sys/net80211/ieee80211_mesh.c

   1 /*-
   2  * Copyright (c) 2009 The FreeBSD Foundation
   3  * All rights reserved.
   4  *
   5  * This software was developed by Rui Paulo under sponsorship from the
   6  * FreeBSD Foundation.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  */
  29 #include <sys/cdefs.h>
  30 #ifdef __FreeBSD__
  31 __FBSDID("$FreeBSD$");
  32 #endif
  33
  34 /*
  35  * IEEE 802.11s Mesh Point (MBSS) support.
  36  *
  37  * Based on March 2009, D3.0 802.11s draft spec.
  38  */
  39 #include "opt_inet.h"
  40 #include "opt_wlan.h"
  41
  42 #include <sys/param.h>
  43 #include <sys/systm.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/malloc.h>
  46 #include <sys/kernel.h>
  47
  48 #include <sys/socket.h>
  49 #include <sys/sockio.h>
  50 #include <sys/endian.h>
  51 #include <sys/errno.h>
  52 #include <sys/proc.h>
  53 #include <sys/sysctl.h>
  54
  55 #include <net/if.h>
  56 #include <net/if_media.h>
  57 #include <net/if_llc.h>
  58 #include <net/ethernet.h>
  59
  60 #include <net80211/ieee80211_var.h>
  61 #include <net80211/ieee80211_action.h>
  62 #include <net80211/ieee80211_input.h>
  63 #include <net80211/ieee80211_mesh.h>
  64
  65 static void     mesh_rt_flush_invalid(struct ieee80211vap *);
  66 static int      mesh_select_proto_path(struct ieee80211vap *, const char *);
  67 static int      mesh_select_proto_metric(struct ieee80211vap *, const char *);
  68 static void     mesh_vattach(struct ieee80211vap *);
  69 static int      mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  70 static void     mesh_rt_cleanup_cb(void *);
  71 static void     mesh_linkchange(struct ieee80211_node *,
  72                     enum ieee80211_mesh_mlstate);
  73 static void     mesh_checkid(void *, struct ieee80211_node *);
  74 static uint32_t mesh_generateid(struct ieee80211vap *);
  75 static int      mesh_checkpseq(struct ieee80211vap *,
  76                     const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
  77 static struct ieee80211_node *
  78                 mesh_find_txnode(struct ieee80211vap *,
  79                     const uint8_t [IEEE80211_ADDR_LEN]);
  80 static void     mesh_forward(struct ieee80211vap *, struct mbuf *,
  81                     const struct ieee80211_meshcntl *);
  82 static int      mesh_input(struct ieee80211_node *, struct mbuf *, int, int);
  83 static void     mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
  84                     int, int);
  85 static void     mesh_peer_timeout_setup(struct ieee80211_node *);
  86 static void     mesh_peer_timeout_backoff(struct ieee80211_node *);
  87 static void     mesh_peer_timeout_cb(void *);
  88 static __inline void
  89                 mesh_peer_timeout_stop(struct ieee80211_node *);
  90 static int      mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
  91 static int      mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
  92 static int      mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
  93                     const uint8_t *);
  94 uint32_t        mesh_airtime_calc(struct ieee80211_node *);
  95
  96 /*
  97  * Timeout values come from the specification and are in milliseconds.
  98  */
  99 SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
 100     "IEEE 802.11s parameters");
 101 static int ieee80211_mesh_retrytimeout = -1;
 102 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT | CTLFLAG_RW,
 103     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
 104     "Retry timeout (msec)");
 105 static int ieee80211_mesh_holdingtimeout = -1;
 106 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT | CTLFLAG_RW,
 107     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
 108     "Holding state timeout (msec)");
 109 static int ieee80211_mesh_confirmtimeout = -1;
 110 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT | CTLFLAG_RW,
 111     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
 112     "Confirm state timeout (msec)");
 113 static int ieee80211_mesh_maxretries = 2;
 114 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLTYPE_INT | CTLFLAG_RW,
 115     &ieee80211_mesh_maxretries, 0,
 116     "Maximum retries during peer link establishment");
 117
 118 static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
 119         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 120
 121 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
 122 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
 123 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
 124 static  ieee80211_recv_action_func mesh_recv_action_meshlmetric_req;
 125 static  ieee80211_recv_action_func mesh_recv_action_meshlmetric_rep;
 126
 127 static  ieee80211_send_action_func mesh_send_action_meshpeering_open;
 128 static  ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
 129 static  ieee80211_send_action_func mesh_send_action_meshpeering_close;
 130 static  ieee80211_send_action_func mesh_send_action_meshlink_request;
 131 static  ieee80211_send_action_func mesh_send_action_meshlink_reply;
 132
 133 static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
 134         .mpm_descr      = "AIRTIME",
 135         .mpm_ie         = IEEE80211_MESHCONF_METRIC_AIRTIME,
 136         .mpm_metric     = mesh_airtime_calc,
 137 };
 138
 139 static struct ieee80211_mesh_proto_path         mesh_proto_paths[4];
 140 static struct ieee80211_mesh_proto_metric       mesh_proto_metrics[4];
 141
 142 #define MESH_RT_LOCK(ms)        mtx_lock(&(ms)->ms_rt_lock)
 143 #define MESH_RT_LOCK_ASSERT(ms) mtx_assert(&(ms)->ms_rt_lock, MA_OWNED)
 144 #define MESH_RT_UNLOCK(ms)      mtx_unlock(&(ms)->ms_rt_lock)
 145
 146 MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh", "802.11s routing table");
 147
 148 /*
 149  * Helper functions to manipulate the Mesh routing table.
 150  */
 151
 152 static struct ieee80211_mesh_route *
 153 mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
 154     const uint8_t dest[IEEE80211_ADDR_LEN])
 155 {
 156         struct ieee80211_mesh_route *rt;
 157
 158         MESH_RT_LOCK_ASSERT(ms);
 159
 160         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
 161                 if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
 162                         return rt;
 163         }
 164         return NULL;
 165 }
 166
 167 static struct ieee80211_mesh_route *
 168 mesh_rt_add_locked(struct ieee80211_mesh_state *ms,
 169     const uint8_t dest[IEEE80211_ADDR_LEN])
 170 {
 171         struct ieee80211_mesh_route *rt;
 172
 173         KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
 174             ("%s: adding broadcast to the routing table", __func__));
 175
 176         MESH_RT_LOCK_ASSERT(ms);
 177
 178         rt = malloc(ALIGN(sizeof(struct ieee80211_mesh_route)) +
 179             ms->ms_ppath->mpp_privlen, M_80211_MESH_RT, M_NOWAIT | M_ZERO);
 180         if (rt != NULL) {
 181                 IEEE80211_ADDR_COPY(rt->rt_dest, dest);
 182                 rt->rt_priv = (void *)ALIGN(&rt[1]);
 183                 rt->rt_crtime = ticks;
 184                 TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
 185         }
 186         return rt;
 187 }
 188
 189 struct ieee80211_mesh_route *
 190 ieee80211_mesh_rt_find(struct ieee80211vap *vap,
 191     const uint8_t dest[IEEE80211_ADDR_LEN])
 192 {
 193         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 194         struct ieee80211_mesh_route *rt;
 195
 196         MESH_RT_LOCK(ms);
 197         rt = mesh_rt_find_locked(ms, dest);
 198         MESH_RT_UNLOCK(ms);
 199         return rt;
 200 }
 201
 202 struct ieee80211_mesh_route *
 203 ieee80211_mesh_rt_add(struct ieee80211vap *vap,
 204     const uint8_t dest[IEEE80211_ADDR_LEN])
 205 {
 206         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 207         struct ieee80211_mesh_route *rt;
 208
 209         KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
 210             ("%s: duplicate entry in the routing table", __func__));
 211         KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
 212             ("%s: adding self to the routing table", __func__));
 213
 214         MESH_RT_LOCK(ms);
 215         rt = mesh_rt_add_locked(ms, dest);
 216         MESH_RT_UNLOCK(ms);
 217         return rt;
 218 }
 219
 220 /*
 221  * Add a proxy route (as needed) for the specified destination.
 222  */
 223 void
 224 ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
 225     const uint8_t dest[IEEE80211_ADDR_LEN])
 226 {
 227         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 228         struct ieee80211_mesh_route *rt;
 229
 230         MESH_RT_LOCK(ms);
 231         rt = mesh_rt_find_locked(ms, dest);
 232         if (rt == NULL) {
 233                 rt = mesh_rt_add_locked(ms, dest);
 234                 if (rt == NULL) {
 235                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 236                             "%s", "unable to add proxy entry");
 237                         vap->iv_stats.is_mesh_rtaddfailed++;
 238                 } else {
 239                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 240                             "%s", "add proxy entry");
 241                         IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
 242                         rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
 243                                      |  IEEE80211_MESHRT_FLAGS_PROXY;
 244                 }
 245         /* XXX assert PROXY? */
 246         } else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
 247                 struct ieee80211com *ic = vap->iv_ic;
 248                 /*
 249                  * Fix existing entry created by received frames from
 250                  * stations that have some memory of dest.  We also
 251                  * flush any frames held on the staging queue; delivering
 252                  * them is too much trouble right now.
 253                  */
 254                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 255                     "%s", "fix proxy entry");
 256                 IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
 257                 rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
 258                              |  IEEE80211_MESHRT_FLAGS_PROXY;
 259                 /* XXX belongs in hwmp */
 260                 ieee80211_ageq_drain_node(&ic->ic_stageq,
 261                    (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
 262                 /* XXX stat? */
 263         }
 264         MESH_RT_UNLOCK(ms);
 265 }
 266
 267 static __inline void
 268 mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
 269 {
 270         TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
 271         free(rt, M_80211_MESH_RT);
 272 }
 273
 274 void
 275 ieee80211_mesh_rt_del(struct ieee80211vap *vap,
 276     const uint8_t dest[IEEE80211_ADDR_LEN])
 277 {
 278         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 279         struct ieee80211_mesh_route *rt, *next;
 280
 281         MESH_RT_LOCK(ms);
 282         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
 283                 if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
 284                         mesh_rt_del(ms, rt);
 285                         MESH_RT_UNLOCK(ms);
 286                         return;
 287                 }
 288         }
 289         MESH_RT_UNLOCK(ms);
 290 }
 291
 292 void
 293 ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
 294 {
 295         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 296         struct ieee80211_mesh_route *rt, *next;
 297
 298         if (ms == NULL)
 299                 return;
 300         MESH_RT_LOCK(ms);
 301         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next)
 302                 mesh_rt_del(ms, rt);
 303         MESH_RT_UNLOCK(ms);
 304 }
 305
 306 void
 307 ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
 308     const uint8_t peer[IEEE80211_ADDR_LEN])
 309 {
 310         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 311         struct ieee80211_mesh_route *rt, *next;
 312
 313         MESH_RT_LOCK(ms);
 314         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
 315                 if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
 316                         mesh_rt_del(ms, rt);
 317         }
 318         MESH_RT_UNLOCK(ms);
 319 }
 320
 321 /*
 322  * Flush expired routing entries, i.e. those in invalid state for
 323  * some time.
