		FREE(ni->ni_ath_ie, M_80211_NODE);
784 	IEEE80211_NODE_SAVEQ_DESTROY(ni);
785 	FREE(ni, M_80211_NODE);
786 }
787 
788 static int8_t
789 node_getrssi(const struct ieee80211_node *ni)
790 {
791 	return ni->ni_rssi;
792 }
793 
794 static void
795 node_getsignal(const struct ieee80211_node *ni, int8_t *rssi, int8_t *noise)
796 {
797 	*rssi = ni->ni_rssi;
798 	*noise = ni->ni_noise;
799 }
800 
801 static void
802 ieee80211_setup_node(struct ieee80211_node_table *nt,
803 	struct ieee80211_node *ni, const uint8_t *macaddr)
804 {
805 	struct ieee80211com *ic = nt->nt_ic;
806 	int hash;
807 
808 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
809 		"%s %p<%s> in %s table\n", __func__, ni,
810 		ether_sprintf(macaddr), nt->nt_name);
811 
812 	IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
813 	hash = IEEE80211_NODE_HASH(macaddr);
814 	ieee80211_node_initref(ni);		/* mark referenced */
815 	ni->ni_chan = IEEE80211_CHAN_ANYC;
816 	ni->ni_authmode = IEEE80211_AUTH_OPEN;
817 	ni->ni_txpower = ic->ic_txpowlimit;	/* max power */
818 	ieee80211_crypto_resetkey(ic, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE);
819 	ni->ni_inact_reload = nt->nt_inact_init;
820 	ni->ni_inact = ni->ni_inact_reload;
821 	ni->ni_ath_defkeyix = 0x7fff;
822 	IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
823 
824 	IEEE80211_NODE_LOCK(nt);
825 	TAILQ_INSERT_TAIL(&nt->nt_node, ni, ni_list);
826 	LIST_INSERT_HEAD(&nt->nt_hash[hash], ni, ni_hash);
827 	ni->ni_table = nt;
828 	ni->ni_ic = ic;
829 	IEEE80211_NODE_UNLOCK(nt);
830 }
831 
832 struct ieee80211_node *
833 ieee80211_alloc_node(struct ieee80211_node_table *nt, const uint8_t *macaddr)
834 {
835 	struct ieee80211com *ic = nt->nt_ic;
836 	struct ieee80211_node *ni;
837 
838 	ni = ic->ic_node_alloc(nt);
839 	if (ni != NULL)
840 		ieee80211_setup_node(nt, ni, macaddr);
841 	else
842 		ic->ic_stats.is_rx_nodealloc++;
843 	return ni;
844 }
845 
846 /*
847  * Craft a temporary node suitable for sending a management frame
848  * to the specified station.  We craft only as much state as we
849  * need to do the work since the node will be immediately reclaimed
850  * once the send completes.
851  */
852 struct ieee80211_node *
853 ieee80211_tmp_node(struct ieee80211com *ic, const uint8_t *macaddr)
854 {
855 	struct ieee80211_node *ni;
856 
857 	ni = ic->ic_node_alloc(&ic->ic_sta);
858 	if (ni != NULL) {
859 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
860 			"%s %p<%s>\n", __func__, ni, ether_sprintf(macaddr));
861 
862 		IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
863 		IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
864 		ieee80211_node_initref(ni);		/* mark referenced */
865 		ni->ni_txpower = ic->ic_bss->ni_txpower;
866 		/* NB: required by ieee80211_fix_rate */
867 		ieee80211_node_set_chan(ic, ni);
868 		ieee80211_crypto_resetkey(ic, &ni->ni_ucastkey,
869 			IEEE80211_KEYIX_NONE);
870 		/* XXX optimize away */
871 		IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
872 
873 		ni->ni_table = NULL;		/* NB: pedantic */
874 		ni->ni_ic = ic;
875 	} else {
876 		/* XXX msg */
877 		ic->ic_stats.is_rx_nodealloc++;
878 	}
879 	return ni;
880 }
881 
882 struct ieee80211_node *
883 ieee80211_dup_bss(struct ieee80211_node_table *nt, const uint8_t *macaddr)
884 {
885 	struct ieee80211com *ic = nt->nt_ic;
886 	struct ieee80211_node *ni;
887 
888 	ni = ic->ic_node_alloc(nt);
889 	if (ni != NULL) {
890 		ieee80211_setup_node(nt, ni, macaddr);
891 		/*
892 		 * Inherit from ic_bss.
893 		 */
894 		ni->ni_authmode = ic->ic_bss->ni_authmode;
895 		ni->ni_txpower = ic->ic_bss->ni_txpower;
896 		ni->ni_vlan = ic->ic_bss->ni_vlan;	/* XXX?? */
897 		IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
898 		ieee80211_node_set_chan(ic, ni);
899 		ni->ni_rsn = ic->ic_bss->ni_rsn;
900 	} else
901 		ic->ic_stats.is_rx_nodealloc++;
902 	return ni;
903 }
904 
905 static struct ieee80211_node *
906 #ifdef IEEE80211_DEBUG_REFCNT
907 _ieee80211_find_node_debug(struct ieee80211_node_table *nt,
908 	const uint8_t *macaddr, const char *func, int line)
909 #else
910 _ieee80211_find_node(struct ieee80211_node_table *nt,
911 	const uint8_t *macaddr)
912 #endif
913 {
914 	struct ieee80211_node *ni;
915 	int hash;
916 
917 	IEEE80211_NODE_LOCK_ASSERT(nt);
918 
919 	hash = IEEE80211_NODE_HASH(macaddr);
920 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
921 		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
922 			ieee80211_ref_node(ni);	/* mark referenced */
923 #ifdef IEEE80211_DEBUG_REFCNT
924 			IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
925 			    "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
926 			    func, line,
927 			    ni, ether_sprintf(ni->ni_macaddr),
928 			    ieee80211_node_refcnt(ni));
929 #endif
930 			return ni;
931 		}
932 	}
933 	return NULL;
934 }
935 #ifdef IEEE80211_DEBUG_REFCNT
936 #define	_ieee80211_find_node(nt, mac) \
937 	_ieee80211_find_node_debug(nt, mac, func, line)
938 #endif
939 
940 struct ieee80211_node *
941 #ifdef IEEE80211_DEBUG_REFCNT
942 ieee80211_find_node_debug(struct ieee80211_node_table *nt,
943 	const uint8_t *macaddr, const char *func, int line)
944 #else
945 ieee80211_find_node(struct ieee80211_node_table *nt, const uint8_t *macaddr)
946 #endif
947 {
948 	struct ieee80211_node *ni;
949 
950 	IEEE80211_NODE_LOCK(nt);
951 	ni = _ieee80211_find_node(nt, macaddr);
952 	IEEE80211_NODE_UNLOCK(nt);
953 	return ni;
954 }
955 
956 /*
957  * Fake up a node; this handles node discovery in adhoc mode.
