--- /dev/null
+diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
+--- madwifi.old/ath/if_ath.c 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/ath/if_ath.c 2007-05-21 08:10:46.864754176 +0200
+@@ -158,8 +158,7 @@
+ static int ath_desc_alloc(struct ath_softc *);
+ static void ath_desc_free(struct ath_softc *);
+ static void ath_desc_swap(struct ath_desc *);
+-static struct ieee80211_node *ath_node_alloc(struct ieee80211_node_table *,
+- struct ieee80211vap *);
++static struct ieee80211_node *ath_node_alloc(struct ieee80211vap *);
+ static void ath_node_cleanup(struct ieee80211_node *);
+ static void ath_node_free(struct ieee80211_node *);
+ static u_int8_t ath_node_getrssi(const struct ieee80211_node *);
+@@ -2385,7 +2384,7 @@
+ if (ath_tx_start(sc->sc_dev, ni, bf_ff, bf_ff->bf_skb, 0) == 0)
+ continue;
+ bad:
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ if (bf_ff->bf_skb != NULL) {
+ dev_kfree_skb(bf_ff->bf_skb);
+ bf_ff->bf_skb = NULL;
+@@ -2525,8 +2524,10 @@
+ skb = bf->bf_skb;
+ ATH_FF_MAGIC_PUT(skb);
+
++#if 0
+ /* decrement extra node reference made when an_tx_ffbuf[] was set */
+- //ieee80211_free_node(ni); /* XXX where was it set ? */
++ ieee80211_unref_node(&ni); /* XXX where was it set ? */
++#endif
+
+ DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
+ "%s: aggregating fast-frame\n", __func__);
+@@ -2585,7 +2586,7 @@
+ ff_flushbad:
+ DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
+ "%s: ff stageq flush failure\n", __func__);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ if (bf_ff->bf_skb) {
+ dev_kfree_skb(bf_ff->bf_skb);
+ bf_ff->bf_skb = NULL;
+@@ -2707,7 +2708,7 @@
+ tbf->bf_node = NULL;
+
+ if (ni != NULL)
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+
+ STAILQ_INSERT_TAIL(&sc->sc_txbuf, tbf, bf_list);
+ }
+@@ -2789,7 +2790,7 @@
+ /* fall thru... */
+ bad:
+ if (ni != NULL)
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ if (bf != NULL) {
+ bf->bf_skb = NULL;
+ bf->bf_node = NULL;
+@@ -3178,7 +3179,7 @@
+ */
+ ni = sc->sc_keyixmap[keyix];
+ if (ni != NULL) {
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ sc->sc_keyixmap[keyix] = NULL;
+ }
+ /*
+@@ -3189,7 +3190,7 @@
+ ath_hal_keyreset(ah, keyix + 32); /* RX key */
+ ni = sc->sc_keyixmap[keyix + 32];
+ if (ni != NULL) { /* as above... */
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ sc->sc_keyixmap[keyix + 32] = NULL;
+ }
+ }
+@@ -3202,7 +3203,7 @@
+ ath_hal_keyreset(ah, keyix + rxkeyoff);
+ ni = sc->sc_keyixmap[keyix + rxkeyoff];
+ if (ni != NULL) { /* as above... */
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ sc->sc_keyixmap[keyix + rxkeyoff] = NULL;
+ }
+ }
+@@ -3764,10 +3765,8 @@
+ dev_kfree_skb(bf->bf_skb);
+ bf->bf_skb = NULL;
+ }
+- if (bf->bf_node != NULL) {
+- ieee80211_free_node(bf->bf_node);
+- bf->bf_node = NULL;
+- }
++ if (bf->bf_node != NULL)
++ ieee80211_unref_node(&bf->bf_node);
+
+ /*
+ * NB: the beacon data buffer must be 32-bit aligned;
+@@ -3808,7 +3807,7 @@
+ DPRINTF(sc, ATH_DEBUG_BEACON,
+ "%s: %s beacons, bslot %d intval %u tsfadjust(Kus) %llu\n",
+ __func__, sc->sc_stagbeacons ? "stagger" : "burst",
+- avp->av_bslot, ni->ni_intval, (unsigned long long) tuadjust);
++ avp->av_bslot, ni->ni_intval, (long long) tuadjust);
+
+ wh = (struct ieee80211_frame *) skb->data;
+ memcpy(&wh[1], &tsfadjust, sizeof(tsfadjust));
+@@ -4128,7 +4127,7 @@
+ vap = sc->sc_bslot[(slot + 1) % ATH_BCBUF];
+ DPRINTF(sc, ATH_DEBUG_BEACON_PROC,
+ "%s: slot %d [tsf %llu tsftu %u intval %u] vap %p\n",
+- __func__, slot, (unsigned long long) tsf, tsftu, ic->ic_lintval, vap);
++ __func__, slot, (long long) tsf, tsftu, ic->ic_lintval, vap);
+ bfaddr = 0;
+ if (vap != NULL) {
+ bf = ath_beacon_generate(sc, vap, needmark);
+@@ -4309,10 +4308,8 @@
+ dev_kfree_skb(bf->bf_skb);
+ bf->bf_skb = NULL;
+ }
+- if (bf->bf_node != NULL) {
+- ieee80211_free_node(bf->bf_node);
+- bf->bf_node = NULL;
+- }
++ if (bf->bf_node != NULL)
++ ieee80211_unref_node(&bf->bf_node);
+ STAILQ_INSERT_TAIL(&sc->sc_bbuf, bf, bf_list);
+ }
+
+@@ -4331,10 +4328,8 @@
+ dev_kfree_skb(bf->bf_skb);
+ bf->bf_skb = NULL;
+ }
+- if (bf->bf_node != NULL) {
+- ieee80211_free_node(bf->bf_node);
+- bf->bf_node = NULL;
+- }
++ if (bf->bf_node != NULL)
++ ieee80211_unref_node(&bf->bf_node);
+ }
+ }
+
+@@ -4620,7 +4615,7 @@
+ /*
+ * Reclaim node reference.
+ */
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ }
+ }
+
+@@ -4679,37 +4674,39 @@
+ }
+
+ static struct ieee80211_node *
+-ath_node_alloc(struct ieee80211_node_table *nt,struct ieee80211vap *vap)
++ath_node_alloc(struct ieee80211vap *vap)
+ {
+- struct ath_softc *sc = nt->nt_ic->ic_dev->priv;
++ struct ath_softc *sc = vap->iv_ic->ic_dev->priv;
+ const size_t space = sizeof(struct ath_node) + sc->sc_rc->arc_space;
+ struct ath_node *an;
+
+ an = kmalloc(space, GFP_ATOMIC);
+- if (an == NULL)
+- return NULL;
+- memset(an, 0, space);
+- an->an_decomp_index = INVALID_DECOMP_INDEX;
+- an->an_avgrssi = ATH_RSSI_DUMMY_MARKER;
+- an->an_halstats.ns_avgbrssi = ATH_RSSI_DUMMY_MARKER;
+- an->an_halstats.ns_avgrssi = ATH_RSSI_DUMMY_MARKER;
+- an->an_halstats.ns_avgtxrssi = ATH_RSSI_DUMMY_MARKER;
+- /*
+- * ath_rate_node_init needs a VAP pointer in node
+- * to decide which mgt rate to use
+- */
+- an->an_node.ni_vap = vap;
+- sc->sc_rc->ops->node_init(sc, an);
+-
+- /* U-APSD init */
+- STAILQ_INIT(&an->an_uapsd_q);
+- an->an_uapsd_qdepth = 0;
+- STAILQ_INIT(&an->an_uapsd_overflowq);
+- an->an_uapsd_overflowqdepth = 0;
+- ATH_NODE_UAPSD_LOCK_INIT(an);
++ if (an != NULL) {
++ memset(an, 0, space);
++ an->an_decomp_index = INVALID_DECOMP_INDEX;
++ an->an_avgrssi = ATH_RSSI_DUMMY_MARKER;
++ an->an_halstats.ns_avgbrssi = ATH_RSSI_DUMMY_MARKER;
++ an->an_halstats.ns_avgrssi = ATH_RSSI_DUMMY_MARKER;
++ an->an_halstats.ns_avgtxrssi = ATH_RSSI_DUMMY_MARKER;
++ /*
++ * ath_rate_node_init needs a vap pointer in node
++ * to decide which mgt rate to use
++ */
++ an->an_node.ni_vap = vap;
++ sc->sc_rc->ops->node_init(sc, an);
+
+- DPRINTF(sc, ATH_DEBUG_NODE, "%s: an %p\n", __func__, an);
+- return &an->an_node;
++ /* U-APSD init */
++ STAILQ_INIT(&an->an_uapsd_q);
++ an->an_uapsd_qdepth = 0;
++ STAILQ_INIT(&an->an_uapsd_overflowq);
++ an->an_uapsd_overflowqdepth = 0;
++ ATH_NODE_UAPSD_LOCK_INIT(an);
++
++ DPRINTF(sc, ATH_DEBUG_NODE, "%s: an %p\n", __func__, an);
++ return &an->an_node;
++ } else {
++ return NULL;
++ }
+ }
+
+ static void
+@@ -4719,6 +4716,7 @@
+ struct ath_softc *sc = ni->ni_ic->ic_dev->priv;
+ struct ath_node *an = ATH_NODE(ni);
+ struct ath_buf *bf;
++ struct ieee80211_cb *cb = NULL;
+
+ /*
+ * U-APSD cleanup
+@@ -4733,15 +4731,18 @@
+ while (an->an_uapsd_qdepth) {
+ bf = STAILQ_FIRST(&an->an_uapsd_q);
+ STAILQ_REMOVE_HEAD(&an->an_uapsd_q, bf_list);
+- bf->bf_desc->ds_link = 0;
+
++ cb = (struct ieee80211_cb *) bf->bf_skb->cb;
++ ieee80211_unref_node(&cb->ni);
+ dev_kfree_skb_any(bf->bf_skb);
++
++ bf->bf_desc->ds_link = 0;
+ bf->bf_skb = NULL;
+ bf->bf_node = NULL;
++
+ ATH_TXBUF_LOCK_IRQ(sc);
+ STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+ ATH_TXBUF_UNLOCK_IRQ(sc);
+- ieee80211_free_node(ni);
+
+ an->an_uapsd_qdepth--;
+ }
+@@ -4749,19 +4750,25 @@
+ while (an->an_uapsd_overflowqdepth) {
+ bf = STAILQ_FIRST(&an->an_uapsd_overflowq);
+ STAILQ_REMOVE_HEAD(&an->an_uapsd_overflowq, bf_list);
+- bf->bf_desc->ds_link = 0;
+
++ cb = (struct ieee80211_cb *) bf->bf_skb->cb;
++ ieee80211_unref_node(&cb->ni);
+ dev_kfree_skb_any(bf->bf_skb);
++
+ bf->bf_skb = NULL;
+ bf->bf_node = NULL;
++ bf->bf_desc->ds_link = 0;
++
+ ATH_TXBUF_LOCK_IRQ(sc);
+ STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+ ATH_TXBUF_UNLOCK_IRQ(sc);
+- ieee80211_free_node(ni);
+
+ an->an_uapsd_overflowqdepth--;
+ }
+
++ /* Clean up node-specific rate things - this currently appears to always be a no-op */
++ sc->sc_rc->ops->node_cleanup(sc, ATH_NODE(ni));
++
+ ATH_NODE_UAPSD_LOCK_IRQ(an);
+ sc->sc_node_cleanup(ni);
+ ATH_NODE_UAPSD_UNLOCK_IRQ(an);
+@@ -4772,7 +4779,6 @@
+ {
+ struct ath_softc *sc = ni->ni_ic->ic_dev->priv;
+
+- sc->sc_rc->ops->node_cleanup(sc, ATH_NODE(ni));
+ sc->sc_node_free(ni);
+ #ifdef ATH_SUPERG_XR
+ ath_grppoll_period_update(sc);
+@@ -5660,7 +5666,7 @@
+ an = ATH_NODE(ieee80211_ref_node(ni));
+ ATH_RSSI_LPF(an->an_avgrssi, rs->rs_rssi);
+ type = ieee80211_input(ni, skb, rs->rs_rssi, rs->rs_tstamp);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ } else {
+ /*
+ * No key index or no entry, do a lookup and
+@@ -5682,7 +5688,7 @@
+ if (keyix != IEEE80211_KEYIX_NONE &&
+ sc->sc_keyixmap[keyix] == NULL)
+ sc->sc_keyixmap[keyix] = ieee80211_ref_node(ni);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ } else
+ type = ieee80211_input_all(ic, skb,
+ rs->rs_rssi, rs->rs_tstamp);
+@@ -6478,8 +6484,7 @@
+ STAILQ_REMOVE_HEAD(&an->an_uapsd_q, bf_list);
+ dev_kfree_skb(lastbuf->bf_skb);
+ lastbuf->bf_skb = NULL;
+- ieee80211_free_node(lastbuf->bf_node);
+- lastbuf->bf_node = NULL;
++ ieee80211_unref_node(&lastbuf->bf_node);
+ ATH_TXBUF_LOCK_IRQ(sc);
+ STAILQ_INSERT_TAIL(&sc->sc_txbuf, lastbuf, bf_list);
+ ATH_TXBUF_UNLOCK_IRQ(sc);
+@@ -7229,7 +7234,7 @@
+ * this is a DEAUTH message that was sent and the
+ * node was timed out due to inactivity.
