xref: /freebsd/sys/net80211/ieee80211_mesh.c (revision 96283082bb8908832b55db28428c24d83414d9da)
159aa14a9SRui Paulo /*-
259aa14a9SRui Paulo  * Copyright (c) 2009 The FreeBSD Foundation
359aa14a9SRui Paulo  * All rights reserved.
459aa14a9SRui Paulo  *
559aa14a9SRui Paulo  * This software was developed by Rui Paulo under sponsorship from the
659aa14a9SRui Paulo  * FreeBSD Foundation.
759aa14a9SRui Paulo  *
859aa14a9SRui Paulo  * Redistribution and use in source and binary forms, with or without
959aa14a9SRui Paulo  * modification, are permitted provided that the following conditions
1059aa14a9SRui Paulo  * are met:
1159aa14a9SRui Paulo  * 1. Redistributions of source code must retain the above copyright
1259aa14a9SRui Paulo  *    notice, this list of conditions and the following disclaimer.
1359aa14a9SRui Paulo  * 2. Redistributions in binary form must reproduce the above copyright
1459aa14a9SRui Paulo  *    notice, this list of conditions and the following disclaimer in the
1559aa14a9SRui Paulo  *    documentation and/or other materials provided with the distribution.
1659aa14a9SRui Paulo  *
1759aa14a9SRui Paulo  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
1859aa14a9SRui Paulo  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1959aa14a9SRui Paulo  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2059aa14a9SRui Paulo  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
2159aa14a9SRui Paulo  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
2259aa14a9SRui Paulo  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
2359aa14a9SRui Paulo  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2459aa14a9SRui Paulo  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2559aa14a9SRui Paulo  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2659aa14a9SRui Paulo  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
2759aa14a9SRui Paulo  * SUCH DAMAGE.
2859aa14a9SRui Paulo  */
2959aa14a9SRui Paulo #include <sys/cdefs.h>
3059aa14a9SRui Paulo #ifdef __FreeBSD__
3159aa14a9SRui Paulo __FBSDID("$FreeBSD$");
3259aa14a9SRui Paulo #endif
3359aa14a9SRui Paulo 
3459aa14a9SRui Paulo /*
3559aa14a9SRui Paulo  * IEEE 802.11s Mesh Point (MBSS) support.
3659aa14a9SRui Paulo  *
3759aa14a9SRui Paulo  * Based on March 2009, D3.0 802.11s draft spec.
3859aa14a9SRui Paulo  */
3959aa14a9SRui Paulo #include "opt_inet.h"
4059aa14a9SRui Paulo #include "opt_wlan.h"
4159aa14a9SRui Paulo 
4259aa14a9SRui Paulo #include <sys/param.h>
4359aa14a9SRui Paulo #include <sys/systm.h>
4459aa14a9SRui Paulo #include <sys/mbuf.h>
4559aa14a9SRui Paulo #include <sys/malloc.h>
4659aa14a9SRui Paulo #include <sys/kernel.h>
4759aa14a9SRui Paulo 
4859aa14a9SRui Paulo #include <sys/socket.h>
4959aa14a9SRui Paulo #include <sys/sockio.h>
5059aa14a9SRui Paulo #include <sys/endian.h>
5159aa14a9SRui Paulo #include <sys/errno.h>
5259aa14a9SRui Paulo #include <sys/proc.h>
5359aa14a9SRui Paulo #include <sys/sysctl.h>
5459aa14a9SRui Paulo 
5559aa14a9SRui Paulo #include <net/if.h>
5659aa14a9SRui Paulo #include <net/if_media.h>
5759aa14a9SRui Paulo #include <net/if_llc.h>
5859aa14a9SRui Paulo #include <net/ethernet.h>
5959aa14a9SRui Paulo 
6059aa14a9SRui Paulo #include <net80211/ieee80211_var.h>
6159aa14a9SRui Paulo #include <net80211/ieee80211_action.h>
6259aa14a9SRui Paulo #include <net80211/ieee80211_input.h>
6359aa14a9SRui Paulo #include <net80211/ieee80211_mesh.h>
6459aa14a9SRui Paulo 
65c104cff2SRui Paulo static void	mesh_rt_flush_invalid(struct ieee80211vap *);
6659aa14a9SRui Paulo static int	mesh_select_proto_path(struct ieee80211vap *, const char *);
6759aa14a9SRui Paulo static int	mesh_select_proto_metric(struct ieee80211vap *, const char *);
6859aa14a9SRui Paulo static void	mesh_vattach(struct ieee80211vap *);
6959aa14a9SRui Paulo static int	mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
70c104cff2SRui Paulo static void	mesh_rt_cleanup_cb(void *);
71aec0289dSRui Paulo static void	mesh_linkchange(struct ieee80211_node *,
7259aa14a9SRui Paulo 		    enum ieee80211_mesh_mlstate);
7359aa14a9SRui Paulo static void	mesh_checkid(void *, struct ieee80211_node *);
7459aa14a9SRui Paulo static uint32_t	mesh_generateid(struct ieee80211vap *);
7559aa14a9SRui Paulo static int	mesh_checkpseq(struct ieee80211vap *,
7659aa14a9SRui Paulo 		    const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
7759aa14a9SRui Paulo static struct ieee80211_node *
7859aa14a9SRui Paulo 		mesh_find_txnode(struct ieee80211vap *,
7959aa14a9SRui Paulo 		    const uint8_t [IEEE80211_ADDR_LEN]);
8059aa14a9SRui Paulo static void	mesh_forward(struct ieee80211vap *, struct mbuf *,
8159aa14a9SRui Paulo 		    const struct ieee80211_meshcntl *);
8259aa14a9SRui Paulo static int	mesh_input(struct ieee80211_node *, struct mbuf *, int, int);
8359aa14a9SRui Paulo static void	mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
8459aa14a9SRui Paulo 		    int, int);
850917631fSRui Paulo static void	mesh_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
8659aa14a9SRui Paulo static void	mesh_peer_timeout_setup(struct ieee80211_node *);
8759aa14a9SRui Paulo static void	mesh_peer_timeout_backoff(struct ieee80211_node *);
8859aa14a9SRui Paulo static void	mesh_peer_timeout_cb(void *);
8959aa14a9SRui Paulo static __inline void
9059aa14a9SRui Paulo 		mesh_peer_timeout_stop(struct ieee80211_node *);
9159aa14a9SRui Paulo static int	mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
9259aa14a9SRui Paulo static int	mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
93c77735e2SRui Paulo static int	mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
94c77735e2SRui Paulo     		    const uint8_t *);
9559aa14a9SRui Paulo uint32_t	mesh_airtime_calc(struct ieee80211_node *);
9659aa14a9SRui Paulo 
9759aa14a9SRui Paulo /*
9859aa14a9SRui Paulo  * Timeout values come from the specification and are in milliseconds.
9959aa14a9SRui Paulo  */
10059aa14a9SRui Paulo SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
10159aa14a9SRui Paulo     "IEEE 802.11s parameters");
10259aa14a9SRui Paulo static int ieee80211_mesh_retrytimeout = -1;
10359aa14a9SRui Paulo SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT | CTLFLAG_RW,
10459aa14a9SRui Paulo     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
10559aa14a9SRui Paulo     "Retry timeout (msec)");
10659aa14a9SRui Paulo static int ieee80211_mesh_holdingtimeout = -1;
10759aa14a9SRui Paulo SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT | CTLFLAG_RW,
10859aa14a9SRui Paulo     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
10959aa14a9SRui Paulo     "Holding state timeout (msec)");
11059aa14a9SRui Paulo static int ieee80211_mesh_confirmtimeout = -1;
11159aa14a9SRui Paulo SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT | CTLFLAG_RW,
11259aa14a9SRui Paulo     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
11359aa14a9SRui Paulo     "Confirm state timeout (msec)");
11459aa14a9SRui Paulo static int ieee80211_mesh_maxretries = 2;
11559aa14a9SRui Paulo SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLTYPE_INT | CTLFLAG_RW,
11659aa14a9SRui Paulo     &ieee80211_mesh_maxretries, 0,
11759aa14a9SRui Paulo     "Maximum retries during peer link establishment");
11859aa14a9SRui Paulo 
11959aa14a9SRui Paulo static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
12059aa14a9SRui Paulo 	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
12159aa14a9SRui Paulo 
12259aa14a9SRui Paulo static	ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
12359aa14a9SRui Paulo static	ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
12459aa14a9SRui Paulo static	ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
12559aa14a9SRui Paulo static	ieee80211_recv_action_func mesh_recv_action_meshlmetric_req;
12659aa14a9SRui Paulo static	ieee80211_recv_action_func mesh_recv_action_meshlmetric_rep;
12759aa14a9SRui Paulo 
12859aa14a9SRui Paulo static	ieee80211_send_action_func mesh_send_action_meshpeering_open;
12959aa14a9SRui Paulo static	ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
13059aa14a9SRui Paulo static	ieee80211_send_action_func mesh_send_action_meshpeering_close;
13159aa14a9SRui Paulo static	ieee80211_send_action_func mesh_send_action_meshlink_request;
13259aa14a9SRui Paulo static	ieee80211_send_action_func mesh_send_action_meshlink_reply;
13359aa14a9SRui Paulo 
13459aa14a9SRui Paulo static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
13559aa14a9SRui Paulo 	.mpm_descr	= "AIRTIME",
1366b8c1829SRui Paulo 	.mpm_ie		= IEEE80211_MESHCONF_METRIC_AIRTIME,
13759aa14a9SRui Paulo 	.mpm_metric	= mesh_airtime_calc,
13859aa14a9SRui Paulo };
13959aa14a9SRui Paulo 
14059aa14a9SRui Paulo static struct ieee80211_mesh_proto_path		mesh_proto_paths[4];
14159aa14a9SRui Paulo static struct ieee80211_mesh_proto_metric	mesh_proto_metrics[4];
14259aa14a9SRui Paulo 
14359aa14a9SRui Paulo #define	MESH_RT_LOCK(ms)	mtx_lock(&(ms)->ms_rt_lock)
144c104cff2SRui Paulo #define	MESH_RT_LOCK_ASSERT(ms)	mtx_assert(&(ms)->ms_rt_lock, MA_OWNED)
14559aa14a9SRui Paulo #define	MESH_RT_UNLOCK(ms)	mtx_unlock(&(ms)->ms_rt_lock)
14659aa14a9SRui Paulo 
14759aa14a9SRui Paulo MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh", "802.11s routing table");
14859aa14a9SRui Paulo 
14959aa14a9SRui Paulo /*
15059aa14a9SRui Paulo  * Helper functions to manipulate the Mesh routing table.
15159aa14a9SRui Paulo  */
152c104cff2SRui Paulo 
153c104cff2SRui Paulo static struct ieee80211_mesh_route *
154c104cff2SRui Paulo mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
155c104cff2SRui Paulo     const uint8_t dest[IEEE80211_ADDR_LEN])
156c104cff2SRui Paulo {
157c104cff2SRui Paulo 	struct ieee80211_mesh_route *rt;
158c104cff2SRui Paulo 
159c104cff2SRui Paulo 	MESH_RT_LOCK_ASSERT(ms);
160c104cff2SRui Paulo 
161c104cff2SRui Paulo 	TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
162c104cff2SRui Paulo 		if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
163c104cff2SRui Paulo 			return rt;
164c104cff2SRui Paulo 	}
165c104cff2SRui Paulo 	return NULL;
166c104cff2SRui Paulo }
167c104cff2SRui Paulo 
168c104cff2SRui Paulo static struct ieee80211_mesh_route *
169c104cff2SRui Paulo mesh_rt_add_locked(struct ieee80211_mesh_state *ms,
170c104cff2SRui Paulo     const uint8_t dest[IEEE80211_ADDR_LEN])
171c104cff2SRui Paulo {
172c104cff2SRui Paulo 	struct ieee80211_mesh_route *rt;
173c104cff2SRui Paulo 
174c104cff2SRui Paulo 	KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
175c104cff2SRui Paulo 	    ("%s: adding broadcast to the routing table", __func__));
176c104cff2SRui Paulo 
177c104cff2SRui Paulo 	MESH_RT_LOCK_ASSERT(ms);
178c104cff2SRui Paulo 
179c104cff2SRui Paulo 	rt = malloc(ALIGN(sizeof(struct ieee80211_mesh_route)) +
180c104cff2SRui Paulo 	    ms->ms_ppath->mpp_privlen, M_80211_MESH_RT, M_NOWAIT | M_ZERO);
181c104cff2SRui Paulo 	if (rt != NULL) {
182c104cff2SRui Paulo 		IEEE80211_ADDR_COPY(rt->rt_dest, dest);
183c104cff2SRui Paulo 		rt->rt_priv = (void *)ALIGN(&rt[1]);
184e50821abSSam Leffler 		rt->rt_crtime = ticks;
185c104cff2SRui Paulo 		TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
186c104cff2SRui Paulo 	}
187c104cff2SRui Paulo 	return rt;
188c104cff2SRui Paulo }
189c104cff2SRui Paulo 
19059aa14a9SRui Paulo struct ieee80211_mesh_route *
19159aa14a9SRui Paulo ieee80211_mesh_rt_find(struct ieee80211vap *vap,
19259aa14a9SRui Paulo     const uint8_t dest[IEEE80211_ADDR_LEN])
19359aa14a9SRui Paulo {
19459aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
19559aa14a9SRui Paulo 	struct ieee80211_mesh_route *rt;
19659aa14a9SRui Paulo 
19759aa14a9SRui Paulo 	MESH_RT_LOCK(ms);
198c104cff2SRui Paulo 	rt = mesh_rt_find_locked(ms, dest);
19959aa14a9SRui Paulo 	MESH_RT_UNLOCK(ms);
20059aa14a9SRui Paulo 	return rt;
20159aa14a9SRui Paulo }
20259aa14a9SRui Paulo 
20359aa14a9SRui Paulo struct ieee80211_mesh_route *
20459aa14a9SRui Paulo ieee80211_mesh_rt_add(struct ieee80211vap *vap,
20559aa14a9SRui Paulo     const uint8_t dest[IEEE80211_ADDR_LEN])
20659aa14a9SRui Paulo {
20759aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
20859aa14a9SRui Paulo 	struct ieee80211_mesh_route *rt;
20959aa14a9SRui Paulo 
21059aa14a9SRui Paulo 	KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
21159aa14a9SRui Paulo 	    ("%s: duplicate entry in the routing table", __func__));
21259aa14a9SRui Paulo 	KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
21359aa14a9SRui Paulo 	    ("%s: adding self to the routing table", __func__));
21459aa14a9SRui Paulo 
21559aa14a9SRui Paulo 	MESH_RT_LOCK(ms);
216c104cff2SRui Paulo 	rt = mesh_rt_add_locked(ms, dest);
21759aa14a9SRui Paulo 	MESH_RT_UNLOCK(ms);
21859aa14a9SRui Paulo 	return rt;
21959aa14a9SRui Paulo }
22059aa14a9SRui Paulo 
221c104cff2SRui Paulo /*
222c104cff2SRui Paulo  * Add a proxy route (as needed) for the specified destination.
223c104cff2SRui Paulo  */
224c104cff2SRui Paulo void
225c104cff2SRui Paulo ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
226c104cff2SRui Paulo     const uint8_t dest[IEEE80211_ADDR_LEN])
227c104cff2SRui Paulo {
228c104cff2SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
229c104cff2SRui Paulo 	struct ieee80211_mesh_route *rt;
230c104cff2SRui Paulo 
231c104cff2SRui Paulo 	MESH_RT_LOCK(ms);
232c104cff2SRui Paulo 	rt = mesh_rt_find_locked(ms, dest);
233c104cff2SRui Paulo 	if (rt == NULL) {
234c104cff2SRui Paulo 		rt = mesh_rt_add_locked(ms, dest);
235c104cff2SRui Paulo 		if (rt == NULL) {
236c104cff2SRui Paulo 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
237c104cff2SRui Paulo 			    "%s", "unable to add proxy entry");
238c104cff2SRui Paulo 			vap->iv_stats.is_mesh_rtaddfailed++;
239c104cff2SRui Paulo 		} else {
2403ca80f0dSRui Paulo 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
2413ca80f0dSRui Paulo 			    "%s", "add proxy entry");
242c104cff2SRui Paulo 			IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
243c104cff2SRui Paulo 			rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
244c104cff2SRui Paulo 				     |  IEEE80211_MESHRT_FLAGS_PROXY;
245c104cff2SRui Paulo 		}
246c104cff2SRui Paulo 	/* XXX assert PROXY? */
247c104cff2SRui Paulo 	} else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
248c104cff2SRui Paulo 		struct ieee80211com *ic = vap->iv_ic;
249c104cff2SRui Paulo 		/*
250c104cff2SRui Paulo 		 * Fix existing entry created by received frames from
251c104cff2SRui Paulo 		 * stations that have some memory of dest.  We also
252c104cff2SRui Paulo 		 * flush any frames held on the staging queue; delivering
253c104cff2SRui Paulo 		 * them is too much trouble right now.
254c104cff2SRui Paulo 		 */
255c104cff2SRui Paulo 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
256c104cff2SRui Paulo 		    "%s", "fix proxy entry");
257c104cff2SRui Paulo 		IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
258c104cff2SRui Paulo 		rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
259c104cff2SRui Paulo 			     |  IEEE80211_MESHRT_FLAGS_PROXY;
260c104cff2SRui Paulo 		/* XXX belongs in hwmp */
261c104cff2SRui Paulo 		ieee80211_ageq_drain_node(&ic->ic_stageq,
262c104cff2SRui Paulo 		   (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
263c104cff2SRui Paulo 		/* XXX stat? */
264c104cff2SRui Paulo 	}
265c104cff2SRui Paulo 	MESH_RT_UNLOCK(ms);
266c104cff2SRui Paulo }
267c104cff2SRui Paulo 
268c104cff2SRui Paulo static __inline void
269c104cff2SRui Paulo mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
270c104cff2SRui Paulo {
271c104cff2SRui Paulo 	TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
272c104cff2SRui Paulo 	free(rt, M_80211_MESH_RT);
273c104cff2SRui Paulo }
274c104cff2SRui Paulo 
27559aa14a9SRui Paulo void
27659aa14a9SRui Paulo ieee80211_mesh_rt_del(struct ieee80211vap *vap,
27759aa14a9SRui Paulo     const uint8_t dest[IEEE80211_ADDR_LEN])
27859aa14a9SRui Paulo {
27959aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
28059aa14a9SRui Paulo 	struct ieee80211_mesh_route *rt, *next;
28159aa14a9SRui Paulo 
28259aa14a9SRui Paulo 	MESH_RT_LOCK(ms);
28359aa14a9SRui Paulo 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
28459aa14a9SRui Paulo 		if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
285c104cff2SRui Paulo 			mesh_rt_del(ms, rt);
28659aa14a9SRui Paulo 			MESH_RT_UNLOCK(ms);
28759aa14a9SRui Paulo 			return;
28859aa14a9SRui Paulo 		}
28959aa14a9SRui Paulo 	}
29059aa14a9SRui Paulo 	MESH_RT_UNLOCK(ms);
29159aa14a9SRui Paulo }
29259aa14a9SRui Paulo 
29359aa14a9SRui Paulo void
29459aa14a9SRui Paulo ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
29559aa14a9SRui Paulo {
29659aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
29759aa14a9SRui Paulo 	struct ieee80211_mesh_route *rt, *next;
29859aa14a9SRui Paulo 
29959aa14a9SRui Paulo 	if (ms == NULL)
30059aa14a9SRui Paulo 		return;
30159aa14a9SRui Paulo 	MESH_RT_LOCK(ms);
302c104cff2SRui Paulo 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next)
303c104cff2SRui Paulo 		mesh_rt_del(ms, rt);
304c104cff2SRui Paulo 	MESH_RT_UNLOCK(ms);
305c104cff2SRui Paulo }
306c104cff2SRui Paulo 
3073ca80f0dSRui Paulo void
3083ca80f0dSRui Paulo ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
3093ca80f0dSRui Paulo     const uint8_t peer[IEEE80211_ADDR_LEN])
3103ca80f0dSRui Paulo {
3113ca80f0dSRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3123ca80f0dSRui Paulo 	struct ieee80211_mesh_route *rt, *next;
3133ca80f0dSRui Paulo 
3143ca80f0dSRui Paulo 	MESH_RT_LOCK(ms);
3153ca80f0dSRui Paulo 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
3163ca80f0dSRui Paulo 		if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
3173ca80f0dSRui Paulo 			mesh_rt_del(ms, rt);
3183ca80f0dSRui Paulo 	}
3193ca80f0dSRui Paulo 	MESH_RT_UNLOCK(ms);
3203ca80f0dSRui Paulo }
3213ca80f0dSRui Paulo 
322c104cff2SRui Paulo /*
323c104cff2SRui Paulo  * Flush expired routing entries, i.e. those in invalid state for
324c104cff2SRui Paulo  * some time.
