13147Sxc151355 /*
2*8594SFei.Feng@Sun.COM  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
33147Sxc151355  * Use is subject to license terms.
43147Sxc151355  */
53147Sxc151355 
63147Sxc151355 /*
73147Sxc151355  * Copyright (c) 2001 Atsushi Onoe
8*8594SFei.Feng@Sun.COM  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
93147Sxc151355  * All rights reserved.
103147Sxc151355  *
113147Sxc151355  * Redistribution and use in source and binary forms, with or without
123147Sxc151355  * modification, are permitted provided that the following conditions
133147Sxc151355  * are met:
143147Sxc151355  * 1. Redistributions of source code must retain the above copyright
153147Sxc151355  *    notice, this list of conditions and the following disclaimer.
163147Sxc151355  * 2. Redistributions in binary form must reproduce the above copyright
173147Sxc151355  *    notice, this list of conditions and the following disclaimer in the
183147Sxc151355  *    documentation and/or other materials provided with the distribution.
193147Sxc151355  * 3. The name of the author may not be used to endorse or promote products
203147Sxc151355  *    derived from this software without specific prior written permission.
213147Sxc151355  *
223147Sxc151355  * Alternatively, this software may be distributed under the terms of the
233147Sxc151355  * GNU General Public License ("GPL") version 2 as published by the Free
243147Sxc151355  * Software Foundation.
253147Sxc151355  *
263147Sxc151355  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
273147Sxc151355  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
283147Sxc151355  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
293147Sxc151355  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
303147Sxc151355  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
313147Sxc151355  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
323147Sxc151355  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
333147Sxc151355  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
343147Sxc151355  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
353147Sxc151355  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
363147Sxc151355  */
373147Sxc151355 
383147Sxc151355 /*
393147Sxc151355  * Node management routines
403147Sxc151355  */
413147Sxc151355 
423147Sxc151355 #include "net80211_impl.h"
433147Sxc151355 
443147Sxc151355 static ieee80211_node_t *ieee80211_node_alloc(ieee80211com_t *);
453147Sxc151355 static void ieee80211_node_cleanup(ieee80211_node_t *);
463147Sxc151355 static void ieee80211_node_free(ieee80211_node_t *);
473147Sxc151355 static uint8_t ieee80211_node_getrssi(const ieee80211_node_t *);
483147Sxc151355 static void ieee80211_setup_node(ieee80211com_t *, ieee80211_node_table_t *,
493147Sxc151355     ieee80211_node_t *, const uint8_t *);
503147Sxc151355 static void ieee80211_node_reclaim(ieee80211_node_table_t *,
513147Sxc151355     ieee80211_node_t *);
523147Sxc151355 static void ieee80211_free_node_locked(ieee80211_node_t *);
533147Sxc151355 static void ieee80211_free_allnodes(ieee80211_node_table_t *);
543147Sxc151355 static void ieee80211_node_leave(ieee80211com_t *, ieee80211_node_t *);
553147Sxc151355 static void ieee80211_timeout_scan_candidates(ieee80211_node_table_t *);
563147Sxc151355 static void ieee80211_timeout_stations(ieee80211_node_table_t *);
573147Sxc151355 static void ieee80211_node_table_init(ieee80211com_t *,
583147Sxc151355     ieee80211_node_table_t *, const char *, int, int,
593147Sxc151355     void (*timeout)(ieee80211_node_table_t *));
603147Sxc151355 static void ieee80211_node_table_cleanup(ieee80211_node_table_t *);
613147Sxc151355 
623147Sxc151355 /*
633147Sxc151355  * association failures before ignored
643147Sxc151355  * The failure may be caused by the response frame is lost for
653147Sxc151355  * environmental reason. So Try associate more than once before
663147Sxc151355  * ignore the node
673147Sxc151355  */
683147Sxc151355 #define	IEEE80211_STA_FAILS_MAX	2
693147Sxc151355 
703147Sxc151355 /*
713147Sxc151355  * Initialize node database management callbacks for the interface.
723147Sxc151355  * This function is called by ieee80211_attach(). These callback
733147Sxc151355  * functions may be overridden in special circumstances, as long as
743147Sxc151355  * as this is done after calling ieee80211_attach() and prior to any
753147Sxc151355  * other call which may allocate a node
763147Sxc151355  */
773147Sxc151355 void
783147Sxc151355 ieee80211_node_attach(ieee80211com_t *ic)
793147Sxc151355 {
803147Sxc151355 	struct ieee80211_impl *im = ic->ic_private;
813147Sxc151355 
823147Sxc151355 	ic->ic_node_alloc = ieee80211_node_alloc;
833147Sxc151355 	ic->ic_node_free = ieee80211_node_free;
843147Sxc151355 	ic->ic_node_cleanup = ieee80211_node_cleanup;
853147Sxc151355 	ic->ic_node_getrssi = ieee80211_node_getrssi;
863147Sxc151355 
873147Sxc151355 	/* default station inactivity timer setings */
883147Sxc151355 	im->im_inact_init = IEEE80211_INACT_INIT;
893147Sxc151355 	im->im_inact_assoc = IEEE80211_INACT_ASSOC;
903147Sxc151355 	im->im_inact_run = IEEE80211_INACT_RUN;
913147Sxc151355 	im->im_inact_probe = IEEE80211_INACT_PROBE;
923147Sxc151355 }
933147Sxc151355 
943147Sxc151355 /*
953147Sxc151355  * Initialize node databases and the ic_bss node element.
963147Sxc151355  */
973147Sxc151355 void
983147Sxc151355 ieee80211_node_lateattach(ieee80211com_t *ic)
993147Sxc151355 {
1003147Sxc151355 	/*
1013147Sxc151355 	 * Calculate ic_tim_bitmap size in bytes
1023147Sxc151355 	 * IEEE80211_AID_MAX defines maximum bits in ic_tim_bitmap
1033147Sxc151355 	 */
1043147Sxc151355 	ic->ic_tim_len = howmany(IEEE80211_AID_MAX, 8) * sizeof (uint8_t);
1053147Sxc151355 
1063147Sxc151355 	ieee80211_node_table_init(ic, &ic->ic_sta, "station",
1074499Shx147065 	    IEEE80211_INACT_INIT, IEEE80211_WEP_NKID,
1084499Shx147065 	    ieee80211_timeout_stations);
1093147Sxc151355 	ieee80211_node_table_init(ic, &ic->ic_scan, "scan",
1104499Shx147065 	    IEEE80211_INACT_SCAN, 0, ieee80211_timeout_scan_candidates);
1113147Sxc151355 
1123147Sxc151355 	ieee80211_reset_bss(ic);
1133147Sxc151355 }
1143147Sxc151355 
1153147Sxc151355 /*
1163147Sxc151355  * Destroy all node databases and is usually called during device detach
1173147Sxc151355  */
1183147Sxc151355 void
1193147Sxc151355 ieee80211_node_detach(ieee80211com_t *ic)
1203147Sxc151355 {
1213147Sxc151355 	/* Node Detach */
1223147Sxc151355 	if (ic->ic_bss != NULL) {
1233147Sxc151355 		ieee80211_free_node(ic->ic_bss);
1243147Sxc151355 		ic->ic_bss = NULL;
1253147Sxc151355 	}
1263147Sxc151355 	ieee80211_node_table_cleanup(&ic->ic_scan);
1273147Sxc151355 	ieee80211_node_table_cleanup(&ic->ic_sta);
1283147Sxc151355 }
1293147Sxc151355 
1303147Sxc151355 /*
1313147Sxc151355  * Increase a node's reference count
1323147Sxc151355  *
1333147Sxc151355  * Return pointer to the node
1343147Sxc151355  */
1353147Sxc151355 ieee80211_node_t *
1363147Sxc151355 ieee80211_ref_node(ieee80211_node_t *in)
1373147Sxc151355 {
1383147Sxc151355 	ieee80211_node_incref(in);
1393147Sxc151355 	return (in);
1403147Sxc151355 }
1413147Sxc151355 
1423147Sxc151355 /*
1433147Sxc151355  * Dexrease a node's reference count
1443147Sxc151355  */
1453147Sxc151355 void
1463147Sxc151355 ieee80211_unref_node(ieee80211_node_t **in)
1473147Sxc151355 {
1483147Sxc151355 	ieee80211_node_decref(*in);
1493147Sxc151355 	*in = NULL;			/* guard against use */
1503147Sxc151355 }
1513147Sxc151355 
1523147Sxc151355 /*
1533147Sxc151355  * Mark ports authorized for data traffic. This function is usually
1543147Sxc151355  * used by 802.1x authenticator.
1553147Sxc151355  */
1563147Sxc151355 void
1573147Sxc151355 ieee80211_node_authorize(ieee80211_node_t *in)
1583147Sxc151355 {
1593147Sxc151355 	ieee80211_impl_t *im = in->in_ic->ic_private;
1603147Sxc151355 
1613147Sxc151355 	in->in_flags |= IEEE80211_NODE_AUTH;
1623147Sxc151355 	in->in_inact_reload = im->im_inact_run;
163*8594SFei.Feng@Sun.COM 	in->in_inact = in->in_inact_reload;
1643147Sxc151355 }
1653147Sxc151355 
1663147Sxc151355 /*
1673147Sxc151355  * Mark ports unauthorized for data traffic. This function is usually
1683147Sxc151355  * used by 802.1x authenticator.
1693147Sxc151355  */
1703147Sxc151355 void
1713147Sxc151355 ieee80211_node_unauthorize(ieee80211_node_t *in)
1723147Sxc151355 {
1733147Sxc151355 	in->in_flags &= ~IEEE80211_NODE_AUTH;
1743147Sxc151355 }
1753147Sxc151355 
1763147Sxc151355 /*
1773147Sxc151355  * Set/change the channel.  The rate set is also updated as
1783147Sxc151355  * to insure a consistent view by drivers.
1793147Sxc151355  */
1803147Sxc151355 static void
1813147Sxc151355 ieee80211_node_setchan(ieee80211com_t *ic, ieee80211_node_t *in,
1823147Sxc151355     struct ieee80211_channel *chan)
1833147Sxc151355 {
1843147Sxc151355 	if (chan == IEEE80211_CHAN_ANYC)
1853147Sxc151355 		chan = ic->ic_curchan;
1863147Sxc151355 	in->in_chan = chan;
1873147Sxc151355 	in->in_rates = ic->ic_sup_rates[ieee80211_chan2mode(ic, chan)];
1883147Sxc151355 }
1893147Sxc151355 
1903147Sxc151355 /*
1913147Sxc151355  * Initialize the channel set to scan based on the available channels
1923147Sxc151355  * and the current PHY mode.
1933147Sxc151355  */
1943147Sxc151355 static void
1953147Sxc151355 ieee80211_reset_scan(ieee80211com_t *ic)
1963147Sxc151355 {
1973147Sxc151355 	ieee80211_impl_t	*im = ic->ic_private;
1983147Sxc151355 
1993147Sxc151355 	if (ic->ic_des_chan != IEEE80211_CHAN_ANYC) {
2003147Sxc151355 		(void) memset(im->im_chan_scan, 0, sizeof (im->im_chan_scan));
2013147Sxc151355 		ieee80211_setbit(im->im_chan_scan,
2024499Shx147065 		    ieee80211_chan2ieee(ic, ic->ic_des_chan));
2033147Sxc151355 	} else {
2043147Sxc151355 		bcopy(ic->ic_chan_active, im->im_chan_scan,
2054499Shx147065 		    sizeof (ic->ic_chan_active));
2063147Sxc151355 	}
2073147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_SCAN, "ieee80211_reset_scan(): "
2084499Shx147065 	    "start chan %u\n", ieee80211_chan2ieee(ic, ic->ic_curchan));
2093147Sxc151355 }
2103147Sxc151355 
2113147Sxc151355 /*
2123147Sxc151355  * Begin an active scan. Initialize the node cache. The scan
2133147Sxc151355  * begins on the next radio channel by calling ieee80211_next_scan().