958  * Note that for the driver's benefit we we treat this like
959  * an association so the driver has an opportunity to setup
960  * it's private state.
961  */
962 struct ieee80211_node *
963 ieee80211_fakeup_adhoc_node(struct ieee80211_node_table *nt,
964 	const uint8_t macaddr[IEEE80211_ADDR_LEN])
965 {
966 	struct ieee80211com *ic = nt->nt_ic;
967 	struct ieee80211_node *ni;
968 
969 	IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
970 	    "%s: mac<%s>\n", __func__, ether_sprintf(macaddr));
971 	ni = ieee80211_dup_bss(nt, macaddr);
972 	if (ni != NULL) {
973 		/* XXX no rate negotiation; just dup */
974 		ni->ni_rates = ic->ic_bss->ni_rates;
975 		if (ic->ic_newassoc != NULL)
976 			ic->ic_newassoc(ni, 1);
977 		if (ic->ic_opmode == IEEE80211_M_AHDEMO) {
978 			/*
979 			 * In adhoc demo mode there are no management
980 			 * frames to use to discover neighbor capabilities,
981 			 * so blindly propagate the local configuration
982 			 * so we can do interesting things (e.g. use
983 			 * WME to disable ACK's).
984 			 */
985 			if (ic->ic_flags & IEEE80211_F_WME)
986 				ni->ni_flags |= IEEE80211_NODE_QOS;
987 			if (ic->ic_flags & IEEE80211_F_FF)
988 				ni->ni_flags |= IEEE80211_NODE_FF;
989 		}
990 		/* XXX not right for 802.1x/WPA */
991 		ieee80211_node_authorize(ni);
992 	}
993 	return ni;
994 }
995 
996 void
997 ieee80211_init_neighbor(struct ieee80211_node *ni,
998 	const struct ieee80211_frame *wh,
999 	const struct ieee80211_scanparams *sp)
1000 {
1001 	ni->ni_esslen = sp->ssid[1];
1002 	memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
1003 	IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
1004 	memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
1005 	ni->ni_intval = sp->bintval;
1006 	ni->ni_capinfo = sp->capinfo;
1007 	ni->ni_chan = ni->ni_ic->ic_curchan;
1008 	ni->ni_fhdwell = sp->fhdwell;
1009 	ni->ni_fhindex = sp->fhindex;
1010 	ni->ni_erp = sp->erp;
1011 	ni->ni_timoff = sp->timoff;
1012 	if (sp->wme != NULL)
1013 		ieee80211_saveie(&ni->ni_wme_ie, sp->wme);
1014 	if (sp->wpa != NULL)
1015 		ieee80211_saveie(&ni->ni_wpa_ie, sp->wpa);
1016 	if (sp->rsn != NULL)
1017 		ieee80211_saveie(&ni->ni_rsn_ie, sp->rsn);
1018 	if (sp->ath != NULL)
1019 		ieee80211_saveath(ni, sp->ath);
1020 
1021 	/* NB: must be after ni_chan is setup */
1022 	ieee80211_setup_rates(ni, sp->rates, sp->xrates,
1023 		IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1024 		IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1025 }
1026 
1027 /*
1028  * Do node discovery in adhoc mode on receipt of a beacon
1029  * or probe response frame.  Note that for the driver's
1030  * benefit we we treat this like an association so the
1031  * driver has an opportunity to setup it's private state.
1032  */
1033 struct ieee80211_node *
1034 ieee80211_add_neighbor(struct ieee80211com *ic,
1035 	const struct ieee80211_frame *wh,
1036 	const struct ieee80211_scanparams *sp)
1037 {
1038 	struct ieee80211_node *ni;
1039 
1040 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1041 	    "%s: mac<%s>\n", __func__, ether_sprintf(wh->i_addr2));
1042 	ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);/* XXX alloc_node? */
1043 	if (ni != NULL) {
1044 		ieee80211_init_neighbor(ni, wh, sp);
1045 		if (ic->ic_newassoc != NULL)
1046 			ic->ic_newassoc(ni, 1);
1047 		/* XXX not right for 802.1x/WPA */
1048 		ieee80211_node_authorize(ni);
1049 	}
1050 	return ni;
1051 }
1052 
1053 #define	IS_CTL(wh) \
1054 	((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
1055 #define	IS_PSPOLL(wh) \
1056 	((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
1057 #define	IS_BAR(wh) \
1058 	((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_BAR)
1059 
1060 /*
1061  * Locate the node for sender, track state, and then pass the
1062  * (referenced) node up to the 802.11 layer for its use.  We
1063  * are required to pass some node so we fall back to ic_bss
1064  * when this frame is from an unknown sender.  The 802.11 layer
1065  * knows this means the sender wasn't in the node table and
1066  * acts accordingly.
1067  */
1068 struct ieee80211_node *
1069 #ifdef IEEE80211_DEBUG_REFCNT
1070 ieee80211_find_rxnode_debug(struct ieee80211com *ic,
1071 	const struct ieee80211_frame_min *wh, const char *func, int line)
1072 #else
1073 ieee80211_find_rxnode(struct ieee80211com *ic,
1074 	const struct ieee80211_frame_min *wh)
1075 #endif
1076 {
1077 	struct ieee80211_node_table *nt;
1078 	struct ieee80211_node *ni;
1079 
1080 	/* XXX check ic_bss first in station mode */
1081 	/* XXX 4-address frames? */
1082 	nt = &ic->ic_sta;
1083 	IEEE80211_NODE_LOCK(nt);
1084 	if (IS_CTL(wh) && !IS_PSPOLL(wh) && !IS_BAR(wh) /*&& !IS_RTS(ah)*/)
1085 		ni = _ieee80211_find_node(nt, wh->i_addr1);
1086 	else
1087 		ni = _ieee80211_find_node(nt, wh->i_addr2);
1088 	if (ni == NULL)
1089 		ni = ieee80211_ref_node(ic->ic_bss);
1090 	IEEE80211_NODE_UNLOCK(nt);
1091 
1092 	return ni;
1093 }
1094 
1095 /*
1096  * Like ieee80211_find_rxnode but use the supplied h/w
1097  * key index as a hint to locate the node in the key
1098  * mapping table.  If an entry is present at the key
1099  * index we return it; otherwise do a normal lookup and
1100  * update the mapping table if the station has a unicast
1101  * key assigned to it.