+ */
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ }
+
+ bus_unmap_single(sc->sc_bdev, bf->bf_skbaddr,
+@@ -7474,7 +7479,7 @@
+ }
+ #endif /* ATH_SUPERG_FF */
+ if (bf->bf_node)
+- ieee80211_free_node(bf->bf_node);
++ ieee80211_unref_node(&bf->bf_node);
+
+ bf->bf_skb = NULL;
+ bf->bf_node = NULL;
+diff -ur madwifi.old/net80211/ieee80211_input.c madwifi.dev/net80211/ieee80211_input.c
+--- madwifi.old/net80211/ieee80211_input.c 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_input.c 2007-05-21 08:10:46.865754024 +0200
+@@ -489,7 +489,7 @@
+ nt = &ic->ic_sta;
+ ni_wds = ieee80211_find_wds_node(nt, wh->i_addr3);
+ if (ni_wds) {
+- ieee80211_free_node(ni_wds); /* Decr ref count */
++ ieee80211_unref_node(&ni_wds); /* Decr ref count */
+ IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
+ wh, NULL, "%s",
+ "multicast echo originated from node behind me");
+@@ -543,10 +543,12 @@
+ * the node table for the packet source address (addr4).
+ * If not, add one.
+ */
++ /* XXX: Useless node mgmt API; make better */
+ if (dir == IEEE80211_FC1_DIR_DSTODS) {
+ struct ieee80211_node_table *nt;
+ struct ieee80211_frame_addr4 *wh4;
+ struct ieee80211_node *ni_wds;
++
+ if (!(vap->iv_flags_ext & IEEE80211_FEXT_WDS)) {
+ IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
+ wh, "data", "%s", "4 addr not allowed");
+@@ -569,7 +571,7 @@
+ if (ni_wds == NULL)
+ ieee80211_add_wds_addr(nt, ni, wh4->i_addr4, 0);
+ else
+- ieee80211_free_node(ni_wds); /* Decr ref count */
++ ieee80211_unref_node(&ni_wds); /* Decr. ref count */
+ }
+
+ /*
+@@ -936,7 +938,7 @@
+ }
+ ni = ieee80211_ref_node(vap->iv_bss);
+ type = ieee80211_input(ni, skb1, rssi, rstamp);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ }
+ if (skb != NULL) /* no vaps, reclaim skb */
+ dev_kfree_skb(skb);
+@@ -986,22 +988,14 @@
+ }
+
+ /*
+- * Use this lock to make sure ni->ni_rxfrag is
+- * not freed by the timer process while we use it.
+- * XXX bogus
+- */
+- IEEE80211_NODE_LOCK_IRQ(ni->ni_table);
+-
+- /*
+ * Update the time stamp. As a side effect, it
+ * also makes sure that the timer will not change
+ * ni->ni_rxfrag for at least 1 second, or in
+ * other words, for the remaining of this function.
++ * XXX HUGE HORRIFIC HACK
+ */
+ ni->ni_rxfragstamp = jiffies;
+
+- IEEE80211_NODE_UNLOCK_IRQ(ni->ni_table);
+-
+ /*
+ * Validate that fragment is in order and
+ * related to the previous ones.
+@@ -1130,7 +1124,7 @@
+ skb = NULL;
+ }
+ /* XXX statistic? */
+- ieee80211_free_node(ni1);
++ ieee80211_unref_node(&ni1);
+ }
+ }
+ if (skb1 != NULL) {
+@@ -1265,6 +1259,7 @@
+ int rssi, u_int32_t rstamp, u_int16_t seq, u_int16_t status)
+ {
+ struct ieee80211vap *vap = ni->ni_vap;
++ unsigned int tmpnode = 0;
+
+ if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
+ IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
+@@ -1272,22 +1267,21 @@
+ "bad sta auth mode %u", ni->ni_authmode);
+ vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
+ if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
+- /* XXX hack to workaround calling convention */
+-
+- /* XXX To send the frame to the requesting STA, we have to
+- * create a node for the station that we're going to reject.
+- * The node will be freed automatically */
+ if (ni == vap->iv_bss) {
+- ni = ieee80211_dup_bss(vap, wh->i_addr2);
++ ni = ieee80211_dup_bss(vap, wh->i_addr2, 0);
+ if (ni == NULL)
+ return;
+
+ IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
+ "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr),
+ ieee80211_node_refcnt(ni));
++ tmpnode = 1;
+ }
+ IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH,
+ (seq + 1) | (IEEE80211_STATUS_ALG << 16));
++
++ if (tmpnode)
++ ieee80211_unref_node(&ni);
+ return;
+ }
+ }
+@@ -1315,23 +1309,16 @@
+ }
+ /* always accept open authentication requests */
+ if (ni == vap->iv_bss) {
+- ni = ieee80211_dup_bss(vap, wh->i_addr2);
++ ni = ieee80211_dup_bss(vap, wh->i_addr2, 0);
+ if (ni == NULL)
+ return;
+
+ IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
+ "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr),
+ ieee80211_node_refcnt(ni));
+-
+- } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
+- (void) ieee80211_ref_node(ni);
+- /*
+- * Mark the node as referenced to reflect that it's
+- * reference count has been bumped to ensure it remains
+- * after the transaction completes.
+- */
+- ni->ni_flags |= IEEE80211_NODE_AREF;
+-
++ tmpnode = 1;
++ }
++
+ IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
+ IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
+ ni, "station authenticated (%s)", "open");
+@@ -1341,6 +1328,8 @@
+ */
+ if (ni->ni_authmode != IEEE80211_AUTH_8021X)
+ ieee80211_node_authorize(ni);
++ if (tmpnode)
++ ieee80211_unref_node(&ni);
+ break;
+
+ case IEEE80211_M_STA:
+@@ -1379,7 +1368,7 @@
+ int istmp;
+
+ if (ni == vap->iv_bss) {
+- ni = ieee80211_tmp_node(vap, mac);
++ ni = ieee80211_dup_bss(vap, mac, 1);
+ if (ni == NULL) {
+ /* XXX msg */
+ return;
+@@ -1389,7 +1378,7 @@
+ istmp = 0;
+ IEEE80211_SEND_MGMT(ni, subtype, arg);
+ if (istmp)
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ }
+
+ static int
+@@ -1505,7 +1494,7 @@
+ switch (seq) {
+ case IEEE80211_AUTH_SHARED_REQUEST:
+ if (ni == vap->iv_bss) {
+- ni = ieee80211_dup_bss(vap, wh->i_addr2);
++ ni = ieee80211_dup_bss(vap, wh->i_addr2, 0);
+ if (ni == NULL) {
+ /* NB: no way to return an error */
+ return;
+@@ -1516,17 +1505,8 @@
+ ieee80211_node_refcnt(ni));
+
+ allocbs = 1;
+- } else {
+- if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
+- (void) ieee80211_ref_node(ni);
+- allocbs = 0;
+ }
+- /*
+- * Mark the node as referenced to reflect that it's
+- * reference count has been bumped to ensure it remains
+- * after the transaction completes.
+- */
+- ni->ni_flags |= IEEE80211_NODE_AREF;
++
+ ni->ni_rssi = rssi;
+ ni->ni_rstamp = rstamp;
+ ni->ni_last_rx = jiffies;
+@@ -1620,14 +1600,13 @@
+ }
+ return;
+ bad:
+- /*
+- * Send an error response; but only when operating as an AP.
+- */
++ /* Send an error response; but only when operating as an AP. */
+ if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
+ /* XXX hack to workaround calling convention */
+ ieee80211_send_error(ni, wh->i_addr2,
+ IEEE80211_FC0_SUBTYPE_AUTH,
+ (seq + 1) | (estatus<<16));
++ ieee80211_node_leave(ni);
+ } else if (vap->iv_opmode == IEEE80211_M_STA) {
+ /*
+ * Kick the state machine. This short-circuits
+@@ -2600,7 +2579,7 @@
+ u_int8_t *frm, *efrm;
+ u_int8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath;
+ u_int8_t rate;
+- int reassoc, resp, allocbs;
++ int reassoc, resp, allocbs = 0;
+ u_int8_t qosinfo;
+
+ wh = (struct ieee80211_frame *) skb->data;
+@@ -3008,13 +2987,13 @@
+ ni = ieee80211_fakeup_adhoc_node(vap,
+ wh->i_addr2);
+ } else {
+- ni = ieee80211_tmp_node(vap, wh->i_addr2);
++ ni = ieee80211_dup_bss(vap, wh->i_addr2, 1);
+ }
+ if (ni == NULL)
+ return;
+ allocbs = 1;
+- } else
+- allocbs = 0;
++ }
++
+ IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
+ "%s", "recv probe req");
+ ni->ni_rssi = rssi;
+@@ -3037,7 +3016,7 @@
+ * Temporary node created just to send a
+ * response, reclaim immediately
+ */
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ } else if (ath != NULL)
+ ieee80211_saveath(ni, ath);
+ break;
+@@ -3067,6 +3046,9 @@
+ ni = vap->iv_xrvap->iv_bss;
+ else {
+ ieee80211_node_leave(ni);
++ /* This would be a stupid place to add a node to the table
++ * XR stuff needs work anyway
++ */
+ ieee80211_node_reset(ni, vap->iv_xrvap);
+ }
+ vap = vap->iv_xrvap;
+diff -ur madwifi.old/net80211/ieee80211_linux.c madwifi.dev/net80211/ieee80211_linux.c
+--- madwifi.old/net80211/ieee80211_linux.c 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_linux.c 2007-05-21 08:10:46.866753872 +0200
+@@ -358,7 +358,7 @@
+ struct ieee80211_node *ni;
+ struct ieee80211_node_table *nt = (struct ieee80211_node_table *) &vap->iv_ic->ic_sta;
+
+- //IEEE80211_NODE_LOCK(nt);
++ /* IEEE80211_NODE_LOCK(nt); */
+ TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
+ /* Assume each node needs 500 bytes */
+ if (buf + space < p + 500)
+@@ -376,7 +376,7 @@
+
+ }
+ }
+- //IEEE80211_NODE_UNLOCK(nt);
++ /* IEEE80211_NODE_UNLOCK(nt); */
+ return (p - buf);
+ }
+
+diff -ur madwifi.old/net80211/ieee80211_linux.h madwifi.dev/net80211/ieee80211_linux.h
+--- madwifi.old/net80211/ieee80211_linux.h 2007-05-04 15:45:58.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_linux.h 2007-05-21 08:10:46.867753720 +0200
+@@ -63,6 +63,12 @@
+
+ #define IEEE80211_RESCHEDULE schedule
+
++/* Locking */
++/* NB: beware, spin_is_locked() is not usefully defined for !(DEBUG || SMP)
++ * because spinlocks do not exist in this configuration. Instead IRQs
++ * or pre-emption are simply disabled, as this is all that is needed.