2143147Sxc151355  * The actual scanning is not automated. The driver itself
2153147Sxc151355  * only handles setting the radio frequency and stepping through
2163147Sxc151355  * the channels.
2173147Sxc151355  */
2183147Sxc151355 void
2193147Sxc151355 ieee80211_begin_scan(ieee80211com_t *ic, boolean_t reset)
2203147Sxc151355 {
2213147Sxc151355 	IEEE80211_LOCK(ic);
2223147Sxc151355 
2233147Sxc151355 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2243147Sxc151355 		ic->ic_flags |= IEEE80211_F_ASCAN;
2253147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_SCAN,
2264499Shx147065 	    "begin %s scan in %s mode on channel %u\n",
2274499Shx147065 	    (ic->ic_flags & IEEE80211_F_ASCAN) ?  "active" : "passive",
2284499Shx147065 	    ieee80211_phymode_name[ic->ic_curmode],
2294499Shx147065 	    ieee80211_chan2ieee(ic, ic->ic_curchan));
2303147Sxc151355 
2313147Sxc151355 	/*
2323147Sxc151355 	 * Clear scan state and flush any previously seen AP's.
2333147Sxc151355 	 */
2343147Sxc151355 	ieee80211_reset_scan(ic);
2353147Sxc151355 	if (reset)
2363147Sxc151355 		ieee80211_free_allnodes(&ic->ic_scan);
2373147Sxc151355 
2383147Sxc151355 	ic->ic_flags |= IEEE80211_F_SCAN;
2393147Sxc151355 	IEEE80211_UNLOCK(ic);
2403147Sxc151355 
2413147Sxc151355 	/* Scan the next channel. */
2423147Sxc151355 	ieee80211_next_scan(ic);
2433147Sxc151355 }
2443147Sxc151355 
2453147Sxc151355 /*
2463147Sxc151355  * Switch to the next channel marked for scanning.
2473147Sxc151355  * A driver is expected to first call ieee80211_begin_scan(),
2483147Sxc151355  * to initialize the node cache, then set the radio channel
2493147Sxc151355  * on the device. And then after a certain time has elapsed,
2503147Sxc151355  * call ieee80211_next_scan() to move to the next channel.
2513147Sxc151355  * Typically, a timeout routine is used to automate this process.
2523147Sxc151355  */
2533147Sxc151355 void
2543147Sxc151355 ieee80211_next_scan(ieee80211com_t *ic)
2553147Sxc151355 {
2563147Sxc151355 	ieee80211_impl_t *im = ic->ic_private;
2573147Sxc151355 	struct ieee80211_channel *chan;
2583147Sxc151355 
2593147Sxc151355 	IEEE80211_LOCK(ic);
2603147Sxc151355 	/*
2613147Sxc151355 	 * Insure any previous mgt frame timeouts don't fire.
2623147Sxc151355 	 * This assumes the driver does the right thing in
2633147Sxc151355 	 * flushing anything queued in the driver and below.
2643147Sxc151355 	 */
2653147Sxc151355 	im->im_mgt_timer = 0;
2663147Sxc151355 
2673147Sxc151355 	chan = ic->ic_curchan;
2683147Sxc151355 	do {
2693147Sxc151355 		if (++chan > &ic->ic_sup_channels[IEEE80211_CHAN_MAX])
2703147Sxc151355 			chan = &ic->ic_sup_channels[0];
2713147Sxc151355 		if (ieee80211_isset(im->im_chan_scan,
2723147Sxc151355 		    ieee80211_chan2ieee(ic, chan))) {
2733147Sxc151355 			ieee80211_clrbit(im->im_chan_scan,
2744499Shx147065 			    ieee80211_chan2ieee(ic, chan));
2753147Sxc151355 			ieee80211_dbg(IEEE80211_MSG_SCAN,
2764499Shx147065 			    "ieee80211_next_scan: chan %d->%d\n",
2774499Shx147065 			    ieee80211_chan2ieee(ic, ic->ic_curchan),
2784499Shx147065 			    ieee80211_chan2ieee(ic, chan));
2793147Sxc151355 			ic->ic_curchan = chan;
2803147Sxc151355 			/*
2813147Sxc151355 			 * drivers should do this as needed,
2823147Sxc151355 			 * for now maintain compatibility
2833147Sxc151355 			 */
2843147Sxc151355 			ic->ic_bss->in_rates =
2854499Shx147065 			    ic->ic_sup_rates[ieee80211_chan2mode(ic, chan)];
2863147Sxc151355 			IEEE80211_UNLOCK(ic);
2873147Sxc151355 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2883147Sxc151355 			return;
2893147Sxc151355 		}
2903147Sxc151355 	} while (chan != ic->ic_curchan);
2913147Sxc151355 	IEEE80211_UNLOCK(ic);
2923147Sxc151355 	ieee80211_end_scan(ic);
2933147Sxc151355 }
2943147Sxc151355 
2953147Sxc151355 /*
2963147Sxc151355  * Copy useful state from node obss into nbss.
2973147Sxc151355  */
2983147Sxc151355 static void
2993147Sxc151355 ieee80211_copy_bss(ieee80211_node_t *nbss, const ieee80211_node_t *obss)
3003147Sxc151355 {
3013147Sxc151355 	/* propagate useful state */
3023147Sxc151355 	nbss->in_authmode = obss->in_authmode;
3033147Sxc151355 	nbss->in_txpower = obss->in_txpower;
3043147Sxc151355 	nbss->in_vlan = obss->in_vlan;
3053147Sxc151355 }
3063147Sxc151355 
3073147Sxc151355 /*
3083147Sxc151355  * Setup the net80211 specific portion of an interface's softc, ic,
3093147Sxc151355  * for use in IBSS mode
3103147Sxc151355  */
3113147Sxc151355 void
3123147Sxc151355 ieee80211_create_ibss(ieee80211com_t *ic, struct ieee80211_channel *chan)
3133147Sxc151355 {
3143147Sxc151355 	ieee80211_impl_t *im = ic->ic_private;
3153147Sxc151355 	ieee80211_node_table_t *nt;
3163147Sxc151355 	ieee80211_node_t *in;
3173147Sxc151355 
3183147Sxc151355 	IEEE80211_LOCK_ASSERT(ic);
3193147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_SCAN, "ieee80211_create_ibss: "
3204499Shx147065 	    "creating ibss\n");
3213147Sxc151355 
3223147Sxc151355 	/*
3233147Sxc151355 	 * Create the station/neighbor table.  Note that for adhoc
3243147Sxc151355 	 * mode we make the initial inactivity timer longer since
3253147Sxc151355 	 * we create nodes only through discovery and they typically
3263147Sxc151355 	 * are long-lived associations.
3273147Sxc151355 	 */
3283147Sxc151355 	nt = &ic->ic_sta;
3293147Sxc151355 	IEEE80211_NODE_LOCK(nt);
3303147Sxc151355 	nt->nt_name = "neighbor";
3313147Sxc151355 	nt->nt_inact_init = im->im_inact_run;
3323147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
3333147Sxc151355 
3343147Sxc151355 	in = ieee80211_alloc_node(ic, &ic->ic_sta, ic->ic_macaddr);
3353147Sxc151355 	if (in == NULL) {
3363147Sxc151355 		ieee80211_err("ieee80211_create_ibss(): alloc node failed\n");
3373147Sxc151355 		return;
3383147Sxc151355 	}
3393147Sxc151355 	IEEE80211_ADDR_COPY(in->in_bssid, ic->ic_macaddr);
3403147Sxc151355 	in->in_esslen = ic->ic_des_esslen;
3413147Sxc151355 	(void) memcpy(in->in_essid, ic->ic_des_essid, in->in_esslen);
3423147Sxc151355 	ieee80211_copy_bss(in, ic->ic_bss);
3433147Sxc151355 	in->in_intval = ic->ic_bintval;
3443147Sxc151355 	if (ic->ic_flags & IEEE80211_F_PRIVACY)
3453147Sxc151355 		in->in_capinfo |= IEEE80211_CAPINFO_PRIVACY;
3463147Sxc151355 	if (ic->ic_phytype == IEEE80211_T_FH) {
3473147Sxc151355 		in->in_fhdwell = 200;
3483147Sxc151355 		in->in_fhindex = 1;
3493147Sxc151355 	}
3503147Sxc151355 	switch (ic->ic_opmode) {
3513147Sxc151355 	case IEEE80211_M_IBSS:
3523147Sxc151355 		ic->ic_flags |= IEEE80211_F_SIBSS;
3533147Sxc151355 		in->in_capinfo |= IEEE80211_CAPINFO_IBSS;
3543147Sxc151355 		if (ic->ic_flags & IEEE80211_F_DESBSSID)
3553147Sxc151355 			IEEE80211_ADDR_COPY(in->in_bssid, ic->ic_des_bssid);
3563147Sxc151355 		else
3573147Sxc151355 			in->in_bssid[0] |= 0x02;	/* local bit for IBSS */
3583147Sxc151355 		break;
3593147Sxc151355 	case IEEE80211_M_AHDEMO:
3603147Sxc151355 		if (ic->ic_flags & IEEE80211_F_DESBSSID)
3613147Sxc151355 			IEEE80211_ADDR_COPY(in->in_bssid, ic->ic_des_bssid);
3623147Sxc151355 		else
3633147Sxc151355 			(void) memset(in->in_bssid, 0, IEEE80211_ADDR_LEN);
3643147Sxc151355 		break;
3653147Sxc151355 	default:
3663147Sxc151355 		ieee80211_err("ieee80211_create_ibss(): "
3674499Shx147065 		    "wrong opmode %u to creat IBSS, abort\n",
3684499Shx147065 		    ic->ic_opmode);
3693147Sxc151355 		ieee80211_free_node(in);
3703147Sxc151355 		return;
3713147Sxc151355 	}
3723147Sxc151355 
3733147Sxc151355 	/*
3743147Sxc151355 	 * Fix the channel and related attributes.
3753147Sxc151355 	 */
3763147Sxc151355 	ieee80211_node_setchan(ic, in, chan);
3773147Sxc151355 	ic->ic_curchan = chan;
3783147Sxc151355 	ic->ic_curmode = ieee80211_chan2mode(ic, chan);
3793147Sxc151355 	/*
3803147Sxc151355 	 * Do mode-specific rate setup.