325c104cff2SRui Paulo  */
326c104cff2SRui Paulo static void
327c104cff2SRui Paulo mesh_rt_flush_invalid(struct ieee80211vap *vap)
328c104cff2SRui Paulo {
329c104cff2SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
330c104cff2SRui Paulo 	struct ieee80211_mesh_route *rt, *next;
331c104cff2SRui Paulo 
332c104cff2SRui Paulo 	if (ms == NULL)
333c104cff2SRui Paulo 		return;
334c104cff2SRui Paulo 	MESH_RT_LOCK(ms);
33559aa14a9SRui Paulo 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
336c104cff2SRui Paulo 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 &&
337e50821abSSam Leffler 		    ticks - rt->rt_crtime >= ms->ms_ppath->mpp_inact)
338c104cff2SRui Paulo 			mesh_rt_del(ms, rt);
33959aa14a9SRui Paulo 	}
34059aa14a9SRui Paulo 	MESH_RT_UNLOCK(ms);
34159aa14a9SRui Paulo }
34259aa14a9SRui Paulo 
34359aa14a9SRui Paulo #define	N(a)	(sizeof(a) / sizeof(a[0]))
34459aa14a9SRui Paulo int
34559aa14a9SRui Paulo ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
34659aa14a9SRui Paulo {
34759aa14a9SRui Paulo 	int i, firstempty = -1;
34859aa14a9SRui Paulo 
34959aa14a9SRui Paulo 	for (i = 0; i < N(mesh_proto_paths); i++) {
3506b8c1829SRui Paulo 		if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
3516b8c1829SRui Paulo 		    IEEE80211_MESH_PROTO_DSZ) == 0)
35259aa14a9SRui Paulo 			return EEXIST;
3536b8c1829SRui Paulo 		if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
35459aa14a9SRui Paulo 			firstempty = i;
35559aa14a9SRui Paulo 	}
35659aa14a9SRui Paulo 	if (firstempty < 0)
35759aa14a9SRui Paulo 		return ENOSPC;
35859aa14a9SRui Paulo 	memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
3596b8c1829SRui Paulo 	mesh_proto_paths[firstempty].mpp_active = 1;
36059aa14a9SRui Paulo 	return 0;
36159aa14a9SRui Paulo }
36259aa14a9SRui Paulo 
36359aa14a9SRui Paulo int
36459aa14a9SRui Paulo ieee80211_mesh_register_proto_metric(const struct
36559aa14a9SRui Paulo     ieee80211_mesh_proto_metric *mpm)
36659aa14a9SRui Paulo {
36759aa14a9SRui Paulo 	int i, firstempty = -1;
36859aa14a9SRui Paulo 
36959aa14a9SRui Paulo 	for (i = 0; i < N(mesh_proto_metrics); i++) {
3706b8c1829SRui Paulo 		if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
3716b8c1829SRui Paulo 		    IEEE80211_MESH_PROTO_DSZ) == 0)
37259aa14a9SRui Paulo 			return EEXIST;
3736b8c1829SRui Paulo 		if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
37459aa14a9SRui Paulo 			firstempty = i;
37559aa14a9SRui Paulo 	}
37659aa14a9SRui Paulo 	if (firstempty < 0)
37759aa14a9SRui Paulo 		return ENOSPC;
37859aa14a9SRui Paulo 	memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
3796b8c1829SRui Paulo 	mesh_proto_metrics[firstempty].mpm_active = 1;
38059aa14a9SRui Paulo 	return 0;
38159aa14a9SRui Paulo }
38259aa14a9SRui Paulo 
38359aa14a9SRui Paulo static int
38459aa14a9SRui Paulo mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
38559aa14a9SRui Paulo {
38659aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
38759aa14a9SRui Paulo 	int i;
38859aa14a9SRui Paulo 
38959aa14a9SRui Paulo 	for (i = 0; i < N(mesh_proto_paths); i++) {
39059aa14a9SRui Paulo 		if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
39159aa14a9SRui Paulo 			ms->ms_ppath = &mesh_proto_paths[i];
39259aa14a9SRui Paulo 			return 0;
39359aa14a9SRui Paulo 		}
39459aa14a9SRui Paulo 	}
39559aa14a9SRui Paulo 	return ENOENT;
39659aa14a9SRui Paulo }
39759aa14a9SRui Paulo 
39859aa14a9SRui Paulo static int
39959aa14a9SRui Paulo mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
40059aa14a9SRui Paulo {
40159aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
40259aa14a9SRui Paulo 	int i;
40359aa14a9SRui Paulo 
40459aa14a9SRui Paulo 	for (i = 0; i < N(mesh_proto_metrics); i++) {
40559aa14a9SRui Paulo 		if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
40659aa14a9SRui Paulo 			ms->ms_pmetric = &mesh_proto_metrics[i];
40759aa14a9SRui Paulo 			return 0;
40859aa14a9SRui Paulo 		}
40959aa14a9SRui Paulo 	}
41059aa14a9SRui Paulo 	return ENOENT;
41159aa14a9SRui Paulo }
41259aa14a9SRui Paulo #undef	N
41359aa14a9SRui Paulo 
41459aa14a9SRui Paulo static void
41559aa14a9SRui Paulo ieee80211_mesh_init(void)
41659aa14a9SRui Paulo {
41759aa14a9SRui Paulo 
41859aa14a9SRui Paulo 	memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
41959aa14a9SRui Paulo 	memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
42059aa14a9SRui Paulo 
42159aa14a9SRui Paulo 	/*
42259aa14a9SRui Paulo 	 * Setup mesh parameters that depends on the clock frequency.
42359aa14a9SRui Paulo 	 */
42459aa14a9SRui Paulo 	ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
42559aa14a9SRui Paulo 	ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
42659aa14a9SRui Paulo 	ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
42759aa14a9SRui Paulo 
42859aa14a9SRui Paulo 	/*
42959aa14a9SRui Paulo 	 * Register action frame handlers.
43059aa14a9SRui Paulo 	 */
43159aa14a9SRui Paulo 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
43259aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_OPEN,
43359aa14a9SRui Paulo 	    mesh_recv_action_meshpeering_open);
43459aa14a9SRui Paulo 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
43559aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
43659aa14a9SRui Paulo 	    mesh_recv_action_meshpeering_confirm);
43759aa14a9SRui Paulo 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
43859aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
43959aa14a9SRui Paulo 	    mesh_recv_action_meshpeering_close);
44059aa14a9SRui Paulo 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
44159aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHLMETRIC_REQ, mesh_recv_action_meshlmetric_req);
44259aa14a9SRui Paulo 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
44359aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHLMETRIC_REP, mesh_recv_action_meshlmetric_rep);
44459aa14a9SRui Paulo 
44559aa14a9SRui Paulo 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
44659aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_OPEN,
44759aa14a9SRui Paulo 	    mesh_send_action_meshpeering_open);
44859aa14a9SRui Paulo 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
44959aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
45059aa14a9SRui Paulo 	    mesh_send_action_meshpeering_confirm);
45159aa14a9SRui Paulo 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
45259aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
45359aa14a9SRui Paulo 	    mesh_send_action_meshpeering_close);
45459aa14a9SRui Paulo 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
45559aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHLMETRIC_REQ,
45659aa14a9SRui Paulo 	    mesh_send_action_meshlink_request);
45759aa14a9SRui Paulo 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
45859aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHLMETRIC_REP,
45959aa14a9SRui Paulo 	    mesh_send_action_meshlink_reply);
46059aa14a9SRui Paulo 
46159aa14a9SRui Paulo 	/*
46259aa14a9SRui Paulo 	 * Register Airtime Link Metric.
46359aa14a9SRui Paulo 	 */
46459aa14a9SRui Paulo 	ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
46559aa14a9SRui Paulo 
46659aa14a9SRui Paulo }
46759aa14a9SRui Paulo SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
46859aa14a9SRui Paulo 
46959aa14a9SRui Paulo void
47059aa14a9SRui Paulo ieee80211_mesh_attach(struct ieee80211com *ic)
47159aa14a9SRui Paulo {
47259aa14a9SRui Paulo 	ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
47359aa14a9SRui Paulo }
47459aa14a9SRui Paulo 
47559aa14a9SRui Paulo void
47659aa14a9SRui Paulo ieee80211_mesh_detach(struct ieee80211com *ic)
47759aa14a9SRui Paulo {
47859aa14a9SRui Paulo }
47959aa14a9SRui Paulo 
48059aa14a9SRui Paulo static void
48159aa14a9SRui Paulo mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
48259aa14a9SRui Paulo {
48359aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
48459aa14a9SRui Paulo 	uint16_t args[3];
48559aa14a9SRui Paulo 
48659aa14a9SRui Paulo 	if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
48759aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
48859aa14a9SRui Paulo 		args[1] = ni->ni_mllid;
48959aa14a9SRui Paulo 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
49059aa14a9SRui Paulo 		ieee80211_send_action(ni,
49159aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
49259aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
49359aa14a9SRui Paulo 		    args);
49459aa14a9SRui Paulo 	}
495c104cff2SRui Paulo 	callout_drain(&ni->ni_mltimer);
49659aa14a9SRui Paulo 	/* XXX belongs in hwmp */
49759aa14a9SRui Paulo 	ieee80211_ageq_drain_node(&ic->ic_stageq,
49859aa14a9SRui Paulo 	   (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
49959aa14a9SRui Paulo }
50059aa14a9SRui Paulo 
50159aa14a9SRui Paulo static void
50259aa14a9SRui Paulo mesh_vdetach(struct ieee80211vap *vap)
50359aa14a9SRui Paulo {
50459aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
50559aa14a9SRui Paulo 
506c104cff2SRui Paulo 	callout_drain(&ms->ms_cleantimer);
50759aa14a9SRui Paulo 	ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
50859aa14a9SRui Paulo 	    NULL);
50959aa14a9SRui Paulo 	ieee80211_mesh_rt_flush(vap);
51059aa14a9SRui Paulo 	mtx_destroy(&ms->ms_rt_lock);
51159aa14a9SRui Paulo 	ms->ms_ppath->mpp_vdetach(vap);
51259aa14a9SRui Paulo 	free(vap->iv_mesh, M_80211_VAP);
51359aa14a9SRui Paulo 	vap->iv_mesh = NULL;
51459aa14a9SRui Paulo }
51559aa14a9SRui Paulo 
51659aa14a9SRui Paulo static void
51759aa14a9SRui Paulo mesh_vattach(struct ieee80211vap *vap)
51859aa14a9SRui Paulo {
51959aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms;
52059aa14a9SRui Paulo 	vap->iv_newstate = mesh_newstate;
52159aa14a9SRui Paulo 	vap->iv_input = mesh_input;
52259aa14a9SRui Paulo 	vap->iv_opdetach = mesh_vdetach;
52359aa14a9SRui Paulo 	vap->iv_recv_mgmt = mesh_recv_mgmt;
5240917631fSRui Paulo 	vap->iv_recv_ctl = mesh_recv_ctl;
52559aa14a9SRui Paulo 	ms = malloc(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
52659aa14a9SRui Paulo 	    M_NOWAIT | M_ZERO);
52759aa14a9SRui Paulo 	if (ms == NULL) {
52859aa14a9SRui Paulo 		printf("%s: couldn't alloc MBSS state\n", __func__);
52959aa14a9SRui Paulo 		return;
53059aa14a9SRui Paulo 	}
53159aa14a9SRui Paulo 	vap->iv_mesh = ms;
53259aa14a9SRui Paulo 	ms->ms_seq = 0;
53359aa14a9SRui Paulo 	ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
53459aa14a9SRui Paulo 	ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
53559aa14a9SRui Paulo 	TAILQ_INIT(&ms->ms_routes);
53659aa14a9SRui Paulo 	mtx_init(&ms->ms_rt_lock, "MBSS", "802.11s routing table", MTX_DEF);
537c104cff2SRui Paulo 	callout_init(&ms->ms_cleantimer, CALLOUT_MPSAFE);
53859aa14a9SRui Paulo 	mesh_select_proto_metric(vap, "AIRTIME");
53959aa14a9SRui Paulo 	KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
54059aa14a9SRui Paulo 	mesh_select_proto_path(vap, "HWMP");
54159aa14a9SRui Paulo 	KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
54259aa14a9SRui Paulo 	ms->ms_ppath->mpp_vattach(vap);
54359aa14a9SRui Paulo }
54459aa14a9SRui Paulo 
54559aa14a9SRui Paulo /*
54659aa14a9SRui Paulo  * IEEE80211_M_MBSS vap state machine handler.
54759aa14a9SRui Paulo  */
54859aa14a9SRui Paulo static int
54959aa14a9SRui Paulo mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
55059aa14a9SRui Paulo {
55159aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
55259aa14a9SRui Paulo 	struct ieee80211com *ic = vap->iv_ic;
55359aa14a9SRui Paulo 	struct ieee80211_node *ni;
55459aa14a9SRui Paulo 	enum ieee80211_state ostate;
55559aa14a9SRui Paulo 
55659aa14a9SRui Paulo 	IEEE80211_LOCK_ASSERT(ic);
55759aa14a9SRui Paulo 
55859aa14a9SRui Paulo 	ostate = vap->iv_state;
55959aa14a9SRui Paulo 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
56059aa14a9SRui Paulo 	    __func__, ieee80211_state_name[ostate],
56159aa14a9SRui Paulo 	    ieee80211_state_name[nstate], arg);
56259aa14a9SRui Paulo 	vap->iv_state = nstate;		/* state transition */
56359aa14a9SRui Paulo 	if (ostate != IEEE80211_S_SCAN)
56459aa14a9SRui Paulo 		ieee80211_cancel_scan(vap);	/* background scan */
56559aa14a9SRui Paulo 	ni = vap->iv_bss;			/* NB: no reference held */
566c104cff2SRui Paulo 	if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN)
567c104cff2SRui Paulo 		callout_drain(&ms->ms_cleantimer);
56859aa14a9SRui Paulo 	switch (nstate) {
56959aa14a9SRui Paulo 	case IEEE80211_S_INIT:
57059aa14a9SRui Paulo 		switch (ostate) {
57159aa14a9SRui Paulo 		case IEEE80211_S_SCAN:
57259aa14a9SRui Paulo 			ieee80211_cancel_scan(vap);
57359aa14a9SRui Paulo 			break;
57459aa14a9SRui Paulo 		case IEEE80211_S_CAC:
57559aa14a9SRui Paulo 			ieee80211_dfs_cac_stop(vap);
57659aa14a9SRui Paulo 			break;
57759aa14a9SRui Paulo 		case IEEE80211_S_RUN:
57859aa14a9SRui Paulo 			ieee80211_iterate_nodes(&ic->ic_sta,
57959aa14a9SRui Paulo 			    mesh_vdetach_peers, NULL);
58059aa14a9SRui Paulo 			break;
58159aa14a9SRui Paulo 		default:
58259aa14a9SRui Paulo 			break;
58359aa14a9SRui Paulo 		}
58459aa14a9SRui Paulo 		if (ostate != IEEE80211_S_INIT) {
58559aa14a9SRui Paulo 			/* NB: optimize INIT -> INIT case */
58659aa14a9SRui Paulo 			ieee80211_reset_bss(vap);
587c104cff2SRui Paulo 			ieee80211_mesh_rt_flush(vap);
58859aa14a9SRui Paulo 		}
58959aa14a9SRui Paulo 		break;
59059aa14a9SRui Paulo 	case IEEE80211_S_SCAN:
59159aa14a9SRui Paulo 		switch (ostate) {
59259aa14a9SRui Paulo 		case IEEE80211_S_INIT:
59359aa14a9SRui Paulo 			if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
59459aa14a9SRui Paulo 			    !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
59559aa14a9SRui Paulo 			    ms->ms_idlen != 0) {
59659aa14a9SRui Paulo 				/*
59759aa14a9SRui Paulo 				 * Already have a channel and a mesh ID; bypass
59859aa14a9SRui Paulo 				 * the scan and startup immediately.
59959aa14a9SRui Paulo 				 */
60059aa14a9SRui Paulo 				ieee80211_create_ibss(vap, vap->iv_des_chan);
60159aa14a9SRui Paulo 				break;
60259aa14a9SRui Paulo 			}
60359aa14a9SRui Paulo 			/*
60459aa14a9SRui Paulo 			 * Initiate a scan.  We can come here as a result
60559aa14a9SRui Paulo 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
60659aa14a9SRui Paulo 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
60759aa14a9SRui Paulo 			 * and the scan request parameters will be present
60859aa14a9SRui Paulo 			 * in iv_scanreq.  Otherwise we do the default.
60959aa14a9SRui Paulo 			*/
61059aa14a9SRui Paulo 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
61159aa14a9SRui Paulo 				ieee80211_check_scan(vap,
61259aa14a9SRui Paulo 				    vap->iv_scanreq_flags,
61359aa14a9SRui Paulo 				    vap->iv_scanreq_duration,
61459aa14a9SRui Paulo 				    vap->iv_scanreq_mindwell,
61559aa14a9SRui Paulo 				    vap->iv_scanreq_maxdwell,
61659aa14a9SRui Paulo 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
61759aa14a9SRui Paulo 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
61859aa14a9SRui Paulo 			} else
61959aa14a9SRui Paulo 				ieee80211_check_scan_current(vap);
62059aa14a9SRui Paulo 			break;
62159aa14a9SRui Paulo 		default:
62259aa14a9SRui Paulo 			break;
62359aa14a9SRui Paulo 		}
62459aa14a9SRui Paulo 		break;
62559aa14a9SRui Paulo 	case IEEE80211_S_CAC:
62659aa14a9SRui Paulo 		/*
62759aa14a9SRui Paulo 		 * Start CAC on a DFS channel.  We come here when starting
62859aa14a9SRui Paulo 		 * a bss on a DFS channel (see ieee80211_create_ibss).
62959aa14a9SRui Paulo 		 */
63059aa14a9SRui Paulo 		ieee80211_dfs_cac_start(vap);
63159aa14a9SRui Paulo 		break;
63259aa14a9SRui Paulo 	case IEEE80211_S_RUN:
63359aa14a9SRui Paulo 		switch (ostate) {
63459aa14a9SRui Paulo 		case IEEE80211_S_INIT:
63559aa14a9SRui Paulo 			/*
63659aa14a9SRui Paulo 			 * Already have a channel; bypass the
63759aa14a9SRui Paulo 			 * scan and startup immediately.
63859aa14a9SRui Paulo 			 * Note that ieee80211_create_ibss will call
63959aa14a9SRui Paulo 			 * back to do a RUN->RUN state change.
64059aa14a9SRui Paulo 			 */
64159aa14a9SRui Paulo 			ieee80211_create_ibss(vap,
64259aa14a9SRui Paulo 			    ieee80211_ht_adjust_channel(ic,
64359aa14a9SRui Paulo 				ic->ic_curchan, vap->iv_flags_ht));
64459aa14a9SRui Paulo 			/* NB: iv_bss is changed on return */
64559aa14a9SRui Paulo 			break;
64659aa14a9SRui Paulo 		case IEEE80211_S_CAC:
64759aa14a9SRui Paulo 			/*
64859aa14a9SRui Paulo 			 * NB: This is the normal state change when CAC
64959aa14a9SRui Paulo 			 * expires and no radar was detected; no need to
65059aa14a9SRui Paulo 			 * clear the CAC timer as it's already expired.
65159aa14a9SRui Paulo 			 */
65259aa14a9SRui Paulo 			/* fall thru... */
65359aa14a9SRui Paulo 		case IEEE80211_S_CSA:
65459aa14a9SRui Paulo #if 0
65559aa14a9SRui Paulo 			/*
65659aa14a9SRui Paulo 			 * Shorten inactivity timer of associated stations
65759aa14a9SRui Paulo 			 * to weed out sta's that don't follow a CSA.
65859aa14a9SRui Paulo 			 */
65959aa14a9SRui Paulo 			ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
66059aa14a9SRui Paulo #endif
66159aa14a9SRui Paulo 			/*
66259aa14a9SRui Paulo 			 * Update bss node channel to reflect where
66359aa14a9SRui Paulo 			 * we landed after CSA.