++ */
++
+ /*
+ * Beacon handler locking definitions.
+ * Beacon locking
+@@ -85,14 +91,14 @@
+ #define IEEE80211_LOCK(_ic) spin_lock(&(_ic)->ic_comlock)
+ #define IEEE80211_UNLOCK(_ic) spin_unlock(&(_ic)->ic_comlock)
+
+-/* NB: beware, spin_is_locked() is unusable for !SMP */
+-#if defined(CONFIG_SMP)
++#if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
+ #define IEEE80211_LOCK_ASSERT(_ic) \
+ KASSERT(spin_is_locked(&(_ic)->ic_comlock),("ieee80211com not locked!"))
+ #else
+ #define IEEE80211_LOCK_ASSERT(_ic)
+ #endif
+
++
+ #define IEEE80211_VAPS_LOCK_INIT(_ic, _name) \
+ spin_lock_init(&(_ic)->ic_vapslock)
+ #define IEEE80211_VAPS_LOCK_DESTROY(_ic)
+@@ -108,11 +114,10 @@
+ } while (0)
+ #define IEEE80211_VAPS_UNLOCK_IRQ_EARLY(_ic) spin_unlock_irqrestore(&(_ic)->ic_vapslock, _vaps_lockflags)
+
+-
+-/* NB: beware, spin_is_locked() is unusable for !SMP */
+-#if defined(CONFIG_SMP)
++#if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
+ #define IEEE80211_VAPS_LOCK_ASSERT(_ic) \
+- KASSERT(spin_is_locked(&(_ic)->ic_vapslock),("ieee80211com_vaps not locked!"))
++ KASSERT(spin_is_locked(&(_ic)->ic_vapslock), \
++ ("ieee80211com_vaps not locked!"))
+ #else
+ #define IEEE80211_VAPS_LOCK_ASSERT(_ic)
+ #endif
+@@ -121,29 +126,63 @@
+ /*
+ * Node locking definitions.
+ */
++#if 0
++
+ typedef spinlock_t ieee80211_node_lock_t;
+-#define IEEE80211_NODE_LOCK_INIT(_nt, _name) spin_lock_init(&(_nt)->nt_nodelock)
+-#define IEEE80211_NODE_LOCK_DESTROY(_nt)
+-#define IEEE80211_NODE_LOCK(_nt) spin_lock(&(_nt)->nt_nodelock)
+-#define IEEE80211_NODE_UNLOCK(_nt) spin_unlock(&(_nt)->nt_nodelock)
+-#define IEEE80211_NODE_LOCK_BH(_nt) spin_lock_bh(&(_nt)->nt_nodelock)
+-#define IEEE80211_NODE_UNLOCK_BH(_nt) spin_unlock_bh(&(_nt)->nt_nodelock)
+-#define IEEE80211_NODE_LOCK_IRQ(_nt) do { \
++#define IEEE80211_NODE_LOCK_INIT(_ni, _name) spin_lock_init(&(_ni)->ni_nodelock)
++#define IEEE80211_NODE_LOCK_DESTROY(_ni)
++#if 0 /* We should always be contesting in the same contexts */
++#define IEEE80211_NODE_LOCK(_ni) spin_lock(&(_ni)->ni_nodelock)
++#define IEEE80211_NODE_UNLOCK(_ni) spin_unlock(&(_ni)->ni_nodelock)
++#define IEEE80211_NODE_LOCK_BH(_ni) spin_lock_bh(&(_ni)->ni_nodelock)
++#define IEEE80211_NODE_UNLOCK_BH(_ni) spin_unlock_bh(&(_ni)->ni_nodelock)
++#endif
++#define IEEE80211_NODE_LOCK_IRQ(_ni) do { \
++ unsigned long __node_lockflags; \
++ spin_lock_irqsave(&(_ni)->ni_nodelock, __node_lockflags);
++#define IEEE80211_NODE_UNLOCK_IRQ(_ni) \
++ spin_unlock_irqrestore(&(_ni)->ni_nodelock, __node_lockflags); \
++} while(0)
++#define IEEE80211_NODE_UNLOCK_IRQ_EARLY(_ni) \
++ spin_unlock_irqrestore(&(_ni)->ni_nodelock, __node_lockflags);
++
++#if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
++#define IEEE80211_NODE_LOCK_ASSERT(_nt) \
++ KASSERT(spin_is_locked(&(_ni)->ni_nodelock), \
++ ("802.11 node not locked!"))
++#else
++#define IEEE80211_NODE_LOCK_ASSERT(_ni)
++#endif
++
++#endif /* node lock */
++
++/*
++ * Node table locking definitions.
++ */
++typedef spinlock_t ieee80211_node_table_lock_t;
++#define IEEE80211_NODE_TABLE_LOCK_INIT(_nt, _name) spin_lock_init(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_TABLE_LOCK_DESTROY(_nt)
++#if 0 /* We should always be contesting in the same contexts */
++#define IEEE80211_NODE_TABLE_LOCK(_nt) spin_lock(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_TABLE_UNLOCK(_nt) spin_unlock(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_TABLE_LOCK_BH(_nt) spin_lock_bh(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_TABLE_UNLOCK_BH(_nt) spin_unlock_bh(&(_nt)->nt_nodelock)
++#endif
++#define IEEE80211_NODE_TABLE_LOCK_IRQ(_nt) do { \
+ unsigned long __node_lockflags; \
+ spin_lock_irqsave(&(_nt)->nt_nodelock, __node_lockflags);
+-#define IEEE80211_NODE_UNLOCK_IRQ(_nt) \
++#define IEEE80211_NODE_TABLE_UNLOCK_IRQ(_nt) \
+ spin_unlock_irqrestore(&(_nt)->nt_nodelock, __node_lockflags); \
+ } while(0)
+-#define IEEE80211_NODE_UNLOCK_IRQ_EARLY(_nt) \
++#define IEEE80211_NODE_TABLE_UNLOCK_IRQ_EARLY(_nt) \
+ spin_unlock_irqrestore(&(_nt)->nt_nodelock, __node_lockflags);
+
+-/* NB: beware, *_is_locked() are bogusly defined for UP+!PREEMPT */
+-#if (defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)) && defined(spinlock_is_locked)
+-#define IEEE80211_NODE_LOCK_ASSERT(_nt) \
+- KASSERT(spinlock_is_locked(&(_nt)->nt_nodelock), \
++#if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
++#define IEEE80211_NODE_TABLE_LOCK_ASSERT(_nt) \
++ KASSERT(spin_is_locked(&(_nt)->nt_nodelock), \
+ ("802.11 node table not locked!"))
+ #else
+-#define IEEE80211_NODE_LOCK_ASSERT(_nt)
++#define IEEE80211_NODE_TABLE_LOCK_ASSERT(_nt)
+ #endif
+
+ /*
+@@ -163,8 +202,7 @@
+ #define IEEE80211_SCAN_UNLOCK_IRQ_EARLY(_nt) \
+ spin_unlock_irqrestore(&(_nt)->nt_scanlock, __scan_lockflags);
+
+-/* NB: beware, spin_is_locked() is unusable for !SMP */
+-#if defined(CONFIG_SMP)
++#if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
+ #define IEEE80211_SCAN_LOCK_ASSERT(_nt) \
+ KASSERT(spin_is_locked(&(_nt)->nt_scanlock), ("scangen not locked!"))
+ #else
+@@ -182,8 +220,7 @@
+ #define ACL_LOCK_BH(_as) spin_lock_bh(&(_as)->as_lock)
+ #define ACL_UNLOCK_BH(_as) spin_unlock_bh(&(_as)->as_lock)
+
+-/* NB: beware, spin_is_locked() is unusable for !SMP */
+-#if defined(CONFIG_SMP)
++#if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
+ #define ACL_LOCK_ASSERT(_as) \
+ KASSERT(spin_is_locked(&(_as)->as_lock), ("ACL not locked!"))