 324  */
 325 static void
 326 mesh_rt_flush_invalid(struct ieee80211vap *vap)
 327 {
 328         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 329         struct ieee80211_mesh_route *rt, *next;
 330
 331         if (ms == NULL)
 332                 return;
 333         MESH_RT_LOCK(ms);
 334         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
 335                 if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 &&
 336                     ticks - rt->rt_crtime >= ms->ms_ppath->mpp_inact)
 337                         mesh_rt_del(ms, rt);
 338         }
 339         MESH_RT_UNLOCK(ms);
 340 }
 341
 342 #define N(a)    (sizeof(a) / sizeof(a[0]))
 343 int
 344 ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
 345 {
 346         int i, firstempty = -1;
 347
 348         for (i = 0; i < N(mesh_proto_paths); i++) {
 349                 if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
 350                     IEEE80211_MESH_PROTO_DSZ) == 0)
 351                         return EEXIST;
 352                 if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
 353                         firstempty = i;
 354         }
 355         if (firstempty < 0)
 356                 return ENOSPC;
 357         memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
 358         mesh_proto_paths[firstempty].mpp_active = 1;
 359         return 0;
 360 }
 361
 362 int
 363 ieee80211_mesh_register_proto_metric(const struct
 364     ieee80211_mesh_proto_metric *mpm)
 365 {
 366         int i, firstempty = -1;
 367
 368         for (i = 0; i < N(mesh_proto_metrics); i++) {
 369                 if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
 370                     IEEE80211_MESH_PROTO_DSZ) == 0)
 371                         return EEXIST;
 372                 if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
 373                         firstempty = i;
 374         }
 375         if (firstempty < 0)
 376                 return ENOSPC;
 377         memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
 378         mesh_proto_metrics[firstempty].mpm_active = 1;
 379         return 0;
 380 }
 381
 382 static int
 383 mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
 384 {
 385         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 386         int i;
 387
 388         for (i = 0; i < N(mesh_proto_paths); i++) {
 389                 if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
 390                         ms->ms_ppath = &mesh_proto_paths[i];
 391                         return 0;
 392                 }
 393         }
 394         return ENOENT;
 395 }
 396
 397 static int
 398 mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
 399 {
 400         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 401         int i;
 402
 403         for (i = 0; i < N(mesh_proto_metrics); i++) {
 404                 if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
 405                         ms->ms_pmetric = &mesh_proto_metrics[i];
 406                         return 0;
 407                 }
 408         }
 409         return ENOENT;
 410 }
 411 #undef  N
 412
 413 static void
 414 ieee80211_mesh_init(void)
 415 {
 416
 417         memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
 418         memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
 419
 420         /*
 421          * Setup mesh parameters that depends on the clock frequency.
 422          */
 423         ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
 424         ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
 425         ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
 426
 427         /*
 428          * Register action frame handlers.
 429          */
 430         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 431             IEEE80211_ACTION_MESHPEERING_OPEN,
 432             mesh_recv_action_meshpeering_open);
 433         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 434             IEEE80211_ACTION_MESHPEERING_CONFIRM,
 435             mesh_recv_action_meshpeering_confirm);
 436         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 437             IEEE80211_ACTION_MESHPEERING_CLOSE,
 438             mesh_recv_action_meshpeering_close);
 439         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 440             IEEE80211_ACTION_MESHLMETRIC_REQ, mesh_recv_action_meshlmetric_req);
 441         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 442             IEEE80211_ACTION_MESHLMETRIC_REP, mesh_recv_action_meshlmetric_rep);
 443
 444         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 445             IEEE80211_ACTION_MESHPEERING_OPEN,
 446             mesh_send_action_meshpeering_open);
 447         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 448             IEEE80211_ACTION_MESHPEERING_CONFIRM,
 449             mesh_send_action_meshpeering_confirm);
 450         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 451             IEEE80211_ACTION_MESHPEERING_CLOSE,
 452             mesh_send_action_meshpeering_close);
 453         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 454             IEEE80211_ACTION_MESHLMETRIC_REQ,
 455             mesh_send_action_meshlink_request);
 456         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 457             IEEE80211_ACTION_MESHLMETRIC_REP,
 458             mesh_send_action_meshlink_reply);
 459
 460         /*
 461          * Register Airtime Link Metric.
 462          */
 463         ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
 464
 465 }
 466 SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
 467
 468 void
 469 ieee80211_mesh_attach(struct ieee80211com *ic)
 470 {
 471         ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
 472 }
 473
 474 void
 475 ieee80211_mesh_detach(struct ieee80211com *ic)
 476 {
 477 }
 478
 479 static void
 480 mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
 481 {
 482         struct ieee80211com *ic = ni->ni_ic;
 483         uint16_t args[3];
 484
 485         if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
 486                 args[0] = ni->ni_mlpid;
 487                 args[1] = ni->ni_mllid;
 488                 args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
 489                 ieee80211_send_action(ni,
 490                     IEEE80211_ACTION_CAT_MESHPEERING,
 491                     IEEE80211_ACTION_MESHPEERING_CLOSE,
 492                     args);
 493         }
 494         callout_drain(&ni->ni_mltimer);
 495         /* XXX belongs in hwmp */
 496         ieee80211_ageq_drain_node(&ic->ic_stageq,
 497            (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
 498 }
 499
 500 static void
 501 mesh_vdetach(struct ieee80211vap *vap)
 502 {
 503         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 504
 505         callout_drain(&ms->ms_cleantimer);
 506         ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
 507             NULL);
 508         ieee80211_mesh_rt_flush(vap);
 509         mtx_destroy(&ms->ms_rt_lock);
 510         ms->ms_ppath->mpp_vdetach(vap);
 511         free(vap->iv_mesh, M_80211_VAP);
 512         vap->iv_mesh = NULL;
 513 }
 514
 515 static void
 516 mesh_vattach(struct ieee80211vap *vap)
 517 {
 518         struct ieee80211_mesh_state *ms;
 519         vap->iv_newstate = mesh_newstate;
 520         vap->iv_input = mesh_input;
 521         vap->iv_opdetach = mesh_vdetach;
 522         vap->iv_recv_mgmt = mesh_recv_mgmt;
 523         ms = malloc(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
 524             M_NOWAIT | M_ZERO);
 525         if (ms == NULL) {
 526                 printf("%s: couldn't alloc MBSS state\n", __func__);
 527                 return;
 528         }
 529         vap->iv_mesh = ms;
 530         ms->ms_seq = 0;
 531         ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
 532         ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
 533         TAILQ_INIT(&ms->ms_routes);
 534         mtx_init(&ms->ms_rt_lock, "MBSS", "802.11s routing table", MTX_DEF);
 535         callout_init(&ms->ms_cleantimer, CALLOUT_MPSAFE);
 536         mesh_select_proto_metric(vap, "AIRTIME");
 537         KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
 538         mesh_select_proto_path(vap, "HWMP");
 539         KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
 540         ms->ms_ppath->mpp_vattach(vap);
 541 }
 542
 543 /*
 544  * IEEE80211_M_MBSS vap state machine handler.
 545  */
 546 static int
 547 mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 548 {
 549         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 550         struct ieee80211com *ic = vap->iv_ic;
 551         struct ieee80211_node *ni;
 552         enum ieee80211_state ostate;
 553
 554         IEEE80211_LOCK_ASSERT(ic);
 555
 556         ostate = vap->iv_state;
 557         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
 558             __func__, ieee80211_state_name[ostate],
 559             ieee80211_state_name[nstate], arg);
 560         vap->iv_state = nstate;         /* state transition */
 561         if (ostate != IEEE80211_S_SCAN)
 562                 ieee80211_cancel_scan(vap);     /* background scan */
 563         ni = vap->iv_bss;                       /* NB: no reference held */
 564         if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN)
 565                 callout_drain(&ms->ms_cleantimer);
 566         switch (nstate) {
 567         case IEEE80211_S_INIT:
 568                 switch (ostate) {
 569                 case IEEE80211_S_SCAN:
 570                         ieee80211_cancel_scan(vap);
 571                         break;
 572                 case IEEE80211_S_CAC:
 573                         ieee80211_dfs_cac_stop(vap);
 574                         break;
 575                 case IEEE80211_S_RUN:
 576                         ieee80211_iterate_nodes(&ic->ic_sta,
 577                             mesh_vdetach_peers, NULL);
 578                         break;
 579                 default:
 580                         break;
 581                 }
 582                 if (ostate != IEEE80211_S_INIT) {
 583                         /* NB: optimize INIT -> INIT case */
 584                         ieee80211_reset_bss(vap);
 585                         ieee80211_mesh_rt_flush(vap);
 586                 }
 587                 break;
 588         case IEEE80211_S_SCAN:
 589                 switch (ostate) {
 590                 case IEEE80211_S_INIT:
 591                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
 592                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
 593                             ms->ms_idlen != 0) {
 594                                 /*
 595                                  * Already have a channel and a mesh ID; bypass
 596                                  * the scan and startup immediately.
 597                                  */
 598                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
 599                                 break;
 600                         }
 601                         /*
 602                          * Initiate a scan.  We can come here as a result
 603                          * of an IEEE80211_IOC_SCAN_REQ too in which case
 604                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
 605                          * and the scan request parameters will be present
 606                          * in iv_scanreq.  Otherwise we do the default.
 607                         */
 608                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
 609                                 ieee80211_check_scan(vap,
 610                                     vap->iv_scanreq_flags,
 611                                     vap->iv_scanreq_duration,
 612                                     vap->iv_scanreq_mindwell,
 613                                     vap->iv_scanreq_maxdwell,
 614                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
 615                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
 616                         } else
 617                                 ieee80211_check_scan_current(vap);
 618                         break;
 619                 default:
 620                         break;
 621                 }
 622                 break;
 623         case IEEE80211_S_CAC:
 624                 /*
 625                  * Start CAC on a DFS channel.  We come here when starting
 626                  * a bss on a DFS channel (see ieee80211_create_ibss).
 627                  */
 628                 ieee80211_dfs_cac_start(vap);
 629                 break;
 630         case IEEE80211_S_RUN:
 631                 switch (ostate) {
 632                 case IEEE80211_S_INIT:
 633                         /*
 634                          * Already have a channel; bypass the
 635                          * scan and startup immediately.
 636                          * Note that ieee80211_create_ibss will call
 637                          * back to do a RUN->RUN state change.
 638                          */
 639                         ieee80211_create_ibss(vap,
 640                             ieee80211_ht_adjust_channel(ic,
 641                                 ic->ic_curchan, vap->iv_flags_ht));
 642                         /* NB: iv_bss is changed on return */
 643                         break;
 644                 case IEEE80211_S_CAC:
 645                         /*
 646                          * NB: This is the normal state change when CAC
 647                          * expires and no radar was detected; no need to
 648                          * clear the CAC timer as it's already expired.
 649                          */
 650                         /* fall thru... */
 651                 case IEEE80211_S_CSA:
 652 #if 0
 653                         /*
 654                          * Shorten inactivity timer of associated stations
 655                          * to weed out sta's that don't follow a CSA.
 656                          */
 657                         ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
 658 #endif
 659                         /*
 660                          * Update bss node channel to reflect where
 661                          * we landed after CSA.
 662                          */
 663                         ieee80211_node_set_chan(vap->iv_bss,
 664                             ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
 665                                 ieee80211_htchanflags(vap->iv_bss->ni_chan)));
 666                         /* XXX bypass debug msgs */
 667                         break;
 668                 case IEEE80211_S_SCAN:
 669                 case IEEE80211_S_RUN:
 670 #ifdef IEEE80211_DEBUG
 671                         if (ieee80211_msg_debug(vap)) {
 672                                 struct ieee80211_node *ni = vap->iv_bss;
 673                                 ieee80211_note(vap,
 674                                     "synchronized with %s meshid ",
 675                                     ether_sprintf(ni->ni_meshid));
 676                                 ieee80211_print_essid(ni->ni_meshid,
 677                                     ni->ni_meshidlen);
 678                                 /* XXX MCS/HT */
 679                                 printf(" channel %d\n",
 680                                     ieee80211_chan2ieee(ic, ic->ic_curchan));
 681                         }
 682 #endif
 683                         break;
 684                 default:
 685                         break;
 686                 }
 687                 ieee80211_node_authorize(vap->iv_bss);
 688                 callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
 689                     mesh_rt_cleanup_cb, vap);
 690                 break;
 691         default:
 692                 break;
 693         }
 694         /* NB: ostate not nstate */
 695         ms->ms_ppath->mpp_newstate(vap, ostate, arg);
 696         return 0;
 697 }
 698
 699 static void
 700 mesh_rt_cleanup_cb(void *arg)
 701 {
 702         struct ieee80211vap *vap = arg;
 703         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 704
 705         mesh_rt_flush_invalid(vap);
 706         callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
 707             mesh_rt_cleanup_cb, vap);
 708 }
 709
 710
 711 /*
 712  * Helper function to note the Mesh Peer Link FSM change.