3813147Sxc151355 	 */
3823147Sxc151355 	ieee80211_setbasicrates(&in->in_rates, ic->ic_curmode);
3833147Sxc151355 	IEEE80211_UNLOCK(ic);
3844126Szf162725 	ieee80211_sta_join(ic, ieee80211_ref_node(in));
3853147Sxc151355 	IEEE80211_LOCK(ic);
3863147Sxc151355 }
3873147Sxc151355 
3883147Sxc151355 void
3893147Sxc151355 ieee80211_reset_bss(ieee80211com_t *ic)
3903147Sxc151355 {
3913147Sxc151355 	ieee80211_node_t *in;
3923147Sxc151355 	ieee80211_node_t *obss;
3933147Sxc151355 
394*8594SFei.Feng@Sun.COM 	ieee80211_node_table_reset(&ic->ic_sta);
395*8594SFei.Feng@Sun.COM 	ieee80211_reset_erp(ic);
396*8594SFei.Feng@Sun.COM 
3973147Sxc151355 	in = ieee80211_alloc_node(ic, &ic->ic_scan, ic->ic_macaddr);
3983147Sxc151355 	ASSERT(in != NULL);
3993147Sxc151355 	obss = ic->ic_bss;
4003147Sxc151355 	ic->ic_bss = ieee80211_ref_node(in);
4013147Sxc151355 	if (obss != NULL) {
4023147Sxc151355 		ieee80211_copy_bss(in, obss);
4033147Sxc151355 		in->in_intval = ic->ic_bintval;
4043147Sxc151355 		ieee80211_free_node(obss);
4053147Sxc151355 	}
4063147Sxc151355 }
4073147Sxc151355 
4083147Sxc151355 static int
4093147Sxc151355 ieee80211_match_bss(ieee80211com_t *ic, ieee80211_node_t *in)
4103147Sxc151355 {
4113147Sxc151355 	uint8_t rate;
4123147Sxc151355 	int fail;
4133147Sxc151355 
4143147Sxc151355 	fail = 0;
4153147Sxc151355 	if (ieee80211_isclr(ic->ic_chan_active,
4163147Sxc151355 	    ieee80211_chan2ieee(ic, in->in_chan))) {
4173147Sxc151355 		fail |= IEEE80211_BADCHAN;
4183147Sxc151355 	}
4193147Sxc151355 	if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
4203147Sxc151355 	    in->in_chan != ic->ic_des_chan) {
4213147Sxc151355 		fail |= IEEE80211_BADCHAN;
4223147Sxc151355 	}
4233147Sxc151355 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
4243147Sxc151355 		if (!(in->in_capinfo & IEEE80211_CAPINFO_IBSS))
4253147Sxc151355 			fail |= IEEE80211_BADOPMODE;
4263147Sxc151355 	} else {
4273147Sxc151355 		if (!(in->in_capinfo & IEEE80211_CAPINFO_ESS))
4283147Sxc151355 			fail |= IEEE80211_BADOPMODE;
4293147Sxc151355 	}
4303147Sxc151355 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
4313147Sxc151355 		if (!(in->in_capinfo & IEEE80211_CAPINFO_PRIVACY))
4323147Sxc151355 			fail |= IEEE80211_BADPRIVACY;
4333147Sxc151355 	} else {
4343147Sxc151355 		if (in->in_capinfo & IEEE80211_CAPINFO_PRIVACY)
4353147Sxc151355 			fail |= IEEE80211_BADPRIVACY;
4363147Sxc151355 	}
4373147Sxc151355 	rate = ieee80211_fix_rate(in, IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE);
4383147Sxc151355 	if (rate & IEEE80211_RATE_BASIC)
4393147Sxc151355 		fail |= IEEE80211_BADRATE;
4403147Sxc151355 	if (ic->ic_des_esslen != 0 &&
4413147Sxc151355 	    (in->in_esslen != ic->ic_des_esslen ||
4423147Sxc151355 	    memcmp(in->in_essid, ic->ic_des_essid, ic->ic_des_esslen) != 0)) {
4433147Sxc151355 		fail |= IEEE80211_BADESSID;
4443147Sxc151355 	}
4453147Sxc151355 	if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
4463147Sxc151355 	    !IEEE80211_ADDR_EQ(ic->ic_des_bssid, in->in_bssid)) {
4473147Sxc151355 		fail |= IEEE80211_BADBSSID;
4483147Sxc151355 	}
4493147Sxc151355 	if (in->in_fails >= IEEE80211_STA_FAILS_MAX)
4503147Sxc151355 		fail |= IEEE80211_NODEFAIL;
4513147Sxc151355 
4523147Sxc151355 	return (fail);
4533147Sxc151355 }
4543147Sxc151355 
4553147Sxc151355 #define	IEEE80211_MAXRATE(_rs) \
4563147Sxc151355 	((_rs).ir_rates[(_rs).ir_nrates - 1] & IEEE80211_RATE_VAL)
4573147Sxc151355 
4583147Sxc151355 /*
4593147Sxc151355  * Compare the capabilities of node a with node b and decide which is
4603147Sxc151355  * more desirable (return b if b is considered better than a).  Note
4613147Sxc151355  * that we assume compatibility/usability has already been checked
4623147Sxc151355  * so we don't need to (e.g. validate whether privacy is supported).
4633147Sxc151355  * Used to select the best scan candidate for association in a BSS.
4643147Sxc151355  *
4653147Sxc151355  * Return desired node
4663147Sxc151355  */
4673147Sxc151355 static ieee80211_node_t *
4683147Sxc151355 ieee80211_node_compare(ieee80211com_t *ic, ieee80211_node_t *a,
4693147Sxc151355     ieee80211_node_t *b)
4703147Sxc151355 {
4713147Sxc151355 	uint8_t maxa;
4723147Sxc151355 	uint8_t maxb;
4733147Sxc151355 	uint8_t rssia;
4743147Sxc151355 	uint8_t rssib;
4753147Sxc151355 
4763147Sxc151355 	/* privacy support preferred */
4773147Sxc151355 	if ((a->in_capinfo & IEEE80211_CAPINFO_PRIVACY) &&
4783147Sxc151355 	    !(b->in_capinfo & IEEE80211_CAPINFO_PRIVACY)) {
4793147Sxc151355 		return (a);
4803147Sxc151355 	}
4813147Sxc151355 	if (!(a->in_capinfo & IEEE80211_CAPINFO_PRIVACY) &&
4823147Sxc151355 	    (b->in_capinfo & IEEE80211_CAPINFO_PRIVACY)) {
4833147Sxc151355 		return (b);
4843147Sxc151355 	}
4853147Sxc151355 
4863147Sxc151355 	/* compare count of previous failures */
4873147Sxc151355 	if (b->in_fails != a->in_fails)
4883147Sxc151355 		return ((a->in_fails > b->in_fails) ? b : a);
4893147Sxc151355 
4903147Sxc151355 	rssia = ic->ic_node_getrssi(a);
4913147Sxc151355 	rssib = ic->ic_node_getrssi(b);
4923147Sxc151355 	if (ABS(rssib - rssia) < IEEE80211_RSSI_CMP_THRESHOLD) {
4933147Sxc151355 		/* best/max rate preferred if signal level close enough */
4943147Sxc151355 		maxa = IEEE80211_MAXRATE(a->in_rates);
4953147Sxc151355 		maxb = IEEE80211_MAXRATE(b->in_rates);
4963147Sxc151355 		if (maxa != maxb)
4973147Sxc151355 			return ((maxb > maxa) ? b : a);
4983147Sxc151355 		/* for now just prefer 5Ghz band to all other bands */
4993147Sxc151355 		if (IEEE80211_IS_CHAN_5GHZ(a->in_chan) &&
5003147Sxc151355 		    !IEEE80211_IS_CHAN_5GHZ(b->in_chan)) {
5013147Sxc151355 			return (a);
5023147Sxc151355 		}
5033147Sxc151355 		if (!IEEE80211_IS_CHAN_5GHZ(a->in_chan) &&
5043147Sxc151355 		    IEEE80211_IS_CHAN_5GHZ(b->in_chan)) {
5053147Sxc151355 			return (b);
5063147Sxc151355 		}
5073147Sxc151355 	}
5083147Sxc151355 	/* all things being equal, compare signal level */
5093147Sxc151355 	return ((rssib > rssia) ? b : a);
5103147Sxc151355 }
5113147Sxc151355 
5123147Sxc151355 /*
5133147Sxc151355  * Mark an ongoing scan stopped.
5143147Sxc151355  */
5153147Sxc151355 void
5163147Sxc151355 ieee80211_cancel_scan(ieee80211com_t *ic)
5173147Sxc151355 {
5183147Sxc151355 	IEEE80211_LOCK(ic);
5193147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_SCAN, "ieee80211_cancel_scan()"
5204499Shx147065 	    "end %s scan\n",
5214499Shx147065 	    (ic->ic_flags & IEEE80211_F_ASCAN) ?  "active" : "passive");
5223147Sxc151355 	ic->ic_flags &= ~(IEEE80211_F_SCAN | IEEE80211_F_ASCAN);
5233147Sxc151355 	cv_broadcast(&((ieee80211_impl_t *)ic->ic_private)->im_scan_cv);
5243147Sxc151355 	IEEE80211_UNLOCK(ic);
5253147Sxc151355 }
5263147Sxc151355 
5273147Sxc151355 /*
5283147Sxc151355  * Complete a scan of potential channels. It is called by
5293147Sxc151355  * ieee80211_next_scan() when the state machine has performed
5303147Sxc151355  * a full cycle of scaning on all available radio channels.
5313147Sxc151355  * ieee80211_end_scan() will inspect the node cache for suitable
5323147Sxc151355  * APs found during scaning, and associate with one, should
5333147Sxc151355  * the parameters of the node match those of the configuration
5343147Sxc151355  * requested from userland.
5353147Sxc151355  */
5363147Sxc151355 void
5373147Sxc151355 ieee80211_end_scan(ieee80211com_t *ic)
5383147Sxc151355 {
5393147Sxc151355 	ieee80211_node_table_t *nt = &ic->ic_scan;
5403147Sxc151355 	ieee80211_node_t *in;
5413147Sxc151355 	ieee80211_node_t *selbs;
5423147Sxc151355 
5433147Sxc151355 	ieee80211_cancel_scan(ic);
5444126Szf162725 	/* notify SCAN done */
5454126Szf162725 	ieee80211_notify(ic, EVENT_SCAN_RESULTS);
5463147Sxc151355 	IEEE80211_LOCK(ic);
5473147Sxc151355 
5483147Sxc151355 	/*
5493147Sxc151355 	 * Automatic sequencing; look for a candidate and
5503147Sxc151355 	 * if found join the network.
5513147Sxc151355 	 */
5523147Sxc151355 	/* NB: unlocked read should be ok */
5533147Sxc151355 	in = list_head(&nt->nt_node);
5544126Szf162725 	if (in == NULL && (ic->ic_flags & IEEE80211_F_WPA) == 0) {
5553147Sxc151355 		ieee80211_dbg(IEEE80211_MSG_SCAN, "ieee80211_end_scan: "
5564499Shx147065 		    "no scan candidate\n");
5573147Sxc151355 	notfound:
5583147Sxc151355 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
5593147Sxc151355 		    (ic->ic_flags & IEEE80211_F_IBSSON) &&
5603147Sxc151355 		    ic->ic_des_esslen != 0) {
5613147Sxc151355 			ieee80211_create_ibss(ic, ic->ic_ibss_chan);
5623147Sxc151355 			IEEE80211_UNLOCK(ic);
5633147Sxc151355 			return;
5643147Sxc151355 		}
5653147Sxc151355 
5663147Sxc151355 		/*
5673147Sxc151355 		 * Reset the list of channels to scan and start again.
5683147Sxc151355 		 */
5693147Sxc151355 		ieee80211_reset_scan(ic);
5703147Sxc151355 		ic->ic_flags |= IEEE80211_F_SCAN | IEEE80211_F_ASCAN;
5713147Sxc151355 		IEEE80211_UNLOCK(ic);
5723147Sxc151355 
5733147Sxc151355 		ieee80211_next_scan(ic);
5743147Sxc151355 		return;
5753147Sxc151355 	}
5763147Sxc151355 
5774126Szf162725 	if (ic->ic_flags & IEEE80211_F_SCANONLY ||
5784126Szf162725 	    ic->ic_flags & IEEE80211_F_WPA) {	/* scan only */
5793147Sxc151355 		ic->ic_flags &= ~IEEE80211_F_SCANONLY;
5803147Sxc151355 		IEEE80211_UNLOCK(ic);
5813147Sxc151355 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
5823147Sxc151355 		return;
5833147Sxc151355 	}
5843147Sxc151355 
5853147Sxc151355 	selbs = NULL;
5863147Sxc151355 	IEEE80211_NODE_LOCK(nt);
5873147Sxc151355 	while (in != NULL) {
5883147Sxc151355 		if (in->in_fails >= IEEE80211_STA_FAILS_MAX) {
5893147Sxc151355 			ieee80211_node_t *tmpin = in;
5903147Sxc151355 
5913147Sxc151355 			/*
5923147Sxc151355 			 * The configuration of the access points may change
5933147Sxc151355 			 * during my scan.  So delete the entry for the AP
5943147Sxc151355 			 * and retry to associate if there is another beacon.