66459aa14a9SRui Paulo 			 */
66559aa14a9SRui Paulo 			ieee80211_node_set_chan(vap->iv_bss,
66659aa14a9SRui Paulo 			    ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
66759aa14a9SRui Paulo 				ieee80211_htchanflags(vap->iv_bss->ni_chan)));
66859aa14a9SRui Paulo 			/* XXX bypass debug msgs */
66959aa14a9SRui Paulo 			break;
67059aa14a9SRui Paulo 		case IEEE80211_S_SCAN:
67159aa14a9SRui Paulo 		case IEEE80211_S_RUN:
67259aa14a9SRui Paulo #ifdef IEEE80211_DEBUG
67359aa14a9SRui Paulo 			if (ieee80211_msg_debug(vap)) {
67459aa14a9SRui Paulo 				struct ieee80211_node *ni = vap->iv_bss;
67559aa14a9SRui Paulo 				ieee80211_note(vap,
67659aa14a9SRui Paulo 				    "synchronized with %s meshid ",
67759aa14a9SRui Paulo 				    ether_sprintf(ni->ni_meshid));
67859aa14a9SRui Paulo 				ieee80211_print_essid(ni->ni_meshid,
67959aa14a9SRui Paulo 				    ni->ni_meshidlen);
68059aa14a9SRui Paulo 				/* XXX MCS/HT */
68159aa14a9SRui Paulo 				printf(" channel %d\n",
68259aa14a9SRui Paulo 				    ieee80211_chan2ieee(ic, ic->ic_curchan));
68359aa14a9SRui Paulo 			}
68459aa14a9SRui Paulo #endif
68559aa14a9SRui Paulo 			break;
68659aa14a9SRui Paulo 		default:
68759aa14a9SRui Paulo 			break;
68859aa14a9SRui Paulo 		}
68959aa14a9SRui Paulo 		ieee80211_node_authorize(vap->iv_bss);
690e50821abSSam Leffler 		callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
691c104cff2SRui Paulo                     mesh_rt_cleanup_cb, vap);
69259aa14a9SRui Paulo 		break;
69359aa14a9SRui Paulo 	default:
69459aa14a9SRui Paulo 		break;
69559aa14a9SRui Paulo 	}
69659aa14a9SRui Paulo 	/* NB: ostate not nstate */
69759aa14a9SRui Paulo 	ms->ms_ppath->mpp_newstate(vap, ostate, arg);
69859aa14a9SRui Paulo 	return 0;
69959aa14a9SRui Paulo }
70059aa14a9SRui Paulo 
701c104cff2SRui Paulo static void
702c104cff2SRui Paulo mesh_rt_cleanup_cb(void *arg)
703c104cff2SRui Paulo {
704c104cff2SRui Paulo 	struct ieee80211vap *vap = arg;
705c104cff2SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
706c104cff2SRui Paulo 
707c104cff2SRui Paulo 	mesh_rt_flush_invalid(vap);
708e50821abSSam Leffler 	callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
709c104cff2SRui Paulo 	    mesh_rt_cleanup_cb, vap);
710c104cff2SRui Paulo }
711c104cff2SRui Paulo 
712c104cff2SRui Paulo 
71359aa14a9SRui Paulo /*
71459aa14a9SRui Paulo  * Helper function to note the Mesh Peer Link FSM change.
71559aa14a9SRui Paulo  */
71659aa14a9SRui Paulo static void
71759aa14a9SRui Paulo mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
71859aa14a9SRui Paulo {
71959aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
72059aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
72159aa14a9SRui Paulo #ifdef IEEE80211_DEBUG
72259aa14a9SRui Paulo 	static const char *meshlinkstates[] = {
72359aa14a9SRui Paulo 		[IEEE80211_NODE_MESH_IDLE]		= "IDLE",
72459aa14a9SRui Paulo 		[IEEE80211_NODE_MESH_OPENSNT]		= "OPEN SENT",
72559aa14a9SRui Paulo 		[IEEE80211_NODE_MESH_OPENRCV]		= "OPEN RECEIVED",
72659aa14a9SRui Paulo 		[IEEE80211_NODE_MESH_CONFIRMRCV]	= "CONFIRM RECEIVED",
72759aa14a9SRui Paulo 		[IEEE80211_NODE_MESH_ESTABLISHED]	= "ESTABLISHED",
72859aa14a9SRui Paulo 		[IEEE80211_NODE_MESH_HOLDING]		= "HOLDING"
72959aa14a9SRui Paulo 	};
73059aa14a9SRui Paulo #endif
73159aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
73259aa14a9SRui Paulo 	    ni, "peer link: %s -> %s",
73359aa14a9SRui Paulo 	    meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
73459aa14a9SRui Paulo 
73559aa14a9SRui Paulo 	/* track neighbor count */
73659aa14a9SRui Paulo 	if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
73759aa14a9SRui Paulo 	    ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
73859aa14a9SRui Paulo 		KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
73959aa14a9SRui Paulo 		ms->ms_neighbors++;
740d093681cSRui Paulo 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
74159aa14a9SRui Paulo 	} else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
74259aa14a9SRui Paulo 	    state != IEEE80211_NODE_MESH_ESTABLISHED) {
74359aa14a9SRui Paulo 		KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
74459aa14a9SRui Paulo 		ms->ms_neighbors--;
745d093681cSRui Paulo 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
74659aa14a9SRui Paulo 	}
74759aa14a9SRui Paulo 	ni->ni_mlstate = state;
748c104cff2SRui Paulo 	switch (state) {
749c104cff2SRui Paulo 	case IEEE80211_NODE_MESH_HOLDING:
75059aa14a9SRui Paulo 		ms->ms_ppath->mpp_peerdown(ni);
751c104cff2SRui Paulo 		break;
752c104cff2SRui Paulo 	case IEEE80211_NODE_MESH_ESTABLISHED:
753c104cff2SRui Paulo 		ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
754c104cff2SRui Paulo 		break;
755c104cff2SRui Paulo 	default:
756c104cff2SRui Paulo 		break;
757c104cff2SRui Paulo 	}
75859aa14a9SRui Paulo }
75959aa14a9SRui Paulo 
76059aa14a9SRui Paulo /*
76159aa14a9SRui Paulo  * Helper function to generate a unique local ID required for mesh
76259aa14a9SRui Paulo  * peer establishment.
76359aa14a9SRui Paulo  */
76459aa14a9SRui Paulo static void
76559aa14a9SRui Paulo mesh_checkid(void *arg, struct ieee80211_node *ni)
76659aa14a9SRui Paulo {
76759aa14a9SRui Paulo 	uint16_t *r = arg;
76859aa14a9SRui Paulo 
76959aa14a9SRui Paulo 	if (*r == ni->ni_mllid)
77059aa14a9SRui Paulo 		*(uint16_t *)arg = 0;
77159aa14a9SRui Paulo }
77259aa14a9SRui Paulo 
77359aa14a9SRui Paulo static uint32_t
77459aa14a9SRui Paulo mesh_generateid(struct ieee80211vap *vap)
77559aa14a9SRui Paulo {
77659aa14a9SRui Paulo 	int maxiter = 4;
77759aa14a9SRui Paulo 	uint16_t r;
77859aa14a9SRui Paulo 
77959aa14a9SRui Paulo 	do {
78059aa14a9SRui Paulo 		get_random_bytes(&r, 2);
78159aa14a9SRui Paulo 		ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
78259aa14a9SRui Paulo 		maxiter--;
78359aa14a9SRui Paulo 	} while (r == 0 && maxiter > 0);
78459aa14a9SRui Paulo 	return r;
78559aa14a9SRui Paulo }
78659aa14a9SRui Paulo 
78759aa14a9SRui Paulo /*
78859aa14a9SRui Paulo  * Verifies if we already received this packet by checking its
78959aa14a9SRui Paulo  * sequence number.
7903ca80f0dSRui Paulo  * Returns 0 if the frame is to be accepted, 1 otherwise.
79159aa14a9SRui Paulo  */
79259aa14a9SRui Paulo static int
79359aa14a9SRui Paulo mesh_checkpseq(struct ieee80211vap *vap,
79459aa14a9SRui Paulo     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
79559aa14a9SRui Paulo {
79659aa14a9SRui Paulo 	struct ieee80211_mesh_route *rt;
79759aa14a9SRui Paulo 
79859aa14a9SRui Paulo 	rt = ieee80211_mesh_rt_find(vap, source);
79959aa14a9SRui Paulo 	if (rt == NULL) {
8003ca80f0dSRui Paulo 		rt = ieee80211_mesh_rt_add(vap, source);
8013ca80f0dSRui Paulo 		if (rt == NULL) {
8023ca80f0dSRui Paulo 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
8033ca80f0dSRui Paulo 			    "%s", "add mcast route failed");
8043ca80f0dSRui Paulo 			vap->iv_stats.is_mesh_rtaddfailed++;
8053ca80f0dSRui Paulo 			return 1;
8063ca80f0dSRui Paulo 		}
807c104cff2SRui Paulo 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
808c104cff2SRui Paulo 		    "add mcast route, mesh seqno %d", seq);
80959aa14a9SRui Paulo 		rt->rt_lastmseq = seq;
81059aa14a9SRui Paulo 		return 0;
81159aa14a9SRui Paulo 	}
81259aa14a9SRui Paulo 	if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
81359aa14a9SRui Paulo 		return 1;
81459aa14a9SRui Paulo 	} else {
81559aa14a9SRui Paulo 		rt->rt_lastmseq = seq;
81659aa14a9SRui Paulo 		return 0;
81759aa14a9SRui Paulo 	}
81859aa14a9SRui Paulo }
81959aa14a9SRui Paulo 
82059aa14a9SRui Paulo /*
82159aa14a9SRui Paulo  * Iterate the routing table and locate the next hop.
82259aa14a9SRui Paulo  */
82359aa14a9SRui Paulo static struct ieee80211_node *
82459aa14a9SRui Paulo mesh_find_txnode(struct ieee80211vap *vap,
82559aa14a9SRui Paulo     const uint8_t dest[IEEE80211_ADDR_LEN])
82659aa14a9SRui Paulo {
82759aa14a9SRui Paulo 	struct ieee80211_mesh_route *rt;
82859aa14a9SRui Paulo 
82959aa14a9SRui Paulo 	rt = ieee80211_mesh_rt_find(vap, dest);
83059aa14a9SRui Paulo 	if (rt == NULL)
83159aa14a9SRui Paulo 		return NULL;
832c104cff2SRui Paulo 	if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 ||
833c104cff2SRui Paulo 	    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY)) {
834c104cff2SRui Paulo 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
835c104cff2SRui Paulo 		    "%s: !valid or proxy, flags 0x%x", __func__, rt->rt_flags);
836c104cff2SRui Paulo 		/* XXX stat */
837c104cff2SRui Paulo 		return NULL;
838c104cff2SRui Paulo 	}
83959aa14a9SRui Paulo 	return ieee80211_find_txnode(vap, rt->rt_nexthop);
84059aa14a9SRui Paulo }
84159aa14a9SRui Paulo 
84259aa14a9SRui Paulo /*
84359aa14a9SRui Paulo  * Forward the specified frame.
84459aa14a9SRui Paulo  * Decrement the TTL and set TA to our MAC address.
84559aa14a9SRui Paulo  */
84659aa14a9SRui Paulo static void
84759aa14a9SRui Paulo mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
84859aa14a9SRui Paulo     const struct ieee80211_meshcntl *mc)
84959aa14a9SRui Paulo {
85059aa14a9SRui Paulo 	struct ieee80211com *ic = vap->iv_ic;
85159aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
85259aa14a9SRui Paulo 	struct ifnet *ifp = vap->iv_ifp;
85359aa14a9SRui Paulo 	struct ifnet *parent = ic->ic_ifp;
85459aa14a9SRui Paulo 	const struct ieee80211_frame *wh =
85559aa14a9SRui Paulo 	    mtod(m, const struct ieee80211_frame *);
85659aa14a9SRui Paulo 	struct mbuf *mcopy;
85759aa14a9SRui Paulo 	struct ieee80211_meshcntl *mccopy;
85859aa14a9SRui Paulo 	struct ieee80211_frame *whcopy;
85959aa14a9SRui Paulo 	struct ieee80211_node *ni;
86059aa14a9SRui Paulo 	int err;
86159aa14a9SRui Paulo 
86259aa14a9SRui Paulo 	if (mc->mc_ttl == 0) {
86359aa14a9SRui Paulo 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
86459aa14a9SRui Paulo 		    "%s", "frame not fwd'd, ttl 0");
86559aa14a9SRui Paulo 		vap->iv_stats.is_mesh_fwd_ttl++;
86659aa14a9SRui Paulo 		return;
86759aa14a9SRui Paulo 	}
86859aa14a9SRui Paulo 	if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
86959aa14a9SRui Paulo 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
87059aa14a9SRui Paulo 		    "%s", "frame not fwd'd, fwding disabled");
87159aa14a9SRui Paulo 		vap->iv_stats.is_mesh_fwd_disabled++;
87259aa14a9SRui Paulo 		return;
87359aa14a9SRui Paulo 	}
87459aa14a9SRui Paulo 	mcopy = m_dup(m, M_DONTWAIT);
87559aa14a9SRui Paulo 	if (mcopy == NULL) {
87659aa14a9SRui Paulo 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
87759aa14a9SRui Paulo 		    "%s", "frame not fwd'd, cannot dup");
87859aa14a9SRui Paulo 		vap->iv_stats.is_mesh_fwd_nobuf++;
87959aa14a9SRui Paulo 		ifp->if_oerrors++;
88059aa14a9SRui Paulo 		return;
88159aa14a9SRui Paulo 	}
88259aa14a9SRui Paulo 	mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
88359aa14a9SRui Paulo 	    sizeof(struct ieee80211_meshcntl));
88459aa14a9SRui Paulo 	if (mcopy == NULL) {
88559aa14a9SRui Paulo 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
88659aa14a9SRui Paulo 		    "%s", "frame not fwd'd, too short");
88759aa14a9SRui Paulo 		vap->iv_stats.is_mesh_fwd_tooshort++;
88859aa14a9SRui Paulo 		ifp->if_oerrors++;
88959aa14a9SRui Paulo 		m_freem(mcopy);
89059aa14a9SRui Paulo 		return;
89159aa14a9SRui Paulo 	}
89259aa14a9SRui Paulo 	whcopy = mtod(mcopy, struct ieee80211_frame *);
89359aa14a9SRui Paulo 	mccopy = (struct ieee80211_meshcntl *)
89459aa14a9SRui Paulo 	    (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
89559aa14a9SRui Paulo 	/* XXX clear other bits? */
89659aa14a9SRui Paulo 	whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
89759aa14a9SRui Paulo 	IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
89859aa14a9SRui Paulo 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
89959aa14a9SRui Paulo 		ni = ieee80211_ref_node(vap->iv_bss);
90059aa14a9SRui Paulo 		mcopy->m_flags |= M_MCAST;
90159aa14a9SRui Paulo 	} else {
90259aa14a9SRui Paulo 		ni = mesh_find_txnode(vap, whcopy->i_addr3);
90359aa14a9SRui Paulo 		if (ni == NULL) {
90459aa14a9SRui Paulo 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
90559aa14a9SRui Paulo 			    "%s", "frame not fwd'd, no path");
90659aa14a9SRui Paulo 			vap->iv_stats.is_mesh_fwd_nopath++;
90759aa14a9SRui Paulo 			m_freem(mcopy);
90859aa14a9SRui Paulo 			return;
90959aa14a9SRui Paulo 		}
91059aa14a9SRui Paulo 		IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
91159aa14a9SRui Paulo 	}
91259aa14a9SRui Paulo 	KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
91359aa14a9SRui Paulo 	mccopy->mc_ttl--;
91459aa14a9SRui Paulo 
91559aa14a9SRui Paulo 	/* XXX calculate priority so drivers can find the tx queue */
91659aa14a9SRui Paulo 	M_WME_SETAC(mcopy, WME_AC_BE);
91759aa14a9SRui Paulo 
91859aa14a9SRui Paulo 	/* XXX do we know m_nextpkt is NULL? */
91959aa14a9SRui Paulo 	mcopy->m_pkthdr.rcvif = (void *) ni;
92059aa14a9SRui Paulo 	err = parent->if_transmit(parent, mcopy);
92159aa14a9SRui Paulo 	if (err != 0) {
92259aa14a9SRui Paulo 		/* NB: IFQ_HANDOFF reclaims mbuf */
92359aa14a9SRui Paulo 		ieee80211_free_node(ni);
92459aa14a9SRui Paulo 	} else {
92559aa14a9SRui Paulo 		ifp->if_opackets++;
92659aa14a9SRui Paulo 	}
92759aa14a9SRui Paulo }
92859aa14a9SRui Paulo 
929c104cff2SRui Paulo static struct mbuf *
930c104cff2SRui Paulo mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
931c104cff2SRui Paulo {
932c104cff2SRui Paulo #define	WHDIR(wh) ((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
933c104cff2SRui Paulo 	uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
934c104cff2SRui Paulo 		  sizeof(struct ieee80211_meshcntl_ae11)];
935c104cff2SRui Paulo 	const struct ieee80211_qosframe_addr4 *wh;
936c104cff2SRui Paulo 	const struct ieee80211_meshcntl_ae10 *mc;
937c104cff2SRui Paulo 	struct ether_header *eh;
938c104cff2SRui Paulo 	struct llc *llc;
939c104cff2SRui Paulo 	int ae;
940c104cff2SRui Paulo 
941c104cff2SRui Paulo 	if (m->m_len < hdrlen + sizeof(*llc) &&
942c104cff2SRui Paulo 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
943c104cff2SRui Paulo 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
944c104cff2SRui Paulo 		    "discard data frame: %s", "m_pullup failed");
945c104cff2SRui Paulo 		vap->iv_stats.is_rx_tooshort++;
946c104cff2SRui Paulo 		return NULL;
947c104cff2SRui Paulo 	}
948c104cff2SRui Paulo 	memcpy(b, mtod(m, caddr_t), hdrlen);
949c104cff2SRui Paulo 	wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
950c104cff2SRui Paulo 	mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
951c104cff2SRui Paulo 	KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
952c104cff2SRui Paulo 		WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
953c104cff2SRui Paulo 	    ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
954c104cff2SRui Paulo 
955c104cff2SRui Paulo 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
956c104cff2SRui Paulo 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
957c104cff2SRui Paulo 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
958c104cff2SRui Paulo 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
959c104cff2SRui Paulo 	    /* NB: preserve AppleTalk frames that have a native SNAP hdr */
960c104cff2SRui Paulo 	    !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
961c104cff2SRui Paulo 	      llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
962c104cff2SRui Paulo 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
963c104cff2SRui Paulo 		llc = NULL;
964c104cff2SRui Paulo 	} else {
965c104cff2SRui Paulo 		m_adj(m, hdrlen - sizeof(*eh));
966c104cff2SRui Paulo 	}
967c104cff2SRui Paulo 	eh = mtod(m, struct ether_header *);
968c104cff2SRui Paulo 	ae = mc->mc_flags & 3;
969c104cff2SRui Paulo 	if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
970c104cff2SRui Paulo 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
971c104cff2SRui Paulo 		if (ae == 0) {
972c104cff2SRui Paulo 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
973c104cff2SRui Paulo 		} else if (ae == 1) {
974c104cff2SRui Paulo 			IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr4);
975c104cff2SRui Paulo 		} else {
976c104cff2SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
977c104cff2SRui Paulo 			    (const struct ieee80211_frame *)wh, NULL,
978c104cff2SRui Paulo 			    "bad AE %d", ae);
979c104cff2SRui Paulo 			vap->iv_stats.is_mesh_badae++;
980c104cff2SRui Paulo 			m_freem(m);
981c104cff2SRui Paulo 			return NULL;
982c104cff2SRui Paulo 		}
983c104cff2SRui Paulo 	} else {
984c104cff2SRui Paulo 		if (ae == 0) {
985c104cff2SRui Paulo 			IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
986c104cff2SRui Paulo 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
987c104cff2SRui Paulo 		} else if (ae == 2) {
988c104cff2SRui Paulo 			IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr4);
989c104cff2SRui Paulo 			IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr5);
990c104cff2SRui Paulo 		} else {
991c104cff2SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
992c104cff2SRui Paulo 			    (const struct ieee80211_frame *)wh, NULL,
993c104cff2SRui Paulo 			    "bad AE %d", ae);
994c104cff2SRui Paulo 			vap->iv_stats.is_mesh_badae++;
995c104cff2SRui Paulo 			m_freem(m);
996c104cff2SRui Paulo 			return NULL;
997c104cff2SRui Paulo 		}
998c104cff2SRui Paulo 	}
999c104cff2SRui Paulo #ifdef ALIGNED_POINTER
1000c104cff2SRui Paulo 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
1001c104cff2SRui Paulo 		m = ieee80211_realign(vap, m, sizeof(*eh));
1002c104cff2SRui Paulo 		if (m == NULL)
1003c104cff2SRui Paulo 			return NULL;
1004c104cff2SRui Paulo 	}
1005c104cff2SRui Paulo #endif /* ALIGNED_POINTER */
1006c104cff2SRui Paulo 	if (llc != NULL) {
1007c104cff2SRui Paulo 		eh = mtod(m, struct ether_header *);
1008c104cff2SRui Paulo 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
1009c104cff2SRui Paulo 	}
1010c104cff2SRui Paulo 	return m;
1011c104cff2SRui Paulo #undef WDIR
1012c104cff2SRui Paulo }
1013c104cff2SRui Paulo 
1014c104cff2SRui Paulo /*
1015c104cff2SRui Paulo  * Return non-zero if the unicast mesh data frame should be processed
1016c104cff2SRui Paulo  * locally.  Frames that are not proxy'd have our address, otherwise
1017c104cff2SRui Paulo  * we need to consult the routing table to look for a proxy entry.
