xref: /freebsd/sys/net80211/ieee80211_mesh.c (revision 9e5787d2284e187abb5b654d924394a65772e004)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2009 The FreeBSD Foundation
5  * All rights reserved.
6  *
7  * This software was developed by Rui Paulo under sponsorship from the
8  * FreeBSD Foundation.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 #include <sys/cdefs.h>
32 #ifdef __FreeBSD__
33 __FBSDID("$FreeBSD$");
34 #endif
35 
36 /*
37  * IEEE 802.11s Mesh Point (MBSS) support.
38  *
39  * Based on March 2009, D3.0 802.11s draft spec.
40  */
41 #include "opt_inet.h"
42 #include "opt_wlan.h"
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/mbuf.h>
47 #include <sys/malloc.h>
48 #include <sys/kernel.h>
49 
50 #include <sys/socket.h>
51 #include <sys/sockio.h>
52 #include <sys/endian.h>
53 #include <sys/errno.h>
54 #include <sys/proc.h>
55 #include <sys/sysctl.h>
56 
57 #include <net/bpf.h>
58 #include <net/if.h>
59 #include <net/if_var.h>
60 #include <net/if_media.h>
61 #include <net/if_llc.h>
62 #include <net/ethernet.h>
63 
64 #include <net80211/ieee80211_var.h>
65 #include <net80211/ieee80211_action.h>
66 #ifdef IEEE80211_SUPPORT_SUPERG
67 #include <net80211/ieee80211_superg.h>
68 #endif
69 #include <net80211/ieee80211_input.h>
70 #include <net80211/ieee80211_mesh.h>
71 
72 static void	mesh_rt_flush_invalid(struct ieee80211vap *);
73 static int	mesh_select_proto_path(struct ieee80211vap *, const char *);
74 static int	mesh_select_proto_metric(struct ieee80211vap *, const char *);
75 static void	mesh_vattach(struct ieee80211vap *);
76 static int	mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
77 static void	mesh_rt_cleanup_cb(void *);
78 static void	mesh_gatemode_setup(struct ieee80211vap *);
79 static void	mesh_gatemode_cb(void *);
80 static void	mesh_linkchange(struct ieee80211_node *,
81 		    enum ieee80211_mesh_mlstate);
82 static void	mesh_checkid(void *, struct ieee80211_node *);
83 static uint32_t	mesh_generateid(struct ieee80211vap *);
84 static int	mesh_checkpseq(struct ieee80211vap *,
85 		    const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
86 static void	mesh_transmit_to_gate(struct ieee80211vap *, struct mbuf *,
87 		    struct ieee80211_mesh_route *);
88 static void	mesh_forward(struct ieee80211vap *, struct mbuf *,
89 		    const struct ieee80211_meshcntl *);
90 static int	mesh_input(struct ieee80211_node *, struct mbuf *,
91 		    const struct ieee80211_rx_stats *rxs, int, int);
92 static void	mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
93 		    const struct ieee80211_rx_stats *rxs, int, int);
94 static void	mesh_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
95 static void	mesh_peer_timeout_setup(struct ieee80211_node *);
96 static void	mesh_peer_timeout_backoff(struct ieee80211_node *);
97 static void	mesh_peer_timeout_cb(void *);
98 static __inline void
99 		mesh_peer_timeout_stop(struct ieee80211_node *);
100 static int	mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
101 static int	mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
102 static int	mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
103     		    const uint8_t *);
104 uint32_t	mesh_airtime_calc(struct ieee80211_node *);
105 
106 /*
107  * Timeout values come from the specification and are in milliseconds.
108  */
109 static SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
110     "IEEE 802.11s parameters");
111 static int	ieee80211_mesh_gateint = -1;
112 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, gateint,
113     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
114     &ieee80211_mesh_gateint, 0, ieee80211_sysctl_msecs_ticks, "I",
115     "mesh gate interval (ms)");
116 static int ieee80211_mesh_retrytimeout = -1;
117 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout,
118     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
119     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
120     "Retry timeout (msec)");
121 static int ieee80211_mesh_holdingtimeout = -1;
122 
123 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout,
124     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
125     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
126     "Holding state timeout (msec)");
127 static int ieee80211_mesh_confirmtimeout = -1;
128 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout,
129     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
130     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
131     "Confirm state timeout (msec)");
132 static int ieee80211_mesh_backofftimeout = -1;
133 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, backofftimeout,
134     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
135     &ieee80211_mesh_backofftimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
136     "Backoff timeout (msec). This is to throutles peering forever when "
137     "not receiving answer or is rejected by a neighbor");
138 static int ieee80211_mesh_maxretries = 2;
139 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLFLAG_RW,
140     &ieee80211_mesh_maxretries, 0,
141     "Maximum retries during peer link establishment");
142 static int ieee80211_mesh_maxholding = 2;
143 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxholding, CTLFLAG_RW,
144     &ieee80211_mesh_maxholding, 0,
145     "Maximum times we are allowed to transition to HOLDING state before "
146     "backinoff during peer link establishment");
147 
148 static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
149 	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
150 
151 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
152 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
153 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
154 static	ieee80211_recv_action_func mesh_recv_action_meshlmetric;
155 static	ieee80211_recv_action_func mesh_recv_action_meshgate;
156 
157 static	ieee80211_send_action_func mesh_send_action_meshpeering_open;
158 static	ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
159 static	ieee80211_send_action_func mesh_send_action_meshpeering_close;
160 static	ieee80211_send_action_func mesh_send_action_meshlmetric;
161 static	ieee80211_send_action_func mesh_send_action_meshgate;
162 
163 static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
164 	.mpm_descr	= "AIRTIME",
165 	.mpm_ie		= IEEE80211_MESHCONF_METRIC_AIRTIME,
166 	.mpm_metric	= mesh_airtime_calc,
167 };
168 
169 static struct ieee80211_mesh_proto_path		mesh_proto_paths[4];
170 static struct ieee80211_mesh_proto_metric	mesh_proto_metrics[4];
171 
172 MALLOC_DEFINE(M_80211_MESH_PREQ, "80211preq", "802.11 MESH Path Request frame");
173 MALLOC_DEFINE(M_80211_MESH_PREP, "80211prep", "802.11 MESH Path Reply frame");
174 MALLOC_DEFINE(M_80211_MESH_PERR, "80211perr", "802.11 MESH Path Error frame");
175 
176 /* The longer one of the lifetime should be stored as new lifetime */
177 #define MESH_ROUTE_LIFETIME_MAX(a, b)	(a > b ? a : b)
178 
179 MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh_rt", "802.11s routing table");
180 MALLOC_DEFINE(M_80211_MESH_GT_RT, "80211mesh_gt", "802.11s known gates table");
181 
182 /*
183  * Helper functions to manipulate the Mesh routing table.
184  */
185 
186 static struct ieee80211_mesh_route *
187 mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
188     const uint8_t dest[IEEE80211_ADDR_LEN])
189 {
190 	struct ieee80211_mesh_route *rt;
191 
192 	MESH_RT_LOCK_ASSERT(ms);
193 
194 	TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
195 		if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
196 			return rt;
197 	}
198 	return NULL;
199 }
200 
201 static struct ieee80211_mesh_route *
202 mesh_rt_add_locked(struct ieee80211vap *vap,
203     const uint8_t dest[IEEE80211_ADDR_LEN])
204 {
205 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
206 	struct ieee80211_mesh_route *rt;
207 
208 	KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
209 	    ("%s: adding broadcast to the routing table", __func__));
210 
211 	MESH_RT_LOCK_ASSERT(ms);
212 
213 	rt = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_route)) +
214 	    ms->ms_ppath->mpp_privlen, M_80211_MESH_RT,
215 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
216 	if (rt != NULL) {
217 		rt->rt_vap = vap;
218 		IEEE80211_ADDR_COPY(rt->rt_dest, dest);
219 		rt->rt_priv = (void *)ALIGN(&rt[1]);
220 		MESH_RT_ENTRY_LOCK_INIT(rt, "MBSS_RT");
221 		callout_init(&rt->rt_discovery, 1);
222 		rt->rt_updtime = ticks;	/* create time */
223 		TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
224 	}
225 	return rt;
226 }
227 
228 struct ieee80211_mesh_route *
229 ieee80211_mesh_rt_find(struct ieee80211vap *vap,
230     const uint8_t dest[IEEE80211_ADDR_LEN])
231 {
232 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
233 	struct ieee80211_mesh_route *rt;
234 
235 	MESH_RT_LOCK(ms);
236 	rt = mesh_rt_find_locked(ms, dest);
237 	MESH_RT_UNLOCK(ms);
238 	return rt;
239 }
240 
241 struct ieee80211_mesh_route *
242 ieee80211_mesh_rt_add(struct ieee80211vap *vap,
243     const uint8_t dest[IEEE80211_ADDR_LEN])
244 {
245 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
246 	struct ieee80211_mesh_route *rt;
247 
248 	KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
249 	    ("%s: duplicate entry in the routing table", __func__));
250 	KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
251 	    ("%s: adding self to the routing table", __func__));
252 
253 	MESH_RT_LOCK(ms);
254 	rt = mesh_rt_add_locked(vap, dest);
255 	MESH_RT_UNLOCK(ms);
256 	return rt;
257 }
258 
259 /*
260  * Update the route lifetime and returns the updated lifetime.
261  * If new_lifetime is zero and route is timedout it will be invalidated.
262  * new_lifetime is in msec
263  */
264 int
265 ieee80211_mesh_rt_update(struct ieee80211_mesh_route *rt, int new_lifetime)
266 {
267 	int timesince, now;
268 	uint32_t lifetime = 0;
269 
270 	KASSERT(rt != NULL, ("route is NULL"));
271 
272 	now = ticks;
273 	MESH_RT_ENTRY_LOCK(rt);
274 
275 	/* dont clobber a proxy entry gated by us */
276 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY && rt->rt_nhops == 0) {
277 		MESH_RT_ENTRY_UNLOCK(rt);
278 		return rt->rt_lifetime;
279 	}
280 
281 	timesince = ticks_to_msecs(now - rt->rt_updtime);
282 	rt->rt_updtime = now;
283 	if (timesince >= rt->rt_lifetime) {
284 		if (new_lifetime != 0) {
285 			rt->rt_lifetime = new_lifetime;
286 		}
287 		else {
288 			rt->rt_flags &= ~IEEE80211_MESHRT_FLAGS_VALID;
289 			rt->rt_lifetime = 0;
290 		}
291 	} else {
292 		/* update what is left of lifetime */
293 		rt->rt_lifetime = rt->rt_lifetime - timesince;
294 		rt->rt_lifetime  = MESH_ROUTE_LIFETIME_MAX(
295 			new_lifetime, rt->rt_lifetime);
296 	}
297 	lifetime = rt->rt_lifetime;
298 	MESH_RT_ENTRY_UNLOCK(rt);
299 
300 	return lifetime;
301 }
302 
303 /*
304  * Add a proxy route (as needed) for the specified destination.
305  */
306 void
307 ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
308     const uint8_t dest[IEEE80211_ADDR_LEN])
309 {
310 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
311 	struct ieee80211_mesh_route *rt;
312 
313 	MESH_RT_LOCK(ms);
314 	rt = mesh_rt_find_locked(ms, dest);
315 	if (rt == NULL) {
316 		rt = mesh_rt_add_locked(vap, dest);
317 		if (rt == NULL) {
318 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
319 			    "%s", "unable to add proxy entry");
320 			vap->iv_stats.is_mesh_rtaddfailed++;
321 		} else {
322 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
323 			    "%s", "add proxy entry");
324 			IEEE80211_ADDR_COPY(rt->rt_mesh_gate, vap->iv_myaddr);
325 			IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
326 			rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
327 				     |  IEEE80211_MESHRT_FLAGS_PROXY;
328 		}
329 	} else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
330 		KASSERT(rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY,
331 		    ("no proxy flag for poxy entry"));
332 		struct ieee80211com *ic = vap->iv_ic;
333 		/*
334 		 * Fix existing entry created by received frames from
335 		 * stations that have some memory of dest.  We also
336 		 * flush any frames held on the staging queue; delivering
337 		 * them is too much trouble right now.
338 		 */
339 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
340 		    "%s", "fix proxy entry");
341 		IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
342 		rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
343 			     |  IEEE80211_MESHRT_FLAGS_PROXY;
344 		/* XXX belongs in hwmp */
345 		ieee80211_ageq_drain_node(&ic->ic_stageq,
346 		   (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
347 		/* XXX stat? */
348 	}
349 	MESH_RT_UNLOCK(ms);
350 }
351 
352 static __inline void
353 mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
354 {
355 	TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
356 	/*
357 	 * Grab the lock before destroying it, to be sure no one else
358 	 * is holding the route.