+ #else
+@@ -299,6 +336,7 @@
+ * is the last reference, otherwise 0
+ * ieee80211_node_refcnt reference count for printing (only)
+ */
++typedef atomic_t ieee80211_node_ref_count_t;
+ #define ieee80211_node_initref(_ni) atomic_set(&(_ni)->ni_refcnt, 1)
+ #define ieee80211_node_incref(_ni) atomic_inc(&(_ni)->ni_refcnt)
+ #define ieee80211_node_decref(_ni) atomic_dec(&(_ni)->ni_refcnt)
+@@ -379,8 +417,8 @@
+ /* msecs_to_jiffies appeared in 2.6.7 and 2.4.29 */
+ #include <linux/delay.h>
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) && \
+- LINUX_VERSION_CODE < KERNEL_VERSION(2,6,7)) || \
+- LINUX_VERSION_CODE < KERNEL_VERSION(2,4,29)
++ LINUX_VERSION_CODE < KERNEL_VERSION(2,6,7)) || \
++ LINUX_VERSION_CODE < KERNEL_VERSION(2,4,29)
+
+ /* The following definitions and inline functions are
+ * copied from the kernel src, include/linux/jiffies.h */
+diff -ur madwifi.old/net80211/ieee80211_node.c madwifi.dev/net80211/ieee80211_node.c
+--- madwifi.old/net80211/ieee80211_node.c 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_node.c 2007-05-21 08:10:46.868753568 +0200
+@@ -65,16 +65,17 @@
+ #define IEEE80211_AID_ISSET(_vap, _b) \
+ ((_vap)->iv_aid_bitmap[IEEE80211_AID(_b) / 32] & (1 << (IEEE80211_AID(_b) % 32)))
+
++static struct ieee80211_node *ieee80211_alloc_node(struct ieee80211vap *, const u_int8_t *);
++
+ static int ieee80211_sta_join1(struct ieee80211_node *);
+
+-static struct ieee80211_node *node_alloc(struct ieee80211_node_table *,
+- struct ieee80211vap *);
++static struct ieee80211_node *node_alloc(struct ieee80211vap *);
+ static void node_cleanup(struct ieee80211_node *);
+ static void node_free(struct ieee80211_node *);
+ static u_int8_t node_getrssi(const struct ieee80211_node *);
+
+-static void _ieee80211_free_node(struct ieee80211_node *);
+-static void node_reclaim(struct ieee80211_node_table *, struct ieee80211_node*);
++static void _node_table_leave(struct ieee80211_node_table *, struct ieee80211_node *);
++static void _node_table_join(struct ieee80211_node_table *, struct ieee80211_node *);
+
+ static void ieee80211_node_timeout(unsigned long);
+
+@@ -194,8 +195,7 @@
+
+ ieee80211_node_table_reset(&ic->ic_sta, vap);
+ if (vap->iv_bss != NULL) {
+- ieee80211_free_node(vap->iv_bss);
+- vap->iv_bss = NULL;
++ ieee80211_unref_node(&vap->iv_bss);
+ }
+ if (vap->iv_aid_bitmap != NULL) {
+ FREE(vap->iv_aid_bitmap, M_DEVBUF);
+@@ -250,6 +250,7 @@
+ nbss->ni_txpower = obss->ni_txpower;
+ nbss->ni_vlan = obss->ni_vlan;
+ nbss->ni_rsn = obss->ni_rsn;
++ nbss->ni_rates = obss->ni_rates;
+ /* XXX statistics? */
+ }
+
+@@ -263,17 +264,17 @@
+ "%s: creating ibss on channel %u\n", __func__,
+ ieee80211_chan2ieee(ic, chan));
+
+- /* Check to see if we already have a node for this mac */
++ /* Check to see if we already have a node for this mac
++ * NB: we gain a node reference here
++ */
+ ni = ieee80211_find_node(&ic->ic_sta, vap->iv_myaddr);
+ if (ni == NULL) {
+- ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr);
++ ni = ieee80211_alloc_node_table(vap, vap->iv_myaddr);
+ if (ni == NULL) {
+ /* XXX recovery? */
+ return;
+ }
+ }
+- else
+- ieee80211_free_node(ni);
+
+ IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, "%s: %p<%s> refcnt %d\n",
+ __func__, vap->iv_bss, ether_sprintf(vap->iv_bss->ni_macaddr),
+@@ -339,7 +340,7 @@
+ else if (IEEE80211_IS_CHAN_QUARTER(chan))
+ ni->ni_rates = ic->ic_sup_quarter_rates;
+
+- (void) ieee80211_sta_join1(ieee80211_ref_node(ni));
++ (void) ieee80211_sta_join1(PASS_NODE(ni));
+ }
+ EXPORT_SYMBOL(ieee80211_create_ibss);
+
+@@ -363,9 +364,10 @@
+ /* XXX multi-bss wrong */
+ ieee80211_reset_erp(ic, ic->ic_curmode);
+
+- ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->iv_myaddr);
++ ni = ieee80211_alloc_node_table(vap, vap->iv_myaddr);
+ KASSERT(ni != NULL, ("unable to setup inital BSS node"));
+ obss = vap->iv_bss;
++ /* New reference for caller */
+ vap->iv_bss = ieee80211_ref_node(ni);
+
+ IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, "%s: new bss %p<%s> refcnt %d\n",
+@@ -375,7 +377,8 @@
+ if (obss != NULL) {
+ copy_bss(ni, obss);
+ ni->ni_intval = ic->ic_lintval;
+- ieee80211_free_node(obss);
++ /* Caller's reference */
++ ieee80211_unref_node(&obss);
+ }
+ }
+
+@@ -581,7 +584,7 @@
+ vap->iv_state == IEEE80211_S_RUN && ssid_equal(obss, selbs));
+ vap->iv_bss = selbs;
+ if (obss != NULL)
+- ieee80211_free_node(obss);
++ ieee80211_unref_node(&obss);
+ ic->ic_bsschan = selbs->ni_chan;
+ ic->ic_curchan = ic->ic_bsschan;
+ ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan);
+@@ -638,21 +641,20 @@
+
+ ni = ieee80211_find_node(&ic->ic_sta, se->se_macaddr);
+ if (ni == NULL) {
+- ni = ieee80211_alloc_node(&ic->ic_sta, vap, se->se_macaddr);
++ ni = ieee80211_alloc_node_table(vap, se->se_macaddr);
+ if (ni == NULL) {
+ IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
+ "%s: Unable to allocate node for BSS: %s\n", __func__,
+ ether_sprintf(ni->ni_macaddr));
+ return 0;
+ }
+- } else
+- ieee80211_free_node(ni);
++ }
+
+ /*
+ * Expand scan state into node's format.
+ * XXX may not need all this stuff
+ */
+- ni->ni_authmode = vap->iv_bss->ni_authmode; /* inherit authmode from iv_bss */
++ ni->ni_authmode = vap->iv_bss->ni_authmode; /* inherit authmode from iv_bss */
+ /* inherit the WPA setup as well (structure copy!) */
+ ni->ni_rsn = vap->iv_bss->ni_rsn;
+ IEEE80211_ADDR_COPY(ni->ni_bssid, se->se_bssid);
+@@ -686,9 +688,9 @@
+
+ IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
+ "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr),
+- ieee80211_node_refcnt(ni)+1);
++ ieee80211_node_refcnt(ni));
+
+- return ieee80211_sta_join1(ieee80211_ref_node(ni));
++ return ieee80211_sta_join1(PASS_NODE(ni));
+ }
+ EXPORT_SYMBOL(ieee80211_sta_join);
+
+@@ -700,15 +702,13 @@
+ ieee80211_sta_leave(struct ieee80211_node *ni)
+ {
+ struct ieee80211vap *vap = ni->ni_vap;
+- struct ieee80211com *ic = vap->iv_ic;
+
+ /* WDS/Repeater: Stop software beacon timer for STA */
+ if (vap->iv_opmode == IEEE80211_M_STA &&
+ vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) {
+ del_timer(&vap->iv_swbmiss);
+ }
+-
+- ic->ic_node_cleanup(ni);
++
+ ieee80211_notify_node_leave(ni);
+ }
+
+@@ -717,11 +717,11 @@
+ */
+
+ static void
+-ieee80211_node_table_init(struct ieee80211com *ic,
+- struct ieee80211_node_table *nt, const char *name, int inact)
++ieee80211_node_table_init(struct ieee80211com *ic, struct ieee80211_node_table *nt,
++ const char *name, int inact)
+ {
+ nt->nt_ic = ic;
+- IEEE80211_NODE_LOCK_INIT(nt, ic->ic_dev->name);
++ IEEE80211_NODE_TABLE_LOCK_INIT(nt, ic->ic_dev->name);
+ IEEE80211_SCAN_LOCK_INIT(nt, ic->ic_dev->name);
+ TAILQ_INIT(&nt->nt_node);
+ nt->nt_name = name;
+@@ -733,11 +733,31 @@
+ mod_timer(&nt->nt_wds_aging_timer, jiffies + HZ * WDS_AGING_TIMER_VAL);
+ }
+
++static __inline void _node_table_join(struct ieee80211_node_table *nt, struct ieee80211_node *ni) {
++ IEEE80211_NODE_TABLE_LOCK_ASSERT(nt);
++
++ ni->ni_table = nt;
++ TAILQ_INSERT_TAIL(&nt->nt_node, ieee80211_ref_node(ni), ni_list);
++ LIST_INSERT_HEAD(&nt->nt_hash[IEEE80211_NODE_HASH(ni->ni_macaddr)], ni, ni_hash);
++}
++
++static __inline void _node_table_leave(struct ieee80211_node_table *nt, struct ieee80211_node *ni) {
++ struct ieee80211_node *hni;
++ IEEE80211_NODE_TABLE_LOCK_ASSERT(nt);
++
++ TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
++ LIST_FOREACH(hni, &nt->nt_hash[IEEE80211_NODE_HASH(ni->ni_macaddr)], ni_hash) {
++ LIST_REMOVE(ni, ni_hash);
++ }
++ ni->ni_table = NULL;
++ _ieee80211_unref_node(ni);
++}
++
+ /* This is overridden by ath_node_alloc in ath/if_ath.c, and so
+- * should never get called
++ * should never get called.
+ */
+ static struct ieee80211_node *
+-node_alloc(struct ieee80211_node_table *nt, struct ieee80211vap *vap)
++node_alloc(struct ieee80211vap *vap)
+ {
+ struct ieee80211_node *ni;
+
+@@ -776,13 +796,6 @@
+ IEEE80211_UNLOCK_IRQ(ni->ni_ic);
+ }
+ }
+- /*
+- * Clear AREF flag that marks the authorization refcnt bump
+- * has happened. This is probably not needed as the node
+- * should always be removed from the table so not found but
+- * do it just in case.
+- */
+- ni->ni_flags &= ~IEEE80211_NODE_AREF;
+
+ /*
+ * Drain power save queue and, if needed, clear TIM.
+@@ -791,10 +804,7 @@
+ vap->iv_set_tim(ni, 0);
+
+ ni->ni_associd = 0;
+- if (ni->ni_challenge != NULL) {
+- FREE(ni->ni_challenge, M_DEVBUF);
+- ni->ni_challenge = NULL;
+- }
++
+ /*
+ * Preserve SSID, WPA, and WME ie's so the bss node is
+ * reusable during a re-auth/re-assoc state transition.
+@@ -819,9 +829,16 @@
+ static void
+ node_free(struct ieee80211_node *ni)
+ {
++#if 0
++ /* We should 'cleanup' and then free'ing should be done automatically on decref */
+ struct ieee80211com *ic = ni->ni_ic;
+
+ ic->ic_node_cleanup(ni);
++#endif
++ KASSERT(ieee80211_node_refcnt(ni) == 0, ("node being free whilst still referenced"));
++
++ if (ni->ni_challenge != NULL)
++ FREE(ni->ni_challenge, M_DEVBUF);
+ if (ni->ni_wpa_ie != NULL)
+ FREE(ni->ni_wpa_ie, M_DEVBUF);
+ if (ni->ni_rsn_ie != NULL)
+@@ -831,6 +848,7 @@
+ if (ni->ni_ath_ie != NULL)
+ FREE(ni->ni_ath_ie, M_DEVBUF);
+ IEEE80211_NODE_SAVEQ_DESTROY(ni);
++
+ FREE(ni, M_80211_NODE);
+ }
+
+@@ -847,55 +865,70 @@
+ * This interface is not intended for general use, it is
+ * used by the routines below to create entries with a
+ * specific purpose.
++ * Dont assume a BSS?
+ */
+ struct ieee80211_node *
+-ieee80211_alloc_node(struct ieee80211_node_table *nt,
+- struct ieee80211vap *vap, const u_int8_t *macaddr)
++ieee80211_alloc_node_table(struct ieee80211vap *vap,
++ const u_int8_t *macaddr)
+ {
+- struct ieee80211com *ic = nt->nt_ic;
++ struct ieee80211com *ic = vap->iv_ic;
++ struct ieee80211_node_table *nt = &ic->ic_sta;
+ struct ieee80211_node *ni;
+- int hash;
+
+- ni = ic->ic_node_alloc(nt, vap);
+- if (ni == NULL) {
+- /* XXX msg */
+- vap->iv_stats.is_rx_nodealloc++;
+- return NULL;
+- }
++ ni = ieee80211_alloc_node(vap, macaddr);
++ if (ni != NULL) {
++ ni->ni_inact = ni->ni_inact_reload = nt->nt_inact_init;
+
+- IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
+- "%s: %p<%s> in %s table, refcnt %d\n", __func__, ni,
+- ether_sprintf(macaddr), nt->nt_name,
+- ieee80211_node_refcnt(ni)+1);
++ WME_UAPSD_NODE_TRIGSEQINIT(ni);
++ IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
+
+- IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
+- hash = IEEE80211_NODE_HASH(macaddr);
+- ieee80211_node_initref(ni); /* mark referenced */
+- ni->ni_chan = IEEE80211_CHAN_ANYC;
+- ni->ni_authmode = IEEE80211_AUTH_OPEN;
+- ni->ni_txpower = ic->ic_txpowlimit; /* max power */
+- ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE);
+- ni->ni_inact_reload = nt->nt_inact_init;
+- ni->ni_inact = ni->ni_inact_reload;
+- ni->ni_ath_defkeyindex = IEEE80211_INVAL_DEFKEY;
+- ni->ni_rxkeyoff = 0;
+- IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
++ _node_table_join(nt, ni);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
++ }
+
+- IEEE80211_NODE_LOCK_IRQ(nt);
+- ni->ni_vap = vap;
+- ni->ni_ic = ic;
+- ni->ni_table = nt;
+- TAILQ_INSERT_TAIL(&nt->nt_node, ni, ni_list);
+- LIST_INSERT_HEAD(&nt->nt_hash[hash], ni, ni_hash);
+- ni->ni_rxfrag = NULL;
+- ni->ni_challenge = NULL;
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ return ni;
++}
++EXPORT_SYMBOL(ieee80211_alloc_node_table);
++
++/* Allocate a node structure and initialise specialised structures
++ * This function does not add the node to the node table, thus this
++ * node will not be found using ieee80211_find_*node.
