Ticket #907: madwifi-refcnt.diff

net80211/ieee80211_crypto.c

@@ -609 +609 @@
-
-/*
- * Validate and strip privacy headers (and trailer) for a
-WEP/Privacy
+Protected Frame
- */
-struct ieee80211_key *
-ieee80211_crypto_decap(struct ieee80211_node *ni, struct sk_buff *skb, int hdrlen)

net80211/ieee80211_node.c

@@ -72 +72 @@
-static u_int8_t node_getrssi(const struct ieee80211_node *);
-
-static void _ieee80211_free_node(struct ieee80211_node *);
-static void node_reclaim(struct ieee80211_node_table *, struct ieee80211_node*);
-
+static void _node_table_leave(struct ieee80211_node_table *, struct ieee80211_node *);
+static void _node_table_join(struct ieee80211_node_table *, struct ieee80211_node *);
+
-static void ieee80211_node_timeout(unsigned long);
-
-static void ieee80211_node_table_init(struct ieee80211com *,
@@ -192 +194 @@
-
-        ieee80211_node_table_reset(&ic->ic_sta, vap);
-        if (vap->iv_bss != NULL) {
-
-
+
-        }
-        if (vap->iv_aid_bitmap != NULL) {
-                FREE(vap->iv_aid_bitmap, M_DEVBUF);
@@ -261 +262 @@
-                "%s: creating ibss on channel %u\n", __func__,
-                ieee80211_chan2ieee(ic, chan));
-
-
+
+
+
-        ni = ieee80211_find_node(&ic->ic_sta, vap->iv_myaddr);
-        if (ni == NULL) {
-                ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr);
@@ -270 +273 @@
-                        return;
-                }
-        }
-        else
-                ieee80211_free_node(ni);
-
-        IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, "%s: %p<%s> refcnt %d\n",
-                __func__, vap->iv_bss, ether_sprintf(vap->iv_bss->ni_macaddr),
@@ -343 +344 @@
-        else if (IEEE80211_IS_CHAN_QUARTER(chan))
-                ni->ni_rates = ic->ic_sup_quarter_rates;
-
-
+
+
-}
-EXPORT_SYMBOL(ieee80211_create_ibss);
-
@@ -370 +372 @@
-        ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr);
-        KASSERT(ni != NULL, ("unable to setup inital BSS node"));
-        obss = vap->iv_bss;
+        // Caller's reference
-        vap->iv_bss = ieee80211_ref_node(ni);
-
-        IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, "%s: new bss %p<%s> refcnt %d\n",
@@ -379 +382 @@
-        if (obss != NULL) {
-                copy_bss(ni, obss);
-                ni->ni_intval = ic->ic_lintval;
-
+
+
-        }
-}
-
@@ -419 +423 @@
-                if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
-                        return 0;
-        } else {
-
+
+
+
-                if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
-                        return 0;
-        }
@@ -578 +584 @@
-                vap->iv_state == IEEE80211_S_RUN && ssid_equal(obss, selbs));
-        vap->iv_bss = selbs;
-        if (obss != NULL)
-free_node(
+unref_node(&
-        ic->ic_bsschan = selbs->ni_chan;
-        ic->ic_curchan = ic->ic_bsschan;
-        ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan);
@@ -641 +647 @@
-                        return 0;
-                }
-        } else
-free_node(
+unref_node(&
-
-        /*
-         * Expand scan state into node's format.