359 	 */
360 	MESH_RT_ENTRY_LOCK(rt);
361 	callout_drain(&rt->rt_discovery);
362 	MESH_RT_ENTRY_LOCK_DESTROY(rt);
363 	IEEE80211_FREE(rt, M_80211_MESH_RT);
364 }
365 
366 void
367 ieee80211_mesh_rt_del(struct ieee80211vap *vap,
368     const uint8_t dest[IEEE80211_ADDR_LEN])
369 {
370 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
371 	struct ieee80211_mesh_route *rt, *next;
372 
373 	MESH_RT_LOCK(ms);
374 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
375 		if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
376 			if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
377 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
378 				    IEEE80211_REASON_MESH_PERR_NO_PROXY);
379 			} else {
380 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
381 				    IEEE80211_REASON_MESH_PERR_DEST_UNREACH);
382 			}
383 			mesh_rt_del(ms, rt);
384 			MESH_RT_UNLOCK(ms);
385 			return;
386 		}
387 	}
388 	MESH_RT_UNLOCK(ms);
389 }
390 
391 void
392 ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
393 {
394 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
395 	struct ieee80211_mesh_route *rt, *next;
396 
397 	if (ms == NULL)
398 		return;
399 	MESH_RT_LOCK(ms);
400 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next)
401 		mesh_rt_del(ms, rt);
402 	MESH_RT_UNLOCK(ms);
403 }
404 
405 void
406 ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
407     const uint8_t peer[IEEE80211_ADDR_LEN])
408 {
409 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
410 	struct ieee80211_mesh_route *rt, *next;
411 
412 	MESH_RT_LOCK(ms);
413 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
414 		if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
415 			mesh_rt_del(ms, rt);
416 	}
417 	MESH_RT_UNLOCK(ms);
418 }
419 
420 /*
421  * Flush expired routing entries, i.e. those in invalid state for
422  * some time.
423  */
424 static void
425 mesh_rt_flush_invalid(struct ieee80211vap *vap)
426 {
427 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
428 	struct ieee80211_mesh_route *rt, *next;
429 
430 	if (ms == NULL)
431 		return;
432 	MESH_RT_LOCK(ms);
433 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
434 		/* Discover paths will be deleted by their own callout */
435 		if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_DISCOVER)
436 			continue;
437 		ieee80211_mesh_rt_update(rt, 0);
438 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
439 			mesh_rt_del(ms, rt);
440 	}
441 	MESH_RT_UNLOCK(ms);
442 }
443 
444 int
445 ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
446 {
447 	int i, firstempty = -1;
448 
449 	for (i = 0; i < nitems(mesh_proto_paths); i++) {
450 		if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
451 		    IEEE80211_MESH_PROTO_DSZ) == 0)
452 			return EEXIST;
453 		if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
454 			firstempty = i;
455 	}
456 	if (firstempty < 0)
457 		return ENOSPC;
458 	memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
459 	mesh_proto_paths[firstempty].mpp_active = 1;
460 	return 0;
461 }
462 
463 int
464 ieee80211_mesh_register_proto_metric(const struct
465     ieee80211_mesh_proto_metric *mpm)
466 {
467 	int i, firstempty = -1;
468 
469 	for (i = 0; i < nitems(mesh_proto_metrics); i++) {
470 		if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
471 		    IEEE80211_MESH_PROTO_DSZ) == 0)
472 			return EEXIST;
473 		if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
474 			firstempty = i;
475 	}
476 	if (firstempty < 0)
477 		return ENOSPC;
478 	memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
479 	mesh_proto_metrics[firstempty].mpm_active = 1;
480 	return 0;
481 }
482 
483 static int
484 mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
485 {
486 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
487 	int i;
488 
489 	for (i = 0; i < nitems(mesh_proto_paths); i++) {
490 		if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
491 			ms->ms_ppath = &mesh_proto_paths[i];
492 			return 0;
493 		}
494 	}
495 	return ENOENT;
496 }
497 
498 static int
499 mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
500 {
501 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
502 	int i;
503 
504 	for (i = 0; i < nitems(mesh_proto_metrics); i++) {
505 		if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
506 			ms->ms_pmetric = &mesh_proto_metrics[i];
507 			return 0;
508 		}
509 	}
510 	return ENOENT;
511 }
512 
513 static void
514 mesh_gatemode_setup(struct ieee80211vap *vap)
515 {
516 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
517 
518 	/*
519 	 * NB: When a mesh gate is running as a ROOT it shall
520 	 * not send out periodic GANNs but instead mark the
521 	 * mesh gate flag for the corresponding proactive PREQ
522 	 * and RANN frames.
523 	 */
524 	if (ms->ms_flags & IEEE80211_MESHFLAGS_ROOT ||
525 	    (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) == 0) {
526 		callout_drain(&ms->ms_gatetimer);
527 		return ;
528 	}
529 	callout_reset(&ms->ms_gatetimer, ieee80211_mesh_gateint,
530 	    mesh_gatemode_cb, vap);
531 }
532 
533 static void
534 mesh_gatemode_cb(void *arg)
535 {
536 	struct ieee80211vap *vap = (struct ieee80211vap *)arg;
537 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
538 	struct ieee80211_meshgann_ie gann;
539 
540 	gann.gann_flags = 0; /* Reserved */
541 	gann.gann_hopcount = 0;
542 	gann.gann_ttl = ms->ms_ttl;
543 	IEEE80211_ADDR_COPY(gann.gann_addr, vap->iv_myaddr);
544 	gann.gann_seq = ms->ms_gateseq++;
545 	gann.gann_interval = ieee80211_mesh_gateint;
546 
547 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH, vap->iv_bss,
548 	    "send broadcast GANN (seq %u)", gann.gann_seq);
549 
550 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
551 	    IEEE80211_ACTION_MESH_GANN, &gann);
552 	mesh_gatemode_setup(vap);
553 }
554 
555 static void
556 ieee80211_mesh_init(void)
557 {
558 
559 	memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
560 	memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
561 
562 	/*
563 	 * Setup mesh parameters that depends on the clock frequency.
564 	 */
565 	ieee80211_mesh_gateint = msecs_to_ticks(10000);
566 	ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
567 	ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
568 	ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
569 	ieee80211_mesh_backofftimeout = msecs_to_ticks(5000);
570 
571 	/*
572 	 * Register action frame handlers.
573 	 */
574 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
575 	    IEEE80211_ACTION_MESHPEERING_OPEN,
576 	    mesh_recv_action_meshpeering_open);
577 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
578 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
579 	    mesh_recv_action_meshpeering_confirm);
580 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
581 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
582 	    mesh_recv_action_meshpeering_close);
583 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
584 	    IEEE80211_ACTION_MESH_LMETRIC, mesh_recv_action_meshlmetric);
585 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
586 	    IEEE80211_ACTION_MESH_GANN, mesh_recv_action_meshgate);
587 
588 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
589 	    IEEE80211_ACTION_MESHPEERING_OPEN,
590 	    mesh_send_action_meshpeering_open);
591 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
592 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
593 	    mesh_send_action_meshpeering_confirm);
594 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
595 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
596 	    mesh_send_action_meshpeering_close);
597 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
598 	    IEEE80211_ACTION_MESH_LMETRIC,
599 	    mesh_send_action_meshlmetric);
600 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
601 	    IEEE80211_ACTION_MESH_GANN,
602 	    mesh_send_action_meshgate);
603 
604 	/*
605 	 * Register Airtime Link Metric.
606 	 */
607 	ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
608 
609 }
610 SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
611 
612 void
613 ieee80211_mesh_attach(struct ieee80211com *ic)
614 {
615 	ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
616 }
617 
618 void
619 ieee80211_mesh_detach(struct ieee80211com *ic)
620 {
621 }
622 
623 static void
624 mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
625 {
626 	struct ieee80211com *ic = ni->ni_ic;
627 	uint16_t args[3];
628 
629 	if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
630 		args[0] = ni->ni_mlpid;
631 		args[1] = ni->ni_mllid;
632 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
633 		ieee80211_send_action(ni,
634 		    IEEE80211_ACTION_CAT_SELF_PROT,
635 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
636 		    args);
637 	}
638 	callout_drain(&ni->ni_mltimer);
639 	/* XXX belongs in hwmp */
640 	ieee80211_ageq_drain_node(&ic->ic_stageq,
641 	   (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
642 }
643 
644 static void
645 mesh_vdetach(struct ieee80211vap *vap)
646 {
647 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
648 
649 	callout_drain(&ms->ms_cleantimer);
650 	ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
651 	    NULL);
652 	ieee80211_mesh_rt_flush(vap);
653 	MESH_RT_LOCK_DESTROY(ms);
654 	ms->ms_ppath->mpp_vdetach(vap);
655 	IEEE80211_FREE(vap->iv_mesh, M_80211_VAP);
656 	vap->iv_mesh = NULL;
657 }
658 
659 static void
660 mesh_vattach(struct ieee80211vap *vap)
661 {
662 	struct ieee80211_mesh_state *ms;
663 	vap->iv_newstate = mesh_newstate;
664 	vap->iv_input = mesh_input;
665 	vap->iv_opdetach = mesh_vdetach;
666 	vap->iv_recv_mgmt = mesh_recv_mgmt;
667 	vap->iv_recv_ctl = mesh_recv_ctl;
668 	ms = IEEE80211_MALLOC(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
669 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
670 	if (ms == NULL) {
671 		printf("%s: couldn't alloc MBSS state\n", __func__);
672 		return;
673 	}
674 	vap->iv_mesh = ms;
675 	ms->ms_seq = 0;
676 	ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
677 	ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
678 	TAILQ_INIT(&ms->ms_known_gates);
679 	TAILQ_INIT(&ms->ms_routes);
680 	MESH_RT_LOCK_INIT(ms, "MBSS");
681 	callout_init(&ms->ms_cleantimer, 1);
682 	callout_init(&ms->ms_gatetimer, 1);
683 	ms->ms_gateseq = 0;
684 	mesh_select_proto_metric(vap, "AIRTIME");
685 	KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
686 	mesh_select_proto_path(vap, "HWMP");
687 	KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
688 	ms->ms_ppath->mpp_vattach(vap);
689 }
690 
691 /*
692  * IEEE80211_M_MBSS vap state machine handler.
693  */
694 static int
695 mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
696 {
697 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
698 	struct ieee80211com *ic = vap->iv_ic;
699 	struct ieee80211_node *ni;
700 	enum ieee80211_state ostate;
701 
702 	IEEE80211_LOCK_ASSERT(ic);
703 
704 	ostate = vap->iv_state;
705 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
706 	    __func__, ieee80211_state_name[ostate],
707 	    ieee80211_state_name[nstate], arg);
708 	vap->iv_state = nstate;		/* state transition */
709 	if (ostate != IEEE80211_S_SCAN)
710 		ieee80211_cancel_scan(vap);	/* background scan */
711 	ni = vap->iv_bss;			/* NB: no reference held */
712 	if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN) {
713 		callout_drain(&ms->ms_cleantimer);
714 		callout_drain(&ms->ms_gatetimer);
715 	}
716 	switch (nstate) {
717 	case IEEE80211_S_INIT:
718 		switch (ostate) {
719 		case IEEE80211_S_SCAN:
720 			ieee80211_cancel_scan(vap);
721 			break;
722 		case IEEE80211_S_CAC:
723 			ieee80211_dfs_cac_stop(vap);
724 			break;
725 		case IEEE80211_S_RUN:
726 			ieee80211_iterate_nodes(&ic->ic_sta,
727 			    mesh_vdetach_peers, NULL);
728 			break;
729 		default:
730 			break;
731 		}
732 		if (ostate != IEEE80211_S_INIT) {
733 			/* NB: optimize INIT -> INIT case */
734 			ieee80211_reset_bss(vap);
735 			ieee80211_mesh_rt_flush(vap);
736 		}
737 		break;
738 	case IEEE80211_S_SCAN:
739 		switch (ostate) {
740 		case IEEE80211_S_INIT:
741 			if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
742 			    !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
743 			    ms->ms_idlen != 0) {
744 				/*
745 				 * Already have a channel and a mesh ID; bypass
746 				 * the scan and startup immediately.
747 				 */
748 				ieee80211_create_ibss(vap, vap->iv_des_chan);
749 				break;
750 			}
751 			/*
752 			 * Initiate a scan.  We can come here as a result
753 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
754 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
755 			 * and the scan request parameters will be present
756 			 * in iv_scanreq.  Otherwise we do the default.