++ * This is useful when sending one off errors or request denials.
++ */
++static struct ieee80211_node *
++ieee80211_alloc_node(struct ieee80211vap *vap, const u_int8_t *macaddr)
++{
++ struct ieee80211com *ic = vap->iv_ic;
++ struct ieee80211_node *ni;
++
++ /* This always allocates zeroed memoery */
++ ni = ic->ic_node_alloc(vap);
++ if (ni != NULL) {
++ IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
++ "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(macaddr),
++ ieee80211_node_refcnt(ni)+1);
+
+- WME_UAPSD_NODE_TRIGSEQINIT(ni);
++ ieee80211_node_initref(ni); /* mark referenced */
++
++ IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
++
++ ni->ni_chan = IEEE80211_CHAN_ANYC;
++ ni->ni_authmode = IEEE80211_AUTH_OPEN;
++ ni->ni_txpower = ic->ic_txpowlimit;
++
++ ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey,
++ IEEE80211_KEYIX_NONE);
++ ni->ni_ath_defkeyindex = IEEE80211_INVAL_DEFKEY;
+
++ ni->ni_vap = vap;
++ ni->ni_ic = ic;
++ } else {
++ /* XXX msg */
++ vap->iv_stats.is_rx_nodealloc++;
++ }
+ return ni;
+ }
+-EXPORT_SYMBOL(ieee80211_alloc_node);
+
+ /* Add wds address to the node table */
+ int
+@@ -917,11 +950,11 @@
+ wds->wds_agingcount = WDS_AGING_COUNT;
+ hash = IEEE80211_NODE_HASH(macaddr);
+ IEEE80211_ADDR_COPY(wds->wds_macaddr, macaddr);
+- ieee80211_ref_node(ni); /* Reference node */
+- wds->wds_ni = ni;
+- IEEE80211_NODE_LOCK_IRQ(nt);
++
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
++ wds->wds_ni = ieee80211_ref_node(ni);
+ LIST_INSERT_HEAD(&nt->nt_wds_hash[hash], wds, wds_hash);
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+ return 0;
+ }
+ EXPORT_SYMBOL(ieee80211_add_wds_addr);
+@@ -934,22 +967,19 @@
+ struct ieee80211_wds_addr *wds, *twds;
+
+ hash = IEEE80211_NODE_HASH(macaddr);
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, twds) {
+ if (IEEE80211_ADDR_EQ(wds->wds_macaddr, macaddr)) {
+- if (ieee80211_node_dectestref(wds->wds_ni)) {
+- _ieee80211_free_node(wds->wds_ni);
+- LIST_REMOVE(wds, wds_hash);
+- FREE(wds, M_80211_WDS);
+- break;
+- }
++ LIST_REMOVE(wds, wds_hash);
++ ieee80211_unref_node(&wds->wds_ni);
++ FREE(wds, M_80211_WDS);
++ break;
+ }
+ }
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+ }
+ EXPORT_SYMBOL(ieee80211_remove_wds_addr);
+
+-
+ /* Remove node references from wds table */
+ void
+ ieee80211_del_wds_node(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
+@@ -957,19 +987,17 @@
+ int hash;
+ struct ieee80211_wds_addr *wds, *twds;
+
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
+ LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, twds) {
+ if (wds->wds_ni == ni) {
+- if (ieee80211_node_dectestref(ni)) {
+- _ieee80211_free_node(ni);
+- LIST_REMOVE(wds, wds_hash);
+- FREE(wds, M_80211_WDS);
+- }
++ LIST_REMOVE(wds, wds_hash);
++ ieee80211_unref_node(&wds->wds_ni);
++ FREE(wds, M_80211_WDS);
+ }
+ }
+ }
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+ }
+ EXPORT_SYMBOL(ieee80211_del_wds_node);
+
+@@ -980,88 +1008,46 @@
+ int hash;
+ struct ieee80211_wds_addr *wds, *twds;
+
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
+ LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, twds) {
+ if (wds->wds_agingcount != WDS_AGING_STATIC) {
+ if (!wds->wds_agingcount) {
+- if (ieee80211_node_dectestref(wds->wds_ni)) {
+- _ieee80211_free_node(wds->wds_ni);
+- LIST_REMOVE(wds, wds_hash);
+- FREE(wds, M_80211_WDS);
+- }
++ LIST_REMOVE(wds, wds_hash);
++ ieee80211_unref_node(&wds->wds_ni);
++ FREE(wds, M_80211_WDS);
+ } else
+ wds->wds_agingcount--;
+ }
+ }
+ }
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+ mod_timer(&nt->nt_wds_aging_timer, jiffies + HZ * WDS_AGING_TIMER_VAL);
+ }
+
+
+ /*
+- * Craft a temporary node suitable for sending a management frame
+- * to the specified station. We craft only as much state as we
+- * need to do the work since the node will be immediately reclaimed
+- * once the send completes.
+- */
+-struct ieee80211_node *
+-ieee80211_tmp_node(struct ieee80211vap *vap, const u_int8_t *macaddr)
+-{
+- struct ieee80211com *ic = vap->iv_ic;
+- struct ieee80211_node *ni;
+-
+- ni = ic->ic_node_alloc(&ic->ic_sta,vap);
+- if (ni != NULL) {
+- IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
+- "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(macaddr),
+- ieee80211_node_refcnt(ni)+1);
+-
+- IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
+- IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_bss->ni_bssid);
+- ieee80211_node_initref(ni); /* mark referenced */
+- ni->ni_txpower = vap->iv_bss->ni_txpower;
+- ni->ni_vap = vap;
+- /* NB: required by ieee80211_fix_rate */
+- ieee80211_node_set_chan(ic, ni);
+- ieee80211_crypto_resetkey(vap, &ni->ni_ucastkey,
+- IEEE80211_KEYIX_NONE);
+- /* XXX optimize away */
+- IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
+-
+- ni->ni_table = NULL; /* NB: pedantic */
+- ni->ni_ic = ic;
+- ni->ni_rxfrag = NULL;
+- ni->ni_challenge = NULL;
+- } else {
+- /* XXX msg */
+- vap->iv_stats.is_rx_nodealloc++;
+- }
+- return ni;
+-}
+-
+-/*
+ * Add the specified station to the station table.
+ */
+ struct ieee80211_node *
+-ieee80211_dup_bss(struct ieee80211vap *vap, const u_int8_t *macaddr)
++ieee80211_dup_bss(struct ieee80211vap *vap, const u_int8_t *macaddr,
++ unsigned char tmp)
+ {
+- struct ieee80211com *ic = vap->iv_ic;
+ struct ieee80211_node *ni;
++
++ /* FIXME: Hack */
++ if (tmp)
++ ni = ieee80211_alloc_node(vap, macaddr);
++ else
++ ni = ieee80211_alloc_node_table(vap, macaddr);
+
+- ni = ieee80211_alloc_node(&ic->ic_sta, vap, macaddr);
+ if (ni != NULL) {
+- /*
+- * Inherit from iv_bss.
+- */
+- ni->ni_authmode = vap->iv_bss->ni_authmode;
+- ni->ni_txpower = vap->iv_bss->ni_txpower;
+- ni->ni_vlan = vap->iv_bss->ni_vlan; /* XXX?? */
++ copy_bss(ni, vap->iv_bss);
+ IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_bss->ni_bssid);
+- ieee80211_node_set_chan(ic, ni);
+- ni->ni_rsn = vap->iv_bss->ni_rsn;
+- ni->ni_rxfrag = NULL;
++ /* Do this only for nodes that already have a BSS. Otherwise
++ * ic_bsschan is not set and we get a KASSERT failure.
++ * Required by ieee80211_fix_rate */
++ ieee80211_node_set_chan(vap->iv_ic, ni);
+ }
+ return ni;
+ }
+@@ -1069,19 +1055,16 @@
+ static struct ieee80211_node *
+ _ieee80211_find_wds_node(struct ieee80211_node_table *nt, const u_int8_t *macaddr)
+ {
+- struct ieee80211_node *ni;
+ struct ieee80211_wds_addr *wds;
+ int hash;
+- IEEE80211_NODE_LOCK_ASSERT(nt);
++ IEEE80211_NODE_TABLE_LOCK_ASSERT(nt);
+
+ hash = IEEE80211_NODE_HASH(macaddr);
+ LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
+ if (IEEE80211_ADDR_EQ(wds->wds_macaddr, macaddr)) {
+- ni = wds->wds_ni;
+ if (wds->wds_agingcount != WDS_AGING_STATIC)
+ wds->wds_agingcount = WDS_AGING_COUNT; /* reset the aging count */
+- ieee80211_ref_node(ni);
+- return ni;
++ return ieee80211_ref_node(wds->wds_ni);
+ }
+ }
+ return NULL;
+@@ -1099,7 +1082,7 @@
+ int hash;
+ struct ieee80211_wds_addr *wds;
+
+- IEEE80211_NODE_LOCK_ASSERT(nt);
++ IEEE80211_NODE_TABLE_LOCK_ASSERT(nt);
+
+ hash = IEEE80211_NODE_HASH(macaddr);
+ LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
+@@ -1120,9 +1103,7 @@
+ nodes. */
+ LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
+ if (IEEE80211_ADDR_EQ(wds->wds_macaddr, macaddr)) {
+- ni = wds->wds_ni;
+- ieee80211_ref_node(ni);
+- return ni;
++ return ieee80211_ref_node(wds->wds_ni);
+ }
+ }
+ return NULL;
+@@ -1137,9 +1118,9 @@
+ {
+ struct ieee80211_node *ni;
+
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ ni = _ieee80211_find_wds_node(nt, macaddr);
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+ return ni;
+ }
+ EXPORT_SYMBOL(ieee80211_find_wds_node);
+@@ -1154,9 +1135,9 @@
+ {
+ struct ieee80211_node *ni;
+
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ ni = _ieee80211_find_node(nt, macaddr);
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+ return ni;
+ }
+ #ifdef IEEE80211_DEBUG_REFCNT
+@@ -1179,7 +1160,7 @@
+ {
+ struct ieee80211_node *ni;
+
+- ni = ieee80211_dup_bss(vap, macaddr);
++ ni = ieee80211_dup_bss(vap, macaddr, 0);
+ if (ni != NULL) {
+ /* XXX no rate negotiation; just dup */
+ ni->ni_rates = vap->iv_bss->ni_rates;
+@@ -1202,14 +1183,13 @@
+ * driver has an opportunity to setup it's private state.