@@ -681 +687 @@
-
-        IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 
-        "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
-+
+ + 
-
-        return ieee80211_sta_join1(ieee80211_ref_node(ni));
-}
@@ -695 +701 @@
-ieee80211_sta_leave(struct ieee80211_node *ni)
-{
-        struct ieee80211vap *vap = ni->ni_vap;
-        struct ieee80211com *ic = vap->iv_ic;
-
-        /* WDS/Repeater: Stop software beacon timer for STA */
-        if (vap->iv_opmode == IEEE80211_M_STA &&
-            vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) {
-                del_timer(&vap->iv_swbmiss);
-        }
-
-
+
-        ieee80211_notify_node_leave(ni);
-}
-
@@ -716 +720 @@
-        struct ieee80211_node_table *nt,        const char *name, int inact)
-{
-        nt->nt_ic = ic;
-
+TABLE_
-        IEEE80211_SCAN_LOCK_INIT(nt, ic->ic_dev->name);
-        TAILQ_INIT(&nt->nt_node);
-        nt->nt_name = name;
@@ -728 +732 @@
-        mod_timer(&nt->nt_wds_aging_timer, jiffies + HZ * WDS_AGING_TIMER_VAL);
-}
-
+static __inline void _node_table_join(struct ieee80211_node_table *nt, struct ieee80211_node *ni) {
+        IEEE80211_NODE_TABLE_LOCK_ASSERT(ni);
+        IEEE80211_NODE_LOCK_ASSERT(ni);
+
+        ni->ni_table = nt;
+        TAILQ_INSERT_TAIL(&nt->nt_node, ieee80211_ref_node(ni), ni_list);
+        LIST_INSERT_HEAD(&nt->nt_hash[IEEE80211_NODE_HASH(ni->ni_macaddr)], ni, ni_hash);
+}
+
+static __inline void _node_table_leave(struct ieee80211_node_table *nt, struct ieee80211_node *ni) {
+        IEEE80211_NODE_TABLE_LOCK_ASSERT(ni);
+        IEEE80211_NODE_LOCK_ASSERT(ni);
+        
+        TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
+        LIST_REMOVE(ni, ni_hash);
+        ni->ni_table = NULL;
+        _ieee80211_unref_node(ni);
+}
+
-static struct ieee80211_node *
-node_alloc(struct ieee80211_node_table *nt, struct ieee80211vap *vap)
-{
@@ -770 +793 @@
-                        IEEE80211_UNLOCK_IRQ(ni->ni_ic);
-                }
-        }
-        /*
-         * Clear AREF flag that marks the authorization refcnt bump
-         * has happened.  This is probably not needed as the node
-         * should always be removed from the table so not found but
-         * do it just in case.
-         */
-        ni->ni_flags &= ~IEEE80211_NODE_AREF;
-
-        /*
-         * Drain power save queue and, if needed, clear TIM.
@@ -814 +830 @@
-static void
-node_free(struct ieee80211_node *ni)
-{
+#if 0
+        // We should 'cleanup' and then free'ing should be done automatically on decref
-        struct ieee80211com *ic = ni->ni_ic;
-
-        ic->ic_node_cleanup(ni);
+#endif 
+
-        if (ni->ni_wpa_ie != NULL)
-                FREE(ni->ni_wpa_ie, M_DEVBUF);
-        if (ni->ni_rsn_ie != NULL)
@@ -864 +884 @@
-                ether_sprintf(macaddr), nt->nt_name,
-                ieee80211_node_refcnt(ni)+1);
-
+        IEEE80211_NODE_LOCK_INIT(ni, ic->ic_dev->name);
+        ieee80211_node_initref(ni);             /* referenced once */
+        
-        IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
-        hash = IEEE80211_NODE_HASH(macaddr);
-
+
-        ni->ni_chan = IEEE80211_CHAN_ANYC;
-        ni->ni_authmode = IEEE80211_AUTH_OPEN;
-        ni->ni_txpower = ic->ic_txpowlimit;     /* max power */
-ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE);
+
-        ni->ni_inact_reload = nt->nt_inact_init;
-        ni->ni_inact = ni->ni_inact_reload;
+        
+        ni->ni_challenge = NULL;
+        ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE);
-        ni->ni_ath_defkeyindex = IEEE80211_INVAL_DEFKEY;
-        ni->ni_rxkeyoff = 0;
-
-
-
-
-
-
-
-
+
-#define N(a)    (sizeof(a)/sizeof(a[0]))
-        for (i = 0; i < N(ni->ni_rxfrag); i++)
-                ni->ni_rxfrag[i] = NULL;
-#undef N
-
-
+
-
+        ni->ni_vap = vap;
+        ni->ni_ic = ic;
+        