5953147Sxc151355 			 */
5963147Sxc151355 			in = list_next(&nt->nt_node, tmpin);
5973147Sxc151355 			ieee80211_node_reclaim(nt, tmpin);
5983147Sxc151355 			continue;
5993147Sxc151355 		}
6003993Seh146360 		/*
6013993Seh146360 		 * It's possible at some special moments, the in_chan will
6023993Seh146360 		 * be none. Need to skip the null node.
6033993Seh146360 		 */
6043993Seh146360 		if (in->in_chan == IEEE80211_CHAN_ANYC) {
6053993Seh146360 			in = list_next(&nt->nt_node, in);
6063993Seh146360 			continue;
6073993Seh146360 		}
6083147Sxc151355 		if (ieee80211_match_bss(ic, in) == 0) {
6093147Sxc151355 			if (selbs == NULL)
6103147Sxc151355 				selbs = in;
6113147Sxc151355 			else
6123147Sxc151355 				selbs = ieee80211_node_compare(ic, selbs, in);
6133147Sxc151355 		}
6143147Sxc151355 		in = list_next(&nt->nt_node, in);
6153147Sxc151355 	}
6164126Szf162725 	if (selbs != NULL)	/* grab ref while dropping lock */
6174126Szf162725 		(void) ieee80211_ref_node(selbs);
6183147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
6193147Sxc151355 	if (selbs == NULL)
6203147Sxc151355 		goto notfound;
6213147Sxc151355 	IEEE80211_UNLOCK(ic);
6223147Sxc151355 	ieee80211_sta_join(ic, selbs);
6233147Sxc151355 }
6243147Sxc151355 
6253147Sxc151355 
6263147Sxc151355 /*
6273147Sxc151355  * Handle 802.11 ad hoc network merge.  The convention, set by the
6283147Sxc151355  * Wireless Ethernet Compatibility Alliance (WECA), is that an 802.11
6293147Sxc151355  * station will change its BSSID to match the "oldest" 802.11 ad hoc
6303147Sxc151355  * network, on the same channel, that has the station's desired SSID.
6313147Sxc151355  * The "oldest" 802.11 network sends beacons with the greatest TSF
6323147Sxc151355  * timestamp.
6333147Sxc151355  * The caller is assumed to validate TSF's before attempting a merge.
6343147Sxc151355  *
6353147Sxc151355  * Return B_TRUE if the BSSID changed, B_FALSE otherwise.
6363147Sxc151355  */
6373147Sxc151355 boolean_t
6383147Sxc151355 ieee80211_ibss_merge(ieee80211_node_t *in)
6393147Sxc151355 {
6403147Sxc151355 	ieee80211com_t *ic = in->in_ic;
6413147Sxc151355 
6423147Sxc151355 	if (in == ic->ic_bss ||
6433147Sxc151355 	    IEEE80211_ADDR_EQ(in->in_bssid, ic->ic_bss->in_bssid)) {
6443147Sxc151355 		/* unchanged, nothing to do */
6453147Sxc151355 		return (B_FALSE);
6463147Sxc151355 	}
6473147Sxc151355 	if (ieee80211_match_bss(ic, in) != 0) {	/* capabilities mismatch */
6483147Sxc151355 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_ibss_merge: "
6494499Shx147065 		    " merge failed, capabilities mismatch\n");
6503147Sxc151355 		return (B_FALSE);
6513147Sxc151355 	}
6523147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_ibss_merge: "
6534499Shx147065 	    "new bssid %s: %s preamble, %s slot time%s\n",
6544499Shx147065 	    ieee80211_macaddr_sprintf(in->in_bssid),
6554499Shx147065 	    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? "short" : "long",
6564499Shx147065 	    (ic->ic_flags & IEEE80211_F_SHSLOT) ? "short" : "long",
6574499Shx147065 	    (ic->ic_flags&IEEE80211_F_USEPROT) ? ", protection" : "");
6584126Szf162725 	ieee80211_sta_join(ic, ieee80211_ref_node(in));
6593147Sxc151355 	return (B_TRUE);
6603147Sxc151355 }
6613147Sxc151355 
6623147Sxc151355 /*
6633147Sxc151355  * Join the specified IBSS/BSS network.  The node is assumed to
6643147Sxc151355  * be passed in with a held reference.
6653147Sxc151355  */
6663147Sxc151355 void
6673147Sxc151355 ieee80211_sta_join(ieee80211com_t *ic, ieee80211_node_t *selbs)
6683147Sxc151355 {
6693147Sxc151355 	ieee80211_impl_t *im = ic->ic_private;
6703147Sxc151355 	ieee80211_node_t *obss;
6713147Sxc151355 
6723147Sxc151355 	IEEE80211_LOCK(ic);
6733147Sxc151355 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
6743147Sxc151355 		ieee80211_node_table_t *nt;
6753147Sxc151355 
6763147Sxc151355 		/*
6773147Sxc151355 		 * Delete unusable rates; we've already checked
6783147Sxc151355 		 * that the negotiated rate set is acceptable.
6793147Sxc151355 		 */
6803147Sxc151355 		(void) ieee80211_fix_rate(selbs, IEEE80211_F_DODEL);
6813147Sxc151355 		/*
6823147Sxc151355 		 * Fillin the neighbor table
6833147Sxc151355 		 */
6843147Sxc151355 		nt = &ic->ic_sta;
6853147Sxc151355 		IEEE80211_NODE_LOCK(nt);
6863147Sxc151355 		nt->nt_name = "neighbor";
6873147Sxc151355 		nt->nt_inact_init = im->im_inact_run;
6883147Sxc151355 		IEEE80211_NODE_UNLOCK(nt);
6893147Sxc151355 	}
6903147Sxc151355 
6913147Sxc151355 	/*
6923147Sxc151355 	 * Committed to selbs, setup state.
6933147Sxc151355 	 */
6943147Sxc151355 	obss = ic->ic_bss;
6954126Szf162725 	ic->ic_bss = selbs;	/* caller assumed to bump refcnt */
6963147Sxc151355 	if (obss != NULL) {
6973147Sxc151355 		ieee80211_copy_bss(selbs, obss);
6983147Sxc151355 		ieee80211_free_node(obss);
6993147Sxc151355 	}
7003147Sxc151355 	ic->ic_curmode = ieee80211_chan2mode(ic, selbs->in_chan);
7013147Sxc151355 	ic->ic_curchan = selbs->in_chan;
7024499Shx147065 	ic->ic_phytype = selbs->in_phytype;
7033147Sxc151355 	/*
7043147Sxc151355 	 * Set the erp state (mostly the slot time) to deal with
7053147Sxc151355 	 * the auto-select case; this should be redundant if the
7063147Sxc151355 	 * mode is locked.
7073147Sxc151355 	 */
7083147Sxc151355 	ieee80211_reset_erp(ic);
7093147Sxc151355 
7103147Sxc151355 	IEEE80211_UNLOCK(ic);
7113147Sxc151355 	if (ic->ic_opmode == IEEE80211_M_STA)
7123147Sxc151355 		ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
7133147Sxc151355 	else
7143147Sxc151355 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
7153147Sxc151355 }
7163147Sxc151355 
7173147Sxc151355 /*
7183147Sxc151355  * Leave the specified IBSS/BSS network.  The node is assumed to
7193147Sxc151355  * be passed in with a held reference.
7203147Sxc151355  */
7213147Sxc151355 void
7223147Sxc151355 ieee80211_sta_leave(ieee80211com_t *ic, ieee80211_node_t *in)
7233147Sxc151355 {
7243147Sxc151355 	IEEE80211_LOCK(ic);
7253147Sxc151355 	ic->ic_node_cleanup(in);
7263147Sxc151355 	ieee80211_notify_node_leave(ic, in);
7273147Sxc151355 	IEEE80211_UNLOCK(ic);
7283147Sxc151355 }
7293147Sxc151355 
7303147Sxc151355 /*
7313147Sxc151355  * Allocate a node. This is the default callback function for
7323147Sxc151355  * ic_node_alloc. This function may be overridden by the driver
7333147Sxc151355  * to allocate device specific node structure.
7343147Sxc151355  */
7353147Sxc151355 /* ARGSUSED */
7363147Sxc151355 static ieee80211_node_t *
7373147Sxc151355 ieee80211_node_alloc(ieee80211com_t *ic)
7383147Sxc151355 {
7393147Sxc151355 	return (kmem_zalloc(sizeof (ieee80211_node_t), KM_SLEEP));
7403147Sxc151355 }
7413147Sxc151355 
7423147Sxc151355 /*
7433147Sxc151355  * Cleanup a node, free any memory associated with the node.
7443147Sxc151355  * This is the default callback function for ic_node_cleanup
7453147Sxc151355  * and may be overridden by the driver.
7463147Sxc151355  */
7473147Sxc151355 static void
7483147Sxc151355 ieee80211_node_cleanup(ieee80211_node_t *in)
7493147Sxc151355 {
7503147Sxc151355 	in->in_associd = 0;
7513147Sxc151355 	in->in_rssi = 0;
7523147Sxc151355 	in->in_rstamp = 0;
7533147Sxc151355 	if (in->in_challenge != NULL) {
7543147Sxc151355 		kmem_free(in->in_challenge, IEEE80211_CHALLENGE_LEN);
7553147Sxc151355 		in->in_challenge = NULL;
7563147Sxc151355 	}
7573147Sxc151355 	if (in->in_rxfrag != NULL) {
7583147Sxc151355 		freemsg(in->in_rxfrag);
7593147Sxc151355 		in->in_rxfrag = NULL;
7603147Sxc151355 	}
7613147Sxc151355 }
7623147Sxc151355 
7633147Sxc151355 /*
7643147Sxc151355  * Free a node. This is the default callback function for ic_node_free
7653147Sxc151355  * and may be overridden by the driver to free memory used by device
7663147Sxc151355  * specific node structure
7673147Sxc151355  */
7683147Sxc151355 static void
7693147Sxc151355 ieee80211_node_free(ieee80211_node_t *in)
7703147Sxc151355 {
7713147Sxc151355 	ieee80211com_t *ic = in->in_ic;
7723147Sxc151355 
7733147Sxc151355 	ic->ic_node_cleanup(in);
7744126Szf162725 	if (in->in_wpa_ie != NULL)
7754126Szf162725 		ieee80211_free(in->in_wpa_ie);
7763147Sxc151355 	kmem_free(in, sizeof (ieee80211_node_t));
7773147Sxc151355 }
7783147Sxc151355 
7793147Sxc151355 /*
7803147Sxc151355  * Get a node current RSSI value. This is the default callback function
7813147Sxc151355  * for ic_node_getrssi and may be overridden by the driver to provide
7823147Sxc151355  * device specific RSSI calculation algorithm.