1018c104cff2SRui Paulo  */
1019c104cff2SRui Paulo static __inline int
1020c104cff2SRui Paulo mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
1021c104cff2SRui Paulo     const struct ieee80211_meshcntl *mc)
1022c104cff2SRui Paulo {
1023c104cff2SRui Paulo 	int ae = mc->mc_flags & 3;
1024c104cff2SRui Paulo 
1025c104cff2SRui Paulo 	KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
1026c104cff2SRui Paulo 	    ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1027c104cff2SRui Paulo 	KASSERT(ae == 0 || ae == 2, ("bad AE %d", ae));
1028c104cff2SRui Paulo 	if (ae == 2) {				/* ucast w/ proxy */
1029c104cff2SRui Paulo 		const struct ieee80211_meshcntl_ae10 *mc10 =
1030c104cff2SRui Paulo 		    (const struct ieee80211_meshcntl_ae10 *) mc;
1031c104cff2SRui Paulo 		struct ieee80211_mesh_route *rt =
1032c104cff2SRui Paulo 		    ieee80211_mesh_rt_find(vap, mc10->mc_addr4);
1033c104cff2SRui Paulo 		/* check for proxy route to ourself */
1034c104cff2SRui Paulo 		return (rt != NULL &&
1035c104cff2SRui Paulo 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
1036c104cff2SRui Paulo 	} else					/* ucast w/o proxy */
1037c104cff2SRui Paulo 		return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
1038c104cff2SRui Paulo }
1039c104cff2SRui Paulo 
104059aa14a9SRui Paulo static int
104159aa14a9SRui Paulo mesh_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
104259aa14a9SRui Paulo {
104359aa14a9SRui Paulo #define	SEQ_LEQ(a,b)	((int)((a)-(b)) <= 0)
104459aa14a9SRui Paulo #define	HAS_SEQ(type)	((type & 0x4) == 0)
104559aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
104659aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
104759aa14a9SRui Paulo 	struct ifnet *ifp = vap->iv_ifp;
104859aa14a9SRui Paulo 	struct ieee80211_frame *wh;
104959aa14a9SRui Paulo 	const struct ieee80211_meshcntl *mc;
1050c104cff2SRui Paulo 	int hdrspace, meshdrlen, need_tap;
105159aa14a9SRui Paulo 	uint8_t dir, type, subtype, qos;
105259aa14a9SRui Paulo 	uint32_t seq;
105359aa14a9SRui Paulo 	uint8_t *addr;
105459aa14a9SRui Paulo 	ieee80211_seq rxseq;
105559aa14a9SRui Paulo 
105659aa14a9SRui Paulo 	KASSERT(ni != NULL, ("null node"));
105759aa14a9SRui Paulo 	ni->ni_inact = ni->ni_inact_reload;
105859aa14a9SRui Paulo 
105959aa14a9SRui Paulo 	need_tap = 1;			/* mbuf need to be tapped. */
106059aa14a9SRui Paulo 	type = -1;			/* undefined */
106159aa14a9SRui Paulo 
106259aa14a9SRui Paulo 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
106359aa14a9SRui Paulo 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
106459aa14a9SRui Paulo 		    ni->ni_macaddr, NULL,
106559aa14a9SRui Paulo 		    "too short (1): len %u", m->m_pkthdr.len);
106659aa14a9SRui Paulo 		vap->iv_stats.is_rx_tooshort++;
106759aa14a9SRui Paulo 		goto out;
106859aa14a9SRui Paulo 	}
106959aa14a9SRui Paulo 	/*
107059aa14a9SRui Paulo 	 * Bit of a cheat here, we use a pointer for a 3-address
107159aa14a9SRui Paulo 	 * frame format but don't reference fields past outside
107259aa14a9SRui Paulo 	 * ieee80211_frame_min w/o first validating the data is
107359aa14a9SRui Paulo 	 * present.
107459aa14a9SRui Paulo 	*/
107559aa14a9SRui Paulo 	wh = mtod(m, struct ieee80211_frame *);
107659aa14a9SRui Paulo 
107759aa14a9SRui Paulo 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
107859aa14a9SRui Paulo 	    IEEE80211_FC0_VERSION_0) {
107959aa14a9SRui Paulo 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
108059aa14a9SRui Paulo 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
108159aa14a9SRui Paulo 		vap->iv_stats.is_rx_badversion++;
108259aa14a9SRui Paulo 		goto err;
108359aa14a9SRui Paulo 	}
108459aa14a9SRui Paulo 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
108559aa14a9SRui Paulo 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
108659aa14a9SRui Paulo 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
108759aa14a9SRui Paulo 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
108859aa14a9SRui Paulo 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
108959aa14a9SRui Paulo 		ni->ni_noise = nf;
109059aa14a9SRui Paulo 		if (HAS_SEQ(type)) {
109159aa14a9SRui Paulo 			uint8_t tid = ieee80211_gettid(wh);
109259aa14a9SRui Paulo 
109359aa14a9SRui Paulo 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
109459aa14a9SRui Paulo 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
109559aa14a9SRui Paulo 				ic->ic_wme.wme_hipri_traffic++;
109659aa14a9SRui Paulo 			rxseq = le16toh(*(uint16_t *)wh->i_seq);
109759aa14a9SRui Paulo 			if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
109859aa14a9SRui Paulo 			    (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
109959aa14a9SRui Paulo 			    SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
110059aa14a9SRui Paulo 				/* duplicate, discard */
110159aa14a9SRui Paulo 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
110259aa14a9SRui Paulo 				    wh->i_addr1, "duplicate",
110359aa14a9SRui Paulo 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
110459aa14a9SRui Paulo 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
110559aa14a9SRui Paulo 				    ni->ni_rxseqs[tid] >>
110659aa14a9SRui Paulo 				    IEEE80211_SEQ_SEQ_SHIFT,
110759aa14a9SRui Paulo 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
110859aa14a9SRui Paulo 				    ni->ni_rxseqs[tid] &
110959aa14a9SRui Paulo 				    IEEE80211_SEQ_FRAG_MASK,
111059aa14a9SRui Paulo 				    tid);
111159aa14a9SRui Paulo 				vap->iv_stats.is_rx_dup++;
111259aa14a9SRui Paulo 				IEEE80211_NODE_STAT(ni, rx_dup);
111359aa14a9SRui Paulo 				goto out;
111459aa14a9SRui Paulo 			}
111559aa14a9SRui Paulo 			ni->ni_rxseqs[tid] = rxseq;
111659aa14a9SRui Paulo 		}
111759aa14a9SRui Paulo 	}
111859aa14a9SRui Paulo #ifdef IEEE80211_DEBUG
111959aa14a9SRui Paulo 	/*
112059aa14a9SRui Paulo 	 * It's easier, but too expensive, to simulate different mesh
112159aa14a9SRui Paulo 	 * topologies by consulting the ACL policy very early, so do this
112259aa14a9SRui Paulo 	 * only under DEBUG.
112359aa14a9SRui Paulo 	 *
112459aa14a9SRui Paulo 	 * NB: this check is also done upon peering link initiation.
112559aa14a9SRui Paulo 	 */
112659aa14a9SRui Paulo 	if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
112759aa14a9SRui Paulo 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
112859aa14a9SRui Paulo 		    wh, NULL, "%s", "disallowed by ACL");
112959aa14a9SRui Paulo 		vap->iv_stats.is_rx_acl++;
113059aa14a9SRui Paulo 		goto out;
113159aa14a9SRui Paulo 	}
113259aa14a9SRui Paulo #endif
113359aa14a9SRui Paulo 	switch (type) {
113459aa14a9SRui Paulo 	case IEEE80211_FC0_TYPE_DATA:
113559aa14a9SRui Paulo 		if (ni == vap->iv_bss)
113659aa14a9SRui Paulo 			goto out;
113759aa14a9SRui Paulo 		if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
113859aa14a9SRui Paulo 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
113959aa14a9SRui Paulo 			    ni->ni_macaddr, NULL,
114059aa14a9SRui Paulo 			    "peer link not yet established (%d)",
114159aa14a9SRui Paulo 			    ni->ni_mlstate);
114259aa14a9SRui Paulo 			vap->iv_stats.is_mesh_nolink++;
114359aa14a9SRui Paulo 			goto out;
114459aa14a9SRui Paulo 		}
114559aa14a9SRui Paulo 		if (dir != IEEE80211_FC1_DIR_FROMDS &&
114659aa14a9SRui Paulo 		    dir != IEEE80211_FC1_DIR_DSTODS) {
114759aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
114859aa14a9SRui Paulo 			    wh, "data", "incorrect dir 0x%x", dir);
114959aa14a9SRui Paulo 			vap->iv_stats.is_rx_wrongdir++;
115059aa14a9SRui Paulo 			goto err;
115159aa14a9SRui Paulo 		}
115259aa14a9SRui Paulo 		/* pull up enough to get to the mesh control */
115359aa14a9SRui Paulo 		hdrspace = ieee80211_hdrspace(ic, wh);
115459aa14a9SRui Paulo 		if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
115559aa14a9SRui Paulo 		    (m = m_pullup(m, hdrspace +
115659aa14a9SRui Paulo 		        sizeof(struct ieee80211_meshcntl))) == NULL) {
115759aa14a9SRui Paulo 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
115859aa14a9SRui Paulo 			    ni->ni_macaddr, NULL,
115959aa14a9SRui Paulo 			    "data too short: expecting %u", hdrspace);
116059aa14a9SRui Paulo 			vap->iv_stats.is_rx_tooshort++;
116159aa14a9SRui Paulo 			goto out;		/* XXX */
116259aa14a9SRui Paulo 		}
116359aa14a9SRui Paulo 		/*
116459aa14a9SRui Paulo 		 * Now calculate the full extent of the headers. Note
1165c104cff2SRui Paulo 		 * mesh_decap will pull up anything we didn't get
116659aa14a9SRui Paulo 		 * above when it strips the 802.11 headers.
116759aa14a9SRui Paulo 		 */
116859aa14a9SRui Paulo 		mc = (const struct ieee80211_meshcntl *)
116959aa14a9SRui Paulo 		    (mtod(m, const uint8_t *) + hdrspace);
1170c104cff2SRui Paulo 		meshdrlen = sizeof(struct ieee80211_meshcntl) +
117159aa14a9SRui Paulo 		    (mc->mc_flags & 3) * IEEE80211_ADDR_LEN;
1172c104cff2SRui Paulo 		hdrspace += meshdrlen;
117359aa14a9SRui Paulo 		seq = LE_READ_4(mc->mc_seq);
117459aa14a9SRui Paulo 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
117559aa14a9SRui Paulo 			addr = wh->i_addr3;
117659aa14a9SRui Paulo 		else
117759aa14a9SRui Paulo 			addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
117859aa14a9SRui Paulo 		if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
117959aa14a9SRui Paulo 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
118059aa14a9SRui Paulo 			    addr, "data", "%s", "not to me");
118159aa14a9SRui Paulo 			vap->iv_stats.is_rx_wrongbss++;	/* XXX kinda */
118259aa14a9SRui Paulo 			goto out;
118359aa14a9SRui Paulo 		}
118459aa14a9SRui Paulo 		if (mesh_checkpseq(vap, addr, seq) != 0) {
118559aa14a9SRui Paulo 			vap->iv_stats.is_rx_dup++;
118659aa14a9SRui Paulo 			goto out;
118759aa14a9SRui Paulo 		}
118859aa14a9SRui Paulo 
118959aa14a9SRui Paulo 		/*
119059aa14a9SRui Paulo 		 * Potentially forward packet.  See table s36 (p140)
119159aa14a9SRui Paulo 		 * for the rules.  XXX tap fwd'd packets not for us?
119259aa14a9SRui Paulo 		 */
119359aa14a9SRui Paulo 		if (dir == IEEE80211_FC1_DIR_FROMDS ||
1194c104cff2SRui Paulo 		    !mesh_isucastforme(vap, wh, mc)) {
119559aa14a9SRui Paulo 			mesh_forward(vap, m, mc);
119659aa14a9SRui Paulo 			if (dir == IEEE80211_FC1_DIR_DSTODS)
119759aa14a9SRui Paulo 				goto out;
119859aa14a9SRui Paulo 			/* NB: fall thru to deliver mcast frames locally */
119959aa14a9SRui Paulo 		}
120059aa14a9SRui Paulo 
120159aa14a9SRui Paulo 		/*
120259aa14a9SRui Paulo 		 * Save QoS bits for use below--before we strip the header.
120359aa14a9SRui Paulo 		 */
120459aa14a9SRui Paulo 		if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
120559aa14a9SRui Paulo 			qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
120659aa14a9SRui Paulo 			    ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
120759aa14a9SRui Paulo 			    ((struct ieee80211_qosframe *)wh)->i_qos[0];
120859aa14a9SRui Paulo 		} else
120959aa14a9SRui Paulo 			qos = 0;
121059aa14a9SRui Paulo 		/*
121159aa14a9SRui Paulo 		 * Next up, any fragmentation.
121259aa14a9SRui Paulo 		 */
121359aa14a9SRui Paulo 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
121459aa14a9SRui Paulo 			m = ieee80211_defrag(ni, m, hdrspace);
121559aa14a9SRui Paulo 			if (m == NULL) {
121659aa14a9SRui Paulo 				/* Fragment dropped or frame not complete yet */
121759aa14a9SRui Paulo 				goto out;
121859aa14a9SRui Paulo 			}
121959aa14a9SRui Paulo 		}
122059aa14a9SRui Paulo 		wh = NULL;		/* no longer valid, catch any uses */
122159aa14a9SRui Paulo 
122259aa14a9SRui Paulo 		if (ieee80211_radiotap_active_vap(vap))
122359aa14a9SRui Paulo 			ieee80211_radiotap_rx(vap, m);
122459aa14a9SRui Paulo 		need_tap = 0;
122559aa14a9SRui Paulo 
122659aa14a9SRui Paulo 		/*
122759aa14a9SRui Paulo 		 * Finally, strip the 802.11 header.
122859aa14a9SRui Paulo 		 */
1229c104cff2SRui Paulo 		m = mesh_decap(vap, m, hdrspace, meshdrlen);
123059aa14a9SRui Paulo 		if (m == NULL) {
123159aa14a9SRui Paulo 			/* XXX mask bit to check for both */
123259aa14a9SRui Paulo 			/* don't count Null data frames as errors */
123359aa14a9SRui Paulo 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
123459aa14a9SRui Paulo 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
123559aa14a9SRui Paulo 				goto out;
123659aa14a9SRui Paulo 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
123759aa14a9SRui Paulo 			    ni->ni_macaddr, "data", "%s", "decap error");
123859aa14a9SRui Paulo 			vap->iv_stats.is_rx_decap++;
123959aa14a9SRui Paulo 			IEEE80211_NODE_STAT(ni, rx_decap);
124059aa14a9SRui Paulo 			goto err;
124159aa14a9SRui Paulo 		}
124259aa14a9SRui Paulo 		if (qos & IEEE80211_QOS_AMSDU) {
124359aa14a9SRui Paulo 			m = ieee80211_decap_amsdu(ni, m);
124459aa14a9SRui Paulo 			if (m == NULL)
124559aa14a9SRui Paulo 				return IEEE80211_FC0_TYPE_DATA;
124659aa14a9SRui Paulo 		}
124759aa14a9SRui Paulo 		ieee80211_deliver_data(vap, ni, m);
124859aa14a9SRui Paulo 		return type;
124959aa14a9SRui Paulo 	case IEEE80211_FC0_TYPE_MGT:
125059aa14a9SRui Paulo 		vap->iv_stats.is_rx_mgmt++;
125159aa14a9SRui Paulo 		IEEE80211_NODE_STAT(ni, rx_mgmt);
125259aa14a9SRui Paulo 		if (dir != IEEE80211_FC1_DIR_NODS) {
125359aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
125459aa14a9SRui Paulo 			    wh, "mgt", "incorrect dir 0x%x", dir);
125559aa14a9SRui Paulo 			vap->iv_stats.is_rx_wrongdir++;
125659aa14a9SRui Paulo 			goto err;
125759aa14a9SRui Paulo 		}
125859aa14a9SRui Paulo 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
125959aa14a9SRui Paulo 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
126059aa14a9SRui Paulo 			    ni->ni_macaddr, "mgt", "too short: len %u",
126159aa14a9SRui Paulo 			    m->m_pkthdr.len);
126259aa14a9SRui Paulo 			vap->iv_stats.is_rx_tooshort++;
126359aa14a9SRui Paulo 			goto out;
126459aa14a9SRui Paulo 		}
126559aa14a9SRui Paulo #ifdef IEEE80211_DEBUG
126659aa14a9SRui Paulo 		if ((ieee80211_msg_debug(vap) &&
126759aa14a9SRui Paulo 		    (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
126859aa14a9SRui Paulo 		    ieee80211_msg_dumppkts(vap)) {
126959aa14a9SRui Paulo 			if_printf(ifp, "received %s from %s rssi %d\n",
127059aa14a9SRui Paulo 			    ieee80211_mgt_subtype_name[subtype >>
127159aa14a9SRui Paulo 			    IEEE80211_FC0_SUBTYPE_SHIFT],
127259aa14a9SRui Paulo 			    ether_sprintf(wh->i_addr2), rssi);
127359aa14a9SRui Paulo 		}
127459aa14a9SRui Paulo #endif
127559aa14a9SRui Paulo 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
127659aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
127759aa14a9SRui Paulo 			    wh, NULL, "%s", "WEP set but not permitted");
127859aa14a9SRui Paulo 			vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
127959aa14a9SRui Paulo 			goto out;
128059aa14a9SRui Paulo 		}
128159aa14a9SRui Paulo 		vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
128259aa14a9SRui Paulo 		goto out;
128359aa14a9SRui Paulo 	case IEEE80211_FC0_TYPE_CTL:
128459aa14a9SRui Paulo 		vap->iv_stats.is_rx_ctl++;
128559aa14a9SRui Paulo 		IEEE80211_NODE_STAT(ni, rx_ctrl);
128659aa14a9SRui Paulo 		goto out;
128759aa14a9SRui Paulo 	default:
128859aa14a9SRui Paulo 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
128959aa14a9SRui Paulo 		    wh, "bad", "frame type 0x%x", type);
129059aa14a9SRui Paulo 		/* should not come here */
129159aa14a9SRui Paulo 		break;
129259aa14a9SRui Paulo 	}
129359aa14a9SRui Paulo err:
129459aa14a9SRui Paulo 	ifp->if_ierrors++;
129559aa14a9SRui Paulo out:
129659aa14a9SRui Paulo 	if (m != NULL) {
129759aa14a9SRui Paulo 		if (need_tap && ieee80211_radiotap_active_vap(vap))
129859aa14a9SRui Paulo 			ieee80211_radiotap_rx(vap, m);
129959aa14a9SRui Paulo 		m_freem(m);
130059aa14a9SRui Paulo 	}
130159aa14a9SRui Paulo 	return type;
130259aa14a9SRui Paulo }
130359aa14a9SRui Paulo 
130459aa14a9SRui Paulo static void
130559aa14a9SRui Paulo mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
130659aa14a9SRui Paulo     int rssi, int nf)
130759aa14a9SRui Paulo {
130859aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
130959aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
131059aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
131159aa14a9SRui Paulo 	struct ieee80211_frame *wh;
131259aa14a9SRui Paulo 	uint8_t *frm, *efrm;
131359aa14a9SRui Paulo 
131459aa14a9SRui Paulo 	wh = mtod(m0, struct ieee80211_frame *);
131559aa14a9SRui Paulo 	frm = (uint8_t *)&wh[1];
131659aa14a9SRui Paulo 	efrm = mtod(m0, uint8_t *) + m0->m_len;
131759aa14a9SRui Paulo 	switch (subtype) {
131859aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
131959aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_BEACON:
132059aa14a9SRui Paulo 	{
132159aa14a9SRui Paulo 		struct ieee80211_scanparams scan;
132259aa14a9SRui Paulo 		/*
132359aa14a9SRui Paulo 		 * We process beacon/probe response
132459aa14a9SRui Paulo 		 * frames to discover neighbors.
132559aa14a9SRui Paulo 		 */
132659aa14a9SRui Paulo 		if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
132759aa14a9SRui Paulo 			return;
132859aa14a9SRui Paulo 		/*
132959aa14a9SRui Paulo 		 * Count frame now that we know it's to be processed.
133059aa14a9SRui Paulo 		 */
133159aa14a9SRui Paulo 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
133259aa14a9SRui Paulo 			vap->iv_stats.is_rx_beacon++;	/* XXX remove */
133359aa14a9SRui Paulo 			IEEE80211_NODE_STAT(ni, rx_beacons);
133459aa14a9SRui Paulo 		} else
133559aa14a9SRui Paulo 			IEEE80211_NODE_STAT(ni, rx_proberesp);
133659aa14a9SRui Paulo 		/*
133759aa14a9SRui Paulo 		 * If scanning, just pass information to the scan module.
133859aa14a9SRui Paulo 		 */
133959aa14a9SRui Paulo 		if (ic->ic_flags & IEEE80211_F_SCAN) {
134059aa14a9SRui Paulo 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
134159aa14a9SRui Paulo 				/*
134259aa14a9SRui Paulo 				 * Actively scanning a channel marked passive;
134359aa14a9SRui Paulo 				 * send a probe request now that we know there
134459aa14a9SRui Paulo 				 * is 802.11 traffic present.
134559aa14a9SRui Paulo 				 *
134659aa14a9SRui Paulo 				 * XXX check if the beacon we recv'd gives
134759aa14a9SRui Paulo 				 * us what we need and suppress the probe req
134859aa14a9SRui Paulo 				 */
134959aa14a9SRui Paulo 				ieee80211_probe_curchan(vap, 1);
135059aa14a9SRui Paulo 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
135159aa14a9SRui Paulo 			}
135259aa14a9SRui Paulo 			ieee80211_add_scan(vap, &scan, wh,
135359aa14a9SRui Paulo 			    subtype, rssi, nf);
135459aa14a9SRui Paulo 			return;
135559aa14a9SRui Paulo 		}
135659aa14a9SRui Paulo 
135759aa14a9SRui Paulo 		/* The rest of this code assumes we are running */
135859aa14a9SRui Paulo 		if (vap->iv_state != IEEE80211_S_RUN)
135959aa14a9SRui Paulo 			return;
136059aa14a9SRui Paulo 		/*
136159aa14a9SRui Paulo 		 * Ignore non-mesh STAs.