+        IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+        IEEE80211_NODE_LOCK_IRQ(ni);
+        _node_table_join(nt, ni);
+        IEEE80211_NODE_UNLOCK_IRQ(ni);
+        IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+
-        WME_UAPSD_NODE_TRIGSEQINIT(ni);
-
-        return ni;
@@ -916 +943 @@
-                wds->wds_agingcount = WDS_AGING_COUNT;
-        hash = IEEE80211_NODE_HASH(macaddr);
-        IEEE80211_ADDR_COPY(wds->wds_macaddr, macaddr);
-ieee80211_ref_node(ni);                /* Reference node */
-wds->wds_ni = ni
-IEEE80211_NODE_LOCK_IRQ(nt
+
+IEEE80211_NODE_TABLE_LOCK_IRQ(nt)
+wds->wds_ni = ieee80211_ref_node(ni
-        LIST_INSERT_HEAD(&nt->nt_wds_hash[hash], wds, wds_hash);
-
+TABLE_
-        return 0;
-}
-EXPORT_SYMBOL(ieee80211_add_wds_addr);
@@ -933 +960 @@
-        struct ieee80211_wds_addr *wds;
-
-        hash = IEEE80211_NODE_HASH(macaddr);
-
+TABLE_
-        LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
-                if (IEEE80211_ADDR_EQ(wds->wds_macaddr, macaddr)) {
-
-
-
-
-
-
+
+
+
+
-                }
-        }
-
+TABLE_
-}
-EXPORT_SYMBOL(ieee80211_remove_wds_addr);
-
@@ -956 +981 @@
-        int hash;
-        struct ieee80211_wds_addr *wds;
-
-
+TABLE_
-        for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
-                LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
-                        if (wds->wds_ni == ni) {
-
-
-
-
-
+
+
+
-                        }
-                }
-        }
-
+TABLE_
-}
-EXPORT_SYMBOL(ieee80211_del_wds_node);
-
@@ -979 +1002 @@
-        int hash;
-        struct ieee80211_wds_addr *wds;
-
-
+TABLE_
-        for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
-                LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
-                        if (wds->wds_agingcount != WDS_AGING_STATIC) {
-                                if (!wds->wds_agingcount) {
-
-
-
-
-
+
+
+
-                                } else
-                                        wds->wds_agingcount--;
-                        }
-                }
-        }
-
+TABLE_
-        mod_timer(&nt->nt_wds_aging_timer, jiffies + HZ * WDS_AGING_TIMER_VAL);
-}
-
@@ -1030 +1051 @@
-                /* XXX optimize away */
-                IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
-
-           /* NB: pedantic */
+
-                ni->ni_ic = ic;
-#define N(a)    (sizeof(a)/sizeof(a[0]))
-                for (i = 0; i < N(ni->ni_rxfrag); i++)
@@ -1056 +1077 @@
-
-        ni = ieee80211_alloc_node(&ic->ic_sta, vap, macaddr);
-        if (ni != NULL) {
-
-
-
+
-                ni->ni_authmode = vap->iv_bss->ni_authmode;
-                ni->ni_txpower = vap->iv_bss->ni_txpower;
-                ni->ni_vlan = vap->iv_bss->ni_vlan;     /* XXX?? */
@@ -1079 +1098 @@
-        struct ieee80211_node *ni;
-        struct ieee80211_wds_addr *wds;
-        int hash;
-
+TABLE_
-
-        hash = IEEE80211_NODE_HASH(macaddr);
-        LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
@@ -1106 +1125 @@
-        int hash;
-        struct ieee80211_wds_addr *wds;
-
-
+TABLE_
-
-        hash = IEEE80211_NODE_HASH(macaddr);
-        LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
@@ -1144 +1163 @@
-{
-        struct ieee80211_node *ni;
-
-
+TABLE_
-        ni = _ieee80211_find_wds_node(nt, macaddr);
-
+TABLE_
-        return ni;
-}
-EXPORT_SYMBOL(ieee80211_find_wds_node);
@@ -1161 +1180 @@
-{
-        struct ieee80211_node *ni;
-
-
+TABLE_
-        ni = _ieee80211_find_node(nt, macaddr);
-
+TABLE_
-        return ni;
-}
-#ifdef IEEE80211_DEBUG_REFCNT
@@ -1291 +1310 @@
-        /* XXX check ic_bss first in station mode */
-        /* XXX 4-address frames? */
-        nt = &ic->ic_sta;
-
+TABLE_
-        if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
-                ni = _ieee80211_find_node(nt, wh->i_addr1);
-        else
-                ni = _ieee80211_find_node(nt, wh->i_addr2);
