1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Atsushi Onoe 5 * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 #include "opt_wlan.h" 31 32 #include <sys/param.h> 33 #include <sys/systm.h> 34 #include <sys/mbuf.h> 35 #include <sys/malloc.h> 36 #include <sys/kernel.h> 37 38 #include <sys/socket.h> 39 40 #include <net/if.h> 41 #include <net/if_var.h> 42 #include <net/if_media.h> 43 #include <net/ethernet.h> 44 45 #include <net80211/ieee80211_var.h> 46 #include <net80211/ieee80211_input.h> 47 #ifdef IEEE80211_SUPPORT_SUPERG 48 #include <net80211/ieee80211_superg.h> 49 #endif 50 #ifdef IEEE80211_SUPPORT_TDMA 51 #include <net80211/ieee80211_tdma.h> 52 #endif 53 #include <net80211/ieee80211_wds.h> 54 #include <net80211/ieee80211_mesh.h> 55 #include <net80211/ieee80211_ratectl.h> 56 #include <net80211/ieee80211_vht.h> 57 58 #include <net/bpf.h> 59 60 #ifdef IEEE80211_DEBUG_REFCNT 61 #define __debrefcnt_used 62 #else 63 #define __debrefcnt_used __unused 64 #endif 65 66 /* 67 * IEEE80211_NODE_HASHSIZE must be a power of 2. 68 */ 69 CTASSERT((IEEE80211_NODE_HASHSIZE & (IEEE80211_NODE_HASHSIZE-1)) == 0); 70 71 /* 72 * Association id's are managed with a bit vector. 73 */ 74 #define IEEE80211_AID_SET(_vap, b) \ 75 ((_vap)->iv_aid_bitmap[IEEE80211_AID(b) / 32] |= \ 76 (1 << (IEEE80211_AID(b) % 32))) 77 #define IEEE80211_AID_CLR(_vap, b) \ 78 ((_vap)->iv_aid_bitmap[IEEE80211_AID(b) / 32] &= \ 79 ~(1 << (IEEE80211_AID(b) % 32))) 80 #define IEEE80211_AID_ISSET(_vap, b) \ 81 ((_vap)->iv_aid_bitmap[IEEE80211_AID(b) / 32] & (1 << (IEEE80211_AID(b) % 32))) 82 83 static int ieee80211_sta_join1(struct ieee80211_node *); 84 85 static struct ieee80211_node *node_alloc(struct ieee80211vap *, 86 const uint8_t [IEEE80211_ADDR_LEN]); 87 static int node_init(struct ieee80211_node *); 88 static void node_cleanup(struct ieee80211_node *); 89 static void node_free(struct ieee80211_node *); 90 static void node_age(struct ieee80211_node *); 91 static int8_t node_getrssi(const struct ieee80211_node *); 92 static void node_getsignal(const struct ieee80211_node *, int8_t *, int8_t *); 93 static void node_getmimoinfo(const struct ieee80211_node *, 94 struct ieee80211_mimo_info *); 95 96 static void __ieee80211_free_node(struct ieee80211_node *); 97 98 static void node_reclaim(struct ieee80211_node_table *nt, 99 struct ieee80211_node *ni); 100 static void ieee80211_node_table_init(struct ieee80211com *ic, 101 struct ieee80211_node_table *nt, const char *name, 102 int inact, int keymaxix); 103 static void ieee80211_node_table_reset(struct ieee80211_node_table *, 104 struct ieee80211vap *); 105 static void ieee80211_node_table_cleanup(struct ieee80211_node_table *nt); 106 static void ieee80211_vap_erp_timeout(struct ieee80211vap *); 107 108 MALLOC_DEFINE(M_80211_NODE, "80211node", "802.11 node state"); 109 MALLOC_DEFINE(M_80211_NODE_IE, "80211nodeie", "802.11 node ie"); 110 111 void 112 ieee80211_node_attach(struct ieee80211com *ic) 113 { 114 /* XXX really want maxlen enforced per-sta */ 115 ieee80211_ageq_init(&ic->ic_stageq, ic->ic_max_keyix * 8, 116 "802.11 staging q"); 117 ieee80211_node_table_init(ic, &ic->ic_sta, "station", 118 IEEE80211_INACT_INIT, ic->ic_max_keyix); 119 callout_init(&ic->ic_inact, 1); 120 callout_reset(&ic->ic_inact, IEEE80211_INACT_WAIT*hz, 121 ieee80211_node_timeout, ic); 122 123 ic->ic_node_alloc = node_alloc; 124 ic->ic_node_init = node_init; 125 ic->ic_node_free = node_free; 126 ic->ic_node_cleanup = node_cleanup; 127 ic->ic_node_age = node_age; 128 ic->ic_node_drain = node_age; /* NB: same as age */ 129 ic->ic_node_getrssi = node_getrssi; 130 ic->ic_node_getsignal = node_getsignal; 131 ic->ic_node_getmimoinfo = node_getmimoinfo; 132 133 /* 134 * Set flags to be propagated to all vap's; 135 * these define default behaviour/configuration. 136 */ 137 ic->ic_flags_ext |= IEEE80211_FEXT_INACT; /* inactivity processing */ 138 } 139 140 void 141 ieee80211_node_detach(struct ieee80211com *ic) 142 { 143 144 callout_drain(&ic->ic_inact); 145 ieee80211_node_table_cleanup(&ic->ic_sta); 146 ieee80211_ageq_drain(&ic->ic_stageq); 147 ieee80211_ageq_cleanup(&ic->ic_stageq); 148 } 149 150 void 151 ieee80211_node_vattach(struct ieee80211vap *vap) 152 { 153 /* NB: driver can override */ 154 vap->iv_max_aid = IEEE80211_AID_DEF; 155 156 /* default station inactivity timer settings */ 157 vap->iv_inact_init = IEEE80211_INACT_INIT; 158 vap->iv_inact_auth = IEEE80211_INACT_AUTH; 159 vap->iv_inact_run = IEEE80211_INACT_RUN; 160 vap->iv_inact_probe = IEEE80211_INACT_PROBE; 161 162 IEEE80211_DPRINTF(vap, IEEE80211_MSG_INACT, 163 "%s: init %u auth %u run %u probe %u\n", __func__, 164 vap->iv_inact_init, vap->iv_inact_auth, 165 vap->iv_inact_run, vap->iv_inact_probe); 166 } 167 168 void 169 ieee80211_node_latevattach(struct ieee80211vap *vap) 170 { 171 if (vap->iv_opmode == IEEE80211_M_HOSTAP) { 172 /* XXX should we allow max aid to be zero? */ 173 if (vap->iv_max_aid < IEEE80211_AID_MIN) { 174 vap->iv_max_aid = IEEE80211_AID_MIN; 175 if_printf(vap->iv_ifp, 176 "WARNING: max aid too small, changed to %d\n", 177 vap->iv_max_aid); 178 } 179 vap->iv_aid_bitmap = (uint32_t *) IEEE80211_MALLOC( 180 howmany(vap->iv_max_aid, 32) * sizeof(uint32_t), 181 M_80211_NODE, 182 IEEE80211_M_NOWAIT | IEEE80211_M_ZERO); 183 if (vap->iv_aid_bitmap == NULL) { 184 /* XXX no way to recover */ 185 printf("%s: no memory for AID bitmap, max aid %d!\n", 186 __func__, vap->iv_max_aid); 187 vap->iv_max_aid = 0; 188 } 189 } 190 191 ieee80211_reset_bss(vap); 192 193 vap->iv_auth = ieee80211_authenticator_get(vap->iv_bss->ni_authmode); 194 } 195 196 void 197 ieee80211_node_vdetach(struct ieee80211vap *vap) 198 { 199 struct ieee80211com *ic = vap->iv_ic; 200 201 ieee80211_node_table_reset(&ic->ic_sta, vap); 202 if (vap->iv_bss != NULL) { 203 ieee80211_free_node(vap->iv_bss); 204 vap->iv_update_bss(vap, NULL); 205 } 206 if (vap->iv_aid_bitmap != NULL) { 207 IEEE80211_FREE(vap->iv_aid_bitmap, M_80211_NODE); 208 vap->iv_aid_bitmap = NULL; 209 } 210 } 211 212 /* 213 * Port authorize/unauthorize interfaces for use by an authenticator. 214 */ 215 216 void 217 ieee80211_node_authorize(struct ieee80211_node *ni) 218 { 219 struct ieee80211vap *vap = ni->ni_vap; 220 221 ni->ni_flags |= IEEE80211_NODE_AUTH; 222 ni->ni_inact_reload = vap->iv_inact_run; 223 ni->ni_inact = ni->ni_inact_reload; 224 225 IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni, 226 "%s: inact_reload %u", __func__, ni->ni_inact_reload); 227 } 228 229 void 230 ieee80211_node_unauthorize(struct ieee80211_node *ni) 231 { 232 struct ieee80211vap *vap = ni->ni_vap; 233 234 ni->ni_flags &= ~IEEE80211_NODE_AUTH; 235 ni->ni_inact_reload = vap->iv_inact_auth; 236 if (ni->ni_inact > ni->ni_inact_reload) 237 ni->ni_inact = ni->ni_inact_reload; 238 239 IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni, 240 "%s: inact_reload %u inact %u", __func__, 241 ni->ni_inact_reload, ni->ni_inact); 242 } 243 244 /* 245 * Fix tx parameters for a node according to ``association state''. 246 */ 247 void 248 ieee80211_node_setuptxparms(struct ieee80211_node *ni) 249 { 250 struct ieee80211vap *vap = ni->ni_vap; 251 enum ieee80211_phymode mode; 252 253 if (ni->ni_flags & IEEE80211_NODE_VHT) { 254 if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan)) 255 mode = IEEE80211_MODE_VHT_5GHZ; 256 else 257 mode = IEEE80211_MODE_VHT_2GHZ; 258 } else if (ni->ni_flags & IEEE80211_NODE_HT) { 259 if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan)) 260 mode = IEEE80211_MODE_11NA; 261 else 262 mode = IEEE80211_MODE_11NG; 263 } else { /* legacy rate handling */ 264 if (IEEE80211_IS_CHAN_ST(ni->ni_chan)) 265 mode = IEEE80211_MODE_STURBO_A; 266 else if (IEEE80211_IS_CHAN_HALF(ni->ni_chan)) 267 mode = IEEE80211_MODE_HALF; 268 else if (IEEE80211_IS_CHAN_QUARTER(ni->ni_chan)) 269 mode = IEEE80211_MODE_QUARTER; 270 /* NB: 108A should be handled as 11a */ 271 else if (IEEE80211_IS_CHAN_A(ni->ni_chan)) 272 mode = IEEE80211_MODE_11A; 273 else if (IEEE80211_IS_CHAN_108G(ni->ni_chan) || 274 (ni->ni_flags & IEEE80211_NODE_ERP)) 275 mode = IEEE80211_MODE_11G; 276 else 277 mode = IEEE80211_MODE_11B; 278 } 279 ni->ni_txparms = &vap->iv_txparms[mode]; 280 } 281 282 /* 283 * Set/change the channel. The rate set is also updated as 284 * to insure a consistent view by drivers. 285 * XXX should be private but hostap needs it to deal with CSA 286 */ 287 void 288 ieee80211_node_set_chan(struct ieee80211_node *ni, 289 struct ieee80211_channel *chan) 290 { 291 struct ieee80211com *ic = ni->ni_ic; 292 struct ieee80211vap *vap = ni->ni_vap; 293 enum ieee80211_phymode mode; 294 295 KASSERT(chan != IEEE80211_CHAN_ANYC, ("no channel")); 296 297 ni->ni_chan = chan; 298 mode = ieee80211_chan2mode(chan); 299 if (IEEE80211_IS_CHAN_HT(chan)) { 300 /* 301 * We must install the legacy rate est in ni_rates and the 302 * HT rate set in ni_htrates. 303 */ 304 ni->ni_htrates = *ieee80211_get_suphtrates(ic, chan); 305 /* 306 * Setup bss tx parameters based on operating mode. We 307 * use legacy rates when operating in a mixed HT+non-HT bss 308 * and non-ERP rates in 11g for mixed ERP+non-ERP bss. 309 */ 310 if (mode == IEEE80211_MODE_11NA && 311 (vap->iv_flags_ht & IEEE80211_FHT_PUREN) == 0) 312 mode = IEEE80211_MODE_11A; 313 else if (mode == IEEE80211_MODE_11NG && 314 (vap->iv_flags_ht & IEEE80211_FHT_PUREN) == 0) 315 mode = IEEE80211_MODE_11G; 316 if (mode == IEEE80211_MODE_11G && 317 (vap->iv_flags & IEEE80211_F_PUREG) == 0) 318 mode = IEEE80211_MODE_11B; 319 } 320 ni->ni_txparms = &vap->iv_txparms[mode]; 321 ni->ni_rates = *ieee80211_get_suprates(ic, chan); 322 } 323 324 static __inline void 325 copy_bss(struct ieee80211_node *nbss, const struct ieee80211_node *obss) 326 { 327 /* propagate useful state */ 328 nbss->ni_authmode = obss->ni_authmode; 329 nbss->ni_txpower = obss->ni_txpower; 330 nbss->ni_vlan = obss->ni_vlan; 331 /* XXX statistics? */ 332 /* XXX legacy WDS bssid? */ 333 } 334 335 void 336 ieee80211_create_ibss(struct ieee80211vap* vap, struct ieee80211_channel *chan) 337 { 338 struct ieee80211com *ic = vap->iv_ic; 339 struct ieee80211_node *ni; 340 341 IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN, 342 "%s: creating %s on channel %u%c flags 0x%08x\n", __func__, 343 ieee80211_opmode_name[vap->iv_opmode], 344 ieee80211_chan2ieee(ic, chan), 345 ieee80211_channel_type_char(chan), 346 chan->ic_flags); 347 348 ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr); 349 if (ni == NULL) { 350 /* XXX recovery? */ 351 return; 352 } 353 IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_myaddr); 354 ni->ni_esslen = vap->iv_des_ssid[0].len; 355 memcpy(ni->ni_essid, vap->iv_des_ssid[0].ssid, ni->ni_esslen); 356 if (vap->iv_bss != NULL) 357 copy_bss(ni, vap->iv_bss); 358 ni->ni_intval = ic->ic_bintval; 359 if (vap->iv_flags & IEEE80211_F_PRIVACY) 360 ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY; 361 if (ic->ic_phytype == IEEE80211_T_FH) { 362 ni->ni_fhdwell = 200; /* XXX */ 363 ni->ni_fhindex = 1; 364 } 365 if (vap->iv_opmode == IEEE80211_M_IBSS) { 366 ni->ni_capinfo |= IEEE80211_CAPINFO_IBSS; /* XXX */ 367 if (vap->iv_flags & IEEE80211_F_DESBSSID) 368 IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_des_bssid); 369 else { 370 net80211_get_random_bytes(ni->ni_bssid, 371 IEEE80211_ADDR_LEN); 372 /* clear group bit, add local bit */ 373 ni->ni_bssid[0] = (ni->ni_bssid[0] &~ 0x01) | 0x02; 374 } 375 } else if (vap->iv_opmode == IEEE80211_M_AHDEMO) { 376 if (vap->iv_flags & IEEE80211_F_DESBSSID) 377 IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_des_bssid); 378 else 379 #ifdef IEEE80211_SUPPORT_TDMA 380 if ((vap->iv_caps & IEEE80211_C_TDMA) == 0) 381 #endif 382 memset(ni->ni_bssid, 0, IEEE80211_ADDR_LEN); 383 #ifdef IEEE80211_SUPPORT_MESH 384 } else if (vap->iv_opmode == IEEE80211_M_MBSS) { 385 ni->ni_meshidlen = vap->iv_mesh->ms_idlen; 386 memcpy(ni->ni_meshid, vap->iv_mesh->ms_id, ni->ni_meshidlen); 387 #endif 388 } 389 /* 390 * Fix the channel and related attributes. 