 713  */
 714 static void
 715 mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
 716 {
 717         struct ieee80211vap *vap = ni->ni_vap;
 718         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 719 #ifdef IEEE80211_DEBUG
 720         static const char *meshlinkstates[] = {
 721                 [IEEE80211_NODE_MESH_IDLE]              = "IDLE",
 722                 [IEEE80211_NODE_MESH_OPENSNT]           = "OPEN SENT",
 723                 [IEEE80211_NODE_MESH_OPENRCV]           = "OPEN RECEIVED",
 724                 [IEEE80211_NODE_MESH_CONFIRMRCV]        = "CONFIRM RECEIVED",
 725                 [IEEE80211_NODE_MESH_ESTABLISHED]       = "ESTABLISHED",
 726                 [IEEE80211_NODE_MESH_HOLDING]           = "HOLDING"
 727         };
 728 #endif
 729         IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
 730             ni, "peer link: %s -> %s",
 731             meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
 732
 733         /* track neighbor count */
 734         if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
 735             ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
 736                 KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
 737                 ms->ms_neighbors++;
 738                 ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
 739         } else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
 740             state != IEEE80211_NODE_MESH_ESTABLISHED) {
 741                 KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
 742                 ms->ms_neighbors--;
 743                 ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
 744         }
 745         ni->ni_mlstate = state;
 746         switch (state) {
 747         case IEEE80211_NODE_MESH_HOLDING:
 748                 ms->ms_ppath->mpp_peerdown(ni);
 749                 break;
 750         case IEEE80211_NODE_MESH_ESTABLISHED:
 751                 ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
 752                 break;
 753         default:
 754                 break;
 755         }
 756 }
 757
 758 /*
 759  * Helper function to generate a unique local ID required for mesh
 760  * peer establishment.
 761  */
 762 static void
 763 mesh_checkid(void *arg, struct ieee80211_node *ni)
 764 {
 765         uint16_t *r = arg;
 766
 767         if (*r == ni->ni_mllid)
 768                 *(uint16_t *)arg = 0;
 769 }
 770
 771 static uint32_t
 772 mesh_generateid(struct ieee80211vap *vap)
 773 {
 774         int maxiter = 4;
 775         uint16_t r;
 776
 777         do {
 778                 get_random_bytes(&r, 2);
 779                 ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
 780                 maxiter--;
 781         } while (r == 0 && maxiter > 0);
 782         return r;
 783 }
 784
 785 /*
 786  * Verifies if we already received this packet by checking its
 787  * sequence number.
 788  * Returns 0 if the frame is to be accepted, 1 otherwise.
 789  */
 790 static int
 791 mesh_checkpseq(struct ieee80211vap *vap,
 792     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
 793 {
 794         struct ieee80211_mesh_route *rt;
 795
 796         rt = ieee80211_mesh_rt_find(vap, source);
 797         if (rt == NULL) {
 798                 rt = ieee80211_mesh_rt_add(vap, source);
 799                 if (rt == NULL) {
 800                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
 801                             "%s", "add mcast route failed");
 802                         vap->iv_stats.is_mesh_rtaddfailed++;
 803                         return 1;
 804                 }
 805                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
 806                     "add mcast route, mesh seqno %d", seq);
 807                 rt->rt_lastmseq = seq;
 808                 return 0;
 809         }
 810         if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
 811                 return 1;
 812         } else {
 813                 rt->rt_lastmseq = seq;
 814                 return 0;
 815         }
 816 }
 817
 818 /*
 819  * Iterate the routing table and locate the next hop.
 820  */
 821 static struct ieee80211_node *
 822 mesh_find_txnode(struct ieee80211vap *vap,
 823     const uint8_t dest[IEEE80211_ADDR_LEN])
 824 {
 825         struct ieee80211_mesh_route *rt;
 826
 827         rt = ieee80211_mesh_rt_find(vap, dest);
 828         if (rt == NULL)
 829                 return NULL;
 830         if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 ||
 831             (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY)) {
 832                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 833                     "%s: !valid or proxy, flags 0x%x", __func__, rt->rt_flags);
 834                 /* XXX stat */
 835                 return NULL;
 836         }
 837         return ieee80211_find_txnode(vap, rt->rt_nexthop);
 838 }
 839
 840 /*
 841  * Forward the specified frame.
 842  * Decrement the TTL and set TA to our MAC address.
 843  */
 844 static void
 845 mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
 846     const struct ieee80211_meshcntl *mc)
 847 {
 848         struct ieee80211com *ic = vap->iv_ic;
 849         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 850         struct ifnet *ifp = vap->iv_ifp;
 851         struct ifnet *parent = ic->ic_ifp;
 852         const struct ieee80211_frame *wh =
 853             mtod(m, const struct ieee80211_frame *);
 854         struct mbuf *mcopy;
 855         struct ieee80211_meshcntl *mccopy;
 856         struct ieee80211_frame *whcopy;
 857         struct ieee80211_node *ni;
 858         int err;
 859
 860         if (mc->mc_ttl == 0) {
 861                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 862                     "%s", "frame not fwd'd, ttl 0");
 863                 vap->iv_stats.is_mesh_fwd_ttl++;
 864                 return;
 865         }
 866         if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
 867                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 868                     "%s", "frame not fwd'd, fwding disabled");
 869                 vap->iv_stats.is_mesh_fwd_disabled++;
 870                 return;
 871         }
 872         mcopy = m_dup(m, M_DONTWAIT);
 873         if (mcopy == NULL) {
 874                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 875                     "%s", "frame not fwd'd, cannot dup");
 876                 vap->iv_stats.is_mesh_fwd_nobuf++;
 877                 ifp->if_oerrors++;
 878                 return;
 879         }
 880         mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
 881             sizeof(struct ieee80211_meshcntl));
 882         if (mcopy == NULL) {
 883                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 884                     "%s", "frame not fwd'd, too short");
 885                 vap->iv_stats.is_mesh_fwd_tooshort++;
 886                 ifp->if_oerrors++;
 887                 m_freem(mcopy);
 888                 return;
 889         }
 890         whcopy = mtod(mcopy, struct ieee80211_frame *);
 891         mccopy = (struct ieee80211_meshcntl *)
 892             (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
 893         /* XXX clear other bits? */
 894         whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
 895         IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
 896         if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 897                 ni = ieee80211_ref_node(vap->iv_bss);
 898                 mcopy->m_flags |= M_MCAST;
 899         } else {
 900                 ni = mesh_find_txnode(vap, whcopy->i_addr3);
 901                 if (ni == NULL) {
 902                         IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 903                             "%s", "frame not fwd'd, no path");
 904                         vap->iv_stats.is_mesh_fwd_nopath++;
 905                         m_freem(mcopy);
 906                         return;
 907                 }
 908                 IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
 909         }
 910         KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
 911         mccopy->mc_ttl--;
 912
 913         /* XXX calculate priority so drivers can find the tx queue */
 914         M_WME_SETAC(mcopy, WME_AC_BE);
 915
 916         /* XXX do we know m_nextpkt is NULL? */
 917         mcopy->m_pkthdr.rcvif = (void *) ni;
 918         err = parent->if_transmit(parent, mcopy);
 919         if (err != 0) {
 920                 /* NB: IFQ_HANDOFF reclaims mbuf */
 921                 ieee80211_free_node(ni);
 922         } else {
 923                 ifp->if_opackets++;
 924         }
 925 }
 926
 927 static struct mbuf *
 928 mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
 929 {
 930 #define WHDIR(wh) ((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
 931         uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
 932                   sizeof(struct ieee80211_meshcntl_ae11)];
 933         const struct ieee80211_qosframe_addr4 *wh;
 934         const struct ieee80211_meshcntl_ae10 *mc;
 935         struct ether_header *eh;
 936         struct llc *llc;
 937         int ae;
 938
 939         if (m->m_len < hdrlen + sizeof(*llc) &&
 940             (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
 941                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
 942                     "discard data frame: %s", "m_pullup failed");
 943                 vap->iv_stats.is_rx_tooshort++;
 944                 return NULL;
 945         }
 946         memcpy(b, mtod(m, caddr_t), hdrlen);
 947         wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
 948         mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
 949         KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
 950                 WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
 951             ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
 952
 953         llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
 954         if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
 955             llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
 956             llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
 957             /* NB: preserve AppleTalk frames that have a native SNAP hdr */
 958             !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
 959               llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
 960                 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
 961                 llc = NULL;
 962         } else {
 963                 m_adj(m, hdrlen - sizeof(*eh));
 964         }
 965         eh = mtod(m, struct ether_header *);
 966         ae = mc->mc_flags & 3;
 967         if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
 968                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
 969                 if (ae == 0) {
 970                         IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
 971                 } else if (ae == 1) {
 972                         IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr4);
 973                 } else {
 974                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 975                             (const struct ieee80211_frame *)wh, NULL,
 976                             "bad AE %d", ae);
 977                         vap->iv_stats.is_mesh_badae++;
 978                         m_freem(m);
 979                         return NULL;
 980                 }
 981         } else {
 982                 if (ae == 0) {
 983                         IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
 984                         IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
 985                 } else if (ae == 2) {
 986                         IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr4);
 987                         IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr5);
 988                 } else {
 989                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 990                             (const struct ieee80211_frame *)wh, NULL,
 991                             "bad AE %d", ae);
 992                         vap->iv_stats.is_mesh_badae++;
 993                         m_freem(m);
 994                         return NULL;
 995                 }
 996         }
 997 #ifdef ALIGNED_POINTER
 998         if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
 999                 m = ieee80211_realign(vap, m, sizeof(*eh));
1000                 if (m == NULL)
1001                         return NULL;
1002         }
1003 #endif /* ALIGNED_POINTER */
1004         if (llc != NULL) {
1005                 eh = mtod(m, struct ether_header *);
1006                 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
1007         }
1008         return m;
1009 #undef WDIR
1010 }
1011
1012 /*
1013  * Return non-zero if the unicast mesh data frame should be processed
1014  * locally.  Frames that are not proxy'd have our address, otherwise
1015  * we need to consult the routing table to look for a proxy entry.
1016  */
1017 static __inline int
1018 mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
1019     const struct ieee80211_meshcntl *mc)
1020 {
1021         int ae = mc->mc_flags & 3;
1022
1023         KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
1024             ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1025         KASSERT(ae == 0 || ae == 2, ("bad AE %d", ae));
1026         if (ae == 2) {                          /* ucast w/ proxy */
1027                 const struct ieee80211_meshcntl_ae10 *mc10 =
1028                     (const struct ieee80211_meshcntl_ae10 *) mc;
1029                 struct ieee80211_mesh_route *rt =
1030                     ieee80211_mesh_rt_find(vap, mc10->mc_addr4);
1031                 /* check for proxy route to ourself */
1032                 return (rt != NULL &&
1033                     (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
1034         } else                                  /* ucast w/o proxy */
1035                 return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
1036 }
1037
1038 static int
1039 mesh_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
1040 {
1041 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
1042 #define HAS_SEQ(type)   ((type & 0x4) == 0)
1043         struct ieee80211vap *vap = ni->ni_vap;
1044         struct ieee80211com *ic = ni->ni_ic;
1045         struct ifnet *ifp = vap->iv_ifp;
1046         struct ieee80211_frame *wh;
1047         const struct ieee80211_meshcntl *mc;
1048         int hdrspace, meshdrlen, need_tap;
1049         uint8_t dir, type, subtype, qos;
1050         uint32_t seq;
1051         uint8_t *addr;
1052         ieee80211_seq rxseq;
1053
1054         KASSERT(ni != NULL, ("null node"));
1055         ni->ni_inact = ni->ni_inact_reload;
1056
1057         need_tap = 1;                   /* mbuf need to be tapped. */
1058         type = -1;                      /* undefined */
1059
1060         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
1061                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1062                     ni->ni_macaddr, NULL,
1063                     "too short (1): len %u", m->m_pkthdr.len);
1064                 vap->iv_stats.is_rx_tooshort++;
1065                 goto out;
1066         }
1067         /*
1068          * Bit of a cheat here, we use a pointer for a 3-address
1069          * frame format but don't reference fields past outside
1070          * ieee80211_frame_min w/o first validating the data is
1071          * present.
