/usr/src/sys/net80211/ieee80211

Bug Summary

File:	net80211/ieee80211_node.c
Warning:	line 1415, column 3 Value stored to 'min_5ghz_rssi' is never read

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name ieee80211_node.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/net80211/ieee80211_node.c

1	/* $OpenBSD: ieee80211_node.c,v 1.198 2023/10/22 12:01:36 stsp Exp $ */
2	/* $NetBSD: ieee80211_node.c,v 1.14 2004/05/09 09:18:47 dyoung Exp $ */
3
4	/*-
5	* Copyright (c) 2001 Atsushi Onoe
6	* Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
7	* Copyright (c) 2008 Damien Bergamini
8	* All rights reserved.
9	*
10	* Redistribution and use in source and binary forms, with or without
11	* modification, are permitted provided that the following conditions
12	* are met:
13	* 1. Redistributions of source code must retain the above copyright
14	* notice, this list of conditions and the following disclaimer.
15	* 2. Redistributions in binary form must reproduce the above copyright
16	* notice, this list of conditions and the following disclaimer in the
17	* documentation and/or other materials provided with the distribution.
18	* 3. The name of the author may not be used to endorse or promote products
19	* derived from this software without specific prior written permission.
20	*
21	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31	*/
32
33	#include "bridge.h"
34
35	#include <sys/param.h>
36	#include <sys/systm.h>
37	#include <sys/mbuf.h>
38	#include <sys/malloc.h>
39	#include <sys/kernel.h>
40	#include <sys/socket.h>
41	#include <sys/sockio.h>
42	#include <sys/endian.h>
43	#include <sys/errno.h>
44	#include <sys/sysctl.h>
45	#include <sys/tree.h>
46
47	#include <net/if.h>
48	#include <net/if_dl.h>
49	#include <net/if_media.h>
50
51	#include <netinet/in.h>
52	#include <netinet/if_ether.h>
53
54	#if NBRIDGE1 > 0
55	#include <net/if_bridge.h>
56	#endif
57
58	#include <net80211/ieee80211_var.h>
59	#include <net80211/ieee80211_priv.h>
60
61	struct ieee80211_node ieee80211_node_alloc(struct ieee80211com );
62	void ieee80211_node_free(struct ieee80211com , struct ieee80211_node );
63	void ieee80211_node_copy(struct ieee80211com , struct ieee80211_node ,
64	const struct ieee80211_node *);
65	void ieee80211_choose_rsnparams(struct ieee80211com *);
66	u_int8_t ieee80211_node_getrssi(struct ieee80211com *,
67	const struct ieee80211_node *);
68	int ieee80211_node_checkrssi(struct ieee80211com *,
69	const struct ieee80211_node *);
70	int ieee80211_ess_is_better(struct ieee80211com ic, struct ieee80211_node ,
71	struct ieee80211_node *);
72	void ieee80211_node_set_timeouts(struct ieee80211_node *);
73	void ieee80211_setup_node(struct ieee80211com , struct ieee80211_node ,
74	const u_int8_t *);
75	struct ieee80211_node ieee80211_alloc_node_helper(struct ieee80211com );
76	void ieee80211_node_free_unref_cb(struct ieee80211_node *);
77	void ieee80211_node_tx_flushed(struct ieee80211com , struct ieee80211_node );
78	void ieee80211_node_switch_bss(struct ieee80211com , struct ieee80211_node );
79	void ieee80211_node_addba_request(struct ieee80211_node *, int);
80	void ieee80211_node_addba_request_ac_be_to(void *);
81	void ieee80211_node_addba_request_ac_bk_to(void *);
82	void ieee80211_node_addba_request_ac_vi_to(void *);
83	void ieee80211_node_addba_request_ac_vo_to(void *);
84	void ieee80211_needs_auth(struct ieee80211com , struct ieee80211_node );
85	#ifndef IEEE80211_STA_ONLY
86	void ieee80211_node_join_ht(struct ieee80211com , struct ieee80211_node );
87	void ieee80211_node_join_rsn(struct ieee80211com , struct ieee80211_node );
88	void ieee80211_node_join_11g(struct ieee80211com , struct ieee80211_node );
89	void ieee80211_node_leave_ht(struct ieee80211com , struct ieee80211_node );
90	void ieee80211_node_leave_vht(struct ieee80211com , struct ieee80211_node );
91	void ieee80211_node_leave_rsn(struct ieee80211com , struct ieee80211_node );
92	void ieee80211_node_leave_11g(struct ieee80211com , struct ieee80211_node );
93	void ieee80211_node_leave_pwrsave(struct ieee80211com *,
94	struct ieee80211_node *);
95	void ieee80211_inact_timeout(void *);
96	void ieee80211_node_cache_timeout(void *);
97	#endif
98	void ieee80211_clean_inactive_nodes(struct ieee80211com *, int);
99
100	#ifndef IEEE80211_STA_ONLY
101	void
102	ieee80211_inact_timeout(void *arg)
103	{
104	struct ieee80211com *ic = arg;
105	struct ieee80211_node ni, next_ni;
106	int s;
107
108	s = splnet()splraise(0x4);
109	for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_MIN(&ic->ic_tree);
110	ni != NULL((void *)0); ni = next_ni) {
111	next_ni = RBT_NEXT(ieee80211_tree, ni)ieee80211_tree_RBT_NEXT(ni);
112	if (ni->ni_refcnt > 0)
113	continue;
114	if (ni->ni_inact < IEEE80211_INACT_MAX(300/5))
115	ni->ni_inact++;
116	}
117	splx(s)spllower(s);
118
119	timeout_add_sec(&ic->ic_inact_timeout, IEEE80211_INACT_WAIT5);
120	}
121
122	void
123	ieee80211_node_cache_timeout(void *arg)
124	{
125	struct ieee80211com *ic = arg;
126
127	ieee80211_clean_nodes(ic, 1);
128	timeout_add_sec(&ic->ic_node_cache_timeout, IEEE80211_CACHE_WAIT30);
129	}
130	#endif
131
132	/*
133	* For debug purposes
134	*/
135	void
136	ieee80211_print_ess(struct ieee80211_ess *ess)
137	{
138	ieee80211_print_essid(ess->essid, ess->esslen);
139	if (ess->flags & IEEE80211_F_RSNON0x00200000) {
140	printf(" wpa");
141	if (ess->rsnprotos & IEEE80211_PROTO_RSN(1 << 0))
142	printf(",wpa2");
143	if (ess->rsnprotos & IEEE80211_PROTO_WPA(1 << 1))
144	printf(",wpa1");
145
146	if (ess->rsnakms & IEEE80211_AKM_8021X \|\|
147	ess->rsnakms & IEEE80211_AKM_SHA256_8021X)
148	printf(",802.1x");
149	printf(" ");
150
151	if (ess->rsnciphers & IEEE80211_CIPHER_USEGROUP)
152	printf(" usegroup");
153	if (ess->rsnciphers & IEEE80211_CIPHER_WEP40)
154	printf(" wep40");
155	if (ess->rsnciphers & IEEE80211_CIPHER_WEP104)
156	printf(" wep104");
157	if (ess->rsnciphers & IEEE80211_CIPHER_TKIP)
158	printf(" tkip");
159	if (ess->rsnciphers & IEEE80211_CIPHER_CCMP)
160	printf(" ccmp");
161	}
162	if (ess->flags & IEEE80211_F_WEPON0x00000100) {
163	int i = ess->def_txkey;
164
165	printf(" wep,");
166	if (ess->nw_keys[i].k_cipher & IEEE80211_CIPHER_WEP40)
167	printf("wep40");
168	if (ess->nw_keys[i].k_cipher & IEEE80211_CIPHER_WEP104)
169	printf("wep104");
170	}
171	if (ess->flags == 0)
172	printf(" clear");
173	printf("\n");
174	}
175
176	void
177	ieee80211_print_ess_list(struct ieee80211com *ic)
178	{
179	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
180	struct ieee80211_ess *ess;
181
182	printf("%s: known networks\n", ifp->if_xname);
183	TAILQ_FOREACH(ess, &ic->ic_ess, ess_next)for((ess) = ((&ic->ic_ess)->tqh_first); (ess) != (( void *)0); (ess) = ((ess)->ess_next.tqe_next)) {
184	ieee80211_print_ess(ess);
185	}
186	}
187
188	struct ieee80211_ess *
189	ieee80211_get_ess(struct ieee80211com ic, const char nwid, int len)
190	{
191	struct ieee80211_ess *ess;
192
193	TAILQ_FOREACH(ess, &ic->ic_ess, ess_next)for((ess) = ((&ic->ic_ess)->tqh_first); (ess) != (( void *)0); (ess) = ((ess)->ess_next.tqe_next)) {
194	if (len == ess->esslen &&
195	memcmp(ess->essid, nwid, ess->esslen)__builtin_memcmp((ess->essid), (nwid), (ess->esslen)) == 0)
196	return ess;
197	}
198
199	return NULL((void *)0);
200	}
201
202	void
203	ieee80211_del_ess(struct ieee80211com ic, char nwid, int len, int all)
204	{
205	struct ieee80211_ess ess, next;
206
207	TAILQ_FOREACH_SAFE(ess, &ic->ic_ess, ess_next, next)for ((ess) = ((&ic->ic_ess)->tqh_first); (ess) != ( (void *)0) && ((next) = ((ess)->ess_next.tqe_next) , 1); (ess) = (next)) {
208	if (all == 1 \|\| (ess->esslen == len &&
209	memcmp(ess->essid, nwid, len)__builtin_memcmp((ess->essid), (nwid), (len)) == 0)) {
210	TAILQ_REMOVE(&ic->ic_ess, ess, ess_next)do { if (((ess)->ess_next.tqe_next) != ((void )0)) (ess)-> ess_next.tqe_next->ess_next.tqe_prev = (ess)->ess_next. tqe_prev; else (&ic->ic_ess)->tqh_last = (ess)-> ess_next.tqe_prev; (ess)->ess_next.tqe_prev = (ess)->ess_next .tqe_next; ((ess)->ess_next.tqe_prev) = ((void )-1); ((ess )->ess_next.tqe_next) = ((void )-1); } while (0);
211	explicit_bzero(ess, sizeof(*ess));
212	free(ess, M_DEVBUF2, sizeof(*ess));
213	if (TAILQ_EMPTY(&ic->ic_ess)(((&ic->ic_ess)->tqh_first) == ((void *)0)))
214	ic->ic_flags &= ~IEEE80211_F_AUTO_JOIN0x10000000;
215	if (all != 1)
216	return;
217	}
218	}
219	}
220
221	/* Keep in sync with ieee80211_ioctl.c:ieee80211_ioctl_setnwkeys() */
222	static int
223	ieee80211_ess_setnwkeys(struct ieee80211_ess *ess,
224	const struct ieee80211_nwkey *nwkey)
225	{
226	struct ieee80211_key *k;
227	int error, i;
228
229	if (nwkey->i_wepon == IEEE80211_NWKEY_OPEN0) {
230	if (!(ess->flags & IEEE80211_F_WEPON0x00000100))
231	return 0;
232	ess->flags &= ~IEEE80211_F_WEPON0x00000100;
233	return ENETRESET52;
234	}
235	if (nwkey->i_defkid < 1 \|\| nwkey->i_defkid > IEEE80211_WEP_NKID4)
236	return EINVAL22;
237
238	for (i = 0; i < IEEE80211_WEP_NKID4; i++) {
239	if (nwkey->i_key[i].i_keylen == 0 \|\|
240	nwkey->i_key[i].i_keydat == NULL((void *)0))
241	continue; /* entry not set */
242	if (nwkey->i_key[i].i_keylen > IEEE80211_KEYBUF_SIZE16)
243	return EINVAL22;
244
245	/* map wep key to ieee80211_key */
246	k = &ess->nw_keys[i];
247	memset(k, 0, sizeof(k))__builtin_memset((k), (0), (sizeof(k)));
248	if (nwkey->i_key[i].i_keylen <= 5)
249	k->k_cipher = IEEE80211_CIPHER_WEP40;
250	else
251	k->k_cipher = IEEE80211_CIPHER_WEP104;
252	k->k_len = ieee80211_cipher_keylen(k->k_cipher);
253	k->k_flags = IEEE80211_KEY_GROUP0x00000001 \| IEEE80211_KEY_TX0x00000002;
254	error = copyin(nwkey->i_key[i].i_keydat, k->k_key, k->k_len);
255	if (error != 0)
256	return error;
257	}
258	ess->def_txkey = nwkey->i_defkid - 1;
259	ess->flags \|= IEEE80211_F_WEPON0x00000100;
260
261	return ENETRESET52;
262	}
263
264
265	/* Keep in sync with ieee80211_ioctl.c:ieee80211_ioctl_setwpaparms() */
266	static int
267	ieee80211_ess_setwpaparms(struct ieee80211_ess *ess,
268	const struct ieee80211_wpaparams *wpa)
269	{
270	if (!wpa->i_enabled) {
271	if (!(ess->flags & IEEE80211_F_RSNON0x00200000))
272	return 0;
273	ess->flags &= ~IEEE80211_F_RSNON0x00200000;
274	ess->rsnprotos = 0;
275	ess->rsnakms = 0;
276	ess->rsngroupcipher = 0;
277	ess->rsnciphers = 0;
278	return ENETRESET52;
279	}
280
281	ess->rsnprotos = 0;
282	if (wpa->i_protos & IEEE80211_WPA_PROTO_WPA10x01)
283	ess->rsnprotos \|= IEEE80211_PROTO_WPA(1 << 1);
284	if (wpa->i_protos & IEEE80211_WPA_PROTO_WPA20x02)
285	ess->rsnprotos \|= IEEE80211_PROTO_RSN(1 << 0);
286	if (ess->rsnprotos == 0) /* set to default (RSN) */
287	ess->rsnprotos = IEEE80211_PROTO_RSN(1 << 0);
288
289	ess->rsnakms = 0;
290	if (wpa->i_akms & IEEE80211_WPA_AKM_PSK0x01)
291	ess->rsnakms \|= IEEE80211_AKM_PSK;
292	if (wpa->i_akms & IEEE80211_WPA_AKM_SHA256_PSK0x04)
293	ess->rsnakms \|= IEEE80211_AKM_SHA256_PSK;
294	if (wpa->i_akms & IEEE80211_WPA_AKM_8021X0x02)
295	ess->rsnakms \|= IEEE80211_AKM_8021X;
296	if (wpa->i_akms & IEEE80211_WPA_AKM_SHA256_8021X0x08)
297	ess->rsnakms \|= IEEE80211_AKM_SHA256_8021X;
298	if (ess->rsnakms == 0) /* set to default (PSK) */
299	ess->rsnakms = IEEE80211_AKM_PSK;
300
301	if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_WEP400x02)
302	ess->rsngroupcipher = IEEE80211_CIPHER_WEP40;
303	else if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_TKIP0x04)
304	ess->rsngroupcipher = IEEE80211_CIPHER_TKIP;
305	else if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_CCMP0x08)
306	ess->rsngroupcipher = IEEE80211_CIPHER_CCMP;
307	else if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_WEP1040x10)
308	ess->rsngroupcipher = IEEE80211_CIPHER_WEP104;
309	else { /* set to default */
310	if (ess->rsnprotos & IEEE80211_PROTO_WPA(1 << 1))
311	ess->rsngroupcipher = IEEE80211_CIPHER_TKIP;
312	else
313	ess->rsngroupcipher = IEEE80211_CIPHER_CCMP;
314	}
315
316	ess->rsnciphers = 0;
317	if (wpa->i_ciphers & IEEE80211_WPA_CIPHER_TKIP0x04)
318	ess->rsnciphers \|= IEEE80211_CIPHER_TKIP;
319	if (wpa->i_ciphers & IEEE80211_WPA_CIPHER_CCMP0x08)
320	ess->rsnciphers \|= IEEE80211_CIPHER_CCMP;
321	if (wpa->i_ciphers & IEEE80211_WPA_CIPHER_USEGROUP0x01)
322	ess->rsnciphers = IEEE80211_CIPHER_USEGROUP;
323	if (ess->rsnciphers == 0) { /* set to default (CCMP, TKIP if WPA1) */
324	ess->rsnciphers = IEEE80211_CIPHER_CCMP;
325	if (ess->rsnprotos & IEEE80211_PROTO_WPA(1 << 1))
326	ess->rsnciphers \|= IEEE80211_CIPHER_TKIP;
327	}
328
329	ess->flags \|= IEEE80211_F_RSNON0x00200000;
330
331	if (ess->rsnakms &
332	(IEEE80211_AKM_8021X\|IEEE80211_WPA_AKM_SHA256_8021X0x08))
333	ess->flags \|= IEEE80211_JOIN_8021X0x40;
334
335	return ENETRESET52;
336	}
337
338	static void
339	ieee80211_ess_clear_wep(struct ieee80211_ess *ess)
340	{
341	int i;
342
343	/* Disable WEP */
344	for (i = 0; i < IEEE80211_WEP_NKID4; i++) {
345	explicit_bzero(&ess->nw_keys[i], sizeof(ess->nw_keys[0]));
346	}
347	ess->def_txkey = 0;
348	ess->flags &= ~IEEE80211_F_WEPON0x00000100;
349	}
350
351	static void
352	ieee80211_ess_clear_wpa(struct ieee80211_ess *ess)
353	{
354	/* Disable WPA */
355	ess->rsnprotos = ess->rsnakms = ess->rsngroupcipher =
356	ess->rsnciphers = 0;
357	explicit_bzero(ess->psk, sizeof(ess->psk));
358	ess->flags &= ~(IEEE80211_F_PSK0x00400000 \| IEEE80211_F_RSNON0x00200000);
359	}
360
361	int
362	ieee80211_add_ess(struct ieee80211com ic, struct ieee80211_join join)
363	{
364	struct ieee80211_ess *ess;
365	int new = 0, ness = 0;
366
367	/* only valid for station (aka, client) mode */
368	if (ic->ic_opmode != IEEE80211_M_STA)
369	return (0);
370
371	TAILQ_FOREACH(ess, &ic->ic_ess, ess_next)for((ess) = ((&ic->ic_ess)->tqh_first); (ess) != (( void *)0); (ess) = ((ess)->ess_next.tqe_next)) {
372	if (ess->esslen == join->i_len &&
373	memcmp(ess->essid, join->i_nwid, ess->esslen)__builtin_memcmp((ess->essid), (join->i_nwid), (ess-> esslen)) == 0)
374	break;
375	ness++;
376	}
377
378	if (ess == NULL((void *)0)) {
379	/* if not found, and wpa/wep are set, then return */
380	if ((join->i_flags & IEEE80211_JOIN_WPA0x10) &&
381	(join->i_flags & IEEE80211_JOIN_NWKEY0x08)) {
382	return (EINVAL22);
383	}
384	if (ness > IEEE80211_CACHE_SIZE512)
385	return (ERANGE34);
386	new = 1;
387	ess = malloc(sizeof(*ess), M_DEVBUF2, M_NOWAIT0x0002\|M_ZERO0x0008);
388	if (ess == NULL((void *)0))
389	return (ENOMEM12);
390	memcpy(ess->essid, join->i_nwid, join->i_len)__builtin_memcpy((ess->essid), (join->i_nwid), (join-> i_len));
391	ess->esslen = join->i_len;
392	}
393
394	if (join->i_flags & IEEE80211_JOIN_WPA0x10) {
395	if (join->i_wpaparams.i_enabled) {
396	if (!(ic->ic_caps & IEEE80211_C_RSN0x00001000)) {
397	free(ess, M_DEVBUF2, sizeof(*ess));
398	return ENODEV19;
399	}
400	ieee80211_ess_setwpaparms(ess,
401	&join->i_wpaparams);
402	if (join->i_flags & IEEE80211_JOIN_WPAPSK0x20) {
403	ess->flags \|= IEEE80211_F_PSK0x00400000;
404	explicit_bzero(ess->psk, sizeof(ess->psk));
405	memcpy(ess->psk, &join->i_wpapsk.i_psk,__builtin_memcpy((ess->psk), (&join->i_wpapsk.i_psk ), (sizeof(ess->psk)))
406	sizeof(ess->psk))__builtin_memcpy((ess->psk), (&join->i_wpapsk.i_psk ), (sizeof(ess->psk)));
407	}
408	ieee80211_ess_clear_wep(ess);
409	} else {
410	ieee80211_ess_clear_wpa(ess);
411	}
412	} else if (join->i_flags & IEEE80211_JOIN_NWKEY0x08) {
413	if (join->i_nwkey.i_wepon) {
414	if (!(ic->ic_caps & IEEE80211_C_WEP0x00000001)) {
415	free(ess, M_DEVBUF2, sizeof(*ess));
416	return ENODEV19;
417	}
418	ieee80211_ess_setnwkeys(ess, &join->i_nwkey);
419	ieee80211_ess_clear_wpa(ess);
420	} else {
421	ieee80211_ess_clear_wep(ess);
422	}
423	}
424
425	if (new)
426	TAILQ_INSERT_TAIL(&ic->ic_ess, ess, ess_next)do { (ess)->ess_next.tqe_next = ((void )0); (ess)->ess_next .tqe_prev = (&ic->ic_ess)->tqh_last; (&ic-> ic_ess)->tqh_last = (ess); (&ic->ic_ess)->tqh_last = &(ess)->ess_next.tqe_next; } while (0);
427
428	return (0);
429	}
430
431	uint8_t
432	ieee80211_ess_adjust_rssi(struct ieee80211com ic, struct ieee80211_node ni)
433	{
434	uint8_t rssi = ni->ni_rssi;
435
436	/*
437	* Slightly punish 2 GHz RSSI values since they are usually
438	* stronger than 5 GHz RSSI values.