1102  */
1103 struct ieee80211_node *
1104 #ifdef IEEE80211_DEBUG_REFCNT
1105 ieee80211_find_rxnode_withkey_debug(struct ieee80211com *ic,
1106 	const struct ieee80211_frame_min *wh, ieee80211_keyix keyix,
1107 	const char *func, int line)
1108 #else
1109 ieee80211_find_rxnode_withkey(struct ieee80211com *ic,
1110 	const struct ieee80211_frame_min *wh, ieee80211_keyix keyix)
1111 #endif
1112 {
1113 	struct ieee80211_node_table *nt;
1114 	struct ieee80211_node *ni;
1115 
1116 	nt = &ic->ic_sta;
1117 	IEEE80211_NODE_LOCK(nt);
1118 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax)
1119 		ni = nt->nt_keyixmap[keyix];
1120 	else
1121 		ni = NULL;
1122 	if (ni == NULL) {
1123 		if (IS_CTL(wh) && !IS_PSPOLL(wh) && !IS_BAR(wh) /*&& !IS_RTS(ah)*/)
1124 			ni = _ieee80211_find_node(nt, wh->i_addr1);
1125 		else
1126 			ni = _ieee80211_find_node(nt, wh->i_addr2);
1127 		if (ni == NULL)
1128 			ni = ieee80211_ref_node(ic->ic_bss);
1129 		if (nt->nt_keyixmap != NULL) {
1130 			/*
1131 			 * If the station has a unicast key cache slot
1132 			 * assigned update the key->node mapping table.
1133 			 */
1134 			keyix = ni->ni_ucastkey.wk_rxkeyix;
1135 			/* XXX can keyixmap[keyix] != NULL? */
1136 			if (keyix < nt->nt_keyixmax &&
1137 			    nt->nt_keyixmap[keyix] == NULL) {
1138 				IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1139 				    "%s: add key map entry %p<%s> refcnt %d\n",
1140 				    __func__, ni, ether_sprintf(ni->ni_macaddr),
1141 				    ieee80211_node_refcnt(ni)+1);
1142 				nt->nt_keyixmap[keyix] = ieee80211_ref_node(ni);
1143 			}
1144 		}
1145 	} else
1146 		ieee80211_ref_node(ni);
1147 	IEEE80211_NODE_UNLOCK(nt);
1148 
1149 	return ni;
1150 }
1151 #undef IS_BAR
1152 #undef IS_PSPOLL
1153 #undef IS_CTL
1154 
1155 /*
1156  * Return a reference to the appropriate node for sending
1157  * a data frame.  This handles node discovery in adhoc networks.
1158  */
1159 struct ieee80211_node *
1160 #ifdef IEEE80211_DEBUG_REFCNT
1161 ieee80211_find_txnode_debug(struct ieee80211com *ic, const uint8_t *macaddr,
1162 	const char *func, int line)
1163 #else
1164 ieee80211_find_txnode(struct ieee80211com *ic, const uint8_t *macaddr)
1165 #endif
1166 {
1167 	struct ieee80211_node_table *nt = &ic->ic_sta;
1168 	struct ieee80211_node *ni;
1169 
1170 	/*
1171 	 * The destination address should be in the node table
1172 	 * unless this is a multicast/broadcast frame.  We can
1173 	 * also optimize station mode operation, all frames go
1174 	 * to the bss node.
1175 	 */
1176 	/* XXX can't hold lock across dup_bss 'cuz of recursive locking */
1177 	IEEE80211_NODE_LOCK(nt);
1178 	if (ic->ic_opmode == IEEE80211_M_STA || IEEE80211_IS_MULTICAST(macaddr))
1179 		ni = ieee80211_ref_node(ic->ic_bss);
1180 	else {
1181 		ni = _ieee80211_find_node(nt, macaddr);
1182 		if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1183 		    (ni != NULL && ni->ni_associd == 0)) {
1184 			/*
1185 			 * Station is not associated; don't permit the
1186 			 * data frame to be sent by returning NULL.  This
1187 			 * is kinda a kludge but the least intrusive way
1188 			 * to add this check into all drivers.
1189 			 */
1190 			ieee80211_unref_node(&ni);	/* NB: null's ni */
1191 		}
1192 	}
1193 	IEEE80211_NODE_UNLOCK(nt);
1194 
1195 	if (ni == NULL) {
1196 		if (ic->ic_opmode == IEEE80211_M_IBSS ||
1197 		    ic->ic_opmode == IEEE80211_M_AHDEMO) {
1198 			/*
1199 			 * In adhoc mode cons up a node for the destination.
1200 			 * Note that we need an additional reference for the
1201 			 * caller to be consistent with _ieee80211_find_node.
1202 			 */
1203 			ni = ieee80211_fakeup_adhoc_node(nt, macaddr);
1204 			if (ni != NULL)
1205 				(void) ieee80211_ref_node(ni);
1206 		} else {
1207 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
1208 				"[%s] no node, discard frame (%s)\n",
1209 				ether_sprintf(macaddr), __func__);
1210 			ic->ic_stats.is_tx_nonode++;
1211 		}
1212 	}
1213 	return ni;
1214 }
1215 
1216 /*
1217  * Like find but search based on the ssid too.
1218  */
1219 struct ieee80211_node *
1220 #ifdef IEEE80211_DEBUG_REFCNT
1221 ieee80211_find_node_with_ssid_debug(struct ieee80211_node_table *nt,
1222 	const uint8_t *macaddr, u_int ssidlen, const uint8_t *ssid,
1223 	const char *func, int line)
1224 #else
1225 ieee80211_find_node_with_ssid(struct ieee80211_node_table *nt,
1226 	const uint8_t *macaddr, u_int ssidlen, const uint8_t *ssid)
1227 #endif
1228 {
1229 #define	MATCH_SSID(ni, ssid, ssidlen) \
1230 	(ni->ni_esslen == ssidlen && memcmp(ni->ni_essid, ssid, ssidlen) == 0)
1231 	static const uint8_t zeromac[IEEE80211_ADDR_LEN];
1232 	struct ieee80211_node *ni;
1233 	int hash;
1234 
1235 	IEEE80211_NODE_LOCK(nt);
1236 	/*
1237 	 * A mac address that is all zero means match only the ssid;
1238 	 * otherwise we must match both.
1239 	 */
1240 	if (IEEE80211_ADDR_EQ(macaddr, zeromac)) {
1241 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1242 			if (MATCH_SSID(ni, ssid, ssidlen))
1243 				break;
1244 		}
1245 	} else {
1246 		hash = IEEE80211_NODE_HASH(macaddr);
1247 		LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
1248 			if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) &&
1249 			    MATCH_SSID(ni, ssid, ssidlen))
1250 				break;
1251 		}
1252 	}
1253 	if (ni != NULL) {
1254 		ieee80211_ref_node(ni);	/* mark referenced */
1255 		IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
1256 		     REFCNT_LOC, ni, ether_sprintf(ni->ni_macaddr),
1257 		     ieee80211_node_refcnt(ni));
1258 	}
1259 	IEEE80211_NODE_UNLOCK(nt);
1260 	return ni;
1261 #undef MATCH_SSID
1262 }
1263 
1264 static void
1265 _ieee80211_free_node(struct ieee80211_node *ni)
1266 {
1267 	struct ieee80211com *ic = ni->ni_ic;
1268 	struct ieee80211_node_table *nt = ni->ni_table;
1269 
1270 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1271 		"%s %p<%s> in %s table\n", __func__, ni,
1272 		ether_sprintf(ni->ni_macaddr),
1273 		nt != NULL ? nt->nt_name : "<gone>");
1274 
1275 	IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
1276 	if (nt != NULL) {
1277 		TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
1278 		LIST_REMOVE(ni, ni_hash);
1279 	}
1280 	ic->ic_node_free(ni);
1281 }
1282 
1283 void
1284 #ifdef IEEE80211_DEBUG_REFCNT
1285 ieee80211_free_node_debug(struct ieee80211_node *ni, const char *func, int line)
1286 #else
1287 ieee80211_free_node(struct ieee80211_node *ni)
1288 #endif
1289 {
1290 	struct ieee80211_node_table *nt = ni->ni_table;
1291 
1292 #ifdef IEEE80211_DEBUG_REFCNT
1293 	IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1294 		"%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni,
1295 		 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)-1);
1296 #endif
1297 	if (nt != NULL) {
1298 		IEEE80211_NODE_LOCK(nt);
1299 		if (ieee80211_node_dectestref(ni)) {
1300 			/*
1301 			 * Last reference, reclaim state.