136259aa14a9SRui Paulo 		 */
136359aa14a9SRui Paulo 		if ((scan.capinfo &
136459aa14a9SRui Paulo 		     (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
136559aa14a9SRui Paulo 		    scan.meshid == NULL || scan.meshconf == NULL) {
136659aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
136759aa14a9SRui Paulo 			    wh, "beacon", "%s", "not a mesh sta");
136859aa14a9SRui Paulo 			vap->iv_stats.is_mesh_wrongmesh++;
136959aa14a9SRui Paulo 			return;
137059aa14a9SRui Paulo 		}
137159aa14a9SRui Paulo 		/*
137259aa14a9SRui Paulo 		 * Ignore STAs for other mesh networks.
137359aa14a9SRui Paulo 		 */
137459aa14a9SRui Paulo 		if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
137559aa14a9SRui Paulo 		    mesh_verify_meshconf(vap, scan.meshconf)) {
137659aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
137759aa14a9SRui Paulo 			    wh, "beacon", "%s", "not for our mesh");
137859aa14a9SRui Paulo 			vap->iv_stats.is_mesh_wrongmesh++;
137959aa14a9SRui Paulo 			return;
138059aa14a9SRui Paulo 		}
138159aa14a9SRui Paulo 		/*
138259aa14a9SRui Paulo 		 * Peer only based on the current ACL policy.
138359aa14a9SRui Paulo 		 */
138459aa14a9SRui Paulo 		if (vap->iv_acl != NULL &&
138559aa14a9SRui Paulo 		    !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
138659aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
138759aa14a9SRui Paulo 			    wh, NULL, "%s", "disallowed by ACL");
138859aa14a9SRui Paulo 			vap->iv_stats.is_rx_acl++;
138959aa14a9SRui Paulo 			return;
139059aa14a9SRui Paulo 		}
139159aa14a9SRui Paulo 		/*
139259aa14a9SRui Paulo 		 * Do neighbor discovery.
139359aa14a9SRui Paulo 		 */
139459aa14a9SRui Paulo 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
139559aa14a9SRui Paulo 			/*
139659aa14a9SRui Paulo 			 * Create a new entry in the neighbor table.
139759aa14a9SRui Paulo 			 */
139859aa14a9SRui Paulo 			ni = ieee80211_add_neighbor(vap, wh, &scan);
139959aa14a9SRui Paulo 		}
140059aa14a9SRui Paulo 		/*
140159aa14a9SRui Paulo 		 * Automatically peer with discovered nodes if possible.
140259aa14a9SRui Paulo 		 * XXX backoff on repeated failure
140359aa14a9SRui Paulo 		 */
140459aa14a9SRui Paulo 		if (ni != vap->iv_bss &&
140559aa14a9SRui Paulo 		    (ms->ms_flags & IEEE80211_MESHFLAGS_AP) &&
140659aa14a9SRui Paulo 		    ni->ni_mlstate == IEEE80211_NODE_MESH_IDLE) {
140759aa14a9SRui Paulo 			uint16_t args[1];
140859aa14a9SRui Paulo 
140959aa14a9SRui Paulo 			ni->ni_mlpid = mesh_generateid(vap);
141059aa14a9SRui Paulo 			if (ni->ni_mlpid == 0)
141159aa14a9SRui Paulo 				return;
141259aa14a9SRui Paulo 			mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
141359aa14a9SRui Paulo 			args[0] = ni->ni_mlpid;
141459aa14a9SRui Paulo 			ieee80211_send_action(ni,
141559aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
141659aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_OPEN, args);
141759aa14a9SRui Paulo 			ni->ni_mlrcnt = 0;
141859aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
141959aa14a9SRui Paulo 		}
142059aa14a9SRui Paulo 		break;
142159aa14a9SRui Paulo 	}
142259aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
142359aa14a9SRui Paulo 	{
142459aa14a9SRui Paulo 		uint8_t *ssid, *meshid, *rates, *xrates;
142559aa14a9SRui Paulo 		uint8_t *sfrm;
142659aa14a9SRui Paulo 
142759aa14a9SRui Paulo 		if (vap->iv_state != IEEE80211_S_RUN) {
142859aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
142959aa14a9SRui Paulo 			    wh, NULL, "wrong state %s",
143059aa14a9SRui Paulo 			    ieee80211_state_name[vap->iv_state]);
143159aa14a9SRui Paulo 			vap->iv_stats.is_rx_mgtdiscard++;
143259aa14a9SRui Paulo 			return;
143359aa14a9SRui Paulo 		}
143459aa14a9SRui Paulo 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
143559aa14a9SRui Paulo 			/* frame must be directed */
143659aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
143759aa14a9SRui Paulo 			    wh, NULL, "%s", "not unicast");
143859aa14a9SRui Paulo 			vap->iv_stats.is_rx_mgtdiscard++;	/* XXX stat */
143959aa14a9SRui Paulo 			return;
144059aa14a9SRui Paulo 		}
144159aa14a9SRui Paulo 		/*
144259aa14a9SRui Paulo 		 * prreq frame format
144359aa14a9SRui Paulo 		 *      [tlv] ssid
144459aa14a9SRui Paulo 		 *      [tlv] supported rates
144559aa14a9SRui Paulo 		 *      [tlv] extended supported rates
144659aa14a9SRui Paulo 		 *	[tlv] mesh id
144759aa14a9SRui Paulo 		 */
144859aa14a9SRui Paulo 		ssid = meshid = rates = xrates = NULL;
144959aa14a9SRui Paulo 		sfrm = frm;
145059aa14a9SRui Paulo 		while (efrm - frm > 1) {
145159aa14a9SRui Paulo 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
145259aa14a9SRui Paulo 			switch (*frm) {
145359aa14a9SRui Paulo 			case IEEE80211_ELEMID_SSID:
145459aa14a9SRui Paulo 				ssid = frm;
145559aa14a9SRui Paulo 				break;
145659aa14a9SRui Paulo 			case IEEE80211_ELEMID_RATES:
145759aa14a9SRui Paulo 				rates = frm;
145859aa14a9SRui Paulo 				break;
145959aa14a9SRui Paulo 			case IEEE80211_ELEMID_XRATES:
146059aa14a9SRui Paulo 				xrates = frm;
146159aa14a9SRui Paulo 				break;
146259aa14a9SRui Paulo 			case IEEE80211_ELEMID_MESHID:
146359aa14a9SRui Paulo 				meshid = frm;
146459aa14a9SRui Paulo 				break;
146559aa14a9SRui Paulo 			}
1466d3befdecSBernhard Schmidt 			frm += frm[1] + 2;
146759aa14a9SRui Paulo 		}
146859aa14a9SRui Paulo 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
146959aa14a9SRui Paulo 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
147059aa14a9SRui Paulo 		if (xrates != NULL)
147159aa14a9SRui Paulo 			IEEE80211_VERIFY_ELEMENT(xrates,
147259aa14a9SRui Paulo 			    IEEE80211_RATE_MAXSIZE - rates[1], return);
14736c946257SRui Paulo 		if (meshid != NULL) {
147459aa14a9SRui Paulo 			IEEE80211_VERIFY_ELEMENT(meshid,
147559aa14a9SRui Paulo 			    IEEE80211_MESHID_LEN, return);
147659aa14a9SRui Paulo 			/* NB: meshid, not ssid */
147759aa14a9SRui Paulo 			IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
14786c946257SRui Paulo 		}
147959aa14a9SRui Paulo 
148059aa14a9SRui Paulo 		/* XXX find a better class or define it's own */
148159aa14a9SRui Paulo 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
148259aa14a9SRui Paulo 		    "%s", "recv probe req");
148359aa14a9SRui Paulo 		/*
148459aa14a9SRui Paulo 		 * Some legacy 11b clients cannot hack a complete
148559aa14a9SRui Paulo 		 * probe response frame.  When the request includes
148659aa14a9SRui Paulo 		 * only a bare-bones rate set, communicate this to
148759aa14a9SRui Paulo 		 * the transmit side.
148859aa14a9SRui Paulo 		 */
148959aa14a9SRui Paulo 		ieee80211_send_proberesp(vap, wh->i_addr2, 0);
149059aa14a9SRui Paulo 		break;
149159aa14a9SRui Paulo 	}
1492*96283082SBernhard Schmidt 
149359aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_ACTION:
1494*96283082SBernhard Schmidt 	case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
149559aa14a9SRui Paulo 		/*
149659aa14a9SRui Paulo 		 * We received an action for an unknown neighbor.
149759aa14a9SRui Paulo 		 * XXX: wait for it to beacon or create ieee80211_node?
149859aa14a9SRui Paulo 		 */
149959aa14a9SRui Paulo 		if (ni == vap->iv_bss) {
150059aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_MESH,
150159aa14a9SRui Paulo 			    wh, NULL, "%s", "unknown node");
150259aa14a9SRui Paulo 			vap->iv_stats.is_rx_mgtdiscard++;
150359aa14a9SRui Paulo 			break;
150459aa14a9SRui Paulo 		}
150559aa14a9SRui Paulo 		/*
150659aa14a9SRui Paulo 		 * Discard if not for us.
1507*96283082SBernhard Schmidt 		 * XXX: if from us too?
150859aa14a9SRui Paulo 		 */
150959aa14a9SRui Paulo 		if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
151059aa14a9SRui Paulo 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
151159aa14a9SRui Paulo 			IEEE80211_DISCARD(vap, IEEE80211_MSG_MESH,
151259aa14a9SRui Paulo 			    wh, NULL, "%s", "not for me");
151359aa14a9SRui Paulo 			vap->iv_stats.is_rx_mgtdiscard++;
151459aa14a9SRui Paulo 			break;
151559aa14a9SRui Paulo 		}
1516*96283082SBernhard Schmidt 		if (vap->iv_state == IEEE80211_S_RUN) {
151759aa14a9SRui Paulo 			if (ieee80211_parse_action(ni, m0) == 0)
1518*96283082SBernhard Schmidt 				(void)ic->ic_recv_action(ni, wh, frm, efrm);
1519*96283082SBernhard Schmidt 		} else {
1520*96283082SBernhard Schmidt 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1521*96283082SBernhard Schmidt 			    wh, NULL, "wrong state %s",
1522*96283082SBernhard Schmidt 			    ieee80211_state_name[vap->iv_state]);
1523*96283082SBernhard Schmidt 			vap->iv_stats.is_rx_mgtdiscard++;
1524*96283082SBernhard Schmidt 		}
152559aa14a9SRui Paulo 		break;
1526*96283082SBernhard Schmidt 
152759aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
152859aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1529*96283082SBernhard Schmidt 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
153059aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1531*96283082SBernhard Schmidt 	case IEEE80211_FC0_SUBTYPE_ATIM:
153259aa14a9SRui Paulo 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1533*96283082SBernhard Schmidt 	case IEEE80211_FC0_SUBTYPE_AUTH:
1534*96283082SBernhard Schmidt 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
153559aa14a9SRui Paulo 		IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
153659aa14a9SRui Paulo 		    wh, NULL, "%s", "not handled");
153759aa14a9SRui Paulo 		vap->iv_stats.is_rx_mgtdiscard++;
1538*96283082SBernhard Schmidt 		break;
1539*96283082SBernhard Schmidt 
154059aa14a9SRui Paulo 	default:
154159aa14a9SRui Paulo 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
154259aa14a9SRui Paulo 		    wh, "mgt", "subtype 0x%x not handled", subtype);
154359aa14a9SRui Paulo 		vap->iv_stats.is_rx_badsubtype++;
154459aa14a9SRui Paulo 		break;
154559aa14a9SRui Paulo 	}
154659aa14a9SRui Paulo }
154759aa14a9SRui Paulo 
15480917631fSRui Paulo static void
15490917631fSRui Paulo mesh_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
15500917631fSRui Paulo {
15510917631fSRui Paulo 
15520917631fSRui Paulo 	switch (subtype) {
15530917631fSRui Paulo 	case IEEE80211_FC0_SUBTYPE_BAR:
15540917631fSRui Paulo 		ieee80211_recv_bar(ni, m);
15550917631fSRui Paulo 		break;
15560917631fSRui Paulo 	}
15570917631fSRui Paulo }
15580917631fSRui Paulo 
155959aa14a9SRui Paulo /*
156059aa14a9SRui Paulo  * Parse meshpeering action ie's for open+confirm frames; the
156159aa14a9SRui Paulo  * important bits are returned in the supplied structure.
156259aa14a9SRui Paulo  */
156359aa14a9SRui Paulo static const struct ieee80211_meshpeer_ie *
156459aa14a9SRui Paulo mesh_parse_meshpeering_action(struct ieee80211_node *ni,
156559aa14a9SRui Paulo 	const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
156659aa14a9SRui Paulo 	const uint8_t *frm, const uint8_t *efrm,
1567c77735e2SRui Paulo 	struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
156859aa14a9SRui Paulo {
156959aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
157059aa14a9SRui Paulo 	const struct ieee80211_meshpeer_ie *mpie;
1571c77735e2SRui Paulo 	const uint8_t *meshid, *meshconf, *meshpeer;
157259aa14a9SRui Paulo 
1573c77735e2SRui Paulo 	meshid = meshconf = meshpeer = NULL;
157459aa14a9SRui Paulo 	while (efrm - frm > 1) {
157559aa14a9SRui Paulo 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
157659aa14a9SRui Paulo 		switch (*frm) {
157759aa14a9SRui Paulo 		case IEEE80211_ELEMID_MESHID:
157859aa14a9SRui Paulo 			meshid = frm;
157959aa14a9SRui Paulo 			break;
158059aa14a9SRui Paulo 		case IEEE80211_ELEMID_MESHCONF:
158159aa14a9SRui Paulo 			meshconf = frm;
158259aa14a9SRui Paulo 			break;
158359aa14a9SRui Paulo 		case IEEE80211_ELEMID_MESHPEER:
158459aa14a9SRui Paulo 			meshpeer = frm;
158559aa14a9SRui Paulo 			mpie = (const struct ieee80211_meshpeer_ie *) frm;
158659aa14a9SRui Paulo 			memset(mp, 0, sizeof(*mp));
158759aa14a9SRui Paulo 			mp->peer_llinkid = LE_READ_2(&mpie->peer_llinkid);
158859aa14a9SRui Paulo 			/* NB: peer link ID is optional on these frames */
1589c77735e2SRui Paulo 			if (subtype == IEEE80211_MESH_PEER_LINK_CLOSE &&
1590c77735e2SRui Paulo 			    mpie->peer_len == 8) {
159159aa14a9SRui Paulo 				mp->peer_linkid = 0;
159259aa14a9SRui Paulo 				mp->peer_rcode = LE_READ_2(&mpie->peer_linkid);
159359aa14a9SRui Paulo 			} else {
159459aa14a9SRui Paulo 				mp->peer_linkid = LE_READ_2(&mpie->peer_linkid);
159559aa14a9SRui Paulo 				mp->peer_rcode = LE_READ_2(&mpie->peer_rcode);
159659aa14a9SRui Paulo 			}
159759aa14a9SRui Paulo 			break;
159859aa14a9SRui Paulo 		}
159959aa14a9SRui Paulo 		frm += frm[1] + 2;
160059aa14a9SRui Paulo 	}
160159aa14a9SRui Paulo 
160259aa14a9SRui Paulo 	/*
160359aa14a9SRui Paulo 	 * Verify the contents of the frame. Action frames with
160459aa14a9SRui Paulo 	 * close subtype don't have a Mesh Configuration IE.
160559aa14a9SRui Paulo 	 * If if fails validation, close the peer link.
