derived from NetBSD:

---
Make the node table into an LRU cache: least-recently used nodes
are at the end of the node queue.  Change the reference-counting
discipline: ni->ni_refcnt indicates how many times net80211 has
granted ni to the driver.  Every node in the table with ni_refcnt=0
is eligible to be garbage-collected.  The mere presence of a node
in the table does not any longer indicate its auth/assoc state;
nodes have a ni_state variable, now.

While I am here, patch ieee80211_find_node_for_beacon to do a "best
match" by bssid/ssid/channel, not a "perfect match."  This keeps
net80211 from caching duplicate nodes in the table.
---

ok deraadt@ dlg@, looks good jsg@

7 files changed, 41 insertions, 74 deletions

diff --git a/sys/dev/ic/ath.c b/sys/dev/ic/ath.c
index d285edd181d..9afb3eb53ef 100644
--- a/sys/dev/ic/ath.c
+++ b/sys/dev/ic/ath.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ath.c,v 1.6 2005/01/03 19:59:18 jsg Exp $  */
+/*      $OpenBSD: ath.c,v 1.7 2005/02/17 18:28:05 reyk Exp $  */
 /*	$NetBSD: ath.c,v 1.37 2004/08/18 21:59:39 dyoung Exp $	*/
 
 /*-
@@ -1177,8 +1177,8 @@ ath_start(struct ifnet *ifp)
 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
 			splx(s);
 			ifp->if_oerrors++;
-			if (ni != NULL && ni != ic->ic_bss)
-			          ieee80211_free_node(ic, ni);
+			if (ni != NULL)
+				ieee80211_release_node(ic, ni);
 			continue;
 		}
 
@@ -2444,10 +2444,7 @@ ath_rx_proc(void *arg, int npending)
 		 * reclamation (e.g. in response to a DEAUTH message)
 		 * so use release_node here instead of unref_node.
 		 */
-		if (ni == ic->ic_bss)
-			ieee80211_unref_node(&ni);
-		else
-			ieee80211_free_node(ic, ni);
+		ieee80211_release_node(ic, ni);
 
   rx_next:
 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
@@ -2895,8 +2892,7 @@ ath_tx_proc(void *arg, int npending)
 			 *     this is a DEAUTH message that was sent and the
 			 *     node was timed out due to inactivity.
 			 */
-			if(ni != NULL && ni != ic->ic_bss)
-  			        ieee80211_free_node(ic, ni);
+			ieee80211_release_node(ic, ni);
 		}
 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
 		    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
@@ -2962,11 +2958,11 @@ ath_draintxq(struct ath_softc *sc)
 		ni = bf->bf_node;
 		bf->bf_node = NULL;
 		s = splnet();
-		if (ni != NULL && ni != ic->ic_bss) {
+		if (ni != NULL) {
 			/*
 			 * Reclaim node reference.
 			 */
-			ieee80211_free_node(ic, ni);
+			ieee80211_release_node(ic, ni);
 		}
 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
 		splx(s);
diff --git a/sys/dev/ic/atw.c b/sys/dev/ic/atw.c
index ddf80afe40f..0a32ad5789d 100644
--- a/sys/dev/ic/atw.c
+++ b/sys/dev/ic/atw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atw.c,v 1.28 2005/01/15 05:24:10 brad Exp $	*/
+/*	$OpenBSD: atw.c,v 1.29 2005/02/17 18:28:05 reyk Exp $	*/
 /*	$NetBSD: atw.c,v 1.69 2004/07/23 07:07:55 dyoung Exp $	*/
 
 /*-
@@ -3255,12 +3255,9 @@ atw_rxintr(struct atw_softc *sc)
 		/*
 		 * The frame may have caused the node to be marked for
 		 * reclamation (e.g. in response to a DEAUTH message)
-		 * so use free_node here instead of unref_node.
+		 * so use release_node here instead of unref_node.
 		 */
-		if (ni == ic->ic_bss)
-			ieee80211_unref_node(&ni);
-		else
-			ieee80211_free_node(ic, ni);
+		ieee80211_release_node(ic, ni);
 	}
 