1072         */
1073         wh = mtod(m, struct ieee80211_frame *);
1074
1075         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1076             IEEE80211_FC0_VERSION_0) {
1077                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1078                     ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
1079                 vap->iv_stats.is_rx_badversion++;
1080                 goto err;
1081         }
1082         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1083         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1084         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1085         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1086                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1087                 ni->ni_noise = nf;
1088                 if (HAS_SEQ(type)) {
1089                         uint8_t tid = ieee80211_gettid(wh);
1090
1091                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
1092                             TID_TO_WME_AC(tid) >= WME_AC_VI)
1093                                 ic->ic_wme.wme_hipri_traffic++;
1094                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
1095                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
1096                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
1097                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
1098                                 /* duplicate, discard */
1099                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1100                                     wh->i_addr1, "duplicate",
1101                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
1102                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
1103                                     ni->ni_rxseqs[tid] >>
1104                                     IEEE80211_SEQ_SEQ_SHIFT,
1105                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
1106                                     ni->ni_rxseqs[tid] &
1107                                     IEEE80211_SEQ_FRAG_MASK,
1108                                     tid);
1109                                 vap->iv_stats.is_rx_dup++;
1110                                 IEEE80211_NODE_STAT(ni, rx_dup);
1111                                 goto out;
1112                         }
1113                         ni->ni_rxseqs[tid] = rxseq;
1114                 }
1115         }
1116 #ifdef IEEE80211_DEBUG
1117         /*
1118          * It's easier, but too expensive, to simulate different mesh
1119          * topologies by consulting the ACL policy very early, so do this
1120          * only under DEBUG.
1121          *
1122          * NB: this check is also done upon peering link initiation.
1123          */
1124         if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
1125                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1126                     wh, NULL, "%s", "disallowed by ACL");
1127                 vap->iv_stats.is_rx_acl++;
1128                 goto out;
1129         }
1130 #endif
1131         switch (type) {
1132         case IEEE80211_FC0_TYPE_DATA:
1133                 if (ni == vap->iv_bss)
1134                         goto out;
1135                 if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
1136                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1137                             ni->ni_macaddr, NULL,
1138                             "peer link not yet established (%d)",
1139                             ni->ni_mlstate);
1140                         vap->iv_stats.is_mesh_nolink++;
1141                         goto out;
1142                 }
1143                 if (dir != IEEE80211_FC1_DIR_FROMDS &&
1144                     dir != IEEE80211_FC1_DIR_DSTODS) {
1145                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1146                             wh, "data", "incorrect dir 0x%x", dir);
1147                         vap->iv_stats.is_rx_wrongdir++;
1148                         goto err;
1149                 }
1150                 /* pull up enough to get to the mesh control */
1151                 hdrspace = ieee80211_hdrspace(ic, wh);
1152                 if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
1153                     (m = m_pullup(m, hdrspace +
1154                         sizeof(struct ieee80211_meshcntl))) == NULL) {
1155                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1156                             ni->ni_macaddr, NULL,
1157                             "data too short: expecting %u", hdrspace);
1158                         vap->iv_stats.is_rx_tooshort++;
1159                         goto out;               /* XXX */
1160                 }
1161                 /*
1162                  * Now calculate the full extent of the headers. Note
1163                  * mesh_decap will pull up anything we didn't get
1164                  * above when it strips the 802.11 headers.
1165                  */
1166                 mc = (const struct ieee80211_meshcntl *)
1167                     (mtod(m, const uint8_t *) + hdrspace);
1168                 meshdrlen = sizeof(struct ieee80211_meshcntl) +
1169                     (mc->mc_flags & 3) * IEEE80211_ADDR_LEN;
1170                 hdrspace += meshdrlen;
1171                 seq = LE_READ_4(mc->mc_seq);
1172                 if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1173                         addr = wh->i_addr3;
1174                 else
1175                         addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
1176                 if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
1177                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1178                             addr, "data", "%s", "not to me");
1179                         vap->iv_stats.is_rx_wrongbss++; /* XXX kinda */
1180                         goto out;
1181                 }
1182                 if (mesh_checkpseq(vap, addr, seq) != 0) {
1183                         vap->iv_stats.is_rx_dup++;
1184                         goto out;
1185                 }
1186
1187                 /*
1188                  * Potentially forward packet.  See table s36 (p140)
1189                  * for the rules.  XXX tap fwd'd packets not for us?
1190                  */
1191                 if (dir == IEEE80211_FC1_DIR_FROMDS ||
1192                     !mesh_isucastforme(vap, wh, mc)) {
1193                         mesh_forward(vap, m, mc);
1194                         if (dir == IEEE80211_FC1_DIR_DSTODS)
1195                                 goto out;
1196                         /* NB: fall thru to deliver mcast frames locally */
1197                 }
1198
1199                 /*
1200                  * Save QoS bits for use below--before we strip the header.
1201                  */
1202                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
1203                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
1204                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
1205                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
1206                 } else
1207                         qos = 0;
1208                 /*
1209                  * Next up, any fragmentation.
1210                  */
1211                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1212                         m = ieee80211_defrag(ni, m, hdrspace);
1213                         if (m == NULL) {
1214                                 /* Fragment dropped or frame not complete yet */
1215                                 goto out;
1216                         }
1217                 }
1218                 wh = NULL;              /* no longer valid, catch any uses */
1219
1220                 if (ieee80211_radiotap_active_vap(vap))
1221                         ieee80211_radiotap_rx(vap, m);
1222                 need_tap = 0;
1223
1224                 /*
1225                  * Finally, strip the 802.11 header.
1226                  */
1227                 m = mesh_decap(vap, m, hdrspace, meshdrlen);
1228                 if (m == NULL) {
1229                         /* XXX mask bit to check for both */
1230                         /* don't count Null data frames as errors */
1231                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
1232                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
1233                                 goto out;
1234                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1235                             ni->ni_macaddr, "data", "%s", "decap error");
1236                         vap->iv_stats.is_rx_decap++;
1237                         IEEE80211_NODE_STAT(ni, rx_decap);
1238                         goto err;
1239                 }
1240                 if (qos & IEEE80211_QOS_AMSDU) {
1241                         m = ieee80211_decap_amsdu(ni, m);
1242                         if (m == NULL)
1243                                 return IEEE80211_FC0_TYPE_DATA;
1244                 }
1245                 ieee80211_deliver_data(vap, ni, m);
1246                 return type;
1247         case IEEE80211_FC0_TYPE_MGT:
1248                 vap->iv_stats.is_rx_mgmt++;
1249                 IEEE80211_NODE_STAT(ni, rx_mgmt);
1250                 if (dir != IEEE80211_FC1_DIR_NODS) {
1251                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1252                             wh, "mgt", "incorrect dir 0x%x", dir);
1253                         vap->iv_stats.is_rx_wrongdir++;
1254                         goto err;
1255                 }
1256                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
1257                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1258                             ni->ni_macaddr, "mgt", "too short: len %u",
1259                             m->m_pkthdr.len);
1260                         vap->iv_stats.is_rx_tooshort++;
1261                         goto out;
1262                 }
1263 #ifdef IEEE80211_DEBUG
1264                 if ((ieee80211_msg_debug(vap) &&
1265                     (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
1266                     ieee80211_msg_dumppkts(vap)) {
1267                         if_printf(ifp, "received %s from %s rssi %d\n",
1268                             ieee80211_mgt_subtype_name[subtype >>
1269                             IEEE80211_FC0_SUBTYPE_SHIFT],
1270                             ether_sprintf(wh->i_addr2), rssi);
1271                 }
1272 #endif
1273                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1274                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1275                             wh, NULL, "%s", "WEP set but not permitted");
1276                         vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
1277                         goto out;
1278                 }
1279                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
1280                 goto out;
1281         case IEEE80211_FC0_TYPE_CTL:
1282                 vap->iv_stats.is_rx_ctl++;
1283                 IEEE80211_NODE_STAT(ni, rx_ctrl);
1284                 goto out;
1285         default:
1286                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1287                     wh, "bad", "frame type 0x%x", type);
1288                 /* should not come here */
1289                 break;
1290         }
1291 err:
1292         ifp->if_ierrors++;
1293 out:
1294         if (m != NULL) {
1295                 if (need_tap && ieee80211_radiotap_active_vap(vap))
1296                         ieee80211_radiotap_rx(vap, m);
1297                 m_freem(m);
1298         }
1299         return type;
1300 }
1301
1302 static void
1303 mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1304     int rssi, int nf)
1305 {
1306         struct ieee80211vap *vap = ni->ni_vap;
1307         struct ieee80211_mesh_state *ms = vap->iv_mesh;
1308         struct ieee80211com *ic = ni->ni_ic;
1309         struct ieee80211_frame *wh;
1310         uint8_t *frm, *efrm;
1311
1312         wh = mtod(m0, struct ieee80211_frame *);
1313         frm = (uint8_t *)&wh[1];
1314         efrm = mtod(m0, uint8_t *) + m0->m_len;
1315         switch (subtype) {
1316         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1317         case IEEE80211_FC0_SUBTYPE_BEACON:
1318         {
1319                 struct ieee80211_scanparams scan;
1320                 /*
1321                  * We process beacon/probe response
1322                  * frames to discover neighbors.
1323                  */
1324                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
1325                         return;
1326                 /*
1327                  * Count frame now that we know it's to be processed.
1328                  */
1329                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1330                         vap->iv_stats.is_rx_beacon++;   /* XXX remove */
1331                         IEEE80211_NODE_STAT(ni, rx_beacons);
1332                 } else
1333                         IEEE80211_NODE_STAT(ni, rx_proberesp);
1334                 /*
1335                  * If scanning, just pass information to the scan module.
1336                  */
1337                 if (ic->ic_flags & IEEE80211_F_SCAN) {
1338                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1339                                 /*
1340                                  * Actively scanning a channel marked passive;
1341                                  * send a probe request now that we know there
1342                                  * is 802.11 traffic present.
1343                                  *
1344                                  * XXX check if the beacon we recv'd gives
1345                                  * us what we need and suppress the probe req
1346                                  */
1347                                 ieee80211_probe_curchan(vap, 1);
1348                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1349                         }
1350                         ieee80211_add_scan(vap, &scan, wh,
1351                             subtype, rssi, nf);
1352                         return;
1353                 }
1354
1355                 /* The rest of this code assumes we are running */
1356                 if (vap->iv_state != IEEE80211_S_RUN)
1357                         return;
1358                 /*
1359                  * Ignore non-mesh STAs.
1360                  */
1361                 if ((scan.capinfo &
1362                      (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
1363                     scan.meshid == NULL || scan.meshconf == NULL) {
1364                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1365                             wh, "beacon", "%s", "not a mesh sta");
1366                         vap->iv_stats.is_mesh_wrongmesh++;
1367                         return;
1368                 }
1369                 /*
1370                  * Ignore STAs for other mesh networks.
1371                  */
1372                 if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
1373                     mesh_verify_meshconf(vap, scan.meshconf)) {
1374                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1375                             wh, "beacon", "%s", "not for our mesh");
1376                         vap->iv_stats.is_mesh_wrongmesh++;
1377                         return;
1378                 }
1379                 /*
1380                  * Peer only based on the current ACL policy.
1381                  */
1382                 if (vap->iv_acl != NULL &&
1383                     !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
1384                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1385                             wh, NULL, "%s", "disallowed by ACL");
1386                         vap->iv_stats.is_rx_acl++;
1387                         return;
1388                 }
1389                 /*
1390                  * Do neighbor discovery.
1391                  */
1392                 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
1393                         /*
1394                          * Create a new entry in the neighbor table.
1395                          */
1396                         ni = ieee80211_add_neighbor(vap, wh, &scan);
1397                 }
1398                 /*
1399                  * Automatically peer with discovered nodes if possible.