160659aa14a9SRui Paulo 	 */
1607c77735e2SRui Paulo 	KASSERT(meshpeer != NULL &&
1608c77735e2SRui Paulo 	    subtype != IEEE80211_ACTION_MESHPEERING_CLOSE,
1609c77735e2SRui Paulo 	    ("parsing close action"));
161059aa14a9SRui Paulo 
1611c77735e2SRui Paulo 	if (mesh_verify_meshid(vap, meshid) ||
1612c77735e2SRui Paulo 	    mesh_verify_meshpeer(vap, subtype, meshpeer) ||
161359aa14a9SRui Paulo 	    mesh_verify_meshconf(vap, meshconf)) {
161459aa14a9SRui Paulo 		uint16_t args[3];
161559aa14a9SRui Paulo 
161659aa14a9SRui Paulo 		IEEE80211_DISCARD(vap,
161759aa14a9SRui Paulo 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
161859aa14a9SRui Paulo 		    wh, NULL, "%s", "not for our mesh");
161959aa14a9SRui Paulo 		vap->iv_stats.is_rx_mgtdiscard++;
162059aa14a9SRui Paulo 		switch (ni->ni_mlstate) {
162159aa14a9SRui Paulo 		case IEEE80211_NODE_MESH_IDLE:
162259aa14a9SRui Paulo 		case IEEE80211_NODE_MESH_ESTABLISHED:
162359aa14a9SRui Paulo 		case IEEE80211_NODE_MESH_HOLDING:
162459aa14a9SRui Paulo 			/* ignore */
162559aa14a9SRui Paulo 			break;
162659aa14a9SRui Paulo 		case IEEE80211_NODE_MESH_OPENSNT:
162759aa14a9SRui Paulo 		case IEEE80211_NODE_MESH_OPENRCV:
162859aa14a9SRui Paulo 		case IEEE80211_NODE_MESH_CONFIRMRCV:
162959aa14a9SRui Paulo 			args[0] = ni->ni_mlpid;
163059aa14a9SRui Paulo 			args[1] = ni->ni_mllid;
163159aa14a9SRui Paulo 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
163259aa14a9SRui Paulo 			ieee80211_send_action(ni,
163359aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
163459aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
163559aa14a9SRui Paulo 			    args);
163659aa14a9SRui Paulo 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
163759aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
163859aa14a9SRui Paulo 			break;
163959aa14a9SRui Paulo 		}
164059aa14a9SRui Paulo 		return NULL;
164159aa14a9SRui Paulo 	}
164259aa14a9SRui Paulo 	return (const struct ieee80211_meshpeer_ie *) mp;
164359aa14a9SRui Paulo }
164459aa14a9SRui Paulo 
164559aa14a9SRui Paulo static int
164659aa14a9SRui Paulo mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
164759aa14a9SRui Paulo 	const struct ieee80211_frame *wh,
164859aa14a9SRui Paulo 	const uint8_t *frm, const uint8_t *efrm)
164959aa14a9SRui Paulo {
165059aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
165159aa14a9SRui Paulo 	struct ieee80211_meshpeer_ie ie;
165259aa14a9SRui Paulo 	const struct ieee80211_meshpeer_ie *meshpeer;
165359aa14a9SRui Paulo 	uint16_t args[3];
165459aa14a9SRui Paulo 
165559aa14a9SRui Paulo 	/* +2+2 for action + code + capabilites */
1656c77735e2SRui Paulo 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
1657c77735e2SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_OPEN);
165859aa14a9SRui Paulo 	if (meshpeer == NULL) {
165959aa14a9SRui Paulo 		return 0;
166059aa14a9SRui Paulo 	}
166159aa14a9SRui Paulo 
166259aa14a9SRui Paulo 	/* XXX move up */
166359aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
166459aa14a9SRui Paulo 	    "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
166559aa14a9SRui Paulo 
166659aa14a9SRui Paulo 	switch (ni->ni_mlstate) {
166759aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_IDLE:
166859aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
166959aa14a9SRui Paulo 		ni->ni_mllid = meshpeer->peer_llinkid;
167059aa14a9SRui Paulo 		ni->ni_mlpid = mesh_generateid(vap);
167159aa14a9SRui Paulo 		if (ni->ni_mlpid == 0)
167259aa14a9SRui Paulo 			return 0;		/* XXX */
167359aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
167459aa14a9SRui Paulo 		/* Announce we're open too... */
167559aa14a9SRui Paulo 		ieee80211_send_action(ni,
167659aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
167759aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_OPEN, args);
167859aa14a9SRui Paulo 		/* ...and confirm the link. */
167959aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
168059aa14a9SRui Paulo 		args[1] = ni->ni_mllid;
168159aa14a9SRui Paulo 		ieee80211_send_action(ni,
168259aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
168359aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
168459aa14a9SRui Paulo 		    args);
168559aa14a9SRui Paulo 		mesh_peer_timeout_setup(ni);
168659aa14a9SRui Paulo 		break;
168759aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENRCV:
168859aa14a9SRui Paulo 		/* Wrong Link ID */
168959aa14a9SRui Paulo 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
169059aa14a9SRui Paulo 			args[0] = ni->ni_mllid;
169159aa14a9SRui Paulo 			args[1] = ni->ni_mlpid;
169259aa14a9SRui Paulo 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
169359aa14a9SRui Paulo 			ieee80211_send_action(ni,
169459aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
169559aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
169659aa14a9SRui Paulo 			    args);
169759aa14a9SRui Paulo 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
169859aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
169959aa14a9SRui Paulo 			break;
170059aa14a9SRui Paulo 		}
170159aa14a9SRui Paulo 		/* Duplicate open, confirm again. */
170259aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
170359aa14a9SRui Paulo 		args[1] = ni->ni_mllid;
170459aa14a9SRui Paulo 		ieee80211_send_action(ni,
170559aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
170659aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
170759aa14a9SRui Paulo 		    args);
170859aa14a9SRui Paulo 		break;
170959aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENSNT:
171059aa14a9SRui Paulo 		ni->ni_mllid = meshpeer->peer_llinkid;
171159aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
171259aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
171359aa14a9SRui Paulo 		args[1] = ni->ni_mllid;
171459aa14a9SRui Paulo 		ieee80211_send_action(ni,
171559aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
171659aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
171759aa14a9SRui Paulo 		    args);
171859aa14a9SRui Paulo 		/* NB: don't setup/clear any timeout */
171959aa14a9SRui Paulo 		break;
172059aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_CONFIRMRCV:
172159aa14a9SRui Paulo 		if (ni->ni_mlpid != meshpeer->peer_linkid ||
172259aa14a9SRui Paulo 		    ni->ni_mllid != meshpeer->peer_llinkid) {
172359aa14a9SRui Paulo 			args[0] = ni->ni_mlpid;
172459aa14a9SRui Paulo 			args[1] = ni->ni_mllid;
172559aa14a9SRui Paulo 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
172659aa14a9SRui Paulo 			ieee80211_send_action(ni,
172759aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
172859aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
172959aa14a9SRui Paulo 			    args);
173059aa14a9SRui Paulo 			mesh_linkchange(ni,
173159aa14a9SRui Paulo 			    IEEE80211_NODE_MESH_HOLDING);
173259aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
173359aa14a9SRui Paulo 			break;
173459aa14a9SRui Paulo 		}
173559aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
173659aa14a9SRui Paulo 		ni->ni_mllid = meshpeer->peer_llinkid;
173759aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
173859aa14a9SRui Paulo 		args[1] = ni->ni_mllid;
173959aa14a9SRui Paulo 		ieee80211_send_action(ni,
174059aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
174159aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
174259aa14a9SRui Paulo 		    args);
174359aa14a9SRui Paulo 		mesh_peer_timeout_stop(ni);
174459aa14a9SRui Paulo 		break;
174559aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_ESTABLISHED:
174659aa14a9SRui Paulo 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
174759aa14a9SRui Paulo 			args[0] = ni->ni_mllid;
174859aa14a9SRui Paulo 			args[1] = ni->ni_mlpid;
174959aa14a9SRui Paulo 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
175059aa14a9SRui Paulo 			ieee80211_send_action(ni,
175159aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
175259aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
175359aa14a9SRui Paulo 			    args);
175459aa14a9SRui Paulo 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
175559aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
175659aa14a9SRui Paulo 			break;
175759aa14a9SRui Paulo 		}
175859aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
175959aa14a9SRui Paulo 		args[1] = ni->ni_mllid;
176059aa14a9SRui Paulo 		ieee80211_send_action(ni,
176159aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
176259aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
176359aa14a9SRui Paulo 		    args);
176459aa14a9SRui Paulo 		break;
176559aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_HOLDING:
176659aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
176759aa14a9SRui Paulo 		args[1] = meshpeer->peer_llinkid;
176859aa14a9SRui Paulo 		args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
176959aa14a9SRui Paulo 		ieee80211_send_action(ni,
177059aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
177159aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
177259aa14a9SRui Paulo 		    args);
177359aa14a9SRui Paulo 		break;
177459aa14a9SRui Paulo 	}
177559aa14a9SRui Paulo 	return 0;
177659aa14a9SRui Paulo }
177759aa14a9SRui Paulo 
177859aa14a9SRui Paulo static int
177959aa14a9SRui Paulo mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
178059aa14a9SRui Paulo 	const struct ieee80211_frame *wh,
178159aa14a9SRui Paulo 	const uint8_t *frm, const uint8_t *efrm)
178259aa14a9SRui Paulo {
178359aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
178459aa14a9SRui Paulo 	struct ieee80211_meshpeer_ie ie;
178559aa14a9SRui Paulo 	const struct ieee80211_meshpeer_ie *meshpeer;
178659aa14a9SRui Paulo 	uint16_t args[3];
178759aa14a9SRui Paulo 
178859aa14a9SRui Paulo 	/* +2+2+2+2 for action + code + capabilites + status code + AID */
1789c77735e2SRui Paulo 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
1790c77735e2SRui Paulo 	    IEEE80211_ACTION_MESHPEERING_CONFIRM);
179159aa14a9SRui Paulo 	if (meshpeer == NULL) {
179259aa14a9SRui Paulo 		return 0;
179359aa14a9SRui Paulo 	}
179459aa14a9SRui Paulo 
179559aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
179659aa14a9SRui Paulo 	    "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
179759aa14a9SRui Paulo 	    meshpeer->peer_llinkid, meshpeer->peer_linkid);
179859aa14a9SRui Paulo 
179959aa14a9SRui Paulo 	switch (ni->ni_mlstate) {
180059aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENRCV:
180159aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
180259aa14a9SRui Paulo 		mesh_peer_timeout_stop(ni);
180359aa14a9SRui Paulo 		break;
180459aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENSNT:
180559aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
180659aa14a9SRui Paulo 		break;
180759aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_HOLDING:
180859aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
180959aa14a9SRui Paulo 		args[1] = meshpeer->peer_llinkid;
181059aa14a9SRui Paulo 		args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
181159aa14a9SRui Paulo 		ieee80211_send_action(ni,
181259aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
181359aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
181459aa14a9SRui Paulo 		    args);
181559aa14a9SRui Paulo 		break;
181659aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_CONFIRMRCV:
181759aa14a9SRui Paulo 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
181859aa14a9SRui Paulo 			args[0] = ni->ni_mlpid;
181959aa14a9SRui Paulo 			args[1] = ni->ni_mllid;
182059aa14a9SRui Paulo 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
182159aa14a9SRui Paulo 			ieee80211_send_action(ni,
182259aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
182359aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
182459aa14a9SRui Paulo 			    args);
182559aa14a9SRui Paulo 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
182659aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
182759aa14a9SRui Paulo 		}
182859aa14a9SRui Paulo 		break;
182959aa14a9SRui Paulo 	default:
183059aa14a9SRui Paulo 		IEEE80211_DISCARD(vap,
183159aa14a9SRui Paulo 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
183259aa14a9SRui Paulo 		    wh, NULL, "received confirm in invalid state %d",
183359aa14a9SRui Paulo 		    ni->ni_mlstate);
183459aa14a9SRui Paulo 		vap->iv_stats.is_rx_mgtdiscard++;
183559aa14a9SRui Paulo 		break;
183659aa14a9SRui Paulo 	}
183759aa14a9SRui Paulo 	return 0;
183859aa14a9SRui Paulo }
183959aa14a9SRui Paulo 
184059aa14a9SRui Paulo static int
184159aa14a9SRui Paulo mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
184259aa14a9SRui Paulo 	const struct ieee80211_frame *wh,
184359aa14a9SRui Paulo 	const uint8_t *frm, const uint8_t *efrm)
184459aa14a9SRui Paulo {
184559aa14a9SRui Paulo 	uint16_t args[3];
184659aa14a9SRui Paulo 
184759aa14a9SRui Paulo 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
184859aa14a9SRui Paulo 	    ni, "%s", "recv PEER CLOSE");
184959aa14a9SRui Paulo 
185059aa14a9SRui Paulo 	switch (ni->ni_mlstate) {
185159aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_IDLE:
185259aa14a9SRui Paulo 		/* ignore */
185359aa14a9SRui Paulo 		break;
185459aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENRCV:
185559aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENSNT:
185659aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_CONFIRMRCV:
185759aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_ESTABLISHED:
185859aa14a9SRui Paulo 		args[0] = ni->ni_mlpid;
185959aa14a9SRui Paulo 		args[1] = ni->ni_mllid;
186059aa14a9SRui Paulo 		args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
186159aa14a9SRui Paulo 		ieee80211_send_action(ni,
186259aa14a9SRui Paulo 		    IEEE80211_ACTION_CAT_MESHPEERING,
186359aa14a9SRui Paulo 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
186459aa14a9SRui Paulo 		    args);
186559aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
186659aa14a9SRui Paulo 		mesh_peer_timeout_setup(ni);
186759aa14a9SRui Paulo 		break;
186859aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_HOLDING:
186959aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
187059aa14a9SRui Paulo 		mesh_peer_timeout_setup(ni);
187159aa14a9SRui Paulo 		break;
187259aa14a9SRui Paulo 	}
187359aa14a9SRui Paulo 	return 0;
187459aa14a9SRui Paulo }
187559aa14a9SRui Paulo 
187659aa14a9SRui Paulo /*
187759aa14a9SRui Paulo  * Link Metric handling.
187859aa14a9SRui Paulo  */
187959aa14a9SRui Paulo static int
188059aa14a9SRui Paulo mesh_recv_action_meshlmetric_req(struct ieee80211_node *ni,
188159aa14a9SRui Paulo 	const struct ieee80211_frame *wh,
188259aa14a9SRui Paulo 	const uint8_t *frm, const uint8_t *efrm)
188359aa14a9SRui Paulo {
188459aa14a9SRui Paulo 	uint32_t metric;
188559aa14a9SRui Paulo 
188659aa14a9SRui Paulo 	metric = mesh_airtime_calc(ni);
188759aa14a9SRui Paulo 	ieee80211_send_action(ni,
188859aa14a9SRui Paulo 	    IEEE80211_ACTION_CAT_MESHLMETRIC,
188959aa14a9SRui Paulo 	    IEEE80211_ACTION_MESHLMETRIC_REP,
189059aa14a9SRui Paulo 	    &metric);
189159aa14a9SRui Paulo 	return 0;
189259aa14a9SRui Paulo }
189359aa14a9SRui Paulo 
189459aa14a9SRui Paulo static int
189559aa14a9SRui Paulo mesh_recv_action_meshlmetric_rep(struct ieee80211_node *ni,
189659aa14a9SRui Paulo 	const struct ieee80211_frame *wh,
189759aa14a9SRui Paulo 	const uint8_t *frm, const uint8_t *efrm)
189859aa14a9SRui Paulo {
189959aa14a9SRui Paulo 	return 0;
190059aa14a9SRui Paulo }
190159aa14a9SRui Paulo 
190259aa14a9SRui Paulo static int
190359aa14a9SRui Paulo mesh_send_action(struct ieee80211_node *ni, struct mbuf *m)
190459aa14a9SRui Paulo {
190559aa14a9SRui Paulo 	struct ieee80211_bpf_params params;
190659aa14a9SRui Paulo 
190759aa14a9SRui Paulo 	memset(&params, 0, sizeof(params));
190859aa14a9SRui Paulo 	params.ibp_pri = WME_AC_VO;
190959aa14a9SRui Paulo 	params.ibp_rate0 = ni->ni_txparms->mgmtrate;
191059aa14a9SRui Paulo 	/* XXX ucast/mcast */
191159aa14a9SRui Paulo 	params.ibp_try0 = ni->ni_txparms->maxretry;
191259aa14a9SRui Paulo 	params.ibp_power = ni->ni_txpower;
191359aa14a9SRui Paulo 	return ieee80211_mgmt_output(ni, m, IEEE80211_FC0_SUBTYPE_ACTION,
191459aa14a9SRui Paulo 	     &params);
191559aa14a9SRui Paulo }
191659aa14a9SRui Paulo 
191759aa14a9SRui Paulo #define	ADDSHORT(frm, v) do {			\
191859aa14a9SRui Paulo 	frm[0] = (v) & 0xff;			\
191959aa14a9SRui Paulo 	frm[1] = (v) >> 8;			\
192059aa14a9SRui Paulo 	frm += 2;				\
192159aa14a9SRui Paulo } while (0)
192259aa14a9SRui Paulo #define	ADDWORD(frm, v) do {			\
192359aa14a9SRui Paulo 	frm[0] = (v) & 0xff;			\
192459aa14a9SRui Paulo 	frm[1] = ((v) >> 8) & 0xff;		\
192559aa14a9SRui Paulo 	frm[2] = ((v) >> 16) & 0xff;		\
192659aa14a9SRui Paulo 	frm[3] = ((v) >> 24) & 0xff;		\
192759aa14a9SRui Paulo 	frm += 4;				\
192859aa14a9SRui Paulo } while (0)
192959aa14a9SRui Paulo 
193059aa14a9SRui Paulo static int
193159aa14a9SRui Paulo mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
193259aa14a9SRui Paulo 	int category, int action, void *args0)
193359aa14a9SRui Paulo {
193459aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
193559aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
193659aa14a9SRui Paulo 	uint16_t *args = args0;
193759aa14a9SRui Paulo 	const struct ieee80211_rateset *rs;
193859aa14a9SRui Paulo 	struct mbuf *m;
193959aa14a9SRui Paulo 	uint8_t *frm;
194059aa14a9SRui Paulo 
194159aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
194259aa14a9SRui Paulo 	    "send PEER OPEN action: localid 0x%x", args[0]);
194359aa14a9SRui Paulo 
194459aa14a9SRui Paulo 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
194559aa14a9SRui Paulo 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
194659aa14a9SRui Paulo 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
194759aa14a9SRui Paulo 	ieee80211_ref_node(ni);
194859aa14a9SRui Paulo 
194959aa14a9SRui Paulo 	m = ieee80211_getmgtframe(&frm,
195059aa14a9SRui Paulo 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
195159aa14a9SRui Paulo 	    sizeof(uint16_t)	/* action+category */
195259aa14a9SRui Paulo 	    + sizeof(uint16_t)	/* capabilites */
195359aa14a9SRui Paulo 	    + 2 + IEEE80211_RATE_SIZE
195459aa14a9SRui Paulo 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
195559aa14a9SRui Paulo 	    + 2 + IEEE80211_MESHID_LEN
195659aa14a9SRui Paulo 	    + sizeof(struct ieee80211_meshconf_ie)
195759aa14a9SRui Paulo 	    + sizeof(struct ieee80211_meshpeer_ie)
195859aa14a9SRui Paulo 	);
195959aa14a9SRui Paulo 	if (m != NULL) {
196059aa14a9SRui Paulo 		/*
196159aa14a9SRui Paulo 		 * mesh peer open action frame format:
196259aa14a9SRui Paulo 		 *   [1] category
196359aa14a9SRui Paulo 		 *   [1] action
196459aa14a9SRui Paulo 		 *   [2] capabilities
196559aa14a9SRui Paulo 		 *   [tlv] rates
196659aa14a9SRui Paulo 		 *   [tlv] xrates
196759aa14a9SRui Paulo 		 *   [tlv] mesh id
196859aa14a9SRui Paulo 		 *   [tlv] mesh conf
196959aa14a9SRui Paulo 		 *   [tlv] mesh peer link mgmt
197059aa14a9SRui Paulo 		 */
197159aa14a9SRui Paulo 		*frm++ = category;
197259aa14a9SRui Paulo 		*frm++ = action;
197359aa14a9SRui Paulo 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
197459aa14a9SRui Paulo 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
197559aa14a9SRui Paulo 		frm = ieee80211_add_rates(frm, rs);
197659aa14a9SRui Paulo 		frm = ieee80211_add_xrates(frm, rs);
197759aa14a9SRui Paulo 		frm = ieee80211_add_meshid(frm, vap);
197859aa14a9SRui Paulo 		frm = ieee80211_add_meshconf(frm, vap);
197959aa14a9SRui Paulo 		frm = ieee80211_add_meshpeer(frm, IEEE80211_MESH_PEER_LINK_OPEN,
198059aa14a9SRui Paulo 		    args[0], 0, 0);
198159aa14a9SRui Paulo 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
198259aa14a9SRui Paulo 		return mesh_send_action(ni, m);
198359aa14a9SRui Paulo 	} else {
198459aa14a9SRui Paulo 		vap->iv_stats.is_tx_nobuf++;
198559aa14a9SRui Paulo 		ieee80211_free_node(ni);
198659aa14a9SRui Paulo 		return ENOMEM;
198759aa14a9SRui Paulo 	}
198859aa14a9SRui Paulo }
198959aa14a9SRui Paulo 
199059aa14a9SRui Paulo static int
199159aa14a9SRui Paulo mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
199259aa14a9SRui Paulo 	int category, int action, void *args0)
199359aa14a9SRui Paulo {
199459aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
199559aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
199659aa14a9SRui Paulo 	uint16_t *args = args0;
199759aa14a9SRui Paulo 	const struct ieee80211_rateset *rs;
199859aa14a9SRui Paulo 	struct mbuf *m;
199959aa14a9SRui Paulo 	uint8_t *frm;
200059aa14a9SRui Paulo 
200159aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
200259aa14a9SRui Paulo 	    "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
200359aa14a9SRui Paulo 	    args[0], args[1]);
200459aa14a9SRui Paulo 
200559aa14a9SRui Paulo 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
200659aa14a9SRui Paulo 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
200759aa14a9SRui Paulo 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
200859aa14a9SRui Paulo 	ieee80211_ref_node(ni);
200959aa14a9SRui Paulo 
201059aa14a9SRui Paulo 	m = ieee80211_getmgtframe(&frm,
201159aa14a9SRui Paulo 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
201259aa14a9SRui Paulo 	    sizeof(uint16_t)	/* action+category */
201359aa14a9SRui Paulo 	    + sizeof(uint16_t)	/* capabilites */
201459aa14a9SRui Paulo 	    + sizeof(uint16_t)	/* status code */