 	/* Update the receive pointer. */
@@ -3627,8 +3624,8 @@ atw_start(struct ifnet *ifp)
 
 		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);
 
-		if (ni != NULL && ni != ic->ic_bss)
-			ieee80211_free_node(ic, ni);
+		if (ni != NULL)
+			ieee80211_release_node(ic, ni);
 
 		if (m0 == NULL) {
 			ifp->if_oerrors++;
diff --git a/sys/dev/ic/ral.c b/sys/dev/ic/ral.c
index 1071b2d9ba7..d7380b5ae55 100644
--- a/sys/dev/ic/ral.c
+++ b/sys/dev/ic/ral.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ral.c,v 1.5 2005/02/17 17:43:31 damien Exp $  */
+/*	$OpenBSD: ral.c,v 1.6 2005/02/17 18:28:05 reyk Exp $  */
 
 /*-
  * Copyright (c) 2005
@@ -552,8 +552,8 @@ ral_reset_tx_ring(struct ral_softc *sc, struct ral_tx_ring *ring)
 			data->m = NULL;
 		}
 
-		if (data->ni != NULL && data->ni != ic->ic_bss) {
-			ieee80211_free_node(ic, data->ni);
+		if (data->ni != NULL) {
+			ieee80211_release_node(ic, data->ni);
 			data->ni = NULL;
 		}
 
@@ -596,8 +596,8 @@ ral_free_tx_ring(struct ral_softc *sc, struct ral_tx_ring *ring)
 				m_freem(data->m);
 			}
 
-			if (data->ni != NULL && data->ni != ic->ic_bss)
-				ieee80211_free_node(ic, data->ni);
+			if (data->ni != NULL)
+				ieee80211_release_node(ic, data->ni);
 
 			if (data->map != NULL)
 				bus_dmamap_destroy(sc->sc_dmat, data->map);
@@ -1030,10 +1030,7 @@ ral_tx_intr(struct ral_softc *sc)
 		bus_dmamap_unload(sc->sc_dmat, data->map);
 		m_freem(data->m);
 		data->m = NULL;
-		if (data->ni == ic->ic_bss)
-			ieee80211_unref_node(&data->ni);
-		else
-			ieee80211_free_node(ic, data->ni);
+		ieee80211_release_node(ic, data->ni);
 		data->ni = NULL;
 
 		/* descriptor is no longer valid */
@@ -1101,10 +1098,7 @@ ral_prio_intr(struct ral_softc *sc)
 		bus_dmamap_unload(sc->sc_dmat, data->map);
 		m_freem(data->m);
 		data->m = NULL;
-		if (data->ni == ic->ic_bss)
-			ieee80211_unref_node(&data->ni);
-		else
-			ieee80211_free_node(ic, data->ni);
+		ieee80211_release_node(ic, data->ni);
 		data->ni = NULL;
 
 		/* descriptor is no longer valid */
@@ -1757,8 +1751,8 @@ ral_start(struct ifnet *ifp)
 				bpf_mtap(ic->ic_rawbpf, m0);
 #endif
 			if (ral_tx_data(sc, m0, ni) != 0) {
-				if (ni != NULL && ni != ic->ic_bss)
-					ieee80211_free_node(ic, ni);
+				if (ni != NULL)
+					ieee80211_release_node(ic, ni);
 				break;
 			}
 		}
diff --git a/sys/dev/ic/rtw.c b/sys/dev/ic/rtw.c
index 555ad4730db..de567dacc1a 100644
--- a/sys/dev/ic/rtw.c
+++ b/sys/dev/ic/rtw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtw.c,v 1.16 2005/02/14 12:49:29 jsg Exp $	*/
+/*	$OpenBSD: rtw.c,v 1.17 2005/02/17 18:28:05 reyk Exp $	*/
 /* $NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
 /*-
  * Copyright (c) 2004, 2005 David Young.  All rights reserved.
@@ -1234,7 +1234,6 @@ rtw_intr_rx(struct rtw_softc *sc, u_int16_t isr)
 	struct rtw_rxdesc_blk *rdb;
 	struct mbuf *m;
 