1302 			 */
1303 			_ieee80211_free_node(ni);
1304 		} else if (ieee80211_node_refcnt(ni) == 1 &&
1305 		    nt->nt_keyixmap != NULL) {
1306 			ieee80211_keyix keyix;
1307 			/*
1308 			 * Check for a last reference in the key mapping table.
1309 			 */
1310 			keyix = ni->ni_ucastkey.wk_rxkeyix;
1311 			if (keyix < nt->nt_keyixmax &&
1312 			    nt->nt_keyixmap[keyix] == ni) {
1313 				IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1314 				    "%s: %p<%s> clear key map entry", __func__,
1315 				    ni, ether_sprintf(ni->ni_macaddr));
1316 				nt->nt_keyixmap[keyix] = NULL;
1317 				ieee80211_node_decref(ni); /* XXX needed? */
1318 				_ieee80211_free_node(ni);
1319 			}
1320 		}
1321 		IEEE80211_NODE_UNLOCK(nt);
1322 	} else {
1323 		if (ieee80211_node_dectestref(ni))
1324 			_ieee80211_free_node(ni);
1325 	}
1326 }
1327 
1328 /*
1329  * Reclaim a unicast key and clear any key cache state.
1330  */
1331 int
1332 ieee80211_node_delucastkey(struct ieee80211_node *ni)
1333 {
1334 	struct ieee80211com *ic = ni->ni_ic;
1335 	struct ieee80211_node_table *nt = &ic->ic_sta;
1336 	struct ieee80211_node *nikey;
1337 	ieee80211_keyix keyix;
1338 	int isowned, status;
1339 
1340 	/*
1341 	 * NB: We must beware of LOR here; deleting the key
1342 	 * can cause the crypto layer to block traffic updates
1343 	 * which can generate a LOR against the node table lock;
1344 	 * grab it here and stash the key index for our use below.
1345 	 *
1346 	 * Must also beware of recursion on the node table lock.
1347 	 * When called from node_cleanup we may already have
1348 	 * the node table lock held.  Unfortunately there's no
1349 	 * way to separate out this path so we must do this
1350 	 * conditionally.
1351 	 */
1352 	isowned = IEEE80211_NODE_IS_LOCKED(nt);
1353 	if (!isowned)
1354 		IEEE80211_NODE_LOCK(nt);
1355 	keyix = ni->ni_ucastkey.wk_rxkeyix;
1356 	status = ieee80211_crypto_delkey(ic, &ni->ni_ucastkey);
1357 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax) {
1358 		nikey = nt->nt_keyixmap[keyix];
1359 		nt->nt_keyixmap[keyix] = NULL;;
1360 	} else
1361 		nikey = NULL;
1362 	if (!isowned)
1363 		IEEE80211_NODE_UNLOCK(&ic->ic_sta);
1364 
1365 	if (nikey != NULL) {
1366 		KASSERT(nikey == ni,
1367 			("key map out of sync, ni %p nikey %p", ni, nikey));
1368 		IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1369 			"%s: delete key map entry %p<%s> refcnt %d\n",
1370 			__func__, ni, ether_sprintf(ni->ni_macaddr),
1371 			ieee80211_node_refcnt(ni)-1);
1372 		ieee80211_free_node(ni);
1373 	}
1374 	return status;
1375 }
1376 
1377 /*
1378  * Reclaim a node.  If this is the last reference count then
1379  * do the normal free work.  Otherwise remove it from the node
1380  * table and mark it gone by clearing the back-reference.
1381  */
1382 static void
1383 node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
1384 {
1385 	ieee80211_keyix keyix;
1386 
1387 	IEEE80211_NODE_LOCK_ASSERT(nt);
1388 
1389 	IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1390 		"%s: remove %p<%s> from %s table, refcnt %d\n",
1391 		__func__, ni, ether_sprintf(ni->ni_macaddr),
1392 		nt->nt_name, ieee80211_node_refcnt(ni)-1);
1393 	/*
1394 	 * Clear any entry in the unicast key mapping table.
1395 	 * We need to do it here so rx lookups don't find it
1396 	 * in the mapping table even if it's not in the hash
1397 	 * table.  We cannot depend on the mapping table entry
1398 	 * being cleared because the node may not be free'd.
1399 	 */
1400 	keyix = ni->ni_ucastkey.wk_rxkeyix;
1401 	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
1402 	    nt->nt_keyixmap[keyix] == ni) {
1403 		IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1404 			"%s: %p<%s> clear key map entry\n",
1405 			__func__, ni, ether_sprintf(ni->ni_macaddr));
1406 		nt->nt_keyixmap[keyix] = NULL;
1407 		ieee80211_node_decref(ni);	/* NB: don't need free */
1408 	}
1409 	if (!ieee80211_node_dectestref(ni)) {
1410 		/*
1411 		 * Other references are present, just remove the
1412 		 * node from the table so it cannot be found.  When
1413 		 * the references are dropped storage will be
1414 		 * reclaimed.
1415 		 */
1416 		TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
1417 		LIST_REMOVE(ni, ni_hash);
1418 		ni->ni_table = NULL;		/* clear reference */
1419 	} else
1420 		_ieee80211_free_node(ni);
1421 }
1422 
1423 static void
1424 ieee80211_free_allnodes_locked(struct ieee80211_node_table *nt)
1425 {
1426 	struct ieee80211com *ic = nt->nt_ic;
1427 	struct ieee80211_node *ni;
1428 
1429 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1430 		"%s: free all nodes in %s table\n", __func__, nt->nt_name);
1431 
1432 	while ((ni = TAILQ_FIRST(&nt->nt_node)) != NULL) {
1433 		if (ni->ni_associd != 0) {
1434 			if (ic->ic_auth->ia_node_leave != NULL)
1435 				ic->ic_auth->ia_node_leave(ic, ni);
1436 			IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
1437 		}
1438 		node_reclaim(nt, ni);
1439 	}
1440 }
1441 
1442 /*
1443  * Timeout inactive stations and do related housekeeping.