-
+TABLE_
-
-        return ni;
-#undef IS_PSPOLL
@@ -1333 +1352 @@
-
-        /* XXX can't hold lock across dup_bss due to recursive locking */
-        nt = &vap->iv_ic->ic_sta;
-
+TABLE_
-        ni = _ieee80211_find_node(nt, mac);
-
+TABLE_
-
-        if (ni == NULL) {
-                if (vap->iv_opmode == IEEE80211_M_IBSS ||
@@ -1380 +1399 @@
-
-        if (vap->iv_aid_bitmap != NULL)
-                IEEE80211_AID_CLR(vap, ni->ni_associd);
-
-
-
-
+
-        vap->iv_ic->ic_node_free(ni);
-}
-
+
-void
-#ifdef IEEE80211_DEBUG_REFCNT
-ieee80211_free_node_debug(struct ieee80211_node *ni, const char *func, int line)
@@ -1394 +1411 @@
-ieee80211_free_node(struct ieee80211_node *ni)
-#endif
-{
-        struct ieee80211_node_table *nt = ni->ni_table;
-        struct ieee80211com *ic = ni->ni_ic;
-
-#ifdef IEEE80211_DEBUG_REFCNT
-        IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
-                "%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni,
-                 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni) - 1);
-#endif
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-}
-#ifdef IEEE80211_DEBUG_REFCNT
-EXPORT_SYMBOL(ieee80211_free_node_debug);
@@ -1438 +1424 @@
-EXPORT_SYMBOL(ieee80211_free_node);
-#endif
-
-/*
- * Reclaim a node.  If this is the last reference count then
- * do the normal free work.  Otherwise remove it from the node
- * table and mark it gone by clearing the back-reference.
- */
-static void
-node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
-{
-
-        IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
-                "%s: remove %p<%s> from %s table, refcnt %d\n",
-                __func__, ni, ether_sprintf(ni->ni_macaddr),
-                nt->nt_name, ieee80211_node_refcnt(ni)-1);
-        if (!ieee80211_node_dectestref(ni)) {
-                /*
-                 * Other references are present, just remove the
-                 * node from the table so it cannot be found.  When
-                 * the references are dropped storage will be
-                 * reclaimed.  This normally only happens for ic_bss.
-                 */
-                TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
-                LIST_REMOVE(ni, ni_hash);
-                ni->ni_table = NULL;            /* clear reference */
-        } else
-                _ieee80211_free_node(ni);
-}
-
-static void
-ieee80211_node_table_reset(struct ieee80211_node_table *nt,
-        struct ieee80211vap *match)
-{
-        struct ieee80211_node *ni, *next;
-
-
+TABLE_
-        TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next) {
-                if (match != NULL && ni->ni_vap != match)
-                        continue;
@@ -1483 +1442 @@
-                        if (vap->iv_aid_bitmap != NULL)
-                                IEEE80211_AID_CLR(vap, ni->ni_associd);
-                }
-node_reclaim(nt, 
+ieee80211_node_leave(
-        }
-
+TABLE_
-}
-
-static void
-ieee80211_node_table_cleanup(struct ieee80211_node_table *nt)
-{
+        struct ieee80211com *ic = nt->nt_ic;
-        struct ieee80211_node *ni, *next;
-
-        TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next) {
@@ -1502 +1462 @@
-                        if (vap->iv_aid_bitmap != NULL)
-                                IEEE80211_AID_CLR(vap, ni->ni_associd);
-                }
-node_reclaim(nt, 
+ic->ic_node_cleanup(
-        }
-        del_timer(&nt->nt_wds_aging_timer);
-        IEEE80211_SCAN_LOCK_DESTROY(nt);
-
+TABLE_
-}
-
-/*
@@ -1534 +1494 @@
-        IEEE80211_SCAN_LOCK_IRQ(nt); 
-        gen = ++nt->nt_scangen;
-restart:
-
+TABLE_
-        TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
-                if (ni->ni_scangen == gen)      /* previously handled */
-                        continue;
@@ -1598 +1558 @@
-                                 * ref for us as needed.