7833147Sxc151355  */
7843147Sxc151355 static uint8_t
7853147Sxc151355 ieee80211_node_getrssi(const ieee80211_node_t *in)
7863147Sxc151355 {
7873147Sxc151355 	return (in->in_rssi);
7883147Sxc151355 }
7893147Sxc151355 
7903147Sxc151355 /* Free fragment if not needed anymore */
7913147Sxc151355 static void
7923147Sxc151355 node_cleanfrag(ieee80211_node_t *in)
7933147Sxc151355 {
7943147Sxc151355 	clock_t ticks;
7953147Sxc151355 
7963147Sxc151355 	ticks = ddi_get_lbolt();
7973147Sxc151355 	if (in->in_rxfrag != NULL && ticks > (in->in_rxfragstamp + hz)) {
7983147Sxc151355 		freemsg(in->in_rxfrag);
7993147Sxc151355 		in->in_rxfrag = NULL;
8003147Sxc151355 	}
8013147Sxc151355 }
8023147Sxc151355 
8033147Sxc151355 /*
8043147Sxc151355  * Setup a node. Initialize the node with specified macaddr. Associate
8053147Sxc151355  * with the interface softc, ic, and add it to the specified node
8063147Sxc151355  * database.
8073147Sxc151355  */
8083147Sxc151355 static void
8093147Sxc151355 ieee80211_setup_node(ieee80211com_t *ic, ieee80211_node_table_t *nt,
8103147Sxc151355     ieee80211_node_t *in, const uint8_t *macaddr)
8113147Sxc151355 {
8123147Sxc151355 	int32_t hash;
8133147Sxc151355 
8143147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_NODE, "ieee80211_setup_node(): "
8154499Shx147065 	    "%p<%s> in %s table\n", in,
8164499Shx147065 	    ieee80211_macaddr_sprintf(macaddr),
8174499Shx147065 	    (nt != NULL) ? nt->nt_name : "NULL");
8183147Sxc151355 
8193147Sxc151355 	in->in_ic = ic;
8203147Sxc151355 	IEEE80211_ADDR_COPY(in->in_macaddr, macaddr);
8213147Sxc151355 	hash = ieee80211_node_hash(macaddr);
8223147Sxc151355 	ieee80211_node_initref(in);		/* mark referenced */
8233147Sxc151355 	in->in_authmode = IEEE80211_AUTH_OPEN;
8243147Sxc151355 	in->in_txpower = ic->ic_txpowlimit;	/* max power */
8253147Sxc151355 	in->in_chan = IEEE80211_CHAN_ANYC;
8263147Sxc151355 	in->in_inact_reload = IEEE80211_INACT_INIT;
8273147Sxc151355 	in->in_inact = in->in_inact_reload;
8283147Sxc151355 	ieee80211_crypto_resetkey(ic, &in->in_ucastkey, IEEE80211_KEYIX_NONE);
8293147Sxc151355 
8303147Sxc151355 	if (nt != NULL) {
8313147Sxc151355 		IEEE80211_NODE_LOCK(nt);
8323147Sxc151355 		list_insert_tail(&nt->nt_node, in);
8333147Sxc151355 		list_insert_tail(&nt->nt_hash[hash], in);
8343147Sxc151355 		in->in_table = nt;
8353147Sxc151355 		in->in_inact_reload = nt->nt_inact_init;
8363147Sxc151355 		IEEE80211_NODE_UNLOCK(nt);
8373147Sxc151355 	}
8383147Sxc151355 }
8393147Sxc151355 
8403147Sxc151355 /*
8413147Sxc151355  * Allocates and initialize a node with specified MAC address.
8423147Sxc151355  * Associate the node with the interface ic. If the allocation
8433147Sxc151355  * is successful, the node structure is initialized by
8443147Sxc151355  * ieee80211_setup_node(); otherwise, NULL is returned
8453147Sxc151355  */
8463147Sxc151355 ieee80211_node_t *
8473147Sxc151355 ieee80211_alloc_node(ieee80211com_t *ic, ieee80211_node_table_t *nt,
8483147Sxc151355     const uint8_t *macaddr)
8493147Sxc151355 {
8503147Sxc151355 	ieee80211_node_t *in;
8513147Sxc151355 
8523147Sxc151355 	in = ic->ic_node_alloc(ic);
8533147Sxc151355 	if (in != NULL)
8543147Sxc151355 		ieee80211_setup_node(ic, nt, in, macaddr);
8553147Sxc151355 	return (in);
8563147Sxc151355 }
8573147Sxc151355 
8583147Sxc151355 /*
8593147Sxc151355  * Craft a temporary node suitable for sending a management frame
8603147Sxc151355  * to the specified station.  We craft only as much state as we
8613147Sxc151355  * need to do the work since the node will be immediately reclaimed
8623147Sxc151355  * once the send completes.
8633147Sxc151355  */
8643147Sxc151355 ieee80211_node_t *
8653147Sxc151355 ieee80211_tmp_node(ieee80211com_t *ic, const uint8_t *macaddr)
8663147Sxc151355 {
8673147Sxc151355 	ieee80211_node_t *in;
8683147Sxc151355 
8693147Sxc151355 	in = ic->ic_node_alloc(ic);
8703147Sxc151355 	if (in != NULL) {
8713147Sxc151355 		ieee80211_dbg(IEEE80211_MSG_NODE, "ieee80211_tmp_node: "
8724499Shx147065 		    "%p<%s>\n", in, ieee80211_macaddr_sprintf(macaddr));
8733147Sxc151355 
8743147Sxc151355 		IEEE80211_ADDR_COPY(in->in_macaddr, macaddr);
8753147Sxc151355 		IEEE80211_ADDR_COPY(in->in_bssid, ic->ic_bss->in_bssid);
8763147Sxc151355 		ieee80211_node_initref(in);		/* mark referenced */
8773147Sxc151355 		in->in_txpower = ic->ic_bss->in_txpower;
8783147Sxc151355 		/* NB: required by ieee80211_fix_rate */
8793147Sxc151355 		ieee80211_node_setchan(ic, in, ic->ic_bss->in_chan);
8803147Sxc151355 		ieee80211_crypto_resetkey(ic, &in->in_ucastkey,
8814499Shx147065 		    IEEE80211_KEYIX_NONE);
8823147Sxc151355 
8833147Sxc151355 		in->in_table = NULL;		/* NB: pedantic */
8843147Sxc151355 		in->in_ic = ic;
8853147Sxc151355 	}
8863147Sxc151355 
8873147Sxc151355 	return (in);
8883147Sxc151355 }
8893147Sxc151355 
8903147Sxc151355 /*
8913147Sxc151355  * ieee80211_dup_bss() is similar to ieee80211_alloc_node(),
8923147Sxc151355  * but is instead used to create a node database entry for
8933147Sxc151355  * the specified BSSID. If the allocation is successful, the
8943147Sxc151355  * node is initialized,  otherwise, NULL is returned.
8953147Sxc151355  */
8963147Sxc151355 ieee80211_node_t *
8973147Sxc151355 ieee80211_dup_bss(ieee80211_node_table_t *nt, const uint8_t *macaddr)
8983147Sxc151355 {
8993147Sxc151355 	ieee80211com_t *ic = nt->nt_ic;
9003147Sxc151355 	ieee80211_node_t *in;
9013147Sxc151355 
9023147Sxc151355 	in = ieee80211_alloc_node(ic, nt, macaddr);
9033147Sxc151355 	if (in != NULL) {
9043147Sxc151355 		/*
9053147Sxc151355 		 * Inherit from ic_bss.
9063147Sxc151355 		 */
9073147Sxc151355 		ieee80211_copy_bss(in, ic->ic_bss);
9083147Sxc151355 		IEEE80211_ADDR_COPY(in->in_bssid, ic->ic_bss->in_bssid);
9093147Sxc151355 		ieee80211_node_setchan(ic, in, ic->ic_bss->in_chan);
9103147Sxc151355 	}
9113147Sxc151355 
9123147Sxc151355 	return (in);
9133147Sxc151355 }
9143147Sxc151355 
9153147Sxc151355 /*
9163147Sxc151355  * Iterate through the node table, searching for a node entry which
9173147Sxc151355  * matches macaddr. If the entry is found, its reference count is
9183147Sxc151355  * incremented, and a pointer to the node is returned; otherwise,
9193147Sxc151355  * NULL will be returned.
9203147Sxc151355  * The node table lock is acquired by the caller.
9213147Sxc151355  */
9223147Sxc151355 static ieee80211_node_t *
9233147Sxc151355 ieee80211_find_node_locked(ieee80211_node_table_t *nt, const uint8_t *macaddr)
9243147Sxc151355 {
9253147Sxc151355 	ieee80211_node_t *in;
9263147Sxc151355 	int hash;
9273147Sxc151355 
9283147Sxc151355 	ASSERT(IEEE80211_NODE_IS_LOCKED(nt));
9293147Sxc151355 
9303147Sxc151355 	hash = ieee80211_node_hash(macaddr);
9313147Sxc151355 	in = list_head(&nt->nt_hash[hash]);
9323147Sxc151355 	while (in != NULL) {
9333147Sxc151355 		if (IEEE80211_ADDR_EQ(in->in_macaddr, macaddr))
9343147Sxc151355 			return (ieee80211_ref_node(in)); /* mark referenced */
9353147Sxc151355 		in = list_next(&nt->nt_hash[hash], in);
9363147Sxc151355 	}
9373147Sxc151355 	return (NULL);
9383147Sxc151355 }
9393147Sxc151355 
9403147Sxc151355 /*
9413147Sxc151355  * Iterate through the node table, searching for a node entry
9423147Sxc151355  * which match specified mac address.
9433147Sxc151355  * Return NULL if no matching node found.
9443147Sxc151355  */
9453147Sxc151355 ieee80211_node_t *
9463147Sxc151355 ieee80211_find_node(ieee80211_node_table_t *nt, const uint8_t *macaddr)
9473147Sxc151355 {
9483147Sxc151355 	ieee80211_node_t *in;
9493147Sxc151355 
9503147Sxc151355 	IEEE80211_NODE_LOCK(nt);
9513147Sxc151355 	in = ieee80211_find_node_locked(nt, macaddr);
9523147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
9533147Sxc151355 	return (in);
9543147Sxc151355 }
9553147Sxc151355 
9563147Sxc151355 /*
9574126Szf162725  * Like find but search based on the ssid too.
9584126Szf162725  */
9594126Szf162725 ieee80211_node_t *
9604126Szf162725 ieee80211_find_node_with_ssid(ieee80211_node_table_t *nt,
9614126Szf162725 	const uint8_t *macaddr, uint32_t ssidlen, const uint8_t *ssid)
9624126Szf162725 {
9634126Szf162725 	ieee80211_node_t *in;
9644126Szf162725 	int hash;
9654126Szf162725 
9664126Szf162725 	IEEE80211_NODE_LOCK(nt);
9674126Szf162725 
9684126Szf162725 	hash = ieee80211_node_hash(macaddr);
9694126Szf162725 	in = list_head(&nt->nt_hash[hash]);
9704126Szf162725 	while (in != NULL) {
9714126Szf162725 		if (IEEE80211_ADDR_EQ(in->in_macaddr, macaddr) &&
9724126Szf162725 		    in->in_esslen == ssidlen &&
9734126Szf162725 		    memcmp(in->in_essid, ssid, ssidlen) == 0)
9744126Szf162725 			break;
9754126Szf162725 		in = list_next(&nt->nt_hash[hash], in);
9764126Szf162725 	}
9774126Szf162725 	if (in != NULL) {
9784126Szf162725 		(void) ieee80211_ref_node(in); /* mark referenced */
9794126Szf162725 	}
9804126Szf162725 	IEEE80211_NODE_UNLOCK(nt);
9814126Szf162725 
9824126Szf162725 	return (in);
9834126Szf162725 }
9844126Szf162725 
9854126Szf162725 /*
9863147Sxc151355  * Fake up a node; this handles node discovery in adhoc mode.