1400                  * XXX backoff on repeated failure
1401                  */
1402                 if (ni != vap->iv_bss &&
1403                     (ms->ms_flags & IEEE80211_MESHFLAGS_AP) &&
1404                     ni->ni_mlstate == IEEE80211_NODE_MESH_IDLE) {
1405                         uint16_t args[1];
1406
1407                         ni->ni_mlpid = mesh_generateid(vap);
1408                         if (ni->ni_mlpid == 0)
1409                                 return;
1410                         mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
1411                         args[0] = ni->ni_mlpid;
1412                         ieee80211_send_action(ni,
1413                             IEEE80211_ACTION_CAT_MESHPEERING,
1414                             IEEE80211_ACTION_MESHPEERING_OPEN, args);
1415                         ni->ni_mlrcnt = 0;
1416                         mesh_peer_timeout_setup(ni);
1417                 }
1418                 break;
1419         }
1420         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1421         {
1422                 uint8_t *ssid, *meshid, *rates, *xrates;
1423                 uint8_t *sfrm;
1424
1425                 if (vap->iv_state != IEEE80211_S_RUN) {
1426                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1427                             wh, NULL, "wrong state %s",
1428                             ieee80211_state_name[vap->iv_state]);
1429                         vap->iv_stats.is_rx_mgtdiscard++;
1430                         return;
1431                 }
1432                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
1433                         /* frame must be directed */
1434                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1435                             wh, NULL, "%s", "not unicast");
1436                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
1437                         return;
1438                 }
1439                 /*
1440                  * prreq frame format
1441                  *      [tlv] ssid
1442                  *      [tlv] supported rates
1443                  *      [tlv] extended supported rates
1444                  *      [tlv] mesh id
1445                  */
1446                 ssid = meshid = rates = xrates = NULL;
1447                 sfrm = frm;
1448                 while (efrm - frm > 1) {
1449                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1450                         switch (*frm) {
1451                         case IEEE80211_ELEMID_SSID:
1452                                 ssid = frm;
1453                                 break;
1454                         case IEEE80211_ELEMID_RATES:
1455                                 rates = frm;
1456                                 break;
1457                         case IEEE80211_ELEMID_XRATES:
1458                                 xrates = frm;
1459                                 break;
1460                         case IEEE80211_ELEMID_MESHID:
1461                                 meshid = frm;
1462                                 break;
1463                         }
1464                         frm += frm[2] + 2;
1465                 }
1466                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
1467                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1468                 if (xrates != NULL)
1469                         IEEE80211_VERIFY_ELEMENT(xrates,
1470                             IEEE80211_RATE_MAXSIZE - rates[1], return);
1471                 if (meshid != NULL)
1472                         IEEE80211_VERIFY_ELEMENT(meshid,
1473                             IEEE80211_MESHID_LEN, return);
1474                 /* NB: meshid, not ssid */
1475                 IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
1476
1477                 /* XXX find a better class or define it's own */
1478                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
1479                     "%s", "recv probe req");
1480                 /*
1481                  * Some legacy 11b clients cannot hack a complete
1482                  * probe response frame.  When the request includes
1483                  * only a bare-bones rate set, communicate this to
1484                  * the transmit side.
1485                  */
1486                 ieee80211_send_proberesp(vap, wh->i_addr2, 0);
1487                 break;
1488         }
1489         case IEEE80211_FC0_SUBTYPE_ACTION:
1490                 if (vap->iv_state != IEEE80211_S_RUN) {
1491                         vap->iv_stats.is_rx_mgtdiscard++;
1492                         break;
1493                 }
1494                 /*
1495                  * We received an action for an unknown neighbor.
1496                  * XXX: wait for it to beacon or create ieee80211_node?
1497                  */
1498                 if (ni == vap->iv_bss) {
1499                         IEEE80211_DISCARD(vap, IEEE80211_MSG_MESH,
1500                             wh, NULL, "%s", "unknown node");
1501                         vap->iv_stats.is_rx_mgtdiscard++;
1502                         break;
1503                 }
1504                 /*
1505                  * Discard if not for us.
1506                  */
1507                 if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
1508                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1509                         IEEE80211_DISCARD(vap, IEEE80211_MSG_MESH,
1510                             wh, NULL, "%s", "not for me");
1511                         vap->iv_stats.is_rx_mgtdiscard++;
1512                         break;
1513                 }
1514                 /* XXX parse_action is a bit useless now */
1515                 if (ieee80211_parse_action(ni, m0) == 0)
1516                         ic->ic_recv_action(ni, wh, frm, efrm);
1517                 break;
1518         case IEEE80211_FC0_SUBTYPE_AUTH:
1519         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1520         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1521         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1522         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1523         case IEEE80211_FC0_SUBTYPE_DEAUTH:
1524         case IEEE80211_FC0_SUBTYPE_DISASSOC:
1525                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1526                     wh, NULL, "%s", "not handled");
1527                 vap->iv_stats.is_rx_mgtdiscard++;
1528                 return;
1529         default:
1530                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1531                     wh, "mgt", "subtype 0x%x not handled", subtype);
1532                 vap->iv_stats.is_rx_badsubtype++;
1533                 break;
1534         }
1535 }
1536
1537 /*
1538  * Parse meshpeering action ie's for open+confirm frames; the
1539  * important bits are returned in the supplied structure.
1540  */
1541 static const struct ieee80211_meshpeer_ie *
1542 mesh_parse_meshpeering_action(struct ieee80211_node *ni,
1543         const struct ieee80211_frame *wh,       /* XXX for VERIFY_LENGTH */
1544         const uint8_t *frm, const uint8_t *efrm,
1545         struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
1546 {
1547         struct ieee80211vap *vap = ni->ni_vap;
1548         const struct ieee80211_meshpeer_ie *mpie;
1549         const uint8_t *meshid, *meshconf, *meshpeer;
1550
1551         meshid = meshconf = meshpeer = NULL;
1552         while (efrm - frm > 1) {
1553                 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
1554                 switch (*frm) {
1555                 case IEEE80211_ELEMID_MESHID:
1556                         meshid = frm;
1557                         break;
1558                 case IEEE80211_ELEMID_MESHCONF:
1559                         meshconf = frm;
1560                         break;
1561                 case IEEE80211_ELEMID_MESHPEER:
1562                         meshpeer = frm;
1563                         mpie = (const struct ieee80211_meshpeer_ie *) frm;
1564                         memset(mp, 0, sizeof(*mp));
1565                         mp->peer_llinkid = LE_READ_2(&mpie->peer_llinkid);
1566                         /* NB: peer link ID is optional on these frames */
1567                         if (subtype == IEEE80211_MESH_PEER_LINK_CLOSE &&
1568                             mpie->peer_len == 8) {
1569                                 mp->peer_linkid = 0;
1570                                 mp->peer_rcode = LE_READ_2(&mpie->peer_linkid);
1571                         } else {
1572                                 mp->peer_linkid = LE_READ_2(&mpie->peer_linkid);
1573                                 mp->peer_rcode = LE_READ_2(&mpie->peer_rcode);
1574                         }
1575                         break;
1576                 }
1577                 frm += frm[1] + 2;
1578         }
1579
1580         /*
1581          * Verify the contents of the frame. Action frames with
1582          * close subtype don't have a Mesh Configuration IE.
1583          * If if fails validation, close the peer link.
1584          */
1585         KASSERT(meshpeer != NULL &&
1586             subtype != IEEE80211_ACTION_MESHPEERING_CLOSE,
1587             ("parsing close action"));
1588
1589         if (mesh_verify_meshid(vap, meshid) ||
1590             mesh_verify_meshpeer(vap, subtype, meshpeer) ||
1591             mesh_verify_meshconf(vap, meshconf)) {
1592                 uint16_t args[3];
1593
1594                 IEEE80211_DISCARD(vap,
1595                     IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
1596                     wh, NULL, "%s", "not for our mesh");
1597                 vap->iv_stats.is_rx_mgtdiscard++;
1598                 switch (ni->ni_mlstate) {
1599                 case IEEE80211_NODE_MESH_IDLE:
1600                 case IEEE80211_NODE_MESH_ESTABLISHED:
1601                 case IEEE80211_NODE_MESH_HOLDING:
1602                         /* ignore */
1603                         break;
1604                 case IEEE80211_NODE_MESH_OPENSNT:
1605                 case IEEE80211_NODE_MESH_OPENRCV:
1606                 case IEEE80211_NODE_MESH_CONFIRMRCV:
1607                         args[0] = ni->ni_mlpid;
1608                         args[1] = ni->ni_mllid;
1609                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1610                         ieee80211_send_action(ni,
1611                             IEEE80211_ACTION_CAT_MESHPEERING,
1612                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1613                             args);
1614                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1615                         mesh_peer_timeout_setup(ni);
1616                         break;
1617                 }
1618                 return NULL;
1619         }
1620         return (const struct ieee80211_meshpeer_ie *) mp;
1621 }
1622
1623 static int
1624 mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
1625         const struct ieee80211_frame *wh,
1626         const uint8_t *frm, const uint8_t *efrm)
1627 {
1628         struct ieee80211vap *vap = ni->ni_vap;
1629         struct ieee80211_meshpeer_ie ie;
1630         const struct ieee80211_meshpeer_ie *meshpeer;
1631         uint16_t args[3];
1632
1633         /* +2+2 for action + code + capabilites */
1634         meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
1635             IEEE80211_ACTION_MESHPEERING_OPEN);
1636         if (meshpeer == NULL) {
1637                 return 0;
1638         }
1639
1640         /* XXX move up */
1641         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1642             "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
1643
1644         switch (ni->ni_mlstate) {
1645         case IEEE80211_NODE_MESH_IDLE:
1646                 mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
1647                 ni->ni_mllid = meshpeer->peer_llinkid;
1648                 ni->ni_mlpid = mesh_generateid(vap);
1649                 if (ni->ni_mlpid == 0)
1650                         return 0;               /* XXX */
1651                 args[0] = ni->ni_mlpid;
1652                 /* Announce we're open too... */
1653                 ieee80211_send_action(ni,
1654                     IEEE80211_ACTION_CAT_MESHPEERING,
1655                     IEEE80211_ACTION_MESHPEERING_OPEN, args);
1656                 /* ...and confirm the link. */
1657                 args[0] = ni->ni_mlpid;
1658                 args[1] = ni->ni_mllid;
1659                 ieee80211_send_action(ni,
1660                     IEEE80211_ACTION_CAT_MESHPEERING,
1661                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1662                     args);
1663                 mesh_peer_timeout_setup(ni);
1664                 break;
1665         case IEEE80211_NODE_MESH_OPENRCV:
1666                 /* Wrong Link ID */
1667                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
1668                         args[0] = ni->ni_mllid;
1669                         args[1] = ni->ni_mlpid;
1670                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1671                         ieee80211_send_action(ni,
1672                             IEEE80211_ACTION_CAT_MESHPEERING,
1673                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1674                             args);
1675                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1676                         mesh_peer_timeout_setup(ni);
1677                         break;
1678                 }
1679                 /* Duplicate open, confirm again. */
1680                 args[0] = ni->ni_mlpid;
1681                 args[1] = ni->ni_mllid;
1682                 ieee80211_send_action(ni,
1683                     IEEE80211_ACTION_CAT_MESHPEERING,
1684                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1685                     args);
1686                 break;
1687         case IEEE80211_NODE_MESH_OPENSNT:
1688                 ni->ni_mllid = meshpeer->peer_llinkid;
1689                 mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
1690                 args[0] = ni->ni_mlpid;
1691                 args[1] = ni->ni_mllid;
1692                 ieee80211_send_action(ni,
1693                     IEEE80211_ACTION_CAT_MESHPEERING,
1694                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1695                     args);
1696                 /* NB: don't setup/clear any timeout */
1697                 break;
1698         case IEEE80211_NODE_MESH_CONFIRMRCV:
1699                 if (ni->ni_mlpid != meshpeer->peer_linkid ||
1700                     ni->ni_mllid != meshpeer->peer_llinkid) {