+ */
+ struct ieee80211_node *
+-ieee80211_add_neighbor(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
++ieee80211_add_neighbor(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
+ const struct ieee80211_scanparams *sp)
+ {
+ struct ieee80211com *ic = vap->iv_ic;
+ struct ieee80211_node *ni;
+
+- ni = ieee80211_dup_bss(vap, wh->i_addr2); /* XXX alloc_node? */
+- /* TODO: not really putting itself in a table */
++ ni = ieee80211_dup_bss(vap, wh->i_addr2, 1);
+ if (ni != NULL) {
+ ni->ni_esslen = sp->ssid[1];
+ memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
+@@ -1284,12 +1264,12 @@
+ /* XXX check ic_bss first in station mode */
+ /* XXX 4-address frames? */
+ nt = &ic->ic_sta;
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
+ ni = _ieee80211_find_node(nt, wh->i_addr1);
+ else
+ ni = _ieee80211_find_node(nt, wh->i_addr2);
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+
+ return ni;
+ #undef IS_PSPOLL
+@@ -1326,9 +1306,9 @@
+
+ /* XXX can't hold lock across dup_bss due to recursive locking */
+ nt = &vap->iv_ic->ic_sta;
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ ni = _ieee80211_find_node(nt, mac);
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+
+ if (ni == NULL) {
+ if (vap->iv_opmode == IEEE80211_M_IBSS ||
+@@ -1355,11 +1335,9 @@
+ EXPORT_SYMBOL(ieee80211_find_txnode);
+ #endif
+
+-/* Caller must lock the IEEE80211_NODE_LOCK
+- *
+- * Context: hwIRQ, softIRQ and process context
++/* Context: hwIRQ, softIRQ and process context
+ */
+-static void
++void
+ _ieee80211_free_node(struct ieee80211_node *ni)
+ {
+ struct ieee80211vap *vap = ni->ni_vap;
+@@ -1373,117 +1351,36 @@
+
+ if (vap->iv_aid_bitmap != NULL)
+ IEEE80211_AID_CLR(vap, ni->ni_associd);
+- if (nt != NULL) {
+- TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
+- LIST_REMOVE(ni, ni_hash);
+- }
++
+ vap->iv_ic->ic_node_free(ni);
+ }
++EXPORT_SYMBOL(_ieee80211_free_node);
+
+-void
+-#ifdef IEEE80211_DEBUG_REFCNT
+-ieee80211_free_node_debug(struct ieee80211_node *ni, const char *func, int line)
+-#else
+-ieee80211_free_node(struct ieee80211_node *ni)
+-#endif
++static void _reset_node(void *arg, struct ieee80211_node *ni)
+ {
+- struct ieee80211_node_table *nt = ni->ni_table;
+- struct ieee80211com *ic = ni->ni_ic;
++ if (ni->ni_associd != 0) {
++ struct ieee80211vap *vap = ni->ni_vap;
+
+-#ifdef IEEE80211_DEBUG_REFCNT
+- IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
+- "%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni,
+- ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni) - 1);
+-#endif
+- /*
+- * XXX: may need to lock out the following race. we dectestref
+- * and determine it's time to free the node. between the if()
+- * and lock, we take an rx intr to receive a frame from this
+- * node. the rx path (tasklet or intr) bumps this node's
+- * refcnt and xmits a response frame. eventually that response
+- * will get reaped, and the reaping code will attempt to use
+- * the node. the code below will delete the node prior
+- * to the reap and we could get a crash.
+- *
+- * as a stopgap before delving deeper, lock intrs to
+- * prevent this case.
+- */
+- IEEE80211_LOCK_IRQ(ic);
+- if (ieee80211_node_dectestref(ni)) {
+- /*
+- * Beware; if the node is marked gone then it's already
+- * been removed from the table and we cannot assume the
+- * table still exists. Regardless, there's no need to lock
+- * the table.
+- */
+- if (ni->ni_table != NULL) {
+- IEEE80211_NODE_LOCK(nt);
+- _ieee80211_free_node(ni);
+- IEEE80211_NODE_UNLOCK(nt);
+- } else
+- _ieee80211_free_node(ni);
++ if (vap->iv_auth->ia_node_leave != NULL)
++ vap->iv_auth->ia_node_leave(ni);
++ if (vap->iv_aid_bitmap != NULL)
++ IEEE80211_AID_CLR(vap, ni->ni_associd);
+ }
+- IEEE80211_UNLOCK_IRQ(ic);
+-}
+-#ifdef IEEE80211_DEBUG_REFCNT
+-EXPORT_SYMBOL(ieee80211_free_node_debug);
+-#else
+-EXPORT_SYMBOL(ieee80211_free_node);
+-#endif
+-
+-/*
+- * Reclaim a node. If this is the last reference count then
+- * do the normal free work. Otherwise remove it from the node
+- * table and mark it gone by clearing the back-reference.
+- */
+-static void
+-node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
+-{
+
+- IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
+- "%s: remove %p<%s> from %s table, refcnt %d\n",
+- __func__, ni, ether_sprintf(ni->ni_macaddr),
+- nt->nt_name, ieee80211_node_refcnt(ni)-1);
+- if (!ieee80211_node_dectestref(ni)) {
+- /*
+- * Other references are present, just remove the
+- * node from the table so it cannot be found. When
+- * the references are dropped storage will be
+- * reclaimed. This normally only happens for ic_bss.
+- */
+- TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
+- LIST_REMOVE(ni, ni_hash);
+- ni->ni_table = NULL; /* clear reference */
+- } else
+- _ieee80211_free_node(ni);
++ ieee80211_node_leave(ni);
+ }
+
+ static void
+ ieee80211_node_table_reset(struct ieee80211_node_table *nt,
+- struct ieee80211vap *match)
++ struct ieee80211vap *vap)
+ {
+- struct ieee80211_node *ni, *next;
+-
+- IEEE80211_NODE_LOCK_IRQ(nt);
+- TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next) {
+- if (match != NULL && ni->ni_vap != match)
+- continue;
+- if (ni->ni_associd != 0) {
+- struct ieee80211vap *vap = ni->ni_vap;
+-
+- if (vap->iv_auth->ia_node_leave != NULL)
+- vap->iv_auth->ia_node_leave(ni);
+- if (vap->iv_aid_bitmap != NULL)
+- IEEE80211_AID_CLR(vap, ni->ni_associd);
+- }
+- node_reclaim(nt, ni);
+- }
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ ieee80211_iterate_dev_nodes(vap->iv_dev, nt, _reset_node, NULL);
+ }
+
+ static void
+ ieee80211_node_table_cleanup(struct ieee80211_node_table *nt)
+ {
++ struct ieee80211com *ic = nt->nt_ic;
+ struct ieee80211_node *ni, *next;
+
+ TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, next) {
+@@ -1495,11 +1392,11 @@
+ if (vap->iv_aid_bitmap != NULL)
+ IEEE80211_AID_CLR(vap, ni->ni_associd);
+ }
+- node_reclaim(nt, ni);
++ ic->ic_node_cleanup(ni);
+ }
+ del_timer(&nt->nt_wds_aging_timer);
+ IEEE80211_SCAN_LOCK_DESTROY(nt);
+- IEEE80211_NODE_LOCK_DESTROY(nt);
++ IEEE80211_NODE_TABLE_LOCK_DESTROY(nt);
+ }
+
+ /*
+@@ -1527,19 +1424,22 @@
+ IEEE80211_SCAN_LOCK_IRQ(nt);
+ gen = ++nt->nt_scangen;
+ restart:
+- IEEE80211_NODE_LOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
+ if (ni->ni_scangen == gen) /* previously handled */
+ continue;
++ /* Temporary entries should no longer be in the node table */
+ /*
+ * Ignore entries for which have yet to receive an
+ * authentication frame. These are transient and
+ * will be reclaimed when the last reference to them
+ * goes away (when frame xmits complete).
+ */
+- if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
+- (ni->ni_flags & IEEE80211_NODE_AREF) == 0)
+- continue;
++ /*
++ *if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
++ * (ni->ni_flags & IEEE80211_NODE_AREF) == 0)
++ * continue;
++ */
+ ni->ni_scangen = gen;
+ /*
+ * Free fragment if not needed anymore
+@@ -1591,7 +1491,7 @@
+ * ref for us as needed.
+ */
+ ieee80211_ref_node(ni);
+- IEEE80211_NODE_UNLOCK_IRQ_EARLY(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ_EARLY(nt);
+ ieee80211_send_nulldata(ni);
+ /* XXX stat? */
+ goto restart;
+@@ -1614,18 +1514,18 @@
+ */
+ ni->ni_vap->iv_stats.is_node_timeout++;
+ ieee80211_ref_node(ni);
+- IEEE80211_NODE_UNLOCK_IRQ_EARLY(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ_EARLY(nt);
+ if (ni->ni_associd != 0) {
+ IEEE80211_SEND_MGMT(ni,
+ IEEE80211_FC0_SUBTYPE_DEAUTH,
+ IEEE80211_REASON_AUTH_EXPIRE);
+ }
+ ieee80211_node_leave(ni);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ goto restart;
+ }
+ }
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+
+ IEEE80211_SCAN_UNLOCK_IRQ(nt);
+ }
+@@ -1660,21 +1560,23 @@
+
+ IEEE80211_SCAN_LOCK_IRQ(nt);
+ gen = ++nt->nt_scangen;
++
+ restart:
+- IEEE80211_NODE_LOCK(nt);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+ TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
+ if (dev != NULL && ni->ni_vap->iv_dev != dev)
+ continue; /* skip node not for this vap */
+ if (ni->ni_scangen != gen) {
+ ni->ni_scangen = gen;
+ (void) ieee80211_ref_node(ni);
+- IEEE80211_NODE_UNLOCK(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ_EARLY(nt);
+ (*f)(arg, ni);
+- ieee80211_free_node(ni);
++
++ ieee80211_unref_node(&ni);
+ goto restart;
+ }
+ }
+- IEEE80211_NODE_UNLOCK(nt);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+
+ IEEE80211_SCAN_UNLOCK_IRQ(nt);
+ }
+@@ -1948,9 +1850,20 @@
+ "station with aid %d leaves (refcnt %u)",
+ IEEE80211_NODE_AID(ni), ieee80211_node_refcnt(ni));
+
++ /* From this point onwards we can no longer find the node,
++ * so no more references are generated
++ */
++ ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
++ ieee80211_del_wds_node(nt, ni);
++ IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
++ _node_table_leave(nt, ni);
++ IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
++
+ /*
+ * If node wasn't previously associated all
+ * we need to do is reclaim the reference.
++ * This also goes for nodes that are auth'ed but
++ * not associated.
+ */
+ /* XXX ibss mode bypasses 11g and notification */
+ if (ni->ni_associd == 0)
+@@ -1968,9 +1881,11 @@
+ IEEE80211_LOCK_IRQ(ic);
+ if (vap->iv_aid_bitmap != NULL)
+ IEEE80211_AID_CLR(vap, ni->ni_associd);
++
+ ni->ni_associd = 0;
+ vap->iv_sta_assoc--;
+ ic->ic_sta_assoc--;
++
+ #ifdef ATH_SUPERG_XR
+ if (ni->ni_vap->iv_flags & IEEE80211_F_XR)
+ ic->ic_xr_sta_assoc--;
+@@ -1981,6 +1896,7 @@
+ if (IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan))
+ ieee80211_node_leave_11g(ni);
+ IEEE80211_UNLOCK_IRQ(ic);
++
+ /*
+ * Cleanup station state. In particular clear various
+ * state that might otherwise be reused if the node
+@@ -1990,19 +1906,10 @@
+ ieee80211_sta_leave(ni);
+ done:
+ /*
+- * Remove the node from any table it's recorded in and
+- * drop the caller's reference. Removal from the table
+- * is important to ensure the node is not reprocessed
+- * for inactivity.