-	struct ieee80211com *ic = &sc->sc_ic;
 	struct ieee80211_node *ni;
 	struct ieee80211_frame *wh;
 
@@ -1393,10 +1392,7 @@ rtw_intr_rx(struct rtw_softc *sc, u_int16_t isr)
 #endif /* RTW_DEBUG */
 
 		ieee80211_input(&sc->sc_if, m, ni, rssi, htsftl);
-		if (ni == ic->ic_bss)
-			ieee80211_unref_node(&ni);
-		else
-			ieee80211_free_node(&sc->sc_ic, ni);
+		ieee80211_release_node(&sc->sc_ic, ni);
 next:
 		rtw_rxdesc_init(rdb, rs, next, 0);
 	}
@@ -1426,10 +1422,7 @@ rtw_txsoft_release(bus_dma_tag_t dmat, struct ieee80211com *ic,
 	    BUS_DMASYNC_POSTWRITE);
 	bus_dmamap_unload(dmat, ts->ts_dmamap);
 	m_freem(m);
-	if (ni == ic->ic_bss)
-		ieee80211_unref_node(&ni);
-	else
-		ieee80211_free_node(ic, ni);
+	ieee80211_release_node(ic, ni);
 }
 
 void
@@ -3003,8 +2996,7 @@ post_load_err:
 	bus_dmamap_unload(sc->sc_dmat, dmamap);
 	m_freem(m0);
 post_dequeue_err:
-	if (ni != ic->ic_bss)
-		ieee80211_free_node(&sc->sc_ic, ni);
+	ieee80211_release_node(&sc->sc_ic, ni);
 	return;
 }
 
diff --git a/sys/dev/pci/if_ipw.c b/sys/dev/pci/if_ipw.c
index bc8d3bbb5d4..a15981c12ae 100644
--- a/sys/dev/pci/if_ipw.c
+++ b/sys/dev/pci/if_ipw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ipw.c,v 1.39 2005/01/13 20:52:13 damien Exp $	*/
+/*	$OpenBSD: if_ipw.c,v 1.40 2005/02/17 18:28:05 reyk Exp $	*/
 
 /*-
  * Copyright (c) 2004, 2005
@@ -939,10 +939,7 @@ ipw_data_intr(struct ipw_softc *sc, struct ipw_status *status,
 	/* Send the frame to the upper layer */
 	ieee80211_input(ifp, m, ni, status->rssi, 0);
 
-	if (ni == ic->ic_bss)
-		ieee80211_unref_node(&ni);
-	else
-		ieee80211_free_node(ic, ni);
+	ieee80211_release_node(ic, ni);
 
 	MGETHDR(m, M_DONTWAIT, MT_DATA);
 	if (m == NULL) {
@@ -1060,8 +1057,8 @@ ipw_release_sbd(struct ipw_softc *sc, struct ipw_soft_bd *sbd)
 
 		m_freem(sbuf->m);
 
-		if (sbuf->ni != NULL && sbuf->ni != ic->ic_bss)
-			ieee80211_free_node(ic, sbuf->ni);
+		if (sbuf->ni != NULL)
+			ieee80211_release_node(ic, sbuf->ni);
 