1444  * Note that we cannot hold the node lock while sending a
1445  * frame as this would lead to a LOR.  Instead we use a
1446  * generation number to mark nodes that we've scanned and
1447  * drop the lock and restart a scan if we have to time out
1448  * a node.  Since we are single-threaded by virtue of
1449  * controlling the inactivity timer we can be sure this will
1450  * process each node only once.
1451  */
1452 static void
1453 ieee80211_timeout_stations(struct ieee80211_node_table *nt)
1454 {
1455 	struct ieee80211com *ic = nt->nt_ic;
1456 	struct ieee80211_node *ni;
1457 	u_int gen;
1458 	int isadhoc;
1459 
1460 	isadhoc = (ic->ic_opmode == IEEE80211_M_IBSS ||
1461 		   ic->ic_opmode == IEEE80211_M_AHDEMO);
1462 	IEEE80211_SCAN_LOCK(nt);
1463 	gen = ++nt->nt_scangen;
1464 restart:
1465 	IEEE80211_NODE_LOCK(nt);
1466 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1467 		if (ni->ni_scangen == gen)	/* previously handled */
1468 			continue;
1469 		ni->ni_scangen = gen;
1470 		/*
1471 		 * Ignore entries for which have yet to receive an
1472 		 * authentication frame.  These are transient and
1473 		 * will be reclaimed when the last reference to them
1474 		 * goes away (when frame xmits complete).
1475 		 */
1476 		if ((ic->ic_opmode == IEEE80211_M_HOSTAP ||
1477 		     ic->ic_opmode == IEEE80211_M_STA) &&
1478 		    (ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1479 			continue;
1480 		/*
1481 		 * Free fragment if not needed anymore
1482 		 * (last fragment older than 1s).
1483 		 * XXX doesn't belong here
1484 		 */
1485 		if (ni->ni_rxfrag[0] != NULL &&
1486 		    ticks > ni->ni_rxfragstamp + hz) {
1487 			m_freem(ni->ni_rxfrag[0]);
1488 			ni->ni_rxfrag[0] = NULL;
1489 		}
1490 		if (ni->ni_inact > 0)
1491 			ni->ni_inact--;
1492 		/*
1493 		 * Special case ourself; we may be idle for extended periods
1494 		 * of time and regardless reclaiming our state is wrong.
1495 		 */
1496 		if (ni == ic->ic_bss)
1497 			continue;
1498 		if (ni->ni_associd != 0 || isadhoc) {
1499 			/*
1500 			 * Age frames on the power save queue.
1501 			 */
1502 			if (ieee80211_node_saveq_age(ni) != 0 &&
1503 			    IEEE80211_NODE_SAVEQ_QLEN(ni) == 0 &&
1504 			    ic->ic_set_tim != NULL)
1505 				ic->ic_set_tim(ni, 0);
1506 			/*
1507 			 * Probe the station before time it out.  We
1508 			 * send a null data frame which may not be
1509 			 * universally supported by drivers (need it
1510 			 * for ps-poll support so it should be...).
1511 			 *
1512 			 * XXX don't probe the station unless we've
1513 			 *     received a frame from them (and have
1514 			 *     some idea of the rates they are capable
1515 			 *     of); this will get fixed more properly
1516 			 *     soon with better handling of the rate set.
1517 			 */
1518 			if ((ic->ic_flags_ext & IEEE80211_FEXT_INACT) &&
1519 			    (0 < ni->ni_inact &&
1520 			     ni->ni_inact <= ic->ic_inact_probe) &&
1521 			    ni->ni_rates.rs_nrates != 0) {
1522 				IEEE80211_NOTE(ic,
1523 				    IEEE80211_MSG_INACT | IEEE80211_MSG_NODE,
1524 				    ni, "%s",
1525 				    "probe station due to inactivity");
1526 				/*
1527 				 * Grab a reference before unlocking the table
1528 				 * so the node cannot be reclaimed before we
1529 				 * send the frame. ieee80211_send_nulldata
1530 				 * understands we've done this and reclaims the
1531 				 * ref for us as needed.
1532 				 */
1533 				ieee80211_ref_node(ni);
1534 				IEEE80211_NODE_UNLOCK(nt);
1535 				ieee80211_send_nulldata(ni);
1536 				/* XXX stat? */
1537 				goto restart;
1538 			}
1539 		}
1540 		if ((ic->ic_flags_ext & IEEE80211_FEXT_INACT) &&
1541 		    ni->ni_inact <= 0) {
1542 			IEEE80211_NOTE(ic,
1543 			    IEEE80211_MSG_INACT | IEEE80211_MSG_NODE, ni,
1544 			    "station timed out due to inactivity "
1545 			    "(refcnt %u)", ieee80211_node_refcnt(ni));
1546 			/*
1547 			 * Send a deauthenticate frame and drop the station.
1548 			 * This is somewhat complicated due to reference counts
1549 			 * and locking.  At this point a station will typically
1550 			 * have a reference count of 1.  ieee80211_node_leave
1551 			 * will do a "free" of the node which will drop the
1552 			 * reference count.  But in the meantime a reference
1553 			 * wil be held by the deauth frame.  The actual reclaim
1554 			 * of the node will happen either after the tx is
1555 			 * completed or by ieee80211_node_leave.
1556 			 *
1557 			 * Separately we must drop the node lock before sending
1558 			 * in case the driver takes a lock, as this can result
1559 			 * in a LOR between the node lock and the driver lock.