-                                 */
-                                ieee80211_ref_node(ni);
-
+TABLE_
-                                ieee80211_send_nulldata(ni);
-                                /* XXX stat? */
-                                goto restart;
@@ -1621 +1581 @@
-                         */
-                        ni->ni_vap->iv_stats.is_node_timeout++;
-                        ieee80211_ref_node(ni);
-
+TABLE_
-                        if (ni->ni_associd != 0) {
-                                IEEE80211_SEND_MGMT(ni,
-                                        IEEE80211_FC0_SUBTYPE_DEAUTH,
-                                        IEEE80211_REASON_AUTH_EXPIRE);
-                        }
-                        ieee80211_node_leave(ni);
-free_node(
+unref_node(&
-                        goto restart;
-                }
-        }
-
+TABLE_
-
-        IEEE80211_SCAN_UNLOCK_IRQ(nt);
-}
@@ -1645 +1605 @@
-{
-        struct ieee80211com *ic = (struct ieee80211com *) arg;
-
-i
+
-        ieee80211_timeout_stations(&ic->ic_sta);
-
-        ic->ic_inact.expires = jiffies + IEEE80211_INACT_WAIT * HZ;
@@ -1661 +1621 @@
-        IEEE80211_SCAN_LOCK_IRQ(nt);
-        gen = ++nt->nt_scangen;
-restart:
-LOCK
+TABLE_LOCK_IRQ
-        TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
-                if (ni->ni_scangen != gen) {
-                        ni->ni_scangen = gen;
-                        (void) ieee80211_ref_node(ni);
-
-
-
-
+
-                }
-        }
-
+
+
+
+
-
-        IEEE80211_SCAN_UNLOCK_IRQ(nt);
-}
@@ -1964 +1924 @@
-        IEEE80211_LOCK_IRQ(ic);
-        if (vap->iv_aid_bitmap != NULL)
-                IEEE80211_AID_CLR(vap, ni->ni_associd);
+
-        ni->ni_associd = 0;
-        vap->iv_sta_assoc--;
-        ic->ic_sta_assoc--;
+
-#ifdef ATH_SUPERG_XR
-        if (ni->ni_vap->iv_flags & IEEE80211_F_XR)
-                ic->ic_xr_sta_assoc--;
@@ -1977 +1939 @@
-        if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan))
-                ieee80211_node_leave_11g(ni);
-        IEEE80211_UNLOCK_IRQ(ic);
+
+        /* From this point onwards we can no longer find the node,
+         * so no more references are generated
+         */
+        ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
+        ieee80211_del_wds_node(nt, ni);
+        IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+        IEEE80211_NODE_LOCK_IRQ(ni);
+        _node_table_leave(nt, ni);
+        IEEE80211_NODE_UNLOCK_IRQ(ni);
+        IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+
-        /*
-         * Cleanup station state.  In particular clear various
-         * state that might otherwise be reused if the node
@@ -1986 +1960 @@
-        ieee80211_sta_leave(ni);
-done:
-        /*
-
-
-
-
+
-         */
-
-
-
-
-
-
-
-
+
+
-}
-EXPORT_SYMBOL(ieee80211_node_leave);
-
@@ -2058 +2023 @@
-void
-ieee80211_node_reset(struct ieee80211_node *ni, struct ieee80211vap *vap)
-{
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
-}

net80211/ieee80211_node.h

@@ -94 +94 @@
-        struct ieee80211_node_table *ni_table;
-        TAILQ_ENTRY(ieee80211_node) ni_list;
-        LIST_ENTRY(ieee80211_node) ni_hash;
-
+
+
-        u_int ni_scangen;                       /* gen# for timeout scan */
-        u_int8_t ni_authmode;                   /* authentication algorithm */
-        u_int16_t ni_flags;                     /* special-purpose state */
@@ -186 +187 @@
-#define WME_UAPSD_NODE_INVALIDSEQ       0xffff
-#define WME_UAPSD_NODE_TRIGSEQINIT(_ni) (memset(&(_ni)->ni_uapsd_trigseq[0], 0xff, sizeof((_ni)->ni_uapsd_trigseq)))
-
-static __inline struct ieee80211_node *
-ieee80211_ref_node(struct ieee80211_node *ni)
-{
-        ieee80211_node_incref(ni);
-        return ni;
-}
-
-static __inline void
-ieee80211_unref_node(struct ieee80211_node **ni)
-{
-        ieee80211_node_decref(*ni);
-        *ni = NULL;                     /* guard against use */
-}
-
-void ieee80211_node_attach(struct ieee80211com *);