9873147Sxc151355  * Note that for the driver's benefit we treat this like an
9883147Sxc151355  * association so the driver has an opportunity to setup it's
9893147Sxc151355  * private state.
9903147Sxc151355  */
9913147Sxc151355 ieee80211_node_t *
9923147Sxc151355 ieee80211_fakeup_adhoc_node(ieee80211_node_table_t *nt, const uint8_t *macaddr)
9933147Sxc151355 {
9943147Sxc151355 	ieee80211com_t *ic = nt->nt_ic;
9953147Sxc151355 	ieee80211_node_t *in;
9963147Sxc151355 
9973147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_NODE, "ieee80211_fakeup_adhoc_node: "
9984499Shx147065 	    "mac<%s>\n", ieee80211_macaddr_sprintf(macaddr));
9993147Sxc151355 	in = ieee80211_dup_bss(nt, macaddr);
10003147Sxc151355 	if (in != NULL) {
10013147Sxc151355 		/* no rate negotiation; just dup */
10023147Sxc151355 		in->in_rates = ic->ic_bss->in_rates;
10033147Sxc151355 		if (ic->ic_node_newassoc != NULL)
10043147Sxc151355 			ic->ic_node_newassoc(in, 1);
10053147Sxc151355 		ieee80211_node_authorize(in);
10063147Sxc151355 	}
10073147Sxc151355 	return (in);
10083147Sxc151355 }
10093147Sxc151355 
10104126Szf162725 static void
10114126Szf162725 ieee80211_saveie(uint8_t **iep, const uint8_t *ie)
10124126Szf162725 {
10134126Szf162725 	uint_t ielen = ie[1]+2;
10144126Szf162725 	/*
10154126Szf162725 	 * Record information element for later use.
10164126Szf162725 	 */
10174126Szf162725 	if (*iep == NULL || (*iep)[1] != ie[1]) {
10184126Szf162725 		if (*iep != NULL)
10194126Szf162725 			ieee80211_free(*iep);
10204126Szf162725 		*iep = ieee80211_malloc(ielen);
10214126Szf162725 	}
10224126Szf162725 	if (*iep != NULL)
10234126Szf162725 		(void) memcpy(*iep, ie, ielen);
10244126Szf162725 }
10254126Szf162725 
10264126Szf162725 static void
10274126Szf162725 saveie(uint8_t **iep, const uint8_t *ie)
10284126Szf162725 {
10295296Szf162725 	if (ie == NULL) {
10305296Szf162725 		if (*iep != NULL)
10315296Szf162725 			ieee80211_free(*iep);
10324126Szf162725 		*iep = NULL;
10335296Szf162725 	}
10344126Szf162725 	else
10354126Szf162725 		ieee80211_saveie(iep, ie);
10364126Szf162725 }
10374126Szf162725 
10383147Sxc151355 /*
10393147Sxc151355  * Process a beacon or probe response frame.
10403147Sxc151355  */
10413147Sxc151355 void
10423147Sxc151355 ieee80211_add_scan(ieee80211com_t *ic, const struct ieee80211_scanparams *sp,
10433147Sxc151355     const struct ieee80211_frame *wh, int subtype, int rssi, int rstamp)
10443147Sxc151355 {
10453147Sxc151355 	ieee80211_node_table_t *nt = &ic->ic_scan;
10463147Sxc151355 	ieee80211_node_t *in;
10473147Sxc151355 	boolean_t newnode = B_FALSE;
10483147Sxc151355 
10494499Shx147065 	in = ieee80211_find_node(nt, wh->i_addr3);
10503147Sxc151355 	if (in == NULL) {
10513147Sxc151355 		/*
10523147Sxc151355 		 * Create a new entry.
10533147Sxc151355 		 */
10544499Shx147065 		in = ieee80211_alloc_node(ic, nt, wh->i_addr3);
10553147Sxc151355 		if (in == NULL) {
10563147Sxc151355 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_add_scan: "
10574499Shx147065 			    "alloc node failed\n");
10583147Sxc151355 			return;
10593147Sxc151355 		}
10603147Sxc151355 		/*
10613147Sxc151355 		 * inherit from ic_bss.
10623147Sxc151355 		 */
10633147Sxc151355 		ieee80211_copy_bss(in, ic->ic_bss);
10643147Sxc151355 		ieee80211_node_setchan(ic, in, ic->ic_curchan);
10653147Sxc151355 		newnode = B_TRUE;
10663147Sxc151355 	}
10673147Sxc151355 
10683147Sxc151355 	/* ap beaconing multiple ssid w/ same bssid */
10693147Sxc151355 
10703147Sxc151355 	/*
10713147Sxc151355 	 * sp->ssid[0] - element ID
10723147Sxc151355 	 * sp->ssid[1] - length
10733147Sxc151355 	 * sp->ssid[2]... - ssid
10743147Sxc151355 	 */
10753147Sxc151355 	if (sp->ssid[1] != 0 &&
10763147Sxc151355 	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP ||
10773147Sxc151355 	    in->in_esslen == 0) {
10783147Sxc151355 		in->in_esslen = sp->ssid[1];
10793147Sxc151355 		bzero(in->in_essid, sizeof (in->in_essid));
10803147Sxc151355 		bcopy(sp->ssid + 2, in->in_essid, sp->ssid[1]);
10813147Sxc151355 	}
10823147Sxc151355 	IEEE80211_ADDR_COPY(in->in_bssid, wh->i_addr3);
10833147Sxc151355 	in->in_rssi = (uint8_t)rssi;
10843147Sxc151355 	in->in_rstamp = rstamp;
10853147Sxc151355 	bcopy(sp->tstamp, in->in_tstamp.data, sizeof (in->in_tstamp));
10863147Sxc151355 	in->in_intval = sp->bintval;
10873147Sxc151355 	in->in_capinfo = sp->capinfo;
10883147Sxc151355 	in->in_chan = &ic->ic_sup_channels[sp->chan];
10893147Sxc151355 	in->in_phytype = sp->phytype;
10903147Sxc151355 	in->in_fhdwell = sp->fhdwell;
10913147Sxc151355 	in->in_fhindex = sp->fhindex;
10923147Sxc151355 	in->in_erp = sp->erp;
10933147Sxc151355 	if (sp->tim != NULL) {
10943147Sxc151355 		struct ieee80211_tim_ie *ie;
10953147Sxc151355 
10963147Sxc151355 		ie = (struct ieee80211_tim_ie *)sp->tim;
10973147Sxc151355 		in->in_dtim_count = ie->tim_count;
10983147Sxc151355 		in->in_dtim_period = ie->tim_period;
10993147Sxc151355 	}
11003147Sxc151355 	/*
11013147Sxc151355 	 * Record the byte offset from the mac header to
11023147Sxc151355 	 * the start of the TIM information element for
11033147Sxc151355 	 * use by hardware and/or to speedup software
11043147Sxc151355 	 * processing of beacon frames.
11053147Sxc151355 	 */
11063147Sxc151355 	in->in_tim_off = sp->timoff;
11074126Szf162725 	/*
11084126Szf162725 	 * Record optional information elements that might be
11094126Szf162725 	 * used by applications or drivers.
11104126Szf162725 	 */
11114126Szf162725 	saveie(&in->in_wpa_ie, sp->wpa);
11123147Sxc151355 
11133147Sxc151355 	/* NB: must be after in_chan is setup */
11143147Sxc151355 	(void) ieee80211_setup_rates(in, sp->rates, sp->xrates,
11154499Shx147065 	    IEEE80211_F_DOSORT);
11163147Sxc151355 
11173147Sxc151355 	if (!newnode)
11183147Sxc151355 		ieee80211_free_node(in);
11193147Sxc151355 }
11203147Sxc151355 
11213147Sxc151355 /*
11223147Sxc151355  * Initialize/update an ad-hoc node with contents from a received
11233147Sxc151355  * beacon frame.
11243147Sxc151355  */
11253147Sxc151355 void
11263147Sxc151355 ieee80211_init_neighbor(ieee80211_node_t *in, const struct ieee80211_frame *wh,
11273147Sxc151355     const struct ieee80211_scanparams *sp)
11283147Sxc151355 {
11293147Sxc151355 	in->in_esslen = sp->ssid[1];
11303147Sxc151355 	(void) memcpy(in->in_essid, sp->ssid + 2, sp->ssid[1]);
11313147Sxc151355 	IEEE80211_ADDR_COPY(in->in_bssid, wh->i_addr3);
11323147Sxc151355 	(void) memcpy(in->in_tstamp.data, sp->tstamp, sizeof (in->in_tstamp));
11333147Sxc151355 	in->in_intval = sp->bintval;
11343147Sxc151355 	in->in_capinfo = sp->capinfo;
11353147Sxc151355 	in->in_chan = in->in_ic->ic_curchan;
11363147Sxc151355 	in->in_fhdwell = sp->fhdwell;
11373147Sxc151355 	in->in_fhindex = sp->fhindex;
11383147Sxc151355 	in->in_erp = sp->erp;
11393147Sxc151355 	in->in_tim_off = sp->timoff;
11403147Sxc151355 
11413147Sxc151355 	/* NB: must be after in_chan is setup */
11423147Sxc151355 	(void) ieee80211_setup_rates(in, sp->rates, sp->xrates,
11434499Shx147065 	    IEEE80211_F_DOSORT);
11443147Sxc151355 }
11453147Sxc151355 
11463147Sxc151355 /*
11473147Sxc151355  * Do node discovery in adhoc mode on receipt of a beacon
11483147Sxc151355  * or probe response frame.  Note that for the driver's
11493147Sxc151355  * benefit we we treat this like an association so the
11503147Sxc151355  * driver has an opportuinty to setup it's private state.
11513147Sxc151355  */
11523147Sxc151355 ieee80211_node_t *
11533147Sxc151355 ieee80211_add_neighbor(ieee80211com_t *ic, const struct ieee80211_frame *wh,
11543147Sxc151355     const struct ieee80211_scanparams *sp)
11553147Sxc151355 {
11563147Sxc151355 	ieee80211_node_t *in;
11573147Sxc151355 
11583147Sxc151355 	in = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
11593147Sxc151355 	if (in != NULL) {
11603147Sxc151355 		ieee80211_init_neighbor(in, wh, sp);
11613147Sxc151355 		if (ic->ic_node_newassoc != NULL)
11623147Sxc151355 			ic->ic_node_newassoc(in, 1);
11633147Sxc151355 	}
11643147Sxc151355 	return (in);
11653147Sxc151355 }
11663147Sxc151355 
11673147Sxc151355 #define	IEEE80211_IS_CTL(wh) \
11683147Sxc151355 	((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
11693147Sxc151355 
11703147Sxc151355 /*
11713147Sxc151355  * Locate the node for sender, track state, and then pass the
11723147Sxc151355  * (referenced) node up to the 802.11 layer for its use.  We
11733147Sxc151355  * are required to pass some node so we fall back to ic_bss
11743147Sxc151355  * when this frame is from an unknown sender.  The 802.11 layer
11753147Sxc151355  * knows this means the sender wasn't in the node table and
11763147Sxc151355  * acts accordingly.