1701                         args[0] = ni->ni_mlpid;
1702                         args[1] = ni->ni_mllid;
1703                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1704                         ieee80211_send_action(ni,
1705                             IEEE80211_ACTION_CAT_MESHPEERING,
1706                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1707                             args);
1708                         mesh_linkchange(ni,
1709                             IEEE80211_NODE_MESH_HOLDING);
1710                         mesh_peer_timeout_setup(ni);
1711                         break;
1712                 }
1713                 mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
1714                 ni->ni_mllid = meshpeer->peer_llinkid;
1715                 args[0] = ni->ni_mlpid;
1716                 args[1] = ni->ni_mllid;
1717                 ieee80211_send_action(ni,
1718                     IEEE80211_ACTION_CAT_MESHPEERING,
1719                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1720                     args);
1721                 mesh_peer_timeout_stop(ni);
1722                 break;
1723         case IEEE80211_NODE_MESH_ESTABLISHED:
1724                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
1725                         args[0] = ni->ni_mllid;
1726                         args[1] = ni->ni_mlpid;
1727                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1728                         ieee80211_send_action(ni,
1729                             IEEE80211_ACTION_CAT_MESHPEERING,
1730                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1731                             args);
1732                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1733                         mesh_peer_timeout_setup(ni);
1734                         break;
1735                 }
1736                 args[0] = ni->ni_mlpid;
1737                 args[1] = ni->ni_mllid;
1738                 ieee80211_send_action(ni,
1739                     IEEE80211_ACTION_CAT_MESHPEERING,
1740                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1741                     args);
1742                 break;
1743         case IEEE80211_NODE_MESH_HOLDING:
1744                 args[0] = ni->ni_mlpid;
1745                 args[1] = meshpeer->peer_llinkid;
1746                 args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
1747                 ieee80211_send_action(ni,
1748                     IEEE80211_ACTION_CAT_MESHPEERING,
1749                     IEEE80211_ACTION_MESHPEERING_CLOSE,
1750                     args);
1751                 break;
1752         }
1753         return 0;
1754 }
1755
1756 static int
1757 mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
1758         const struct ieee80211_frame *wh,
1759         const uint8_t *frm, const uint8_t *efrm)
1760 {
1761         struct ieee80211vap *vap = ni->ni_vap;
1762         struct ieee80211_meshpeer_ie ie;
1763         const struct ieee80211_meshpeer_ie *meshpeer;
1764         uint16_t args[3];
1765
1766         /* +2+2+2+2 for action + code + capabilites + status code + AID */
1767         meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
1768             IEEE80211_ACTION_MESHPEERING_CONFIRM);
1769         if (meshpeer == NULL) {
1770                 return 0;
1771         }
1772
1773         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1774             "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
1775             meshpeer->peer_llinkid, meshpeer->peer_linkid);
1776
1777         switch (ni->ni_mlstate) {
1778         case IEEE80211_NODE_MESH_OPENRCV:
1779                 mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
1780                 mesh_peer_timeout_stop(ni);
1781                 break;
1782         case IEEE80211_NODE_MESH_OPENSNT:
1783                 mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
1784                 break;
1785         case IEEE80211_NODE_MESH_HOLDING:
1786                 args[0] = ni->ni_mlpid;
1787                 args[1] = meshpeer->peer_llinkid;
1788                 args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
1789                 ieee80211_send_action(ni,
1790                     IEEE80211_ACTION_CAT_MESHPEERING,
1791                     IEEE80211_ACTION_MESHPEERING_CLOSE,
1792                     args);
1793                 break;
1794         case IEEE80211_NODE_MESH_CONFIRMRCV:
1795                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
1796                         args[0] = ni->ni_mlpid;
1797                         args[1] = ni->ni_mllid;
1798                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1799                         ieee80211_send_action(ni,
1800                             IEEE80211_ACTION_CAT_MESHPEERING,
1801                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1802                             args);
1803                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1804                         mesh_peer_timeout_setup(ni);
1805                 }
1806                 break;
1807         default:
1808                 IEEE80211_DISCARD(vap,
1809                     IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
1810                     wh, NULL, "received confirm in invalid state %d",
1811                     ni->ni_mlstate);
1812                 vap->iv_stats.is_rx_mgtdiscard++;
1813                 break;
1814         }
1815         return 0;
1816 }
1817
1818 static int
1819 mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
1820         const struct ieee80211_frame *wh,
1821         const uint8_t *frm, const uint8_t *efrm)
1822 {
1823         uint16_t args[3];
1824
1825         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
1826             ni, "%s", "recv PEER CLOSE");
1827
1828         switch (ni->ni_mlstate) {
1829         case IEEE80211_NODE_MESH_IDLE:
1830                 /* ignore */
1831                 break;
1832         case IEEE80211_NODE_MESH_OPENRCV:
1833         case IEEE80211_NODE_MESH_OPENSNT:
1834         case IEEE80211_NODE_MESH_CONFIRMRCV:
1835         case IEEE80211_NODE_MESH_ESTABLISHED:
1836                 args[0] = ni->ni_mlpid;
1837                 args[1] = ni->ni_mllid;
1838                 args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
1839                 ieee80211_send_action(ni,
1840                     IEEE80211_ACTION_CAT_MESHPEERING,
1841                     IEEE80211_ACTION_MESHPEERING_CLOSE,
1842                     args);
1843                 mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1844                 mesh_peer_timeout_setup(ni);
1845                 break;
1846         case IEEE80211_NODE_MESH_HOLDING:
1847                 mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
1848                 mesh_peer_timeout_setup(ni);
1849                 break;
1850         }
1851         return 0;
1852 }
1853
1854 /*
1855  * Link Metric handling.
1856  */
1857 static int
1858 mesh_recv_action_meshlmetric_req(struct ieee80211_node *ni,
1859         const struct ieee80211_frame *wh,
1860         const uint8_t *frm, const uint8_t *efrm)
1861 {
1862         uint32_t metric;
1863
1864         metric = mesh_airtime_calc(ni);
1865         ieee80211_send_action(ni,
1866             IEEE80211_ACTION_CAT_MESHLMETRIC,
1867             IEEE80211_ACTION_MESHLMETRIC_REP,
1868             &metric);
1869         return 0;
1870 }
1871
1872 static int
1873 mesh_recv_action_meshlmetric_rep(struct ieee80211_node *ni,
1874         const struct ieee80211_frame *wh,
1875         const uint8_t *frm, const uint8_t *efrm)
1876 {
1877         return 0;
1878 }
1879
1880 static int
1881 mesh_send_action(struct ieee80211_node *ni, struct mbuf *m)
1882 {
1883         struct ieee80211_bpf_params params;
1884
1885         memset(&params, 0, sizeof(params));
1886         params.ibp_pri = WME_AC_VO;
1887         params.ibp_rate0 = ni->ni_txparms->mgmtrate;
1888         /* XXX ucast/mcast */
1889         params.ibp_try0 = ni->ni_txparms->maxretry;
1890         params.ibp_power = ni->ni_txpower;
1891         return ieee80211_mgmt_output(ni, m, IEEE80211_FC0_SUBTYPE_ACTION,
1892              &params);
1893 }
1894
1895 #define ADDSHORT(frm, v) do {                   \
1896         frm[0] = (v) & 0xff;                    \
1897         frm[1] = (v) >> 8;                      \
1898         frm += 2;                               \
1899 } while (0)
1900 #define ADDWORD(frm, v) do {                    \
1901         frm[0] = (v) & 0xff;                    \
1902         frm[1] = ((v) >> 8) & 0xff;             \
1903         frm[2] = ((v) >> 16) & 0xff;            \
1904         frm[3] = ((v) >> 24) & 0xff;            \
1905         frm += 4;                               \
1906 } while (0)
1907
1908 static int
1909 mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
1910         int category, int action, void *args0)
1911 {
1912         struct ieee80211vap *vap = ni->ni_vap;
1913         struct ieee80211com *ic = ni->ni_ic;
1914         uint16_t *args = args0;
1915         const struct ieee80211_rateset *rs;
1916         struct mbuf *m;
1917         uint8_t *frm;
1918
1919         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1920             "send PEER OPEN action: localid 0x%x", args[0]);
1921
1922         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1923             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
1924             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
1925         ieee80211_ref_node(ni);
1926
1927         m = ieee80211_getmgtframe(&frm,
1928             ic->ic_headroom + sizeof(struct ieee80211_frame),
1929             sizeof(uint16_t)    /* action+category */
1930             + sizeof(uint16_t)  /* capabilites */
1931             + 2 + IEEE80211_RATE_SIZE
1932             + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1933             + 2 + IEEE80211_MESHID_LEN
1934             + sizeof(struct ieee80211_meshconf_ie)
1935             + sizeof(struct ieee80211_meshpeer_ie)
1936         );
1937         if (m != NULL) {
1938                 /*
1939                  * mesh peer open action frame format:
1940                  *   [1] category
1941                  *   [1] action
1942                  *   [2] capabilities
1943                  *   [tlv] rates
1944                  *   [tlv] xrates
1945                  *   [tlv] mesh id
1946                  *   [tlv] mesh conf
1947                  *   [tlv] mesh peer link mgmt
1948                  */
1949                 *frm++ = category;
1950                 *frm++ = action;
1951                 ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
1952                 rs = ieee80211_get_suprates(ic, ic->ic_curchan);
1953                 frm = ieee80211_add_rates(frm, rs);
1954                 frm = ieee80211_add_xrates(frm, rs);
1955                 frm = ieee80211_add_meshid(frm, vap);
1956                 frm = ieee80211_add_meshconf(frm, vap);
1957                 frm = ieee80211_add_meshpeer(frm, IEEE80211_MESH_PEER_LINK_OPEN,
1958                     args[0], 0, 0);
1959                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
1960                 return mesh_send_action(ni, m);
1961         } else {
1962                 vap->iv_stats.is_tx_nobuf++;
1963                 ieee80211_free_node(ni);
1964                 return ENOMEM;
1965         }
1966 }
1967
1968 static int
1969 mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
1970         int category, int action, void *args0)
1971 {
1972         struct ieee80211vap *vap = ni->ni_vap;
1973         struct ieee80211com *ic = ni->ni_ic;
1974         uint16_t *args = args0;
1975         const struct ieee80211_rateset *rs;
1976         struct mbuf *m;
1977         uint8_t *frm;
1978
1979         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1980             "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
1981             args[0], args[1]);
1982
1983         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1984             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
1985             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
1986         ieee80211_ref_node(ni);
1987
1988         m = ieee80211_getmgtframe(&frm,
1989             ic->ic_headroom + sizeof(struct ieee80211_frame),
1990             sizeof(uint16_t)    /* action+category */
1991             + sizeof(uint16_t)  /* capabilites */
1992             + sizeof(uint16_t)  /* status code */
1993             + sizeof(uint16_t)  /* AID */
1994             + 2 + IEEE80211_RATE_SIZE
1995             + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1996             + 2 + IEEE80211_MESHID_LEN
1997             + sizeof(struct ieee80211_meshconf_ie)
1998             + sizeof(struct ieee80211_meshpeer_ie)
1999         );
2000         if (m != NULL) {
2001                 /*
2002                  * mesh peer confirm action frame format:
2003                  *   [1] category
2004                  *   [1] action
2005                  *   [2] capabilities
2006                  *   [2] status code
2007                  *   [2] association id (peer ID)
2008                  *   [tlv] rates
2009                  *   [tlv] xrates
2010                  *   [tlv] mesh id
2011                  *   [tlv] mesh conf
2012                  *   [tlv] mesh peer link mgmt
2013                  */
2014                 *frm++ = category;
2015                 *frm++ = action;
2016                 ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2017                 ADDSHORT(frm, 0);               /* status code */
2018                 ADDSHORT(frm, args[1]);         /* AID */
2019                 rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2020                 frm = ieee80211_add_rates(frm, rs);
2021                 frm = ieee80211_add_xrates(frm, rs);
2022                 frm = ieee80211_add_meshid(frm, vap);
2023                 frm = ieee80211_add_meshconf(frm, vap);
2024                 frm = ieee80211_add_meshpeer(frm,
2025                     IEEE80211_MESH_PEER_LINK_CONFIRM,
2026                     args[0], args[1], 0);
2027                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2028                 return mesh_send_action(ni, m);
2029         } else {
2030                 vap->iv_stats.is_tx_nobuf++;
2031                 ieee80211_free_node(ni);
2032                 return ENOMEM;
2033         }
2034 }
2035
2036 static int
2037 mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
2038         int category, int action, void *args0)
2039 {
2040         struct ieee80211vap *vap = ni->ni_vap;
2041         struct ieee80211com *ic = ni->ni_ic;