1560 			 */
1561 			ieee80211_ref_node(ni);
1562 			IEEE80211_NODE_UNLOCK(nt);
1563 			if (ni->ni_associd != 0) {
1564 				IEEE80211_SEND_MGMT(ic, ni,
1565 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
1566 				    IEEE80211_REASON_AUTH_EXPIRE);
1567 			}
1568 			ieee80211_node_leave(ic, ni);
1569 			ieee80211_free_node(ni);
1570 			ic->ic_stats.is_node_timeout++;
1571 			goto restart;
1572 		}
1573 	}
1574 	IEEE80211_NODE_UNLOCK(nt);
1575 
1576 	IEEE80211_SCAN_UNLOCK(nt);
1577 }
1578 
1579 void
1580 ieee80211_node_timeout(void *arg)
1581 {
1582 	struct ieee80211com *ic = arg;
1583 
1584 	ieee80211_scan_timeout(ic);
1585 	ieee80211_timeout_stations(&ic->ic_sta);
1586 
1587 	IEEE80211_LOCK(ic);
1588 	ieee80211_erp_timeout(ic);
1589 	ieee80211_ht_timeout(ic);
1590 	IEEE80211_UNLOCK(ic);
1591 
1592 	callout_reset(&ic->ic_inact, IEEE80211_INACT_WAIT*hz,
1593 		ieee80211_node_timeout, ic);
1594 }
1595 
1596 void
1597 ieee80211_iterate_nodes(struct ieee80211_node_table *nt, ieee80211_iter_func *f, void *arg)
1598 {
1599 	struct ieee80211_node *ni;
1600 	u_int gen;
1601 
1602 	IEEE80211_SCAN_LOCK(nt);
1603 	gen = ++nt->nt_scangen;
1604 restart:
1605 	IEEE80211_NODE_LOCK(nt);
1606 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1607 		if (ni->ni_scangen != gen) {
1608 			ni->ni_scangen = gen;
1609 			(void) ieee80211_ref_node(ni);
1610 			IEEE80211_NODE_UNLOCK(nt);
1611 			(*f)(arg, ni);
1612 			ieee80211_free_node(ni);
1613 			goto restart;
1614 		}
1615 	}
1616 	IEEE80211_NODE_UNLOCK(nt);
1617 
1618 	IEEE80211_SCAN_UNLOCK(nt);
1619 }
1620 
1621 void
1622 ieee80211_dump_node(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
1623 {
1624 	printf("0x%p: mac %s refcnt %d\n", ni,
1625 		ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni));
1626 	printf("\tscangen %u authmode %u flags 0x%x\n",
1627 		ni->ni_scangen, ni->ni_authmode, ni->ni_flags);
1628 	printf("\tassocid 0x%x txpower %u vlan %u\n",
1629 		ni->ni_associd, ni->ni_txpower, ni->ni_vlan);
1630 	printf("\ttxseq %u rxseq %u fragno %u rxfragstamp %u\n",
1631 		ni->ni_txseqs[IEEE80211_NONQOS_TID],
1632 		ni->ni_rxseqs[IEEE80211_NONQOS_TID] >> IEEE80211_SEQ_SEQ_SHIFT,
1633 		ni->ni_rxseqs[IEEE80211_NONQOS_TID] & IEEE80211_SEQ_FRAG_MASK,
1634 		ni->ni_rxfragstamp);
1635 	printf("\trstamp %u rssi %d noise %d intval %u capinfo 0x%x\n",
1636 		ni->ni_rstamp, ni->ni_rssi, ni->ni_noise,
1637 		ni->ni_intval, ni->ni_capinfo);
1638 	printf("\tbssid %s essid \"%.*s\" channel %u:0x%x\n",
1639 		ether_sprintf(ni->ni_bssid),
1640 		ni->ni_esslen, ni->ni_essid,
1641 		ni->ni_chan->ic_freq, ni->ni_chan->ic_flags);
1642 	printf("\tfails %u inact %u txrate %u\n",
1643 		ni->ni_fails, ni->ni_inact, ni->ni_txrate);
1644 	printf("\thtcap %x htparam %x htctlchan %u ht2ndchan %u\n",
1645 		ni->ni_htcap, ni->ni_htparam,
1646 		ni->ni_htctlchan, ni->ni_ht2ndchan);
1647 	printf("\thtopmode %x htstbc %x chw %u\n",
1648 		ni->ni_htopmode, ni->ni_htstbc, ni->ni_chw);
1649 }
1650 
1651 void
1652 ieee80211_dump_nodes(struct ieee80211_node_table *nt)
1653 {
1654 	ieee80211_iterate_nodes(nt,
1655 		(ieee80211_iter_func *) ieee80211_dump_node, nt);
1656 }
1657 
1658 void
1659 ieee80211_notify_erp(struct ieee80211com *ic)
1660 {
1661 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1662 		ieee80211_beacon_notify(ic, IEEE80211_BEACON_ERP);
1663 }
1664 
1665 /*
1666  * Handle a station joining an 11g network.
1667  */
1668 static void
1669 ieee80211_node_join_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
1670 {
1671 
1672 	IEEE80211_LOCK_ASSERT(ic);
1673 
1674 	/*
1675 	 * Station isn't capable of short slot time.  Bump
1676 	 * the count of long slot time stations and disable
1677 	 * use of short slot time.  Note that the actual switch
1678 	 * over to long slot time use may not occur until the
1679 	 * next beacon transmission (per sec. 7.3.1.4 of 11g).
1680 	 */
1681 	if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
1682 		ic->ic_longslotsta++;
1683 		IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1684 		    "station needs long slot time, count %d",
1685 		    ic->ic_longslotsta);
1686 		/* XXX vap's w/ conflicting needs won't work */
1687 		if (!IEEE80211_IS_CHAN_108G(ic->ic_bsschan)) {
1688 			/*
1689 			 * Don't force slot time when switched to turbo
1690 			 * mode as non-ERP stations won't be present; this
1691 			 * need only be done when on the normal G channel.
1692 			 */
1693 			ieee80211_set_shortslottime(ic, 0);
1694 		}
1695 	}
1696 	/*
1697 	 * If the new station is not an ERP station
1698 	 * then bump the counter and enable protection
1699 	 * if configured.
1700 	 */
1701 	if (!ieee80211_iserp_rateset(ic, &ni->ni_rates)) {
1702 		ic->ic_nonerpsta++;
1703 		IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1704 		    "station is !ERP, %d non-ERP stations associated",
1705 		    ic->ic_nonerpsta);
1706 		/*
1707 		 * If station does not support short preamble
1708 		 * then we must enable use of Barker preamble.
1709 		 */
1710 		if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) == 0) {
1711 			IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1712 			    "%s", "station needs long preamble");
1713 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1714 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1715 		}
1716 		/*
1717 		 * If protection is configured, enable it.
1718 		 */
1719 		if (ic->ic_protmode != IEEE80211_PROT_NONE &&
1720 		    ic->ic_nonerpsta == 1 &&
1721 		    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0) {
1722 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1723 			    "%s: enable use of protection\n", __func__);
1724 			ic->ic_flags |= IEEE80211_F_USEPROT;
1725 			ieee80211_notify_erp(ic);
1726 		}
1727 	} else
1728 		ni->ni_flags |= IEEE80211_NODE_ERP;
1729 }
1730 
1731 void
1732 ieee80211_node_join(struct ieee80211com *ic, struct ieee80211_node *ni, int resp)
1733 {
1734 	int newassoc;
1735 
1736 	if (ni->ni_associd == 0) {
1737 		uint16_t aid;
1738 
1739 		IEEE80211_LOCK(ic);
1740 		/*
1741 		 * It would be good to search the bitmap
1742 		 * more efficiently, but this will do for now.