11773147Sxc151355  */
11783147Sxc151355 ieee80211_node_t *
11793147Sxc151355 ieee80211_find_rxnode(ieee80211com_t *ic, const struct ieee80211_frame *wh)
11803147Sxc151355 {
11813147Sxc151355 	ieee80211_node_table_t *nt;
11823147Sxc151355 	ieee80211_node_t *in;
11833147Sxc151355 
11843147Sxc151355 	/* may want scanned nodes in the neighbor table for adhoc */
11853147Sxc151355 	if (ic->ic_opmode == IEEE80211_M_STA ||
11863147Sxc151355 	    (ic->ic_flags & IEEE80211_F_SCAN)) {
11873147Sxc151355 		nt = &ic->ic_scan;
11883147Sxc151355 	} else {
11893147Sxc151355 		nt = &ic->ic_sta;
11903147Sxc151355 	}
11913147Sxc151355 
11923147Sxc151355 	IEEE80211_NODE_LOCK(nt);
11933147Sxc151355 	if (IEEE80211_IS_CTL(wh))
11943147Sxc151355 		in = ieee80211_find_node_locked(nt, wh->i_addr1);
11953147Sxc151355 	else
11963147Sxc151355 		in = ieee80211_find_node_locked(nt, wh->i_addr2);
11973147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
11983147Sxc151355 
11993147Sxc151355 	if (in == NULL)
12003147Sxc151355 		in = ieee80211_ref_node(ic->ic_bss);
12013147Sxc151355 
12023147Sxc151355 	return (in);
12033147Sxc151355 }
12043147Sxc151355 
12053147Sxc151355 /*
12063147Sxc151355  * Return a reference to the appropriate node for sending
12073147Sxc151355  * a data frame.  This handles node discovery in adhoc networks.
12083147Sxc151355  */
12093147Sxc151355 ieee80211_node_t *
12103147Sxc151355 ieee80211_find_txnode(ieee80211com_t *ic, const uint8_t *daddr)
12113147Sxc151355 {
12123147Sxc151355 	ieee80211_node_table_t *nt = &ic->ic_sta;
12133147Sxc151355 	ieee80211_node_t *in;
12143147Sxc151355 
12153147Sxc151355 	/*
12163147Sxc151355 	 * The destination address should be in the node table
12173147Sxc151355 	 * unless this is a multicast/broadcast frame.  We can
12183147Sxc151355 	 * also optimize station mode operation, all frames go
12193147Sxc151355 	 * to the bss node.
12203147Sxc151355 	 */
12213147Sxc151355 	IEEE80211_NODE_LOCK(nt);
12223147Sxc151355 	if (ic->ic_opmode == IEEE80211_M_STA || IEEE80211_IS_MULTICAST(daddr))
12233147Sxc151355 		in = ieee80211_ref_node(ic->ic_bss);
12243147Sxc151355 	else
12253147Sxc151355 		in = ieee80211_find_node_locked(nt, daddr);
12263147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
12273147Sxc151355 
12283147Sxc151355 	if (in == NULL) {
12293147Sxc151355 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
12303147Sxc151355 			/*
12313147Sxc151355 			 * In adhoc mode cons up a node for the destination.
12323147Sxc151355 			 * Note that we need an additional reference for the
12333147Sxc151355 			 * caller to be consistent with
12343147Sxc151355 			 * ieee80211_find_node_locked
12353147Sxc151355 			 * can't hold lock across ieee80211_dup_bss 'cuz of
12363147Sxc151355 			 * recursive locking
12373147Sxc151355 			 */
12383147Sxc151355 			in = ieee80211_fakeup_adhoc_node(nt, daddr);
12393147Sxc151355 			if (in != NULL)
12403147Sxc151355 				(void) ieee80211_ref_node(in);
12413147Sxc151355 		} else {
12423147Sxc151355 			ieee80211_dbg(IEEE80211_MSG_OUTPUT,
12434499Shx147065 			    "ieee80211_find_txnode: "
12444499Shx147065 			    "[%s] no node, discard frame\n",
12454499Shx147065 			    ieee80211_macaddr_sprintf(daddr));
12463147Sxc151355 		}
12473147Sxc151355 	}
12483147Sxc151355 	return (in);
12493147Sxc151355 }
12503147Sxc151355 
12513147Sxc151355 /*
12523147Sxc151355  * Remove a node from the node database entries and free memory
12533147Sxc151355  * associated with the node. The node table lock is acquired by
12543147Sxc151355  * the caller.
12553147Sxc151355  */
12563147Sxc151355 static void
12573147Sxc151355 ieee80211_free_node_locked(ieee80211_node_t *in)
12583147Sxc151355 {
12593147Sxc151355 	ieee80211com_t *ic = in->in_ic;
12603147Sxc151355 	ieee80211_node_table_t *nt = in->in_table;
12613147Sxc151355 	int32_t hash;
12623147Sxc151355 
12633147Sxc151355 	if (nt != NULL) {
12643147Sxc151355 		hash = ieee80211_node_hash(in->in_macaddr);
12653147Sxc151355 		list_remove(&nt->nt_hash[hash], in);
12663147Sxc151355 		list_remove(&nt->nt_node, in);
12673147Sxc151355 	}
12683147Sxc151355 	ic->ic_node_free(in);
12693147Sxc151355 }
12703147Sxc151355 
12713147Sxc151355 /*
12723147Sxc151355  * Remove a node from the node database entries and free any
12733147Sxc151355  * memory associated with the node.
12743147Sxc151355  * This method can be overridden in ieee80211_attach()
12753147Sxc151355  */
12763147Sxc151355 void
12773147Sxc151355 ieee80211_free_node(ieee80211_node_t *in)
12783147Sxc151355 {
12793147Sxc151355 	ieee80211_node_table_t *nt = in->in_table;
12803147Sxc151355 
12813147Sxc151355 	if (nt != NULL)
12823147Sxc151355 		IEEE80211_NODE_LOCK(nt);
12833147Sxc151355 	if (ieee80211_node_decref_nv(in) == 0)
12843147Sxc151355 		ieee80211_free_node_locked(in);
12853147Sxc151355 	if (nt != NULL)
12863147Sxc151355 		IEEE80211_NODE_UNLOCK(nt);
12873147Sxc151355 }
12883147Sxc151355 
12893147Sxc151355 /*
12903147Sxc151355  * Reclaim a node.  If this is the last reference count then
12913147Sxc151355  * do the normal free work.  Otherwise remove it from the node
12923147Sxc151355  * table and mark it gone by clearing the back-reference.
12933147Sxc151355  */
12943147Sxc151355 static void
12953147Sxc151355 ieee80211_node_reclaim(ieee80211_node_table_t *nt, ieee80211_node_t *in)
12963147Sxc151355 {
12973147Sxc151355 	int32_t hash;
12983147Sxc151355 
12993147Sxc151355 	IEEE80211_NODE_LOCK_ASSERT(nt);
13003147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_NODE, "node_reclaim: "
13014499Shx147065 	    " remove %p<%s> from %s table, refcnt %d\n",
13024499Shx147065 	    in, ieee80211_macaddr_sprintf(in->in_macaddr), nt->nt_name,
13034499Shx147065 	    ieee80211_node_refcnt(in));
13043147Sxc151355 
13053147Sxc151355 	if (ieee80211_node_decref_nv(in) != 0) {
13063147Sxc151355 		/*
13073147Sxc151355 		 * Clear any entry in the unicast key mapping table.
13083147Sxc151355 		 * We need to do it here so rx lookups don't find it
13093147Sxc151355 		 * in the mapping table even if it's not in the hash
13103147Sxc151355 		 * table.  We cannot depend on the mapping table entry
13113147Sxc151355 		 * being cleared because the node may not be free'd.
13123147Sxc151355 		 */
13133147Sxc151355 		hash = ieee80211_node_hash(in->in_macaddr);
13143147Sxc151355 		list_remove(&nt->nt_hash[hash], in);
13153147Sxc151355 		list_remove(&nt->nt_node, in);
13163147Sxc151355 		in->in_table = NULL;
13173147Sxc151355 	} else {
13183147Sxc151355 		ieee80211_free_node_locked(in);
13193147Sxc151355 	}
13203147Sxc151355 }
13213147Sxc151355 
13223147Sxc151355 /*
13233147Sxc151355  * Iterate through the node list and reclaim all node in the node table.
13243147Sxc151355  * The node table lock is acquired by the caller
13253147Sxc151355  */
13263147Sxc151355 static void
13273147Sxc151355 ieee80211_free_allnodes_locked(ieee80211_node_table_t *nt)
13283147Sxc151355 {
13293147Sxc151355 	ieee80211_node_t *in;
13303147Sxc151355 
13313147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_NODE, "ieee80211_free_allnodes_locked(): "
13324499Shx147065 	    "free all nodes in %s table\n", nt->nt_name);
13333147Sxc151355 
13343147Sxc151355 	in = list_head(&nt->nt_node);
13353147Sxc151355 	while (in != NULL) {
13363147Sxc151355 		ieee80211_node_reclaim(nt, in);
13373147Sxc151355 		in = list_head(&nt->nt_node);
13383147Sxc151355 	}
13393147Sxc151355 	ieee80211_reset_erp(nt->nt_ic);
13403147Sxc151355 }
13413147Sxc151355 
13423147Sxc151355 /*
13433147Sxc151355  * Iterate through the node list, calling ieee80211_node_reclaim() for
13443147Sxc151355  * all nodes associated with the interface.
13453147Sxc151355  */
13463147Sxc151355 static void
13473147Sxc151355 ieee80211_free_allnodes(ieee80211_node_table_t *nt)
13483147Sxc151355 {
13493147Sxc151355 	IEEE80211_NODE_LOCK(nt);
13503147Sxc151355 	ieee80211_free_allnodes_locked(nt);
13513147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
13523147Sxc151355 }
13533147Sxc151355 
13543147Sxc151355 /*
13553147Sxc151355  * Timeout entries in the scan cache. This is the timeout callback
13563147Sxc151355  * function of node table ic_scan which is called when the inactivity
13573147Sxc151355  * timer expires.
13583147Sxc151355  */
13593147Sxc151355 static void
13603147Sxc151355 ieee80211_timeout_scan_candidates(ieee80211_node_table_t *nt)
13613147Sxc151355 {
13623147Sxc151355 	ieee80211com_t *ic = nt->nt_ic;
13633147Sxc151355 	ieee80211_node_t *in;
13643147Sxc151355 
13653147Sxc151355 	IEEE80211_NODE_LOCK(nt);
13663147Sxc151355 	in = ic->ic_bss;
13673147Sxc151355 	node_cleanfrag(in);	/* Free fragment if not needed */
13683147Sxc151355 	nt->nt_inact_timer = IEEE80211_INACT_WAIT;
13693147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
13703147Sxc151355 }
13713147Sxc151355 
13723147Sxc151355 /*
13733147Sxc151355  * Timeout inactive stations and do related housekeeping.
13743147Sxc151355  * Note that we cannot hold the node lock while sending a
13753147Sxc151355  * frame as this would lead to a LOR.  Instead we use a
13763147Sxc151355  * generation number to mark nodes that we've scanned and
13773147Sxc151355  * drop the lock and restart a scan if we have to time out
13783147Sxc151355  * a node.  Since we are single-threaded by virtue of
13793147Sxc151355  * controlling the inactivity timer we can be sure this will
13803147Sxc151355  * process each node only once.