-void ieee80211_node_detach(struct ieee80211com *);
-void ieee80211_node_vattach(struct ieee80211vap *);
@@ -243 +230 @@
- */
-struct ieee80211_node_table {
-        struct ieee80211com *nt_ic;             /* back reference */
-
+table_
-        TAILQ_HEAD(, ieee80211_node) nt_node;   /* information of all nodes */
-        ATH_LIST_HEAD(, ieee80211_node) nt_hash[IEEE80211_NODE_HASHSIZE];
-        ATH_LIST_HEAD(, ieee80211_wds_addr) nt_wds_hash[IEEE80211_NODE_HASHSIZE];
@@ -280 +267 @@
-#else
-void ieee80211_free_node(struct ieee80211_node *);
-
+static __inline struct ieee80211_node *
+ieee80211_ref_node(struct ieee80211_node *ni)
+{
+        ieee80211_node_incref(ni);
+        return ni;
+}
+
+static __inline void
+ieee80211_unref_node(struct ieee80211_node **pni)
+{       
+        struct ieee80211_node *ni = *pni;
+        IEEE80211_NODE_LOCK_IRQ(ni);
+        _ieee80211_unref_node(ni);
+        IEEE80211_NODE_UNLOCK_IRQ(ni);
+        pni = NULL;                     /* guard against use */
+}
+
+static __inline void
+_ieee80211_unref_node(struct ieee80211_node *ni) {
+        if (ieee80211_node_dectestref(ni)) {
+                _ieee80211_free_node(ni);
+        }
+}
+
-struct ieee80211_node *ieee80211_find_node(struct ieee80211_node_table *,
-        const u_int8_t *);
-struct ieee80211_node * ieee80211_find_rxnode(struct ieee80211com *,

net80211/ieee80211_wireless.c

@@ -515 +515 @@
-ieee80211_ioctl_siwap(struct net_device *dev, struct iw_request_info *info,
-        struct sockaddr *ap_addr, char *extra)
-{
-        static const u_int8_t zero_bssid[IEEE80211_ADDR_LEN];
-        static const u_int8_t broadcast_bssid[IEEE80211_ADDR_LEN] = 
-                "\xff\xff\xff\xff\xff\xff";
-        struct ieee80211vap *vap = dev->priv;
-
-        /* NB: should not be set when in AP mode */
@@ -534 +531 @@
-         *
-         * anything else specifies a particular AP.
-         */
-
-
-
-
-
-
-
+
+
+
-                        vap->iv_flags |= IEEE80211_F_DESBSSID;
+                
+                IEEE80211_ADDR_COPY(vap->iv_des_bssid, &ap_addr->sa_data);
-                if (IS_UP_AUTO(vap))
-                        ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
-        }
@@ -557 +552 @@
-        if (vap->iv_flags & IEEE80211_F_DESBSSID)
-                IEEE80211_ADDR_COPY(&ap_addr->sa_data, vap->iv_des_bssid);
-        else {
-                static const u_int8_t zero_bssid[IEEE80211_ADDR_LEN];
-                if (vap->iv_state == IEEE80211_S_RUN)
-                        if (vap->iv_opmode != IEEE80211_M_WDS) 
-                                IEEE80211_ADDR_COPY(&ap_addr->sa_data, vap->iv_bss->ni_bssid);
-                        else
-                                IEEE80211_ADDR_COPY(&ap_addr->sa_data, vap->wds_mac);
-                else
-IEEE80211_ADDR_COPY(&ap_addr->sa_data, zero_bssid
+memset(&ap_addr->sa_data, 0, IEEE80211_ADDR_LEN
-        }
-        ap_addr->sa_family = ARPHRD_ETHER;
-        return 0;

net80211/ieee80211_input.c

@@ -985 +985 @@
-         * not freed by the timer process while we use it.
-         * XXX bogus
-         */
-
+TABLE_
-
-        /*
-         * Update the time stamp.  As a side effect, it
@@ -995 +995 @@
-         */
-        ni->ni_rxfragstamp = jiffies;
-
-
+TABLE_
-
-        /*
-         * Validate that fragment is in order and
@@ -1307 +1307 @@
-                        "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
-                        ieee80211_node_refcnt(ni));
-
- else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
-       (void) ieee80211_ref_node(ni);
+
+
-                /*
-
-
-
+
-                 */
-                ni->ni_flags |= IEEE80211_NODE_AREF;
-
@@ -1399 +1397 @@
-{
-        struct ieee80211vap *vap = ni->ni_vap;
-        u_int8_t *challenge;
-, estatus
+ = 0, estatus = 0
-
-        /*
-         * NB: this can happen as we allow pre-shared key
@@ -1409 +1407 @@
-         * ordering in which case this check would just be
-         * for sanity/consistency.