201559aa14a9SRui Paulo 	    + sizeof(uint16_t)	/* AID */
201659aa14a9SRui Paulo 	    + 2 + IEEE80211_RATE_SIZE
201759aa14a9SRui Paulo 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
201859aa14a9SRui Paulo 	    + 2 + IEEE80211_MESHID_LEN
201959aa14a9SRui Paulo 	    + sizeof(struct ieee80211_meshconf_ie)
202059aa14a9SRui Paulo 	    + sizeof(struct ieee80211_meshpeer_ie)
202159aa14a9SRui Paulo 	);
202259aa14a9SRui Paulo 	if (m != NULL) {
202359aa14a9SRui Paulo 		/*
202459aa14a9SRui Paulo 		 * mesh peer confirm action frame format:
202559aa14a9SRui Paulo 		 *   [1] category
202659aa14a9SRui Paulo 		 *   [1] action
202759aa14a9SRui Paulo 		 *   [2] capabilities
202859aa14a9SRui Paulo 		 *   [2] status code
202959aa14a9SRui Paulo 		 *   [2] association id (peer ID)
203059aa14a9SRui Paulo 		 *   [tlv] rates
203159aa14a9SRui Paulo 		 *   [tlv] xrates
203259aa14a9SRui Paulo 		 *   [tlv] mesh id
203359aa14a9SRui Paulo 		 *   [tlv] mesh conf
203459aa14a9SRui Paulo 		 *   [tlv] mesh peer link mgmt
203559aa14a9SRui Paulo 		 */
203659aa14a9SRui Paulo 		*frm++ = category;
203759aa14a9SRui Paulo 		*frm++ = action;
203859aa14a9SRui Paulo 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
203959aa14a9SRui Paulo 		ADDSHORT(frm, 0);		/* status code */
204059aa14a9SRui Paulo 		ADDSHORT(frm, args[1]);		/* AID */
204159aa14a9SRui Paulo 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
204259aa14a9SRui Paulo 		frm = ieee80211_add_rates(frm, rs);
204359aa14a9SRui Paulo 		frm = ieee80211_add_xrates(frm, rs);
204459aa14a9SRui Paulo 		frm = ieee80211_add_meshid(frm, vap);
204559aa14a9SRui Paulo 		frm = ieee80211_add_meshconf(frm, vap);
204659aa14a9SRui Paulo 		frm = ieee80211_add_meshpeer(frm,
204759aa14a9SRui Paulo 		    IEEE80211_MESH_PEER_LINK_CONFIRM,
204859aa14a9SRui Paulo 		    args[0], args[1], 0);
204959aa14a9SRui Paulo 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
205059aa14a9SRui Paulo 		return mesh_send_action(ni, m);
205159aa14a9SRui Paulo 	} else {
205259aa14a9SRui Paulo 		vap->iv_stats.is_tx_nobuf++;
205359aa14a9SRui Paulo 		ieee80211_free_node(ni);
205459aa14a9SRui Paulo 		return ENOMEM;
205559aa14a9SRui Paulo 	}
205659aa14a9SRui Paulo }
205759aa14a9SRui Paulo 
205859aa14a9SRui Paulo static int
205959aa14a9SRui Paulo mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
206059aa14a9SRui Paulo 	int category, int action, void *args0)
206159aa14a9SRui Paulo {
206259aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
206359aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
206459aa14a9SRui Paulo 	uint16_t *args = args0;
206559aa14a9SRui Paulo 	struct mbuf *m;
206659aa14a9SRui Paulo 	uint8_t *frm;
206759aa14a9SRui Paulo 
206859aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
206959aa14a9SRui Paulo 	    "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d",
207059aa14a9SRui Paulo 	    args[0], args[1], args[2]);
207159aa14a9SRui Paulo 
207259aa14a9SRui Paulo 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
207359aa14a9SRui Paulo 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
207459aa14a9SRui Paulo 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
207559aa14a9SRui Paulo 	ieee80211_ref_node(ni);
207659aa14a9SRui Paulo 
207759aa14a9SRui Paulo 	m = ieee80211_getmgtframe(&frm,
207859aa14a9SRui Paulo 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
207959aa14a9SRui Paulo 	    sizeof(uint16_t)	/* action+category */
208059aa14a9SRui Paulo 	    + sizeof(uint16_t)	/* reason code */
208159aa14a9SRui Paulo 	    + 2 + IEEE80211_MESHID_LEN
208259aa14a9SRui Paulo 	    + sizeof(struct ieee80211_meshpeer_ie)
208359aa14a9SRui Paulo 	);
208459aa14a9SRui Paulo 	if (m != NULL) {
208559aa14a9SRui Paulo 		/*
208659aa14a9SRui Paulo 		 * mesh peer close action frame format:
208759aa14a9SRui Paulo 		 *   [1] category
208859aa14a9SRui Paulo 		 *   [1] action
208959aa14a9SRui Paulo 		 *   [2] reason code
209059aa14a9SRui Paulo 		 *   [tlv] mesh id
209159aa14a9SRui Paulo 		 *   [tlv] mesh peer link mgmt
209259aa14a9SRui Paulo 		 */
209359aa14a9SRui Paulo 		*frm++ = category;
209459aa14a9SRui Paulo 		*frm++ = action;
209559aa14a9SRui Paulo 		ADDSHORT(frm, args[2]);		/* reason code */
209659aa14a9SRui Paulo 		frm = ieee80211_add_meshid(frm, vap);
209759aa14a9SRui Paulo 		frm = ieee80211_add_meshpeer(frm,
209859aa14a9SRui Paulo 		    IEEE80211_MESH_PEER_LINK_CLOSE,
209959aa14a9SRui Paulo 		    args[0], args[1], args[2]);
210059aa14a9SRui Paulo 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
210159aa14a9SRui Paulo 		return mesh_send_action(ni, m);
210259aa14a9SRui Paulo 	} else {
210359aa14a9SRui Paulo 		vap->iv_stats.is_tx_nobuf++;
210459aa14a9SRui Paulo 		ieee80211_free_node(ni);
210559aa14a9SRui Paulo 		return ENOMEM;
210659aa14a9SRui Paulo 	}
210759aa14a9SRui Paulo }
210859aa14a9SRui Paulo 
210959aa14a9SRui Paulo static int
211059aa14a9SRui Paulo mesh_send_action_meshlink_request(struct ieee80211_node *ni,
211159aa14a9SRui Paulo 	int category, int action, void *arg0)
211259aa14a9SRui Paulo {
211359aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
211459aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
211559aa14a9SRui Paulo 	struct mbuf *m;
211659aa14a9SRui Paulo 	uint8_t *frm;
211759aa14a9SRui Paulo 
211859aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
211959aa14a9SRui Paulo 	    "%s", "send LINK METRIC REQUEST action");
212059aa14a9SRui Paulo 
212159aa14a9SRui Paulo 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
212259aa14a9SRui Paulo 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
212359aa14a9SRui Paulo 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
212459aa14a9SRui Paulo 	ieee80211_ref_node(ni);
212559aa14a9SRui Paulo 
212659aa14a9SRui Paulo 	m = ieee80211_getmgtframe(&frm,
212759aa14a9SRui Paulo 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
212859aa14a9SRui Paulo 	    sizeof(uint16_t)	/* action+category */
212959aa14a9SRui Paulo 	);
213059aa14a9SRui Paulo 	if (m != NULL) {
213159aa14a9SRui Paulo 		/*
213259aa14a9SRui Paulo 		 * mesh link metric request
213359aa14a9SRui Paulo 		 *   [1] category
213459aa14a9SRui Paulo 		 *   [1] action
213559aa14a9SRui Paulo 		 */
213659aa14a9SRui Paulo 		*frm++ = category;
213759aa14a9SRui Paulo 		*frm++ = action;
213859aa14a9SRui Paulo 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
213959aa14a9SRui Paulo 		return mesh_send_action(ni, m);
214059aa14a9SRui Paulo 	} else {
214159aa14a9SRui Paulo 		vap->iv_stats.is_tx_nobuf++;
214259aa14a9SRui Paulo 		ieee80211_free_node(ni);
214359aa14a9SRui Paulo 		return ENOMEM;
214459aa14a9SRui Paulo 	}
214559aa14a9SRui Paulo }
214659aa14a9SRui Paulo 
214759aa14a9SRui Paulo static int
214859aa14a9SRui Paulo mesh_send_action_meshlink_reply(struct ieee80211_node *ni,
214959aa14a9SRui Paulo 	int category, int action, void *args0)
215059aa14a9SRui Paulo {
215159aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
215259aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
215359aa14a9SRui Paulo 	uint32_t *metric = args0;
215459aa14a9SRui Paulo 	struct mbuf *m;
215559aa14a9SRui Paulo 	uint8_t *frm;
215659aa14a9SRui Paulo 
215759aa14a9SRui Paulo 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
215859aa14a9SRui Paulo 	    "send LINK METRIC REPLY action: metric 0x%x", *metric);
215959aa14a9SRui Paulo 
216059aa14a9SRui Paulo 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
216159aa14a9SRui Paulo 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
216259aa14a9SRui Paulo 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
216359aa14a9SRui Paulo 	ieee80211_ref_node(ni);
216459aa14a9SRui Paulo 
216559aa14a9SRui Paulo 	m = ieee80211_getmgtframe(&frm,
216659aa14a9SRui Paulo 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
216759aa14a9SRui Paulo 	    sizeof(uint16_t)	/* action+category */
216859aa14a9SRui Paulo 	    + sizeof(struct ieee80211_meshlmetric_ie)
216959aa14a9SRui Paulo 	);
217059aa14a9SRui Paulo 	if (m != NULL) {
217159aa14a9SRui Paulo 		/*
217259aa14a9SRui Paulo 		 * mesh link metric reply
217359aa14a9SRui Paulo 		 *   [1] category
217459aa14a9SRui Paulo 		 *   [1] action
217559aa14a9SRui Paulo 		 *   [tlv] mesh link metric
217659aa14a9SRui Paulo 		 */
217759aa14a9SRui Paulo 		*frm++ = category;
217859aa14a9SRui Paulo 		*frm++ = action;
217959aa14a9SRui Paulo 		frm = ieee80211_add_meshlmetric(frm, *metric);
218059aa14a9SRui Paulo 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
218159aa14a9SRui Paulo 		return mesh_send_action(ni, m);
218259aa14a9SRui Paulo 	} else {
218359aa14a9SRui Paulo 		vap->iv_stats.is_tx_nobuf++;
218459aa14a9SRui Paulo 		ieee80211_free_node(ni);
218559aa14a9SRui Paulo 		return ENOMEM;
218659aa14a9SRui Paulo 	}
218759aa14a9SRui Paulo }
218859aa14a9SRui Paulo 
218959aa14a9SRui Paulo static void
219059aa14a9SRui Paulo mesh_peer_timeout_setup(struct ieee80211_node *ni)
219159aa14a9SRui Paulo {
219259aa14a9SRui Paulo 	switch (ni->ni_mlstate) {
219359aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_HOLDING:
219459aa14a9SRui Paulo 		ni->ni_mltval = ieee80211_mesh_holdingtimeout;
219559aa14a9SRui Paulo 		break;
219659aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_CONFIRMRCV:
219759aa14a9SRui Paulo 		ni->ni_mltval = ieee80211_mesh_confirmtimeout;
219859aa14a9SRui Paulo 		break;
219959aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_IDLE:
220059aa14a9SRui Paulo 		ni->ni_mltval = 0;
220159aa14a9SRui Paulo 		break;
220259aa14a9SRui Paulo 	default:
220359aa14a9SRui Paulo 		ni->ni_mltval = ieee80211_mesh_retrytimeout;
220459aa14a9SRui Paulo 		break;
220559aa14a9SRui Paulo 	}
220659aa14a9SRui Paulo 	if (ni->ni_mltval)
220759aa14a9SRui Paulo 		callout_reset(&ni->ni_mltimer, ni->ni_mltval,
220859aa14a9SRui Paulo 		    mesh_peer_timeout_cb, ni);
220959aa14a9SRui Paulo }
221059aa14a9SRui Paulo 
221159aa14a9SRui Paulo /*
221259aa14a9SRui Paulo  * Same as above but backoffs timer statisically 50%.
221359aa14a9SRui Paulo  */
221459aa14a9SRui Paulo static void
221559aa14a9SRui Paulo mesh_peer_timeout_backoff(struct ieee80211_node *ni)
221659aa14a9SRui Paulo {
221759aa14a9SRui Paulo 	uint32_t r;
221859aa14a9SRui Paulo 
221959aa14a9SRui Paulo 	r = arc4random();
222059aa14a9SRui Paulo 	ni->ni_mltval += r % ni->ni_mltval;
222159aa14a9SRui Paulo 	callout_reset(&ni->ni_mltimer, ni->ni_mltval, mesh_peer_timeout_cb,
222259aa14a9SRui Paulo 	    ni);
222359aa14a9SRui Paulo }
222459aa14a9SRui Paulo 
222559aa14a9SRui Paulo static __inline void
222659aa14a9SRui Paulo mesh_peer_timeout_stop(struct ieee80211_node *ni)
222759aa14a9SRui Paulo {
2228c104cff2SRui Paulo 	callout_drain(&ni->ni_mltimer);
222959aa14a9SRui Paulo }
223059aa14a9SRui Paulo 
223159aa14a9SRui Paulo /*
223259aa14a9SRui Paulo  * Mesh Peer Link Management FSM timeout handling.
223359aa14a9SRui Paulo  */
223459aa14a9SRui Paulo static void
223559aa14a9SRui Paulo mesh_peer_timeout_cb(void *arg)
223659aa14a9SRui Paulo {
223759aa14a9SRui Paulo 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
223859aa14a9SRui Paulo 	uint16_t args[3];
223959aa14a9SRui Paulo 
224059aa14a9SRui Paulo 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
224159aa14a9SRui Paulo 	    ni, "mesh link timeout, state %d, retry counter %d",
224259aa14a9SRui Paulo 	    ni->ni_mlstate, ni->ni_mlrcnt);
224359aa14a9SRui Paulo 
224459aa14a9SRui Paulo 	switch (ni->ni_mlstate) {
224559aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_IDLE:
224659aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_ESTABLISHED:
224759aa14a9SRui Paulo 		break;
224859aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENSNT:
224959aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_OPENRCV:
225059aa14a9SRui Paulo 		if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
225159aa14a9SRui Paulo 			args[0] = ni->ni_mlpid;
225259aa14a9SRui Paulo 			args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
225359aa14a9SRui Paulo 			ieee80211_send_action(ni,
225459aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
225559aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
225659aa14a9SRui Paulo 			ni->ni_mlrcnt = 0;
225759aa14a9SRui Paulo 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
225859aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
225959aa14a9SRui Paulo 		} else {
226059aa14a9SRui Paulo 			args[0] = ni->ni_mlpid;
226159aa14a9SRui Paulo 			ieee80211_send_action(ni,
226259aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
226359aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_OPEN, args);
226459aa14a9SRui Paulo 			ni->ni_mlrcnt++;
226559aa14a9SRui Paulo 			mesh_peer_timeout_backoff(ni);
226659aa14a9SRui Paulo 		}
226759aa14a9SRui Paulo 		break;
226859aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_CONFIRMRCV:
226959aa14a9SRui Paulo 		if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
227059aa14a9SRui Paulo 			args[0] = ni->ni_mlpid;
227159aa14a9SRui Paulo 			args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
227259aa14a9SRui Paulo 			ieee80211_send_action(ni,
227359aa14a9SRui Paulo 			    IEEE80211_ACTION_CAT_MESHPEERING,
227459aa14a9SRui Paulo 			    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
227559aa14a9SRui Paulo 			ni->ni_mlrcnt = 0;
227659aa14a9SRui Paulo 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
227759aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
227859aa14a9SRui Paulo 		} else {
227959aa14a9SRui Paulo 			ni->ni_mlrcnt++;
228059aa14a9SRui Paulo 			mesh_peer_timeout_setup(ni);
228159aa14a9SRui Paulo 		}
228259aa14a9SRui Paulo 		break;
228359aa14a9SRui Paulo 	case IEEE80211_NODE_MESH_HOLDING:
228459aa14a9SRui Paulo 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
228559aa14a9SRui Paulo 		break;
228659aa14a9SRui Paulo 	}
228759aa14a9SRui Paulo }
228859aa14a9SRui Paulo 
2289aec0289dSRui Paulo static int
229059aa14a9SRui Paulo mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
229159aa14a9SRui Paulo {
229259aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
229359aa14a9SRui Paulo 
229459aa14a9SRui Paulo 	if (ie == NULL || ie[1] != ms->ms_idlen)
229559aa14a9SRui Paulo 		return 1;
229659aa14a9SRui Paulo 	return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
229759aa14a9SRui Paulo }
229859aa14a9SRui Paulo 
229959aa14a9SRui Paulo /*
230059aa14a9SRui Paulo  * Check if we are using the same algorithms for this mesh.
230159aa14a9SRui Paulo  */
230259aa14a9SRui Paulo static int
230359aa14a9SRui Paulo mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
230459aa14a9SRui Paulo {
230559aa14a9SRui Paulo 	const struct ieee80211_meshconf_ie *meshconf =
230659aa14a9SRui Paulo 	    (const struct ieee80211_meshconf_ie *) ie;
230759aa14a9SRui Paulo 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
230879ea4264SRui Paulo 	uint16_t cap;
230959aa14a9SRui Paulo 
231059aa14a9SRui Paulo 	if (meshconf == NULL)
231159aa14a9SRui Paulo 		return 1;
23126b8c1829SRui Paulo 	if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
231359aa14a9SRui Paulo 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
23146b8c1829SRui Paulo 		    "unknown path selection algorithm: 0x%x\n",
23156b8c1829SRui Paulo 		    meshconf->conf_pselid);
231659aa14a9SRui Paulo 		return 1;
231759aa14a9SRui Paulo 	}
23186b8c1829SRui Paulo 	if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
231959aa14a9SRui Paulo 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
23206b8c1829SRui Paulo 		    "unknown path metric algorithm: 0x%x\n",
23216b8c1829SRui Paulo 		    meshconf->conf_pmetid);
232259aa14a9SRui Paulo 		return 1;
232359aa14a9SRui Paulo 	}
23246b8c1829SRui Paulo 	if (meshconf->conf_ccid != 0) {
232559aa14a9SRui Paulo 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
23266b8c1829SRui Paulo 		    "unknown congestion control algorithm: 0x%x\n",
23276b8c1829SRui Paulo 		    meshconf->conf_ccid);
232859aa14a9SRui Paulo 		return 1;
232959aa14a9SRui Paulo 	}
23306b8c1829SRui Paulo 	if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
233159aa14a9SRui Paulo 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
23326b8c1829SRui Paulo 		    "unknown sync algorithm: 0x%x\n",
23336b8c1829SRui Paulo 		    meshconf->conf_syncid);
233459aa14a9SRui Paulo 		return 1;
233559aa14a9SRui Paulo 	}
23366b8c1829SRui Paulo 	if (meshconf->conf_authid != 0) {
233759aa14a9SRui Paulo 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
23386b8c1829SRui Paulo 		    "unknown auth auth algorithm: 0x%x\n",
23396b8c1829SRui Paulo 		    meshconf->conf_pselid);
234059aa14a9SRui Paulo 		return 1;
234159aa14a9SRui Paulo 	}
234279ea4264SRui Paulo 	/* NB: conf_cap is only read correctly here */
234379ea4264SRui Paulo 	cap = LE_READ_2(&meshconf->conf_cap);
234459aa14a9SRui Paulo 	/* Not accepting peers */
234579ea4264SRui Paulo 	if (!(cap & IEEE80211_MESHCONF_CAP_AP)) {
234659aa14a9SRui Paulo 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
234759aa14a9SRui Paulo 		    "not accepting peers: 0x%x\n", meshconf->conf_cap);
234859aa14a9SRui Paulo 		return 1;
234959aa14a9SRui Paulo 	}
235059aa14a9SRui Paulo 	return 0;
235159aa14a9SRui Paulo }
235259aa14a9SRui Paulo 
235359aa14a9SRui Paulo static int
2354c77735e2SRui Paulo mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
2355c77735e2SRui Paulo     const uint8_t *ie)
235659aa14a9SRui Paulo {
235759aa14a9SRui Paulo 	const struct ieee80211_meshpeer_ie *meshpeer =
235859aa14a9SRui Paulo 	    (const struct ieee80211_meshpeer_ie *) ie;
235959aa14a9SRui Paulo 
2360c77735e2SRui Paulo 	if (meshpeer == NULL || meshpeer->peer_len < 6 ||
2361c77735e2SRui Paulo 	    meshpeer->peer_len > 10)
236259aa14a9SRui Paulo 		return 1;
2363c77735e2SRui Paulo 	switch (subtype) {
236459aa14a9SRui Paulo 	case IEEE80211_MESH_PEER_LINK_OPEN:
2365c77735e2SRui Paulo 		if (meshpeer->peer_len != 6)
236659aa14a9SRui Paulo 			return 1;
236759aa14a9SRui Paulo 		break;
236859aa14a9SRui Paulo 	case IEEE80211_MESH_PEER_LINK_CONFIRM:
2369c77735e2SRui Paulo 		if (meshpeer->peer_len != 8)
237059aa14a9SRui Paulo 			return 1;
237159aa14a9SRui Paulo 		break;
237259aa14a9SRui Paulo 	case IEEE80211_MESH_PEER_LINK_CLOSE:
2373c77735e2SRui Paulo 		if (meshpeer->peer_len < 8)
237459aa14a9SRui Paulo 			return 1;
2375c77735e2SRui Paulo 		if (meshpeer->peer_len == 8 && meshpeer->peer_linkid != 0)
237659aa14a9SRui Paulo 			return 1;
237759aa14a9SRui Paulo 		if (meshpeer->peer_rcode == 0)
237859aa14a9SRui Paulo 			return 1;
237959aa14a9SRui Paulo 		break;
238059aa14a9SRui Paulo 	}
238159aa14a9SRui Paulo 	return 0;
238259aa14a9SRui Paulo }
238359aa14a9SRui Paulo 
238459aa14a9SRui Paulo /*
238559aa14a9SRui Paulo  * Add a Mesh ID IE to a frame.
238659aa14a9SRui Paulo  */
238759aa14a9SRui Paulo uint8_t *
238859aa14a9SRui Paulo ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
238959aa14a9SRui Paulo {
239059aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
239159aa14a9SRui Paulo 
239259aa14a9SRui Paulo 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
239359aa14a9SRui Paulo 
239459aa14a9SRui Paulo 	*frm++ = IEEE80211_ELEMID_MESHID;
239559aa14a9SRui Paulo 	*frm++ = ms->ms_idlen;
239659aa14a9SRui Paulo 	memcpy(frm, ms->ms_id, ms->ms_idlen);
239759aa14a9SRui Paulo 	return frm + ms->ms_idlen;
239859aa14a9SRui Paulo }
239959aa14a9SRui Paulo 
240059aa14a9SRui Paulo /*
240159aa14a9SRui Paulo  * Add a Mesh Configuration IE to a frame.
240259aa14a9SRui Paulo  * For now just use HWMP routing, Airtime link metric, Null Congestion
240359aa14a9SRui Paulo  * Signaling, Null Sync Protocol and Null Authentication.
240459aa14a9SRui Paulo  */
240559aa14a9SRui Paulo uint8_t *
240659aa14a9SRui Paulo ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
240759aa14a9SRui Paulo {
240859aa14a9SRui Paulo 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
2409651e41a4SRui Paulo 	uint16_t caps;
241059aa14a9SRui Paulo 
241159aa14a9SRui Paulo 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
241259aa14a9SRui Paulo 
241359aa14a9SRui Paulo 	*frm++ = IEEE80211_ELEMID_MESHCONF;
241459aa14a9SRui Paulo 	*frm++ = sizeof(struct ieee80211_meshconf_ie) - 2;
24156b8c1829SRui Paulo 	*frm++ = ms->ms_ppath->mpp_ie;		/* path selection */
24166b8c1829SRui Paulo 	*frm++ = ms->ms_pmetric->mpm_ie;	/* link metric */
24176b8c1829SRui Paulo 	*frm++ = IEEE80211_MESHCONF_CC_DISABLED;
24186b8c1829SRui Paulo 	*frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
24196b8c1829SRui Paulo 	*frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
242059aa14a9SRui Paulo 	/* NB: set the number of neighbors before the rest */
242159aa14a9SRui Paulo 	*frm = (ms->ms_neighbors > 15 ? 15 : ms->ms_neighbors) << 1;
242259aa14a9SRui Paulo 	if (ms->ms_flags & IEEE80211_MESHFLAGS_PORTAL)
242359aa14a9SRui Paulo 		*frm |= IEEE80211_MESHCONF_FORM_MP;
242459aa14a9SRui Paulo 	frm += 1;
2425651e41a4SRui Paulo 	caps = 0;
242659aa14a9SRui Paulo 	if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
2427651e41a4SRui Paulo 		caps |= IEEE80211_MESHCONF_CAP_AP;
242859aa14a9SRui Paulo 	if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
2429651e41a4SRui Paulo 		caps |= IEEE80211_MESHCONF_CAP_FWRD;
2430651e41a4SRui Paulo 	ADDSHORT(frm, caps);
243159aa14a9SRui Paulo 	return frm;
243259aa14a9SRui Paulo }
243359aa14a9SRui Paulo 
243459aa14a9SRui Paulo /*
243559aa14a9SRui Paulo  * Add a Mesh Peer Management IE to a frame.