 		/* kill watchdog timer */
 		sc->sc_tx_timer = 0;
@@ -1385,8 +1382,8 @@ ipw_start(struct ifnet *ifp)
 #endif
 
 		if (ipw_tx_start(ifp, m, ni) != 0) {
-			if (ni != NULL && ni != ic->ic_bss)
-				ieee80211_free_node(ic, ni);
+			if (ni != NULL)
+				ieee80211_release_node(ic, ni);
 			break;
 		}
 
diff --git a/sys/dev/pci/if_iwi.c b/sys/dev/pci/if_iwi.c
index 7e133400056..437f8e675f6 100644
--- a/sys/dev/pci/if_iwi.c
+++ b/sys/dev/pci/if_iwi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwi.c,v 1.24 2005/01/09 16:47:50 damien Exp $	*/
+/*	$OpenBSD: if_iwi.c,v 1.25 2005/02/17 18:28:05 reyk Exp $	*/
 
 /*-
  * Copyright (c) 2004, 2005
@@ -795,10 +795,7 @@ iwi_frame_intr(struct iwi_softc *sc, struct iwi_rx_buf *buf, int i,
 	/* Send the frame to the upper layer */
 	ieee80211_input(ifp, m, ni, IWI_RSSIDBM2RAW(frame->rssi_dbm), 0);
 
-	if (ni == ic->ic_bss)
-		ieee80211_unref_node(&ni);
-	else
-		ieee80211_free_node(ic, ni);
+	ieee80211_release_node(ic, ni);
 
 	MGETHDR(buf->m, M_DONTWAIT, MT_DATA);
 	if (buf->m == NULL) {
@@ -971,8 +968,7 @@ iwi_tx_intr(struct iwi_softc *sc)
 		bus_dmamap_unload(sc->sc_dmat, buf->map);
 		m_freem(buf->m);
 		buf->m = NULL;
-		if (buf->ni != ic->ic_bss)
-			ieee80211_free_node(ic, buf->ni);
+		ieee80211_release_node(ic, buf->ni);
 		buf->ni = NULL;
 
 		sc->tx_queued--;
@@ -1221,8 +1217,8 @@ iwi_start(struct ifnet *ifp)
 #endif
 
 		if (iwi_tx_start(ifp, m0, ni) != 0) {
-			if (ni != NULL && ni != ic->ic_bss)
-				ieee80211_free_node(ic, ni);
+			if (ni != NULL)
+				ieee80211_release_node(ic, ni);
 			break;
 		}
 
@@ -2003,8 +1999,7 @@ iwi_stop(struct ifnet *ifp, int disable)
 			buf->m = NULL;
 
 			if (buf->ni != NULL) {
-				if (buf->ni != ic->ic_bss)
-					ieee80211_free_node(ic, buf->ni);
+				ieee80211_release_node(ic, buf->ni);
 				buf->ni = NULL;
 			}
 		}
diff --git a/sys/dev/usb/if_atu.c b/sys/dev/usb/if_atu.c
index a1b3bc97a38..7394b031268 100644
--- a/sys/dev/usb/if_atu.c
+++ b/sys/dev/usb/if_atu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_atu.c,v 1.50 2005/01/26 13:05:49 dlg Exp $ */
+/*	$OpenBSD: if_atu.c,v 1.51 2005/02/17 18:28:05 reyk Exp $ */
 /*
  * Copyright (c) 2003, 2004
  *	Daan Vreeken <Danovitsch@Vitsch.net>.  All rights reserved.
@@ -1635,10 +1635,7 @@ atu_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 
 	ieee80211_input(ifp, m, ni, h->rssi, UGETDW(h->rx_time));
 
-	if (ni == ic->ic_bss)
-		ieee80211_unref_node(&ni);
-	else
-		ieee80211_free_node(ic, ni);
+	ieee80211_release_node(ic, ni);
 done1:
 	splx(s);
 done:
@@ -1867,9 +1864,8 @@ bad:
 			cd->atu_tx_inuse--;
 			splx(s);
 			/* ifp_if_oerrors++; */
-			if (ni != NULL && ni != ic->ic_bss)
-				/* reclaim node */
-				ieee80211_free_node(ic, ni);
+			if (ni != NULL)
+				ieee80211_release_node(ic, ni);
 			continue;
 		}
 		ifp->if_timer = 5;