757 			*/
758 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
759 				ieee80211_check_scan(vap,
760 				    vap->iv_scanreq_flags,
761 				    vap->iv_scanreq_duration,
762 				    vap->iv_scanreq_mindwell,
763 				    vap->iv_scanreq_maxdwell,
764 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
765 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
766 			} else
767 				ieee80211_check_scan_current(vap);
768 			break;
769 		default:
770 			break;
771 		}
772 		break;
773 	case IEEE80211_S_CAC:
774 		/*
775 		 * Start CAC on a DFS channel.  We come here when starting
776 		 * a bss on a DFS channel (see ieee80211_create_ibss).
777 		 */
778 		ieee80211_dfs_cac_start(vap);
779 		break;
780 	case IEEE80211_S_RUN:
781 		switch (ostate) {
782 		case IEEE80211_S_INIT:
783 			/*
784 			 * Already have a channel; bypass the
785 			 * scan and startup immediately.
786 			 * Note that ieee80211_create_ibss will call
787 			 * back to do a RUN->RUN state change.
788 			 */
789 			ieee80211_create_ibss(vap,
790 			    ieee80211_ht_adjust_channel(ic,
791 				ic->ic_curchan, vap->iv_flags_ht));
792 			/* NB: iv_bss is changed on return */
793 			break;
794 		case IEEE80211_S_CAC:
795 			/*
796 			 * NB: This is the normal state change when CAC
797 			 * expires and no radar was detected; no need to
798 			 * clear the CAC timer as it's already expired.
799 			 */
800 			/* fall thru... */
801 		case IEEE80211_S_CSA:
802 #if 0
803 			/*
804 			 * Shorten inactivity timer of associated stations
805 			 * to weed out sta's that don't follow a CSA.
806 			 */
807 			ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
808 #endif
809 			/*
810 			 * Update bss node channel to reflect where
811 			 * we landed after CSA.
812 			 */
813 			ieee80211_node_set_chan(ni,
814 			    ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
815 				ieee80211_htchanflags(ni->ni_chan)));
816 			/* XXX bypass debug msgs */
817 			break;
818 		case IEEE80211_S_SCAN:
819 		case IEEE80211_S_RUN:
820 #ifdef IEEE80211_DEBUG
821 			if (ieee80211_msg_debug(vap)) {
822 				ieee80211_note(vap,
823 				    "synchronized with %s meshid ",
824 				    ether_sprintf(ni->ni_meshid));
825 				ieee80211_print_essid(ni->ni_meshid,
826 				    ni->ni_meshidlen);
827 				/* XXX MCS/HT */
828 				printf(" channel %d\n",
829 				    ieee80211_chan2ieee(ic, ic->ic_curchan));
830 			}
831 #endif
832 			break;
833 		default:
834 			break;
835 		}
836 		ieee80211_node_authorize(ni);
837 		callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
838                     mesh_rt_cleanup_cb, vap);
839 		mesh_gatemode_setup(vap);
840 		break;
841 	default:
842 		break;
843 	}
844 	/* NB: ostate not nstate */
845 	ms->ms_ppath->mpp_newstate(vap, ostate, arg);
846 	return 0;
847 }
848 
849 static void
850 mesh_rt_cleanup_cb(void *arg)
851 {
852 	struct ieee80211vap *vap = arg;
853 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
854 
855 	mesh_rt_flush_invalid(vap);
856 	callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
857 	    mesh_rt_cleanup_cb, vap);
858 }
859 
860 /*
861  * Mark a mesh STA as gate and return a pointer to it.
862  * If this is first time, we create a new gate route.
863  * Always update the path route to this mesh gate.
864  */
865 struct ieee80211_mesh_gate_route *
866 ieee80211_mesh_mark_gate(struct ieee80211vap *vap, const uint8_t *addr,
867     struct ieee80211_mesh_route *rt)
868 {
869 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
870 	struct ieee80211_mesh_gate_route *gr = NULL, *next;
871 	int found = 0;
872 
873 	MESH_RT_LOCK(ms);
874 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
875 		if (IEEE80211_ADDR_EQ(gr->gr_addr, addr)) {
876 			found = 1;
877 			break;
878 		}
879 	}
880 
881 	if (!found) {
882 		/* New mesh gate add it to known table. */
883 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, addr,
884 		    "%s", "stored new gate information from pro-PREQ.");
885 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
886 		    M_80211_MESH_GT_RT,
887 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
888 		IEEE80211_ADDR_COPY(gr->gr_addr, addr);
889 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
890 	}
891 	gr->gr_route = rt;
892 	/* TODO: link from path route to gate route */
893 	MESH_RT_UNLOCK(ms);
894 
895 	return gr;
896 }
897 
898 
899 /*
900  * Helper function to note the Mesh Peer Link FSM change.
901  */
902 static void
903 mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
904 {
905 	struct ieee80211vap *vap = ni->ni_vap;
906 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
907 #ifdef IEEE80211_DEBUG
908 	static const char *meshlinkstates[] = {
909 		[IEEE80211_NODE_MESH_IDLE]		= "IDLE",
910 		[IEEE80211_NODE_MESH_OPENSNT]		= "OPEN SENT",
911 		[IEEE80211_NODE_MESH_OPENRCV]		= "OPEN RECEIVED",
912 		[IEEE80211_NODE_MESH_CONFIRMRCV]	= "CONFIRM RECEIVED",
913 		[IEEE80211_NODE_MESH_ESTABLISHED]	= "ESTABLISHED",
914 		[IEEE80211_NODE_MESH_HOLDING]		= "HOLDING"
915 	};
916 #endif
917 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
918 	    ni, "peer link: %s -> %s",
919 	    meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
920 
921 	/* track neighbor count */
922 	if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
923 	    ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
924 		KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
925 		ms->ms_neighbors++;
926 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
927 	} else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
928 	    state != IEEE80211_NODE_MESH_ESTABLISHED) {
929 		KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
930 		ms->ms_neighbors--;
931 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
932 	}
933 	ni->ni_mlstate = state;
934 	switch (state) {
935 	case IEEE80211_NODE_MESH_HOLDING:
936 		ms->ms_ppath->mpp_peerdown(ni);
937 		break;
938 	case IEEE80211_NODE_MESH_ESTABLISHED:
939 		ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
940 		break;
941 	default:
942 		break;
943 	}
944 }
945 
946 /*
947  * Helper function to generate a unique local ID required for mesh
948  * peer establishment.
949  */
950 static void
951 mesh_checkid(void *arg, struct ieee80211_node *ni)
952 {
953 	uint16_t *r = arg;
954 
955 	if (*r == ni->ni_mllid)
956 		*(uint16_t *)arg = 0;
957 }
958 
959 static uint32_t
960 mesh_generateid(struct ieee80211vap *vap)
961 {
962 	int maxiter = 4;
963 	uint16_t r;
964 
965 	do {
966 		get_random_bytes(&r, 2);
967 		ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
968 		maxiter--;
969 	} while (r == 0 && maxiter > 0);
970 	return r;
971 }
972 
973 /*
974  * Verifies if we already received this packet by checking its
975  * sequence number.
976  * Returns 0 if the frame is to be accepted, 1 otherwise.
977  */
978 static int
979 mesh_checkpseq(struct ieee80211vap *vap,
980     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
981 {
982 	struct ieee80211_mesh_route *rt;
983 
984 	rt = ieee80211_mesh_rt_find(vap, source);
985 	if (rt == NULL) {
986 		rt = ieee80211_mesh_rt_add(vap, source);
987 		if (rt == NULL) {
988 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
989 			    "%s", "add mcast route failed");
990 			vap->iv_stats.is_mesh_rtaddfailed++;
991 			return 1;
992 		}
993 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
994 		    "add mcast route, mesh seqno %d", seq);
995 		rt->rt_lastmseq = seq;
996 		return 0;
997 	}
998 	if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
999 		return 1;
1000 	} else {
1001 		rt->rt_lastmseq = seq;
1002 		return 0;
1003 	}
1004 }
1005 
1006 /*
1007  * Iterate the routing table and locate the next hop.
1008  */
1009 struct ieee80211_node *
1010 ieee80211_mesh_find_txnode(struct ieee80211vap *vap,
1011     const uint8_t dest[IEEE80211_ADDR_LEN])
1012 {
1013 	struct ieee80211_mesh_route *rt;
1014 
1015 	rt = ieee80211_mesh_rt_find(vap, dest);
1016 	if (rt == NULL)
1017 		return NULL;
1018 	if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1019 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1020 		    "%s: !valid, flags 0x%x", __func__, rt->rt_flags);
1021 		/* XXX stat */
1022 		return NULL;
1023 	}
1024 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
1025 		rt = ieee80211_mesh_rt_find(vap, rt->rt_mesh_gate);
1026 		if (rt == NULL) return NULL;
1027 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1028 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1029 			    "%s: meshgate !valid, flags 0x%x", __func__,
1030 			    rt->rt_flags);
1031 			/* XXX stat */
1032 			return NULL;
1033 		}
1034 	}
1035 	return ieee80211_find_txnode(vap, rt->rt_nexthop);
1036 }
1037 
1038 static void
1039 mesh_transmit_to_gate(struct ieee80211vap *vap, struct mbuf *m,
1040     struct ieee80211_mesh_route *rt_gate)
1041 {
1042 	struct ifnet *ifp = vap->iv_ifp;
1043 	struct ieee80211_node *ni;
1044 
1045 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1046 
1047 	ni = ieee80211_mesh_find_txnode(vap, rt_gate->rt_dest);
1048 	if (ni == NULL) {
1049 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1050 		m_freem(m);
1051 		return;
1052 	}
1053 
1054 	/*
1055 	 * Send through the VAP packet transmit path.
1056 	 * This consumes the node ref grabbed above and
1057 	 * the mbuf, regardless of whether there's a problem
1058 	 * or not.
1059 	 */
1060 	(void) ieee80211_vap_pkt_send_dest(vap, m, ni);
1061 }
1062 
1063 /*
1064  * Forward the queued frames to known valid mesh gates.
1065  * Assume destination to be outside the MBSS (i.e. proxy entry),
1066  * If no valid mesh gates are known silently discard queued frames.
1067  * After transmitting frames to all known valid mesh gates, this route
1068  * will be marked invalid, and a new path discovery will happen in the hopes
1069  * that (at least) one of the mesh gates have a new proxy entry for us to use.
1070  */
1071 void
1072 ieee80211_mesh_forward_to_gates(struct ieee80211vap *vap,
1073     struct ieee80211_mesh_route *rt_dest)
1074 {
1075 	struct ieee80211com *ic = vap->iv_ic;
1076 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1077 	struct ieee80211_mesh_route *rt_gate;
1078 	struct ieee80211_mesh_gate_route *gr = NULL, *gr_next;
1079 	struct mbuf *m, *mcopy, *next;
1080 
1081 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1082 
1083 	KASSERT( rt_dest->rt_flags == IEEE80211_MESHRT_FLAGS_DISCOVER,
1084 	    ("Route is not marked with IEEE80211_MESHRT_FLAGS_DISCOVER"));
1085 
1086 	/* XXX: send to more than one valid mash gate */
1087 	MESH_RT_LOCK(ms);
1088 
1089 	m = ieee80211_ageq_remove(&ic->ic_stageq,
1090 	    (struct ieee80211_node *)(uintptr_t)
1091 	    ieee80211_mac_hash(ic, rt_dest->rt_dest));
1092 
1093 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, gr_next) {
1094 		rt_gate = gr->gr_route;
1095 		if (rt_gate == NULL) {
1096 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1097 				rt_dest->rt_dest,
1098 				"mesh gate with no path %6D",
1099 				gr->gr_addr, ":");
1100 			continue;
1101 		}
1102 		if ((rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
1103 			continue;
1104 		KASSERT(rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_GATE,
1105 		    ("route not marked as a mesh gate"));
1106 		KASSERT((rt_gate->rt_flags &
1107 			IEEE80211_MESHRT_FLAGS_PROXY) == 0,
1108 			("found mesh gate that is also marked porxy"));
1109 		/*
1110 		 * convert route to a proxy route gated by the current
1111 		 * mesh gate, this is needed so encap can built data
1112 		 * frame with correct address.