1743 		 */
1744 		for (aid = 1; aid < ic->ic_max_aid; aid++) {
1745 			if (!IEEE80211_AID_ISSET(aid,
1746 			    ic->ic_aid_bitmap))
1747 				break;
1748 		}
1749 		if (aid >= ic->ic_max_aid) {
1750 			IEEE80211_UNLOCK(ic);
1751 			IEEE80211_SEND_MGMT(ic, ni, resp,
1752 			    IEEE80211_REASON_ASSOC_TOOMANY);
1753 			ieee80211_node_leave(ic, ni);
1754 			return;
1755 		}
1756 		ni->ni_associd = aid | 0xc000;
1757 		ni->ni_jointime = time_uptime;
1758 		IEEE80211_AID_SET(ni->ni_associd, ic->ic_aid_bitmap);
1759 		ic->ic_sta_assoc++;
1760 
1761 		if (IEEE80211_IS_CHAN_HT(ic->ic_bsschan))
1762 			ieee80211_ht_node_join(ni);
1763 		if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
1764 		    IEEE80211_IS_CHAN_FULL(ic->ic_bsschan))
1765 			ieee80211_node_join_11g(ic, ni);
1766 		IEEE80211_UNLOCK(ic);
1767 
1768 		newassoc = 1;
1769 	} else
1770 		newassoc = 0;
1771 
1772 	IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, ni,
1773 	    "station associated at aid %d: %s preamble, %s slot time%s%s%s%s%s%s",
1774 	    IEEE80211_NODE_AID(ni),
1775 	    ic->ic_flags & IEEE80211_F_SHPREAMBLE ? "short" : "long",
1776 	    ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long",
1777 	    ic->ic_flags & IEEE80211_F_USEPROT ? ", protection" : "",
1778 	    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1779 	    ni->ni_flags & IEEE80211_NODE_HT ?
1780 		(ni->ni_chw == 20 ? ", HT20" : ", HT40") : "",
1781 	    ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1782 	    IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_FF) ?
1783 		", fast-frames" : "",
1784 	    IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_TURBOP) ?
1785 		", turbo" : ""
1786 	);
1787 
1788 	/* give driver a chance to setup state like ni_txrate */
1789 	if (ic->ic_newassoc != NULL)
1790 		ic->ic_newassoc(ni, newassoc);
1791 	IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_SUCCESS);
1792 	/* tell the authenticator about new station */
1793 	if (ic->ic_auth->ia_node_join != NULL)
1794 		ic->ic_auth->ia_node_join(ic, ni);
1795 	ieee80211_notify_node_join(ic, ni,
1796 	    resp == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
1797 }
1798 
1799 static void
1800 disable_protection(struct ieee80211com *ic)
1801 {
1802 	KASSERT(ic->ic_nonerpsta == 0 &&
1803 	    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0,
1804 	   ("%d non ERP stations, flags 0x%x", ic->ic_nonerpsta,
1805 	   ic->ic_flags_ext));
1806 
1807 	ic->ic_flags &= ~IEEE80211_F_USEPROT;
1808 	/* XXX verify mode? */
1809 	if (ic->ic_caps & IEEE80211_C_SHPREAMBLE) {
1810 		ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1811 		ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1812 	}
1813 	ieee80211_notify_erp(ic);
1814 }
1815 
1816 /*
1817  * Handle a station leaving an 11g network.
1818  */
1819 static void
1820 ieee80211_node_leave_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
1821 {
1822 
1823 	IEEE80211_LOCK_ASSERT(ic);
1824 
1825 	KASSERT(IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan),
1826 	     ("not in 11g, bss %u:0x%x, curmode %u", ic->ic_bsschan->ic_freq,
1827 	      ic->ic_bsschan->ic_flags, ic->ic_curmode));
1828 
1829 	/*
1830 	 * If a long slot station do the slot time bookkeeping.
1831 	 */
1832 	if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
1833 		KASSERT(ic->ic_longslotsta > 0,
1834 		    ("bogus long slot station count %d", ic->ic_longslotsta));
1835 		ic->ic_longslotsta--;
1836 		IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1837 		    "long slot time station leaves, count now %d",
1838 		    ic->ic_longslotsta);
1839 		if (ic->ic_longslotsta == 0) {
1840 			/*
1841 			 * Re-enable use of short slot time if supported
1842 			 * and not operating in IBSS mode (per spec).
1843 			 */
1844 			if ((ic->ic_caps & IEEE80211_C_SHSLOT) &&
1845 			    ic->ic_opmode != IEEE80211_M_IBSS) {
1846 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1847 				    "%s: re-enable use of short slot time\n",
1848 				    __func__);
1849 				ieee80211_set_shortslottime(ic, 1);
1850 			}
1851 		}
1852 	}
1853 	/*
1854 	 * If a non-ERP station do the protection-related bookkeeping.
1855 	 */
1856 	if ((ni->ni_flags & IEEE80211_NODE_ERP) == 0) {
1857 		KASSERT(ic->ic_nonerpsta > 0,
1858 		    ("bogus non-ERP station count %d", ic->ic_nonerpsta));
1859 		ic->ic_nonerpsta--;
1860 		IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1861 		    "non-ERP station leaves, count now %d%s", ic->ic_nonerpsta,
1862 		    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) ?
1863 			" (non-ERP sta present)" : "");
1864 		if (ic->ic_nonerpsta == 0 &&
1865 		    (ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0) {
1866 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1867 				"%s: disable use of protection\n", __func__);
1868 			disable_protection(ic);
1869 		}
1870 	}
1871 }
1872 
1873 /*
1874  * Time out presence of an overlapping bss with non-ERP
1875  * stations.  When operating in hostap mode we listen for
1876  * beacons from other stations and if we identify a non-ERP
1877  * station is present we enable protection.  To identify
1878  * when all non-ERP stations are gone we time out this
1879  * condition.
1880  */
1881 static void
1882 ieee80211_erp_timeout(struct ieee80211com *ic)
1883 {
1884 
1885 	IEEE80211_LOCK_ASSERT(ic);
1886 
1887 	if ((ic->ic_flags_ext & IEEE80211_FEXT_NONERP_PR) &&
1888 	    time_after(ticks, ic->ic_lastnonerp + IEEE80211_NONERP_PRESENT_AGE)) {
1889 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1890 		    "%s\n", "age out non-ERP sta present on channel");
1891 		ic->ic_flags_ext &= ~IEEE80211_FEXT_NONERP_PR;
1892 		if (ic->ic_nonerpsta == 0)
1893 			disable_protection(ic);
1894 	}
1895 }
1896 
1897 /*
1898  * Handle bookkeeping for station deauthentication/disassociation
1899  * when operating as an ap.
1900  */
1901 void
1902 ieee80211_node_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
1903 {
1904 	struct ieee80211_node_table *nt = ni->ni_table;
1905 
1906 	IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, ni,
1907 	    "station with aid %d leaves", IEEE80211_NODE_AID(ni));
1908 
1909 	KASSERT(ic->ic_opmode != IEEE80211_M_STA,
1910 		("unexpected operating mode %u", ic->ic_opmode));
1911 	/*
1912 	 * If node wasn't previously associated all
1913 	 * we need to do is reclaim the reference.