-         */
-        estatus = 0;                    /* NB: silence compiler */
-        if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
-                IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
-                        ni->ni_macaddr, "shared key auth",
@@ -1500 +1497 @@
-                                ieee80211_node_refcnt(ni));
-
-                                allocbs = 1;
-                        } else {
-                                if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
-                                        (void) ieee80211_ref_node(ni);
-                                allocbs = 0;
-                        }
-
-
-
-
-
-
+
-                        ni->ni_rssi = rssi;
-                        ni->ni_rstamp = rstamp;
-                        ni->ni_last_rx = jiffies;
@@ -2647 +2635 @@
-                }
-                if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
-                        if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
-                                /*
-                                 * Create a new entry in the neighbor table.
-                                 */
-                                ni = ieee80211_add_neighbor(vap, wh, &scan);
-                        } else {
-                                /*
@@ -2822 +2807 @@
-                                        ni = vap->iv_xrvap->iv_bss;
-                                else {
-                                        ieee80211_node_leave(ni);
+                                        /* This would be a stupid place to add a node to the table
+                                         * XR stuff needs work anyway
+                                         */
-                                        ieee80211_node_reset(ni, vap->iv_xrvap);
-                                }
-                                vap = vap->iv_xrvap;
@@ -2834 +2822 @@
-#endif
-                IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
-                        "recv auth frame with algorithm %d seq %d", algo, seq);
-
-
-
+
-                if (vap->iv_acl != NULL &&
-                    !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
-                        IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
@@ -2869 +2855 @@
-                                /* XXX not right */
-                                ieee80211_send_error(ni, wh->i_addr2,
-                                        IEEE80211_FC0_SUBTYPE_AUTH,
-+
+ + 
-                        }
-                        return;
-                } 

net80211/ieee80211_linux.h

@@ -65 +65 @@
-
-#define IEEE80211_RESCHEDULE    schedule
-
+/* Locking */
+/* NB: beware, spin_is_locked() is not usefully defined for UP+!PREEMPT 
+ * because spinlocks do not exist in this configuration. Instead IRQs 
+ * are simply disabled, as this is all that is needed 
+ */
+
-/*
- * Beacon handler locking definitions.
- * Beacon locking 
@@ -87 +93 @@
-#define IEEE80211_LOCK(_ic)     spin_lock(&(_ic)->ic_comlock)
-#define IEEE80211_UNLOCK(_ic)   spin_unlock(&(_ic)->ic_comlock)
-
-
-
+
-#define IEEE80211_LOCK_ASSERT(_ic) \
-        KASSERT(spin_is_locked(&(_ic)->ic_comlock),("ieee80211com not locked!"))
-#else
-#define IEEE80211_LOCK_ASSERT(_ic)
-#endif
-
+
-#define IEEE80211_VAPS_LOCK_INIT(_ic, _name)            \
-        spin_lock_init(&(_ic)->ic_vapslock)
-#define IEEE80211_VAPS_LOCK_DESTROY(_ic)
@@ -110 +116 @@
-} while (0)
-#define IEEE80211_VAPS_UNLOCK_IRQ_EARLY(_ic)    spin_unlock_irqrestore(&(_ic)->ic_vapslock, _vaps_lockflags)
-
-
-
-
+
-#define IEEE80211_VAPS_LOCK_ASSERT(_ic) \
-        KASSERT(spin_is_locked(&(_ic)->ic_vapslock),("ieee80211com_vaps not locked!"))
-#else
@@ -124 +128 @@
- * Node locking definitions.
- */
-typedef spinlock_t ieee80211_node_lock_t;
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-        unsigned long __node_lockflags;         \
+        spin_lock_irqsave(&(_ni)->ni_nodelock, __node_lockflags);
+#define IEEE80211_NODE_UNLOCK_IRQ(_ni)          \
+        spin_unlock_irqrestore(&(_ni)->ni_nodelock, __node_lockflags); \
+} while(0)
+#define IEEE80211_NODE_UNLOCK_IRQ_EARLY(_ni)            \
+        spin_unlock_irqrestore(&(_ni)->ni_nodelock, __node_lockflags);
+
+#if (defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)) && defined(spinlock_is_locked)
+#define IEEE80211_NODE_LOCK_ASSERT(_nt) \
+        KASSERT(spinlock_is_locked(&(_ni)->ni_nodelock), \
+                ("802.11 node not locked!"))