391 */ 392 /* clear DFS CAC state on previous channel */ 393 if (ic->ic_bsschan != IEEE80211_CHAN_ANYC && 394 ic->ic_bsschan->ic_freq != chan->ic_freq && 395 IEEE80211_IS_CHAN_CACDONE(ic->ic_bsschan)) 396 ieee80211_dfs_cac_clear(ic, ic->ic_bsschan); 397 ic->ic_bsschan = chan; 398 ieee80211_node_set_chan(ni, chan); 399 ic->ic_curmode = ieee80211_chan2mode(chan); 400 /* 401 * Do mode-specific setup. 402 */ 403 if (IEEE80211_IS_CHAN_FULL(chan)) { 404 if (IEEE80211_IS_CHAN_ANYG(chan)) { 405 /* 406 * Use a mixed 11b/11g basic rate set. 407 */ 408 ieee80211_setbasicrates(&ni->ni_rates, 409 IEEE80211_MODE_11G); 410 if (vap->iv_flags & IEEE80211_F_PUREG) { 411 /* 412 * Also mark OFDM rates basic so 11b 413 * stations do not join (WiFi compliance). 414 */ 415 ieee80211_addbasicrates(&ni->ni_rates, 416 IEEE80211_MODE_11A); 417 } 418 } else if (IEEE80211_IS_CHAN_B(chan)) { 419 /* 420 * Force pure 11b rate set. 421 */ 422 ieee80211_setbasicrates(&ni->ni_rates, 423 IEEE80211_MODE_11B); 424 } 425 } 426 427 /* XXX TODO: other bits and pieces - eg fast-frames? */ 428 429 /* If we're an 11n channel then initialise the 11n bits */ 430 if (IEEE80211_IS_CHAN_VHT(ni->ni_chan)) { 431 /* XXX what else? */ 432 ieee80211_ht_node_init(ni); 433 ieee80211_vht_node_init(ni); 434 } else if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) { 435 /* XXX what else? */ 436 ieee80211_ht_node_init(ni); 437 } 438 439 (void) ieee80211_sta_join1(ieee80211_ref_node(ni)); 440 } 441 442 /* 443 * Reset bss state on transition to the INIT state. 444 * Clear any stations from the table (they have been 445 * deauth'd) and reset the bss node (clears key, rate 446 * etc. state). 447 */ 448 void 449 ieee80211_reset_bss(struct ieee80211vap *vap) 450 { 451 struct ieee80211com *ic = vap->iv_ic; 452 struct ieee80211_node *ni, *obss; 453 454 ieee80211_node_table_reset(&ic->ic_sta, vap); 455 /* XXX multi-bss: wrong */ 456 ieee80211_vap_reset_erp(vap); 457 458 ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr); 459 KASSERT(ni != NULL, ("unable to setup initial BSS node")); 460 obss = vap->iv_update_bss(vap, ieee80211_ref_node(ni)); 461 if (obss != NULL) { 462 copy_bss(ni, obss); 463 ni->ni_intval = ic->ic_bintval; 464 ieee80211_free_node(obss); 465 } else 466 IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_myaddr); 467 } 468 469 static int 470 match_ssid(const struct ieee80211_node *ni, 471 int nssid, const struct ieee80211_scan_ssid ssids[]) 472 { 473 int i; 474 475 for (i = 0; i < nssid; i++) { 476 if (ni->ni_esslen == ssids[i].len && 477 memcmp(ni->ni_essid, ssids[i].ssid, ni->ni_esslen) == 0) 478 return 1; 479 } 480 return 0; 481 } 482 483 /* 484 * Test a node for suitability/compatibility. 485 */ 486 static int 487 check_bss(struct ieee80211vap *vap, struct ieee80211_node *ni) 488 { 489 struct ieee80211com *ic = ni->ni_ic; 490 uint8_t rate; 491 492 if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan))) 493 return 0; 494 if (vap->iv_opmode == IEEE80211_M_IBSS) { 495 if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0) 496 return 0; 497 } else { 498 if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0) 499 return 0; 500 } 501 if (vap->iv_flags & IEEE80211_F_PRIVACY) { 502 if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0) 503 return 0; 504 } else { 505 /* XXX does this mean privacy is supported or required? */ 506 if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) 507 return 0; 508 } 509 rate = ieee80211_fix_rate(ni, &ni->ni_rates, 510 IEEE80211_F_JOIN | IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE); 511 if (rate & IEEE80211_RATE_BASIC) 512 return 0; 513 if (vap->iv_des_nssid != 0 && 514 !match_ssid(ni, vap->iv_des_nssid, vap->iv_des_ssid)) 515 return 0; 516 if ((vap->iv_flags & IEEE80211_F_DESBSSID) && 517 !IEEE80211_ADDR_EQ(vap->iv_des_bssid, ni->ni_bssid)) 518 return 0; 519 return 1; 520 } 521 522 #ifdef IEEE80211_DEBUG 523 /* 524 * Display node suitability/compatibility. 525 */ 526 static void 527 check_bss_debug(struct ieee80211vap *vap, struct ieee80211_node *ni) 528 { 529 struct ieee80211com *ic = ni->ni_ic; 530 uint8_t rate; 531 int fail; 532 533 fail = 0; 534 if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan))) 535 fail |= 0x01; 536 if (vap->iv_opmode == IEEE80211_M_IBSS) { 537 if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0) 538 fail |= 0x02; 539 } else { 540 if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0) 541 fail |= 0x02; 542 } 543 if (vap->iv_flags & IEEE80211_F_PRIVACY) { 544 if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0) 545 fail |= 0x04; 546 } else { 547 /* XXX does this mean privacy is supported or required? */ 548 if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) 549 fail |= 0x04; 550 } 551 rate = ieee80211_fix_rate(ni, &ni->ni_rates, 552 IEEE80211_F_JOIN | IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE); 553 if (rate & IEEE80211_RATE_BASIC) 554 fail |= 0x08; 555 if (vap->iv_des_nssid != 0 && 556 !match_ssid(ni, vap->iv_des_nssid, vap->iv_des_ssid)) 557 fail |= 0x10; 558 if ((vap->iv_flags & IEEE80211_F_DESBSSID) && 559 !IEEE80211_ADDR_EQ(vap->iv_des_bssid, ni->ni_bssid)) 560 fail |= 0x20; 561 562 printf(" %c %s", fail ? '-' : '+', ether_sprintf(ni->ni_macaddr)); 563 printf(" %s%c", ether_sprintf(ni->ni_bssid), fail & 0x20 ? '!' : ' '); 564 printf(" %3d%c", 565 ieee80211_chan2ieee(ic, ni->ni_chan), fail & 0x01 ? '!' : ' '); 566 printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2, 567 fail & 0x08 ? '!' : ' '); 568 printf(" %4s%c", 569 (ni->ni_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" : 570 (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" : 571 "????", 572 fail & 0x02 ? '!' : ' '); 573 printf(" %3s%c ", 574 (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) ? "wep" : "no", 575 fail & 0x04 ? '!' : ' '); 576 ieee80211_print_essid(ni->ni_essid, ni->ni_esslen); 577 printf("%s\n", fail & 0x10 ? "!" : ""); 578 } 579 #endif /* IEEE80211_DEBUG */ 580 581 int 582 ieee80211_ibss_merge_check(struct ieee80211_node *ni) 583 { 584 struct ieee80211vap *vap = ni->ni_vap; 585 586 if (ni == vap->iv_bss || 587 IEEE80211_ADDR_EQ(ni->ni_bssid, vap->iv_bss->ni_bssid)) { 588 /* unchanged, nothing to do */ 589 return 0; 590 } 591 592 if (!check_bss(vap, ni)) { 593 /* capabilities mismatch */ 594 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC, 595 "%s: merge failed, capabilities mismatch\n", __func__); 596 #ifdef IEEE80211_DEBUG 597 if (ieee80211_msg_assoc(vap)) 598 check_bss_debug(vap, ni); 599 #endif 600 vap->iv_stats.is_ibss_capmismatch++; 601 return 0; 602 } 603 604 return 1; 605 } 606 607 /* 608 * Check if the given node should populate the node table. 609 * 610 * We need to be in "see all beacons for all ssids" mode in order 611 * to do IBSS merges, however this means we will populate nodes for 612 * /all/ IBSS SSIDs, versus just the one we care about. 613 * 614 * So this check ensures the node can actually belong to our IBSS 615 * configuration. For now it simply checks the SSID. 616 */ 617 int 618 ieee80211_ibss_node_check_new(struct ieee80211_node *ni, 619 const struct ieee80211_scanparams *scan) 620 { 621 struct ieee80211vap *vap = ni->ni_vap; 622 int i; 623 624 /* 625 * If we have no SSID and no scan SSID, return OK. 626 */ 627 if (vap->iv_des_nssid == 0 && scan->ssid == NULL) 628 goto ok; 629 630 /* 631 * If we have one of (SSID, scan SSID) then return error. 632 */ 633 if (!! (vap->iv_des_nssid == 0) != !! (scan->ssid == NULL)) 634 goto mismatch; 635 636 /* 637 * Double-check - we need scan SSID. 638 */ 639 if (scan->ssid == NULL) 640 goto mismatch; 641 642 /* 643 * Check if the scan SSID matches the SSID list for the VAP. 644 */ 645 for (i = 0; i < vap->iv_des_nssid; i++) { 646 /* Sanity length check */ 647 if (vap->iv_des_ssid[i].len != scan->ssid[1]) 648 continue; 649 650 /* Note: SSID in the scan entry is the IE format */ 651 if (memcmp(vap->iv_des_ssid[i].ssid, scan->ssid + 2, 652 vap->iv_des_ssid[i].len) == 0) 653 goto ok; 654 } 655 656 mismatch: 657 return (0); 658 ok: 659 return (1); 660 } 661 662 /* 663 * Handle 802.11 ad hoc network merge. The 664 * convention, set by the Wireless Ethernet Compatibility Alliance 665 * (WECA), is that an 802.11 station will change its BSSID to match 666 * the "oldest" 802.11 ad hoc network, on the same channel, that 667 * has the station's desired SSID. The "oldest" 802.11 network 668 * sends beacons with the greatest TSF timestamp. 669 * 670 * The caller is assumed to validate TSF's before attempting a merge. 671 * 672 * Return !0 if the BSSID changed, 0 otherwise. 673 */ 674 int 675 ieee80211_ibss_merge(struct ieee80211_node *ni) 676 { 677 #ifdef IEEE80211_DEBUG 678 struct ieee80211vap *vap = ni->ni_vap; 679 #endif 680 681 if (! ieee80211_ibss_merge_check(ni)) 682 return 0; 683 684 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC, 685 "%s: new bssid %s: %s preamble, %s slot time%s\n", __func__, 686 ether_sprintf(ni->ni_bssid), 687 vap->iv_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long", 688 vap->iv_flags&IEEE80211_F_SHSLOT ? "short" : "long", 689 vap->iv_flags&IEEE80211_F_USEPROT ? ", protection" : "" 690 ); 691 return ieee80211_sta_join1(ieee80211_ref_node(ni)); 692 } 693 694 /* 695 * Calculate HT channel promotion flags for all vaps. 696 * This assumes ni_chan have been setup for each vap. 697 */ 698 static int 699 gethtadjustflags(struct ieee80211com *ic) 700 { 701 struct ieee80211vap *vap; 702 int flags; 703 704 flags = 0; 705 /* XXX locking */ 706 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) { 707 if (vap->iv_state < IEEE80211_S_RUN) 708 continue; 709 switch (vap->iv_opmode) { 710 case IEEE80211_M_WDS: 711 case IEEE80211_M_STA: 712 case IEEE80211_M_AHDEMO: 713 case IEEE80211_M_HOSTAP: 714 case IEEE80211_M_IBSS: 715 case IEEE80211_M_MBSS: 716 flags |= ieee80211_htchanflags(vap->iv_bss->ni_chan); 717 break; 718 default: 719 break; 720 } 721 } 722 return flags; 723 } 724 725 /* 726 * Calculate VHT channel promotion flags for all vaps. 727 * This assumes ni_chan have been setup for each vap. 728 */ 729 static int 730 getvhtadjustflags(struct ieee80211com *ic) 731 { 732 struct ieee80211vap *vap; 733 int flags; 734 735 flags = 0; 736 /* XXX locking */ 737 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) { 738 if (vap->iv_state < IEEE80211_S_RUN) 739 continue; 740 switch (vap->iv_opmode) { 741 case IEEE80211_M_WDS: 742 case IEEE80211_M_STA: 743 case IEEE80211_M_AHDEMO: 744 case IEEE80211_M_HOSTAP: 745 case IEEE80211_M_IBSS: 746 case IEEE80211_M_MBSS: 747 flags |= ieee80211_vhtchanflags(vap->iv_bss->ni_chan); 748 break; 749 default: 750 break; 751 } 752 } 753 return flags; 754 } 755 756 /* 757 * Check if the current channel needs to change based on whether 758 * any vap's are using HT20/HT40. This is used to sync the state 759 * of ic_curchan after a channel width change on a running vap. 760 * 761 * Same applies for VHT. 762 */ 763 void 764 ieee80211_sync_curchan(struct ieee80211com *ic) 765 { 766 struct ieee80211_channel *c; 767 768 c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan, gethtadjustflags(ic)); 769 c = ieee80211_vht_adjust_channel(ic, c, getvhtadjustflags(ic)); 770 771 if (c != ic->ic_curchan) { 772 ic->ic_curchan = c; 773 ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan); 774 ic->ic_rt = ieee80211_get_ratetable(ic->ic_curchan); 775 IEEE80211_UNLOCK(ic); 776 ic->ic_set_channel(ic); 777 ieee80211_radiotap_chan_change(ic); 778 IEEE80211_LOCK(ic); 779 } 780 } 781 782 /* 783 * Setup the current channel. The request channel may be 784 * promoted if other vap's are operating with HT20/HT40. 785 */ 786 void 787 ieee80211_setupcurchan(struct ieee80211com *ic, struct ieee80211_channel *c) 788 { 789 if (ic->ic_htcaps & IEEE80211_HTC_HT) { 790 int flags = gethtadjustflags(ic); 791 /* 792 * Check for channel promotion required to support the 793 * set of running vap's. This assumes we are called 794 * after ni_chan is setup for each vap. 795 */ 796 /* XXX VHT? */ 797 /* NB: this assumes IEEE80211_FHT_USEHT40 > IEEE80211_FHT_HT */ 798 if (flags > ieee80211_htchanflags(c)) 799 c = ieee80211_ht_adjust_channel(ic, c, flags); 800 } 801 802 /* 803 * VHT promotion - this will at least promote to VHT20/40 804 * based on what HT has done; it may further promote the 805 * channel to VHT80 or above. 