439	*/
440	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)(((ni->ni_chan)->ic_flags & 0x0080) != 0)) {
441	if (ic->ic_max_rssi) {
442	uint8_t p = (5 * ic->ic_max_rssi) / 100;
443	if (rssi >= p)
444	rssi -= p; /* punish by 5% */
445	} else {
446	if (rssi >= 8)
447	rssi -= 8; /* punish by 8 dBm */
448	}
449	}
450
451	return rssi;
452	}
453
454	int
455	ieee80211_ess_calculate_score(struct ieee80211com *ic,
456	struct ieee80211_node *ni)
457	{
458	int score = 0;
459	uint8_t min_5ghz_rssi;
460
461	if (ic->ic_max_rssi)
462	min_5ghz_rssi = IEEE80211_RSSI_THRES_RATIO_5GHZ50;
463	else
464	min_5ghz_rssi = (uint8_t)IEEE80211_RSSI_THRES_5GHZ(-70);
465
466	/* not using join any */
467	if (ieee80211_get_ess(ic, ni->ni_essid, ni->ni_esslen))
468	score += 32;
469
470	/* Calculate the crypto score */
471	if (ni->ni_rsnprotos & IEEE80211_PROTO_RSN(1 << 0))
472	score += 16;
473	if (ni->ni_rsnprotos & IEEE80211_PROTO_WPA(1 << 1))
474	score += 8;
475	if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY0x0010)
476	score += 4;
477
478	/* 5GHz with a good signal */
479	if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan)(((ni->ni_chan)->ic_flags & 0x0100) != 0) &&
480	ni->ni_rssi > min_5ghz_rssi)
481	score += 2;
482
483	/* HT/VHT available */
484	if (ieee80211_node_supports_ht(ni))
485	score++;
486	if (ieee80211_node_supports_vht(ni))
487	score++;
488
489	/* Boost this AP if it had no auth/assoc failures in the past. */
490	if (ni->ni_fails == 0)
491	score += 21;
492
493	return score;
494	}
495
496	/*
497	* Given two APs, determine the "better" one of the two.
498	* We compute a score based on the following attributes:
499	*
500	* crypto: wpa2 > wpa1 > wep > open
501	* band: 5 GHz > 2 GHz provided 5 GHz rssi is above threshold
502	* supported standard revisions: 11ac > 11n > 11a/b/g
503	* rssi: rssi1 > rssi2 as a numeric comparison with a slight
504	* disadvantage for 2 GHz APs
505	*
506	* Crypto carries most weight, followed by band, followed by rssi.
507	*/
508	int
509	ieee80211_ess_is_better(struct ieee80211com *ic,
510	struct ieee80211_node nicur, struct ieee80211_node nican)
511	{
512	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
513	int score_cur = 0, score_can = 0;
514	int cur_rssi, can_rssi;
515
516	score_cur = ieee80211_ess_calculate_score(ic, nicur);
517	score_can = ieee80211_ess_calculate_score(ic, nican);
518
519	cur_rssi = ieee80211_ess_adjust_rssi(ic, nicur);
520	can_rssi = ieee80211_ess_adjust_rssi(ic, nican);
521
522	if (can_rssi > cur_rssi)
523	score_can++;
524
525	if ((ifp->if_flags & IFF_DEBUG0x4) && (score_can <= score_cur)) {
526	printf("%s: AP %s ", ifp->if_xname,
527	ether_sprintf(nican->ni_bssid));
528	ieee80211_print_essid(nican->ni_essid, nican->ni_esslen);
529	printf(" score %d\n", score_can);
530	}
531
532	return score_can > score_cur;
533	}
534
535	/* Determine whether a candidate AP belongs to a given ESS. */
536	int
537	ieee80211_match_ess(struct ieee80211_ess ess, struct ieee80211_node ni)
538	{
539	if (ess->esslen != 0 &&
540	(ess->esslen != ni->ni_esslen \|\|
541	memcmp(ess->essid, ni->ni_essid, ess->esslen)__builtin_memcmp((ess->essid), (ni->ni_essid), (ess-> esslen)) != 0)) {
542	ni->ni_assoc_fail \|= IEEE80211_NODE_ASSOCFAIL_ESSID0x10;
543	return 0;
544	}
545
546	if (ess->flags & (IEEE80211_F_PSK0x00400000 \| IEEE80211_F_RSNON0x00200000)) {
547	/* Ensure same WPA version. */
548	if ((ni->ni_rsnprotos & IEEE80211_PROTO_RSN(1 << 0)) &&
549	(ess->rsnprotos & IEEE80211_PROTO_RSN(1 << 0)) == 0) {
550	ni->ni_assoc_fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
551	return 0;
552	}
553	if ((ni->ni_rsnprotos & IEEE80211_PROTO_WPA(1 << 1)) &&
554	(ess->rsnprotos & IEEE80211_PROTO_WPA(1 << 1)) == 0) {
555	ni->ni_assoc_fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
556	return 0;
557	}
558	} else if (ess->flags & IEEE80211_F_WEPON0x00000100) {
559	if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY0x0010) == 0) {
560	ni->ni_assoc_fail \|= IEEE80211_NODE_ASSOCFAIL_PRIVACY0x04;
561	return 0;
562	}
563	} else {
564	if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY0x0010) != 0) {
565	ni->ni_assoc_fail \|= IEEE80211_NODE_ASSOCFAIL_PRIVACY0x04;
566	return 0;
567	}
568	}
569
570	if (ess->esslen == 0 &&
571	(ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY0x0010) != 0) {
572	ni->ni_assoc_fail \|= IEEE80211_NODE_ASSOCFAIL_PRIVACY0x04;
573	return 0;
574	}
575
576	return 1;
577	}
578
579	void
580	ieee80211_switch_ess(struct ieee80211com *ic)
581	{
582	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
583	struct ieee80211_ess ess, seless = NULL((void *)0);
584	struct ieee80211_node ni, selni = NULL((void *)0);
585
586	if (!ISSET(ifp->if_flags, IFF_RUNNING)((ifp->if_flags) & (0x40)))
587	return;
588
589	/* Find the best AP matching an entry on our ESS join list. */
590	RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree)for ((ni) = ieee80211_tree_RBT_MIN((&ic->ic_tree)); (ni ) != ((void *)0); (ni) = ieee80211_tree_RBT_NEXT((ni))) {
591	if ((ic->ic_flags & IEEE80211_F_DESBSSID0x00000800) &&
592	!IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid)(__builtin_memcmp((ic->ic_des_bssid), (ni->ni_bssid), ( 6)) == 0))
593	continue;
594
595	TAILQ_FOREACH(ess, &ic->ic_ess, ess_next)for((ess) = ((&ic->ic_ess)->tqh_first); (ess) != (( void *)0); (ess) = ((ess)->ess_next.tqe_next)) {
596	if (ieee80211_match_ess(ess, ni))
597	break;
598	}
599	if (ess == NULL((void *)0))
600	continue;
601
602	/*
603	* Operate only on ic_des_essid if auto-join is disabled.
604	* We might have a password stored for this network.
605	*/
606	if (!ISSET(ic->ic_flags, IEEE80211_F_AUTO_JOIN)((ic->ic_flags) & (0x10000000))) {
607	if (ic->ic_des_esslen == ni->ni_esslen &&
608	memcmp(ic->ic_des_essid, ni->ni_essid,__builtin_memcmp((ic->ic_des_essid), (ni->ni_essid), (ni ->ni_esslen))
609	ni->ni_esslen)__builtin_memcmp((ic->ic_des_essid), (ni->ni_essid), (ni ->ni_esslen)) == 0) {
610	ieee80211_set_ess(ic, ess, ni);
611	return;
612	}
613	continue;
614	}
615
616	if (selni == NULL((void *)0)) {
617	seless = ess;
618	selni = ni;
619	continue;
620	}
621
622	if (ieee80211_ess_is_better(ic, selni, ni)) {
623	seless = ess;
624	selni = ni;
625	}
626	}
627
628	if (selni && seless && !(selni->ni_esslen == ic->ic_des_esslen &&
629	(memcmp(ic->ic_des_essid, selni->ni_essid,__builtin_memcmp((ic->ic_des_essid), (selni->ni_essid), (32))
630	IEEE80211_NWID_LEN)__builtin_memcmp((ic->ic_des_essid), (selni->ni_essid), (32)) == 0))) {
631	if (ifp->if_flags & IFF_DEBUG0x4) {
632	printf("%s: best AP %s ", ifp->if_xname,
633	ether_sprintf(selni->ni_bssid));
634	ieee80211_print_essid(selni->ni_essid,
635	selni->ni_esslen);
636	printf(" score %d\n",
637	ieee80211_ess_calculate_score(ic, selni));
638	printf("%s: switching to network ", ifp->if_xname);
639	ieee80211_print_essid(selni->ni_essid,
640	selni->ni_esslen);
641	if (seless->esslen == 0)
642	printf(" via join any");
643	printf("\n");
644
645	}
646	ieee80211_set_ess(ic, seless, selni);
647	}
648	}
649
650	void
651	ieee80211_set_ess(struct ieee80211com ic, struct ieee80211_ess ess,
652	struct ieee80211_node *ni)
653	{
654	memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN)__builtin_memset((ic->ic_des_essid), (0), (32));
655	ic->ic_des_esslen = ni->ni_esslen;
656	memcpy(ic->ic_des_essid, ni->ni_essid, ic->ic_des_esslen)__builtin_memcpy((ic->ic_des_essid), (ni->ni_essid), (ic ->ic_des_esslen));
657
658	ieee80211_disable_wep(ic);
659	ieee80211_disable_rsn(ic);
660
661	if (ess->flags & IEEE80211_F_RSNON0x00200000) {
662	explicit_bzero(ic->ic_psk, sizeof(ic->ic_psk));
663	memcpy(ic->ic_psk, ess->psk, sizeof(ic->ic_psk))__builtin_memcpy((ic->ic_psk), (ess->psk), (sizeof(ic-> ic_psk)));
664
665	ic->ic_rsnprotos = ess->rsnprotos;
666	ic->ic_rsnakms = ess->rsnakms;
667	ic->ic_rsngroupcipher = ess->rsngroupcipher;
668	ic->ic_rsnciphers = ess->rsnciphers;
669	ic->ic_flags \|= IEEE80211_F_RSNON0x00200000;
670	if (ess->flags & IEEE80211_F_PSK0x00400000)
671	ic->ic_flags \|= IEEE80211_F_PSK0x00400000;
672	} else if (ess->flags & IEEE80211_F_WEPON0x00000100) {
673	struct ieee80211_key *k;
674	int i;
675
676	for (i = 0; i < IEEE80211_WEP_NKID4; i++) {
677	k = &ic->ic_nw_keys[i];
678	if (k->k_cipher != IEEE80211_CIPHER_NONE)
679	(ic->ic_delete_key)(ic, NULL((void )0), k);
680	memcpy(&ic->ic_nw_keys[i], &ess->nw_keys[i],__builtin_memcpy((&ic->ic_nw_keys[i]), (&ess->nw_keys [i]), (sizeof(struct ieee80211_key)))
681	sizeof(struct ieee80211_key))__builtin_memcpy((&ic->ic_nw_keys[i]), (&ess->nw_keys [i]), (sizeof(struct ieee80211_key)));
682	if (k->k_cipher != IEEE80211_CIPHER_NONE)
683	(ic->ic_set_key)(ic, NULL((void )0), k);
684	}
685	ic->ic_def_txkey = ess->def_txkey;
686	ic->ic_flags \|= IEEE80211_F_WEPON0x00000100;
687	}
688	}
689
690	void
691	ieee80211_deselect_ess(struct ieee80211com *ic)
692	{
693	memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN)__builtin_memset((ic->ic_des_essid), (0), (32));
694	ic->ic_des_esslen = 0;
695	ieee80211_disable_wep(ic);
696	ieee80211_disable_rsn(ic);
697	}
698
699	void
700	ieee80211_node_attach(struct ifnet *ifp)
701	{
702	struct ieee80211com ic = (void )ifp;
703	#ifndef IEEE80211_STA_ONLY
704	int size;
705	#endif
706
707	RBT_INIT(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_INIT(&ic->ic_tree);
708	ic->ic_node_alloc = ieee80211_node_alloc;
709	ic->ic_node_free = ieee80211_node_free;
710	ic->ic_node_copy = ieee80211_node_copy;
711	ic->ic_node_getrssi = ieee80211_node_getrssi;
712	ic->ic_node_checkrssi = ieee80211_node_checkrssi;
713	ic->ic_scangen = 1;
714	ic->ic_max_nnodes = ieee80211_cache_size;
715
716	if (ic->ic_max_aid == 0)
717	ic->ic_max_aid = IEEE80211_AID_DEF1800;
718	else if (ic->ic_max_aid > IEEE80211_AID_MAX2007)
719	ic->ic_max_aid = IEEE80211_AID_MAX2007;
720	#ifndef IEEE80211_STA_ONLY
721	size = howmany(ic->ic_max_aid, 32)(((ic->ic_max_aid) + ((32) - 1)) / (32)) * sizeof(u_int32_t);
722	ic->ic_aid_bitmap = malloc(size, M_DEVBUF2, M_NOWAIT0x0002 \| M_ZERO0x0008);
723	if (ic->ic_aid_bitmap == NULL((void *)0)) {
724	/* XXX no way to recover */
725	printf("%s: no memory for AID bitmap!\n", __func__);
726	ic->ic_max_aid = 0;
727	}
728	if (ic->ic_caps & (IEEE80211_C_HOSTAP0x00000008 \| IEEE80211_C_IBSS0x00000002)) {
729	ic->ic_tim_len = howmany(ic->ic_max_aid, 8)(((ic->ic_max_aid) + ((8) - 1)) / (8));
730	ic->ic_tim_bitmap = malloc(ic->ic_tim_len, M_DEVBUF2,
731	M_NOWAIT0x0002 \| M_ZERO0x0008);
732	if (ic->ic_tim_bitmap == NULL((void *)0)) {
733	printf("%s: no memory for TIM bitmap!\n", __func__);
734	ic->ic_tim_len = 0;
735	} else
736	ic->ic_set_tim = ieee80211_set_tim;
737	timeout_set(&ic->ic_rsn_timeout,
738	ieee80211_gtk_rekey_timeout, ic);
739	timeout_set(&ic->ic_inact_timeout,
740	ieee80211_inact_timeout, ic);
741	timeout_set(&ic->ic_node_cache_timeout,
742	ieee80211_node_cache_timeout, ic);
743	}
744	#endif
745	TAILQ_INIT(&ic->ic_ess)do { (&ic->ic_ess)->tqh_first = ((void *)0); (& ic->ic_ess)->tqh_last = &(&ic->ic_ess)->tqh_first ; } while (0);
746	}
747
748	struct ieee80211_node *
749	ieee80211_alloc_node_helper(struct ieee80211com *ic)
750	{
751	struct ieee80211_node *ni;
752	if (ic->ic_nnodes >= ic->ic_max_nnodes)
753	ieee80211_clean_nodes(ic, 0);
754	if (ic->ic_nnodes >= ic->ic_max_nnodes)
755	return NULL((void *)0);
756	ni = (*ic->ic_node_alloc)(ic);
757	return ni;
758	}
759
760	void
761	ieee80211_node_lateattach(struct ifnet *ifp)
762	{
763	struct ieee80211com ic = (void )ifp;
764	struct ieee80211_node *ni;
765
766	ni = ieee80211_alloc_node_helper(ic);
767	if (ni == NULL((void *)0))
768	panic("unable to setup initial BSS node");
769	ni->ni_chan = IEEE80211_CHAN_ANYC((struct ieee80211_channel ) ((void )0));
770	ic->ic_bss = ieee80211_ref_node(ni);
771	ic->ic_txpower = IEEE80211_TXPOWER_MAX100;
772	#ifndef IEEE80211_STA_ONLY
773	mq_init(&ni->ni_savedq, IEEE80211_PS_MAX_QUEUE50, IPL_NET0x4);
774	#endif
775	}
776
777	void
778	ieee80211_node_detach(struct ifnet *ifp)
779	{
780	struct ieee80211com ic = (void )ifp;
781
782	if (ic->ic_bss != NULL((void *)0)) {
783	(*ic->ic_node_free)(ic, ic->ic_bss);
784	ic->ic_bss = NULL((void *)0);
785	}
786	ieee80211_del_ess(ic, NULL((void *)0), 0, 1);
787	ieee80211_free_allnodes(ic, 1);
788	#ifndef IEEE80211_STA_ONLY
789	free(ic->ic_aid_bitmap, M_DEVBUF2,
790	howmany(ic->ic_max_aid, 32)(((ic->ic_max_aid) + ((32) - 1)) / (32)) * sizeof(u_int32_t));
791	free(ic->ic_tim_bitmap, M_DEVBUF2, ic->ic_tim_len);
792	timeout_del(&ic->ic_inact_timeout);
793	timeout_del(&ic->ic_node_cache_timeout);
794	timeout_del(&ic->ic_tkip_micfail_timeout);
795	#endif
796	timeout_del(&ic->ic_rsn_timeout);
797	}
798
799	/*
800	* AP scanning support.
801	*/
802
803	/*
804	* Initialize the active channel set based on the set
805	* of available channels and the current PHY mode.
806	*/
807	void
808	ieee80211_reset_scan(struct ifnet *ifp)
809	{
810	struct ieee80211com ic = (void )ifp;
811
812	memcpy(ic->ic_chan_scan, ic->ic_chan_active,__builtin_memcpy((ic->ic_chan_scan), (ic->ic_chan_active ), (sizeof(ic->ic_chan_active)))
813	sizeof(ic->ic_chan_active))__builtin_memcpy((ic->ic_chan_scan), (ic->ic_chan_active ), (sizeof(ic->ic_chan_active)));
814	/* NB: hack, setup so next_scan starts with the first channel */
815	if (ic->ic_bss != NULL((void )0) && ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC((struct ieee80211_channel ) ((void *)0)))
816	ic->ic_bss->ni_chan = &ic->ic_channels[IEEE80211_CHAN_MAX255];
817	}
818
819	/*
820	* Increase a node's inactivity counter.
821	* This counter get reset to zero if a frame is received.
822	* This function is intended for station mode only.
823	* See ieee80211_node_cache_timeout() for hostap mode.
824	*/
825	void
826	ieee80211_node_raise_inact(void arg, struct ieee80211_node ni)
827	{
828	if (ni->ni_refcnt == 0 && ni->ni_inact < IEEE80211_INACT_SCAN10)
829	ni->ni_inact++;
830	}
831
832	/*
833	* Begin an active scan.
834	*/
835	void
836	ieee80211_begin_scan(struct ifnet *ifp)
837	{
838	struct ieee80211com ic = (void )ifp;
839
840	/*
841	* In all but hostap mode scanning starts off in
842	* an active mode before switching to passive.