+#else
+#define IEEE80211_NODE_LOCK_ASSERT(_ni)
+#endif
+
+/*
+ * Node table locking definitions.
+ */
+typedef spinlock_t ieee80211_node_table_lock_t;
+#define IEEE80211_NODE_TABLE_LOCK_INIT(_nt, _name)      spin_lock_init(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_TABLE_LOCK_DESTROY(_nt)
+#if 0   /* We should always be contesting in the same contexts */
+#define IEEE80211_NODE_TABLE_LOCK(_nt)  spin_lock(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_TABLE_UNLOCK(_nt)        spin_unlock(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_TABLE_LOCK_BH(_nt)       spin_lock_bh(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_TABLE_UNLOCK_BH(_nt)     spin_unlock_bh(&(_nt)->nt_nodelock)
+#endif
+#define IEEE80211_NODE_TABLE_LOCK_IRQ(_nt)      do {    \
+        unsigned long __node_lockflags;         \
-        spin_lock_irqsave(&(_nt)->nt_nodelock, __node_lockflags);
-
+TABLE_
-        spin_unlock_irqrestore(&(_nt)->nt_nodelock, __node_lockflags); \
-} while(0)
-
+TABLE_
-        spin_unlock_irqrestore(&(_nt)->nt_nodelock, __node_lockflags);
-
-/* NB: beware, *_is_locked() are bogusly defined for UP+!PREEMPT */
-#if (defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)) && defined(spinlock_is_locked)
-
+TABLE_
-        KASSERT(spinlock_is_locked(&(_nt)->nt_nodelock), \
-                ("802.11 node table not locked!"))
-#else
-
+TABLE_
-#endif
-
-/*
@@ -165 +199 @@
-#define IEEE80211_SCAN_UNLOCK_IRQ_EARLY(_nt)            \
-        spin_unlock_irqrestore(&(_nt)->nt_scanlock, __scan_lockflags);
-
-
-
+
-#define IEEE80211_SCAN_LOCK_ASSERT(_nt) \
-        KASSERT(spin_is_locked(&(_nt)->nt_scanlock), ("scangen not locked!"))
-#else
@@ -184 +217 @@
-#define ACL_LOCK_BH(_as)                spin_lock_bh(&(_as)->as_lock)
-#define ACL_UNLOCK_BH(_as)              spin_unlock_bh(&(_as)->as_lock)
-
-
-
+
-#define ACL_LOCK_ASSERT(_as) \
-        KASSERT(spin_is_locked(&(_as)->as_lock), ("ACL not locked!"))
-#else
@@ -295 +327 @@
- *                              is the last reference, otherwise 0
- * ieee80211_node_refcnt        reference count for printing (only)
- */
+typedef atomic_t ieee80211_node_ref_count_t; 
-#define ieee80211_node_initref(_ni)     atomic_set(&(_ni)->ni_refcnt, 1)
-#define ieee80211_node_incref(_ni)      atomic_inc(&(_ni)->ni_refcnt)
-#define ieee80211_node_decref(_ni)      atomic_dec(&(_ni)->ni_refcnt)
@@ -375 +408 @@
-/* msecs_to_jiffies appeared in 2.6.7 and 2.4.29 */
-#include <linux/delay.h>
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) && \
- 
- 
+
+
-
-/* The following definitions and inline functions are
- * copied from the kernel src, include/linux/jiffies.h */

ath/if_ath.c

@@ -2971 +2971 @@
-
-/*
- * Allocate tx/rx key slots for TKIP.  We allocate two slots for
-r
+
- */
-static u_int16_t
-key_alloc_2pair(struct ath_softc *sc)
@@ -4713 +4713 @@
-                an->an_uapsd_overflowqdepth--;
-        }
-
+        // Clean up node-specific rate things - this currently appears to always be a no-op
+        ath_rate_node_cleanup(sc, ATH_NODE(ni));
+
-        ATH_NODE_UAPSD_LOCK_IRQ(an);
-        sc->sc_node_cleanup(ni);
-        ATH_NODE_UAPSD_UNLOCK_IRQ(an);
@@ -4723 +4726 @@
-{
-        struct ath_softc *sc = ni->ni_ic->ic_dev->priv;
-
-        ath_rate_node_cleanup(sc, ATH_NODE(ni));
-        sc->sc_node_free(ni);
-#ifdef ATH_SUPERG_XR
-        ath_grppoll_period_update(sc);