806 */ 807 if (ic->ic_vhtcaps != 0) { 808 int flags = getvhtadjustflags(ic); 809 if (flags > ieee80211_vhtchanflags(c)) 810 c = ieee80211_vht_adjust_channel(ic, c, flags); 811 } 812 813 ic->ic_bsschan = ic->ic_curchan = c; 814 ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan); 815 ic->ic_rt = ieee80211_get_ratetable(ic->ic_curchan); 816 } 817 818 /* 819 * Change the current channel. The channel change is guaranteed to have 820 * happened before the next state change. 821 */ 822 void 823 ieee80211_setcurchan(struct ieee80211com *ic, struct ieee80211_channel *c) 824 { 825 ieee80211_setupcurchan(ic, c); 826 ieee80211_runtask(ic, &ic->ic_chan_task); 827 } 828 829 void 830 ieee80211_update_chw(struct ieee80211com *ic) 831 { 832 833 ieee80211_setupcurchan(ic, ic->ic_curchan); 834 ieee80211_runtask(ic, &ic->ic_chw_task); 835 } 836 837 /* 838 * Join the specified IBSS/BSS network. The node is assumed to 839 * be passed in with a held reference. 840 */ 841 static int 842 ieee80211_sta_join1(struct ieee80211_node *selbs) 843 { 844 struct ieee80211vap *vap = selbs->ni_vap; 845 struct ieee80211com *ic = selbs->ni_ic; 846 struct ieee80211_node *obss; 847 int canreassoc; 848 849 /* 850 * Committed to selbs, setup state. 851 */ 852 obss = vap->iv_update_bss(vap, selbs); /* NB: caller assumed to bump refcnt */ 853 /* 854 * Check if old+new node have the same address in which 855 * case we can reassociate when operating in sta mode. 856 */ 857 /* XXX We'll not be in RUN anymore as iv_state got updated already? */ 858 canreassoc = (obss != NULL && 859 vap->iv_state == IEEE80211_S_RUN && 860 IEEE80211_ADDR_EQ(obss->ni_macaddr, selbs->ni_macaddr)); 861 if (obss != NULL) { 862 struct ieee80211_node_table *nt = obss->ni_table; 863 864 copy_bss(selbs, obss); 865 ieee80211_node_decref(obss); /* iv_bss reference */ 866 867 IEEE80211_NODE_LOCK(nt); 868 node_reclaim(nt, obss); /* station table reference */ 869 IEEE80211_NODE_UNLOCK(nt); 870 871 obss = NULL; /* NB: guard against later use */ 872 } 873 874 /* 875 * Delete unusable rates; we've already checked 876 * that the negotiated rate set is acceptable. 877 */ 878 ieee80211_fix_rate(vap->iv_bss, &vap->iv_bss->ni_rates, 879 IEEE80211_F_DODEL | IEEE80211_F_JOIN); 880 881 ieee80211_setcurchan(ic, selbs->ni_chan); 882 /* 883 * Set the erp state (mostly the slot time) to deal with 884 * the auto-select case; this should be redundant if the 885 * mode is locked. 886 */ 887 ieee80211_vap_reset_erp(vap); 888 ieee80211_wme_initparams(vap); 889 890 if (vap->iv_opmode == IEEE80211_M_STA) { 891 if (canreassoc) { 892 /* Reassociate */ 893 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1); 894 } else { 895 /* 896 * Act as if we received a DEAUTH frame in case we 897 * are invoked from the RUN state. This will cause 898 * us to try to re-authenticate if we are operating 899 * as a station. 900 */ 901 IEEE80211_DPRINTF(vap, IEEE80211_MSG_AUTH, 902 "%s %p<%s> %s -> AUTH, FC0_SUBTYPE_DEAUTH\n", 903 __func__, selbs, ether_sprintf(selbs->ni_macaddr), 904 ieee80211_state_name[vap->iv_state]); 905 ieee80211_new_state(vap, IEEE80211_S_AUTH, 906 IEEE80211_FC0_SUBTYPE_DEAUTH); 907 } 908 } else 909 ieee80211_new_state(vap, IEEE80211_S_RUN, -1); 910 return 1; 911 } 912 913 int 914 ieee80211_sta_join(struct ieee80211vap *vap, struct ieee80211_channel *chan, 915 const struct ieee80211_scan_entry *se) 916 { 917 struct ieee80211com *ic = vap->iv_ic; 918 struct ieee80211_node *ni; 919 int do_ht = 0; 920 921 ni = ieee80211_alloc_node(&ic->ic_sta, vap, se->se_macaddr); 922 if (ni == NULL) { 923 /* XXX msg */ 924 return 0; 925 } 926 927 /* 928 * Expand scan state into node's format. 929 * XXX may not need all this stuff 930 */ 931 IEEE80211_ADDR_COPY(ni->ni_bssid, se->se_bssid); 932 ni->ni_esslen = se->se_ssid[1]; 933 memcpy(ni->ni_essid, se->se_ssid+2, ni->ni_esslen); 934 ni->ni_tstamp.tsf = se->se_tstamp.tsf; 935 ni->ni_intval = se->se_intval; 936 ni->ni_capinfo = se->se_capinfo; 937 ni->ni_chan = chan; 938 ni->ni_timoff = se->se_timoff; 939 ni->ni_fhdwell = se->se_fhdwell; 940 ni->ni_fhindex = se->se_fhindex; 941 ni->ni_erp = se->se_erp; 942 IEEE80211_RSSI_LPF(ni->ni_avgrssi, se->se_rssi); 943 ni->ni_noise = se->se_noise; 944 if (vap->iv_opmode == IEEE80211_M_STA) { 945 /* NB: only infrastructure mode requires an associd */ 946 ni->ni_flags |= IEEE80211_NODE_ASSOCID; 947 } 948 949 if (ieee80211_ies_init(&ni->ni_ies, se->se_ies.data, se->se_ies.len)) { 950 ieee80211_ies_expand(&ni->ni_ies); 951 #ifdef IEEE80211_SUPPORT_SUPERG 952 if (ni->ni_ies.ath_ie != NULL) 953 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie); 954 #endif 955 if (ni->ni_ies.htcap_ie != NULL) 956 ieee80211_parse_htcap(ni, ni->ni_ies.htcap_ie); 957 if (ni->ni_ies.htinfo_ie != NULL) 958 ieee80211_parse_htinfo(ni, ni->ni_ies.htinfo_ie); 959 #ifdef IEEE80211_SUPPORT_MESH 960 if (ni->ni_ies.meshid_ie != NULL) 961 ieee80211_parse_meshid(ni, ni->ni_ies.meshid_ie); 962 #endif 963 #ifdef IEEE80211_SUPPORT_TDMA 964 if (ni->ni_ies.tdma_ie != NULL) 965 ieee80211_parse_tdma(ni, ni->ni_ies.tdma_ie); 966 #endif 967 if (ni->ni_ies.vhtcap_ie != NULL) 968 ieee80211_parse_vhtcap(ni, ni->ni_ies.vhtcap_ie); 969 if (ni->ni_ies.vhtopmode_ie != NULL) 970 ieee80211_parse_vhtopmode(ni, ni->ni_ies.vhtopmode_ie); 971 972 /* XXX parse BSSLOAD IE */ 973 /* XXX parse TXPWRENV IE */ 974 /* XXX parse APCHANREP IE */ 975 } 976 977 vap->iv_dtim_period = se->se_dtimperiod; 978 vap->iv_dtim_count = 0; 979 980 /* NB: must be after ni_chan is setup */ 981 ieee80211_setup_rates(ni, se->se_rates, se->se_xrates, 982 IEEE80211_F_DOSORT); 983 if (ieee80211_iserp_rateset(&ni->ni_rates)) 984 ni->ni_flags |= IEEE80211_NODE_ERP; 985 986 /* 987 * Setup HT state for this node if it's available, otherwise 988 * non-STA modes won't pick this state up. 989 * 990 * For IBSS and related modes that don't go through an 991 * association request/response, the only appropriate place 992 * to setup the HT state is here. 993 */ 994 if (ni->ni_ies.htinfo_ie != NULL && 995 ni->ni_ies.htcap_ie != NULL && 996 vap->iv_flags_ht & IEEE80211_FHT_HT) { 997 ieee80211_ht_node_init(ni); 998 ieee80211_ht_updateparams(ni, 999 ni->ni_ies.htcap_ie, 1000 ni->ni_ies.htinfo_ie); 1001 do_ht = 1; 1002 } 1003 1004 /* 1005 * Setup VHT state for this node if it's available. 1006 * Same as the above. 1007 * 1008 * For now, don't allow 2GHz VHT operation. 1009 */ 1010 if (ni->ni_ies.vhtopmode_ie != NULL && 1011 ni->ni_ies.vhtcap_ie != NULL && 1012 vap->iv_flags_vht & IEEE80211_FVHT_VHT) { 1013 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) { 1014 printf("%s: BSS %6D: 2GHz channel, VHT info; ignoring\n", 1015 __func__, 1016 ni->ni_macaddr, 1017 ":"); 1018 } else { 1019 ieee80211_vht_node_init(ni); 1020 ieee80211_vht_updateparams(ni, 1021 ni->ni_ies.vhtcap_ie, 1022 ni->ni_ies.vhtopmode_ie); 1023 ieee80211_setup_vht_rates(ni, ni->ni_ies.vhtcap_ie, 1024 ni->ni_ies.vhtopmode_ie); 1025 do_ht = 1; 1026 } 1027 } 1028 1029 /* Finally do the node channel change */ 1030 if (do_ht) { 1031 ieee80211_ht_updateparams_final(ni, ni->ni_ies.htcap_ie, 1032 ni->ni_ies.htinfo_ie); 1033 ieee80211_setup_htrates(ni, ni->ni_ies.htcap_ie, 1034 IEEE80211_F_JOIN | IEEE80211_F_DOBRS); 1035 ieee80211_setup_basic_htrates(ni, ni->ni_ies.htinfo_ie); 1036 } 1037 1038 /* XXX else check for ath FF? */ 1039 /* XXX QoS? Difficult given that WME config is specific to a master */ 1040 1041 ieee80211_node_setuptxparms(ni); 1042 ieee80211_ratectl_node_init(ni); 1043 1044 return ieee80211_sta_join1(ieee80211_ref_node(ni)); 1045 } 1046 1047 /* 1048 * Leave the specified IBSS/BSS network. The node is assumed to 1049 * be passed in with a held reference. 1050 */ 1051 void 1052 ieee80211_sta_leave(struct ieee80211_node *ni) 1053 { 1054 struct ieee80211com *ic = ni->ni_ic; 1055 1056 ic->ic_node_cleanup(ni); 1057 ieee80211_notify_node_leave(ni); 1058 } 1059 1060 /* 1061 * Send a deauthenticate frame and drop the station. 1062 */ 1063 void 1064 ieee80211_node_deauth(struct ieee80211_node *ni, int reason) 1065 { 1066 /* NB: bump the refcnt to be sure temporary nodes are not reclaimed */ 1067 ieee80211_ref_node(ni); 1068 if (ni->ni_associd != 0) 1069 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH, reason); 1070 ieee80211_node_leave(ni); 1071 ieee80211_free_node(ni); 1072 } 1073 1074 static struct ieee80211_node * 1075 node_alloc(struct ieee80211vap *vap, const uint8_t macaddr[IEEE80211_ADDR_LEN]) 1076 { 1077 struct ieee80211_node *ni; 1078 1079 ni = (struct ieee80211_node *) IEEE80211_MALLOC(sizeof(struct ieee80211_node), 1080 M_80211_NODE, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO); 1081 return ni; 1082 } 1083 1084 static int 1085 node_init(struct ieee80211_node *ni) 1086 { 1087 return 0; 1088 } 1089 1090 /* 1091 * Initialize an ie blob with the specified data. If previous 1092 * data exists re-use the data block. As a side effect we clear 1093 * all references to specific ie's; the caller is required to 1094 * recalculate them. 1095 */ 1096 int 1097 ieee80211_ies_init(struct ieee80211_ies *ies, const uint8_t *data, int len) 1098 { 1099 /* NB: assumes data+len are the last fields */ 1100 memset(ies, 0, offsetof(struct ieee80211_ies, data)); 1101 if (ies->data != NULL && ies->len != len) { 1102 /* data size changed */ 1103 IEEE80211_FREE(ies->data, M_80211_NODE_IE); 1104 ies->data = NULL; 1105 } 1106 if (ies->data == NULL) { 1107 ies->data = (uint8_t *) IEEE80211_MALLOC(len, M_80211_NODE_IE, 1108 IEEE80211_M_NOWAIT | IEEE80211_M_ZERO); 1109 if (ies->data == NULL) { 1110 ies->len = 0; 1111 /* NB: pointers have already been zero'd above */ 1112 return 0; 1113 } 1114 } 1115 memcpy(ies->data, data, len); 1116 ies->len = len; 1117 return 1; 1118 } 1119 1120 /* 1121 * Reclaim storage for an ie blob. 1122 */ 1123 void 1124 ieee80211_ies_cleanup(struct ieee80211_ies *ies) 1125 { 1126 if (ies->data != NULL) 1127 IEEE80211_FREE(ies->data, M_80211_NODE_IE); 1128 } 1129 1130 /* 1131 * Expand an ie blob data contents and to fillin individual 1132 * ie pointers. The data blob is assumed to be well-formed; 1133 * we don't do any validity checking of ie lengths. 1134 */ 1135 void 1136 ieee80211_ies_expand(struct ieee80211_ies *ies) 1137 { 1138 uint8_t *ie; 1139 int ielen; 1140 1141 ie = ies->data; 1142 ielen = ies->len; 1143 while (ielen > 1) { 1144 /* Make sure the given IE length fits into the total length. */ 1145 if ((2 + ie[1]) > ielen) { 1146 printf("%s: malformed IEs! ies %p { data %p len %d }: " 1147 "ie %u len 2+%u > total len left %d\n", 1148 __func__, ies, ies->data, ies->len, 1149 ie[0], ie[1], ielen); 1150 return; 1151 } 1152 switch (ie[0]) { 1153 case IEEE80211_ELEMID_VENDOR: 1154 if (iswpaoui(ie)) 1155 ies->wpa_ie = ie; 1156 else if (iswmeoui(ie)) 1157 ies->wme_ie = ie; 1158 #ifdef IEEE80211_SUPPORT_SUPERG 1159 else if (isatherosoui(ie)) 1160 ies->ath_ie = ie; 1161 #endif 1162 #ifdef IEEE80211_SUPPORT_TDMA 1163 else if (istdmaoui(ie)) 1164 ies->tdma_ie = ie; 1165 #endif 1166 break; 1167 case IEEE80211_ELEMID_RSN: 1168 ies->rsn_ie = ie; 1169 break; 1170 case IEEE80211_ELEMID_HTCAP: 1171 ies->htcap_ie = ie; 1172 break; 1173 case IEEE80211_ELEMID_HTINFO: 1174 ies->htinfo_ie = ie; 1175 break; 1176 #ifdef IEEE80211_SUPPORT_MESH 1177 case IEEE80211_ELEMID_MESHID: 1178 ies->meshid_ie = ie; 1179 break; 1180 #endif 1181 case IEEE80211_ELEMID_VHT_CAP: 1182 ies->vhtcap_ie = ie; 1183 break; 1184 case IEEE80211_ELEMID_VHT_OPMODE: 1185 ies->vhtopmode_ie = ie; 1186 break; 1187 case IEEE80211_ELEMID_VHT_PWR_ENV: 1188 ies->vhtpwrenv_ie = ie; 1189 break; 1190 case IEEE80211_ELEMID_BSSLOAD: 1191 ies->bssload_ie = ie; 1192 break; 1193 case IEEE80211_ELEMID_APCHANREP: 1194 ies->apchanrep_ie = ie; 1195 break; 1196 } 1197 ielen -= 2 + ie[1]; 1198 ie += 2 + ie[1]; 1199 } 1200 } 1201 1202 /* 1203 * Reclaim any resources in a node and reset any critical 1204 * state. Typically nodes are free'd immediately after, 1205 * but in some cases the storage may be reused so we need 1206 * to insure consistent state (should probably fix that). 