1113 		 */
1114 		rt_dest->rt_flags = IEEE80211_MESHRT_FLAGS_PROXY |
1115 			IEEE80211_MESHRT_FLAGS_VALID;
1116 		rt_dest->rt_ext_seq = 1; /* random value */
1117 		IEEE80211_ADDR_COPY(rt_dest->rt_mesh_gate, rt_gate->rt_dest);
1118 		IEEE80211_ADDR_COPY(rt_dest->rt_nexthop, rt_gate->rt_nexthop);
1119 		rt_dest->rt_metric = rt_gate->rt_metric;
1120 		rt_dest->rt_nhops = rt_gate->rt_nhops;
1121 		ieee80211_mesh_rt_update(rt_dest, ms->ms_ppath->mpp_inact);
1122 		MESH_RT_UNLOCK(ms);
1123 		/* XXX: lock?? */
1124 		mcopy = m_dup(m, M_NOWAIT);
1125 		for (; mcopy != NULL; mcopy = next) {
1126 			next = mcopy->m_nextpkt;
1127 			mcopy->m_nextpkt = NULL;
1128 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1129 			    rt_dest->rt_dest,
1130 			    "flush queued frame %p len %d", mcopy,
1131 			    mcopy->m_pkthdr.len);
1132 			mesh_transmit_to_gate(vap, mcopy, rt_gate);
1133 		}
1134 		MESH_RT_LOCK(ms);
1135 	}
1136 	rt_dest->rt_flags = 0; /* Mark invalid */
1137 	m_freem(m);
1138 	MESH_RT_UNLOCK(ms);
1139 }
1140 
1141 /*
1142  * Forward the specified frame.
1143  * Decrement the TTL and set TA to our MAC address.
1144  */
1145 static void
1146 mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
1147     const struct ieee80211_meshcntl *mc)
1148 {
1149 	struct ieee80211com *ic = vap->iv_ic;
1150 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1151 	struct ifnet *ifp = vap->iv_ifp;
1152 	const struct ieee80211_frame *wh =
1153 	    mtod(m, const struct ieee80211_frame *);
1154 	struct mbuf *mcopy;
1155 	struct ieee80211_meshcntl *mccopy;
1156 	struct ieee80211_frame *whcopy;
1157 	struct ieee80211_node *ni;
1158 	int err;
1159 
1160 	/* This is called from the RX path - don't hold this lock */
1161 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1162 
1163 	/*
1164 	 * mesh ttl of 1 means we are the last one receiving it,
1165 	 * according to amendment we decrement and then check if
1166 	 * 0, if so we dont forward.
1167 	 */
1168 	if (mc->mc_ttl < 1) {
1169 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1170 		    "%s", "frame not fwd'd, ttl 1");
1171 		vap->iv_stats.is_mesh_fwd_ttl++;
1172 		return;
1173 	}
1174 	if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
1175 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1176 		    "%s", "frame not fwd'd, fwding disabled");
1177 		vap->iv_stats.is_mesh_fwd_disabled++;
1178 		return;
1179 	}
1180 	mcopy = m_dup(m, M_NOWAIT);
1181 	if (mcopy == NULL) {
1182 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1183 		    "%s", "frame not fwd'd, cannot dup");
1184 		vap->iv_stats.is_mesh_fwd_nobuf++;
1185 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1186 		return;
1187 	}
1188 	mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
1189 	    sizeof(struct ieee80211_meshcntl));
1190 	if (mcopy == NULL) {
1191 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1192 		    "%s", "frame not fwd'd, too short");
1193 		vap->iv_stats.is_mesh_fwd_tooshort++;
1194 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1195 		m_freem(mcopy);
1196 		return;
1197 	}
1198 	whcopy = mtod(mcopy, struct ieee80211_frame *);
1199 	mccopy = (struct ieee80211_meshcntl *)
1200 	    (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
1201 	/* XXX clear other bits? */
1202 	whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
1203 	IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
1204 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1205 		ni = ieee80211_ref_node(vap->iv_bss);
1206 		mcopy->m_flags |= M_MCAST;
1207 	} else {
1208 		ni = ieee80211_mesh_find_txnode(vap, whcopy->i_addr3);
1209 		if (ni == NULL) {
1210 			/*
1211 			 * [Optional] any of the following three actions:
1212 			 * o silently discard
1213 			 * o trigger a path discovery
1214 			 * o inform TA that meshDA is unknown.
1215 			 */
1216 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1217 			    "%s", "frame not fwd'd, no path");
1218 			ms->ms_ppath->mpp_senderror(vap, whcopy->i_addr3, NULL,
1219 			    IEEE80211_REASON_MESH_PERR_NO_FI);
1220 			vap->iv_stats.is_mesh_fwd_nopath++;
1221 			m_freem(mcopy);
1222 			return;
1223 		}
1224 		IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
1225 	}
1226 	KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
1227 	mccopy->mc_ttl--;
1228 
1229 	/* XXX calculate priority so drivers can find the tx queue */
1230 	M_WME_SETAC(mcopy, WME_AC_BE);
1231 
1232 	/* XXX do we know m_nextpkt is NULL? */
1233 	MPASS((mcopy->m_pkthdr.csum_flags & CSUM_SND_TAG) == 0);
1234 	mcopy->m_pkthdr.rcvif = (void *) ni;
1235 
1236 	/*
1237 	 * XXX this bypasses all of the VAP TX handling; it passes frames
1238 	 * directly to the parent interface.
1239 	 *
1240 	 * Because of this, there's no TX lock being held as there's no
1241 	 * encaps state being used.
1242 	 *
1243 	 * Doing a direct parent transmit may not be the correct thing
1244 	 * to do here; we'll have to re-think this soon.
1245 	 */
1246 	IEEE80211_TX_LOCK(ic);
1247 	err = ieee80211_parent_xmitpkt(ic, mcopy);
1248 	IEEE80211_TX_UNLOCK(ic);
1249 	if (!err)
1250 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1251 }
1252 
1253 static struct mbuf *
1254 mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
1255 {
1256 #define	WHDIR(wh)	((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
1257 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1258 	uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
1259 		  sizeof(struct ieee80211_meshcntl_ae10)];
1260 	const struct ieee80211_qosframe_addr4 *wh;
1261 	const struct ieee80211_meshcntl_ae10 *mc;
1262 	struct ether_header *eh;
1263 	struct llc *llc;
1264 	int ae;
1265 
1266 	if (m->m_len < hdrlen + sizeof(*llc) &&
1267 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
1268 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
1269 		    "discard data frame: %s", "m_pullup failed");
1270 		vap->iv_stats.is_rx_tooshort++;
1271 		return NULL;
1272 	}
1273 	memcpy(b, mtod(m, caddr_t), hdrlen);
1274 	wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
1275 	mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
1276 	KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
1277 		WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
1278 	    ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1279 
1280 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
1281 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
1282 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
1283 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
1284 	    /* NB: preserve AppleTalk frames that have a native SNAP hdr */
1285 	    !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
1286 	      llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
1287 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
1288 		llc = NULL;
1289 	} else {
1290 		m_adj(m, hdrlen - sizeof(*eh));
1291 	}
1292 	eh = mtod(m, struct ether_header *);
1293 	ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1294 	if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
1295 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
1296 		if (ae == IEEE80211_MESH_AE_00) {
1297 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
1298 		} else if (ae == IEEE80211_MESH_AE_01) {
1299 			IEEE80211_ADDR_COPY(eh->ether_shost,
1300 			    MC01(mc)->mc_addr4);
1301 		} else {
1302 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1303 			    (const struct ieee80211_frame *)wh, NULL,
1304 			    "bad AE %d", ae);
1305 			vap->iv_stats.is_mesh_badae++;
1306 			m_freem(m);
1307 			return NULL;
1308 		}
1309 	} else {
1310 		if (ae == IEEE80211_MESH_AE_00) {
1311 			IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
1312 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
1313 		} else if (ae == IEEE80211_MESH_AE_10) {
1314 			IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr5);
1315 			IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr6);
1316 		} else {
1317 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1318 			    (const struct ieee80211_frame *)wh, NULL,
1319 			    "bad AE %d", ae);
1320 			vap->iv_stats.is_mesh_badae++;
1321 			m_freem(m);
1322 			return NULL;
1323 		}
1324 	}
1325 #ifndef __NO_STRICT_ALIGNMENT
1326 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
1327 		m = ieee80211_realign(vap, m, sizeof(*eh));
1328 		if (m == NULL)
1329 			return NULL;
1330 	}
1331 #endif /* !__NO_STRICT_ALIGNMENT */
1332 	if (llc != NULL) {
1333 		eh = mtod(m, struct ether_header *);
1334 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
1335 	}
1336 	return m;
1337 #undef	WDIR
1338 #undef	MC01
1339 }
1340 
1341 /*
1342  * Return non-zero if the unicast mesh data frame should be processed
1343  * locally.  Frames that are not proxy'd have our address, otherwise
1344  * we need to consult the routing table to look for a proxy entry.
1345  */
1346 static __inline int
1347 mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
1348     const struct ieee80211_meshcntl *mc)
1349 {
1350 	int ae = mc->mc_flags & 3;
1351 
1352 	KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
1353 	    ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1354 	KASSERT(ae == IEEE80211_MESH_AE_00 || ae == IEEE80211_MESH_AE_10,
1355 	    ("bad AE %d", ae));
1356 	if (ae == IEEE80211_MESH_AE_10) {	/* ucast w/ proxy */
1357 		const struct ieee80211_meshcntl_ae10 *mc10 =
1358 		    (const struct ieee80211_meshcntl_ae10 *) mc;
1359 		struct ieee80211_mesh_route *rt =
1360 		    ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1361 		/* check for proxy route to ourself */
1362 		return (rt != NULL &&
1363 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
1364 	} else					/* ucast w/o proxy */
1365 		return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
1366 }
1367 
1368 /*
1369  * Verifies transmitter, updates lifetime, precursor list and forwards data.
1370  * > 0 means we have forwarded data and no need to process locally
1371  * == 0 means we want to process locally (and we may have forwarded data
1372  * < 0 means there was an error and data should be discarded
1373  */
1374 static int
1375 mesh_recv_indiv_data_to_fwrd(struct ieee80211vap *vap, struct mbuf *m,
1376     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1377 {
1378 	struct ieee80211_qosframe_addr4 *qwh;
1379 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1380 	struct ieee80211_mesh_route *rt_meshda, *rt_meshsa;
1381 
1382 	/* This is called from the RX path - don't hold this lock */
1383 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1384 
1385 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1386 
1387 	/*
1388 	 * TODO:
1389 	 * o verify addr2 is  a legitimate transmitter
1390 	 * o lifetime of precursor of addr3 (addr2) is max(init, curr)
1391 	 * o lifetime of precursor of addr4 (nexthop) is max(init, curr)
1392 	 */
1393 
1394 	/* set lifetime of addr3 (meshDA) to initial value */
1395 	rt_meshda = ieee80211_mesh_rt_find(vap, qwh->i_addr3);
1396 	if (rt_meshda == NULL) {
1397 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, qwh->i_addr2,
1398 		    "no route to meshDA(%6D)", qwh->i_addr3, ":");
1399 		/*
1400 		 * [Optional] any of the following three actions:
1401 		 * o silently discard 				[X]
1402 		 * o trigger a path discovery			[ ]
1403 		 * o inform TA that meshDA is unknown.		[ ]
1404 		 */
1405 		/* XXX: stats */
1406 		return (-1);
1407 	}
1408 
1409 	ieee80211_mesh_rt_update(rt_meshda, ticks_to_msecs(
1410 	    ms->ms_ppath->mpp_inact));
1411 
1412 	/* set lifetime of addr4 (meshSA) to initial value */
1413 	rt_meshsa = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1414 	KASSERT(rt_meshsa != NULL, ("no route"));
1415 	ieee80211_mesh_rt_update(rt_meshsa, ticks_to_msecs(
1416 	    ms->ms_ppath->mpp_inact));
1417 
1418 	mesh_forward(vap, m, mc);
1419 	return (1); /* dont process locally */
1420 }
1421 
1422 /*
1423  * Verifies transmitter, updates lifetime, precursor list and process data
1424  * locally, if data is proxy with AE = 10 it could mean data should go
1425  * on another mesh path or data should be forwarded to the DS.