2042         uint16_t *args = args0;
2043         struct mbuf *m;
2044         uint8_t *frm;
2045
2046         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2047             "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d",
2048             args[0], args[1], args[2]);
2049
2050         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2051             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2052             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2053         ieee80211_ref_node(ni);
2054
2055         m = ieee80211_getmgtframe(&frm,
2056             ic->ic_headroom + sizeof(struct ieee80211_frame),
2057             sizeof(uint16_t)    /* action+category */
2058             + sizeof(uint16_t)  /* reason code */
2059             + 2 + IEEE80211_MESHID_LEN
2060             + sizeof(struct ieee80211_meshpeer_ie)
2061         );
2062         if (m != NULL) {
2063                 /*
2064                  * mesh peer close action frame format:
2065                  *   [1] category
2066                  *   [1] action
2067                  *   [2] reason code
2068                  *   [tlv] mesh id
2069                  *   [tlv] mesh peer link mgmt
2070                  */
2071                 *frm++ = category;
2072                 *frm++ = action;
2073                 ADDSHORT(frm, args[2]);         /* reason code */
2074                 frm = ieee80211_add_meshid(frm, vap);
2075                 frm = ieee80211_add_meshpeer(frm,
2076                     IEEE80211_MESH_PEER_LINK_CLOSE,
2077                     args[0], args[1], args[2]);
2078                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2079                 return mesh_send_action(ni, m);
2080         } else {
2081                 vap->iv_stats.is_tx_nobuf++;
2082                 ieee80211_free_node(ni);
2083                 return ENOMEM;
2084         }
2085 }
2086
2087 static int
2088 mesh_send_action_meshlink_request(struct ieee80211_node *ni,
2089         int category, int action, void *arg0)
2090 {
2091         struct ieee80211vap *vap = ni->ni_vap;
2092         struct ieee80211com *ic = ni->ni_ic;
2093         struct mbuf *m;
2094         uint8_t *frm;
2095
2096         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2097             "%s", "send LINK METRIC REQUEST action");
2098
2099         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2100             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2101             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2102         ieee80211_ref_node(ni);
2103
2104         m = ieee80211_getmgtframe(&frm,
2105             ic->ic_headroom + sizeof(struct ieee80211_frame),
2106             sizeof(uint16_t)    /* action+category */
2107         );
2108         if (m != NULL) {
2109                 /*
2110                  * mesh link metric request
2111                  *   [1] category
2112                  *   [1] action
2113                  */
2114                 *frm++ = category;
2115                 *frm++ = action;
2116                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2117                 return mesh_send_action(ni, m);
2118         } else {
2119                 vap->iv_stats.is_tx_nobuf++;
2120                 ieee80211_free_node(ni);
2121                 return ENOMEM;
2122         }
2123 }
2124
2125 static int
2126 mesh_send_action_meshlink_reply(struct ieee80211_node *ni,
2127         int category, int action, void *args0)
2128 {
2129         struct ieee80211vap *vap = ni->ni_vap;
2130         struct ieee80211com *ic = ni->ni_ic;
2131         uint32_t *metric = args0;
2132         struct mbuf *m;
2133         uint8_t *frm;
2134
2135         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2136             "send LINK METRIC REPLY action: metric 0x%x", *metric);
2137
2138         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2139             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2140             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2141         ieee80211_ref_node(ni);
2142
2143         m = ieee80211_getmgtframe(&frm,
2144             ic->ic_headroom + sizeof(struct ieee80211_frame),
2145             sizeof(uint16_t)    /* action+category */
2146             + sizeof(struct ieee80211_meshlmetric_ie)
2147         );
2148         if (m != NULL) {
2149                 /*
2150                  * mesh link metric reply
2151                  *   [1] category
2152                  *   [1] action
2153                  *   [tlv] mesh link metric
2154                  */
2155                 *frm++ = category;
2156                 *frm++ = action;
2157                 frm = ieee80211_add_meshlmetric(frm, *metric);
2158                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2159                 return mesh_send_action(ni, m);
2160         } else {
2161                 vap->iv_stats.is_tx_nobuf++;
2162                 ieee80211_free_node(ni);
2163                 return ENOMEM;
2164         }
2165 }
2166
2167 static void
2168 mesh_peer_timeout_setup(struct ieee80211_node *ni)
2169 {
2170         switch (ni->ni_mlstate) {
2171         case IEEE80211_NODE_MESH_HOLDING:
2172                 ni->ni_mltval = ieee80211_mesh_holdingtimeout;
2173                 break;
2174         case IEEE80211_NODE_MESH_CONFIRMRCV:
2175                 ni->ni_mltval = ieee80211_mesh_confirmtimeout;
2176                 break;
2177         case IEEE80211_NODE_MESH_IDLE:
2178                 ni->ni_mltval = 0;
2179                 break;
2180         default:
2181                 ni->ni_mltval = ieee80211_mesh_retrytimeout;
2182                 break;
2183         }
2184         if (ni->ni_mltval)
2185                 callout_reset(&ni->ni_mltimer, ni->ni_mltval,
2186                     mesh_peer_timeout_cb, ni);
2187 }
2188
2189 /*
2190  * Same as above but backoffs timer statisically 50%.
2191  */
2192 static void
2193 mesh_peer_timeout_backoff(struct ieee80211_node *ni)
2194 {
2195         uint32_t r;
2196
2197         r = arc4random();
2198         ni->ni_mltval += r % ni->ni_mltval;
2199         callout_reset(&ni->ni_mltimer, ni->ni_mltval, mesh_peer_timeout_cb,
2200             ni);
2201 }
2202
2203 static __inline void
2204 mesh_peer_timeout_stop(struct ieee80211_node *ni)
2205 {
2206         callout_drain(&ni->ni_mltimer);
2207 }
2208
2209 /*
2210  * Mesh Peer Link Management FSM timeout handling.
2211  */
2212 static void
2213 mesh_peer_timeout_cb(void *arg)
2214 {
2215         struct ieee80211_node *ni = (struct ieee80211_node *)arg;
2216         uint16_t args[3];
2217
2218         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
2219             ni, "mesh link timeout, state %d, retry counter %d",
2220             ni->ni_mlstate, ni->ni_mlrcnt);
2221
2222         switch (ni->ni_mlstate) {
2223         case IEEE80211_NODE_MESH_IDLE:
2224         case IEEE80211_NODE_MESH_ESTABLISHED:
2225                 break;
2226         case IEEE80211_NODE_MESH_OPENSNT:
2227         case IEEE80211_NODE_MESH_OPENRCV:
2228                 if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
2229                         args[0] = ni->ni_mlpid;
2230                         args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
2231                         ieee80211_send_action(ni,
2232                             IEEE80211_ACTION_CAT_MESHPEERING,
2233                             IEEE80211_ACTION_MESHPEERING_CLOSE, args);
2234                         ni->ni_mlrcnt = 0;
2235                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2236                         mesh_peer_timeout_setup(ni);
2237                 } else {
2238                         args[0] = ni->ni_mlpid;
2239                         ieee80211_send_action(ni,
2240                             IEEE80211_ACTION_CAT_MESHPEERING,
2241                             IEEE80211_ACTION_MESHPEERING_OPEN, args);
2242                         ni->ni_mlrcnt++;
2243                         mesh_peer_timeout_backoff(ni);
2244                 }
2245                 break;
2246         case IEEE80211_NODE_MESH_CONFIRMRCV:
2247                 if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
2248                         args[0] = ni->ni_mlpid;
2249                         args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
2250                         ieee80211_send_action(ni,
2251                             IEEE80211_ACTION_CAT_MESHPEERING,
2252                             IEEE80211_ACTION_MESHPEERING_CLOSE, args);
2253                         ni->ni_mlrcnt = 0;
2254                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2255                         mesh_peer_timeout_setup(ni);
2256                 } else {
2257                         ni->ni_mlrcnt++;
2258                         mesh_peer_timeout_setup(ni);
2259                 }
2260                 break;
2261         case IEEE80211_NODE_MESH_HOLDING:
2262                 mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
2263                 break;
2264         }
2265 }
2266
2267 static int
2268 mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
2269 {
2270         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2271
2272         if (ie == NULL || ie[1] != ms->ms_idlen)
2273                 return 1;
2274         return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
2275 }
2276
2277 /*
2278  * Check if we are using the same algorithms for this mesh.
2279  */
2280 static int
2281 mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
2282 {
2283         const struct ieee80211_meshconf_ie *meshconf =
2284             (const struct ieee80211_meshconf_ie *) ie;
2285         const struct ieee80211_mesh_state *ms = vap->iv_mesh;
2286
2287         if (meshconf == NULL)
2288                 return 1;
2289         if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
2290                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2291                     "unknown path selection algorithm: 0x%x\n",
2292                     meshconf->conf_pselid);
2293                 return 1;
2294         }
2295         if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
2296                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2297                     "unknown path metric algorithm: 0x%x\n",
2298                     meshconf->conf_pmetid);
2299                 return 1;
2300         }
2301         if (meshconf->conf_ccid != 0) {
2302                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2303                     "unknown congestion control algorithm: 0x%x\n",
2304                     meshconf->conf_ccid);
2305                 return 1;
2306         }
2307         if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
2308                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2309                     "unknown sync algorithm: 0x%x\n",
2310                     meshconf->conf_syncid);
2311                 return 1;
2312         }
2313         if (meshconf->conf_authid != 0) {
2314                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2315                     "unknown auth auth algorithm: 0x%x\n",
2316                     meshconf->conf_pselid);
2317                 return 1;
2318         }
2319         /* Not accepting peers */
2320         if (!(meshconf->conf_cap & IEEE80211_MESHCONF_CAP_AP)) {
2321                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2322                     "not accepting peers: 0x%x\n", meshconf->conf_cap);
2323                 return 1;
2324         }
2325         return 0;
2326 }
2327
2328 static int
2329 mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
2330     const uint8_t *ie)
2331 {
2332         const struct ieee80211_meshpeer_ie *meshpeer =
2333             (const struct ieee80211_meshpeer_ie *) ie;
2334
2335         if (meshpeer == NULL || meshpeer->peer_len < 6 ||
2336             meshpeer->peer_len > 10)
2337                 return 1;
2338         switch (subtype) {
2339         case IEEE80211_MESH_PEER_LINK_OPEN:
2340                 if (meshpeer->peer_len != 6)
2341                         return 1;
2342                 break;
2343         case IEEE80211_MESH_PEER_LINK_CONFIRM:
2344                 if (meshpeer->peer_len != 8)
2345                         return 1;
2346                 break;
2347         case IEEE80211_MESH_PEER_LINK_CLOSE:
2348                 if (meshpeer->peer_len < 8)
2349                         return 1;
2350                 if (meshpeer->peer_len == 8 && meshpeer->peer_linkid != 0)
2351                         return 1;
2352                 if (meshpeer->peer_rcode == 0)
2353                         return 1;
2354                 break;
2355         }
2356         return 0;
2357 }
2358
2359 /*
2360  * Add a Mesh ID IE to a frame.
2361  */
2362 uint8_t *
2363 ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
2364 {
2365         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2366
2367         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
2368
2369         *frm++ = IEEE80211_ELEMID_MESHID;
2370         *frm++ = ms->ms_idlen;
2371         memcpy(frm, ms->ms_id, ms->ms_idlen);
2372         return frm + ms->ms_idlen;
2373 }
2374
2375 /*
2376  * Add a Mesh Configuration IE to a frame.
2377  * For now just use HWMP routing, Airtime link metric, Null Congestion
2378  * Signaling, Null Sync Protocol and Null Authentication.
2379  */
2380 uint8_t *
2381 ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
2382 {
2383         const struct ieee80211_mesh_state *ms = vap->iv_mesh;
2384
2385         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
2386
2387         *frm++ = IEEE80211_ELEMID_MESHCONF;
2388         *frm++ = sizeof(struct ieee80211_meshconf_ie) - 2;
2389         *frm++ = ms->ms_ppath->mpp_ie;          /* path selection */
2390         *frm++ = ms->ms_pmetric->mpm_ie;        /* link metric */
2391         *frm++ = IEEE80211_MESHCONF_CC_DISABLED;
2392         *frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
2393         *frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
2394         /* NB: set the number of neighbors before the rest */
2395         *frm = (ms->ms_neighbors > 15 ? 15 : ms->ms_neighbors) << 1;
2396         if (ms->ms_flags & IEEE80211_MESHFLAGS_PORTAL)
2397                 *frm |= IEEE80211_MESHCONF_FORM_MP;
2398         frm += 1;
2399         if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
2400                 *frm |= IEEE80211_MESHCONF_CAP_AP;
2401         if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
2402                 *frm |= IEEE80211_MESHCONF_CAP_FWRD;
2403         frm += 1;
2404         return frm;
2405 }
2406
2407 /*
2408  * Add a Mesh Peer Management IE to a frame.