1207 */ 1208 static void 1209 node_cleanup(struct ieee80211_node *ni) 1210 { 1211 struct ieee80211vap *vap = ni->ni_vap; 1212 struct ieee80211com *ic = ni->ni_ic; 1213 int i; 1214 1215 /* NB: preserve ni_table */ 1216 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) { 1217 if (vap->iv_opmode != IEEE80211_M_STA) 1218 vap->iv_ps_sta--; 1219 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT; 1220 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni, 1221 "power save mode off, %u sta's in ps mode", vap->iv_ps_sta); 1222 } 1223 /* 1224 * Cleanup any VHT and HT-related state. 1225 */ 1226 if (ni->ni_flags & IEEE80211_NODE_VHT) 1227 ieee80211_vht_node_cleanup(ni); 1228 if (ni->ni_flags & IEEE80211_NODE_HT) 1229 ieee80211_ht_node_cleanup(ni); 1230 #ifdef IEEE80211_SUPPORT_SUPERG 1231 /* Always do FF node cleanup; for A-MSDU */ 1232 ieee80211_ff_node_cleanup(ni); 1233 #endif 1234 #ifdef IEEE80211_SUPPORT_MESH 1235 /* 1236 * Cleanup any mesh-related state. 1237 */ 1238 if (vap->iv_opmode == IEEE80211_M_MBSS) 1239 ieee80211_mesh_node_cleanup(ni); 1240 #endif 1241 /* 1242 * Clear any staging queue entries. 1243 */ 1244 ieee80211_ageq_drain_node(&ic->ic_stageq, ni); 1245 1246 /* 1247 * Clear AREF flag that marks the authorization refcnt bump 1248 * has happened. This is probably not needed as the node 1249 * should always be removed from the table so not found but 1250 * do it just in case. 1251 * Likewise clear the ASSOCID flag as these flags are intended 1252 * to be managed in tandem. 1253 */ 1254 ni->ni_flags &= ~(IEEE80211_NODE_AREF | IEEE80211_NODE_ASSOCID); 1255 1256 /* 1257 * Drain power save queue and, if needed, clear TIM. 1258 */ 1259 if (ieee80211_node_psq_drain(ni) != 0 && vap->iv_set_tim != NULL) 1260 vap->iv_set_tim(ni, 0); 1261 1262 ni->ni_associd = 0; 1263 if (ni->ni_challenge != NULL) { 1264 IEEE80211_FREE(ni->ni_challenge, M_80211_NODE); 1265 ni->ni_challenge = NULL; 1266 } 1267 /* 1268 * Preserve SSID, WPA, and WME ie's so the bss node is 1269 * reusable during a re-auth/re-assoc state transition. 1270 * If we remove these data they will not be recreated 1271 * because they come from a probe-response or beacon frame 1272 * which cannot be expected prior to the association-response. 1273 * This should not be an issue when operating in other modes 1274 * as stations leaving always go through a full state transition 1275 * which will rebuild this state. 1276 * 1277 * XXX does this leave us open to inheriting old state? 1278 */ 1279 for (i = 0; i < nitems(ni->ni_rxfrag); i++) 1280 if (ni->ni_rxfrag[i] != NULL) { 1281 m_freem(ni->ni_rxfrag[i]); 1282 ni->ni_rxfrag[i] = NULL; 1283 } 1284 /* 1285 * Must be careful here to remove any key map entry w/o a LOR. 1286 */ 1287 ieee80211_node_delucastkey(ni); 1288 } 1289 1290 static void 1291 node_free(struct ieee80211_node *ni) 1292 { 1293 struct ieee80211com *ic = ni->ni_ic; 1294 1295 ieee80211_ratectl_node_deinit(ni); 1296 ic->ic_node_cleanup(ni); 1297 ieee80211_ies_cleanup(&ni->ni_ies); 1298 ieee80211_psq_cleanup(&ni->ni_psq); 1299 IEEE80211_FREE(ni, M_80211_NODE); 1300 } 1301 1302 static void 1303 node_age(struct ieee80211_node *ni) 1304 { 1305 struct ieee80211vap *vap = ni->ni_vap; 1306 1307 /* 1308 * Age frames on the power save queue. 1309 */ 1310 if (ieee80211_node_psq_age(ni) != 0 && 1311 ni->ni_psq.psq_len == 0 && vap->iv_set_tim != NULL) 1312 vap->iv_set_tim(ni, 0); 1313 /* 1314 * Age out HT resources (e.g. frames on the 1315 * A-MPDU reorder queues). 1316 */ 1317 if (ni->ni_associd != 0 && (ni->ni_flags & IEEE80211_NODE_HT)) 1318 ieee80211_ht_node_age(ni); 1319 } 1320 1321 static int8_t 1322 node_getrssi(const struct ieee80211_node *ni) 1323 { 1324 uint32_t avgrssi = ni->ni_avgrssi; 1325 int32_t rssi; 1326 1327 if (avgrssi == IEEE80211_RSSI_DUMMY_MARKER) 1328 return 0; 1329 rssi = IEEE80211_RSSI_GET(avgrssi); 1330 return rssi < 0 ? 0 : rssi > 127 ? 127 : rssi; 1331 } 1332 1333 static void 1334 node_getsignal(const struct ieee80211_node *ni, int8_t *rssi, int8_t *noise) 1335 { 1336 *rssi = node_getrssi(ni); 1337 *noise = ni->ni_noise; 1338 } 1339 1340 static void 1341 node_getmimoinfo(const struct ieee80211_node *ni, 1342 struct ieee80211_mimo_info *info) 1343 { 1344 int i; 1345 uint32_t avgrssi; 1346 int32_t rssi; 1347 1348 bzero(info, sizeof(*info)); 1349 1350 for (i = 0; i < MIN(IEEE80211_MAX_CHAINS, ni->ni_mimo_chains); i++) { 1351 /* Note: for now, just pri20 channel info */ 1352 avgrssi = ni->ni_mimo_rssi_ctl[i]; 1353 if (avgrssi == IEEE80211_RSSI_DUMMY_MARKER) { 1354 info->ch[i].rssi[0] = 0; 1355 } else { 1356 rssi = IEEE80211_RSSI_GET(avgrssi); 1357 info->ch[i].rssi[0] = rssi < 0 ? 0 : rssi > 127 ? 127 : rssi; 1358 } 1359 info->ch[i].noise[0] = ni->ni_mimo_noise_ctl[i]; 1360 } 1361 1362 /* XXX ext radios? */ 1363 1364 /* XXX EVM? */ 1365 } 1366 1367 static void 1368 ieee80211_add_node_nt(struct ieee80211_node_table *nt, 1369 struct ieee80211_node *ni) 1370 { 1371 struct ieee80211com *ic = nt->nt_ic; 1372 int hash; 1373 1374 IEEE80211_NODE_LOCK_ASSERT(nt); 1375 1376 hash = IEEE80211_NODE_HASH(ic, ni->ni_macaddr); 1377 (void) ic; /* XXX IEEE80211_NODE_HASH */ 1378 TAILQ_INSERT_TAIL(&nt->nt_node, ni, ni_list); 1379 LIST_INSERT_HEAD(&nt->nt_hash[hash], ni, ni_hash); 1380 nt->nt_count++; 1381 ni->ni_table = nt; 1382 } 1383 1384 static void 1385 ieee80211_del_node_nt(struct ieee80211_node_table *nt, 1386 struct ieee80211_node *ni) 1387 { 1388 1389 IEEE80211_NODE_LOCK_ASSERT(nt); 1390 1391 TAILQ_REMOVE(&nt->nt_node, ni, ni_list); 1392 LIST_REMOVE(ni, ni_hash); 1393 nt->nt_count--; 1394 KASSERT(nt->nt_count >= 0, 1395 ("nt_count is negative (%d)!\n", nt->nt_count)); 1396 ni->ni_table = NULL; 1397 } 1398 1399 struct ieee80211_node * 1400 ieee80211_alloc_node(struct ieee80211_node_table *nt, 1401 struct ieee80211vap *vap, const uint8_t macaddr[IEEE80211_ADDR_LEN]) 1402 { 1403 struct ieee80211com *ic = nt->nt_ic; 1404 struct ieee80211_node *ni; 1405 1406 ni = ic->ic_node_alloc(vap, macaddr); 1407 if (ni == NULL) { 1408 vap->iv_stats.is_rx_nodealloc++; 1409 return NULL; 1410 } 1411 1412 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 1413 "%s %p<%s> in %s table\n", __func__, ni, 1414 ether_sprintf(macaddr), nt->nt_name); 1415 1416 IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr); 1417 ieee80211_node_initref(ni); /* mark referenced */ 1418 ni->ni_chan = IEEE80211_CHAN_ANYC; 1419 ni->ni_authmode = IEEE80211_AUTH_OPEN; 1420 ni->ni_txpower = ic->ic_txpowlimit; /* max power */ 1421 ni->ni_txparms = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)]; 1422 ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE); 1423 ni->ni_avgrssi = IEEE80211_RSSI_DUMMY_MARKER; 1424 ni->ni_inact_reload = nt->nt_inact_init; 1425 ni->ni_inact = ni->ni_inact_reload; 1426 ni->ni_ath_defkeyix = 0x7fff; 1427 ieee80211_psq_init(&ni->ni_psq, "unknown"); 1428 #ifdef IEEE80211_SUPPORT_MESH 1429 if (vap->iv_opmode == IEEE80211_M_MBSS) 1430 ieee80211_mesh_node_init(vap, ni); 1431 #endif 1432 IEEE80211_NODE_LOCK(nt); 1433 ieee80211_add_node_nt(nt, ni); 1434 ni->ni_vap = vap; 1435 ni->ni_ic = ic; 1436 IEEE80211_NODE_UNLOCK(nt); 1437 1438 /* handle failure; free node state */ 1439 if (ic->ic_node_init(ni) != 0) { 1440 vap->iv_stats.is_rx_nodealloc++; 1441 ieee80211_psq_cleanup(&ni->ni_psq); 1442 ieee80211_ratectl_node_deinit(ni); 1443 __ieee80211_free_node(ni); 1444 return NULL; 1445 } 1446 1447 IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni, 1448 "%s: inact_reload %u", __func__, ni->ni_inact_reload); 1449 1450 return ni; 1451 } 1452 1453 /* 1454 * Craft a temporary node suitable for sending a management frame 1455 * to the specified station. We craft only as much state as we 1456 * need to do the work since the node will be immediately reclaimed 1457 * once the send completes. 1458 */ 1459 struct ieee80211_node * 1460 ieee80211_tmp_node(struct ieee80211vap *vap, 1461 const uint8_t macaddr[IEEE80211_ADDR_LEN]) 1462 { 1463 struct ieee80211com *ic = vap->iv_ic; 1464 struct ieee80211_node *ni; 1465 1466 ni = ic->ic_node_alloc(vap, macaddr); 1467 if (ni != NULL) { 1468 struct ieee80211_node *bss = vap->iv_bss; 1469 1470 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 1471 "%s %p<%s>\n", __func__, ni, ether_sprintf(macaddr)); 1472 1473 ni->ni_table = NULL; /* NB: pedantic */ 1474 ni->ni_ic = ic; /* NB: needed to set channel */ 1475 ni->ni_vap = vap; 1476 1477 IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr); 1478 IEEE80211_ADDR_COPY(ni->ni_bssid, bss->ni_bssid); 1479 ieee80211_node_initref(ni); /* mark referenced */ 1480 /* NB: required by ieee80211_fix_rate */ 1481 ieee80211_node_set_chan(ni, bss->ni_chan); 1482 ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey, 1483 IEEE80211_KEYIX_NONE); 1484 ni->ni_txpower = bss->ni_txpower; 1485 /* XXX optimize away */ 1486 ieee80211_psq_init(&ni->ni_psq, "unknown"); 1487 1488 ieee80211_ratectl_node_init(ni); 1489 1490 /* handle failure; free node state */ 1491 if (ic->ic_node_init(ni) != 0) { 1492 vap->iv_stats.is_rx_nodealloc++; 1493 ieee80211_psq_cleanup(&ni->ni_psq); 1494 ieee80211_ratectl_node_deinit(ni); 1495 __ieee80211_free_node(ni); 1496 return NULL; 1497 } 1498 1499 } else { 1500 /* XXX msg */ 1501 vap->iv_stats.is_rx_nodealloc++; 1502 } 1503 return ni; 1504 } 1505 1506 struct ieee80211_node * 1507 ieee80211_dup_bss(struct ieee80211vap *vap, 1508 const uint8_t macaddr[IEEE80211_ADDR_LEN]) 1509 { 1510 struct ieee80211com *ic = vap->iv_ic; 1511 struct ieee80211_node *ni; 1512 1513 ni = ieee80211_alloc_node(&ic->ic_sta, vap, macaddr); 1514 if (ni != NULL) { 1515 struct ieee80211_node *bss = vap->iv_bss; 1516 /* 1517 * Inherit from iv_bss. 1518 */ 1519 copy_bss(ni, bss); 1520 IEEE80211_ADDR_COPY(ni->ni_bssid, bss->ni_bssid); 1521 ieee80211_node_set_chan(ni, bss->ni_chan); 1522 } 1523 return ni; 1524 } 1525 1526 /* 1527 * Create a bss node for a legacy WDS vap. The far end does 1528 * not associate so we just create create a new node and 1529 * simulate an association. The caller is responsible for 1530 * installing the node as the bss node and handling any further 1531 * setup work like authorizing the port. 1532 */ 1533 struct ieee80211_node * 1534 ieee80211_node_create_wds(struct ieee80211vap *vap, 1535 const uint8_t bssid[IEEE80211_ADDR_LEN], struct ieee80211_channel *chan) 1536 { 1537 struct ieee80211com *ic = vap->iv_ic; 1538 struct ieee80211_node *ni; 1539 1540 /* XXX check if node already in sta table? */ 1541 ni = ieee80211_alloc_node(&ic->ic_sta, vap, bssid); 1542 if (ni != NULL) { 1543 ni->ni_wdsvap = vap; 1544 IEEE80211_ADDR_COPY(ni->ni_bssid, bssid); 1545 /* 1546 * Inherit any manually configured settings. 1547 */ 1548 copy_bss(ni, vap->iv_bss); 1549 ieee80211_node_set_chan(ni, chan); 1550 /* NB: propagate ssid so available to WPA supplicant */ 1551 ni->ni_esslen = vap->iv_des_ssid[0].len; 1552 memcpy(ni->ni_essid, vap->iv_des_ssid[0].ssid, ni->ni_esslen); 1553 /* NB: no associd for peer */ 1554 /* 1555 * There are no management frames to use to 1556 * discover neighbor capabilities, so blindly 1557 * propagate the local configuration. 1558 */ 1559 if (vap->iv_flags & IEEE80211_F_WME) 1560 ni->ni_flags |= IEEE80211_NODE_QOS; 1561 #ifdef IEEE80211_SUPPORT_SUPERG 1562 if (vap->iv_flags & IEEE80211_F_FF) 1563 ni->ni_flags |= IEEE80211_NODE_FF; 1564 #endif 1565 /* XXX VHT */ 1566 if ((ic->ic_htcaps & IEEE80211_HTC_HT) && 1567 (vap->iv_flags_ht & IEEE80211_FHT_HT)) { 1568 /* 1569 * Device is HT-capable and HT is enabled for 1570 * the vap; setup HT operation. On return 1571 * ni_chan will be adjusted to an HT channel. 