+- */
+- if (nt != NULL) {
+- IEEE80211_NODE_LOCK_IRQ(nt);
+- node_reclaim(nt, ni);
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
+- ieee80211_remove_wds_addr(nt,ni->ni_macaddr);
+- ieee80211_del_wds_node(nt,ni);
+- } else
+- ieee80211_free_node(ni);
++ * Run a cleanup and then drop the caller's reference
++ */
++ ic->ic_node_cleanup(ni);
++ ieee80211_unref_node(&ni);
+ }
+ EXPORT_SYMBOL(ieee80211_node_leave);
+
+@@ -2062,25 +1969,8 @@
+ void
+ ieee80211_node_reset(struct ieee80211_node *ni, struct ieee80211vap *vap)
+ {
+- if (ni != NULL) {
+- struct ieee80211_node_table *nt = ni->ni_table;
+- if (!nt)
+- nt = &vap->iv_ic->ic_sta;
+- IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_bss->ni_bssid);
+- ni->ni_prev_vap = ni->ni_vap;
+- ni->ni_vap = vap;
+- ni->ni_ic = vap->iv_ic;
+- /*
+- * if node not found in the node table
+- * add it to the node table .
+- */
+- if(nt && ieee80211_find_node(nt, ni->ni_macaddr) != ni) {
+- int hash = IEEE80211_NODE_HASH(ni->ni_macaddr);
+- IEEE80211_NODE_LOCK_IRQ(nt);
+- TAILQ_INSERT_TAIL(&nt->nt_node, ni, ni_list);
+- LIST_INSERT_HEAD(&nt->nt_hash[hash], ni, ni_hash);
+- ni->ni_table = nt;
+- IEEE80211_NODE_UNLOCK_IRQ(nt);
+- }
+- }
++ IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_bss->ni_bssid);
++ ni->ni_prev_vap = ni->ni_vap;
++ ni->ni_vap = vap;
++ ni->ni_ic = vap->iv_ic;
+ }
+diff -ur madwifi.old/net80211/ieee80211_node.h madwifi.dev/net80211/ieee80211_node.h
+--- madwifi.old/net80211/ieee80211_node.h 2007-03-06 11:59:28.000000000 +0100
++++ madwifi.dev/net80211/ieee80211_node.h 2007-05-21 08:10:46.869753416 +0200
+@@ -52,14 +52,14 @@
+ * authorized. The latter timeout is shorter to more aggressively
+ * reclaim nodes that leave part way through the 802.1x exchange.
+ */
+-#define IEEE80211_INACT_WAIT 15 /* inactivity interval (secs) */
++#define IEEE80211_INACT_WAIT 15 /* inactivity interval (secs) */
+ #define IEEE80211_INACT_INIT (30/IEEE80211_INACT_WAIT) /* initial */
+ #define IEEE80211_INACT_AUTH (180/IEEE80211_INACT_WAIT) /* associated but not authorized */
+ #define IEEE80211_INACT_RUN (300/IEEE80211_INACT_WAIT) /* authorized */
+ #define IEEE80211_INACT_PROBE (30/IEEE80211_INACT_WAIT) /* probe */
+ #define IEEE80211_INACT_SCAN (300/IEEE80211_INACT_WAIT) /* scanned */
+
+-#define IEEE80211_TRANS_WAIT 5 /* mgt frame tx timer (secs) */
++#define IEEE80211_TRANS_WAIT 5 /* mgt frame tx timer (secs) */
+
+ #define IEEE80211_NODE_HASHSIZE 32
+ /* simple hash is enough for variation of macaddr */
+@@ -94,7 +94,8 @@
+ struct ieee80211_node_table *ni_table;
+ TAILQ_ENTRY(ieee80211_node) ni_list;
+ LIST_ENTRY(ieee80211_node) ni_hash;
+- atomic_t ni_refcnt;
++ // ieee80211_node_lock_t ni_nodelock; /* on node - notably for ref counting */
++ ieee80211_node_ref_count_t ni_refcnt;
+ u_int ni_scangen; /* gen# for timeout scan */
+ u_int8_t ni_authmode; /* authentication algorithm */
+ u_int16_t ni_flags; /* special-purpose state */
+@@ -121,13 +122,13 @@
+ u_int16_t ni_associd; /* assoc response */
+ u_int16_t ni_txpower; /* current transmit power (in 0.5 dBm) */
+ u_int16_t ni_vlan; /* vlan tag */
+- u_int32_t *ni_challenge; /* shared-key challenge */
++ u_int32_t *ni_challenge; /* shared-key challenge */
+ u_int8_t *ni_wpa_ie; /* captured WPA ie */
+ u_int8_t *ni_rsn_ie; /* captured RSN ie */
+ u_int8_t *ni_wme_ie; /* captured WME ie */
+ u_int8_t *ni_ath_ie; /* captured Atheros ie */
+- u_int16_t ni_txseqs[17]; /* tx seq per-tid */
+- u_int16_t ni_rxseqs[17]; /* rx seq previous per-tid*/
++ u_int16_t ni_txseqs[17]; /* tx seq per-tid */
++ u_int16_t ni_rxseqs[17]; /* rx seq previous per-tid*/
+ u_int32_t ni_rxfragstamp; /* time stamp of last rx frag */
+ struct sk_buff *ni_rxfrag; /* rx frag reassembly */
+ struct ieee80211_rsnparms ni_rsn; /* RSN/WPA parameters */
+@@ -156,7 +157,7 @@
+ struct ieee80211_channel *ni_chan;
+ u_int16_t ni_fhdwell; /* FH only */
+ u_int8_t ni_fhindex; /* FH only */
+- u_int8_t ni_erp; /* ERP from beacon/probe resp */
++ u_int8_t ni_erp; /* ERP from beacon/probe resp */
+ u_int16_t ni_timoff; /* byte offset to TIM ie */
+
+ /* others */
+@@ -168,7 +169,7 @@
+ struct ieee80211vap *ni_prev_vap; /* previously associated vap */
+ u_int8_t ni_uapsd; /* U-APSD per-node flags matching WMM STA Qos Info field */
+ u_int8_t ni_uapsd_maxsp; /* maxsp from flags above */
+- u_int16_t ni_uapsd_trigseq[WME_NUM_AC]; /* trigger suppression on retry */
++ u_int16_t ni_uapsd_trigseq[WME_NUM_AC]; /* trigger suppression on retry */
+ __le16 ni_pschangeseq;
+ };
+ MALLOC_DECLARE(M_80211_NODE);
+@@ -186,20 +187,6 @@
+ #define WME_UAPSD_NODE_INVALIDSEQ 0xffff
+ #define WME_UAPSD_NODE_TRIGSEQINIT(_ni) (memset(&(_ni)->ni_uapsd_trigseq[0], 0xff, sizeof((_ni)->ni_uapsd_trigseq)))
+
+-static __inline struct ieee80211_node *
+-ieee80211_ref_node(struct ieee80211_node *ni)
+-{
+- ieee80211_node_incref(ni);
+- return ni;
+-}
+-
+-static __inline void
+-ieee80211_unref_node(struct ieee80211_node **ni)
+-{
+- ieee80211_node_decref(*ni);
+- *ni = NULL; /* guard against use */
+-}
+-
+ void ieee80211_node_attach(struct ieee80211com *);
+ void ieee80211_node_detach(struct ieee80211com *);
+ void ieee80211_node_vattach(struct ieee80211vap *);
+@@ -242,43 +229,39 @@
+ * is a second table for associated stations or neighbors.
+ */
+ struct ieee80211_node_table {
++ const char *nt_name; /* for debugging */
+ struct ieee80211com *nt_ic; /* back reference */
+- ieee80211_node_lock_t nt_nodelock; /* on node table */
++ ieee80211_node_table_lock_t nt_nodelock; /* on node table */
+ TAILQ_HEAD(, ieee80211_node) nt_node; /* information of all nodes */
+ ATH_LIST_HEAD(, ieee80211_node) nt_hash[IEEE80211_NODE_HASHSIZE];
+ ATH_LIST_HEAD(, ieee80211_wds_addr) nt_wds_hash[IEEE80211_NODE_HASHSIZE];
+- const char *nt_name; /* for debugging */
+ ieee80211_scan_lock_t nt_scanlock; /* on nt_scangen */
+ u_int nt_scangen; /* gen# for timeout scan */
+ int nt_inact_init; /* initial node inact setting */
+ struct timer_list nt_wds_aging_timer; /* timer to age out wds entries */
+ };
+
+-struct ieee80211_node *ieee80211_alloc_node(struct ieee80211_node_table *,
+- struct ieee80211vap *, const u_int8_t *);
+-struct ieee80211_node *ieee80211_tmp_node(struct ieee80211vap *,
+- const u_int8_t *);
+-struct ieee80211_node *ieee80211_dup_bss(struct ieee80211vap *,
++struct ieee80211_node *ieee80211_alloc_node_table(struct ieee80211vap *,
+ const u_int8_t *);
++struct ieee80211_node *ieee80211_dup_bss(struct ieee80211vap *,
++ const u_int8_t *, unsigned char);
+ void ieee80211_node_reset(struct ieee80211_node *, struct ieee80211vap *);
+ #ifdef IEEE80211_DEBUG_REFCNT
+-void ieee80211_free_node_debug(struct ieee80211_node *, const char *, int);
+ struct ieee80211_node *ieee80211_find_node_debug(struct ieee80211_node_table *,
+ const u_int8_t *, const char *, int);
+ struct ieee80211_node *ieee80211_find_rxnode_debug(struct ieee80211com *,
+ const struct ieee80211_frame_min *, const char *, int);
+ struct ieee80211_node *ieee80211_find_txnode_debug(struct ieee80211vap *,
+ const u_int8_t *, const char *, int);
+-#define ieee80211_free_node(ni) \
+- ieee80211_free_node_debug(ni, __func__, __LINE__)
+-#define ieee80211_find_node(nt, mac) \
+- ieee80211_find_node_debug(nt, mac, __func__, __LINE__)
+-#define ieee80211_find_rxnode(nt, wh) \
+- ieee80211_find_rxnode_debug(nt, wh, __func__, __LINE__)
+-#define ieee80211_find_txnode(nt, mac) \
+- ieee80211_find_txnode_debug(nt, mac, __func__, __LINE__)
++#define ieee80211_unref_node(_ni) \
++ ieee80211_unref_node_debug(_ni, __func__, __LINE__)
++#define ieee80211_find_node(_nt, _mac) \
++ ieee80211_find_node_debug(_nt, _mac, __func__, __LINE__)
++#define ieee80211_find_rxnode(_nt, _wh) \
++ ieee80211_find_rxnode_debug(_nt, _wh, __func__, __LINE__)
++#define ieee80211_find_txnode(_nt, _mac) \
++ ieee80211_find_txnode_debug(_nt, _mac, __func__, __LINE__)
+ #else
+-void ieee80211_free_node(struct ieee80211_node *);
+
+ struct ieee80211_node *ieee80211_find_node(struct ieee80211_node_table *,
+ const u_int8_t *);
+@@ -287,6 +270,53 @@
+ struct ieee80211_node *ieee80211_find_txnode(struct ieee80211vap *,
+ const u_int8_t *);
+ #endif
++
++void _ieee80211_free_node(struct ieee80211_node *);
++
++static __inline struct ieee80211_node *
++ieee80211_ref_node(struct ieee80211_node *ni)