843	*/
844	#ifndef IEEE80211_STA_ONLY
845	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
846	#endif
847	{
848	ic->ic_flags \|= IEEE80211_F_ASCAN0x00000001;
849	ic->ic_stats.is_scan_active++;
850	}
851	#ifndef IEEE80211_STA_ONLY
852	else
853	ic->ic_stats.is_scan_passive++;
854	#endif
855	if (ifp->if_flags & IFF_DEBUG0x4)
856	printf("%s: begin %s scan\n", ifp->if_xname,
857	(ic->ic_flags & IEEE80211_F_ASCAN0x00000001) ?
858	"active" : "passive");
859
860
861	if (ic->ic_opmode == IEEE80211_M_STA) {
862	ieee80211_node_cleanup(ic, ic->ic_bss);
863	ieee80211_iterate_nodes(ic, ieee80211_node_raise_inact, NULL((void *)0));
864	}
865
866	/*
867	* Reset the current mode. Setting the current mode will also
868	* reset scan state.
869	*/
870	if (IFM_MODE(ic->ic_media.ifm_cur->ifm_media)((ic->ic_media.ifm_cur->ifm_media) & 0x000000ff00000000ULL ) == IFM_AUTO0ULL)
871	ic->ic_curmode = IEEE80211_MODE_AUTO;
872	ieee80211_setmode(ic, ic->ic_curmode);
873
874	ic->ic_scan_count = 0;
875
876	/* Scan the next channel. */
877	ieee80211_next_scan(ifp);
878	}
879
880	/*
881	* Switch to the next channel marked for scanning.
882	*/
883	void
884	ieee80211_next_scan(struct ifnet *ifp)
885	{
886	struct ieee80211com ic = (void )ifp;
887	struct ieee80211_channel *chan;
888
889	chan = ic->ic_bss->ni_chan;
890	for (;;) {
891	if (++chan > &ic->ic_channels[IEEE80211_CHAN_MAX255])
892	chan = &ic->ic_channels[0];
893	if (isset(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan))((ic->ic_chan_scan)[(ieee80211_chan2ieee(ic, chan))>> 3] & (1<<((ieee80211_chan2ieee(ic, chan))&(8 -1 ))))) {
894	/*
895	* Ignore channels marked passive-only
896	* during an active scan.
897	*/
898	if ((ic->ic_flags & IEEE80211_F_ASCAN0x00000001) == 0 \|\|
899	(chan->ic_flags & IEEE80211_CHAN_PASSIVE0x0200) == 0)
900	break;
901	}
902	if (chan == ic->ic_bss->ni_chan) {
903	ieee80211_end_scan(ifp);
904	return;
905	}
906	}
907	clrbit(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan))((ic->ic_chan_scan)[(ieee80211_chan2ieee(ic, chan))>> 3] &= ~(1<<((ieee80211_chan2ieee(ic, chan))&(8 - 1))));
908	DPRINTF(("chan %d->%d\n",
909	ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
910	ieee80211_chan2ieee(ic, chan)));
911	ic->ic_bss->ni_chan = chan;
912	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
913	}
914
915	#ifndef IEEE80211_STA_ONLY
916	void
917	ieee80211_create_ibss(struct ieee80211com* ic, struct ieee80211_channel *chan)
918	{
919	enum ieee80211_phymode mode;
920	struct ieee80211_node *ni;
921	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
922
923	ni = ic->ic_bss;
924	if (ifp->if_flags & IFF_DEBUG0x4)
925	printf("%s: creating ibss\n", ifp->if_xname);
926	ic->ic_flags \|= IEEE80211_F_SIBSS0x00000002;
927	ni->ni_chan = chan;
928	if ((ic->ic_flags & IEEE80211_F_VHTON0x20000000) && IEEE80211_IS_CHAN_5GHZ(chan)(((chan)->ic_flags & 0x0100) != 0))
929	mode = IEEE80211_MODE_11AC;
930	else if (ic->ic_flags & IEEE80211_F_HTON0x02000000)
931	mode = IEEE80211_MODE_11N;
932	else
933	mode = ieee80211_chan2mode(ic, ni->ni_chan);
934	ieee80211_setmode(ic, mode);
935	/* Pick an appropriate mode for supported legacy rates. */
936	if (ic->ic_curmode == IEEE80211_MODE_11AC) {
937	mode = IEEE80211_MODE_11A;
938	} else if (ic->ic_curmode == IEEE80211_MODE_11N) {
939	if (IEEE80211_IS_CHAN_5GHZ(chan)(((chan)->ic_flags & 0x0100) != 0))
940	mode = IEEE80211_MODE_11A;
941	else
942	mode = IEEE80211_MODE_11G;
943	} else {
944	mode = ic->ic_curmode;
945	}
946	ni->ni_rates = ic->ic_sup_rates[mode];
947	ni->ni_txrate = 0;
948	IEEE80211_ADDR_COPY(ni->ni_macaddr, ic->ic_myaddr)__builtin_memcpy((ni->ni_macaddr), (ic->ic_myaddr), (6) );
949	IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_myaddr)__builtin_memcpy((ni->ni_bssid), (ic->ic_myaddr), (6));
950	if (ic->ic_opmode == IEEE80211_M_IBSS) {
951	if ((ic->ic_flags & IEEE80211_F_DESBSSID0x00000800) != 0)
952	IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_des_bssid)__builtin_memcpy((ni->ni_bssid), (ic->ic_des_bssid), (6 ));
953	else
954	ni->ni_bssid[0] \|= 0x02; /* local bit for IBSS */
955	}
956	ni->ni_esslen = ic->ic_des_esslen;
957	memcpy(ni->ni_essid, ic->ic_des_essid, ni->ni_esslen)__builtin_memcpy((ni->ni_essid), (ic->ic_des_essid), (ni ->ni_esslen));
958	ni->ni_rssi = 0;
959	ni->ni_rstamp = 0;
960	memset(ni->ni_tstamp, 0, sizeof(ni->ni_tstamp))__builtin_memset((ni->ni_tstamp), (0), (sizeof(ni->ni_tstamp )));
961	ni->ni_intval = ic->ic_lintval;
962	ni->ni_capinfo = IEEE80211_CAPINFO_IBSS0x0002;
963	if (ic->ic_flags & IEEE80211_F_WEPON0x00000100)
964	ni->ni_capinfo \|= IEEE80211_CAPINFO_PRIVACY0x0010;
965	if (ic->ic_flags & IEEE80211_F_HTON0x02000000) {
966	const struct ieee80211_edca_ac_params *ac_qap;
967	struct ieee80211_edca_ac_params *ac;
968	int aci;
969
970	/*
971	* Configure HT protection. This will be updated later
972	* based on the number of non-HT nodes in the node cache.
973	*/
974	ic->ic_protmode = IEEE80211_PROT_NONE;
975	ni->ni_htop1 = IEEE80211_HTPROT_NONE;
976	/* Disallow Greenfield mode. None of our drivers support it. */
977	ni->ni_htop1 \|= IEEE80211_HTOP1_NONGF_STA0x0004;
978	if (ic->ic_updateprot)
979	ic->ic_updateprot(ic);
980
981	/* Configure QoS EDCA parameters. */
982	for (aci = 0; aci < EDCA_NUM_AC4; aci++) {
983	ac = &ic->ic_edca_ac[aci];
984	ac_qap = &ieee80211_qap_edca_table[ic->ic_curmode][aci];
985	ac->ac_acm = ac_qap->ac_acm;
986	ac->ac_aifsn = ac_qap->ac_aifsn;
987	ac->ac_ecwmin = ac_qap->ac_ecwmin;
988	ac->ac_ecwmax = ac_qap->ac_ecwmax;
989	ac->ac_txoplimit = ac_qap->ac_txoplimit;
990	}
991	if (ic->ic_updateedca)
992	(*ic->ic_updateedca)(ic);
993	}
994	if (ic->ic_flags & IEEE80211_F_RSNON0x00200000) {
995	struct ieee80211_key *k;
996
997	/* initialize 256-bit global key counter to a random value */
998	arc4random_buf(ic->ic_globalcnt, EAPOL_KEY_NONCE_LEN32);
999
1000	ni->ni_rsnprotos = ic->ic_rsnprotos;
1001	ni->ni_rsnakms = ic->ic_rsnakms;
1002	ni->ni_rsnciphers = ic->ic_rsnciphers;
1003	ni->ni_rsngroupcipher = ic->ic_rsngroupcipher;
1004	ni->ni_rsngroupmgmtcipher = ic->ic_rsngroupmgmtcipher;
1005	ni->ni_rsncaps = 0;
1006	if (ic->ic_caps & IEEE80211_C_MFP0x00002000) {
1007	ni->ni_rsncaps \|= IEEE80211_RSNCAP_MFPC0x0080;
1008	if (ic->ic_flags & IEEE80211_F_MFPR0x01000000)
1009	ni->ni_rsncaps \|= IEEE80211_RSNCAP_MFPR0x0040;
1010	}
1011
1012	ic->ic_def_txkey = 1;
1013	ic->ic_flags &= ~IEEE80211_F_COUNTERM0x00800000;
1014	k = &ic->ic_nw_keys[ic->ic_def_txkey];
1015	memset(k, 0, sizeof(k))__builtin_memset((k), (0), (sizeof(k)));
1016	k->k_id = ic->ic_def_txkey;
1017	k->k_cipher = ni->ni_rsngroupcipher;
1018	k->k_flags = IEEE80211_KEY_GROUP0x00000001 \| IEEE80211_KEY_TX0x00000002;
1019	k->k_len = ieee80211_cipher_keylen(k->k_cipher);
1020	arc4random_buf(k->k_key, k->k_len);
1021	(ic->ic_set_key)(ic, ni, k); / XXX */
1022
1023	if (ic->ic_caps & IEEE80211_C_MFP0x00002000) {
1024	ic->ic_igtk_kid = 4;
1025	k = &ic->ic_nw_keys[ic->ic_igtk_kid];
1026	memset(k, 0, sizeof(k))__builtin_memset((k), (0), (sizeof(k)));
1027	k->k_id = ic->ic_igtk_kid;
1028	k->k_cipher = ni->ni_rsngroupmgmtcipher;
1029	k->k_flags = IEEE80211_KEY_IGTK0x00000004 \| IEEE80211_KEY_TX0x00000002;
1030	k->k_len = 16;
1031	arc4random_buf(k->k_key, k->k_len);
1032	(ic->ic_set_key)(ic, ni, k); / XXX */
1033	}
1034	/*
1035	* In HostAP mode, multicast traffic is sent using ic_bss
1036	* as the Tx node, so mark our node as valid so we can send
1037	* multicast frames using the group key we've just configured.
1038	*/
1039	ni->ni_port_valid = 1;
1040	ni->ni_flags \|= IEEE80211_NODE_TXPROT0x0010;
1041
1042	/* schedule a GTK/IGTK rekeying after 3600s */
1043	timeout_add_sec(&ic->ic_rsn_timeout, 3600);
1044	}
1045	timeout_add_sec(&ic->ic_inact_timeout, IEEE80211_INACT_WAIT5);
1046	timeout_add_sec(&ic->ic_node_cache_timeout, IEEE80211_CACHE_WAIT30);
1047	ieee80211_new_state(ic, IEEE80211_S_RUN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_RUN), (-1)));
1048	}
1049	#endif /* IEEE80211_STA_ONLY */
1050
1051	int
1052	ieee80211_match_bss(struct ieee80211com ic, struct ieee80211_node ni,
1053	int bgscan)
1054	{
1055	u_int8_t rate;
1056	int fail;
1057
1058	fail = 0;
1059	if ((ic->ic_flags & IEEE80211_F_BGSCAN0x08000000) == 0 &&
1060	isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan))(((ic->ic_chan_active)[(ieee80211_chan2ieee(ic, ni->ni_chan ))>>3] & (1<<((ieee80211_chan2ieee(ic, ni-> ni_chan))&(8 -1)))) == 0))
1061	fail \|= IEEE80211_NODE_ASSOCFAIL_CHAN0x01;
1062	if (ic->ic_des_chan != IEEE80211_CHAN_ANYC((struct ieee80211_channel ) ((void )0)) &&
1063	ni->ni_chan != ic->ic_des_chan)
1064	fail \|= IEEE80211_NODE_ASSOCFAIL_CHAN0x01;
1065	#ifndef IEEE80211_STA_ONLY
1066	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1067	if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS0x0002) == 0)
1068	fail \|= IEEE80211_NODE_ASSOCFAIL_IBSS0x02;
1069	} else
1070	#endif
1071	{
1072	if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS0x0001) == 0)
1073	fail \|= IEEE80211_NODE_ASSOCFAIL_IBSS0x02;
1074	}
1075	if (ic->ic_flags & (IEEE80211_F_WEPON0x00000100 \| IEEE80211_F_RSNON0x00200000)) {
1076	if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY0x0010) == 0)
1077	fail \|= IEEE80211_NODE_ASSOCFAIL_PRIVACY0x04;
1078	} else {
1079	if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY0x0010)
1080	fail \|= IEEE80211_NODE_ASSOCFAIL_PRIVACY0x04;
1081	}
1082
1083	rate = ieee80211_fix_rate(ic, ni, IEEE80211_F_DONEGO0x00000004);
1084	if (rate & IEEE80211_RATE_BASIC0x80)
1085	fail \|= IEEE80211_NODE_ASSOCFAIL_BASIC_RATE0x08;
1086	if (ic->ic_des_esslen == 0)
1087	fail \|= IEEE80211_NODE_ASSOCFAIL_ESSID0x10;
1088	if (ic->ic_des_esslen != 0 &&
1089	(ni->ni_esslen != ic->ic_des_esslen \|\|
1090	memcmp(ni->ni_essid, ic->ic_des_essid, ic->ic_des_esslen)__builtin_memcmp((ni->ni_essid), (ic->ic_des_essid), (ic ->ic_des_esslen)) != 0))
1091	fail \|= IEEE80211_NODE_ASSOCFAIL_ESSID0x10;
1092	if ((ic->ic_flags & IEEE80211_F_DESBSSID0x00000800) &&
1093	!IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid)(__builtin_memcmp((ic->ic_des_bssid), (ni->ni_bssid), ( 6)) == 0))
1094	fail \|= IEEE80211_NODE_ASSOCFAIL_BSSID0x20;
1095
1096	if (ic->ic_flags & IEEE80211_F_RSNON0x00200000) {
1097	/*
1098	* If at least one RSN IE field from the AP's RSN IE fails
1099	* to overlap with any value the STA supports, the STA shall
1100	* decline to associate with that AP.
1101	*/
1102	if ((ni->ni_rsnprotos & ic->ic_rsnprotos) == 0)
1103	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1104	if ((ni->ni_rsnakms & ic->ic_rsnakms) == 0)
1105	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1106	if ((ni->ni_rsnakms & ic->ic_rsnakms &
1107	~(IEEE80211_AKM_PSK \| IEEE80211_AKM_SHA256_PSK)) == 0) {
1108	/* AP only supports PSK AKMPs */
1109	if (!(ic->ic_flags & IEEE80211_F_PSK0x00400000))
1110	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1111	}
1112	if (ni->ni_rsngroupcipher != IEEE80211_CIPHER_WEP40 &&
1113	ni->ni_rsngroupcipher != IEEE80211_CIPHER_TKIP &&
1114	ni->ni_rsngroupcipher != IEEE80211_CIPHER_CCMP &&
1115	ni->ni_rsngroupcipher != IEEE80211_CIPHER_WEP104)
1116	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1117	if ((ni->ni_rsnciphers & ic->ic_rsnciphers) == 0)
1118	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1119
1120	/* we only support BIP as the IGTK cipher */
1121	if ((ni->ni_rsncaps & IEEE80211_RSNCAP_MFPC0x0080) &&
1122	ni->ni_rsngroupmgmtcipher != IEEE80211_CIPHER_BIP)
1123	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1124
1125	/* we do not support MFP but AP requires it */
1126	if (!(ic->ic_caps & IEEE80211_C_MFP0x00002000) &&
1127	(ni->ni_rsncaps & IEEE80211_RSNCAP_MFPR0x0040))
1128	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1129
1130	/* we require MFP but AP does not support it */
1131	if ((ic->ic_caps & IEEE80211_C_MFP0x00002000) &&
1132	(ic->ic_flags & IEEE80211_F_MFPR0x01000000) &&
1133	!(ni->ni_rsncaps & IEEE80211_RSNCAP_MFPC0x0080))
1134	fail \|= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40;
1135	}
1136
1137	if (ic->ic_ific_ac.ac_if.if_flags & IFF_DEBUG0x4) {
1138	printf("%s: %c %s%c", ic->ic_ific_ac.ac_if.if_xname, fail ? '-' : '+',
1139	ether_sprintf(ni->ni_bssid),
1140	fail & IEEE80211_NODE_ASSOCFAIL_BSSID0x20 ? '!' : ' ');
1141	printf(" %3d%c", ieee80211_chan2ieee(ic, ni->ni_chan),
1142	fail & IEEE80211_NODE_ASSOCFAIL_CHAN0x01 ? '!' : ' ');
1143	printf(" %+4d", ni->ni_rssi);
1144	printf(" %2dM%c", (rate & IEEE80211_RATE_VAL0x7f) / 2,
1145	fail & IEEE80211_NODE_ASSOCFAIL_BASIC_RATE0x08 ? '!' : ' ');
1146	printf(" %4s%c",
1147	(ni->ni_capinfo & IEEE80211_CAPINFO_ESS0x0001) ? "ess" :
1148	(ni->ni_capinfo & IEEE80211_CAPINFO_IBSS0x0002) ? "ibss" :
1149	"????",
1150	fail & IEEE80211_NODE_ASSOCFAIL_IBSS0x02 ? '!' : ' ');
1151	printf(" %7s%c ",
1152	(ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY0x0010) ?
1153	"privacy" : "no",
1154	fail & IEEE80211_NODE_ASSOCFAIL_PRIVACY0x04 ? '!' : ' ');
1155	printf(" %3s%c ",
1156	(ic->ic_flags & IEEE80211_F_RSNON0x00200000) ?
1157	"rsn" : "no",
1158	fail & IEEE80211_NODE_ASSOCFAIL_WPA_PROTO0x40 ? '!' : ' ');
1159	ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
1160	printf("%s\n",
1161	fail & IEEE80211_NODE_ASSOCFAIL_ESSID0x10 ? "!" : "");
1162	}
1163
1164	/* We don't care about unrelated networks during background scans. */
1165	if (bgscan) {
1166	if ((fail & IEEE80211_NODE_ASSOCFAIL_ESSID0x10) == 0)
1167	ni->ni_assoc_fail = fail;
1168	} else
1169	ni->ni_assoc_fail = fail;
1170	if ((fail & IEEE80211_NODE_ASSOCFAIL_ESSID0x10) == 0)
1171	ic->ic_bss->ni_assoc_fail = ni->ni_assoc_fail;
1172
1173	return fail;
1174	}
1175
1176	struct ieee80211_node_switch_bss_arg {
1177	u_int8_t cur_macaddr[IEEE80211_ADDR_LEN6];
1178	u_int8_t sel_macaddr[IEEE80211_ADDR_LEN6];
1179	};
1180
1181	void
1182	ieee80211_node_free_unref_cb(struct ieee80211_node *ni)
1183	{
1184	free(ni->ni_unref_arg, M_DEVBUF2, ni->ni_unref_arg_size);
1185
1186	/* Guard against accidental reuse. */
1187	ni->ni_unref_cb = NULL((void *)0);
1188	ni->ni_unref_arg = NULL((void *)0);
1189	ni->ni_unref_arg_size = 0;
1190	}
1191
1192	/* Implements ni->ni_unref_cb(). */
1193	void
1194	ieee80211_node_tx_stopped(struct ieee80211com *ic,
1195	struct ieee80211_node *ni)
1196	{
1197	splassert(IPL_NET)do { if (splassert_ctl > 0) { splassert_check(0x4, __func__ ); } } while (0);
1198
1199	if ((ic->ic_flags & IEEE80211_F_BGSCAN0x08000000) == 0)
1200	return;
1201
1202	/*
1203	* Install a callback which will switch us to the new AP once
1204	* the de-auth frame has been processed by hardware.
1205	* Pass on the existing ni->ni_unref_arg argument.
1206	*/
1207	ic->ic_bss->ni_unref_cb = ieee80211_node_switch_bss;
1208
1209	/*
1210	* All data frames queued to hardware have been flushed and
1211	* A-MPDU Tx has been stopped. We are now going to switch APs.