1572 */ 1573 ieee80211_ht_wds_init(ni); 1574 if (vap->iv_flags_vht & IEEE80211_FVHT_VHT) { 1575 printf("%s: TODO: vht_wds_init\n", __func__); 1576 } 1577 } else { 1578 struct ieee80211_channel *c = ni->ni_chan; 1579 /* 1580 * Force a legacy channel to be used. 1581 */ 1582 c = ieee80211_find_channel(ic, 1583 c->ic_freq, c->ic_flags &~ IEEE80211_CHAN_HT); 1584 KASSERT(c != NULL, ("no legacy channel, %u/%x", 1585 ni->ni_chan->ic_freq, ni->ni_chan->ic_flags)); 1586 ni->ni_chan = c; 1587 } 1588 } 1589 return ni; 1590 } 1591 1592 struct ieee80211_node * 1593 _ieee80211_find_node_locked(struct ieee80211_node_table *nt, 1594 const uint8_t macaddr[IEEE80211_ADDR_LEN], 1595 const char *func __debrefcnt_used, int line __debrefcnt_used) 1596 { 1597 struct ieee80211_node *ni; 1598 int hash; 1599 1600 IEEE80211_NODE_LOCK_ASSERT(nt); 1601 1602 hash = IEEE80211_NODE_HASH(nt->nt_ic, macaddr); 1603 LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) { 1604 if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) { 1605 ieee80211_ref_node(ni); /* mark referenced */ 1606 #ifdef IEEE80211_DEBUG_REFCNT 1607 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE, 1608 "%s (%s:%u) %p<%s> refcnt %d\n", __func__, 1609 func, line, 1610 ni, ether_sprintf(ni->ni_macaddr), 1611 ieee80211_node_refcnt(ni)); 1612 #endif 1613 return ni; 1614 } 1615 } 1616 return NULL; 1617 } 1618 1619 struct ieee80211_node * 1620 _ieee80211_find_node(struct ieee80211_node_table *nt, 1621 const uint8_t macaddr[IEEE80211_ADDR_LEN], 1622 const char *func __debrefcnt_used, int line __debrefcnt_used) 1623 { 1624 struct ieee80211_node *ni; 1625 1626 IEEE80211_NODE_LOCK(nt); 1627 ni = _ieee80211_find_node_locked(nt, macaddr, func, line); 1628 IEEE80211_NODE_UNLOCK(nt); 1629 return ni; 1630 } 1631 1632 struct ieee80211_node * 1633 _ieee80211_find_vap_node_locked(struct ieee80211_node_table *nt, 1634 const struct ieee80211vap *vap, const uint8_t macaddr[IEEE80211_ADDR_LEN], 1635 const char *func __debrefcnt_used, int line __debrefcnt_used) 1636 { 1637 struct ieee80211_node *ni; 1638 int hash; 1639 1640 IEEE80211_NODE_LOCK_ASSERT(nt); 1641 1642 hash = IEEE80211_NODE_HASH(nt->nt_ic, macaddr); 1643 LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) { 1644 if (ni->ni_vap == vap && 1645 IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) { 1646 ieee80211_ref_node(ni); /* mark referenced */ 1647 #ifdef IEEE80211_DEBUG_REFCNT 1648 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE, 1649 "%s (%s:%u) %p<%s> refcnt %d\n", __func__, 1650 func, line, 1651 ni, ether_sprintf(ni->ni_macaddr), 1652 ieee80211_node_refcnt(ni)); 1653 #endif 1654 return ni; 1655 } 1656 } 1657 return NULL; 1658 } 1659 1660 struct ieee80211_node * 1661 _ieee80211_find_vap_node(struct ieee80211_node_table *nt, 1662 const struct ieee80211vap *vap, const uint8_t macaddr[IEEE80211_ADDR_LEN], 1663 const char *func __debrefcnt_used, int line __debrefcnt_used) 1664 { 1665 struct ieee80211_node *ni; 1666 1667 IEEE80211_NODE_LOCK(nt); 1668 ni = _ieee80211_find_vap_node_locked(nt, vap, macaddr, func, line); 1669 IEEE80211_NODE_UNLOCK(nt); 1670 return ni; 1671 } 1672 1673 /* 1674 * Fake up a node; this handles node discovery in adhoc mode. 1675 * Note that for the driver's benefit we treat this like 1676 * an association so the driver has an opportunity to setup 1677 * it's private state. 1678 */ 1679 struct ieee80211_node * 1680 ieee80211_fakeup_adhoc_node(struct ieee80211vap *vap, 1681 const uint8_t macaddr[IEEE80211_ADDR_LEN]) 1682 { 1683 struct ieee80211_node *ni; 1684 1685 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE | IEEE80211_MSG_ASSOC, 1686 "%s: mac<%s>\n", __func__, ether_sprintf(macaddr)); 1687 ni = ieee80211_dup_bss(vap, macaddr); 1688 if (ni != NULL) { 1689 struct ieee80211com *ic = vap->iv_ic; 1690 1691 /* XXX no rate negotiation; just dup */ 1692 ni->ni_rates = vap->iv_bss->ni_rates; 1693 if (ieee80211_iserp_rateset(&ni->ni_rates)) 1694 ni->ni_flags |= IEEE80211_NODE_ERP; 1695 if (vap->iv_opmode == IEEE80211_M_AHDEMO) { 1696 /* 1697 * In adhoc demo mode there are no management 1698 * frames to use to discover neighbor capabilities, 1699 * so blindly propagate the local configuration 1700 * so we can do interesting things (e.g. use 1701 * WME to disable ACK's). 1702 */ 1703 /* 1704 * XXX TODO: 11n? 1705 */ 1706 if (vap->iv_flags & IEEE80211_F_WME) 1707 ni->ni_flags |= IEEE80211_NODE_QOS; 1708 #ifdef IEEE80211_SUPPORT_SUPERG 1709 if (vap->iv_flags & IEEE80211_F_FF) 1710 ni->ni_flags |= IEEE80211_NODE_FF; 1711 #endif 1712 } 1713 ieee80211_node_setuptxparms(ni); 1714 ieee80211_ratectl_node_init(ni); 1715 1716 /* 1717 * XXX TODO: 11n? At least 20MHz, at least A-MPDU RX, 1718 * not A-MPDU TX; not 11n rates, etc. We'll cycle 1719 * that after we hear that we can indeed do 11n 1720 * (either by a beacon frame or by a probe response.) 1721 */ 1722 1723 /* 1724 * This is the first time we see the node. 1725 */ 1726 if (ic->ic_newassoc != NULL) 1727 ic->ic_newassoc(ni, 1); 1728 1729 /* 1730 * Kick off a probe request to the given node; 1731 * we will then use the probe response to update 1732 * 11n/etc configuration state. 1733 * 1734 * XXX TODO: this isn't guaranteed, and until we get 1735 * a probe response, we won't be able to actually 1736 * do anything 802.11n related to the node. 1737 * So if this does indeed work, maybe we should hold 1738 * off on sending responses until we get the probe 1739 * response, or just default to some sensible subset 1740 * of 802.11n behaviour (eg always allow aggregation 1741 * negotiation TO us, but not FROM us, etc) so we 1742 * aren't entirely busted. 1743 */ 1744 if (vap->iv_opmode == IEEE80211_M_IBSS) { 1745 ieee80211_send_probereq(ni, /* node */ 1746 vap->iv_myaddr, /* SA */ 1747 ni->ni_macaddr, /* DA */ 1748 vap->iv_bss->ni_bssid, /* BSSID */ 1749 vap->iv_bss->ni_essid, 1750 vap->iv_bss->ni_esslen); /* SSID */ 1751 } 1752 1753 /* XXX not right for 802.1x/WPA */ 1754 ieee80211_node_authorize(ni); 1755 } 1756 return ni; 1757 } 1758 1759 void 1760 ieee80211_init_neighbor(struct ieee80211_node *ni, 1761 const struct ieee80211_frame *wh, 1762 const struct ieee80211_scanparams *sp) 1763 { 1764 int do_ht_setup = 0, do_vht_setup = 0; 1765 1766 ni->ni_esslen = sp->ssid[1]; 1767 memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]); 1768 IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3); 1769 memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp)); 1770 ni->ni_intval = sp->bintval; 1771 ni->ni_capinfo = sp->capinfo; 1772 ni->ni_chan = ni->ni_ic->ic_curchan; 1773 ni->ni_fhdwell = sp->fhdwell; 1774 ni->ni_fhindex = sp->fhindex; 1775 ni->ni_erp = sp->erp; 1776 ni->ni_timoff = sp->timoff; 1777 #ifdef IEEE80211_SUPPORT_MESH 1778 if (ni->ni_vap->iv_opmode == IEEE80211_M_MBSS) 1779 ieee80211_mesh_init_neighbor(ni, wh, sp); 1780 #endif 1781 if (ieee80211_ies_init(&ni->ni_ies, sp->ies, sp->ies_len)) { 1782 ieee80211_ies_expand(&ni->ni_ies); 1783 if (ni->ni_ies.wme_ie != NULL) 1784 ni->ni_flags |= IEEE80211_NODE_QOS; 1785 else 1786 ni->ni_flags &= ~IEEE80211_NODE_QOS; 1787 #ifdef IEEE80211_SUPPORT_SUPERG 1788 if (ni->ni_ies.ath_ie != NULL) 1789 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie); 1790 #endif 1791 if (ni->ni_ies.htcap_ie != NULL) 1792 ieee80211_parse_htcap(ni, ni->ni_ies.htcap_ie); 1793 if (ni->ni_ies.htinfo_ie != NULL) 1794 ieee80211_parse_htinfo(ni, ni->ni_ies.htinfo_ie); 1795 1796 if (ni->ni_ies.vhtcap_ie != NULL) 1797 ieee80211_parse_vhtcap(ni, ni->ni_ies.vhtcap_ie); 1798 if (ni->ni_ies.vhtopmode_ie != NULL) 1799 ieee80211_parse_vhtopmode(ni, ni->ni_ies.vhtopmode_ie); 1800 1801 if ((ni->ni_ies.htcap_ie != NULL) && 1802 (ni->ni_ies.htinfo_ie != NULL) && 1803 (ni->ni_vap->iv_flags_ht & IEEE80211_FHT_HT)) { 1804 do_ht_setup = 1; 1805 } 1806 1807 if ((ni->ni_ies.vhtcap_ie != NULL) && 1808 (ni->ni_ies.vhtopmode_ie != NULL) && 1809 (ni->ni_vap->iv_flags_vht & IEEE80211_FVHT_VHT)) { 1810 do_vht_setup = 1; 1811 } 1812 } 1813 1814 /* NB: must be after ni_chan is setup */ 1815 ieee80211_setup_rates(ni, sp->rates, sp->xrates, 1816 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 1817 IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 1818 1819 /* 1820 * If the neighbor is HT compatible, flip that on. 1821 */ 1822 if (do_ht_setup) { 1823 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_ASSOC, 1824 "%s: doing HT setup\n", __func__); 1825 ieee80211_ht_node_init(ni); 1826 ieee80211_ht_updateparams(ni, 1827 ni->ni_ies.htcap_ie, 1828 ni->ni_ies.htinfo_ie); 1829 1830 if (do_vht_setup) { 1831 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) { 1832 printf("%s: BSS %6D: 2GHz channel, VHT info; ignoring\n", 1833 __func__, 1834 ni->ni_macaddr, 1835 ":"); 1836 } else { 1837 ieee80211_vht_node_init(ni); 1838 ieee80211_vht_updateparams(ni, 1839 ni->ni_ies.vhtcap_ie, 1840 ni->ni_ies.vhtopmode_ie); 1841 ieee80211_setup_vht_rates(ni, 1842 ni->ni_ies.vhtcap_ie, 1843 ni->ni_ies.vhtopmode_ie); 1844 } 1845 } 1846 1847 /* 1848 * Finally do the channel upgrade/change based 1849 * on the HT/VHT configuration. 1850 */ 1851 ieee80211_ht_updateparams_final(ni, ni->ni_ies.htcap_ie, 1852 ni->ni_ies.htinfo_ie); 1853 ieee80211_setup_htrates(ni, 1854 ni->ni_ies.htcap_ie, 1855 IEEE80211_F_JOIN | IEEE80211_F_DOBRS); 1856 ieee80211_setup_basic_htrates(ni, 1857 ni->ni_ies.htinfo_ie); 1858 1859 ieee80211_node_setuptxparms(ni); 1860 ieee80211_ratectl_node_init(ni); 1861 1862 /* Reassociate; we're now 11n/11ac */ 1863 /* 1864 * XXX TODO: this is the wrong thing to do - 1865 * we're calling it with isnew=1 so the ath(4) 1866 * driver reinitialises the rate tables. 1867 * This "mostly" works for ath(4), but it won't 1868 * be right for firmware devices which allocate 1869 * node states. 1870 * 1871 * So, do we just create a new node and delete 1872 * the old one? Or? 1873 */ 1874 if (ni->ni_ic->ic_newassoc) 1875 ni->ni_ic->ic_newassoc(ni, 1); 1876 } 1877 } 1878 1879 /* 1880 * Do node discovery in adhoc mode on receipt of a beacon 1881 * or probe response frame. Note that for the driver's 1882 * benefit we treat this like an association so the 1883 * driver has an opportunity to setup it's private state. 1884 */ 1885 struct ieee80211_node * 1886 ieee80211_add_neighbor(struct ieee80211vap *vap, 1887 const struct ieee80211_frame *wh, 1888 const struct ieee80211_scanparams *sp) 1889 { 1890 struct ieee80211_node *ni; 1891 1892 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC, 1893 "%s: mac<%s>\n", __func__, ether_sprintf(wh->i_addr2)); 1894 ni = ieee80211_dup_bss(vap, wh->i_addr2);/* XXX alloc_node? */ 1895 if (ni != NULL) { 1896 struct ieee80211com *ic = vap->iv_ic; 1897 1898 ieee80211_init_neighbor(ni, wh, sp); 1899 if (ieee80211_iserp_rateset(&ni->ni_rates)) 1900 ni->ni_flags |= IEEE80211_NODE_ERP; 1901 ieee80211_node_setuptxparms(ni); 1902 ieee80211_ratectl_node_init(ni); 1903 if (ic->ic_newassoc != NULL) 1904 ic->ic_newassoc(ni, 1); 1905 /* XXX not right for 802.1x/WPA */ 1906 ieee80211_node_authorize(ni); 1907 } 1908 return ni; 1909 } 1910 1911 #define IS_PROBEREQ(wh) \ 1912 ((wh->i_fc[0] & (IEEE80211_FC0_TYPE_MASK|IEEE80211_FC0_SUBTYPE_MASK)) \ 1913 == (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ)) 1914 #define IS_BCAST_PROBEREQ(wh) \ 1915 (IS_PROBEREQ(wh) && IEEE80211_IS_MULTICAST( \ 1916 ((const struct ieee80211_frame *)(wh))->i_addr3)) 1917 1918 static __inline struct ieee80211_node * 1919 _find_rxnode(struct ieee80211_node_table *nt, 1920 const struct ieee80211_frame_min *wh, 1921 const char *func __debrefcnt_used, int line __debrefcnt_used) 1922 { 1923 if (IS_BCAST_PROBEREQ(wh)) 1924 return NULL; /* spam bcast probe req to all vap's */ 1925 return _ieee80211_find_node_locked(nt, wh->i_addr2, func, line); 1926 } 1927 1928 /* 1929 * Locate the node for sender, track state, and then pass the 1930 * (referenced) node up to the 802.11 layer for its use. Note 1931 * we can return NULL if the sender is not in the table. 1932 */ 1933 struct ieee80211_node * 1934 _ieee80211_find_rxnode(struct ieee80211com *ic, 1935 const struct ieee80211_frame_min *wh, 1936 const char *func __debrefcnt_used, int line __debrefcnt_used) 1937 { 1938 struct ieee80211_node_table *nt; 1939 struct ieee80211_node *ni; 1940 1941 nt = &ic->ic_sta; 1942 IEEE80211_NODE_LOCK(nt); 1943 ni = _find_rxnode(nt, wh, func, line); 1944 IEEE80211_NODE_UNLOCK(nt); 1945 1946 return ni; 1947 } 1948 1949 /* 1950 * Like ieee80211_find_rxnode but use the supplied h/w 1951 * key index as a hint to locate the node in the key 1952 * mapping table. If an entry is present at the key 1953 * index we return it; otherwise do a normal lookup and 1954 * update the mapping table if the station has a unicast 1955 * key assigned to it. 1956 */ 1957 struct ieee80211_node * 1958 _ieee80211_find_rxnode_withkey(struct ieee80211com *ic, 1959 const struct ieee80211_frame_min *wh, ieee80211_keyix keyix, 1960 const char *func __debrefcnt_used, int line __debrefcnt_used) 1961 { 1962 struct ieee80211_node_table *nt; 1963 struct ieee80211_node *ni; 1964 1965 nt = &ic->ic_sta; 1966 IEEE80211_NODE_LOCK(nt); 1967 if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax) 1968 ni = nt->nt_keyixmap[keyix]; 1969 else 1970 ni = NULL; 1971 if (ni == NULL) { 1972 ni = _find_rxnode(nt, wh, func, line); 1973 if (ni != NULL && nt->nt_keyixmap != NULL) { 1974 /* 1975 * If the station has a unicast key cache slot 1976 * assigned update the key->node mapping table. 