1426  *
1427  * > 0 means we have forwarded data and no need to process locally
1428  * == 0 means we want to process locally (and we may have forwarded data
1429  * < 0 means there was an error and data should be discarded
1430  */
1431 static int
1432 mesh_recv_indiv_data_to_me(struct ieee80211vap *vap, struct mbuf *m,
1433     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1434 {
1435 	struct ieee80211_qosframe_addr4 *qwh;
1436 	const struct ieee80211_meshcntl_ae10 *mc10;
1437 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1438 	struct ieee80211_mesh_route *rt;
1439 	int ae;
1440 
1441 	/* This is called from the RX path - don't hold this lock */
1442 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1443 
1444 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1445 	mc10 = (const struct ieee80211_meshcntl_ae10 *)mc;
1446 
1447 	/*
1448 	 * TODO:
1449 	 * o verify addr2 is  a legitimate transmitter
1450 	 * o lifetime of precursor entry is max(init, curr)
1451 	 */
1452 
1453 	/* set lifetime of addr4 (meshSA) to initial value */
1454 	rt = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1455 	KASSERT(rt != NULL, ("no route"));
1456 	ieee80211_mesh_rt_update(rt, ticks_to_msecs(ms->ms_ppath->mpp_inact));
1457 	rt = NULL;
1458 
1459 	ae = mc10->mc_flags & IEEE80211_MESH_AE_MASK;
1460 	KASSERT(ae == IEEE80211_MESH_AE_00 ||
1461 	    ae == IEEE80211_MESH_AE_10, ("bad AE %d", ae));
1462 	if (ae == IEEE80211_MESH_AE_10) {
1463 		if (IEEE80211_ADDR_EQ(mc10->mc_addr5, qwh->i_addr3)) {
1464 			return (0); /* process locally */
1465 		}
1466 
1467 		rt =  ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1468 		if (rt != NULL &&
1469 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) &&
1470 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) == 0) {
1471 			/*
1472 			 * Forward on another mesh-path, according to
1473 			 * amendment as specified in 9.32.4.1
1474 			 */
1475 			IEEE80211_ADDR_COPY(qwh->i_addr3, mc10->mc_addr5);
1476 			mesh_forward(vap, m,
1477 			    (const struct ieee80211_meshcntl *)mc10);
1478 			return (1); /* dont process locally */
1479 		}
1480 		/*
1481 		 * All other cases: forward of MSDUs from the MBSS to DS indiv.
1482 		 * addressed according to 13.11.3.2.
1483 		 */
1484 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT, qwh->i_addr2,
1485 		    "forward frame to DS, SA(%6D) DA(%6D)",
1486 		    mc10->mc_addr6, ":", mc10->mc_addr5, ":");
1487 	}
1488 	return (0); /* process locally */
1489 }
1490 
1491 /*
1492  * Try to forward the group addressed data on to other mesh STAs, and
1493  * also to the DS.
1494  *
1495  * > 0 means we have forwarded data and no need to process locally
1496  * == 0 means we want to process locally (and we may have forwarded data
1497  * < 0 means there was an error and data should be discarded
1498  */
1499 static int
1500 mesh_recv_group_data(struct ieee80211vap *vap, struct mbuf *m,
1501     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1502 {
1503 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1504 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1505 
1506 	/* This is called from the RX path - don't hold this lock */
1507 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1508 
1509 	mesh_forward(vap, m, mc);
1510 
1511 	if(mc->mc_ttl > 0) {
1512 		if (mc->mc_flags & IEEE80211_MESH_AE_01) {
1513 			/*
1514 			 * Forward of MSDUs from the MBSS to DS group addressed
1515 			 * (according to 13.11.3.2)
1516 			 * This happens by delivering the packet, and a bridge
1517 			 * will sent it on another port member.
1518 			 */
1519 			if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE &&
1520 			    ms->ms_flags & IEEE80211_MESHFLAGS_FWD) {
1521 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH,
1522 				    MC01(mc)->mc_addr4, "%s",
1523 				    "forward from MBSS to the DS");
1524 			}
1525 		}
1526 	}
1527 	return (0); /* process locally */
1528 #undef	MC01
1529 }
1530 
1531 static int
1532 mesh_input(struct ieee80211_node *ni, struct mbuf *m,
1533     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1534 {
1535 #define	HAS_SEQ(type)	((type & 0x4) == 0)
1536 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1537 	struct ieee80211vap *vap = ni->ni_vap;
1538 	struct ieee80211com *ic = ni->ni_ic;
1539 	struct ifnet *ifp = vap->iv_ifp;
1540 	struct ieee80211_frame *wh;
1541 	const struct ieee80211_meshcntl *mc;
1542 	int hdrspace, meshdrlen, need_tap, error;
1543 	uint8_t dir, type, subtype, ae;
1544 	uint32_t seq;
1545 	const uint8_t *addr;
1546 	uint8_t qos[2];
1547 
1548 	KASSERT(ni != NULL, ("null node"));
1549 	ni->ni_inact = ni->ni_inact_reload;
1550 
1551 	need_tap = 1;			/* mbuf need to be tapped. */
1552 	type = -1;			/* undefined */
1553 
1554 	/* This is called from the RX path - don't hold this lock */
1555 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1556 
1557 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
1558 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1559 		    ni->ni_macaddr, NULL,
1560 		    "too short (1): len %u", m->m_pkthdr.len);
1561 		vap->iv_stats.is_rx_tooshort++;
1562 		goto out;
1563 	}
1564 	/*
1565 	 * Bit of a cheat here, we use a pointer for a 3-address
1566 	 * frame format but don't reference fields past outside
1567 	 * ieee80211_frame_min w/o first validating the data is
1568 	 * present.
1569 	*/
1570 	wh = mtod(m, struct ieee80211_frame *);
1571 
1572 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1573 	    IEEE80211_FC0_VERSION_0) {
1574 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1575 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
1576 		vap->iv_stats.is_rx_badversion++;
1577 		goto err;
1578 	}
1579 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1580 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1581 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1582 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1583 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1584 		ni->ni_noise = nf;
1585 		if (HAS_SEQ(type)) {
1586 			uint8_t tid = ieee80211_gettid(wh);
1587 
1588 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
1589 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
1590 				ic->ic_wme.wme_hipri_traffic++;
1591 			if (! ieee80211_check_rxseq(ni, wh, wh->i_addr1, rxs))
1592 				goto out;
1593 		}
1594 	}
1595 #ifdef IEEE80211_DEBUG
1596 	/*
1597 	 * It's easier, but too expensive, to simulate different mesh
1598 	 * topologies by consulting the ACL policy very early, so do this
1599 	 * only under DEBUG.
1600 	 *
1601 	 * NB: this check is also done upon peering link initiation.
1602 	 */
1603 	if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1604 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1605 		    wh, NULL, "%s", "disallowed by ACL");
1606 		vap->iv_stats.is_rx_acl++;
1607 		goto out;
1608 	}
1609 #endif
1610 	switch (type) {
1611 	case IEEE80211_FC0_TYPE_DATA:
1612 		if (ni == vap->iv_bss)
1613 			goto out;
1614 		if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
1615 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1616 			    ni->ni_macaddr, NULL,
1617 			    "peer link not yet established (%d)",
1618 			    ni->ni_mlstate);
1619 			vap->iv_stats.is_mesh_nolink++;
1620 			goto out;
1621 		}
1622 		if (dir != IEEE80211_FC1_DIR_FROMDS &&
1623 		    dir != IEEE80211_FC1_DIR_DSTODS) {
1624 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1625 			    wh, "data", "incorrect dir 0x%x", dir);
1626 			vap->iv_stats.is_rx_wrongdir++;
1627 			goto err;
1628 		}
1629 
1630 		/* All Mesh data frames are QoS subtype */
1631 		if (!HAS_SEQ(type)) {
1632 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1633 			    wh, "data", "incorrect subtype 0x%x", subtype);
1634 			vap->iv_stats.is_rx_badsubtype++;
1635 			goto err;
1636 		}
1637 
1638 		/*
1639 		 * Next up, any fragmentation.
1640 		 * XXX: we defrag before we even try to forward,
1641 		 * Mesh Control field is not present in sub-sequent
1642 		 * fragmented frames. This is in contrast to Draft 4.0.
1643 		 */
1644 		hdrspace = ieee80211_hdrspace(ic, wh);
1645 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1646 			m = ieee80211_defrag(ni, m, hdrspace);
1647 			if (m == NULL) {
1648 				/* Fragment dropped or frame not complete yet */
1649 				goto out;
1650 			}
1651 		}
1652 		wh = mtod(m, struct ieee80211_frame *); /* NB: after defrag */
1653 
1654 		/*
1655 		 * Now we have a complete Mesh Data frame.
1656 		 */
1657 
1658 		/*
1659 		 * Only fromDStoDS data frames use 4 address qos frames
1660 		 * as specified in amendment. Otherwise addr4 is located
1661 		 * in the Mesh Control field and a 3 address qos frame
1662 		 * is used.
1663 		 */
1664 		*(uint16_t *)qos = *(uint16_t *)ieee80211_getqos(wh);
1665 
1666 		/*
1667 		 * NB: The mesh STA sets the Mesh Control Present
1668 		 * subfield to 1 in the Mesh Data frame containing
1669 		 * an unfragmented MSDU, an A-MSDU, or the first
1670 		 * fragment of an MSDU.
1671 		 * After defrag it should always be present.
1672 		 */
1673 		if (!(qos[1] & IEEE80211_QOS_MC)) {
1674 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1675 			    ni->ni_macaddr, NULL,
1676 			    "%s", "Mesh control field not present");
1677 			vap->iv_stats.is_rx_elem_missing++; /* XXX: kinda */
1678 			goto err;
1679 		}
1680 
1681 		/* pull up enough to get to the mesh control */
1682 		if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
1683 		    (m = m_pullup(m, hdrspace +
1684 		        sizeof(struct ieee80211_meshcntl))) == NULL) {
1685 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1686 			    ni->ni_macaddr, NULL,
1687 			    "data too short: expecting %u", hdrspace);
1688 			vap->iv_stats.is_rx_tooshort++;
1689 			goto out;		/* XXX */
1690 		}
1691 		/*
1692 		 * Now calculate the full extent of the headers. Note
1693 		 * mesh_decap will pull up anything we didn't get
1694 		 * above when it strips the 802.11 headers.
1695 		 */
1696 		mc = (const struct ieee80211_meshcntl *)
1697 		    (mtod(m, const uint8_t *) + hdrspace);
1698 		ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1699 		meshdrlen = sizeof(struct ieee80211_meshcntl) +
1700 		    ae * IEEE80211_ADDR_LEN;
1701 		hdrspace += meshdrlen;
1702 
1703 		/* pull complete hdrspace = ieee80211_hdrspace + meshcontrol */
1704 		if ((meshdrlen > sizeof(struct ieee80211_meshcntl)) &&
1705 		    (m->m_len < hdrspace) &&
1706 		    ((m = m_pullup(m, hdrspace)) == NULL)) {
1707 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1708 			    ni->ni_macaddr, NULL,
1709 			    "data too short: expecting %u", hdrspace);
1710 			vap->iv_stats.is_rx_tooshort++;
1711 			goto out;		/* XXX */
1712 		}
1713 		/* XXX: are we sure there is no reallocating after m_pullup? */
1714 
1715 		seq = le32dec(mc->mc_seq);
1716 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1717 			addr = wh->i_addr3;
1718 		else if (ae == IEEE80211_MESH_AE_01)
1719 			addr = MC01(mc)->mc_addr4;
1720 		else
1721 			addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
1722 		if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
1723 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1724 			    addr, "data", "%s", "not to me");
1725 			vap->iv_stats.is_rx_wrongbss++;	/* XXX kinda */
1726 			goto out;
1727 		}
1728 		if (mesh_checkpseq(vap, addr, seq) != 0) {
1729 			vap->iv_stats.is_rx_dup++;
1730 			goto out;
1731 		}
1732 
1733 		/* This code "routes" the frame to the right control path */
1734 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1735 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr3))
1736 				error =
1737 				    mesh_recv_indiv_data_to_me(vap, m, wh, mc);
1738 			else if (IEEE80211_IS_MULTICAST(wh->i_addr3))
1739 				error = mesh_recv_group_data(vap, m, wh, mc);
1740 			else
1741 				error = mesh_recv_indiv_data_to_fwrd(vap, m,
1742 				    wh, mc);
1743 		} else
1744 			error = mesh_recv_group_data(vap, m, wh, mc);
1745 		if (error < 0)
1746 			goto err;
1747 		else if (error > 0)
1748 			goto out;
1749 
1750 		if (ieee80211_radiotap_active_vap(vap))
1751 			ieee80211_radiotap_rx(vap, m);
1752 		need_tap = 0;
1753 
1754 		/*
1755 		 * Finally, strip the 802.11 header.