1212	* Queue a de-auth frame addressed at our current AP.
1213	*/
1214	if (IEEE80211_SEND_MGMT(ic, ic->ic_bss,((*(ic)->ic_send_mgmt)(ic, ic->ic_bss, 0xc0, IEEE80211_REASON_AUTH_LEAVE , 0))
1215	IEEE80211_FC0_SUBTYPE_DEAUTH,((*(ic)->ic_send_mgmt)(ic, ic->ic_bss, 0xc0, IEEE80211_REASON_AUTH_LEAVE , 0))
1216	IEEE80211_REASON_AUTH_LEAVE)((*(ic)->ic_send_mgmt)(ic, ic->ic_bss, 0xc0, IEEE80211_REASON_AUTH_LEAVE , 0)) != 0) {
1217	ic->ic_flags &= ~IEEE80211_F_BGSCAN0x08000000;
1218	ieee80211_node_free_unref_cb(ni);
1219	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
1220	return;
1221	}
1222
1223	/* F_BGSCAN flag gets cleared in ieee80211_node_join_bss(). */
1224	}
1225
1226	/* Implements ni->ni_unref_cb(). */
1227	void
1228	ieee80211_node_tx_flushed(struct ieee80211com ic, struct ieee80211_node ni)
1229	{
1230	splassert(IPL_NET)do { if (splassert_ctl > 0) { splassert_check(0x4, __func__ ); } } while (0);
1231
1232	if ((ic->ic_flags & IEEE80211_F_BGSCAN0x08000000) == 0)
1233	return;
1234
1235	/* All data frames queued to hardware have been flushed. */
1236	if (ic->ic_caps & IEEE80211_C_TX_AMPDU0x00010000) {
1237	/*
1238	* Install a callback which will switch us to the
1239	* new AP once Tx agg sessions have been stopped,
1240	* which involves sending a DELBA frame.
1241	* Pass on the existing ni->ni_unref_arg argument.
1242	*/
1243	ic->ic_bss->ni_unref_cb = ieee80211_node_tx_stopped;
1244	ieee80211_stop_ampdu_tx(ic, ic->ic_bss,
1245	IEEE80211_FC0_SUBTYPE_DEAUTH0xc0);
1246	} else
1247	ieee80211_node_tx_stopped(ic, ni);
1248	}
1249
1250	/* Implements ni->ni_unref_cb(). */
1251	void
1252	ieee80211_node_switch_bss(struct ieee80211com ic, struct ieee80211_node ni)
1253	{
1254	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
1255	struct ieee80211_node_switch_bss_arg *sba = ni->ni_unref_arg;
1256	struct ieee80211_node curbs, selbs;
1257
1258	splassert(IPL_NET)do { if (splassert_ctl > 0) { splassert_check(0x4, __func__ ); } } while (0);
1259
1260	if ((ic->ic_flags & IEEE80211_F_BGSCAN0x08000000) == 0)
1261	return;
1262
1263	ic->ic_xflags &= ~IEEE80211_F_TX_MGMT_ONLY0x00000001;
1264
1265	selbs = ieee80211_find_node(ic, sba->sel_macaddr);
1266	if (selbs == NULL((void *)0)) {
1267	ieee80211_node_free_unref_cb(ni);
1268	ic->ic_flags &= ~IEEE80211_F_BGSCAN0x08000000;
1269	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
1270	return;
1271	}
1272
1273	curbs = ieee80211_find_node(ic, sba->cur_macaddr);
1274	if (curbs == NULL((void *)0)) {
1275	ieee80211_node_free_unref_cb(ni);
1276	ic->ic_flags &= ~IEEE80211_F_BGSCAN0x08000000;
1277	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
1278	return;
1279	}
1280
1281	if (ifp->if_flags & IFF_DEBUG0x4) {
1282	printf("%s: roaming from %s chan %d ",
1283	ifp->if_xname, ether_sprintf(curbs->ni_macaddr),
1284	ieee80211_chan2ieee(ic, curbs->ni_chan));
1285	printf("to %s chan %d\n", ether_sprintf(selbs->ni_macaddr),
1286	ieee80211_chan2ieee(ic, selbs->ni_chan));
1287	}
1288	ieee80211_node_newstate(curbs, IEEE80211_STA_CACHE)do { (curbs)->ni_state = (IEEE80211_STA_CACHE); } while (0 );
1289	/*
1290	* ieee80211_node_join_bss() frees arg and ic->ic_bss via
1291	* ic->ic_node_copy() in ieee80211_node_cleanup().
1292	*/
1293	ieee80211_node_join_bss(ic, selbs);
1294	}
1295
1296	void
1297	ieee80211_node_join_bss(struct ieee80211com ic, struct ieee80211_node selbs)
1298	{
1299	enum ieee80211_phymode mode;
1300	struct ieee80211_node *ni;
1301	uint32_t assoc_fail = 0;
1302
1303	/* Reinitialize media mode and channels if needed. */
1304	mode = ieee80211_chan2mode(ic, selbs->ni_chan);
1305	if (mode != ic->ic_curmode)
1306	ieee80211_setmode(ic, mode);
1307
1308	/* Keep recorded association failures for this BSS/ESS intact. */
1309	if (IEEE80211_ADDR_EQ(ic->ic_bss->ni_macaddr, selbs->ni_macaddr)(__builtin_memcmp((ic->ic_bss->ni_macaddr), (selbs-> ni_macaddr), (6)) == 0) \|\|
1310	(ic->ic_des_esslen > 0 && ic->ic_des_esslen == selbs->ni_esslen &&
1311	memcmp(ic->ic_des_essid, selbs->ni_essid, selbs->ni_esslen)__builtin_memcmp((ic->ic_des_essid), (selbs->ni_essid), (selbs->ni_esslen)) == 0))
1312	assoc_fail = ic->ic_bss->ni_assoc_fail;
1313
1314	(*ic->ic_node_copy)(ic, ic->ic_bss, selbs);
1315	ni = ic->ic_bss;
1316	ni->ni_assoc_fail \|= assoc_fail;
1317
1318	ic->ic_curmode = ieee80211_chan2mode(ic, ni->ni_chan);
1319
1320	/* Make sure we send valid rates in an association request. */
1321	if (ic->ic_opmode == IEEE80211_M_STA)
1322	ieee80211_fix_rate(ic, ni,
1323	IEEE80211_F_DOSORT0x00000001 \| IEEE80211_F_DOFRATE0x00000002 \|
1324	IEEE80211_F_DONEGO0x00000004 \| IEEE80211_F_DODEL0x00000008);
1325
1326	if (ic->ic_flags & IEEE80211_F_RSNON0x00200000)
1327	ieee80211_choose_rsnparams(ic);
1328	else if (ic->ic_flags & IEEE80211_F_WEPON0x00000100)
1329	ni->ni_rsncipher = IEEE80211_CIPHER_USEGROUP;
1330
1331	ieee80211_node_newstate(selbs, IEEE80211_STA_BSS)do { (selbs)->ni_state = (IEEE80211_STA_BSS); } while (0);
1332	#ifndef IEEE80211_STA_ONLY
1333	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1334	ieee80211_fix_rate(ic, ni, IEEE80211_F_DOFRATE0x00000002 \|
1335	IEEE80211_F_DONEGO0x00000004 \| IEEE80211_F_DODEL0x00000008);
1336	if (ni->ni_rates.rs_nrates == 0) {
1337	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
1338	return;
1339	}
1340	ieee80211_new_state(ic, IEEE80211_S_RUN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_RUN), (-1)));
1341	} else
1342	#endif
1343	{
1344	int bgscan = ((ic->ic_flags & IEEE80211_F_BGSCAN0x08000000) &&
1345	ic->ic_opmode == IEEE80211_M_STA &&
1346	ic->ic_state == IEEE80211_S_RUN);
1347	int auth_next = (ic->ic_opmode == IEEE80211_M_STA &&
1348	ic->ic_state == IEEE80211_S_AUTH);
1349	int mgt = -1;
1350
1351	timeout_del(&ic->ic_bgscan_timeout);
1352	ic->ic_flags &= ~IEEE80211_F_BGSCAN0x08000000;
1353
1354	/*
1355	* After a background scan, we have now switched APs.
1356	* Pretend we were just de-authed, which makes
1357	* ieee80211_new_state() try to re-auth and thus send
1358	* an AUTH frame to our newly selected AP.
1359	*/
1360	if (bgscan)
1361	mgt = IEEE80211_FC0_SUBTYPE_DEAUTH0xc0;
1362	/*
1363	* If we are trying another AP after the previous one
1364	* failed (state transition AUTH->AUTH), ensure that
1365	* ieee80211_new_state() tries to send another auth frame.
1366	*/
1367	else if (auth_next)
1368	mgt = IEEE80211_FC0_SUBTYPE_AUTH0xb0;
1369
1370	ieee80211_new_state(ic, IEEE80211_S_AUTH, mgt)(((ic)->ic_newstate)((ic), (IEEE80211_S_AUTH), (mgt)));
1371	}
1372	}
1373
1374	struct ieee80211_node *
1375	ieee80211_node_choose_bss(struct ieee80211com *ic, int bgscan,
1376	struct ieee80211_node **curbs)
1377	{
1378	struct ieee80211_node ni, nextbs, selbs = NULL((void )0),
1379	selbs2 = NULL((void )0), selbs5 = NULL((void )0);
1380	uint8_t min_5ghz_rssi;
1381
1382	ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_MIN(&ic->ic_tree);
1383
1384	for (; ni != NULL((void *)0); ni = nextbs) {
1385	nextbs = RBT_NEXT(ieee80211_tree, ni)ieee80211_tree_RBT_NEXT(ni);
1386	if (ni->ni_fails) {
1387	/*
1388	* The configuration of the access points may change
1389	* during my scan. So delete the entry for the AP
1390	* and retry to associate if there is another beacon.
1391	*/
1392	if (ni->ni_fails++ > 2)
1393	ieee80211_free_node(ic, ni);
1394	continue;
1395	}
1396
1397	if (curbs && ieee80211_node_cmp(ic->ic_bss, ni) == 0)
1398	*curbs = ni;
1399
1400	if (ieee80211_match_bss(ic, ni, bgscan) != 0)
1401	continue;
1402
1403	if (ic->ic_caps & IEEE80211_C_SCANALLBAND0x00008000) {
1404	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)(((ni->ni_chan)->ic_flags & 0x0080) != 0) &&
1405	(selbs2 == NULL((void *)0) \|\| ni->ni_rssi > selbs2->ni_rssi))
1406	selbs2 = ni;
1407	else if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan)(((ni->ni_chan)->ic_flags & 0x0100) != 0) &&
1408	(selbs5 == NULL((void *)0) \|\| ni->ni_rssi > selbs5->ni_rssi))
1409	selbs5 = ni;
1410	} else if (selbs == NULL((void *)0) \|\| ni->ni_rssi > selbs->ni_rssi)
1411	selbs = ni;
1412	}
1413
1414	if (ic->ic_max_rssi)
1415	min_5ghz_rssi = IEEE80211_RSSI_THRES_RATIO_5GHZ50;
	Value stored to 'min_5ghz_rssi' is never read
1416	else
1417	min_5ghz_rssi = (uint8_t)IEEE80211_RSSI_THRES_5GHZ(-70);
1418
1419	/*
1420	* Prefer a 5Ghz AP even if its RSSI is weaker than the best 2Ghz AP
1421	* (as long as it meets the minimum RSSI threshold) since the 5Ghz band
1422	* is usually less saturated.
1423	*/
1424	if (selbs5 && (*ic->ic_node_checkrssi)(ic, selbs5))
1425	selbs = selbs5;
1426	else if (selbs5 && selbs2)
1427	selbs = (selbs5->ni_rssi >= selbs2->ni_rssi ? selbs5 : selbs2);
1428	else if (selbs2)
1429	selbs = selbs2;
1430	else if (selbs5)
1431	selbs = selbs5;
1432
1433	return selbs;
1434	}
1435
1436	/*
1437	* Complete a scan of potential channels.
1438	*/
1439	void
1440	ieee80211_end_scan(struct ifnet *ifp)
1441	{
1442	struct ieee80211com ic = (void )ifp;
1443	struct ieee80211_node ni, selbs = NULL((void )0), curbs = NULL((void *)0);
1444	int bgscan = ((ic->ic_flags & IEEE80211_F_BGSCAN0x08000000) &&
1445	ic->ic_opmode == IEEE80211_M_STA &&
1446	ic->ic_state == IEEE80211_S_RUN);
1447
1448	if (ifp->if_flags & IFF_DEBUG0x4)
1449	printf("%s: end %s scan\n", ifp->if_xname,
1450	bgscan ? "background" :
1451	((ic->ic_flags & IEEE80211_F_ASCAN0x00000001) ?
1452	"active" : "passive"));
1453
1454	if (ic->ic_scan_count)
1455	ic->ic_flags &= ~IEEE80211_F_ASCAN0x00000001;
1456
1457	if (ic->ic_opmode == IEEE80211_M_STA)
1458	ieee80211_clean_inactive_nodes(ic, IEEE80211_INACT_SCAN10);
1459
1460	ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_MIN(&ic->ic_tree);
1461
1462	#ifndef IEEE80211_STA_ONLY
1463	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1464	/* XXX off stack? */
1465	u_char occupied[howmany(IEEE80211_CHAN_MAX, NBBY)(((255) + ((8) - 1)) / (8))];
1466	int i, fail;
1467
1468	/*
1469	* The passive scan to look for existing AP's completed,
1470	* select a channel to camp on. Identify the channels
1471	* that already have one or more AP's and try to locate
1472	* an unoccupied one. If that fails, pick a random
1473	* channel from the active set.
1474	*/
1475	memset(occupied, 0, sizeof(occupied))__builtin_memset((occupied), (0), (sizeof(occupied)));
1476	RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree)for ((ni) = ieee80211_tree_RBT_MIN((&ic->ic_tree)); (ni ) != ((void *)0); (ni) = ieee80211_tree_RBT_NEXT((ni)))
1477	setbit(occupied, ieee80211_chan2ieee(ic, ni->ni_chan))((occupied)[(ieee80211_chan2ieee(ic, ni->ni_chan))>> 3] \|= 1<<((ieee80211_chan2ieee(ic, ni->ni_chan))& (8 -1)));
1478	for (i = 0; i < IEEE80211_CHAN_MAX255; i++)
1479	if (isset(ic->ic_chan_active, i)((ic->ic_chan_active)[(i)>>3] & (1<<((i)& (8 -1)))) && isclr(occupied, i)(((occupied)[(i)>>3] & (1<<((i)&(8 -1)))) == 0))
1480	break;
1481	if (i == IEEE80211_CHAN_MAX255) {
1482	fail = arc4random() & 3; /* random 0-3 */
1483	for (i = 0; i < IEEE80211_CHAN_MAX255; i++)
1484	if (isset(ic->ic_chan_active, i)((ic->ic_chan_active)[(i)>>3] & (1<<((i)& (8 -1)))) && fail-- == 0)
1485	break;
1486	}
1487	ieee80211_create_ibss(ic, &ic->ic_channels[i]);
1488	return;
1489	}
1490	#endif
1491	if (ni == NULL((void *)0)) {
1492	DPRINTF(("no scan candidate\n"));
1493	notfound:
1494
1495	#ifndef IEEE80211_STA_ONLY
1496	if (ic->ic_opmode == IEEE80211_M_IBSS &&
1497	(ic->ic_flags & IEEE80211_F_IBSSON0x00000200) &&
1498	ic->ic_des_esslen != 0) {
1499	ieee80211_create_ibss(ic, ic->ic_ibss_chan);
1500	return;
1501	}
1502	#endif
1503	/*
1504	* Reset the list of channels to scan and scan the next mode
1505	* if nothing has been found.
1506	* If the device scans all bands in one fell swoop, return
1507	* current scan results to userspace regardless of mode.
1508	* This will loop forever until an access point is found.
1509	*/
1510	ieee80211_reset_scan(ifp);
1511	if (ieee80211_next_mode(ifp) == IEEE80211_MODE_AUTO \|\|
1512	(ic->ic_caps & IEEE80211_C_SCANALLBAND0x00008000))
1513	ic->ic_scan_count++;
1514
1515	ieee80211_next_scan(ifp);
1516	return;
1517	}
1518
1519	/* Possibly switch which ssid we are associated with */
1520	if (!bgscan && ic->ic_opmode == IEEE80211_M_STA)
1521	ieee80211_switch_ess(ic);
1522
1523	selbs = ieee80211_node_choose_bss(ic, bgscan, &curbs);
1524	if (bgscan) {
1525	struct ieee80211_node_switch_bss_arg *arg;
1526
1527	/* AP disappeared? Should not happen. */
1528	if (selbs == NULL((void )0) \|\| curbs == NULL((void )0)) {
1529	ic->ic_flags &= ~IEEE80211_F_BGSCAN0x08000000;
1530	goto notfound;
1531	}
1532
1533	/*
1534	* After a background scan we might end up choosing the
1535	* same AP again. Or the newly selected AP's RSSI level
1536	* might be low enough to trigger another background scan.
1537	* Do not change ic->ic_bss in these cases and make
1538	* background scans less frequent.
1539	*/
1540	if (selbs == curbs \|\| !(*ic->ic_node_checkrssi)(ic, selbs)) {
1541	if (ic->ic_bgscan_fail < IEEE80211_BGSCAN_FAIL_MAX512) {
1542	if (ic->ic_bgscan_fail <= 0)
1543	ic->ic_bgscan_fail = 1;
1544	else
1545	ic->ic_bgscan_fail *= 2;
1546	}
1547	ic->ic_flags &= ~IEEE80211_F_BGSCAN0x08000000;
1548
1549	/*
1550	* HT is negotiated during association so we must use
1551	* ic_bss to check HT. The nodes tree was re-populated
1552	* during background scan and therefore selbs and curbs
1553	* may not carry HT information.
1554	*/
1555	ni = ic->ic_bss;
1556	if (ni->ni_flags & IEEE80211_NODE_VHT0x10000)
1557	ieee80211_setmode(ic, IEEE80211_MODE_11AC);
1558	else if (ni->ni_flags & IEEE80211_NODE_HT0x0400)
1559	ieee80211_setmode(ic, IEEE80211_MODE_11N);
1560	else
1561	ieee80211_setmode(ic,
1562	ieee80211_chan2mode(ic, ni->ni_chan));
1563	return;
1564	}
1565
1566	arg = malloc(sizeof(*arg), M_DEVBUF2, M_NOWAIT0x0002 \| M_ZERO0x0008);
1567	if (arg == NULL((void *)0)) {
1568	ic->ic_flags &= ~IEEE80211_F_BGSCAN0x08000000;
1569	return;
1570	}
1571
1572	ic->ic_bgscan_fail = 0;
1573
1574	/* Prevent dispatch of additional data frames to hardware. */
1575	ic->ic_xflags \|= IEEE80211_F_TX_MGMT_ONLY0x00000001;
1576
1577	IEEE80211_ADDR_COPY(arg->cur_macaddr, curbs->ni_macaddr)__builtin_memcpy((arg->cur_macaddr), (curbs->ni_macaddr ), (6));
1578	IEEE80211_ADDR_COPY(arg->sel_macaddr, selbs->ni_macaddr)__builtin_memcpy((arg->sel_macaddr), (selbs->ni_macaddr ), (6));
1579
1580	if (ic->ic_bgscan_done) {
1581	/*
1582	* The driver will flush its queues and allow roaming
1583	* to proceed once queues have been flushed.
1584	* On failure the driver will move back to SCAN state.
1585	*/
1586	ic->ic_bgscan_done(ic, arg, sizeof(*arg));
1587	return;
1588	}
1589
1590	/*
1591	* Install a callback which will switch us to the new AP once
1592	* all dispatched frames have been processed by hardware.
1593	*/
1594	ic->ic_bss->ni_unref_arg = arg;
1595	ic->ic_bss->ni_unref_arg_size = sizeof(*arg);
1596	if (ic->ic_bss->ni_refcnt > 0)
1597	ic->ic_bss->ni_unref_cb = ieee80211_node_tx_flushed;
1598	else
1599	ieee80211_node_tx_flushed(ic, ni);
1600	/* F_BGSCAN flag gets cleared in ieee80211_node_join_bss(). */
1601	return;
1602	} else if (selbs == NULL((void *)0))
1603	goto notfound;
1604
1605	ieee80211_node_join_bss(ic, selbs);
1606	}
1607
1608	/*
1609	* Autoselect the best RSN parameters (protocol, AKMP, pairwise cipher...)