1977 */ 1978 keyix = ni->ni_ucastkey.wk_rxkeyix; 1979 /* XXX can keyixmap[keyix] != NULL? */ 1980 if (keyix < nt->nt_keyixmax && 1981 nt->nt_keyixmap[keyix] == NULL) { 1982 IEEE80211_DPRINTF(ni->ni_vap, 1983 IEEE80211_MSG_NODE, 1984 "%s: add key map entry %p<%s> refcnt %d\n", 1985 __func__, ni, ether_sprintf(ni->ni_macaddr), 1986 ieee80211_node_refcnt(ni)+1); 1987 nt->nt_keyixmap[keyix] = ieee80211_ref_node(ni); 1988 } 1989 } 1990 } else { 1991 if (IS_BCAST_PROBEREQ(wh)) 1992 ni = NULL; /* spam bcast probe req to all vap's */ 1993 else 1994 ieee80211_ref_node(ni); 1995 } 1996 IEEE80211_NODE_UNLOCK(nt); 1997 1998 return ni; 1999 } 2000 #undef IS_BCAST_PROBEREQ 2001 #undef IS_PROBEREQ 2002 2003 /* 2004 * Return a reference to the appropriate node for sending 2005 * a data frame. This handles node discovery in adhoc networks. 2006 */ 2007 struct ieee80211_node * 2008 _ieee80211_find_txnode(struct ieee80211vap *vap, 2009 const uint8_t macaddr[IEEE80211_ADDR_LEN], 2010 const char *func __debrefcnt_used, int line __debrefcnt_used) 2011 { 2012 struct ieee80211_node_table *nt = &vap->iv_ic->ic_sta; 2013 struct ieee80211_node *ni; 2014 2015 /* 2016 * The destination address should be in the node table 2017 * unless this is a multicast/broadcast frame. We can 2018 * also optimize station mode operation, all frames go 2019 * to the bss node. 2020 */ 2021 /* XXX can't hold lock across dup_bss 'cuz of recursive locking */ 2022 IEEE80211_NODE_LOCK(nt); 2023 if (vap->iv_opmode == IEEE80211_M_STA || 2024 vap->iv_opmode == IEEE80211_M_WDS || 2025 IEEE80211_IS_MULTICAST(macaddr)) 2026 ni = ieee80211_ref_node(vap->iv_bss); 2027 else 2028 ni = _ieee80211_find_node_locked(nt, macaddr, func, line); 2029 IEEE80211_NODE_UNLOCK(nt); 2030 2031 if (ni == NULL) { 2032 if (vap->iv_opmode == IEEE80211_M_IBSS || 2033 vap->iv_opmode == IEEE80211_M_AHDEMO) { 2034 /* 2035 * In adhoc mode cons up a node for the destination. 2036 * Note that we need an additional reference for the 2037 * caller to be consistent with 2038 * ieee80211_find_node_locked. 2039 */ 2040 /* 2041 * XXX TODO: this doesn't fake up 11n state; we need 2042 * to find another way to get it upgraded. 2043 */ 2044 ni = ieee80211_fakeup_adhoc_node(vap, macaddr); 2045 if (ni != NULL) 2046 (void) ieee80211_ref_node(ni); 2047 } else { 2048 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT, macaddr, 2049 "no node, discard frame (%s)", __func__); 2050 vap->iv_stats.is_tx_nonode++; 2051 } 2052 } 2053 return ni; 2054 } 2055 2056 static void 2057 __ieee80211_free_node(struct ieee80211_node *ni) 2058 { 2059 struct ieee80211_node_table *nt = ni->ni_table; 2060 2061 /* 2062 * NB: careful about referencing the vap as it may be 2063 * gone if the last reference was held by a driver. 2064 * We know the com will always be present so it's safe 2065 * to use ni_ic below to reclaim resources. 2066 */ 2067 #if 0 2068 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 2069 "%s %p<%s> in %s table\n", __func__, ni, 2070 ether_sprintf(ni->ni_macaddr), 2071 nt != NULL ? nt->nt_name : "<gone>"); 2072 #endif 2073 if (ni->ni_associd != 0) { 2074 struct ieee80211vap *vap = ni->ni_vap; 2075 if (vap->iv_aid_bitmap != NULL) 2076 IEEE80211_AID_CLR(vap, ni->ni_associd); 2077 } 2078 if (nt != NULL) 2079 ieee80211_del_node_nt(nt, ni); 2080 ni->ni_ic->ic_node_free(ni); 2081 } 2082 2083 /* 2084 * Clear any entry in the unicast key mapping table. 2085 */ 2086 static int 2087 node_clear_keyixmap(struct ieee80211_node_table *nt, struct ieee80211_node *ni) 2088 { 2089 ieee80211_keyix keyix; 2090 2091 keyix = ni->ni_ucastkey.wk_rxkeyix; 2092 if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax && 2093 nt->nt_keyixmap[keyix] == ni) { 2094 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE, 2095 "%s: %p<%s> clear key map entry %u\n", 2096 __func__, ni, ether_sprintf(ni->ni_macaddr), keyix); 2097 nt->nt_keyixmap[keyix] = NULL; 2098 ieee80211_node_decref(ni); 2099 return 1; 2100 } 2101 2102 return 0; 2103 } 2104 2105 void 2106 _ieee80211_free_node(struct ieee80211_node *ni, 2107 const char *func __debrefcnt_used, int line __debrefcnt_used) 2108 { 2109 struct ieee80211_node_table *nt = ni->ni_table; 2110 2111 #ifdef IEEE80211_DEBUG_REFCNT 2112 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE, 2113 "%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni, 2114 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)-1); 2115 #endif 2116 if (nt != NULL) { 2117 IEEE80211_NODE_LOCK(nt); 2118 if (ieee80211_node_dectestref(ni)) { 2119 /* 2120 * Last reference, reclaim state. 2121 */ 2122 __ieee80211_free_node(ni); 2123 } else if (ieee80211_node_refcnt(ni) == 1) 2124 if (node_clear_keyixmap(nt, ni)) 2125 __ieee80211_free_node(ni); 2126 IEEE80211_NODE_UNLOCK(nt); 2127 } else { 2128 if (ieee80211_node_dectestref(ni)) 2129 __ieee80211_free_node(ni); 2130 } 2131 } 2132 2133 /* 2134 * Reclaim a unicast key and clear any key cache state. 2135 */ 2136 int 2137 ieee80211_node_delucastkey(struct ieee80211_node *ni) 2138 { 2139 struct ieee80211com *ic = ni->ni_ic; 2140 struct ieee80211_node_table *nt = &ic->ic_sta; 2141 struct ieee80211_node *nikey; 2142 ieee80211_keyix keyix; 2143 int isowned, status; 2144 2145 /* 2146 * NB: We must beware of LOR here; deleting the key 2147 * can cause the crypto layer to block traffic updates 2148 * which can generate a LOR against the node table lock; 2149 * grab it here and stash the key index for our use below. 2150 * 2151 * Must also beware of recursion on the node table lock. 2152 * When called from node_cleanup we may already have 2153 * the node table lock held. Unfortunately there's no 2154 * way to separate out this path so we must do this 2155 * conditionally. 2156 */ 2157 isowned = IEEE80211_NODE_IS_LOCKED(nt); 2158 if (!isowned) 2159 IEEE80211_NODE_LOCK(nt); 2160 nikey = NULL; 2161 status = 1; /* NB: success */ 2162 if (ni->ni_ucastkey.wk_keyix != IEEE80211_KEYIX_NONE) { 2163 keyix = ni->ni_ucastkey.wk_rxkeyix; 2164 status = ieee80211_crypto_delkey(ni->ni_vap, &ni->ni_ucastkey); 2165 if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax) { 2166 nikey = nt->nt_keyixmap[keyix]; 2167 nt->nt_keyixmap[keyix] = NULL; 2168 } 2169 } 2170 if (!isowned) 2171 IEEE80211_NODE_UNLOCK(nt); 2172 2173 if (nikey != NULL) { 2174 KASSERT(nikey == ni, 2175 ("key map out of sync, ni %p nikey %p", ni, nikey)); 2176 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE, 2177 "%s: delete key map entry %p<%s> refcnt %d\n", 2178 __func__, ni, ether_sprintf(ni->ni_macaddr), 2179 ieee80211_node_refcnt(ni)-1); 2180 ieee80211_free_node(ni); 2181 } 2182 return status; 2183 } 2184 2185 /* 2186 * Reclaim a node. If this is the last reference count then 2187 * do the normal free work. Otherwise remove it from the node 2188 * table and mark it gone by clearing the back-reference. 2189 */ 2190 static void 2191 node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni) 2192 { 2193 2194 IEEE80211_NODE_LOCK_ASSERT(nt); 2195 2196 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE, 2197 "%s: remove %p<%s> from %s table, refcnt %d\n", 2198 __func__, ni, ether_sprintf(ni->ni_macaddr), 2199 nt->nt_name, ieee80211_node_refcnt(ni)-1); 2200 /* 2201 * Clear any entry in the unicast key mapping table. 2202 * We need to do it here so rx lookups don't find it 2203 * in the mapping table even if it's not in the hash 2204 * table. We cannot depend on the mapping table entry 2205 * being cleared because the node may not be free'd. 2206 */ 2207 (void)node_clear_keyixmap(nt, ni); 2208 if (!ieee80211_node_dectestref(ni)) { 2209 /* 2210 * Other references are present, just remove the 2211 * node from the table so it cannot be found. When 2212 * the references are dropped storage will be 2213 * reclaimed. 2214 */ 2215 ieee80211_del_node_nt(nt, ni); 2216 } else 2217 __ieee80211_free_node(ni); 2218 } 2219 2220 /* 2221 * Node table support. 2222 */ 2223 2224 static void 2225 ieee80211_node_table_init(struct ieee80211com *ic, 2226 struct ieee80211_node_table *nt, 2227 const char *name, int inact, int keyixmax) 2228 { 2229 2230 nt->nt_ic = ic; 2231 IEEE80211_NODE_LOCK_INIT(nt, ic->ic_name); 2232 TAILQ_INIT(&nt->nt_node); 2233 nt->nt_count = 0; 2234 nt->nt_name = name; 2235 nt->nt_inact_init = inact; 2236 nt->nt_keyixmax = keyixmax; 2237 if (nt->nt_keyixmax > 0) { 2238 nt->nt_keyixmap = (struct ieee80211_node **) IEEE80211_MALLOC( 2239 keyixmax * sizeof(struct ieee80211_node *), 2240 M_80211_NODE, 2241 IEEE80211_M_NOWAIT | IEEE80211_M_ZERO); 2242 if (nt->nt_keyixmap == NULL) 2243 ic_printf(ic, 2244 "Cannot allocate key index map with %u entries\n", 2245 keyixmax); 2246 } else 2247 nt->nt_keyixmap = NULL; 2248 } 2249 2250 static void 2251 ieee80211_node_table_reset(struct ieee80211_node_table *nt, 2252 struct ieee80211vap *match) 2253 { 2254 struct ieee80211_node *ni, *next; 2255 2256 IEEE80211_NODE_LOCK(nt); 2257 TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next) { 2258 if (match != NULL && ni->ni_vap != match) 2259 continue; 2260 /* XXX can this happen? if so need's work */ 2261 if (ni->ni_associd != 0) { 2262 struct ieee80211vap *vap = ni->ni_vap; 2263 2264 if (vap->iv_auth->ia_node_leave != NULL) 2265 vap->iv_auth->ia_node_leave(ni); 2266 if (vap->iv_aid_bitmap != NULL) 2267 IEEE80211_AID_CLR(vap, ni->ni_associd); 2268 } 2269 ni->ni_wdsvap = NULL; /* clear reference */ 2270 node_reclaim(nt, ni); 2271 } 2272 if (match != NULL && match->iv_opmode == IEEE80211_M_WDS) { 2273 /* 2274 * Make a separate pass to clear references to this vap 2275 * held by DWDS entries. They will not be matched above 2276 * because ni_vap will point to the ap vap but we still 2277 * need to clear ni_wdsvap when the WDS vap is destroyed 2278 * and/or reset. 2279 */ 2280 TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next) 2281 if (ni->ni_wdsvap == match) 2282 ni->ni_wdsvap = NULL; 2283 } 2284 IEEE80211_NODE_UNLOCK(nt); 2285 } 2286 2287 static void 2288 ieee80211_node_table_cleanup(struct ieee80211_node_table *nt) 2289 { 2290 ieee80211_node_table_reset(nt, NULL); 2291 if (nt->nt_keyixmap != NULL) { 2292 #ifdef DIAGNOSTIC 2293 /* XXX verify all entries are NULL */ 2294 int i; 2295 for (i = 0; i < nt->nt_keyixmax; i++) 2296 if (nt->nt_keyixmap[i] != NULL) 2297 printf("%s: %s[%u] still active\n", __func__, 2298 nt->nt_name, i); 2299 #endif 2300 IEEE80211_FREE(nt->nt_keyixmap, M_80211_NODE); 2301 nt->nt_keyixmap = NULL; 2302 } 2303 IEEE80211_NODE_LOCK_DESTROY(nt); 2304 } 2305 2306 static void 2307 timeout_stations(void *arg __unused, struct ieee80211_node *ni) 2308 { 2309 struct ieee80211com *ic = ni->ni_ic; 2310 struct ieee80211vap *vap = ni->ni_vap; 2311 2312 /* 2313 * Only process stations when in RUN state. This 2314 * insures, for example, that we don't timeout an 2315 * inactive station during CAC. Note that CSA state 2316 * is actually handled in ieee80211_node_timeout as 2317 * it applies to more than timeout processing. 2318 */ 2319 if (vap->iv_state != IEEE80211_S_RUN) 2320 return; 2321 /* 2322 * Ignore entries for which have yet to receive an 2323 * authentication frame. These are transient and 2324 * will be reclaimed when the last reference to them 2325 * goes away (when frame xmits complete). 2326 */ 2327 if ((vap->iv_opmode == IEEE80211_M_HOSTAP || 2328 vap->iv_opmode == IEEE80211_M_STA) && 2329 (ni->ni_flags & IEEE80211_NODE_AREF) == 0) 2330 return; 2331 /* 2332 * Free fragment if not needed anymore 2333 * (last fragment older than 1s). 