13813147Sxc151355  */
13823147Sxc151355 static void
13833147Sxc151355 ieee80211_timeout_stations(ieee80211_node_table_t *nt)
13843147Sxc151355 {
13853147Sxc151355 	ieee80211com_t *ic = nt->nt_ic;
13863147Sxc151355 	ieee80211_impl_t *im = ic->ic_private;
13873147Sxc151355 	ieee80211_node_t *in = NULL;
13883147Sxc151355 	uint32_t gen;
13893147Sxc151355 	boolean_t isadhoc;
13903147Sxc151355 
13913147Sxc151355 	IEEE80211_LOCK_ASSERT(ic);
13923147Sxc151355 	isadhoc = (ic->ic_opmode == IEEE80211_M_IBSS ||
13934499Shx147065 	    ic->ic_opmode == IEEE80211_M_AHDEMO);
13943147Sxc151355 	IEEE80211_SCAN_LOCK(nt);
13953147Sxc151355 	gen = ++nt->nt_scangen;
13963147Sxc151355 restart:
13973147Sxc151355 	IEEE80211_NODE_LOCK(nt);
13983147Sxc151355 	for (in = list_head(&nt->nt_node); in != NULL;
13994499Shx147065 	    in = list_next(&nt->nt_node, in)) {
14003147Sxc151355 		if (in->in_scangen == gen)	/* previously handled */
14013147Sxc151355 			continue;
14023147Sxc151355 		in->in_scangen = gen;
14033147Sxc151355 		node_cleanfrag(in);	/* free fragment if not needed */
14043147Sxc151355 
14053147Sxc151355 		/*
14063147Sxc151355 		 * Special case ourself; we may be idle for extended periods
14073147Sxc151355 		 * of time and regardless reclaiming our state is wrong.
14083147Sxc151355 		 */
14093147Sxc151355 		if (in == ic->ic_bss)
14103147Sxc151355 			continue;
14113147Sxc151355 		in->in_inact--;
14123147Sxc151355 		if (in->in_associd != 0 || isadhoc) {
14133147Sxc151355 			/*
14143147Sxc151355 			 * Probe the station before time it out.  We
14153147Sxc151355 			 * send a null data frame which may not be
14163147Sxc151355 			 * uinversally supported by drivers (need it
14173147Sxc151355 			 * for ps-poll support so it should be...).
14183147Sxc151355 			 */
14193147Sxc151355 			if (0 < in->in_inact &&
14203147Sxc151355 			    in->in_inact <= im->im_inact_probe) {
14213147Sxc151355 				ieee80211_dbg(IEEE80211_MSG_NODE, "net80211: "
14224499Shx147065 				    "probe station due to inactivity\n");
14233147Sxc151355 				IEEE80211_NODE_UNLOCK(nt);
14243147Sxc151355 				IEEE80211_UNLOCK(ic);
14253147Sxc151355 				(void) ieee80211_send_nulldata(in);
14263147Sxc151355 				IEEE80211_LOCK(ic);
14273147Sxc151355 				goto restart;
14283147Sxc151355 			}
14293147Sxc151355 		}
14303147Sxc151355 		if (in->in_inact <= 0) {
14313147Sxc151355 			ieee80211_dbg(IEEE80211_MSG_NODE, "net80211: "
14324499Shx147065 			    "station timed out due to inact (refcnt %u)\n",
14334499Shx147065 			    ieee80211_node_refcnt(in));
14343147Sxc151355 			/*
14353147Sxc151355 			 * Send a deauthenticate frame and drop the station.
14363147Sxc151355 			 * This is somewhat complicated due to reference counts
14373147Sxc151355 			 * and locking.  At this point a station will typically
14383147Sxc151355 			 * have a reference count of 1.  ieee80211_node_leave
14393147Sxc151355 			 * will do a "free" of the node which will drop the
14403147Sxc151355 			 * reference count.  But in the meantime a reference
14413147Sxc151355 			 * wil be held by the deauth frame.  The actual reclaim
14423147Sxc151355 			 * of the node will happen either after the tx is
14433147Sxc151355 			 * completed or by ieee80211_node_leave.
14443147Sxc151355 			 *
14453147Sxc151355 			 * Separately we must drop the node lock before sending
14463147Sxc151355 			 * in case the driver takes a lock, as this will result
14473147Sxc151355 			 * in  LOR between the node lock and the driver lock.
14483147Sxc151355 			 */
14493147Sxc151355 			IEEE80211_NODE_UNLOCK(nt);
14503147Sxc151355 			if (in->in_associd != 0) {
14513147Sxc151355 				IEEE80211_UNLOCK(ic);
14523147Sxc151355 				IEEE80211_SEND_MGMT(ic, in,
14534499Shx147065 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
14544499Shx147065 				    IEEE80211_REASON_AUTH_EXPIRE);
14553147Sxc151355 				IEEE80211_LOCK(ic);
14563147Sxc151355 			}
14573147Sxc151355 			ieee80211_node_leave(ic, in);
14583147Sxc151355 			goto restart;
14593147Sxc151355 		}
14603147Sxc151355 	}
14613147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
14623147Sxc151355 
14633147Sxc151355 	IEEE80211_SCAN_UNLOCK(nt);
14643147Sxc151355 
14653147Sxc151355 	nt->nt_inact_timer = IEEE80211_INACT_WAIT;
14663147Sxc151355 }
14673147Sxc151355 
14683147Sxc151355 /*
14693147Sxc151355  * Call the user-defined call back function for all nodes in
14703147Sxc151355  * the node cache. The callback is invoked with the user-supplied
14713147Sxc151355  * value and a pointer to the current node.
14723147Sxc151355  */
14733147Sxc151355 void
14743147Sxc151355 ieee80211_iterate_nodes(ieee80211_node_table_t *nt, ieee80211_iter_func *f,
14753147Sxc151355     void *arg)
14763147Sxc151355 {
14773147Sxc151355 	ieee80211_node_t *in;
14783147Sxc151355 
14793147Sxc151355 	IEEE80211_NODE_LOCK(nt);
14803147Sxc151355 	in = list_head(&nt->nt_node);
14813147Sxc151355 	while (in != NULL) {
14824499Shx147065 		if (in->in_chan == IEEE80211_CHAN_ANYC) {
14834499Shx147065 			in = list_next(&nt->nt_node, in);
14844499Shx147065 			continue;
14854499Shx147065 		}
14863147Sxc151355 		(void) ieee80211_ref_node(in);
14873147Sxc151355 		IEEE80211_NODE_UNLOCK(nt);
14883147Sxc151355 		(*f)(arg, in);
14893147Sxc151355 		ieee80211_free_node(in);
14903147Sxc151355 		IEEE80211_NODE_LOCK(nt);
14913147Sxc151355 		in = list_next(&nt->nt_node, in);
14923147Sxc151355 	}
14933147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
14943147Sxc151355 }
14953147Sxc151355 
14963147Sxc151355 /*
14973147Sxc151355  * Handle bookkeeping for station deauthentication/disassociation
14983147Sxc151355  * when operating as an ap.
14993147Sxc151355  */
15003147Sxc151355 static void
15013147Sxc151355 ieee80211_node_leave(ieee80211com_t *ic, ieee80211_node_t *in)
15023147Sxc151355 {
15033147Sxc151355 	ieee80211_node_table_t *nt = in->in_table;
15043147Sxc151355 
15053147Sxc151355 	ASSERT(ic->ic_opmode == IEEE80211_M_IBSS);
15063147Sxc151355 
15073147Sxc151355 	/*
15083147Sxc151355 	 * Remove the node from any table it's recorded in and
15093147Sxc151355 	 * drop the caller's reference.  Removal from the table
15103147Sxc151355 	 * is important to insure the node is not reprocessed
15113147Sxc151355 	 * for inactivity.
15123147Sxc151355 	 */
15133147Sxc151355 	if (nt != NULL) {
15143147Sxc151355 		IEEE80211_NODE_LOCK(nt);
15153147Sxc151355 		ieee80211_node_reclaim(nt, in);
15163147Sxc151355 		IEEE80211_NODE_UNLOCK(nt);
15173147Sxc151355 	} else {
15183147Sxc151355 		ieee80211_free_node(in);
15193147Sxc151355 	}
15203147Sxc151355 }
15213147Sxc151355 
15223147Sxc151355 /*
15233147Sxc151355  * Initialize a node table with specified name, inactivity timer value
15243147Sxc151355  * and callback inactivity timeout function. Associate the node table
15253147Sxc151355  * with interface softc, ic.
15263147Sxc151355  */
15273147Sxc151355 static void
15283147Sxc151355 ieee80211_node_table_init(ieee80211com_t *ic, ieee80211_node_table_t *nt,
15293147Sxc151355     const char *name, int inact, int keyixmax,
15303147Sxc151355     void (*timeout)(ieee80211_node_table_t *))
15313147Sxc151355 {
15323147Sxc151355 	int i;
15333147Sxc151355 
15343147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_NODE, "ieee80211_node_table_init():"
15354499Shx147065 	    "%s table, inact %d\n", name, inact);
15363147Sxc151355 
15373147Sxc151355 	nt->nt_ic = ic;
15383147Sxc151355 	nt->nt_name = name;
15393147Sxc151355 	nt->nt_inact_timer = 0;
15403147Sxc151355 	nt->nt_inact_init = inact;
15413147Sxc151355 	nt->nt_timeout = timeout;
15423147Sxc151355 	nt->nt_keyixmax = keyixmax;
15433147Sxc151355 	nt->nt_scangen = 1;
15443147Sxc151355 	mutex_init(&nt->nt_scanlock, NULL, MUTEX_DRIVER, NULL);
15453147Sxc151355 	mutex_init(&nt->nt_nodelock, NULL, MUTEX_DRIVER, NULL);
15463147Sxc151355 
15473147Sxc151355 	list_create(&nt->nt_node, sizeof (ieee80211_node_t),
15484499Shx147065 	    offsetof(ieee80211_node_t, in_node));
15493147Sxc151355 	for (i = 0; i < IEEE80211_NODE_HASHSIZE; i++) {
15503147Sxc151355 		list_create(&nt->nt_hash[i], sizeof (ieee80211_node_t),
15514499Shx147065 		    offsetof(ieee80211_node_t, in_hash));
15523147Sxc151355 	}
15533147Sxc151355 }
15543147Sxc151355 
15553147Sxc151355 /*
15563147Sxc151355  * Reset a node table. Clean its inactivity timer and call
15573147Sxc151355  * ieee80211_free_allnodes_locked() to free all nodes in the
15583147Sxc151355  * node table.
15593147Sxc151355  */
15603147Sxc151355 void
15613147Sxc151355 ieee80211_node_table_reset(ieee80211_node_table_t *nt)
15623147Sxc151355 {
15633147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_NODE, "ieee80211_node_table_reset(): "
15644499Shx147065 	    "%s table\n", nt->nt_name);
15653147Sxc151355 
15663147Sxc151355 	IEEE80211_NODE_LOCK(nt);
15673147Sxc151355 	nt->nt_inact_timer = 0;
15683147Sxc151355 	ieee80211_free_allnodes_locked(nt);
15693147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
15703147Sxc151355 }
15713147Sxc151355 
15723147Sxc151355 /*
15733147Sxc151355  * Destroy a node table. Free all nodes in the node table.
15743147Sxc151355  * This function is usually called by node detach function.
15753147Sxc151355  */
15763147Sxc151355 static void
15773147Sxc151355 ieee80211_node_table_cleanup(ieee80211_node_table_t *nt)
15783147Sxc151355 {
15793147Sxc151355 	ieee80211_dbg(IEEE80211_MSG_NODE, "ieee80211_node_table_cleanup(): "
15803147Sxc151355 	    "%s table\n", nt->nt_name);
15813147Sxc151355 
15823147Sxc151355 	IEEE80211_NODE_LOCK(nt);
15833147Sxc151355 	ieee80211_free_allnodes_locked(nt);
15843147Sxc151355 	IEEE80211_NODE_UNLOCK(nt);
15853147Sxc151355 	mutex_destroy(&nt->nt_nodelock);
15863147Sxc151355 	mutex_destroy(&nt->nt_scanlock);
15873147Sxc151355 }
1588