1610	* that are supported by both peers (STA mode only).
1611	*/
1612	void
1613	ieee80211_choose_rsnparams(struct ieee80211com *ic)
1614	{
1615	struct ieee80211_node *ni = ic->ic_bss;
1616	struct ieee80211_pmk *pmk;
1617
1618	/* filter out unsupported protocol versions */
1619	ni->ni_rsnprotos &= ic->ic_rsnprotos;
1620	/* prefer RSN (aka WPA2) over WPA */
1621	if (ni->ni_rsnprotos & IEEE80211_PROTO_RSN(1 << 0))
1622	ni->ni_rsnprotos = IEEE80211_PROTO_RSN(1 << 0);
1623	else
1624	ni->ni_rsnprotos = IEEE80211_PROTO_WPA(1 << 1);
1625
1626	/* filter out unsupported AKMPs */
1627	ni->ni_rsnakms &= ic->ic_rsnakms;
1628	/* prefer SHA-256 based AKMPs */
1629	if ((ic->ic_flags & IEEE80211_F_PSK0x00400000) && (ni->ni_rsnakms &
1630	(IEEE80211_AKM_PSK \| IEEE80211_AKM_SHA256_PSK))) {
1631	/* AP supports PSK AKMP and a PSK is configured */
1632	if (ni->ni_rsnakms & IEEE80211_AKM_SHA256_PSK)
1633	ni->ni_rsnakms = IEEE80211_AKM_SHA256_PSK;
1634	else
1635	ni->ni_rsnakms = IEEE80211_AKM_PSK;
1636	} else {
1637	if (ni->ni_rsnakms & IEEE80211_AKM_SHA256_8021X)
1638	ni->ni_rsnakms = IEEE80211_AKM_SHA256_8021X;
1639	else
1640	ni->ni_rsnakms = IEEE80211_AKM_8021X;
1641	/* check if we have a cached PMK for this AP */
1642	if (ni->ni_rsnprotos == IEEE80211_PROTO_RSN(1 << 0) &&
1643	(pmk = ieee80211_pmksa_find(ic, ni, NULL((void )0))) != NULL((void )0)) {
1644	memcpy(ni->ni_pmkid, pmk->pmk_pmkid,__builtin_memcpy((ni->ni_pmkid), (pmk->pmk_pmkid), (16) )
1645	IEEE80211_PMKID_LEN)__builtin_memcpy((ni->ni_pmkid), (pmk->pmk_pmkid), (16) );
1646	ni->ni_flags \|= IEEE80211_NODE_PMKID0x0200;
1647	}
1648	}
1649
1650	/* filter out unsupported pairwise ciphers */
1651	ni->ni_rsnciphers &= ic->ic_rsnciphers;
1652	/* prefer CCMP over TKIP */
1653	if (ni->ni_rsnciphers & IEEE80211_CIPHER_CCMP)
1654	ni->ni_rsnciphers = IEEE80211_CIPHER_CCMP;
1655	else
1656	ni->ni_rsnciphers = IEEE80211_CIPHER_TKIP;
1657	ni->ni_rsncipher = ni->ni_rsnciphers;
1658
1659	/* use MFP if we both support it */
1660	if ((ic->ic_caps & IEEE80211_C_MFP0x00002000) &&
1661	(ni->ni_rsncaps & IEEE80211_RSNCAP_MFPC0x0080))
1662	ni->ni_flags \|= IEEE80211_NODE_MFP0x0080;
1663	}
1664
1665	int
1666	ieee80211_get_rate(struct ieee80211com *ic)
1667	{
1668	u_int8_t (*rates)[IEEE80211_RATE_MAXSIZE15];
1669	int rate;
1670
1671	rates = &ic->ic_bss->ni_rates.rs_rates;
1672
1673	if (ic->ic_fixed_rate != -1)
1674	rate = (*rates)[ic->ic_fixed_rate];
1675	else if (ic->ic_state == IEEE80211_S_RUN)
1676	rate = (*rates)[ic->ic_bss->ni_txrate];
1677	else
1678	rate = 0;
1679
1680	return rate & IEEE80211_RATE_VAL0x7f;
1681	}
1682
1683	struct ieee80211_node *
1684	ieee80211_node_alloc(struct ieee80211com *ic)
1685	{
1686	return malloc(sizeof(struct ieee80211_node), M_DEVBUF2,
1687	M_NOWAIT0x0002 \| M_ZERO0x0008);
1688	}
1689
1690	void
1691	ieee80211_node_cleanup(struct ieee80211com ic, struct ieee80211_node ni)
1692	{
1693	if (ni->ni_rsnie != NULL((void *)0)) {
1694	free(ni->ni_rsnie, M_DEVBUF2, 2 + ni->ni_rsnie[1]);
1695	ni->ni_rsnie = NULL((void *)0);
1696	}
1697	ieee80211_ba_del(ni);
1698	#ifndef IEEE80211_STA_ONLY
1699	mq_purge(&ni->ni_savedq);
1700	#endif
1701	ieee80211_node_free_unref_cb(ni);
1702	}
1703
1704	void
1705	ieee80211_node_free(struct ieee80211com ic, struct ieee80211_node ni)
1706	{
1707	ieee80211_node_cleanup(ic, ni);
1708	free(ni, M_DEVBUF2, 0);
1709	}
1710
1711	void
1712	ieee80211_node_copy(struct ieee80211com *ic,
1713	struct ieee80211_node dst, const struct ieee80211_node src)
1714	{
1715	ieee80211_node_cleanup(ic, dst);
1716	dst = src;
1717	dst->ni_rsnie = NULL((void *)0);
1718	if (src->ni_rsnie != NULL((void *)0))
1719	ieee80211_save_ie(src->ni_rsnie, &dst->ni_rsnie);
1720	ieee80211_node_set_timeouts(dst);
1721	#ifndef IEEE80211_STA_ONLY
1722	mq_init(&dst->ni_savedq, IEEE80211_PS_MAX_QUEUE50, IPL_NET0x4);
1723	#endif
1724	}
1725
1726	u_int8_t
1727	ieee80211_node_getrssi(struct ieee80211com *ic,
1728	const struct ieee80211_node *ni)
1729	{
1730	return ni->ni_rssi;
1731	}
1732
1733	int
1734	ieee80211_node_checkrssi(struct ieee80211com *ic,
1735	const struct ieee80211_node *ni)
1736	{
1737	uint8_t thres;
1738
1739	if (ni->ni_chan == IEEE80211_CHAN_ANYC((struct ieee80211_channel ) ((void )0)))
1740	return 0;
1741
1742	if (ic->ic_max_rssi) {
1743	thres = (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)(((ni->ni_chan)->ic_flags & 0x0080) != 0)) ?
1744	IEEE80211_RSSI_THRES_RATIO_2GHZ60 :
1745	IEEE80211_RSSI_THRES_RATIO_5GHZ50;
1746	return ((ni->ni_rssi * 100) / ic->ic_max_rssi >= thres);
1747	}
1748
1749	thres = (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)(((ni->ni_chan)->ic_flags & 0x0080) != 0)) ?
1750	IEEE80211_RSSI_THRES_2GHZ(-60) :
1751	IEEE80211_RSSI_THRES_5GHZ(-70);
1752	return (ni->ni_rssi >= (u_int8_t)thres);
1753	}
1754
1755	void
1756	ieee80211_node_set_timeouts(struct ieee80211_node *ni)
1757	{
1758	int i;
1759
1760	#ifndef IEEE80211_STA_ONLY
1761	timeout_set(&ni->ni_eapol_to, ieee80211_eapol_timeout, ni);
1762	timeout_set(&ni->ni_sa_query_to, ieee80211_sa_query_timeout, ni);
1763	#endif
1764	timeout_set(&ni->ni_addba_req_to[EDCA_AC_BE],
1765	ieee80211_node_addba_request_ac_be_to, ni);
1766	timeout_set(&ni->ni_addba_req_to[EDCA_AC_BK],
1767	ieee80211_node_addba_request_ac_bk_to, ni);
1768	timeout_set(&ni->ni_addba_req_to[EDCA_AC_VI],
1769	ieee80211_node_addba_request_ac_vi_to, ni);
1770	timeout_set(&ni->ni_addba_req_to[EDCA_AC_VO],
1771	ieee80211_node_addba_request_ac_vo_to, ni);
1772	for (i = 0; i < nitems(ni->ni_addba_req_intval)(sizeof((ni->ni_addba_req_intval)) / sizeof((ni->ni_addba_req_intval )[0])); i++)
1773	ni->ni_addba_req_intval[i] = 1;
1774	}
1775
1776	void
1777	ieee80211_setup_node(struct ieee80211com *ic,
1778	struct ieee80211_node ni, const u_int8_t macaddr)
1779	{
1780	int i, s;
1781
1782	DPRINTF(("%s\n", ether_sprintf((u_int8_t *)macaddr)));
1783	IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr)__builtin_memcpy((ni->ni_macaddr), (macaddr), (6));
1784	ieee80211_node_newstate(ni, IEEE80211_STA_CACHE)do { (ni)->ni_state = (IEEE80211_STA_CACHE); } while (0);
1785
1786	ni->ni_ic = ic; /* back-pointer */
1787	/* Initialize cached last sequence numbers with invalid values. */
1788	ni->ni_rxseq = 0xffffU;
1789	for (i=0; i < IEEE80211_NUM_TID16; ++i)
1790	ni->ni_qos_rxseqs[i] = 0xffffU;
1791	#ifndef IEEE80211_STA_ONLY
1792	mq_init(&ni->ni_savedq, IEEE80211_PS_MAX_QUEUE50, IPL_NET0x4);
1793	#endif
1794	ieee80211_node_set_timeouts(ni);
1795
1796	s = splnet()splraise(0x4);
1797	RBT_INSERT(ieee80211_tree, &ic->ic_tree, ni)ieee80211_tree_RBT_INSERT(&ic->ic_tree, ni);
1798	ic->ic_nnodes++;
1799	splx(s)spllower(s);
1800	}
1801
1802	struct ieee80211_node *
1803	ieee80211_alloc_node(struct ieee80211com ic, const u_int8_t macaddr)
1804	{
1805	struct ieee80211_node *ni = ieee80211_alloc_node_helper(ic);
1806	if (ni != NULL((void *)0))
1807	ieee80211_setup_node(ic, ni, macaddr);
1808	else
1809	ic->ic_stats.is_rx_nodealloc++;
1810	return ni;
1811	}
1812
1813	struct ieee80211_node *
1814	ieee80211_dup_bss(struct ieee80211com ic, const u_int8_t macaddr)
1815	{
1816	struct ieee80211_node *ni = ieee80211_alloc_node_helper(ic);
1817	if (ni != NULL((void *)0)) {
1818	ieee80211_setup_node(ic, ni, macaddr);
1819	/*
1820	* Inherit from ic_bss.
1821	*/
1822	IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid)__builtin_memcpy((ni->ni_bssid), (ic->ic_bss->ni_bssid ), (6));
1823	ni->ni_chan = ic->ic_bss->ni_chan;
1824	} else
1825	ic->ic_stats.is_rx_nodealloc++;
1826	return ni;
1827	}
1828
1829	struct ieee80211_node *
1830	ieee80211_find_node(struct ieee80211com ic, const u_int8_t macaddr)
1831	{
1832	struct ieee80211_node *ni;
1833	int cmp;
1834
1835	/* similar to RBT_FIND except we compare keys, not nodes */
1836	ni = RBT_ROOT(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_ROOT(&ic->ic_tree);
1837	while (ni != NULL((void *)0)) {
1838	cmp = memcmp(macaddr, ni->ni_macaddr, IEEE80211_ADDR_LEN)__builtin_memcmp((macaddr), (ni->ni_macaddr), (6));
1839	if (cmp < 0)
1840	ni = RBT_LEFT(ieee80211_tree, ni)ieee80211_tree_RBT_LEFT(ni);
1841	else if (cmp > 0)
1842	ni = RBT_RIGHT(ieee80211_tree, ni)ieee80211_tree_RBT_RIGHT(ni);
1843	else
1844	break;
1845	}
1846	return ni;
1847	}
1848
1849	/*
1850	* Return a reference to the appropriate node for sending
1851	* a data frame. This handles node discovery in adhoc networks.
1852	*
1853	* Drivers will call this, so increase the reference count before
1854	* returning the node.
1855	*/
1856	struct ieee80211_node *
1857	ieee80211_find_txnode(struct ieee80211com ic, const u_int8_t macaddr)
1858	{
1859	#ifndef IEEE80211_STA_ONLY
1860	struct ieee80211_node *ni;
1861	int s;
1862	#endif
1863
1864	/*
1865	* The destination address should be in the node table
1866	* unless we are operating in station mode or this is a
1867	* multicast/broadcast frame.
1868	*/
1869	if (ic->ic_opmode == IEEE80211_M_STA \|\| IEEE80211_IS_MULTICAST(macaddr)(*(macaddr) & 0x01))
1870	return ieee80211_ref_node(ic->ic_bss);
1871
1872	#ifndef IEEE80211_STA_ONLY
1873	s = splnet()splraise(0x4);
1874	ni = ieee80211_find_node(ic, macaddr);
1875	splx(s)spllower(s);
1876	if (ni == NULL((void *)0)) {
1877	if (ic->ic_opmode != IEEE80211_M_IBSS &&
1878	ic->ic_opmode != IEEE80211_M_AHDEMO)
1879	return NULL((void *)0);
1880
1881	/*
1882	* Fake up a node; this handles node discovery in
1883	* adhoc mode. Note that for the driver's benefit
1884	* we treat this like an association so the driver
1885	* has an opportunity to setup its private state.
1886	*
1887	* XXX need better way to handle this; issue probe
1888	* request so we can deduce rate set, etc.
1889	*/
1890	if ((ni = ieee80211_dup_bss(ic, macaddr)) == NULL((void *)0))
1891	return NULL((void *)0);
1892	/* XXX no rate negotiation; just dup */
1893	ni->ni_rates = ic->ic_bss->ni_rates;
1894	ni->ni_txrate = 0;
1895	if (ic->ic_newassoc)
1896	(*ic->ic_newassoc)(ic, ni, 1);
1897	}
1898	return ieee80211_ref_node(ni);
1899	#else
1900	return NULL((void )0); / can't get there */
1901	#endif /* IEEE80211_STA_ONLY */
1902	}
1903
1904	/*
1905	* It is usually desirable to process a Rx packet using its sender's
1906	* node-record instead of the BSS record.
1907	*
1908	* - AP mode: keep a node-record for every authenticated/associated
1909	* station in the BSS. For future use, we also track neighboring
1910	* APs, since they might belong to the same ESS. APs in the same
1911	* ESS may bridge packets to each other, forming a Wireless
1912	* Distribution System (WDS).
1913	*
1914	* - IBSS mode: keep a node-record for every station in the BSS.
1915	* Also track neighboring stations by their beacons/probe responses.
1916	*
1917	* - monitor mode: keep a node-record for every sender, regardless
1918	* of BSS.
1919	*
1920	* - STA mode: the only available node-record is the BSS record,
1921	* ic->ic_bss.
1922	*
1923	* Of all the 802.11 Control packets, only the node-records for
1924	* RTS packets node-record can be looked up.
1925	*
1926	* Return non-zero if the packet's node-record is kept, zero
1927	* otherwise.
1928	*/
1929	static __inline int
1930	ieee80211_needs_rxnode(struct ieee80211com *ic,
1931	const struct ieee80211_frame wh, const u_int8_t *bssid)
1932	{
1933	int monitor, rc = 0;
1934
1935	monitor = (ic->ic_opmode == IEEE80211_M_MONITOR);
1936
1937	bssid = NULL((void )0);
1938
1939	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK0x0c) {
1940	case IEEE80211_FC0_TYPE_CTL0x04:
1941	if (!monitor)
1942	break;
1943	return (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK0xf0) ==
1944	IEEE80211_FC0_SUBTYPE_RTS0xb0;
1945	case IEEE80211_FC0_TYPE_MGT0x00:
1946	*bssid = wh->i_addr3;
1947	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK0xf0) {
1948	case IEEE80211_FC0_SUBTYPE_BEACON0x80:
1949	case IEEE80211_FC0_SUBTYPE_PROBE_RESP0x50:
1950	break;
1951	default:
1952	#ifndef IEEE80211_STA_ONLY
1953	if (ic->ic_opmode == IEEE80211_M_STA)
1954	break;
1955	rc = IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid)(__builtin_memcmp((bssid), (ic->ic_bss->ni_bssid), (6) ) == 0) \|\|
1956	IEEE80211_ADDR_EQ(bssid, etherbroadcastaddr)(__builtin_memcmp((bssid), (etherbroadcastaddr), (6)) == 0);
1957	#endif
1958	break;
1959	}
1960	break;
1961	case IEEE80211_FC0_TYPE_DATA0x08:
1962	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK0x03) {
1963	case IEEE80211_FC1_DIR_NODS0x00:
1964	*bssid = wh->i_addr3;
1965	#ifndef IEEE80211_STA_ONLY
1966	if (ic->ic_opmode == IEEE80211_M_IBSS \|\|
1967	ic->ic_opmode == IEEE80211_M_AHDEMO)
1968	rc = IEEE80211_ADDR_EQ(bssid,(__builtin_memcmp((bssid), (ic->ic_bss->ni_bssid), (6) ) == 0)
1969	ic->ic_bss->ni_bssid)(__builtin_memcmp((*bssid), (ic->ic_bss->ni_bssid), (6) ) == 0);
1970	#endif
1971	break;
1972	case IEEE80211_FC1_DIR_TODS0x01:
1973	*bssid = wh->i_addr1;
1974	#ifndef IEEE80211_STA_ONLY
1975	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1976	rc = IEEE80211_ADDR_EQ(bssid,(__builtin_memcmp((bssid), (ic->ic_bss->ni_bssid), (6) ) == 0)
1977	ic->ic_bss->ni_bssid)(__builtin_memcmp((*bssid), (ic->ic_bss->ni_bssid), (6) ) == 0);
1978	#endif
1979	break;
1980	case IEEE80211_FC1_DIR_FROMDS0x02:
1981	case IEEE80211_FC1_DIR_DSTODS0x03:
1982	*bssid = wh->i_addr2;
1983	#ifndef IEEE80211_STA_ONLY
1984	rc = (ic->ic_opmode == IEEE80211_M_HOSTAP);
1985	#endif
1986	break;
1987	}
1988	break;
1989	}
1990	return monitor \|\| rc;
1991	}
1992
1993	/*
1994	* Drivers call this, so increase the reference count before returning
1995	* the node.