243659aa14a9SRui Paulo  */
243759aa14a9SRui Paulo uint8_t *
243859aa14a9SRui Paulo ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
243959aa14a9SRui Paulo     uint16_t peerid, uint16_t reason)
244059aa14a9SRui Paulo {
2441c77735e2SRui Paulo 	/* XXX change for AH */
2442c77735e2SRui Paulo 	static const uint8_t meshpeerproto[4] = IEEE80211_MESH_PEER_PROTO;
2443c77735e2SRui Paulo 
244459aa14a9SRui Paulo 	KASSERT(localid != 0, ("localid == 0"));
244559aa14a9SRui Paulo 
244659aa14a9SRui Paulo 	*frm++ = IEEE80211_ELEMID_MESHPEER;
244759aa14a9SRui Paulo 	switch (subtype) {
244859aa14a9SRui Paulo 	case IEEE80211_MESH_PEER_LINK_OPEN:
2449f78595faSRui Paulo 		*frm++ = 6;		/* length */
2450c77735e2SRui Paulo 		memcpy(frm, meshpeerproto, 4);
2451c77735e2SRui Paulo 		frm += 4;
245259aa14a9SRui Paulo 		ADDSHORT(frm, localid);	/* local ID */
245359aa14a9SRui Paulo 		break;
245459aa14a9SRui Paulo 	case IEEE80211_MESH_PEER_LINK_CONFIRM:
245559aa14a9SRui Paulo 		KASSERT(peerid != 0, ("sending peer confirm without peer id"));
2456c77735e2SRui Paulo 		*frm++ = 8;		/* length */
2457c77735e2SRui Paulo 		memcpy(frm, meshpeerproto, 4);
2458c77735e2SRui Paulo 		frm += 4;
245959aa14a9SRui Paulo 		ADDSHORT(frm, localid);	/* local ID */
246059aa14a9SRui Paulo 		ADDSHORT(frm, peerid);	/* peer ID */
246159aa14a9SRui Paulo 		break;
246259aa14a9SRui Paulo 	case IEEE80211_MESH_PEER_LINK_CLOSE:
246359aa14a9SRui Paulo 		if (peerid)
2464c77735e2SRui Paulo 			*frm++ = 10;	/* length */
246559aa14a9SRui Paulo 		else
2466c77735e2SRui Paulo 			*frm++ = 8;	/* length */
2467c77735e2SRui Paulo 		memcpy(frm, meshpeerproto, 4);
2468c77735e2SRui Paulo 		frm += 4;
246959aa14a9SRui Paulo 		ADDSHORT(frm, localid);	/* local ID */
247059aa14a9SRui Paulo 		if (peerid)
247159aa14a9SRui Paulo 			ADDSHORT(frm, peerid);	/* peer ID */
247259aa14a9SRui Paulo 		ADDSHORT(frm, reason);
247359aa14a9SRui Paulo 		break;
247459aa14a9SRui Paulo 	}
247559aa14a9SRui Paulo 	return frm;
247659aa14a9SRui Paulo }
247759aa14a9SRui Paulo 
247859aa14a9SRui Paulo /*
247959aa14a9SRui Paulo  * Compute an Airtime Link Metric for the link with this node.
248059aa14a9SRui Paulo  *
248159aa14a9SRui Paulo  * Based on Draft 3.0 spec (11B.10, p.149).
248259aa14a9SRui Paulo  */
248359aa14a9SRui Paulo /*
248459aa14a9SRui Paulo  * Max 802.11s overhead.
248559aa14a9SRui Paulo  */
248659aa14a9SRui Paulo #define IEEE80211_MESH_MAXOVERHEAD \
248759aa14a9SRui Paulo 	(sizeof(struct ieee80211_qosframe_addr4) \
248859aa14a9SRui Paulo 	 + sizeof(struct ieee80211_meshcntl_ae11) \
248959aa14a9SRui Paulo 	+ sizeof(struct llc) \
249059aa14a9SRui Paulo 	+ IEEE80211_ADDR_LEN \
249159aa14a9SRui Paulo 	+ IEEE80211_WEP_IVLEN \
249259aa14a9SRui Paulo 	+ IEEE80211_WEP_KIDLEN \
249359aa14a9SRui Paulo 	+ IEEE80211_WEP_CRCLEN \
249459aa14a9SRui Paulo 	+ IEEE80211_WEP_MICLEN \
249559aa14a9SRui Paulo 	+ IEEE80211_CRC_LEN)
249659aa14a9SRui Paulo uint32_t
249759aa14a9SRui Paulo mesh_airtime_calc(struct ieee80211_node *ni)
249859aa14a9SRui Paulo {
249959aa14a9SRui Paulo #define M_BITS 8
250059aa14a9SRui Paulo #define S_FACTOR (2 * M_BITS)
250159aa14a9SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
250259aa14a9SRui Paulo 	struct ifnet *ifp = ni->ni_vap->iv_ifp;
250359aa14a9SRui Paulo 	const static int nbits = 8192 << M_BITS;
250459aa14a9SRui Paulo 	uint32_t overhead, rate, errrate;
250559aa14a9SRui Paulo 	uint64_t res;
250659aa14a9SRui Paulo 
250759aa14a9SRui Paulo 	/* Time to transmit a frame */
250859aa14a9SRui Paulo 	rate = ni->ni_txrate;
250959aa14a9SRui Paulo 	overhead = ieee80211_compute_duration(ic->ic_rt,
251059aa14a9SRui Paulo 	    ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
251159aa14a9SRui Paulo 	/* Error rate in percentage */
251259aa14a9SRui Paulo 	/* XXX assuming small failures are ok */
251359aa14a9SRui Paulo 	errrate = (((ifp->if_oerrors +
251459aa14a9SRui Paulo 	    ifp->if_ierrors) / 100) << M_BITS) / 100;
251559aa14a9SRui Paulo 	res = (overhead + (nbits / rate)) *
251659aa14a9SRui Paulo 	    ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
251759aa14a9SRui Paulo 
251859aa14a9SRui Paulo 	return (uint32_t)(res >> S_FACTOR);
251959aa14a9SRui Paulo #undef M_BITS
252059aa14a9SRui Paulo #undef S_FACTOR
252159aa14a9SRui Paulo }
252259aa14a9SRui Paulo 
252359aa14a9SRui Paulo /*
252459aa14a9SRui Paulo  * Add a Mesh Link Metric report IE to a frame.
252559aa14a9SRui Paulo  */
252659aa14a9SRui Paulo uint8_t *
252759aa14a9SRui Paulo ieee80211_add_meshlmetric(uint8_t *frm, uint32_t metric)
252859aa14a9SRui Paulo {
252959aa14a9SRui Paulo 	*frm++ = IEEE80211_ELEMID_MESHLINK;
253059aa14a9SRui Paulo 	*frm++ = 4;
253159aa14a9SRui Paulo 	ADDWORD(frm, metric);
253259aa14a9SRui Paulo 	return frm;
253359aa14a9SRui Paulo }
253459aa14a9SRui Paulo #undef ADDSHORT
253559aa14a9SRui Paulo #undef ADDWORD
253659aa14a9SRui Paulo 
253759aa14a9SRui Paulo /*
253859aa14a9SRui Paulo  * Initialize any mesh-specific node state.
253959aa14a9SRui Paulo  */
254059aa14a9SRui Paulo void
254159aa14a9SRui Paulo ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
254259aa14a9SRui Paulo {
254359aa14a9SRui Paulo 	ni->ni_flags |= IEEE80211_NODE_QOS;
254459aa14a9SRui Paulo 	callout_init(&ni->ni_mltimer, CALLOUT_MPSAFE);
254559aa14a9SRui Paulo }
254659aa14a9SRui Paulo 
254759aa14a9SRui Paulo /*
254859aa14a9SRui Paulo  * Cleanup any mesh-specific node state.
254959aa14a9SRui Paulo  */
255059aa14a9SRui Paulo void
255159aa14a9SRui Paulo ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
255259aa14a9SRui Paulo {
255359aa14a9SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
255459aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
255559aa14a9SRui Paulo 
255659aa14a9SRui Paulo 	callout_drain(&ni->ni_mltimer);
255759aa14a9SRui Paulo 	/* NB: short-circuit callbacks after mesh_vdetach */
255859aa14a9SRui Paulo 	if (vap->iv_mesh != NULL)
255959aa14a9SRui Paulo 		ms->ms_ppath->mpp_peerdown(ni);
256059aa14a9SRui Paulo }
256159aa14a9SRui Paulo 
256259aa14a9SRui Paulo void
256359aa14a9SRui Paulo ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
256459aa14a9SRui Paulo {
256559aa14a9SRui Paulo 	ni->ni_meshidlen = ie[1];
256659aa14a9SRui Paulo 	memcpy(ni->ni_meshid, ie + 2, ie[1]);
256759aa14a9SRui Paulo }
256859aa14a9SRui Paulo 
256959aa14a9SRui Paulo /*
257059aa14a9SRui Paulo  * Setup mesh-specific node state on neighbor discovery.
257159aa14a9SRui Paulo  */
257259aa14a9SRui Paulo void
257359aa14a9SRui Paulo ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
257459aa14a9SRui Paulo 	const struct ieee80211_frame *wh,
257559aa14a9SRui Paulo 	const struct ieee80211_scanparams *sp)
257659aa14a9SRui Paulo {
257759aa14a9SRui Paulo 	ieee80211_parse_meshid(ni, sp->meshid);
257859aa14a9SRui Paulo }
257959aa14a9SRui Paulo 
2580d093681cSRui Paulo void
2581d093681cSRui Paulo ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
2582d093681cSRui Paulo 	struct ieee80211_beacon_offsets *bo)
2583d093681cSRui Paulo {
2584d093681cSRui Paulo 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
2585d093681cSRui Paulo 
2586d093681cSRui Paulo 	if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
2587d093681cSRui Paulo 		(void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
2588d093681cSRui Paulo 		clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
2589d093681cSRui Paulo 	}
2590d093681cSRui Paulo }
2591d093681cSRui Paulo 
259259aa14a9SRui Paulo static int
259359aa14a9SRui Paulo mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
259459aa14a9SRui Paulo {
259559aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
259659aa14a9SRui Paulo 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
259759aa14a9SRui Paulo 	struct ieee80211_mesh_route *rt;
259859aa14a9SRui Paulo 	struct ieee80211req_mesh_route *imr;
259959aa14a9SRui Paulo 	size_t len, off;
260059aa14a9SRui Paulo 	uint8_t *p;
260159aa14a9SRui Paulo 	int error;
260259aa14a9SRui Paulo 
260359aa14a9SRui Paulo 	if (vap->iv_opmode != IEEE80211_M_MBSS)
260459aa14a9SRui Paulo 		return ENOSYS;
260559aa14a9SRui Paulo 
260659aa14a9SRui Paulo 	error = 0;
260759aa14a9SRui Paulo 	switch (ireq->i_type) {
260859aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_ID:
260959aa14a9SRui Paulo 		ireq->i_len = ms->ms_idlen;
261059aa14a9SRui Paulo 		memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
261159aa14a9SRui Paulo 		error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
261259aa14a9SRui Paulo 		break;
261359aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_AP:
261459aa14a9SRui Paulo 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
261559aa14a9SRui Paulo 		break;
261659aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_FWRD:
261759aa14a9SRui Paulo 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
261859aa14a9SRui Paulo 		break;
261959aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_TTL:
262059aa14a9SRui Paulo 		ireq->i_val = ms->ms_ttl;
262159aa14a9SRui Paulo 		break;
262259aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_RTCMD:
262359aa14a9SRui Paulo 		switch (ireq->i_val) {
262459aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_LIST:
262559aa14a9SRui Paulo 			len = 0;
262659aa14a9SRui Paulo 			MESH_RT_LOCK(ms);
262759aa14a9SRui Paulo 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
262859aa14a9SRui Paulo 				len += sizeof(*imr);
262959aa14a9SRui Paulo 			}
263059aa14a9SRui Paulo 			MESH_RT_UNLOCK(ms);
263159aa14a9SRui Paulo 			if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
263259aa14a9SRui Paulo 				ireq->i_len = len;
263359aa14a9SRui Paulo 				return ENOMEM;
263459aa14a9SRui Paulo 			}
263559aa14a9SRui Paulo 			ireq->i_len = len;
2636c104cff2SRui Paulo 			/* XXX M_WAIT? */
263759aa14a9SRui Paulo 			p = malloc(len, M_TEMP, M_NOWAIT | M_ZERO);
263859aa14a9SRui Paulo 			if (p == NULL)
263959aa14a9SRui Paulo 				return ENOMEM;
264059aa14a9SRui Paulo 			off = 0;
264159aa14a9SRui Paulo 			MESH_RT_LOCK(ms);
264259aa14a9SRui Paulo 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
264359aa14a9SRui Paulo 				if (off >= len)
264459aa14a9SRui Paulo 					break;
264559aa14a9SRui Paulo 				imr = (struct ieee80211req_mesh_route *)
264659aa14a9SRui Paulo 				    (p + off);
26473ca80f0dSRui Paulo 				imr->imr_flags = rt->rt_flags;
264859aa14a9SRui Paulo 				IEEE80211_ADDR_COPY(imr->imr_dest,
264959aa14a9SRui Paulo 				    rt->rt_dest);
265059aa14a9SRui Paulo 				IEEE80211_ADDR_COPY(imr->imr_nexthop,
265159aa14a9SRui Paulo 				    rt->rt_nexthop);
265259aa14a9SRui Paulo 				imr->imr_metric = rt->rt_metric;
265359aa14a9SRui Paulo 				imr->imr_nhops = rt->rt_nhops;
265459aa14a9SRui Paulo 				imr->imr_lifetime = rt->rt_lifetime;
2655c104cff2SRui Paulo 				imr->imr_lastmseq = rt->rt_lastmseq;
265659aa14a9SRui Paulo 				off += sizeof(*imr);
265759aa14a9SRui Paulo 			}
265859aa14a9SRui Paulo 			MESH_RT_UNLOCK(ms);
265959aa14a9SRui Paulo 			error = copyout(p, (uint8_t *)ireq->i_data,
266059aa14a9SRui Paulo 			    ireq->i_len);
266159aa14a9SRui Paulo 			free(p, M_TEMP);
266259aa14a9SRui Paulo 			break;
266359aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_FLUSH:
266459aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_ADD:
266559aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_DELETE:
266659aa14a9SRui Paulo 			return EINVAL;
266759aa14a9SRui Paulo 		default:
266859aa14a9SRui Paulo 			return ENOSYS;
266959aa14a9SRui Paulo 		}
267059aa14a9SRui Paulo 		break;
267159aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_PR_METRIC:
267259aa14a9SRui Paulo 		len = strlen(ms->ms_pmetric->mpm_descr);
267359aa14a9SRui Paulo 		if (ireq->i_len < len)
267459aa14a9SRui Paulo 			return EINVAL;
267559aa14a9SRui Paulo 		ireq->i_len = len;
267659aa14a9SRui Paulo 		error = copyout(ms->ms_pmetric->mpm_descr,
267759aa14a9SRui Paulo 		    (uint8_t *)ireq->i_data, len);
267859aa14a9SRui Paulo 		break;
267959aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_PR_PATH:
268059aa14a9SRui Paulo 		len = strlen(ms->ms_ppath->mpp_descr);
268159aa14a9SRui Paulo 		if (ireq->i_len < len)
268259aa14a9SRui Paulo 			return EINVAL;
268359aa14a9SRui Paulo 		ireq->i_len = len;
268459aa14a9SRui Paulo 		error = copyout(ms->ms_ppath->mpp_descr,
268559aa14a9SRui Paulo 		    (uint8_t *)ireq->i_data, len);
268659aa14a9SRui Paulo 		break;
268759aa14a9SRui Paulo 	default:
268859aa14a9SRui Paulo 		return ENOSYS;
268959aa14a9SRui Paulo 	}
269059aa14a9SRui Paulo 
269159aa14a9SRui Paulo 	return error;
269259aa14a9SRui Paulo }
269359aa14a9SRui Paulo IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
269459aa14a9SRui Paulo 
269559aa14a9SRui Paulo static int
269659aa14a9SRui Paulo mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
269759aa14a9SRui Paulo {
269859aa14a9SRui Paulo 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
269959aa14a9SRui Paulo 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
270059aa14a9SRui Paulo 	uint8_t tmpaddr[IEEE80211_ADDR_LEN];
270159aa14a9SRui Paulo 	char tmpproto[IEEE80211_MESH_PROTO_DSZ];
270259aa14a9SRui Paulo 	int error;
270359aa14a9SRui Paulo 
270459aa14a9SRui Paulo 	if (vap->iv_opmode != IEEE80211_M_MBSS)
270559aa14a9SRui Paulo 		return ENOSYS;
270659aa14a9SRui Paulo 
270759aa14a9SRui Paulo 	error = 0;
270859aa14a9SRui Paulo 	switch (ireq->i_type) {
270959aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_ID:
271059aa14a9SRui Paulo 		if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
271159aa14a9SRui Paulo 			return EINVAL;
271259aa14a9SRui Paulo 		error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
2713c104cff2SRui Paulo 		if (error != 0)
271459aa14a9SRui Paulo 			break;
271559aa14a9SRui Paulo 		memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
271659aa14a9SRui Paulo 		ms->ms_idlen = ireq->i_len;
271759aa14a9SRui Paulo 		memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
2718c104cff2SRui Paulo 		error = ENETRESET;
271959aa14a9SRui Paulo 		break;
272059aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_AP:
272159aa14a9SRui Paulo 		if (ireq->i_val)
272259aa14a9SRui Paulo 			ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
272359aa14a9SRui Paulo 		else
272459aa14a9SRui Paulo 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
2725c104cff2SRui Paulo 		error = ENETRESET;
272659aa14a9SRui Paulo 		break;
272759aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_FWRD:
272859aa14a9SRui Paulo 		if (ireq->i_val)
272959aa14a9SRui Paulo 			ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
273059aa14a9SRui Paulo 		else
273159aa14a9SRui Paulo 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
273259aa14a9SRui Paulo 		break;
273359aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_TTL:
273459aa14a9SRui Paulo 		ms->ms_ttl = (uint8_t) ireq->i_val;
273559aa14a9SRui Paulo 		break;
273659aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_RTCMD:
273759aa14a9SRui Paulo 		switch (ireq->i_val) {
273859aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_LIST:
273959aa14a9SRui Paulo 			return EINVAL;
274059aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_FLUSH:
274159aa14a9SRui Paulo 			ieee80211_mesh_rt_flush(vap);
274259aa14a9SRui Paulo 			break;
274359aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_ADD:
274459aa14a9SRui Paulo 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||
274559aa14a9SRui Paulo 			    IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))
274659aa14a9SRui Paulo 				return EINVAL;
274759aa14a9SRui Paulo 			error = copyin(ireq->i_data, &tmpaddr,
274859aa14a9SRui Paulo 			    IEEE80211_ADDR_LEN);
2749c104cff2SRui Paulo 			if (error == 0)
275059aa14a9SRui Paulo 				ieee80211_mesh_discover(vap, tmpaddr, NULL);
275159aa14a9SRui Paulo 			break;
275259aa14a9SRui Paulo 		case IEEE80211_MESH_RTCMD_DELETE:
275359aa14a9SRui Paulo 			ieee80211_mesh_rt_del(vap, ireq->i_data);
275459aa14a9SRui Paulo 			break;
275559aa14a9SRui Paulo 		default:
275659aa14a9SRui Paulo 			return ENOSYS;
275759aa14a9SRui Paulo 		}
275859aa14a9SRui Paulo 		break;
275959aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_PR_METRIC:
276059aa14a9SRui Paulo 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
2761c104cff2SRui Paulo 		if (error == 0) {
2762c104cff2SRui Paulo 			error = mesh_select_proto_metric(vap, tmpproto);
2763c104cff2SRui Paulo 			if (error == 0)
2764c104cff2SRui Paulo 				error = ENETRESET;
2765c104cff2SRui Paulo 		}
276659aa14a9SRui Paulo 		break;
276759aa14a9SRui Paulo 	case IEEE80211_IOC_MESH_PR_PATH:
276859aa14a9SRui Paulo 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
2769c104cff2SRui Paulo 		if (error == 0) {
2770c104cff2SRui Paulo 			error = mesh_select_proto_path(vap, tmpproto);
2771c104cff2SRui Paulo 			if (error == 0)
2772c104cff2SRui Paulo 				error = ENETRESET;
2773c104cff2SRui Paulo 		}
277459aa14a9SRui Paulo 		break;
277559aa14a9SRui Paulo 	default:
277659aa14a9SRui Paulo 		return ENOSYS;
277759aa14a9SRui Paulo 	}
277859aa14a9SRui Paulo 	return error;
277959aa14a9SRui Paulo }
278059aa14a9SRui Paulo IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);
2781