1756 		 */
1757 		m = mesh_decap(vap, m, hdrspace, meshdrlen);
1758 		if (m == NULL) {
1759 			/* XXX mask bit to check for both */
1760 			/* don't count Null data frames as errors */
1761 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
1762 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
1763 				goto out;
1764 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1765 			    ni->ni_macaddr, "data", "%s", "decap error");
1766 			vap->iv_stats.is_rx_decap++;
1767 			IEEE80211_NODE_STAT(ni, rx_decap);
1768 			goto err;
1769 		}
1770 		if (qos[0] & IEEE80211_QOS_AMSDU) {
1771 			m = ieee80211_decap_amsdu(ni, m);
1772 			if (m == NULL)
1773 				return IEEE80211_FC0_TYPE_DATA;
1774 		}
1775 		ieee80211_deliver_data(vap, ni, m);
1776 		return type;
1777 	case IEEE80211_FC0_TYPE_MGT:
1778 		vap->iv_stats.is_rx_mgmt++;
1779 		IEEE80211_NODE_STAT(ni, rx_mgmt);
1780 		if (dir != IEEE80211_FC1_DIR_NODS) {
1781 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1782 			    wh, "mgt", "incorrect dir 0x%x", dir);
1783 			vap->iv_stats.is_rx_wrongdir++;
1784 			goto err;
1785 		}
1786 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
1787 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1788 			    ni->ni_macaddr, "mgt", "too short: len %u",
1789 			    m->m_pkthdr.len);
1790 			vap->iv_stats.is_rx_tooshort++;
1791 			goto out;
1792 		}
1793 #ifdef IEEE80211_DEBUG
1794 		if ((ieee80211_msg_debug(vap) &&
1795 		    (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
1796 		    ieee80211_msg_dumppkts(vap)) {
1797 			if_printf(ifp, "received %s from %s rssi %d\n",
1798 			    ieee80211_mgt_subtype_name(subtype),
1799 			    ether_sprintf(wh->i_addr2), rssi);
1800 		}
1801 #endif
1802 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1803 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1804 			    wh, NULL, "%s", "WEP set but not permitted");
1805 			vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
1806 			goto out;
1807 		}
1808 		vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
1809 		goto out;
1810 	case IEEE80211_FC0_TYPE_CTL:
1811 		vap->iv_stats.is_rx_ctl++;
1812 		IEEE80211_NODE_STAT(ni, rx_ctrl);
1813 		goto out;
1814 	default:
1815 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1816 		    wh, "bad", "frame type 0x%x", type);
1817 		/* should not come here */
1818 		break;
1819 	}
1820 err:
1821 	if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1822 out:
1823 	if (m != NULL) {
1824 		if (need_tap && ieee80211_radiotap_active_vap(vap))
1825 			ieee80211_radiotap_rx(vap, m);
1826 		m_freem(m);
1827 	}
1828 	return type;
1829 #undef	HAS_SEQ
1830 #undef	MC01
1831 }
1832 
1833 static void
1834 mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1835     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1836 {
1837 	struct ieee80211vap *vap = ni->ni_vap;
1838 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1839 	struct ieee80211com *ic = ni->ni_ic;
1840 	struct ieee80211_channel *rxchan = ic->ic_curchan;
1841 	struct ieee80211_frame *wh;
1842 	struct ieee80211_mesh_route *rt;
1843 	uint8_t *frm, *efrm;
1844 
1845 	wh = mtod(m0, struct ieee80211_frame *);
1846 	frm = (uint8_t *)&wh[1];
1847 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1848 	switch (subtype) {
1849 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1850 	case IEEE80211_FC0_SUBTYPE_BEACON:
1851 	{
1852 		struct ieee80211_scanparams scan;
1853 		struct ieee80211_channel *c;
1854 		/*
1855 		 * We process beacon/probe response
1856 		 * frames to discover neighbors.
1857 		 */
1858 		if (rxs != NULL) {
1859 			c = ieee80211_lookup_channel_rxstatus(vap, rxs);
1860 			if (c != NULL)
1861 				rxchan = c;
1862 		}
1863 		if (ieee80211_parse_beacon(ni, m0, rxchan, &scan) != 0)
1864 			return;
1865 		/*
1866 		 * Count frame now that we know it's to be processed.
1867 		 */
1868 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1869 			vap->iv_stats.is_rx_beacon++;	/* XXX remove */
1870 			IEEE80211_NODE_STAT(ni, rx_beacons);
1871 		} else
1872 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1873 		/*
1874 		 * If scanning, just pass information to the scan module.
1875 		 */
1876 		if (ic->ic_flags & IEEE80211_F_SCAN) {
1877 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1878 				/*
1879 				 * Actively scanning a channel marked passive;
1880 				 * send a probe request now that we know there
1881 				 * is 802.11 traffic present.
1882 				 *
1883 				 * XXX check if the beacon we recv'd gives
1884 				 * us what we need and suppress the probe req
1885 				 */
1886 				ieee80211_probe_curchan(vap, 1);
1887 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1888 			}
1889 			ieee80211_add_scan(vap, rxchan, &scan, wh,
1890 			    subtype, rssi, nf);
1891 			return;
1892 		}
1893 
1894 		/* The rest of this code assumes we are running */
1895 		if (vap->iv_state != IEEE80211_S_RUN)
1896 			return;
1897 		/*
1898 		 * Ignore non-mesh STAs.
1899 		 */
1900 		if ((scan.capinfo &
1901 		     (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
1902 		    scan.meshid == NULL || scan.meshconf == NULL) {
1903 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1904 			    wh, "beacon", "%s", "not a mesh sta");
1905 			vap->iv_stats.is_mesh_wrongmesh++;
1906 			return;
1907 		}
1908 		/*
1909 		 * Ignore STAs for other mesh networks.
1910 		 */
1911 		if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
1912 		    mesh_verify_meshconf(vap, scan.meshconf)) {
1913 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1914 			    wh, "beacon", "%s", "not for our mesh");
1915 			vap->iv_stats.is_mesh_wrongmesh++;
1916 			return;
1917 		}
1918 		/*
1919 		 * Peer only based on the current ACL policy.
1920 		 */
1921 		if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1922 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1923 			    wh, NULL, "%s", "disallowed by ACL");
1924 			vap->iv_stats.is_rx_acl++;
1925 			return;
1926 		}
1927 		/*
1928 		 * Do neighbor discovery.
1929 		 */
1930 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
1931 			/*
1932 			 * Create a new entry in the neighbor table.
1933 			 */
1934 			ni = ieee80211_add_neighbor(vap, wh, &scan);
1935 		}
1936 		/*
1937 		 * Automatically peer with discovered nodes if possible.
1938 		 */
1939 		if (ni != vap->iv_bss &&
1940 		    (ms->ms_flags & IEEE80211_MESHFLAGS_AP)) {
1941 			switch (ni->ni_mlstate) {
1942 			case IEEE80211_NODE_MESH_IDLE:
1943 			{
1944 				uint16_t args[1];
1945 
1946 				/* Wait for backoff callout to reset counter */
1947 				if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
1948 					return;
1949 
1950 				ni->ni_mlpid = mesh_generateid(vap);
1951 				if (ni->ni_mlpid == 0)
1952 					return;
1953 				mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
1954 				args[0] = ni->ni_mlpid;
1955 				ieee80211_send_action(ni,
1956 				IEEE80211_ACTION_CAT_SELF_PROT,
1957 				IEEE80211_ACTION_MESHPEERING_OPEN, args);
1958 				ni->ni_mlrcnt = 0;
1959 				mesh_peer_timeout_setup(ni);
1960 				break;
1961 			}
1962 			case IEEE80211_NODE_MESH_ESTABLISHED:
1963 			{
1964 				/*
1965 				 * Valid beacon from a peer mesh STA
1966 				 * bump TA lifetime
1967 				 */
1968 				rt = ieee80211_mesh_rt_find(vap, wh->i_addr2);
1969 				if(rt != NULL) {
1970 					ieee80211_mesh_rt_update(rt,
1971 					    ticks_to_msecs(
1972 					    ms->ms_ppath->mpp_inact));
1973 				}
1974 				break;
1975 			}
1976 			default:
1977 				break; /* ignore */
1978 			}
1979 		}
1980 		break;
1981 	}
1982 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1983 	{
1984 		uint8_t *ssid, *meshid, *rates, *xrates;
1985 
1986 		if (vap->iv_state != IEEE80211_S_RUN) {
1987 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1988 			    wh, NULL, "wrong state %s",
1989 			    ieee80211_state_name[vap->iv_state]);
1990 			vap->iv_stats.is_rx_mgtdiscard++;
1991 			return;
1992 		}
1993 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
1994 			/* frame must be directed */
1995 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1996 			    wh, NULL, "%s", "not unicast");
1997 			vap->iv_stats.is_rx_mgtdiscard++;	/* XXX stat */
1998 			return;
1999 		}
2000 		/*
2001 		 * prreq frame format
2002 		 *      [tlv] ssid
2003 		 *      [tlv] supported rates
2004 		 *      [tlv] extended supported rates
2005 		 *	[tlv] mesh id
2006 		 */
2007 		ssid = meshid = rates = xrates = NULL;
2008 		while (efrm - frm > 1) {
2009 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2010 			switch (*frm) {
2011 			case IEEE80211_ELEMID_SSID:
2012 				ssid = frm;
2013 				break;
2014 			case IEEE80211_ELEMID_RATES:
2015 				rates = frm;
2016 				break;
2017 			case IEEE80211_ELEMID_XRATES:
2018 				xrates = frm;
2019 				break;
2020 			case IEEE80211_ELEMID_MESHID:
2021 				meshid = frm;
2022 				break;
2023 			}
2024 			frm += frm[1] + 2;
2025 		}
2026 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2027 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2028 		if (xrates != NULL)
2029 			IEEE80211_VERIFY_ELEMENT(xrates,
2030 			    IEEE80211_RATE_MAXSIZE - rates[1], return);
2031 		if (meshid != NULL) {
2032 			IEEE80211_VERIFY_ELEMENT(meshid,
2033 			    IEEE80211_MESHID_LEN, return);
2034 			/* NB: meshid, not ssid */
2035 			IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
2036 		}
2037 
2038 		/* XXX find a better class or define it's own */
2039 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
2040 		    "%s", "recv probe req");
2041 		/*
2042 		 * Some legacy 11b clients cannot hack a complete
2043 		 * probe response frame.  When the request includes
2044 		 * only a bare-bones rate set, communicate this to
2045 		 * the transmit side.
2046 		 */
2047 		ieee80211_send_proberesp(vap, wh->i_addr2, 0);
2048 		break;
2049 	}
2050 
2051 	case IEEE80211_FC0_SUBTYPE_ACTION:
2052 	case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2053 		if (ni == vap->iv_bss) {
2054 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2055 			    wh, NULL, "%s", "unknown node");
2056 			vap->iv_stats.is_rx_mgtdiscard++;
2057 		} else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2058 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2059 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2060 			    wh, NULL, "%s", "not for us");
2061 			vap->iv_stats.is_rx_mgtdiscard++;
2062 		} else if (vap->iv_state != IEEE80211_S_RUN) {
2063 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2064 			    wh, NULL, "wrong state %s",
2065 			    ieee80211_state_name[vap->iv_state]);
2066 			vap->iv_stats.is_rx_mgtdiscard++;
2067 		} else {
2068 			if (ieee80211_parse_action(ni, m0) == 0)
2069 				(void)ic->ic_recv_action(ni, wh, frm, efrm);
2070 		}
2071 		break;
2072 
2073 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2074 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2075 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2076 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2077 	case IEEE80211_FC0_SUBTYPE_TIMING_ADV:
2078 	case IEEE80211_FC0_SUBTYPE_ATIM:
2079 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
2080 	case IEEE80211_FC0_SUBTYPE_AUTH:
2081 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
2082 		IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2083 		    wh, NULL, "%s", "not handled");
2084 		vap->iv_stats.is_rx_mgtdiscard++;
2085 		break;
2086 
2087 	default:
2088 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2089 		    wh, "mgt", "subtype 0x%x not handled", subtype);
2090 		vap->iv_stats.is_rx_badsubtype++;
2091 		break;
2092 	}
2093 }
2094 
2095 static void
2096 mesh_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2097 {
2098 
2099 	switch (subtype) {
2100 	case IEEE80211_FC0_SUBTYPE_BAR:
2101 		ieee80211_recv_bar(ni, m);
2102 		break;
2103 	}
2104 }
2105 
2106 /*
2107  * Parse meshpeering action ie's for MPM frames
2108  */
2109 static const struct ieee80211_meshpeer_ie *
2110 mesh_parse_meshpeering_action(struct ieee80211_node *ni,
2111 	const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2112 	const uint8_t *frm, const uint8_t *efrm,
2113 	struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
2114 {
2115 	struct ieee80211vap *vap = ni->ni_vap;
2116 	const struct ieee80211_meshpeer_ie *mpie;
2117 	uint16_t args[3];
2118 	const uint8_t *meshid, *meshconf;
2119 	uint8_t sendclose = 0; /* 1 = MPM frame rejected, close will be sent */
2120 
2121 	meshid = meshconf = NULL;
2122 	while (efrm - frm > 1) {
2123 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
2124 		switch (*frm) {
2125 		case IEEE80211_ELEMID_MESHID:
2126 			meshid = frm;
2127 			break;
2128 		case IEEE80211_ELEMID_MESHCONF:
2129 			meshconf = frm;
2130 			break;
2131 		case IEEE80211_ELEMID_MESHPEER:
2132 			mpie = (const struct ieee80211_meshpeer_ie *) frm;
2133 			memset(mp, 0, sizeof(*mp));
2134 			mp->peer_len = mpie->peer_len;
2135 			mp->peer_proto = le16dec(&mpie->peer_proto);
2136 			mp->peer_llinkid = le16dec(&mpie->peer_llinkid);
2137 			switch (subtype) {
2138 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2139 				mp->peer_linkid =
2140 				    le16dec(&mpie->peer_linkid);
2141 				break;
2142 			case IEEE80211_ACTION_MESHPEERING_CLOSE:
2143 				/* NB: peer link ID is optional */
2144 				if (mpie->peer_len ==
2145 				    (IEEE80211_MPM_BASE_SZ + 2)) {
2146 					mp->peer_linkid = 0;
2147 					mp->peer_rcode =
2148 					    le16dec(&mpie->peer_linkid);
2149 				} else {
2150 					mp->peer_linkid =
2151 					    le16dec(&mpie->peer_linkid);
2152 					mp->peer_rcode =
2153 					    le16dec(&mpie->peer_rcode);
2154 				}
2155 				break;
2156 			}
2157 			break;
2158 		}
2159 		frm += frm[1] + 2;
2160 	}
2161 
2162 	/*
2163 	 * Verify the contents of the frame.