2409  */
2410 uint8_t *
2411 ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
2412     uint16_t peerid, uint16_t reason)
2413 {
2414         /* XXX change for AH */
2415         static const uint8_t meshpeerproto[4] = IEEE80211_MESH_PEER_PROTO;
2416
2417         KASSERT(localid != 0, ("localid == 0"));
2418
2419         *frm++ = IEEE80211_ELEMID_MESHPEER;
2420         switch (subtype) {
2421         case IEEE80211_MESH_PEER_LINK_OPEN:
2422                 *frm++ = 6;             /* length */
2423                 memcpy(frm, meshpeerproto, 4);
2424                 frm += 4;
2425                 ADDSHORT(frm, localid); /* local ID */
2426                 break;
2427         case IEEE80211_MESH_PEER_LINK_CONFIRM:
2428                 KASSERT(peerid != 0, ("sending peer confirm without peer id"));
2429                 *frm++ = 8;             /* length */
2430                 memcpy(frm, meshpeerproto, 4);
2431                 frm += 4;
2432                 ADDSHORT(frm, localid); /* local ID */
2433                 ADDSHORT(frm, peerid);  /* peer ID */
2434                 break;
2435         case IEEE80211_MESH_PEER_LINK_CLOSE:
2436                 if (peerid)
2437                         *frm++ = 10;    /* length */
2438                 else
2439                         *frm++ = 8;     /* length */
2440                 memcpy(frm, meshpeerproto, 4);
2441                 frm += 4;
2442                 ADDSHORT(frm, localid); /* local ID */
2443                 if (peerid)
2444                         ADDSHORT(frm, peerid);  /* peer ID */
2445                 ADDSHORT(frm, reason);
2446                 break;
2447         }
2448         return frm;
2449 }
2450
2451 /*
2452  * Compute an Airtime Link Metric for the link with this node.
2453  *
2454  * Based on Draft 3.0 spec (11B.10, p.149).
2455  */
2456 /*
2457  * Max 802.11s overhead.
2458  */
2459 #define IEEE80211_MESH_MAXOVERHEAD \
2460         (sizeof(struct ieee80211_qosframe_addr4) \
2461          + sizeof(struct ieee80211_meshcntl_ae11) \
2462         + sizeof(struct llc) \
2463         + IEEE80211_ADDR_LEN \
2464         + IEEE80211_WEP_IVLEN \
2465         + IEEE80211_WEP_KIDLEN \
2466         + IEEE80211_WEP_CRCLEN \
2467         + IEEE80211_WEP_MICLEN \
2468         + IEEE80211_CRC_LEN)
2469 uint32_t
2470 mesh_airtime_calc(struct ieee80211_node *ni)
2471 {
2472 #define M_BITS 8
2473 #define S_FACTOR (2 * M_BITS)
2474         struct ieee80211com *ic = ni->ni_ic;
2475         struct ifnet *ifp = ni->ni_vap->iv_ifp;
2476         const static int nbits = 8192 << M_BITS;
2477         uint32_t overhead, rate, errrate;
2478         uint64_t res;
2479
2480         /* Time to transmit a frame */
2481         rate = ni->ni_txrate;
2482         overhead = ieee80211_compute_duration(ic->ic_rt,
2483             ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
2484         /* Error rate in percentage */
2485         /* XXX assuming small failures are ok */
2486         errrate = (((ifp->if_oerrors +
2487             ifp->if_ierrors) / 100) << M_BITS) / 100;
2488         res = (overhead + (nbits / rate)) *
2489             ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
2490
2491         return (uint32_t)(res >> S_FACTOR);
2492 #undef M_BITS
2493 #undef S_FACTOR
2494 }
2495
2496 /*
2497  * Add a Mesh Link Metric report IE to a frame.
2498  */
2499 uint8_t *
2500 ieee80211_add_meshlmetric(uint8_t *frm, uint32_t metric)
2501 {
2502         *frm++ = IEEE80211_ELEMID_MESHLINK;
2503         *frm++ = 4;
2504         ADDWORD(frm, metric);
2505         return frm;
2506 }
2507 #undef ADDSHORT
2508 #undef ADDWORD
2509
2510 /*
2511  * Initialize any mesh-specific node state.
2512  */
2513 void
2514 ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
2515 {
2516         ni->ni_flags |= IEEE80211_NODE_QOS;
2517         callout_init(&ni->ni_mltimer, CALLOUT_MPSAFE);
2518 }
2519
2520 /*
2521  * Cleanup any mesh-specific node state.
2522  */
2523 void
2524 ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
2525 {
2526         struct ieee80211vap *vap = ni->ni_vap;
2527         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2528
2529         callout_drain(&ni->ni_mltimer);
2530         /* NB: short-circuit callbacks after mesh_vdetach */
2531         if (vap->iv_mesh != NULL)
2532                 ms->ms_ppath->mpp_peerdown(ni);
2533 }
2534
2535 void
2536 ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
2537 {
2538         ni->ni_meshidlen = ie[1];
2539         memcpy(ni->ni_meshid, ie + 2, ie[1]);
2540 }
2541
2542 /*
2543  * Setup mesh-specific node state on neighbor discovery.
2544  */
2545 void
2546 ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
2547         const struct ieee80211_frame *wh,
2548         const struct ieee80211_scanparams *sp)
2549 {
2550         ieee80211_parse_meshid(ni, sp->meshid);
2551 }
2552
2553 void
2554 ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
2555         struct ieee80211_beacon_offsets *bo)
2556 {
2557         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
2558
2559         if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
2560                 (void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
2561                 clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
2562         }
2563 }
2564
2565 static int
2566 mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
2567 {
2568         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2569         uint8_t tmpmeshid[IEEE80211_NWID_LEN];
2570         struct ieee80211_mesh_route *rt;
2571         struct ieee80211req_mesh_route *imr;
2572         size_t len, off;
2573         uint8_t *p;
2574         int error;
2575
2576         if (vap->iv_opmode != IEEE80211_M_MBSS)
2577                 return ENOSYS;
2578
2579         error = 0;
2580         switch (ireq->i_type) {
2581         case IEEE80211_IOC_MESH_ID:
2582                 ireq->i_len = ms->ms_idlen;
2583                 memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
2584                 error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
2585                 break;
2586         case IEEE80211_IOC_MESH_AP:
2587                 ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
2588                 break;
2589         case IEEE80211_IOC_MESH_FWRD:
2590                 ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
2591                 break;
2592         case IEEE80211_IOC_MESH_TTL:
2593                 ireq->i_val = ms->ms_ttl;
2594                 break;
2595         case IEEE80211_IOC_MESH_RTCMD:
2596                 switch (ireq->i_val) {
2597                 case IEEE80211_MESH_RTCMD_LIST:
2598                         len = 0;
2599                         MESH_RT_LOCK(ms);
2600                         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
2601                                 len += sizeof(*imr);
2602                         }
2603                         MESH_RT_UNLOCK(ms);
2604                         if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
2605                                 ireq->i_len = len;
2606                                 return ENOMEM;
2607                         }
2608                         ireq->i_len = len;
2609                         /* XXX M_WAIT? */
2610                         p = malloc(len, M_TEMP, M_NOWAIT | M_ZERO);
2611                         if (p == NULL)
2612                                 return ENOMEM;
2613                         off = 0;
2614                         MESH_RT_LOCK(ms);
2615                         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
2616                                 if (off >= len)
2617                                         break;
2618                                 imr = (struct ieee80211req_mesh_route *)
2619                                     (p + off);
2620                                 imr->imr_flags = rt->rt_flags;
2621                                 IEEE80211_ADDR_COPY(imr->imr_dest,
2622                                     rt->rt_dest);
2623                                 IEEE80211_ADDR_COPY(imr->imr_nexthop,
2624                                     rt->rt_nexthop);
2625                                 imr->imr_metric = rt->rt_metric;
2626                                 imr->imr_nhops = rt->rt_nhops;
2627                                 imr->imr_lifetime = rt->rt_lifetime;
2628                                 imr->imr_lastmseq = rt->rt_lastmseq;
2629                                 off += sizeof(*imr);
2630                         }
2631                         MESH_RT_UNLOCK(ms);
2632                         error = copyout(p, (uint8_t *)ireq->i_data,
2633                             ireq->i_len);
2634                         free(p, M_TEMP);
2635                         break;
2636                 case IEEE80211_MESH_RTCMD_FLUSH:
2637                 case IEEE80211_MESH_RTCMD_ADD:
2638                 case IEEE80211_MESH_RTCMD_DELETE:
2639                         return EINVAL;
2640                 default:
2641                         return ENOSYS;
2642                 }
2643                 break;
2644         case IEEE80211_IOC_MESH_PR_METRIC:
2645                 len = strlen(ms->ms_pmetric->mpm_descr);
2646                 if (ireq->i_len < len)
2647                         return EINVAL;
2648                 ireq->i_len = len;
2649                 error = copyout(ms->ms_pmetric->mpm_descr,
2650                     (uint8_t *)ireq->i_data, len);
2651                 break;
2652         case IEEE80211_IOC_MESH_PR_PATH:
2653                 len = strlen(ms->ms_ppath->mpp_descr);
2654                 if (ireq->i_len < len)
2655                         return EINVAL;
2656                 ireq->i_len = len;
2657                 error = copyout(ms->ms_ppath->mpp_descr,
2658                     (uint8_t *)ireq->i_data, len);
2659                 break;
2660         default:
2661                 return ENOSYS;
2662         }
2663
2664         return error;
2665 }
2666 IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
2667
2668 static int
2669 mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
2670 {
2671         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2672         uint8_t tmpmeshid[IEEE80211_NWID_LEN];
2673         uint8_t tmpaddr[IEEE80211_ADDR_LEN];
2674         char tmpproto[IEEE80211_MESH_PROTO_DSZ];
2675         int error;
2676
2677         if (vap->iv_opmode != IEEE80211_M_MBSS)
2678                 return ENOSYS;
2679
2680         error = 0;
2681         switch (ireq->i_type) {
2682         case IEEE80211_IOC_MESH_ID:
2683                 if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
2684                         return EINVAL;
2685                 error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
2686                 if (error != 0)
2687                         break;
2688                 memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
2689                 ms->ms_idlen = ireq->i_len;
2690                 memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
2691                 error = ENETRESET;
2692                 break;
2693         case IEEE80211_IOC_MESH_AP:
2694                 if (ireq->i_val)
2695                         ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
2696                 else
2697                         ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
2698                 error = ENETRESET;
2699                 break;
2700         case IEEE80211_IOC_MESH_FWRD:
2701                 if (ireq->i_val)
2702                         ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
2703                 else
2704                         ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
2705                 break;
2706         case IEEE80211_IOC_MESH_TTL:
2707                 ms->ms_ttl = (uint8_t) ireq->i_val;
2708                 break;
2709         case IEEE80211_IOC_MESH_RTCMD:
2710                 switch (ireq->i_val) {
2711                 case IEEE80211_MESH_RTCMD_LIST:
2712                         return EINVAL;
2713                 case IEEE80211_MESH_RTCMD_FLUSH:
2714                         ieee80211_mesh_rt_flush(vap);
2715                         break;
2716                 case IEEE80211_MESH_RTCMD_ADD:
2717                         if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||
2718                             IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))
2719                                 return EINVAL;
2720                         error = copyin(ireq->i_data, &tmpaddr,
2721                             IEEE80211_ADDR_LEN);
2722                         if (error == 0)
2723                                 ieee80211_mesh_discover(vap, tmpaddr, NULL);
2724                         break;
2725                 case IEEE80211_MESH_RTCMD_DELETE:
2726                         ieee80211_mesh_rt_del(vap, ireq->i_data);
2727                         break;
2728                 default:
2729                         return ENOSYS;
2730                 }
2731                 break;
2732         case IEEE80211_IOC_MESH_PR_METRIC:
2733                 error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
2734                 if (error == 0) {
2735                         error = mesh_select_proto_metric(vap, tmpproto);
2736                         if (error == 0)
2737                                 error = ENETRESET;
2738                 }
2739                 break;
2740         case IEEE80211_IOC_MESH_PR_PATH:
2741                 error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
2742                 if (error == 0) {
2743                         error = mesh_select_proto_path(vap, tmpproto);
2744                         if (error == 0)
2745                                 error = ENETRESET;
2746                 }
2747                 break;
2748         default:
2749                 return ENOSYS;
2750         }
2751         return error;
2752 }
2753 IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);