1996	*/
1997	struct ieee80211_node *
1998	ieee80211_find_rxnode(struct ieee80211com *ic,
1999	const struct ieee80211_frame *wh)
2000	{
2001	static const u_int8_t zero[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
2002	struct ieee80211_node *ni;
2003	const u_int8_t *bssid;
2004	int s;
2005
2006	if (!ieee80211_needs_rxnode(ic, wh, &bssid))
2007	return ieee80211_ref_node(ic->ic_bss);
2008
2009	s = splnet()splraise(0x4);
2010	ni = ieee80211_find_node(ic, wh->i_addr2);
2011	splx(s)spllower(s);
2012
2013	if (ni != NULL((void *)0))
2014	return ieee80211_ref_node(ni);
2015	#ifndef IEEE80211_STA_ONLY
2016	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
2017	return ieee80211_ref_node(ic->ic_bss);
2018	#endif
2019	/* XXX see remarks in ieee80211_find_txnode */
2020	/* XXX no rate negotiation; just dup */
2021	if ((ni = ieee80211_dup_bss(ic, wh->i_addr2)) == NULL((void *)0))
2022	return ieee80211_ref_node(ic->ic_bss);
2023
2024	IEEE80211_ADDR_COPY(ni->ni_bssid, (bssid != NULL) ? bssid : zero)__builtin_memcpy((ni->ni_bssid), ((bssid != ((void *)0)) ? bssid : zero), (6));
2025
2026	ni->ni_rates = ic->ic_bss->ni_rates;
2027	ni->ni_txrate = 0;
2028	if (ic->ic_newassoc)
2029	(*ic->ic_newassoc)(ic, ni, 1);
2030
2031	DPRINTF(("faked-up node %p for %s\n", ni,
2032	ether_sprintf((u_int8_t *)wh->i_addr2)));
2033
2034	return ieee80211_ref_node(ni);
2035	}
2036
2037	void
2038	ieee80211_node_tx_ba_clear(struct ieee80211_node *ni, int tid)
2039	{
2040	struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
2041
2042	if (ba->ba_state != IEEE80211_BA_INIT0) {
2043	if (timeout_pending(&ba->ba_to)((&ba->ba_to)->to_flags & 0x02))
2044	timeout_del(&ba->ba_to);
2045	ba->ba_state = IEEE80211_BA_INIT0;
2046	}
2047	}
2048
2049	void
2050	ieee80211_ba_del(struct ieee80211_node *ni)
2051	{
2052	int tid;
2053
2054	for (tid = 0; tid < nitems(ni->ni_rx_ba)(sizeof((ni->ni_rx_ba)) / sizeof((ni->ni_rx_ba)[0])); tid++) {
2055	struct ieee80211_rx_ba *ba = &ni->ni_rx_ba[tid];
2056	if (ba->ba_state != IEEE80211_BA_INIT0) {
2057	if (timeout_pending(&ba->ba_to)((&ba->ba_to)->to_flags & 0x02))
2058	timeout_del(&ba->ba_to);
2059	if (timeout_pending(&ba->ba_gap_to)((&ba->ba_gap_to)->to_flags & 0x02))
2060	timeout_del(&ba->ba_gap_to);
2061	ba->ba_state = IEEE80211_BA_INIT0;
2062	}
2063	}
2064
2065	for (tid = 0; tid < nitems(ni->ni_tx_ba)(sizeof((ni->ni_tx_ba)) / sizeof((ni->ni_tx_ba)[0])); tid++)
2066	ieee80211_node_tx_ba_clear(ni, tid);
2067
2068	timeout_del(&ni->ni_addba_req_to[EDCA_AC_BE]);
2069	timeout_del(&ni->ni_addba_req_to[EDCA_AC_BK]);
2070	timeout_del(&ni->ni_addba_req_to[EDCA_AC_VI]);
2071	timeout_del(&ni->ni_addba_req_to[EDCA_AC_VO]);
2072	}
2073
2074	void
2075	ieee80211_free_node(struct ieee80211com ic, struct ieee80211_node ni)
2076	{
2077	if (ni == ic->ic_bss)
2078	panic("freeing bss node");
2079
2080	splassert(IPL_NET)do { if (splassert_ctl > 0) { splassert_check(0x4, __func__ ); } } while (0);
2081
2082	DPRINTF(("%s\n", ether_sprintf(ni->ni_macaddr)));
2083	#ifndef IEEE80211_STA_ONLY
2084	timeout_del(&ni->ni_eapol_to);
2085	timeout_del(&ni->ni_sa_query_to);
2086	IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap)((ic->ic_aid_bitmap)[((ni->ni_associd) &~ 0xc000) / 32] &= ~(1 << (((ni->ni_associd) &~ 0xc000) % 32)));
2087	#endif
2088	ieee80211_ba_del(ni);
2089	RBT_REMOVE(ieee80211_tree, &ic->ic_tree, ni)ieee80211_tree_RBT_REMOVE(&ic->ic_tree, ni);
2090	ic->ic_nnodes--;
2091	#ifndef IEEE80211_STA_ONLY
2092	if (mq_purge(&ni->ni_savedq) > 0) {
2093	if (ic->ic_set_tim != NULL((void *)0))
2094	(*ic->ic_set_tim)(ic, ni->ni_associd, 0);
2095	}
2096	#endif
2097	(*ic->ic_node_free)(ic, ni);
2098	/* TBD indicate to drivers that a new node can be allocated */
2099	}
2100
2101	void
2102	ieee80211_release_node(struct ieee80211com ic, struct ieee80211_node ni)
2103	{
2104	int s;
2105	void (ni_unref_cb)(struct ieee80211com , struct ieee80211_node *);
2106
2107	DPRINTF(("%s refcnt %u\n", ether_sprintf(ni->ni_macaddr),
2108	ni->ni_refcnt));
2109	s = splnet()splraise(0x4);
2110	if (ieee80211_node_decref(ni) == 0) {
2111	if (ni->ni_unref_cb) {
2112	/* The callback may set ni->ni_unref_cb again. */
2113	ni_unref_cb = ni->ni_unref_cb;
2114	ni->ni_unref_cb = NULL((void *)0);
2115	/* Freed by callback if necessary: */
2116	(*ni_unref_cb)(ic, ni);
2117	}
2118	if (ni->ni_state == IEEE80211_STA_COLLECT)
2119	ieee80211_free_node(ic, ni);
2120	}
2121	splx(s)spllower(s);
2122	}
2123
2124	void
2125	ieee80211_free_allnodes(struct ieee80211com *ic, int clear_ic_bss)
2126	{
2127	struct ieee80211_node *ni;
2128	int s;
2129
2130	DPRINTF(("freeing all nodes\n"));
2131	s = splnet()splraise(0x4);
2132	while ((ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_MIN(&ic->ic_tree)) != NULL((void *)0))
2133	ieee80211_free_node(ic, ni);
2134	splx(s)spllower(s);
2135
2136	if (clear_ic_bss && ic->ic_bss != NULL((void *)0))
2137	ieee80211_node_cleanup(ic, ic->ic_bss);
2138	}
2139
2140	void
2141	ieee80211_clean_cached(struct ieee80211com *ic)
2142	{
2143	struct ieee80211_node ni, next_ni;
2144	int s;
2145
2146	s = splnet()splraise(0x4);
2147	for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_MIN(&ic->ic_tree);
2148	ni != NULL((void *)0); ni = next_ni) {
2149	next_ni = RBT_NEXT(ieee80211_tree, ni)ieee80211_tree_RBT_NEXT(ni);
2150	if (ni->ni_state == IEEE80211_STA_CACHE)
2151	ieee80211_free_node(ic, ni);
2152	}
2153	splx(s)spllower(s);
2154	}
2155	/*
2156	* Timeout inactive nodes.
2157	*
2158	* If called because of a cache timeout, which happens only in hostap and ibss
2159	* modes, clean all inactive cached or authenticated nodes but don't de-auth
2160	* any associated nodes. Also update HT protection settings.
2161	*
2162	* Else, this function is called because a new node must be allocated but the
2163	* node cache is full. In this case, return as soon as a free slot was made
2164	* available. If acting as hostap, clean cached nodes regardless of their
2165	* recent activity and also allow de-authing of authenticated nodes older
2166	* than one cache wait interval, and de-authing of inactive associated nodes.
2167	*/
2168	void
2169	ieee80211_clean_nodes(struct ieee80211com *ic, int cache_timeout)
2170	{
2171	struct ieee80211_node ni, next_ni;
2172	u_int gen = ic->ic_scangen++; /* NB: ok 'cuz single-threaded*/
2173	int s;
2174	#ifndef IEEE80211_STA_ONLY
2175	int nnodes = 0, nonht = 0, nonhtassoc = 0;
2176	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
2177	enum ieee80211_htprot htprot = IEEE80211_HTPROT_NONE;
2178	enum ieee80211_protmode protmode = IEEE80211_PROT_NONE;
2179	#endif
2180
2181	s = splnet()splraise(0x4);
2182	for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_MIN(&ic->ic_tree);
2183	ni != NULL((void *)0); ni = next_ni) {
2184	next_ni = RBT_NEXT(ieee80211_tree, ni)ieee80211_tree_RBT_NEXT(ni);
2185	if (!cache_timeout && ic->ic_nnodes < ic->ic_max_nnodes)
2186	break;
2187	if (ni->ni_scangen == gen) /* previously handled */
2188	continue;
2189	#ifndef IEEE80211_STA_ONLY
2190	nnodes++;
2191	if ((ic->ic_flags & IEEE80211_F_HTON0x02000000) && cache_timeout) {
2192	/*
2193	* Check if node supports 802.11n.
2194	* Only require HT capabilities IE for this check.
2195	* Nodes might never reveal their supported MCS to us
2196	* unless they go through a full association sequence.
2197	* ieee80211_node_supports_ht() could misclassify them.
2198	*/
2199	if ((ni->ni_flags & IEEE80211_NODE_HTCAP0x20000) == 0) {
2200	nonht++;
2201	if (ni->ni_state == IEEE80211_STA_ASSOC)
2202	nonhtassoc++;
2203	}
2204	}
2205	#endif
2206	ni->ni_scangen = gen;
2207	if (ni->ni_refcnt > 0)
2208	continue;
2209	#ifndef IEEE80211_STA_ONLY
2210	if ((ic->ic_opmode == IEEE80211_M_HOSTAP \|\|
2211	ic->ic_opmode == IEEE80211_M_IBSS) &&
2212	ic->ic_state == IEEE80211_S_RUN) {
2213	if (cache_timeout) {
2214	if (ni->ni_state != IEEE80211_STA_COLLECT &&
2215	(ni->ni_state == IEEE80211_STA_ASSOC \|\|
2216	ni->ni_inact < IEEE80211_INACT_MAX(300/5)))
2217	continue;
2218	} else {
2219	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
2220	((ni->ni_state == IEEE80211_STA_ASSOC &&
2221	ni->ni_inact < IEEE80211_INACT_MAX(300/5)) \|\|
2222	(ni->ni_state == IEEE80211_STA_AUTH &&
2223	ni->ni_inact == 0)))
2224	continue;
2225
2226	if (ic->ic_opmode == IEEE80211_M_IBSS &&
2227	ni->ni_state != IEEE80211_STA_COLLECT &&
2228	ni->ni_state != IEEE80211_STA_CACHE &&
2229	ni->ni_inact < IEEE80211_INACT_MAX(300/5))
2230	continue;
2231	}
2232	}
2233	if (ifp->if_flags & IFF_DEBUG0x4)
2234	printf("%s: station %s purged from node cache\n",
2235	ifp->if_xname, ether_sprintf(ni->ni_macaddr));
2236	#endif
2237	/*
2238	* If we're hostap and the node is authenticated, send
2239	* a deauthentication frame. The node will be freed when
2240	* the driver calls ieee80211_release_node().
2241	*/
2242	#ifndef IEEE80211_STA_ONLY
2243	nnodes--;
2244	if ((ic->ic_flags & IEEE80211_F_HTON0x02000000) && cache_timeout) {
2245	if ((ni->ni_flags & IEEE80211_NODE_HTCAP0x20000) == 0) {
2246	nonht--;
2247	if (ni->ni_state == IEEE80211_STA_ASSOC)
2248	nonhtassoc--;
2249	}
2250	}
2251	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
2252	ni->ni_state >= IEEE80211_STA_AUTH &&
2253	ni->ni_state != IEEE80211_STA_COLLECT) {
2254	IEEE80211_SEND_MGMT(ic, ni,((*(ic)->ic_send_mgmt)(ic, ni, 0xc0, IEEE80211_REASON_AUTH_EXPIRE , 0))
2255	IEEE80211_FC0_SUBTYPE_DEAUTH,((*(ic)->ic_send_mgmt)(ic, ni, 0xc0, IEEE80211_REASON_AUTH_EXPIRE , 0))
2256	IEEE80211_REASON_AUTH_EXPIRE)((*(ic)->ic_send_mgmt)(ic, ni, 0xc0, IEEE80211_REASON_AUTH_EXPIRE , 0));
2257	ieee80211_node_leave(ic, ni);
2258	} else
2259	#endif
2260	ieee80211_free_node(ic, ni);
2261	ic->ic_stats.is_node_timeout++;
2262	}
2263
2264	#ifndef IEEE80211_STA_ONLY
2265	if ((ic->ic_flags & IEEE80211_F_HTON0x02000000) && cache_timeout) {
2266	uint16_t htop1 = ic->ic_bss->ni_htop1;
2267
2268	/* Update HT protection settings. */
2269	if (nonht) {
2270	protmode = IEEE80211_PROT_CTSONLY;
2271	if (nonhtassoc)
2272	htprot = IEEE80211_HTPROT_NONHT_MIXED;
2273	else
2274	htprot = IEEE80211_HTPROT_NONMEMBER;
2275	}
2276	if ((htop1 & IEEE80211_HTOP1_PROT_MASK0x0003) != htprot) {
2277	htop1 &= ~IEEE80211_HTOP1_PROT_MASK0x0003;
2278	htop1 \|= htprot;
2279	ic->ic_bss->ni_htop1 = htop1;
2280	ic->ic_protmode = protmode;
2281	if (ic->ic_updateprot)
2282	ic->ic_updateprot(ic);
2283	}
2284	}
2285
2286	/*
2287	* During a cache timeout we iterate over all nodes.
2288	* Check for node leaks by comparing the actual number of cached
2289	* nodes with the ic_nnodes count, which is maintained while adding
2290	* and removing nodes from the cache.
2291	*/
2292	if ((ifp->if_flags & IFF_DEBUG0x4) && cache_timeout &&
2293	nnodes != ic->ic_nnodes)
2294	printf("%s: number of cached nodes is %d, expected %d,"
2295	"possible nodes leak\n", ifp->if_xname, nnodes,
2296	ic->ic_nnodes);
2297	#endif
2298	splx(s)spllower(s);
2299	}
2300
2301	void
2302	ieee80211_clean_inactive_nodes(struct ieee80211com *ic, int inact_max)
2303	{
2304	struct ieee80211_node ni, next_ni;
2305	u_int gen = ic->ic_scangen++; /* NB: ok 'cuz single-threaded*/
2306	int s;
2307
2308	s = splnet()splraise(0x4);
2309	for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)ieee80211_tree_RBT_MIN(&ic->ic_tree);
2310	ni != NULL((void *)0); ni = next_ni) {
2311	next_ni = RBT_NEXT(ieee80211_tree, ni)ieee80211_tree_RBT_NEXT(ni);
2312	if (ni->ni_scangen == gen) /* previously handled */
2313	continue;
2314	ni->ni_scangen = gen;
2315	if (ni->ni_refcnt > 0 \|\| ni->ni_inact < inact_max)
2316	continue;
2317	ieee80211_free_node(ic, ni);
2318	ic->ic_stats.is_node_timeout++;
2319	}
2320
2321	splx(s)spllower(s);
2322	}
2323
2324	void
2325	ieee80211_iterate_nodes(struct ieee80211com ic, ieee80211_iter_func f,
2326	void *arg)
2327	{
2328	struct ieee80211_node *ni;
2329	int s;
2330
2331	s = splnet()splraise(0x4);
2332	RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree)for ((ni) = ieee80211_tree_RBT_MIN((&ic->ic_tree)); (ni ) != ((void *)0); (ni) = ieee80211_tree_RBT_NEXT((ni)))
2333	(*f)(arg, ni);
2334	splx(s)spllower(s);
2335	}
2336
2337
2338	/*
2339	* Install received HT caps information in the node's state block.
2340	*/
2341	void
2342	ieee80211_setup_htcaps(struct ieee80211_node ni, const uint8_t data,
2343	uint8_t len)
2344	{
2345	uint16_t rxrate;
2346
2347	if (len != 26)
2348	return;
2349
2350	ni->ni_htcaps = (data[0] \| (data[1] << 8));
2351	ni->ni_ampdu_param = data[2];
2352
2353	memcpy(ni->ni_rxmcs, &data[3], sizeof(ni->ni_rxmcs))__builtin_memcpy((ni->ni_rxmcs), (&data[3]), (sizeof(ni ->ni_rxmcs)));
2354	/* clear reserved bits */
2355	clrbit(ni->ni_rxmcs, 77)((ni->ni_rxmcs)[(77)>>3] &= ~(1<<((77)& (8 -1))));
2356	clrbit(ni->ni_rxmcs, 78)((ni->ni_rxmcs)[(78)>>3] &= ~(1<<((78)& (8 -1))));
2357	clrbit(ni->ni_rxmcs, 79)((ni->ni_rxmcs)[(79)>>3] &= ~(1<<((79)& (8 -1))));
2358
2359	/* Max MCS Rx rate in 1Mb/s units (0 means "not specified"). */
2360	rxrate = ((data[13] \| (data[14]) << 8) & IEEE80211_MCS_RX_RATE_HIGH0x03ff);
2361	if (rxrate < 1024)
2362	ni->ni_max_rxrate = rxrate;
2363
2364	ni->ni_tx_mcs_set = data[15];
2365	ni->ni_htxcaps = (data[19] \| (data[20] << 8));
2366	ni->ni_txbfcaps = (data[21] \| (data[22] << 8) \| (data[23] << 16) \|
2367	(data[24] << 24));
2368	ni->ni_aselcaps = data[25];
2369
2370	ni->ni_flags \|= IEEE80211_NODE_HTCAP0x20000;
2371	}
2372
2373	#ifndef IEEE80211_STA_ONLY
2374	/*
2375	* Handle nodes switching from 11n into legacy modes.
2376	*/
2377	void
2378	ieee80211_clear_htcaps(struct ieee80211_node *ni)
2379	{
2380	ni->ni_htcaps = 0;
2381	ni->ni_ampdu_param = 0;
2382	memset(ni->ni_rxmcs, 0, sizeof(ni->ni_rxmcs))__builtin_memset((ni->ni_rxmcs), (0), (sizeof(ni->ni_rxmcs )));
2383	ni->ni_max_rxrate = 0;
2384	ni->ni_tx_mcs_set = 0;
2385	ni->ni_htxcaps = 0;
2386	ni->ni_txbfcaps = 0;
2387	ni->ni_aselcaps = 0;
2388
2389	ni->ni_flags &= ~(IEEE80211_NODE_HT0x0400 \| IEEE80211_NODE_HT_SGI200x4000 \|
2390	IEEE80211_NODE_HT_SGI400x8000 \| IEEE80211_NODE_HTCAP0x20000);
2391
2392	}
2393	#endif
2394
2395	int
2396	ieee80211_40mhz_valid_secondary_above(uint8_t primary_chan)
2397	{
2398	static const uint8_t valid_secondary_chan[] = {
2399	5, 6, 7, 8, 9, 10, 11, 12, 13,
2400	40, 48, 56, 64, 104, 112, 120, 128, 136, 144, 153, 161
2401	};
2402	uint8_t secondary_chan;
2403	int i;
2404
2405	if ((primary_chan >= 1 && primary_chan <= 9) \|\|
2406	(primary_chan >= 36 && primary_chan <= 157))
2407	secondary_chan = primary_chan + 4;
2408	else
2409	return 0;
2410
2411	for (i = 0; i < nitems(valid_secondary_chan)(sizeof((valid_secondary_chan)) / sizeof((valid_secondary_chan )[0])); i++) {
2412	if (secondary_chan == valid_secondary_chan[i])
2413	return 1;
2414	}
2415
2416	return 0;
2417	}
2418
2419	int
2420	ieee80211_40mhz_valid_secondary_below(uint8_t primary_chan)
2421	{
2422	static const uint8_t valid_secondary_chan[] = {
2423	1, 2, 3, 4, 5, 6, 7, 8, 9,
2424	36, 44, 52, 60, 100, 108, 116, 124, 132, 140, 149, 157
2425	};
2426	int8_t secondary_chan;
2427	int i;
2428
2429	if ((primary_chan >= 5 && primary_chan <= 13) \|\|
2430	(primary_chan >= 40 && primary_chan <= 161))
2431	secondary_chan = primary_chan - 4;
2432	else
2433	return 0;
2434
2435	for (i = 0; i < nitems(valid_secondary_chan)(sizeof((valid_secondary_chan)) / sizeof((valid_secondary_chan )[0])); i++) {
2436	if (secondary_chan == valid_secondary_chan[i])
2437	return 1;
2438	}
2439
2440	return 0;
2441	}
2442
2443	/*
2444	* Only accept 40 MHz channel configurations that conform to
2445	* regulatory operating classes as defined by the 802.11ac spec.
2446	* Passing other configurations down to firmware can result in
2447	* regulatory assertions being trigged, such as fatal firmware
2448	* error 14FD in iwm(4).
2449	*
2450	* See 802.11ac 2013, page 380, Tables E-1 to E-5.