2164 	 * If it fails validation, close the peer link.
2165 	 */
2166 	if (mesh_verify_meshpeer(vap, subtype, (const uint8_t *)mp)) {
2167 		sendclose = 1;
2168 		IEEE80211_DISCARD(vap,
2169 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2170 		    wh, NULL, "%s", "MPM validation failed");
2171 	}
2172 
2173 	/* If meshid is not the same reject any frames type. */
2174 	if (sendclose == 0 && mesh_verify_meshid(vap, meshid)) {
2175 		sendclose = 1;
2176 		IEEE80211_DISCARD(vap,
2177 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2178 		    wh, NULL, "%s", "not for our mesh");
2179 		if (subtype == IEEE80211_ACTION_MESHPEERING_CLOSE) {
2180 			/*
2181 			 * Standard not clear about this, if we dont ignore
2182 			 * there will be an endless loop between nodes sending
2183 			 * CLOSE frames between each other with wrong meshid.
2184 			 * Discard and timers will bring FSM to IDLE state.
2185 			 */
2186 			return NULL;
2187 		}
2188 	}
2189 
2190 	/*
2191 	 * Close frames are accepted if meshid is the same.
2192 	 * Verify the other two types.
2193 	 */
2194 	if (sendclose == 0 && subtype != IEEE80211_ACTION_MESHPEERING_CLOSE &&
2195 	    mesh_verify_meshconf(vap, meshconf)) {
2196 		sendclose = 1;
2197 		IEEE80211_DISCARD(vap,
2198 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2199 		    wh, NULL, "%s", "configuration missmatch");
2200 	}
2201 
2202 	if (sendclose) {
2203 		vap->iv_stats.is_rx_mgtdiscard++;
2204 		switch (ni->ni_mlstate) {
2205 		case IEEE80211_NODE_MESH_IDLE:
2206 		case IEEE80211_NODE_MESH_ESTABLISHED:
2207 		case IEEE80211_NODE_MESH_HOLDING:
2208 			/* ignore */
2209 			break;
2210 		case IEEE80211_NODE_MESH_OPENSNT:
2211 		case IEEE80211_NODE_MESH_OPENRCV:
2212 		case IEEE80211_NODE_MESH_CONFIRMRCV:
2213 			args[0] = ni->ni_mlpid;
2214 			args[1] = ni->ni_mllid;
2215 			/* Reason codes for rejection */
2216 			switch (subtype) {
2217 			case IEEE80211_ACTION_MESHPEERING_OPEN:
2218 				args[2] = IEEE80211_REASON_MESH_CPVIOLATION;
2219 				break;
2220 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2221 				args[2] = IEEE80211_REASON_MESH_INCONS_PARAMS;
2222 				break;
2223 			}
2224 			ieee80211_send_action(ni,
2225 			    IEEE80211_ACTION_CAT_SELF_PROT,
2226 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2227 			    args);
2228 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2229 			mesh_peer_timeout_setup(ni);
2230 			break;
2231 		}
2232 		return NULL;
2233 	}
2234 
2235 	return (const struct ieee80211_meshpeer_ie *) mp;
2236 }
2237 
2238 static int
2239 mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
2240 	const struct ieee80211_frame *wh,
2241 	const uint8_t *frm, const uint8_t *efrm)
2242 {
2243 	struct ieee80211vap *vap = ni->ni_vap;
2244 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2245 	struct ieee80211_meshpeer_ie ie;
2246 	const struct ieee80211_meshpeer_ie *meshpeer;
2247 	uint16_t args[3];
2248 
2249 	/* +2+2 for action + code + capabilites */
2250 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
2251 	    IEEE80211_ACTION_MESHPEERING_OPEN);
2252 	if (meshpeer == NULL) {
2253 		return 0;
2254 	}
2255 
2256 	/* XXX move up */
2257 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2258 	    "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
2259 
2260 	switch (ni->ni_mlstate) {
2261 	case IEEE80211_NODE_MESH_IDLE:
2262 		/* Reject open request if reached our maximum neighbor count */
2263 		if (ms->ms_neighbors >= IEEE80211_MESH_MAX_NEIGHBORS) {
2264 			args[0] = meshpeer->peer_llinkid;
2265 			args[1] = 0;
2266 			args[2] = IEEE80211_REASON_MESH_MAX_PEERS;
2267 			ieee80211_send_action(ni,
2268 			    IEEE80211_ACTION_CAT_SELF_PROT,
2269 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2270 			    args);
2271 			/* stay in IDLE state */
2272 			return (0);
2273 		}
2274 		/* Open frame accepted */
2275 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2276 		ni->ni_mllid = meshpeer->peer_llinkid;
2277 		ni->ni_mlpid = mesh_generateid(vap);
2278 		if (ni->ni_mlpid == 0)
2279 			return 0;		/* XXX */
2280 		args[0] = ni->ni_mlpid;
2281 		/* Announce we're open too... */
2282 		ieee80211_send_action(ni,
2283 		    IEEE80211_ACTION_CAT_SELF_PROT,
2284 		    IEEE80211_ACTION_MESHPEERING_OPEN, args);
2285 		/* ...and confirm the link. */
2286 		args[0] = ni->ni_mlpid;
2287 		args[1] = ni->ni_mllid;
2288 		ieee80211_send_action(ni,
2289 		    IEEE80211_ACTION_CAT_SELF_PROT,
2290 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2291 		    args);
2292 		mesh_peer_timeout_setup(ni);
2293 		break;
2294 	case IEEE80211_NODE_MESH_OPENRCV:
2295 		/* Wrong Link ID */
2296 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2297 			args[0] = ni->ni_mllid;
2298 			args[1] = ni->ni_mlpid;
2299 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2300 			ieee80211_send_action(ni,
2301 			    IEEE80211_ACTION_CAT_SELF_PROT,
2302 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2303 			    args);
2304 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2305 			mesh_peer_timeout_setup(ni);
2306 			break;
2307 		}
2308 		/* Duplicate open, confirm again. */
2309 		args[0] = ni->ni_mlpid;
2310 		args[1] = ni->ni_mllid;
2311 		ieee80211_send_action(ni,
2312 		    IEEE80211_ACTION_CAT_SELF_PROT,
2313 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2314 		    args);
2315 		break;
2316 	case IEEE80211_NODE_MESH_OPENSNT:
2317 		ni->ni_mllid = meshpeer->peer_llinkid;
2318 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2319 		args[0] = ni->ni_mlpid;
2320 		args[1] = ni->ni_mllid;
2321 		ieee80211_send_action(ni,
2322 		    IEEE80211_ACTION_CAT_SELF_PROT,
2323 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2324 		    args);
2325 		/* NB: don't setup/clear any timeout */
2326 		break;
2327 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2328 		if (ni->ni_mlpid != meshpeer->peer_linkid ||
2329 		    ni->ni_mllid != meshpeer->peer_llinkid) {
2330 			args[0] = ni->ni_mlpid;
2331 			args[1] = ni->ni_mllid;
2332 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2333 			ieee80211_send_action(ni,
2334 			    IEEE80211_ACTION_CAT_SELF_PROT,
2335 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2336 			    args);
2337 			mesh_linkchange(ni,
2338 			    IEEE80211_NODE_MESH_HOLDING);
2339 			mesh_peer_timeout_setup(ni);
2340 			break;
2341 		}
2342 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2343 		ni->ni_mllid = meshpeer->peer_llinkid;
2344 		args[0] = ni->ni_mlpid;
2345 		args[1] = ni->ni_mllid;
2346 		ieee80211_send_action(ni,
2347 		    IEEE80211_ACTION_CAT_SELF_PROT,
2348 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2349 		    args);
2350 		mesh_peer_timeout_stop(ni);
2351 		break;
2352 	case IEEE80211_NODE_MESH_ESTABLISHED:
2353 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2354 			args[0] = ni->ni_mllid;
2355 			args[1] = ni->ni_mlpid;
2356 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2357 			ieee80211_send_action(ni,
2358 			    IEEE80211_ACTION_CAT_SELF_PROT,
2359 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2360 			    args);
2361 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2362 			mesh_peer_timeout_setup(ni);
2363 			break;
2364 		}
2365 		args[0] = ni->ni_mlpid;
2366 		args[1] = ni->ni_mllid;
2367 		ieee80211_send_action(ni,
2368 		    IEEE80211_ACTION_CAT_SELF_PROT,
2369 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2370 		    args);
2371 		break;
2372 	case IEEE80211_NODE_MESH_HOLDING:
2373 		args[0] = ni->ni_mlpid;
2374 		args[1] = meshpeer->peer_llinkid;
2375 		/* Standard not clear about what the reaason code should be */
2376 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2377 		ieee80211_send_action(ni,
2378 		    IEEE80211_ACTION_CAT_SELF_PROT,
2379 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2380 		    args);
2381 		break;
2382 	}
2383 	return 0;
2384 }
2385 
2386 static int
2387 mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
2388 	const struct ieee80211_frame *wh,
2389 	const uint8_t *frm, const uint8_t *efrm)
2390 {
2391 	struct ieee80211vap *vap = ni->ni_vap;
2392 	struct ieee80211_meshpeer_ie ie;
2393 	const struct ieee80211_meshpeer_ie *meshpeer;
2394 	uint16_t args[3];
2395 
2396 	/* +2+2+2+2 for action + code + capabilites + status code + AID */
2397 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
2398 	    IEEE80211_ACTION_MESHPEERING_CONFIRM);
2399 	if (meshpeer == NULL) {
2400 		return 0;
2401 	}
2402 
2403 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2404 	    "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
2405 	    meshpeer->peer_llinkid, meshpeer->peer_linkid);
2406 
2407 	switch (ni->ni_mlstate) {
2408 	case IEEE80211_NODE_MESH_OPENRCV:
2409 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2410 		mesh_peer_timeout_stop(ni);
2411 		break;
2412 	case IEEE80211_NODE_MESH_OPENSNT:
2413 		mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
2414 		mesh_peer_timeout_setup(ni);
2415 		break;
2416 	case IEEE80211_NODE_MESH_HOLDING:
2417 		args[0] = ni->ni_mlpid;
2418 		args[1] = meshpeer->peer_llinkid;
2419 		/* Standard not clear about what the reaason code should be */
2420 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2421 		ieee80211_send_action(ni,
2422 		    IEEE80211_ACTION_CAT_SELF_PROT,
2423 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2424 		    args);
2425 		break;
2426 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2427 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2428 			args[0] = ni->ni_mlpid;
2429 			args[1] = ni->ni_mllid;
2430 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2431 			ieee80211_send_action(ni,
2432 			    IEEE80211_ACTION_CAT_SELF_PROT,
2433 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2434 			    args);
2435 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2436 			mesh_peer_timeout_setup(ni);
2437 		}
2438 		break;
2439 	default:
2440 		IEEE80211_DISCARD(vap,
2441 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2442 		    wh, NULL, "received confirm in invalid state %d",
2443 		    ni->ni_mlstate);
2444 		vap->iv_stats.is_rx_mgtdiscard++;
2445 		break;
2446 	}
2447 	return 0;
2448 }
2449 
2450 static int
2451 mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
2452 	const struct ieee80211_frame *wh,
2453 	const uint8_t *frm, const uint8_t *efrm)
2454 {
2455 	struct ieee80211_meshpeer_ie ie;
2456 	const struct ieee80211_meshpeer_ie *meshpeer;
2457 	uint16_t args[3];
2458 
2459 	/* +2 for action + code */
2460 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2, efrm, &ie,
2461 	    IEEE80211_ACTION_MESHPEERING_CLOSE);
2462 	if (meshpeer == NULL) {
2463 		return 0;
2464 	}
2465 
2466 	/*
2467 	 * XXX: check reason code, for example we could receive
2468 	 * IEEE80211_REASON_MESH_MAX_PEERS then we should not attempt
2469 	 * to peer again.