2334 * XXX doesn't belong here, move to node_age 2335 */ 2336 if (ni->ni_rxfrag[0] != NULL && 2337 ticks > ni->ni_rxfragstamp + hz) { 2338 m_freem(ni->ni_rxfrag[0]); 2339 ni->ni_rxfrag[0] = NULL; 2340 } 2341 if (ni->ni_inact > 0) { 2342 ni->ni_inact--; 2343 IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni, 2344 "%s: inact %u inact_reload %u nrates %u", 2345 __func__, ni->ni_inact, ni->ni_inact_reload, 2346 ni->ni_rates.rs_nrates); 2347 } 2348 /* 2349 * Special case ourself; we may be idle for extended periods 2350 * of time and regardless reclaiming our state is wrong. 2351 * XXX run ic_node_age 2352 */ 2353 /* XXX before inact decrement? */ 2354 if (ni == vap->iv_bss) 2355 return; 2356 if (ni->ni_associd != 0 || 2357 (vap->iv_opmode == IEEE80211_M_IBSS || 2358 vap->iv_opmode == IEEE80211_M_AHDEMO)) { 2359 /* 2360 * Age/drain resources held by the station. 2361 */ 2362 ic->ic_node_age(ni); 2363 /* 2364 * Probe the station before time it out. We 2365 * send a null data frame which may not be 2366 * universally supported by drivers (need it 2367 * for ps-poll support so it should be...). 2368 * 2369 * XXX don't probe the station unless we've 2370 * received a frame from them (and have 2371 * some idea of the rates they are capable 2372 * of); this will get fixed more properly 2373 * soon with better handling of the rate set. 2374 */ 2375 if ((vap->iv_flags_ext & IEEE80211_FEXT_INACT) && 2376 (0 < ni->ni_inact && 2377 ni->ni_inact <= vap->iv_inact_probe) && 2378 ni->ni_rates.rs_nrates != 0) { 2379 IEEE80211_NOTE(vap, 2380 IEEE80211_MSG_INACT | IEEE80211_MSG_NODE, 2381 ni, "%s", 2382 "probe station due to inactivity"); 2383 /* 2384 * Grab a reference so the node cannot 2385 * be reclaimed before we send the frame. 2386 * ieee80211_send_nulldata understands 2387 * we've done this and reclaims the 2388 * ref for us as needed. 2389 */ 2390 /* XXX fix this (not required anymore). */ 2391 ieee80211_ref_node(ni); 2392 /* XXX useless */ 2393 ieee80211_send_nulldata(ni); 2394 /* XXX stat? */ 2395 return; 2396 } 2397 } 2398 if ((vap->iv_flags_ext & IEEE80211_FEXT_INACT) && 2399 ni->ni_inact <= 0) { 2400 IEEE80211_NOTE(vap, 2401 IEEE80211_MSG_INACT | IEEE80211_MSG_NODE, ni, 2402 "station timed out due to inactivity " 2403 "(refcnt %u)", ieee80211_node_refcnt(ni)); 2404 /* 2405 * Send a deauthenticate frame and drop the station. 2406 * This is somewhat complicated due to reference counts 2407 * and locking. At this point a station will typically 2408 * have a reference count of 2. ieee80211_node_leave 2409 * will do a "free" of the node which will drop the 2410 * reference count. But in the meantime a reference 2411 * wil be held by the deauth frame. The actual reclaim 2412 * of the node will happen either after the tx is 2413 * completed or by ieee80211_node_leave. 2414 */ 2415 if (ni->ni_associd != 0) { 2416 IEEE80211_SEND_MGMT(ni, 2417 IEEE80211_FC0_SUBTYPE_DEAUTH, 2418 IEEE80211_REASON_AUTH_EXPIRE); 2419 } 2420 ieee80211_node_leave(ni); 2421 vap->iv_stats.is_node_timeout++; 2422 } 2423 } 2424 2425 /* 2426 * Timeout inactive stations and do related housekeeping. 2427 */ 2428 static void 2429 ieee80211_timeout_stations(struct ieee80211com *ic) 2430 { 2431 struct ieee80211_node_table *nt = &ic->ic_sta; 2432 2433 ieee80211_iterate_nodes(nt, timeout_stations, NULL); 2434 } 2435 2436 /* 2437 * Aggressively reclaim resources. This should be used 2438 * only in a critical situation to reclaim mbuf resources. 2439 */ 2440 void 2441 ieee80211_drain(struct ieee80211com *ic) 2442 { 2443 struct ieee80211_node_table *nt = &ic->ic_sta; 2444 struct ieee80211vap *vap; 2445 struct ieee80211_node *ni; 2446 2447 IEEE80211_NODE_LOCK(nt); 2448 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) { 2449 /* 2450 * Ignore entries for which have yet to receive an 2451 * authentication frame. These are transient and 2452 * will be reclaimed when the last reference to them 2453 * goes away (when frame xmits complete). 2454 */ 2455 vap = ni->ni_vap; 2456 /* 2457 * Only process stations when in RUN state. This 2458 * insures, for example, that we don't timeout an 2459 * inactive station during CAC. Note that CSA state 2460 * is actually handled in ieee80211_node_timeout as 2461 * it applies to more than timeout processing. 2462 */ 2463 if (vap->iv_state != IEEE80211_S_RUN) 2464 continue; 2465 /* XXX can vap be NULL? */ 2466 if ((vap->iv_opmode == IEEE80211_M_HOSTAP || 2467 vap->iv_opmode == IEEE80211_M_STA) && 2468 (ni->ni_flags & IEEE80211_NODE_AREF) == 0) 2469 continue; 2470 /* 2471 * Free fragments. 2472 * XXX doesn't belong here, move to node_drain 2473 */ 2474 if (ni->ni_rxfrag[0] != NULL) { 2475 m_freem(ni->ni_rxfrag[0]); 2476 ni->ni_rxfrag[0] = NULL; 2477 } 2478 /* 2479 * Drain resources held by the station. 2480 */ 2481 ic->ic_node_drain(ni); 2482 } 2483 IEEE80211_NODE_UNLOCK(nt); 2484 } 2485 2486 /* 2487 * Per-ieee80211vap inactivity timer callback. 2488 */ 2489 static void 2490 ieee80211_vap_timeout(struct ieee80211vap *vap) 2491 { 2492 2493 IEEE80211_LOCK_ASSERT(vap->iv_ic); 2494 2495 ieee80211_vap_erp_timeout(vap); 2496 ieee80211_ht_timeout(vap); 2497 ieee80211_vht_timeout(vap); 2498 } 2499 2500 /* 2501 * Per-ieee80211com inactivity timer callback. 2502 */ 2503 void 2504 ieee80211_node_timeout(void *arg) 2505 { 2506 struct ieee80211com *ic = arg; 2507 struct ieee80211vap *vap; 2508 2509 /* 2510 * Defer timeout processing if a channel switch is pending. 2511 * We typically need to be mute so not doing things that 2512 * might generate frames is good to handle in one place. 2513 * Suppressing the station timeout processing may extend the 2514 * lifetime of inactive stations (by not decrementing their 2515 * idle counters) but this should be ok unless the CSA is 2516 * active for an unusually long time. 2517 */ 2518 if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) { 2519 ieee80211_scan_timeout(ic); 2520 ieee80211_timeout_stations(ic); 2521 ieee80211_ageq_age(&ic->ic_stageq, IEEE80211_INACT_WAIT); 2522 2523 IEEE80211_LOCK(ic); 2524 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) 2525 ieee80211_vap_timeout(vap); 2526 IEEE80211_UNLOCK(ic); 2527 } 2528 callout_reset(&ic->ic_inact, IEEE80211_INACT_WAIT*hz, 2529 ieee80211_node_timeout, ic); 2530 } 2531 2532 /* 2533 * The same as ieee80211_iterate_nodes(), but for one vap only. 2534 */ 2535 int 2536 ieee80211_iterate_nodes_vap(struct ieee80211_node_table *nt, 2537 struct ieee80211vap *vap, ieee80211_iter_func *f, void *arg) 2538 { 2539 struct ieee80211_node **ni_arr; 2540 struct ieee80211_node *ni; 2541 size_t size; 2542 int count, i; 2543 2544 /* 2545 * Iterate over the node table and save an array of ref'ed nodes. 2546 * 2547 * This is separated out from calling the actual node function so that 2548 * no LORs will occur. 2549 */ 2550 IEEE80211_NODE_LOCK(nt); 2551 count = nt->nt_count; 2552 size = count * sizeof(struct ieee80211_node *); 2553 ni_arr = (struct ieee80211_node **) IEEE80211_MALLOC(size, M_80211_NODE, 2554 IEEE80211_M_NOWAIT | IEEE80211_M_ZERO); 2555 if (ni_arr == NULL) { 2556 IEEE80211_NODE_UNLOCK(nt); 2557 return (ENOMEM); 2558 } 2559 2560 i = 0; 2561 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) { 2562 if (vap != NULL && ni->ni_vap != vap) 2563 continue; 2564 KASSERT(i < count, 2565 ("node array overflow (vap %p, i %d, count %d)\n", 2566 vap, i, count)); 2567 ni_arr[i] = ieee80211_ref_node(ni); 2568 i++; 2569 } 2570 IEEE80211_NODE_UNLOCK(nt); 2571 2572 for (i = 0; i < count; i++) { 2573 if (ni_arr[i] == NULL) /* end of the list */ 2574 break; 2575 (*f)(arg, ni_arr[i]); 2576 /* ieee80211_free_node() locks by itself */ 2577 ieee80211_free_node(ni_arr[i]); 2578 } 2579 2580 IEEE80211_FREE(ni_arr, M_80211_NODE); 2581 2582 return (0); 2583 } 2584 2585 /* 2586 * Just a wrapper, so we don't have to change every ieee80211_iterate_nodes() 2587 * reference in the source. 2588 */ 2589 void 2590 ieee80211_iterate_nodes(struct ieee80211_node_table *nt, 2591 ieee80211_iter_func *f, void *arg) 2592 { 2593 /* XXX no way to pass error to the caller. */ 2594 (void) ieee80211_iterate_nodes_vap(nt, NULL, f, arg); 2595 } 2596 2597 void 2598 ieee80211_dump_node(struct ieee80211_node_table *nt __unused, 2599 struct ieee80211_node *ni) 2600 { 2601 printf("%p: mac %s refcnt %d\n", ni, 2602 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)); 2603 printf("\tauthmode %u flags 0x%x\n", 2604 ni->ni_authmode, ni->ni_flags); 2605 printf("\tassocid 0x%x txpower %u vlan %u\n", 2606 ni->ni_associd, ni->ni_txpower, ni->ni_vlan); 2607 printf("\ttxseq %u rxseq %u fragno %u rxfragstamp %u\n", 2608 ni->ni_txseqs[IEEE80211_NONQOS_TID], 2609 ni->ni_rxseqs[IEEE80211_NONQOS_TID] >> IEEE80211_SEQ_SEQ_SHIFT, 2610 ni->ni_rxseqs[IEEE80211_NONQOS_TID] & IEEE80211_SEQ_FRAG_MASK, 2611 ni->ni_rxfragstamp); 2612 printf("\trssi %d noise %d intval %u capinfo 0x%x\n", 2613 node_getrssi(ni), ni->ni_noise, 2614 ni->ni_intval, ni->ni_capinfo); 2615 printf("\tbssid %s essid \"%.*s\" channel %u:0x%x\n", 2616 ether_sprintf(ni->ni_bssid), 2617 ni->ni_esslen, ni->ni_essid, 2618 ni->ni_chan->ic_freq, ni->ni_chan->ic_flags); 2619 printf("\tinact %u inact_reload %u txrate %u\n", 2620 ni->ni_inact, ni->ni_inact_reload, ni->ni_txrate); 2621 printf("\thtcap %x htparam %x htctlchan %u ht2ndchan %u\n", 2622 ni->ni_htcap, ni->ni_htparam, 2623 ni->ni_htctlchan, ni->ni_ht2ndchan); 2624 printf("\thtopmode %x htstbc %x htchw %u\n", 2625 ni->ni_htopmode, ni->ni_htstbc, ni->ni_chw); 2626 printf("\tvhtcap %x freq1 %d freq2 %d vhtbasicmcs %x\n", 2627 ni->ni_vhtcap, (int) ni->ni_vht_chan1, (int) ni->ni_vht_chan2, 2628 (int) ni->ni_vht_basicmcs); 2629 /* XXX VHT state */ 2630 } 2631 2632 void 2633 ieee80211_dump_nodes(struct ieee80211_node_table *nt) 2634 { 2635 ieee80211_iterate_nodes(nt, 2636 (ieee80211_iter_func *) ieee80211_dump_node, nt); 2637 } 2638 2639 /* 2640 * Iterate over the VAPs and update their ERP beacon IEs. 2641 * 2642 * Note this must be called from the deferred ERP update task paths. 2643 */ 2644 void 2645 ieee80211_notify_erp_locked(struct ieee80211com *ic) 2646 { 2647 struct ieee80211vap *vap; 2648 2649 IEEE80211_LOCK_ASSERT(ic); 2650 2651 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) 2652 if (vap->iv_opmode == IEEE80211_M_HOSTAP) 2653 ieee80211_beacon_notify(vap, IEEE80211_BEACON_ERP); 2654 } 2655 2656 /* 2657 * Handle a station joining an 11g network. 2658 */ 2659 static void 2660 ieee80211_node_join_11g(struct ieee80211_node *ni) 2661 { 2662 struct ieee80211com *ic = ni->ni_ic; 2663 struct ieee80211vap *vap = ni->ni_vap; 2664 2665 IEEE80211_LOCK_ASSERT(ic); 2666 2667 /* 2668 * Station isn't capable of short slot time. Bump 2669 * the count of long slot time stations and disable 2670 * use of short slot time. Note that the actual switch 2671 * over to long slot time use may not occur until the 2672 * next beacon transmission (per sec. 7.3.1.4 of 11g). 2673 */ 2674 if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) { 2675 vap->iv_longslotsta++; 2676 IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni, 2677 "station needs long slot time, count %d", 2678 vap->iv_longslotsta); 2679 /* 2680 * XXX TODO: this may need all VAPs checked! 2681 */ 2682 if (!IEEE80211_IS_CHAN_108G(ic->ic_bsschan)) { 2683 /* 2684 * Don't force slot time when switched to turbo 2685 * mode as non-ERP stations won't be present; this 2686 * need only be done when on the normal G channel. 2687 */ 2688 ieee80211_vap_set_shortslottime(vap, 0); 2689 } 2690 } 2691 /* 2692 * If the new station is not an ERP station 2693 * then bump the counter and enable protection 2694 * if configured. 2695 */ 2696 if (!ieee80211_iserp_rateset(&ni->ni_rates)) { 2697 vap->iv_nonerpsta++; 2698 IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni, 2699 "station is !ERP, %d non-ERP stations associated", 2700 vap->iv_nonerpsta); 2701 /* 2702 * If station does not support short preamble 2703 * then we must enable use of Barker preamble. 