2451	*/
2452	int
2453	ieee80211_40mhz_center_freq_valid(uint8_t primary_chan, uint8_t htop0)
2454	{
2455	uint8_t sco;
2456
2457	sco = ((htop0 & IEEE80211_HTOP0_SCO_MASK0x03) >> IEEE80211_HTOP0_SCO_SHIFT0);
2458	switch (sco) {
2459	case IEEE80211_HTOP0_SCO_SCN0:
2460	return 1;
2461	case IEEE80211_HTOP0_SCO_SCA1:
2462	return ieee80211_40mhz_valid_secondary_above(primary_chan);
2463	case IEEE80211_HTOP0_SCO_SCB3:
2464	return ieee80211_40mhz_valid_secondary_below(primary_chan);
2465	}
2466
2467	return 0;
2468	}
2469
2470	/*
2471	* Install received HT op information in the node's state block.
2472	*/
2473	int
2474	ieee80211_setup_htop(struct ieee80211_node ni, const uint8_t data,
2475	uint8_t len, int isprobe)
2476	{
2477	if (len != 22)
2478	return 0;
2479
2480	ni->ni_primary_chan = data[0]; /* corresponds to ni_chan */
2481	ni->ni_htop0 = data[1];
2482	if (!ieee80211_40mhz_center_freq_valid(data[0], data[1]))
2483	ni->ni_htop0 &= ~IEEE80211_HTOP0_SCO_MASK0x03;
2484	ni->ni_htop1 = (data[2] \| (data[3] << 8));
2485	ni->ni_htop2 = (data[3] \| (data[4] << 8));
2486
2487	/*
2488	* According to 802.11-2012 Table 8-130 the Basic MCS set is
2489	* only "present in Beacon, Probe Response, Mesh Peering Open
2490	* and Mesh Peering Confirm frames. Otherwise reserved."
2491	*/
2492	if (isprobe)
2493	memcpy(ni->ni_basic_mcs, &data[6], sizeof(ni->ni_basic_mcs))__builtin_memcpy((ni->ni_basic_mcs), (&data[6]), (sizeof (ni->ni_basic_mcs)));
2494
2495	return 1;
2496	}
2497
2498	/*
2499	* Install received VHT caps information in the node's state block.
2500	*/
2501	void
2502	ieee80211_setup_vhtcaps(struct ieee80211_node ni, const uint8_t data,
2503	uint8_t len)
2504	{
2505	if (len != 12)
2506	return;
2507
2508	ni->ni_vhtcaps = (data[0] \| (data[1] << 8) \| data[2] << 16 \|
2509	data[3] << 24);
2510	ni->ni_vht_rxmcs = (data[4] \| (data[5] << 8));
2511	ni->ni_vht_rx_max_lgi_mbit_s = ((data[6] \| (data[7] << 8)) &
2512	IEEE80211_VHT_MAX_LGI_MBIT_S_MASK0x1fff);
2513	ni->ni_vht_txmcs = (data[8] \| (data[9] << 8));
2514	ni->ni_vht_tx_max_lgi_mbit_s = ((data[10] \| (data[11] << 8)) &
2515	IEEE80211_VHT_MAX_LGI_MBIT_S_MASK0x1fff);
2516
2517	ni->ni_flags \|= IEEE80211_NODE_VHTCAP0x40000;
2518	}
2519
2520	/*
2521	* Only accept 80 MHz channel configurations that conform to
2522	* regulatory operating classes as defined by the 802.11ac spec.
2523	* Passing other configurations down to firmware can result in
2524	* regulatory assertions being trigged, such as fatal firmware
2525	* error 14FD in iwm(4).
2526	*
2527	* See 802.11ac 2013, page 380, Tables E-1 to E-5.
2528	*/
2529	int
2530	ieee80211_80mhz_center_freq_valid(const uint8_t chanidx)
2531	{
2532	static const uint8_t valid_center_chanidx[] = {
2533	42, 50, 58, 106, 112, 114, 138, 155
2534	};
2535	int i;
2536
2537	for (i = 0; i < nitems(valid_center_chanidx)(sizeof((valid_center_chanidx)) / sizeof((valid_center_chanidx )[0])); i++) {
2538	if (chanidx == valid_center_chanidx[i])
2539	return 1;
2540	}
2541
2542	return 0;
2543	}
2544
2545	/*
2546	* Install received VHT op information in the node's state block.
2547	*/
2548	int
2549	ieee80211_setup_vhtop(struct ieee80211_node ni, const uint8_t data,
2550	uint8_t len, int isprobe)
2551	{
2552	uint8_t sco;
2553	int have_40mhz;
2554
2555	if (len != 5)
2556	return 0;
2557
2558	if (data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_HT0 &&
2559	data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_801 &&
2560	data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_1602 &&
2561	data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_80803)
2562	return 0;
2563
2564	sco = ((ni->ni_htop0 & IEEE80211_HTOP0_SCO_MASK0x03) >>
2565	IEEE80211_HTOP0_SCO_SHIFT0);
2566	have_40mhz = (sco == IEEE80211_HTOP0_SCO_SCA1 \|\|
2567	sco == IEEE80211_HTOP0_SCO_SCB3);
2568
2569	if (have_40mhz && ieee80211_80mhz_center_freq_valid(data[1])) {
2570	ni->ni_vht_chan_width = data[0];
2571	ni->ni_vht_chan_center_freq_idx0 = data[1];
2572
2573	/* Only used in non-consecutive 80-80 160MHz configs. */
2574	if (data[2] && ieee80211_80mhz_center_freq_valid(data[2]))
2575	ni->ni_vht_chan_center_freq_idx1 = data[2];
2576	else
2577	ni->ni_vht_chan_center_freq_idx1 = 0;
2578	} else {
2579	ni->ni_vht_chan_width = IEEE80211_VHTOP0_CHAN_WIDTH_HT0;
2580	ni->ni_vht_chan_center_freq_idx0 = 0;
2581	ni->ni_vht_chan_center_freq_idx1 = 0;
2582	}
2583
2584	ni->ni_vht_basic_mcs = (data[3] \| data[4] << 8);
2585	return 1;
2586	}
2587
2588	#ifndef IEEE80211_STA_ONLY
2589	/*
2590	* Handle nodes switching from 11ac into legacy modes.
2591	*/
2592	void
2593	ieee80211_clear_vhtcaps(struct ieee80211_node *ni)
2594	{
2595	ni->ni_vhtcaps = 0;
2596	ni->ni_vht_rxmcs = 0;
2597	ni->ni_vht_rx_max_lgi_mbit_s = 0;
2598	ni->ni_vht_txmcs = 0;
2599	ni->ni_vht_tx_max_lgi_mbit_s = 0;
2600
2601	ni->ni_flags &= ~(IEEE80211_NODE_VHT0x10000 \| IEEE80211_NODE_VHT_SGI800x80000 \|
2602	IEEE80211_NODE_VHT_SGI1600x100000 \| IEEE80211_NODE_VHTCAP0x40000);
2603
2604	}
2605	#endif
2606
2607	/*
2608	* Install received rate set information in the node's state block.
2609	*/
2610	int
2611	ieee80211_setup_rates(struct ieee80211com ic, struct ieee80211_node ni,
2612	const u_int8_t rates, const u_int8_t xrates, int flags)
2613	{
2614	struct ieee80211_rateset *rs = &ni->ni_rates;
2615
2616	memset(rs, 0, sizeof(rs))__builtin_memset((rs), (0), (sizeof(rs)));
2617	rs->rs_nrates = rates[1];
2618	memcpy(rs->rs_rates, rates + 2, rs->rs_nrates)__builtin_memcpy((rs->rs_rates), (rates + 2), (rs->rs_nrates ));
2619	if (xrates != NULL((void *)0)) {
2620	u_int8_t nxrates;
2621	/*
2622	* Tack on 11g extended supported rate element.
2623	*/
2624	nxrates = xrates[1];
2625	if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE15) {
2626	nxrates = IEEE80211_RATE_MAXSIZE15 - rs->rs_nrates;
2627	DPRINTF(("extended rate set too large; "
2628	"only using %u of %u rates\n",
2629	nxrates, xrates[1]));
2630	ic->ic_stats.is_rx_rstoobig++;
2631	}
2632	memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates)__builtin_memcpy((rs->rs_rates + rs->rs_nrates), (xrates +2), (nxrates));
2633	rs->rs_nrates += nxrates;
2634	}
2635	return ieee80211_fix_rate(ic, ni, flags);
2636	}
2637
2638	void
2639	ieee80211_node_trigger_addba_req(struct ieee80211_node *ni, int tid)
2640	{
2641	if (ni->ni_tx_ba[tid].ba_state == IEEE80211_BA_INIT0 &&
2642	!timeout_pending(&ni->ni_addba_req_to[tid])((&ni->ni_addba_req_to[tid])->to_flags & 0x02)) {
2643	timeout_add_sec(&ni->ni_addba_req_to[tid],
2644	ni->ni_addba_req_intval[tid]);
2645	}
2646	}
2647
2648	void
2649	ieee80211_node_addba_request(struct ieee80211_node *ni, int tid)
2650	{
2651	struct ieee80211com *ic = ni->ni_ic;
2652	uint16_t ssn = ni->ni_qos_txseqs[tid];
2653
2654	ieee80211_addba_request(ic, ni, ssn, tid);
2655	}
2656
2657	void
2658	ieee80211_node_addba_request_ac_be_to(void *arg)
2659	{
2660	struct ieee80211_node *ni = arg;
2661	ieee80211_node_addba_request(ni, EDCA_AC_BE);
2662	}
2663
2664	void
2665	ieee80211_node_addba_request_ac_bk_to(void *arg)
2666	{
2667	struct ieee80211_node *ni = arg;
2668	ieee80211_node_addba_request(ni, EDCA_AC_BK);
2669	}
2670
2671	void
2672	ieee80211_node_addba_request_ac_vi_to(void *arg)
2673	{
2674	struct ieee80211_node *ni = arg;
2675	ieee80211_node_addba_request(ni, EDCA_AC_VI);
2676	}
2677
2678	void
2679	ieee80211_node_addba_request_ac_vo_to(void *arg)
2680	{
2681	struct ieee80211_node *ni = arg;
2682	ieee80211_node_addba_request(ni, EDCA_AC_VO);
2683	}
2684
2685	#ifndef IEEE80211_STA_ONLY
2686	/*
2687	* Check if the specified node supports ERP.
2688	*/
2689	int
2690	ieee80211_iserp_sta(const struct ieee80211_node *ni)
2691	{
2692	static const u_int8_t rates[] = { 2, 4, 11, 22, 12, 24, 48 };
2693	const struct ieee80211_rateset *rs = &ni->ni_rates;
2694	int i, j;
2695
2696	/*
2697	* A STA supports ERP operation if it includes all the Clause 19
2698	* mandatory rates in its supported rate set.
2699	*/
2700	for (i = 0; i < nitems(rates)(sizeof((rates)) / sizeof((rates)[0])); i++) {
2701	for (j = 0; j < rs->rs_nrates; j++) {
2702	if ((rs->rs_rates[j] & IEEE80211_RATE_VAL0x7f) == rates[i])
2703	break;
2704	}
2705	if (j == rs->rs_nrates)
2706	return 0;
2707	}
2708	return 1;
2709	}
2710
2711	/*
2712	* This function is called to notify the 802.1X PACP machine that a new
2713	* 802.1X port is enabled and must be authenticated. For 802.11, a port
2714	* becomes enabled whenever a STA successfully completes Open System
2715	* authentication with an AP.
2716	*/
2717	void
2718	ieee80211_needs_auth(struct ieee80211com ic, struct ieee80211_node ni)
2719	{
2720	/*
2721	* XXX this could be done via the route socket of via a dedicated
2722	* EAP socket or another kernel->userland notification mechanism.
2723	* The notification should include the MAC address (ni_macaddr).
2724	*/
2725	}
2726
2727	/*
2728	* Handle an HT STA joining an HT network.
2729	*/
2730	void
2731	ieee80211_node_join_ht(struct ieee80211com ic, struct ieee80211_node ni)
2732	{
2733	enum ieee80211_htprot;
2734
2735	/* Update HT protection setting. */
2736	if ((ni->ni_flags & IEEE80211_NODE_HT0x0400) == 0) {
2737	uint16_t htop1 = ic->ic_bss->ni_htop1;
2738	htop1 &= ~IEEE80211_HTOP1_PROT_MASK0x0003;
2739	htop1 \|= IEEE80211_HTPROT_NONHT_MIXED;
2740	ic->ic_bss->ni_htop1 = htop1;
2741	if (ic->ic_updateprot)
2742	ic->ic_updateprot(ic);
2743	}
2744	}
2745
2746	/*
2747	* Handle a station joining an RSN network.
2748	*/
2749	void
2750	ieee80211_node_join_rsn(struct ieee80211com ic, struct ieee80211_node ni)
2751	{
2752	DPRINTF(("station %s associated using proto %d akm 0x%x "
2753	"cipher 0x%x groupcipher 0x%x\n", ether_sprintf(ni->ni_macaddr),
2754	ni->ni_rsnprotos, ni->ni_rsnakms, ni->ni_rsnciphers,
2755	ni->ni_rsngroupcipher));
2756
2757	ni->ni_rsn_state = RSNA_AUTHENTICATION;
2758
2759	ni->ni_key_count = 0;
2760	ni->ni_port_valid = 0;
2761	ni->ni_flags &= ~IEEE80211_NODE_TXRXPROT(0x0010 \| 0x0008);
2762	ni->ni_flags &= ~IEEE80211_NODE_RSN_NEW_PTK0x2000;
2763	ni->ni_replaycnt = -1; /* XXX */
2764	ni->ni_rsn_retries = 0;
2765	ni->ni_rsncipher = ni->ni_rsnciphers;
2766
2767	ni->ni_rsn_state = RSNA_AUTHENTICATION_2;
2768
2769	/* generate a new authenticator nonce (ANonce) */
2770	arc4random_buf(ni->ni_nonce, EAPOL_KEY_NONCE_LEN32);
2771
2772	if (!ieee80211_is_8021x_akm(ni->ni_rsnakms)) {
2773	memcpy(ni->ni_pmk, ic->ic_psk, IEEE80211_PMK_LEN)__builtin_memcpy((ni->ni_pmk), (ic->ic_psk), (32));
2774	ni->ni_flags \|= IEEE80211_NODE_PMK0x0100;
2775	(void)ieee80211_send_4way_msg1(ic, ni);
2776	} else if (ni->ni_flags & IEEE80211_NODE_PMK0x0100) {
2777	/* skip 802.1X auth if a cached PMK was found */
2778	(void)ieee80211_send_4way_msg1(ic, ni);
2779	} else {
2780	/* no cached PMK found, needs full 802.1X auth */
2781	ieee80211_needs_auth(ic, ni);
2782	}
2783	}
2784
2785	void
2786	ieee80211_count_longslotsta(void arg, struct ieee80211_node ni)
2787	{
2788	int *longslotsta = arg;
2789
2790	if (ni->ni_associd == 0 \|\| ni->ni_state == IEEE80211_STA_COLLECT)
2791	return;
2792
2793	if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME0x0400))
2794	(*longslotsta)++;
2795	}
2796
2797	void
2798	ieee80211_count_nonerpsta(void arg, struct ieee80211_node ni)
2799	{
2800	int *nonerpsta = arg;
2801
2802	if (ni->ni_associd == 0 \|\| ni->ni_state == IEEE80211_STA_COLLECT)
2803	return;
2804
2805	if (!ieee80211_iserp_sta(ni))
2806	(*nonerpsta)++;
2807	}
2808
2809	void
2810	ieee80211_count_pssta(void arg, struct ieee80211_node ni)
2811	{
2812	int *pssta = arg;
2813
2814	if (ni->ni_associd == 0 \|\| ni->ni_state == IEEE80211_STA_COLLECT)
2815	return;
2816
2817	if (ni->ni_pwrsave == IEEE80211_PS_DOZE)
2818	(*pssta)++;
2819	}
2820
2821	void
2822	ieee80211_count_rekeysta(void arg, struct ieee80211_node ni)
2823	{
2824	int *rekeysta = arg;
2825
2826	if (ni->ni_associd == 0 \|\| ni->ni_state == IEEE80211_STA_COLLECT)
2827	return;
2828
2829	if (ni->ni_flags & IEEE80211_NODE_REKEY0x0004)
2830	(*rekeysta)++;
2831	}
2832
2833	/*
2834	* Handle a station joining an 11g network.
2835	*/
2836	void
2837	ieee80211_node_join_11g(struct ieee80211com ic, struct ieee80211_node ni)
2838	{
2839	int longslotsta = 0, nonerpsta = 0;
2840
2841	if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME0x0400)) {
2842	/*
2843	* Joining STA doesn't support short slot time. We must
2844	* disable the use of short slot time for all other associated
2845	* STAs and give the driver a chance to reconfigure the
2846	* hardware.
2847	*/
2848	ieee80211_iterate_nodes(ic,
2849	ieee80211_count_longslotsta, &longslotsta);
2850	if (longslotsta == 1) {
2851	if (ic->ic_caps & IEEE80211_C_SHSLOT0x00000080)
2852	ieee80211_set_shortslottime(ic, 0);
2853	}
2854	DPRINTF(("[%s] station needs long slot time, count %d\n",
2855	ether_sprintf(ni->ni_macaddr), longslotsta));
2856	}
2857
2858	if (!ieee80211_iserp_sta(ni)) {
2859	/*
2860	* Joining STA is non-ERP.
2861	*/
2862	ieee80211_iterate_nodes(ic,
2863	ieee80211_count_nonerpsta, &nonerpsta);
2864	DPRINTF(("[%s] station is non-ERP, %d non-ERP "
2865	"stations associated\n", ether_sprintf(ni->ni_macaddr),
2866	nonerpsta));
2867	/* must enable the use of protection */
2868	if (ic->ic_protmode != IEEE80211_PROT_NONE) {
2869	DPRINTF(("enable use of protection\n"));
2870	ic->ic_flags \|= IEEE80211_F_USEPROT0x00100000;
2871	}
2872
2873	if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE0x0020))
2874	ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE0x00040000;
2875	} else
2876	ni->ni_flags \|= IEEE80211_NODE_ERP0x0001;
2877	}
2878
2879	void
2880	ieee80211_node_join(struct ieee80211com ic, struct ieee80211_node ni,
2881	int resp)
2882	{
2883	int newassoc = (ni->ni_state != IEEE80211_STA_ASSOC);
2884
2885	if (ni->ni_associd == 0) {
2886	u_int16_t aid;
2887
2888	/*
2889	* It would be clever to search the bitmap
2890	* more efficiently, but this will do for now.
2891	*/
2892	for (aid = 1; aid < ic->ic_max_aid; aid++) {
2893	if (!IEEE80211_AID_ISSET(aid,((ic->ic_aid_bitmap)[((aid) &~ 0xc000) / 32] & (1 << (((aid) &~ 0xc000) % 32)))
2894	ic->ic_aid_bitmap)((ic->ic_aid_bitmap)[((aid) &~ 0xc000) / 32] & (1 << (((aid) &~ 0xc000) % 32))))
2895	break;
2896	}
2897	if (aid >= ic->ic_max_aid) {
2898	IEEE80211_SEND_MGMT(ic, ni, resp,((*(ic)->ic_send_mgmt)(ic, ni, resp, IEEE80211_REASON_ASSOC_TOOMANY , 0))
2899	IEEE80211_REASON_ASSOC_TOOMANY)((*(ic)->ic_send_mgmt)(ic, ni, resp, IEEE80211_REASON_ASSOC_TOOMANY , 0));
2900	ieee80211_node_leave(ic, ni);
2901	return;
2902	}
2903	ni->ni_associd = aid \| 0xc000;
2904	IEEE80211_AID_SET(ni->ni_associd, ic->ic_aid_bitmap)((ic->ic_aid_bitmap)[((ni->ni_associd) &~ 0xc000) / 32] \|= (1 << (((ni->ni_associd) &~ 0xc000) % 32 )));
2905	if (ic->ic_curmode == IEEE80211_MODE_11G \|\|
2906	(ic->ic_curmode == IEEE80211_MODE_11N &&
2907	IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)(((ic->ic_bss->ni_chan)->ic_flags & 0x0080) != 0 )))
2908	ieee80211_node_join_11g(ic, ni);
2909	}
2910
2911	DPRINTF(("station %s %s associated at aid %d\n",
2912	ether_sprintf(ni->ni_macaddr), newassoc ? "newly" : "already",
2913	ni->ni_associd & ~0xc000));
2914
2915	ieee80211_ht_negotiate(ic, ni);
2916	if (ic->ic_flags & IEEE80211_F_HTON0x02000000)
2917	ieee80211_node_join_ht(ic, ni);
2918
2919	/* give driver a chance to setup state like ni_txrate */
2920	if (ic->ic_newassoc)
2921	(*ic->ic_newassoc)(ic, ni, newassoc);
2922	IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_SUCCESS)((*(ic)->ic_send_mgmt)(ic, ni, resp, IEEE80211_STATUS_SUCCESS , 0));
2923	ieee80211_node_newstate(ni, IEEE80211_STA_ASSOC)do { (ni)->ni_state = (IEEE80211_STA_ASSOC); } while (0);
2924
2925	if (!(ic->ic_flags & IEEE80211_F_RSNON0x00200000)) {
2926	ni->ni_port_valid = 1;
2927	ni->ni_rsncipher = IEEE80211_CIPHER_USEGROUP;
2928	} else
2929	ieee80211_node_join_rsn(ic, ni);
2930
2931	#if NBRIDGE1 > 0
2932	/*
2933	* If the parent interface is a bridge port, learn
2934	* the node's address dynamically on this interface.