++{
++ ieee80211_node_incref(ni);
++ return ni;
++}
++
++static __inline struct ieee80211_node *
++_ieee80211_pass_node(struct ieee80211_node **pni) {
++ struct ieee80211_node *tmp = *pni;
++ *pni = NULL;
++ return (tmp);
++}
++
++#define PASS_NODE(_ni) \
++ _ieee80211_pass_node(&_ni)
++
++static __inline int
++_ieee80211_unref_node(struct ieee80211_node *ni) {
++ if (ieee80211_node_dectestref(ni)) {
++ _ieee80211_free_node(ni);
++ return 1;
++ } else {
++ return 0;
++ }
++}
++
++static __inline void
++#ifdef IEEE80211_DEBUG_REFCNT
++ieee80211_unref_node_debug(struct ieee80211_node **pni, const char *func, int line)
++#else
++ieee80211_unref_node(struct ieee80211_node **pni)
++#endif
++{
++ struct ieee80211_node *ni = *pni;
++#ifdef IEEE80211_DEBUG_REFCNT
++ IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
++ "%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni,
++ ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni) - 1);
++#endif
++ _ieee80211_unref_node(ni);
++ *pni = NULL; /* guard against use */
++}
++
+ int ieee80211_add_wds_addr(struct ieee80211_node_table *, struct ieee80211_node *,
+ const u_int8_t *, u_int8_t);
+ void ieee80211_remove_wds_addr(struct ieee80211_node_table *, const u_int8_t *);
+diff -ur madwifi.old/net80211/ieee80211_output.c madwifi.dev/net80211/ieee80211_output.c
+--- madwifi.old/net80211/ieee80211_output.c 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_output.c 2007-05-21 08:10:46.870753264 +0200
+@@ -254,7 +254,7 @@
+ goto bad;
+ }
+
+- cb->ni = ni;
++ cb->ni = ieee80211_ref_node(ni);
+
+ /* power-save checks */
+ if (WME_UAPSD_AC_CAN_TRIGGER(skb->priority, ni)) {
+@@ -293,13 +293,14 @@
+ }
+ #endif
+ ieee80211_parent_queue_xmit(skb);
++ ieee80211_unref_node(&ni);
+ return 0;
+
+ bad:
+ if (skb != NULL)
+ dev_kfree_skb(skb);
+ if (ni != NULL)
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ return 0;
+ }
+
+@@ -453,7 +454,7 @@
+ if (skb == NULL) {
+ /* XXX debug msg */
+ vap->iv_stats.is_tx_nobuf++;
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ return -ENOMEM;
+ }
+ cb = (struct ieee80211_cb *)skb->cb;
+@@ -507,16 +508,14 @@
+ u_int8_t *frm;
+ int tid;
+
+- ieee80211_ref_node(ni);
+ skb = ieee80211_getmgtframe(&frm, 2);
+ if (skb == NULL) {
+ /* XXX debug msg */
+ vap->iv_stats.is_tx_nobuf++;
+- ieee80211_free_node(ni);
+ return -ENOMEM;
+ }
+ cb = (struct ieee80211_cb *)skb->cb;
+- cb->ni = ni;
++ cb->ni = ieee80211_ref_node(ni);
+
+ skb->priority = ac;
+ qwh = (struct ieee80211_qosframe *)skb_push(skb, sizeof(struct ieee80211_qosframe));
+@@ -865,7 +864,7 @@
+ nt = &ic->ic_sta;
+ ni_wds = ieee80211_find_wds_node(nt, eh.ether_shost);
+ if (ni_wds)
+- ieee80211_free_node(ni_wds); /* Decr ref count */
++ ieee80211_unref_node(&ni_wds); /* Decr ref count */
+ else
+ ieee80211_add_wds_addr(nt, ni, eh.ether_shost, 0);
+ }
+@@ -1719,7 +1718,6 @@
+ __func__, __LINE__,
+ ni, ether_sprintf(ni->ni_macaddr),
+ ieee80211_node_refcnt(ni) + 1);
+- ieee80211_ref_node(ni);
+
+ /*
+ * prreq frame format
+@@ -1735,7 +1733,6 @@
+ vap->app_ie[IEEE80211_APPIE_FRAME_PROBE_REQ].length);
+ if (skb == NULL) {
+ vap->iv_stats.is_tx_nobuf++;
+- ieee80211_free_node(ni);
+ return -ENOMEM;
+ }
+
+@@ -1758,7 +1755,7 @@
+ skb_trim(skb, frm - skb->data);
+
+ cb = (struct ieee80211_cb *)skb->cb;
+- cb->ni = ni;
++ cb->ni = ieee80211_ref_node(ni);
+
+ wh = (struct ieee80211_frame *)
+ skb_push(skb, sizeof(struct ieee80211_frame));
+@@ -2234,7 +2231,7 @@
+ mod_timer(&vap->iv_mgtsend, jiffies + timer * HZ);
+ return 0;
+ bad:
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ return ret;
+ #undef senderr
+ }
+diff -ur madwifi.old/net80211/ieee80211_power.c madwifi.dev/net80211/ieee80211_power.c
+--- madwifi.old/net80211/ieee80211_power.c 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_power.c 2007-05-21 08:10:46.870753264 +0200
+@@ -109,13 +109,15 @@
+ int
+ ieee80211_node_saveq_drain(struct ieee80211_node *ni)
+ {
++ struct ieee80211_cb *cb = NULL;
+ struct sk_buff *skb;
+ int qlen;
+
+ IEEE80211_NODE_SAVEQ_LOCK(ni);
+ qlen = skb_queue_len(&ni->ni_savedq);
+ while ((skb = __skb_dequeue(&ni->ni_savedq)) != NULL) {
+- ieee80211_free_node(ni);
++ cb = (struct ieee80211_cb *) skb->cb;
++ ieee80211_unref_node(&cb->ni);
+ dev_kfree_skb_any(skb);
+ }
+ IEEE80211_NODE_SAVEQ_UNLOCK(ni);
+diff -ur madwifi.old/net80211/ieee80211_proto.c madwifi.dev/net80211/ieee80211_proto.c
+--- madwifi.old/net80211/ieee80211_proto.c 2006-12-08 18:20:08.000000000 +0100
++++ madwifi.dev/net80211/ieee80211_proto.c 2007-05-21 08:10:46.871753112 +0200
+@@ -1456,7 +1456,7 @@
+ */
+ if (vap->iv_opmode == IEEE80211_M_WDS) {
+ struct ieee80211_node *wds_ni;
+- wds_ni = ieee80211_alloc_node(&ic->ic_sta, vap, vap->wds_mac);
++ wds_ni = ieee80211_alloc_node_table(vap, vap->wds_mac);
+ if (wds_ni != NULL) {
+ if (ieee80211_add_wds_addr(&ic->ic_sta, wds_ni, vap->wds_mac, 1) == 0) {
+ ieee80211_node_authorize(wds_ni);
+diff -ur madwifi.old/net80211/ieee80211_var.h madwifi.dev/net80211/ieee80211_var.h
+--- madwifi.old/net80211/ieee80211_var.h 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_var.h 2007-05-21 08:12:01.499407984 +0200
+@@ -44,6 +44,8 @@
+
+ #include <sys/queue.h>
+
++struct ieee80211vap;
++
+ #include <net80211/_ieee80211.h>
+ #include <net80211/ieee80211.h>
+ #include <net80211/ieee80211_crypto.h>
+@@ -115,7 +117,6 @@
+ * the underlying device and the net80211 layer is exposed here;
+ * e.g. device-specific callbacks.
+ */
+-struct ieee80211vap;
+
+ struct ieee80211com {
+ struct net_device *ic_dev; /* associated device */
+@@ -236,8 +237,7 @@
+ /* new station association callback/notification */
+ void (*ic_newassoc)(struct ieee80211_node *, int);
+ /* node state management */
+- struct ieee80211_node *(*ic_node_alloc)(struct ieee80211_node_table *,
+- struct ieee80211vap *);
++ struct ieee80211_node *(*ic_node_alloc)(struct ieee80211vap *);
+ void (*ic_node_free)(struct ieee80211_node *);
+ void (*ic_node_cleanup)(struct ieee80211_node *);
+ u_int8_t (*ic_node_getrssi)(const struct ieee80211_node *);
+diff -ur madwifi.old/net80211/ieee80211_wireless.c madwifi.dev/net80211/ieee80211_wireless.c
+--- madwifi.old/net80211/ieee80211_wireless.c 2007-05-18 13:19:16.000000000 +0200
++++ madwifi.dev/net80211/ieee80211_wireless.c 2007-05-21 08:10:46.874752656 +0200
+@@ -3186,7 +3186,7 @@
+ error = -ENXIO;
+ ieee80211_key_update_end(vap);
+ if (ni != NULL)
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ #ifdef ATH_SUPERG_XR
+ /* set the same params on the xr vap device if exists */
+ if (vap->iv_xrvap && !(vap->iv_flags & IEEE80211_F_XR))
+@@ -3246,7 +3246,7 @@
+ memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
+ }
+ if (ni != NULL)
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ return (copy_to_user(iwr->u.data.pointer, &ik, sizeof(ik)) ? -EFAULT : 0);
+ }
+
+@@ -3271,7 +3271,7 @@
+ return -ENOENT; /* No such entity is a more appropriate error */
+ /* XXX error return */
+ ieee80211_crypto_delkey(vap, &ni->ni_ucastkey, ni);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ } else {
+ if (kix >= IEEE80211_WEP_NKID)
+ return -EINVAL;
+@@ -3382,7 +3382,7 @@
+ return -EINVAL;
+ if (dev == ni->ni_vap->iv_dev)
+ domlme(mlme, ni);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ } else
+ ieee80211_iterate_dev_nodes(dev, &ic->ic_sta, domlme, mlme);
+ break;
+@@ -3401,7 +3401,7 @@
+ ieee80211_node_authorize(ni);
+ else
+ ieee80211_node_unauthorize(ni);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ break;
+ case IEEE80211_MLME_CLEAR_STATS:
+ if (vap->iv_opmode != IEEE80211_M_HOSTAP)
+@@ -3412,7 +3412,7 @@
+
+ /* clear statistics */
+ memset(&ni->ni_stats, 0, sizeof(struct ieee80211_nodestats));
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ break;
+ default:
+ return -EINVAL;
+@@ -3785,7 +3785,7 @@
+ ielen = sizeof(wpaie.rsn_ie);
+ memcpy(wpaie.rsn_ie, ni->ni_rsn_ie, ielen);
+ }
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ return (copy_to_user(iwr->u.data.pointer, &wpaie, sizeof(wpaie)) ?
+ -EFAULT : 0);
+ }
+@@ -3813,7 +3813,7 @@
+ /* NB: copy out only the statistics */
+ error = copy_to_user(iwr->u.data.pointer + off, &ni->ni_stats,
+ iwr->u.data.length - off);
+- ieee80211_free_node(ni);
++ ieee80211_unref_node(&ni);
+ return (error ? -EFAULT : 0);
+ }
+
projects / openwrt.git / commitdiff