1914 	 */
1915 	/* XXX ibss mode bypasses 11g and notification */
1916 	if (ni->ni_associd == 0)
1917 		goto done;
1918 	/*
1919 	 * Tell the authenticator the station is leaving.
1920 	 * Note that we must do this before yanking the
1921 	 * association id as the authenticator uses the
1922 	 * associd to locate it's state block.
1923 	 */
1924 	if (ic->ic_auth->ia_node_leave != NULL)
1925 		ic->ic_auth->ia_node_leave(ic, ni);
1926 
1927 	IEEE80211_LOCK(ic);
1928 	IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
1929 	ni->ni_associd = 0;
1930 	ic->ic_sta_assoc--;
1931 
1932 	if (IEEE80211_IS_CHAN_HT(ic->ic_bsschan))
1933 		ieee80211_ht_node_leave(ni);
1934 	if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
1935 	    IEEE80211_IS_CHAN_FULL(ic->ic_bsschan))
1936 		ieee80211_node_leave_11g(ic, ni);
1937 	IEEE80211_UNLOCK(ic);
1938 	/*
1939 	 * Cleanup station state.  In particular clear various
1940 	 * state that might otherwise be reused if the node
1941 	 * is reused before the reference count goes to zero
1942 	 * (and memory is reclaimed).
1943 	 */
1944 	ieee80211_sta_leave(ic, ni);
1945 done:
1946 	/*
1947 	 * Remove the node from any table it's recorded in and
1948 	 * drop the caller's reference.  Removal from the table
1949 	 * is important to insure the node is not reprocessed
1950 	 * for inactivity.
1951 	 */
1952 	if (nt != NULL) {
1953 		IEEE80211_NODE_LOCK(nt);
1954 		node_reclaim(nt, ni);
1955 		IEEE80211_NODE_UNLOCK(nt);
1956 	} else
1957 		ieee80211_free_node(ni);
1958 }
1959 
1960 int8_t
1961 ieee80211_getrssi(struct ieee80211com *ic)
1962 {
1963 #define	NZ(x)	((x) == 0 ? 1 : (x))
1964 	struct ieee80211_node_table *nt = &ic->ic_sta;
1965 	int rssi_samples;
1966 	int32_t rssi_total;
1967 	struct ieee80211_node *ni;
1968 
1969 	rssi_total = 0;
1970 	rssi_samples = 0;
1971 	switch (ic->ic_opmode) {
1972 	case IEEE80211_M_IBSS:		/* average of all ibss neighbors */
1973 	case IEEE80211_M_AHDEMO:	/* average of all neighbors */
1974 	case IEEE80211_M_HOSTAP:	/* average of all associated stations */
1975 		/* XXX locking */
1976 		TAILQ_FOREACH(ni, &nt->nt_node, ni_list)
1977 			if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
1978 			    (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS)) {
1979 				int8_t rssi = ic->ic_node_getrssi(ni);
1980 				if (rssi != 0) {
1981 					rssi_samples++;
1982 					rssi_total += rssi;
1983 				}
1984 			}
1985 		break;
1986 	case IEEE80211_M_MONITOR:	/* XXX */
1987 	case IEEE80211_M_STA:		/* use stats from associated ap */
1988 	default:
1989 		if (ic->ic_bss != NULL)
1990 			rssi_total = ic->ic_node_getrssi(ic->ic_bss);
1991 		rssi_samples = 1;
1992 		break;
1993 	}
1994 	return rssi_total / NZ(rssi_samples);
1995 #undef NZ
1996 }
1997 
1998 void
1999 ieee80211_getsignal(struct ieee80211com *ic, int8_t *rssi, int8_t *noise)
2000 {
2001 
2002 	if (ic->ic_bss == NULL)		/* NB: shouldn't happen */
2003 		return;
2004 	ic->ic_node_getsignal(ic->ic_bss, rssi, noise);
2005 	/* for non-station mode return avg'd rssi accounting */
2006 	if (ic->ic_opmode != IEEE80211_M_STA)
2007 		*rssi = ieee80211_getrssi(ic);
2008 }
2009 
2010 /*
2011  * Node table support.
2012  */
2013 
2014 static void
2015 ieee80211_node_table_init(struct ieee80211com *ic,
2016 	struct ieee80211_node_table *nt,
2017 	const char *name, int inact, int keyixmax)
2018 {
2019 
2020 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
2021 		"%s %s table, inact %u\n", __func__, name, inact);
2022 
2023 	nt->nt_ic = ic;
2024 	/* XXX need unit */
2025 	IEEE80211_NODE_LOCK_INIT(nt, ic->ic_ifp->if_xname);
2026 	IEEE80211_SCAN_LOCK_INIT(nt, ic->ic_ifp->if_xname);
2027 	TAILQ_INIT(&nt->nt_node);
2028 	nt->nt_name = name;
2029 	nt->nt_scangen = 1;
2030 	nt->nt_inact_init = inact;
2031 	nt->nt_keyixmax = keyixmax;
2032 	if (nt->nt_keyixmax > 0) {
2033 		MALLOC(nt->nt_keyixmap, struct ieee80211_node **,
2034 			keyixmax * sizeof(struct ieee80211_node *),
2035 			M_80211_NODE, M_NOWAIT | M_ZERO);
2036 		if (nt->nt_keyixmap == NULL)
2037 			if_printf(ic->ic_ifp,
2038 			    "Cannot allocate key index map with %u entries\n",
2039 			    keyixmax);
2040 	} else
2041 		nt->nt_keyixmap = NULL;
2042 }
2043 
2044 static void
2045 ieee80211_node_table_reset(struct ieee80211_node_table *nt)
2046 {
2047 
2048 	IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
2049 		"%s %s table\n", __func__, nt->nt_name);
2050 
2051 	IEEE80211_NODE_LOCK(nt);
2052 	ieee80211_free_allnodes_locked(nt);
2053 	IEEE80211_NODE_UNLOCK(nt);
2054 }
2055 
2056 static void
2057 ieee80211_node_table_cleanup(struct ieee80211_node_table *nt)
2058 {
2059 
2060 	IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
2061 		"%s %s table\n", __func__, nt->nt_name);
2062 
2063 	IEEE80211_NODE_LOCK(nt);
2064 	ieee80211_free_allnodes_locked(nt);
2065 	if (nt->nt_keyixmap != NULL) {
2066 		/* XXX verify all entries are NULL */
2067 		int i;
2068 		for (i = 0; i < nt->nt_keyixmax; i++)
2069 			if (nt->nt_keyixmap[i] != NULL)
2070 				printf("%s: %s[%u] still active\n", __func__,
2071 					nt->nt_name, i);
2072 		FREE(nt->nt_keyixmap, M_80211_NODE);
2073 		nt->nt_keyixmap = NULL;
2074 	}
2075 	IEEE80211_SCAN_LOCK_DESTROY(nt);
2076 	IEEE80211_NODE_LOCK_DESTROY(nt);
2077 }
2078