2935	*/
2936	if (ic->ic_ific_ac.ac_if.if_bridgeidx != 0)
2937	bridge_update(&ic->ic_ific_ac.ac_if,
2938	(struct ether_addr *)ni->ni_macaddr, 0);
2939	#endif
2940	}
2941
2942	/*
2943	* Handle an HT STA leaving an HT network.
2944	*/
2945	void
2946	ieee80211_node_leave_ht(struct ieee80211com ic, struct ieee80211_node ni)
2947	{
2948	struct ieee80211_rx_ba *ba;
2949	u_int8_t tid;
2950	int i;
2951
2952	/* free all Block Ack records */
2953	ieee80211_ba_del(ni);
2954	for (tid = 0; tid < IEEE80211_NUM_TID16; tid++) {
2955	ba = &ni->ni_rx_ba[tid];
2956	if (ba->ba_buf != NULL((void *)0)) {
2957	for (i = 0; i < IEEE80211_BA_MAX_WINSZ64; i++)
2958	m_freem(ba->ba_buf[i].m);
2959	free(ba->ba_buf, M_DEVBUF2,
2960	IEEE80211_BA_MAX_WINSZ64 * sizeof(*ba->ba_buf));
2961	ba->ba_buf = NULL((void *)0);
2962	}
2963	}
2964
2965	ieee80211_clear_htcaps(ni);
2966	}
2967
2968	/*
2969	* Handle a VHT STA leaving a VHT network.
2970	*/
2971	void
2972	ieee80211_node_leave_vht(struct ieee80211com ic, struct ieee80211_node ni)
2973	{
2974	ieee80211_clear_vhtcaps(ni);
2975	}
2976
2977	/*
2978	* Handle a station leaving an RSN network.
2979	*/
2980	void
2981	ieee80211_node_leave_rsn(struct ieee80211com ic, struct ieee80211_node ni)
2982	{
2983	int rekeysta = 0;
2984
2985	ni->ni_rsn_state = RSNA_INITIALIZE;
2986	if (ni->ni_flags & IEEE80211_NODE_REKEY0x0004) {
2987	ni->ni_flags &= ~IEEE80211_NODE_REKEY0x0004;
2988	ieee80211_iterate_nodes(ic,
2989	ieee80211_count_rekeysta, &rekeysta);
2990	if (rekeysta == 0)
2991	ieee80211_setkeysdone(ic);
2992	}
2993	ni->ni_flags &= ~IEEE80211_NODE_PMK0x0100;
2994	ni->ni_rsn_gstate = RSNA_IDLE;
2995
2996	timeout_del(&ni->ni_eapol_to);
2997	timeout_del(&ni->ni_sa_query_to);
2998
2999	ni->ni_rsn_retries = 0;
3000	ni->ni_flags &= ~IEEE80211_NODE_TXRXPROT(0x0010 \| 0x0008);
3001	ni->ni_port_valid = 0;
3002	(*ic->ic_delete_key)(ic, ni, &ni->ni_pairwise_key);
3003	}
3004
3005	/*
3006	* Handle a station leaving an 11g network.
3007	*/
3008	void
3009	ieee80211_node_leave_11g(struct ieee80211com ic, struct ieee80211_node ni)
3010	{
3011	int longslotsta = 0, nonerpsta = 0;
3012
3013	if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME0x0400)) {
3014	/* leaving STA did not support short slot time */
3015	ieee80211_iterate_nodes(ic,
3016	ieee80211_count_longslotsta, &longslotsta);
3017	if (longslotsta == 1) {
3018	/*
3019	* All associated STAs now support short slot time, so
3020	* enable this feature and give the driver a chance to
3021	* reconfigure the hardware. Notice that IBSS always
3022	* use a long slot time.
3023	*/
3024	if ((ic->ic_caps & IEEE80211_C_SHSLOT0x00000080) &&
3025	ic->ic_opmode != IEEE80211_M_IBSS)
3026	ieee80211_set_shortslottime(ic, 1);
3027	}
3028	DPRINTF(("[%s] long slot time station leaves, count %d\n",
3029	ether_sprintf(ni->ni_macaddr), longslotsta));
3030	}
3031
3032	if (!(ni->ni_flags & IEEE80211_NODE_ERP0x0001)) {
3033	/* leaving STA was non-ERP */
3034	ieee80211_iterate_nodes(ic,
3035	ieee80211_count_nonerpsta, &nonerpsta);
3036	if (nonerpsta == 1) {
3037	/*
3038	* All associated STAs are now ERP capable, disable use
3039	* of protection and re-enable short preamble support.
3040	*/
3041	ic->ic_flags &= ~IEEE80211_F_USEPROT0x00100000;
3042	if (ic->ic_caps & IEEE80211_C_SHPREAMBLE0x00000100)
3043	ic->ic_flags \|= IEEE80211_F_SHPREAMBLE0x00040000;
3044	}
3045	DPRINTF(("[%s] non-ERP station leaves, count %d\n",
3046	ether_sprintf(ni->ni_macaddr), nonerpsta));
3047	}
3048	}
3049
3050	void
3051	ieee80211_node_leave_pwrsave(struct ieee80211com *ic,
3052	struct ieee80211_node *ni)
3053	{
3054	struct mbuf_queue keep = MBUF_QUEUE_INITIALIZER(IFQ_MAXLEN, IPL_NET){ { ((void )0), ((((0x4)) > 0x0 && ((0x4)) < 0x9 ) ? 0x9 : ((0x4))), 0x0 }, { ((void )0), ((void *)0), 0 }, ( 256), 0 };
3055	struct mbuf *m;
3056
3057	if (ni->ni_pwrsave == IEEE80211_PS_DOZE)
3058	ni->ni_pwrsave = IEEE80211_PS_AWAKE;
3059
3060	if (mq_len(&ni->ni_savedq)({ typeof((&ni->ni_savedq)->mq_list.ml_len) __tmp = (volatile typeof((&ni->ni_savedq)->mq_list.ml_len ) )&((&ni->ni_savedq)->mq_list.ml_len); membar_datadep_consumer (); __tmp; }) > 0) {
3061	if (ic->ic_set_tim != NULL((void *)0))
3062	(*ic->ic_set_tim)(ic, ni->ni_associd, 0);
3063	}
3064	while ((m = mq_dequeue(&ni->ni_savedq)) != NULL((void *)0)) {
3065	if (ni->ni_refcnt > 0)
3066	ieee80211_node_decref(ni);
3067	m_freem(m);
3068	}
3069
3070	/* Purge frames queued for transmission during DTIM. */
3071	while ((m = mq_dequeue(&ic->ic_pwrsaveq)) != NULL((void *)0)) {
3072	if (m->m_pkthdrM_dat.MH.MH_pkthdr.ph_cookie == ni) {
3073	if (ni->ni_refcnt > 0)
3074	ieee80211_node_decref(ni);
3075	m_freem(m);
3076	} else
3077	mq_enqueue(&keep, m);
3078	}
3079	while ((m = mq_dequeue(&keep)) != NULL((void *)0))
3080	mq_enqueue(&ic->ic_pwrsaveq, m);
3081	}
3082
3083	/*
3084	* Handle bookkeeping for station deauthentication/disassociation
3085	* when operating as an ap.
3086	*/
3087	void
3088	ieee80211_node_leave(struct ieee80211com ic, struct ieee80211_node ni)
3089	{
3090	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
3091	panic("not in ap mode, mode %u", ic->ic_opmode);
3092
3093	if (ni->ni_state == IEEE80211_STA_COLLECT)
3094	return;
3095	/*
3096	* If node wasn't previously associated all we need to do is
3097	* reclaim the reference.
3098	*/
3099	if (ni->ni_associd == 0) {
3100	ieee80211_node_newstate(ni, IEEE80211_STA_COLLECT)do { (ni)->ni_state = (IEEE80211_STA_COLLECT); } while (0);
3101	return;
3102	}
3103
3104	ieee80211_node_leave_pwrsave(ic, ni);
3105
3106	if (ic->ic_flags & IEEE80211_F_RSNON0x00200000)
3107	ieee80211_node_leave_rsn(ic, ni);
3108
3109	if (ic->ic_curmode == IEEE80211_MODE_11G \|\|
3110	(ic->ic_curmode == IEEE80211_MODE_11N &&
3111	IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)(((ic->ic_bss->ni_chan)->ic_flags & 0x0080) != 0 )))
3112	ieee80211_node_leave_11g(ic, ni);
3113
3114	if (ni->ni_flags & IEEE80211_NODE_HT0x0400)
3115	ieee80211_node_leave_ht(ic, ni);
3116	if (ni->ni_flags & IEEE80211_NODE_VHT0x10000)
3117	ieee80211_node_leave_vht(ic, ni);
3118
3119	if (ic->ic_node_leave != NULL((void *)0))
3120	(*ic->ic_node_leave)(ic, ni);
3121
3122	ieee80211_node_newstate(ni, IEEE80211_STA_COLLECT)do { (ni)->ni_state = (IEEE80211_STA_COLLECT); } while (0);
3123
3124	#if NBRIDGE1 > 0
3125	/*
3126	* If the parent interface is a bridge port, delete
3127	* any dynamically learned address for this node.
3128	*/
3129	if (ic->ic_ific_ac.ac_if.if_bridgeidx != 0)
3130	bridge_update(&ic->ic_ific_ac.ac_if,
3131	(struct ether_addr *)ni->ni_macaddr, 1);
3132	#endif
3133	}
3134
3135	static int
3136	ieee80211_do_slow_print(struct ieee80211com ic, int did_print)
3137	{
3138	static const struct timeval merge_print_intvl = {
3139	.tv_sec = 1, .tv_usec = 0
3140	};
3141	if ((ic->ic_ific_ac.ac_if.if_flags & IFF_LINK00x1000) == 0)
3142	return 0;
3143	if (!*did_print && (ic->ic_ific_ac.ac_if.if_flags & IFF_DEBUG0x4) == 0 &&
3144	!ratecheck(&ic->ic_last_merge_print, &merge_print_intvl))
3145	return 0;
3146
3147	*did_print = 1;
3148	return 1;
3149	}
3150
3151	/* ieee80211_ibss_merge helps merge 802.11 ad hoc networks. The
3152	* convention, set by the Wireless Ethernet Compatibility Alliance
3153	* (WECA), is that an 802.11 station will change its BSSID to match
3154	* the "oldest" 802.11 ad hoc network, on the same channel, that
3155	* has the station's desired SSID. The "oldest" 802.11 network
3156	* sends beacons with the greatest TSF timestamp.
3157	*
3158	* Return ENETRESET if the BSSID changed, 0 otherwise.
3159	*
3160	* XXX Perhaps we should compensate for the time that elapses
3161	* between the MAC receiving the beacon and the host processing it
3162	* in ieee80211_ibss_merge.
3163	*/
3164	int
3165	ieee80211_ibss_merge(struct ieee80211com ic, struct ieee80211_node ni,
3166	u_int64_t local_tsft)
3167	{
3168	u_int64_t beacon_tsft;
3169	int did_print = 0, sign;
3170	union {
3171	u_int64_t word;
3172	u_int8_t tstamp[8];
3173	} u;
3174
3175	/* ensure alignment */
3176	(void)memcpy(&u, &ni->ni_tstamp[0], sizeof(u))__builtin_memcpy((&u), (&ni->ni_tstamp[0]), (sizeof (u)));
3177	beacon_tsft = letoh64(u.word)((__uint64_t)(u.word));
3178
3179	/* we are faster, let the other guy catch up */
3180	if (beacon_tsft < local_tsft)
3181	sign = -1;
3182	else
3183	sign = 1;
3184
3185	if (IEEE80211_ADDR_EQ(ni->ni_bssid, ic->ic_bss->ni_bssid)(__builtin_memcmp((ni->ni_bssid), (ic->ic_bss->ni_bssid ), (6)) == 0)) {
3186	if (!ieee80211_do_slow_print(ic, &did_print))
3187	return 0;
3188	printf("%s: tsft offset %s%llu\n", ic->ic_ific_ac.ac_if.if_xname,
3189	(sign < 0) ? "-" : "",
3190	(sign < 0)
3191	? (local_tsft - beacon_tsft)
3192	: (beacon_tsft - local_tsft));
3193	return 0;
3194	}
3195
3196	if (sign < 0)
3197	return 0;
3198
3199	if (ieee80211_match_bss(ic, ni, 0) != 0)
3200	return 0;
3201
3202	if (ieee80211_do_slow_print(ic, &did_print)) {
3203	printf("%s: ieee80211_ibss_merge: bssid mismatch %s\n",
3204	ic->ic_ific_ac.ac_if.if_xname, ether_sprintf(ni->ni_bssid));
3205	printf("%s: my tsft %llu beacon tsft %llu\n",
3206	ic->ic_ific_ac.ac_if.if_xname, local_tsft, beacon_tsft);
3207	printf("%s: sync TSF with %s\n",
3208	ic->ic_ific_ac.ac_if.if_xname, ether_sprintf(ni->ni_macaddr));
3209	}
3210
3211	ic->ic_flags &= ~IEEE80211_F_SIBSS0x00000002;
3212
3213	/* negotiate rates with new IBSS */
3214	ieee80211_fix_rate(ic, ni, IEEE80211_F_DOFRATE0x00000002 \|
3215	IEEE80211_F_DONEGO0x00000004 \| IEEE80211_F_DODEL0x00000008);
3216	if (ni->ni_rates.rs_nrates == 0) {
3217	if (ieee80211_do_slow_print(ic, &did_print)) {
3218	printf("%s: rates mismatch, BSSID %s\n",
3219	ic->ic_ific_ac.ac_if.if_xname, ether_sprintf(ni->ni_bssid));
3220	}
3221	return 0;
3222	}
3223
3224	if (ieee80211_do_slow_print(ic, &did_print)) {
3225	printf("%s: sync BSSID %s -> ",
3226	ic->ic_ific_ac.ac_if.if_xname, ether_sprintf(ic->ic_bss->ni_bssid));
3227	printf("%s ", ether_sprintf(ni->ni_bssid));
3228	printf("(from %s)\n", ether_sprintf(ni->ni_macaddr));
3229	}
3230
3231	ieee80211_node_newstate(ni, IEEE80211_STA_BSS)do { (ni)->ni_state = (IEEE80211_STA_BSS); } while (0);
3232	(*ic->ic_node_copy)(ic, ic->ic_bss, ni);
3233
3234	return ENETRESET52;
3235	}
3236
3237	void
3238	ieee80211_set_tim(struct ieee80211com *ic, int aid, int set)
3239	{
3240	if (set)
3241	setbit(ic->ic_tim_bitmap, aid & ~0xc000)((ic->ic_tim_bitmap)[(aid & ~0xc000)>>3] \|= 1<< ((aid & ~0xc000)&(8 -1)));
3242	else
3243	clrbit(ic->ic_tim_bitmap, aid & ~0xc000)((ic->ic_tim_bitmap)[(aid & ~0xc000)>>3] &= ~ (1<<((aid & ~0xc000)&(8 -1))));
3244	}
3245
3246	/*
3247	* This function shall be called by drivers immediately after every DTIM.
3248	* Transmit all group addressed MSDUs buffered at the AP.
3249	*/
3250	void
3251	ieee80211_notify_dtim(struct ieee80211com *ic)
3252	{
3253	/* NB: group addressed MSDUs are buffered in ic_bss */
3254	struct ieee80211_node *ni = ic->ic_bss;
3255	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
3256	struct ieee80211_frame *wh;
3257	struct mbuf *m;
3258
3259	KASSERT(ic->ic_opmode == IEEE80211_M_HOSTAP)((ic->ic_opmode == IEEE80211_M_HOSTAP) ? (void)0 : __assert ("diagnostic ", "/usr/src/sys/net80211/ieee80211_node.c", 3259 , "ic->ic_opmode == IEEE80211_M_HOSTAP"));
3260
3261	while ((m = mq_dequeue(&ni->ni_savedq)) != NULL((void *)0)) {
3262	if (!mq_empty(&ni->ni_savedq)(({ typeof((&ni->ni_savedq)->mq_list.ml_len) __tmp = (volatile typeof((&ni->ni_savedq)->mq_list.ml_len ) )&((&ni->ni_savedq)->mq_list.ml_len); membar_datadep_consumer (); __tmp; }) == 0)) {
3263	/* more queued frames, set the more data bit */
3264	wh = mtod(m, struct ieee80211_frame )((struct ieee80211_frame )((m)->m_hdr.mh_data));
3265	wh->i_fc[1] \|= IEEE80211_FC1_MORE_DATA0x20;
3266	}
3267	mq_enqueue(&ic->ic_pwrsaveq, m);
3268	if_start(ifp);
3269	}
3270	/* XXX assumes everything has been sent */
3271	ic->ic_tim_mcast_pending = 0;
3272	}
3273	#endif /* IEEE80211_STA_ONLY */
3274
3275	/*
3276	* Compare nodes in the tree by lladdr
3277	*/
3278	int
3279	ieee80211_node_cmp(const struct ieee80211_node *b1,
3280	const struct ieee80211_node *b2)
3281	{
3282	return (memcmp(b1->ni_macaddr, b2->ni_macaddr, IEEE80211_ADDR_LEN)__builtin_memcmp((b1->ni_macaddr), (b2->ni_macaddr), (6 )));
3283	}
3284
3285	/*
3286	* Compare nodes in the tree by essid
3287	*/
3288	int
3289	ieee80211_ess_cmp(const struct ieee80211_ess_rbt *b1,
3290	const struct ieee80211_ess_rbt *b2)
3291	{
3292	return (memcmp(b1->essid, b2->essid, IEEE80211_NWID_LEN)__builtin_memcmp((b1->essid), (b2->essid), (32)));
3293	}
3294
3295	/*
3296	* Generate red-black tree function logic
3297	*/
3298	RBT_GENERATE(ieee80211_tree, ieee80211_node, ni_node, ieee80211_node_cmp)static int ieee80211_tree_RBT_COMPARE(const void lptr, const void rptr) { const struct ieee80211_node l = lptr, r = rptr ; return ieee80211_node_cmp(l, r); } static const struct rb_type ieee80211_tree_RBT_INFO = { ieee80211_tree_RBT_COMPARE, ((void )0), __builtin_offsetof(struct ieee80211_node, ni_node), }; const struct rb_type const ieee80211_tree_RBT_TYPE = &ieee80211_tree_RBT_INFO;
3299	RBT_GENERATE(ieee80211_ess_tree, ieee80211_ess_rbt, ess_rbt, ieee80211_ess_cmp)static int ieee80211_ess_tree_RBT_COMPARE(const void lptr, const void rptr) { const struct ieee80211_ess_rbt l = lptr, r = rptr; return ieee80211_ess_cmp(l, r); } static const struct rb_type ieee80211_ess_tree_RBT_INFO = { ieee80211_ess_tree_RBT_COMPARE , ((void )0), __builtin_offsetof(struct ieee80211_ess_rbt, ess_rbt ), }; const struct rb_type const ieee80211_ess_tree_RBT_TYPE = &ieee80211_ess_tree_RBT_INFO;