2704 */ 2705 if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) == 0) { 2706 IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni, 2707 "%s", "station needs long preamble"); 2708 vap->iv_flags |= IEEE80211_F_USEBARKER; 2709 vap->iv_flags &= ~IEEE80211_F_SHPREAMBLE; 2710 ieee80211_vap_update_preamble(vap); 2711 } 2712 /* 2713 * If protection is configured and this is the first 2714 * indication we should use protection, enable it. 2715 */ 2716 if (vap->iv_protmode != IEEE80211_PROT_NONE && 2717 vap->iv_nonerpsta == 1 && 2718 (vap->iv_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0) { 2719 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_ASSOC, 2720 "%s: enable use of protection\n", __func__); 2721 vap->iv_flags |= IEEE80211_F_USEPROT; 2722 ieee80211_vap_update_erp_protmode(vap); 2723 } 2724 } else 2725 ni->ni_flags |= IEEE80211_NODE_ERP; 2726 } 2727 2728 void 2729 ieee80211_node_join(struct ieee80211_node *ni, int resp) 2730 { 2731 struct ieee80211com *ic = ni->ni_ic; 2732 struct ieee80211vap *vap = ni->ni_vap; 2733 int newassoc; 2734 2735 if (ni->ni_associd == 0) { 2736 uint16_t aid; 2737 2738 KASSERT(vap->iv_aid_bitmap != NULL, ("no aid bitmap")); 2739 /* 2740 * It would be good to search the bitmap 2741 * more efficiently, but this will do for now. 2742 */ 2743 for (aid = 1; aid < vap->iv_max_aid; aid++) { 2744 if (!IEEE80211_AID_ISSET(vap, aid)) 2745 break; 2746 } 2747 if (aid >= vap->iv_max_aid) { 2748 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_TOOMANY); 2749 ieee80211_node_leave(ni); 2750 return; 2751 } 2752 ni->ni_associd = aid | 0xc000; 2753 ni->ni_jointime = time_uptime; 2754 IEEE80211_LOCK(ic); 2755 IEEE80211_AID_SET(vap, ni->ni_associd); 2756 vap->iv_sta_assoc++; 2757 2758 if (IEEE80211_IS_CHAN_HT(ic->ic_bsschan)) 2759 ieee80211_ht_node_join(ni); 2760 if (IEEE80211_IS_CHAN_VHT(ic->ic_bsschan)) 2761 ieee80211_vht_node_join(ni); 2762 if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) && 2763 IEEE80211_IS_CHAN_FULL(ic->ic_bsschan)) 2764 ieee80211_node_join_11g(ni); 2765 IEEE80211_UNLOCK(ic); 2766 2767 newassoc = 1; 2768 } else 2769 newassoc = 0; 2770 2771 /* 2772 * XXX VHT - should log VHT channel width, etc 2773 */ 2774 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, ni, 2775 "station associated at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s%s", 2776 IEEE80211_NODE_AID(ni), 2777 vap->iv_flags & IEEE80211_F_SHPREAMBLE ? "short" : "long", 2778 vap->iv_flags & IEEE80211_F_SHSLOT ? "short" : "long", 2779 vap->iv_flags & IEEE80211_F_USEPROT ? ", protection" : "", 2780 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "", 2781 /* XXX update for VHT string */ 2782 ni->ni_flags & IEEE80211_NODE_HT ? 2783 (ni->ni_chw == 40 ? ", HT40" : ", HT20") : "", 2784 ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "", 2785 ni->ni_flags & IEEE80211_NODE_AMSDU ? " (+AMSDU)" : "", 2786 ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" : 2787 ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "", 2788 ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "", 2789 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ? 2790 ", fast-frames" : "", 2791 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ? 2792 ", turbo" : "" 2793 ); 2794 2795 ieee80211_node_setuptxparms(ni); 2796 ieee80211_ratectl_node_init(ni); 2797 /* give driver a chance to setup state like ni_txrate */ 2798 if (ic->ic_newassoc != NULL) 2799 ic->ic_newassoc(ni, newassoc); 2800 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_SUCCESS); 2801 /* tell the authenticator about new station */ 2802 if (vap->iv_auth->ia_node_join != NULL) 2803 vap->iv_auth->ia_node_join(ni); 2804 ieee80211_notify_node_join(ni, 2805 resp == IEEE80211_FC0_SUBTYPE_ASSOC_RESP); 2806 } 2807 2808 static void 2809 disable_protection(struct ieee80211vap *vap) 2810 { 2811 struct ieee80211com *ic = vap->iv_ic; 2812 2813 KASSERT(vap->iv_nonerpsta == 0 && 2814 (vap->iv_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0, 2815 ("%d non ERP stations, flags 0x%x", vap->iv_nonerpsta, 2816 vap->iv_flags_ext)); 2817 2818 vap->iv_flags &= ~IEEE80211_F_USEPROT; 2819 /* XXX verify mode? */ 2820 if (ic->ic_caps & IEEE80211_C_SHPREAMBLE) { 2821 vap->iv_flags |= IEEE80211_F_SHPREAMBLE; 2822 vap->iv_flags &= ~IEEE80211_F_USEBARKER; 2823 } 2824 ieee80211_vap_update_erp_protmode(vap); 2825 ieee80211_vap_update_preamble(vap); 2826 } 2827 2828 /* 2829 * Handle a station leaving an 11g network. 2830 */ 2831 static void 2832 ieee80211_node_leave_11g(struct ieee80211_node *ni) 2833 { 2834 struct ieee80211com *ic = ni->ni_ic; 2835 struct ieee80211vap *vap = ni->ni_vap; 2836 2837 IEEE80211_LOCK_ASSERT(ic); 2838 2839 KASSERT(IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan), 2840 ("not in 11g, bss %u:0x%x", ic->ic_bsschan->ic_freq, 2841 ic->ic_bsschan->ic_flags)); 2842 2843 /* 2844 * If a long slot station do the slot time bookkeeping. 2845 */ 2846 if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) { 2847 KASSERT(vap->iv_longslotsta > 0, 2848 ("bogus long slot station count %d", vap->iv_longslotsta)); 2849 vap->iv_longslotsta--; 2850 IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni, 2851 "long slot time station leaves, count now %d", 2852 vap->iv_longslotsta); 2853 /* 2854 * XXX TODO: this may need all VAPs checked! 2855 */ 2856 if (vap->iv_longslotsta == 0) { 2857 /* 2858 * Re-enable use of short slot time if supported 2859 * and not operating in IBSS mode (per spec). 2860 */ 2861 if ((ic->ic_caps & IEEE80211_C_SHSLOT) && 2862 ic->ic_opmode != IEEE80211_M_IBSS) { 2863 IEEE80211_DPRINTF(ni->ni_vap, 2864 IEEE80211_MSG_ASSOC, 2865 "%s: re-enable use of short slot time\n", 2866 __func__); 2867 ieee80211_vap_set_shortslottime(vap, 1); 2868 } 2869 } 2870 } 2871 /* 2872 * If a non-ERP station do the protection-related bookkeeping. 2873 */ 2874 if ((ni->ni_flags & IEEE80211_NODE_ERP) == 0) { 2875 KASSERT(vap->iv_nonerpsta > 0, 2876 ("bogus non-ERP station count %d", vap->iv_nonerpsta)); 2877 vap->iv_nonerpsta--; 2878 IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ASSOC, ni, 2879 "non-ERP station leaves, count now %d%s", vap->iv_nonerpsta, 2880 (vap->iv_flags_ext & IEEE80211_FEXT_NONERP_PR) ? 2881 " (non-ERP sta present)" : ""); 2882 if (vap->iv_nonerpsta == 0 && 2883 (vap->iv_flags_ext & IEEE80211_FEXT_NONERP_PR) == 0) { 2884 IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_ASSOC, 2885 "%s: disable use of protection\n", __func__); 2886 disable_protection(vap); 2887 } 2888 } 2889 } 2890 2891 /* 2892 * Time out presence of an overlapping bss with non-ERP 2893 * stations. When operating in hostap mode we listen for 2894 * beacons from other stations and if we identify a non-ERP 2895 * station is present we enable protection. To identify 2896 * when all non-ERP stations are gone we time out this 2897 * condition. 2898 */ 2899 static void 2900 ieee80211_vap_erp_timeout(struct ieee80211vap *vap) 2901 { 2902 2903 IEEE80211_LOCK_ASSERT(vap->iv_ic); 2904 2905 if ((vap->iv_flags_ext & IEEE80211_FEXT_NONERP_PR) && 2906 ieee80211_time_after(ticks, vap->iv_lastnonerp + IEEE80211_NONERP_PRESENT_AGE)) { 2907 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC, 2908 "%s", "age out non-ERP sta present on channel"); 2909 vap->iv_flags_ext &= ~IEEE80211_FEXT_NONERP_PR; 2910 if (vap->iv_nonerpsta == 0) 2911 disable_protection(vap); 2912 } 2913 } 2914 2915 /* 2916 * Handle bookkeeping for station deauthentication/disassociation 2917 * when operating as an ap. 2918 */ 2919 void 2920 ieee80211_node_leave(struct ieee80211_node *ni) 2921 { 2922 struct ieee80211com *ic = ni->ni_ic; 2923 struct ieee80211vap *vap = ni->ni_vap; 2924 struct ieee80211_node_table *nt = ni->ni_table; 2925 2926 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, ni, 2927 "station with aid %d leaves", IEEE80211_NODE_AID(ni)); 2928 2929 KASSERT(vap->iv_opmode != IEEE80211_M_STA, 2930 ("unexpected operating mode %u", vap->iv_opmode)); 2931 /* 2932 * If node wasn't previously associated all 2933 * we need to do is reclaim the reference. 2934 */ 2935 /* XXX ibss mode bypasses 11g and notification */ 2936 if (ni->ni_associd == 0) 2937 goto done; 2938 /* 2939 * Tell the authenticator the station is leaving. 2940 * Note that we must do this before yanking the 2941 * association id as the authenticator uses the 2942 * associd to locate it's state block. 2943 */ 2944 if (vap->iv_auth->ia_node_leave != NULL) 2945 vap->iv_auth->ia_node_leave(ni); 2946 2947 IEEE80211_LOCK(ic); 2948 IEEE80211_AID_CLR(vap, ni->ni_associd); 2949 vap->iv_sta_assoc--; 2950 2951 if (IEEE80211_IS_CHAN_VHT(ic->ic_bsschan)) 2952 ieee80211_vht_node_leave(ni); 2953 if (IEEE80211_IS_CHAN_HT(ic->ic_bsschan)) 2954 ieee80211_ht_node_leave(ni); 2955 if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) && 2956 IEEE80211_IS_CHAN_FULL(ic->ic_bsschan)) 2957 ieee80211_node_leave_11g(ni); 2958 IEEE80211_UNLOCK(ic); 2959 /* 2960 * Cleanup station state. In particular clear various 2961 * state that might otherwise be reused if the node 2962 * is reused before the reference count goes to zero 2963 * (and memory is reclaimed). 2964 */ 2965 ieee80211_sta_leave(ni); 2966 done: 2967 /* 2968 * Remove the node from any table it's recorded in and 2969 * drop the caller's reference. Removal from the table 2970 * is important to insure the node is not reprocessed 2971 * for inactivity. 2972 */ 2973 if (nt != NULL) { 2974 IEEE80211_NODE_LOCK(nt); 2975 node_reclaim(nt, ni); 2976 IEEE80211_NODE_UNLOCK(nt); 2977 } else 2978 ieee80211_free_node(ni); 2979 } 2980 2981 struct rssiinfo { 2982 int rssi_samples; 2983 uint32_t rssi_total; 2984 }; 2985 2986 static void 2987 get_hostap_rssi(void *arg, struct ieee80211_node *ni) 2988 { 2989 struct rssiinfo *info = arg; 2990 struct ieee80211vap *vap = ni->ni_vap; 2991 int8_t rssi; 2992 2993 /* only associated stations */ 2994 if (ni->ni_associd == 0) 2995 return; 2996 rssi = vap->iv_ic->ic_node_getrssi(ni); 2997 if (rssi != 0) { 2998 info->rssi_samples++; 2999 info->rssi_total += rssi; 3000 } 3001 } 3002 3003 static void 3004 get_adhoc_rssi(void *arg, struct ieee80211_node *ni) 3005 { 3006 struct rssiinfo *info = arg; 3007 struct ieee80211vap *vap = ni->ni_vap; 3008 int8_t rssi; 3009 3010 /* only neighbors */ 3011 /* XXX check bssid */ 3012 if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0) 3013 return; 3014 rssi = vap->iv_ic->ic_node_getrssi(ni); 3015 if (rssi != 0) { 3016 info->rssi_samples++; 3017 info->rssi_total += rssi; 3018 } 3019 } 3020 3021 #ifdef IEEE80211_SUPPORT_MESH 3022 static void 3023 get_mesh_rssi(void *arg, struct ieee80211_node *ni) 3024 { 3025 struct rssiinfo *info = arg; 3026 struct ieee80211vap *vap = ni->ni_vap; 3027 int8_t rssi; 3028 3029 /* only neighbors that peered successfully */ 3030 if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) 3031 return; 3032 rssi = vap->iv_ic->ic_node_getrssi(ni); 3033 if (rssi != 0) { 3034 info->rssi_samples++; 3035 info->rssi_total += rssi; 3036 } 3037 } 3038 #endif /* IEEE80211_SUPPORT_MESH */ 3039 3040 int8_t 3041 ieee80211_getrssi(struct ieee80211vap *vap) 3042 { 3043 #define NZ(x) ((x) == 0 ? 1 : (x)) 3044 struct ieee80211com *ic = vap->iv_ic; 3045 struct rssiinfo info; 3046 3047 info.rssi_total = 0; 3048 info.rssi_samples = 0; 3049 switch (vap->iv_opmode) { 3050 case IEEE80211_M_IBSS: /* average of all ibss neighbors */ 3051 case IEEE80211_M_AHDEMO: /* average of all neighbors */ 3052 ieee80211_iterate_nodes_vap(&ic->ic_sta, vap, get_adhoc_rssi, 3053 &info); 3054 break; 3055 case IEEE80211_M_HOSTAP: /* average of all associated stations */ 3056 ieee80211_iterate_nodes_vap(&ic->ic_sta, vap, get_hostap_rssi, 3057 &info); 3058 break; 3059 #ifdef IEEE80211_SUPPORT_MESH 3060 case IEEE80211_M_MBSS: /* average of all mesh neighbors */ 3061 ieee80211_iterate_nodes_vap(&ic->ic_sta, vap, get_mesh_rssi, 3062 &info); 3063 break; 3064 #endif 3065 case IEEE80211_M_MONITOR: /* XXX */ 3066 case IEEE80211_M_STA: /* use stats from associated ap */ 3067 default: 3068 if (vap->iv_bss != NULL) 3069 info.rssi_total = ic->ic_node_getrssi(vap->iv_bss); 3070 info.rssi_samples = 1; 3071 break; 3072 } 3073 return info.rssi_total / NZ(info.rssi_samples); 3074 #undef NZ 3075 } 3076 3077 void 3078 ieee80211_getsignal(struct ieee80211vap *vap, int8_t *rssi, int8_t *noise) 3079 { 3080 3081 if (vap->iv_bss == NULL) /* NB: shouldn't happen */ 3082 return; 3083 vap->iv_ic->ic_node_getsignal(vap->iv_bss, rssi, noise); 3084 /* for non-station mode return avg'd rssi accounting */ 3085 if (vap->iv_opmode != IEEE80211_M_STA) 3086 *rssi = ieee80211_getrssi(vap); 3087 } 3088