2470 	 */
2471 
2472 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2473 	    ni, "%s", "recv PEER CLOSE");
2474 
2475 	switch (ni->ni_mlstate) {
2476 	case IEEE80211_NODE_MESH_IDLE:
2477 		/* ignore */
2478 		break;
2479 	case IEEE80211_NODE_MESH_OPENRCV:
2480 	case IEEE80211_NODE_MESH_OPENSNT:
2481 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2482 	case IEEE80211_NODE_MESH_ESTABLISHED:
2483 		args[0] = ni->ni_mlpid;
2484 		args[1] = ni->ni_mllid;
2485 		args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
2486 		ieee80211_send_action(ni,
2487 		    IEEE80211_ACTION_CAT_SELF_PROT,
2488 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2489 		    args);
2490 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2491 		mesh_peer_timeout_setup(ni);
2492 		break;
2493 	case IEEE80211_NODE_MESH_HOLDING:
2494 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
2495 		mesh_peer_timeout_stop(ni);
2496 		break;
2497 	}
2498 	return 0;
2499 }
2500 
2501 /*
2502  * Link Metric handling.
2503  */
2504 static int
2505 mesh_recv_action_meshlmetric(struct ieee80211_node *ni,
2506 	const struct ieee80211_frame *wh,
2507 	const uint8_t *frm, const uint8_t *efrm)
2508 {
2509 	const struct ieee80211_meshlmetric_ie *ie =
2510 	    (const struct ieee80211_meshlmetric_ie *)
2511 	    (frm+2); /* action + code */
2512 	struct ieee80211_meshlmetric_ie lm_rep;
2513 
2514 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2515 		lm_rep.lm_flags = 0;
2516 		lm_rep.lm_metric = mesh_airtime_calc(ni);
2517 		ieee80211_send_action(ni,
2518 		    IEEE80211_ACTION_CAT_MESH,
2519 		    IEEE80211_ACTION_MESH_LMETRIC,
2520 		    &lm_rep);
2521 	}
2522 	/* XXX: else do nothing for now */
2523 	return 0;
2524 }
2525 
2526 /*
2527  * Parse meshgate action ie's for GANN frames.
2528  * Returns -1 if parsing fails, otherwise 0.
2529  */
2530 static int
2531 mesh_parse_meshgate_action(struct ieee80211_node *ni,
2532     const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2533     struct ieee80211_meshgann_ie *ie, const uint8_t *frm, const uint8_t *efrm)
2534 {
2535 	struct ieee80211vap *vap = ni->ni_vap;
2536 	const struct ieee80211_meshgann_ie *gannie;
2537 
2538 	while (efrm - frm > 1) {
2539 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return -1);
2540 		switch (*frm) {
2541 		case IEEE80211_ELEMID_MESHGANN:
2542 			gannie = (const struct ieee80211_meshgann_ie *) frm;
2543 			memset(ie, 0, sizeof(*ie));
2544 			ie->gann_ie = gannie->gann_ie;
2545 			ie->gann_len = gannie->gann_len;
2546 			ie->gann_flags = gannie->gann_flags;
2547 			ie->gann_hopcount = gannie->gann_hopcount;
2548 			ie->gann_ttl = gannie->gann_ttl;
2549 			IEEE80211_ADDR_COPY(ie->gann_addr, gannie->gann_addr);
2550 			ie->gann_seq = le32dec(&gannie->gann_seq);
2551 			ie->gann_interval = le16dec(&gannie->gann_interval);
2552 			break;
2553 		}
2554 		frm += frm[1] + 2;
2555 	}
2556 
2557 	return 0;
2558 }
2559 
2560 /*
2561  * Mesh Gate Announcement handling.
2562  */
2563 static int
2564 mesh_recv_action_meshgate(struct ieee80211_node *ni,
2565 	const struct ieee80211_frame *wh,
2566 	const uint8_t *frm, const uint8_t *efrm)
2567 {
2568 	struct ieee80211vap *vap = ni->ni_vap;
2569 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2570 	struct ieee80211_mesh_gate_route *gr, *next;
2571 	struct ieee80211_mesh_route *rt_gate;
2572 	struct ieee80211_meshgann_ie pgann;
2573 	struct ieee80211_meshgann_ie ie;
2574 	int found = 0;
2575 
2576 	/* +2 for action + code */
2577 	if (mesh_parse_meshgate_action(ni, wh, &ie, frm+2, efrm) != 0) {
2578 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2579 		    ni->ni_macaddr, NULL, "%s",
2580 		    "GANN parsing failed");
2581 		vap->iv_stats.is_rx_mgtdiscard++;
2582 		return (0);
2583 	}
2584 
2585 	if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ie.gann_addr))
2586 		return 0;
2587 
2588 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ni->ni_macaddr,
2589 	    "received GANN, meshgate: %6D (seq %u)", ie.gann_addr, ":",
2590 	    ie.gann_seq);
2591 
2592 	if (ms == NULL)
2593 		return (0);
2594 	MESH_RT_LOCK(ms);
2595 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
2596 		if (!IEEE80211_ADDR_EQ(gr->gr_addr, ie.gann_addr))
2597 			continue;
2598 		if (ie.gann_seq <= gr->gr_lastseq) {
2599 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2600 			    ni->ni_macaddr, NULL,
2601 			    "GANN old seqno %u <= %u",
2602 			    ie.gann_seq, gr->gr_lastseq);
2603 			MESH_RT_UNLOCK(ms);
2604 			return (0);
2605 		}
2606 		/* corresponding mesh gate found & GANN accepted */
2607 		found = 1;
2608 		break;
2609 
2610 	}
2611 	if (found == 0) {
2612 		/* this GANN is from a new mesh Gate add it to known table. */
2613 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2614 		    "stored new GANN information, seq %u.", ie.gann_seq);
2615 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
2616 		    M_80211_MESH_GT_RT,
2617 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
2618 		IEEE80211_ADDR_COPY(gr->gr_addr, ie.gann_addr);
2619 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
2620 	}
2621 	gr->gr_lastseq = ie.gann_seq;
2622 
2623 	/* check if we have a path to this gate */
2624 	rt_gate = mesh_rt_find_locked(ms, gr->gr_addr);
2625 	if (rt_gate != NULL &&
2626 	    rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) {
2627 		gr->gr_route = rt_gate;
2628 		rt_gate->rt_flags |= IEEE80211_MESHRT_FLAGS_GATE;
2629 	}
2630 
2631 	MESH_RT_UNLOCK(ms);
2632 
2633 	/* popagate only if decremented ttl >= 1 && forwarding is enabled */
2634 	if ((ie.gann_ttl - 1) < 1 && !(ms->ms_flags & IEEE80211_MESHFLAGS_FWD))
2635 		return 0;
2636 	pgann.gann_flags = ie.gann_flags; /* Reserved */
2637 	pgann.gann_hopcount = ie.gann_hopcount + 1;
2638 	pgann.gann_ttl = ie.gann_ttl - 1;
2639 	IEEE80211_ADDR_COPY(pgann.gann_addr, ie.gann_addr);
2640 	pgann.gann_seq = ie.gann_seq;
2641 	pgann.gann_interval = ie.gann_interval;
2642 
2643 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2644 	    "%s", "propagate GANN");
2645 
2646 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
2647 	    IEEE80211_ACTION_MESH_GANN, &pgann);
2648 
2649 	return 0;
2650 }
2651 
2652 static int
2653 mesh_send_action(struct ieee80211_node *ni,
2654     const uint8_t sa[IEEE80211_ADDR_LEN],
2655     const uint8_t da[IEEE80211_ADDR_LEN],
2656     struct mbuf *m)
2657 {
2658 	struct ieee80211vap *vap = ni->ni_vap;
2659 	struct ieee80211com *ic = ni->ni_ic;
2660 	struct ieee80211_bpf_params params;
2661 	int ret;
2662 
2663 	KASSERT(ni != NULL, ("null node"));
2664 
2665 	if (vap->iv_state == IEEE80211_S_CAC) {
2666 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
2667 		    "block %s frame in CAC state", "Mesh action");
2668 		vap->iv_stats.is_tx_badstate++;
2669 		ieee80211_free_node(ni);
2670 		m_freem(m);
2671 		return EIO;		/* XXX */
2672 	}
2673 
2674 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_NOWAIT);
2675 	if (m == NULL) {
2676 		ieee80211_free_node(ni);
2677 		return ENOMEM;
2678 	}
2679 
2680 	IEEE80211_TX_LOCK(ic);
2681 	ieee80211_send_setup(ni, m,
2682 	     IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ACTION,
2683 	     IEEE80211_NONQOS_TID, sa, da, sa);
2684 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
2685 
2686 	memset(&params, 0, sizeof(params));
2687 	params.ibp_pri = WME_AC_VO;
2688 	params.ibp_rate0 = ni->ni_txparms->mgmtrate;
2689 	if (IEEE80211_IS_MULTICAST(da))
2690 		params.ibp_try0 = 1;
2691 	else
2692 		params.ibp_try0 = ni->ni_txparms->maxretry;
2693 	params.ibp_power = ni->ni_txpower;
2694 
2695 	IEEE80211_NODE_STAT(ni, tx_mgmt);
2696 
2697 	ret = ieee80211_raw_output(vap, ni, m, &params);
2698 	IEEE80211_TX_UNLOCK(ic);
2699 	return (ret);
2700 }
2701 
2702 #define	ADDSHORT(frm, v) do {			\
2703 	frm[0] = (v) & 0xff;			\
2704 	frm[1] = (v) >> 8;			\
2705 	frm += 2;				\
2706 } while (0)
2707 #define	ADDWORD(frm, v) do {			\
2708 	frm[0] = (v) & 0xff;			\
2709 	frm[1] = ((v) >> 8) & 0xff;		\
2710 	frm[2] = ((v) >> 16) & 0xff;		\
2711 	frm[3] = ((v) >> 24) & 0xff;		\
2712 	frm += 4;				\
2713 } while (0)
2714 
2715 static int
2716 mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
2717 	int category, int action, void *args0)
2718 {
2719 	struct ieee80211vap *vap = ni->ni_vap;
2720 	struct ieee80211com *ic = ni->ni_ic;
2721 	uint16_t *args = args0;
2722 	const struct ieee80211_rateset *rs;
2723 	struct mbuf *m;
2724 	uint8_t *frm;
2725 
2726 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2727 	    "send PEER OPEN action: localid 0x%x", args[0]);
2728 
2729 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2730 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2731 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2732 	ieee80211_ref_node(ni);
2733 
2734 	m = ieee80211_getmgtframe(&frm,
2735 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2736 	    sizeof(uint16_t)	/* action+category */
2737 	    + sizeof(uint16_t)	/* capabilites */
2738 	    + 2 + IEEE80211_RATE_SIZE
2739 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2740 	    + 2 + IEEE80211_MESHID_LEN
2741 	    + sizeof(struct ieee80211_meshconf_ie)
2742 	    + sizeof(struct ieee80211_meshpeer_ie)
2743 	);
2744 	if (m != NULL) {
2745 		/*
2746 		 * mesh peer open action frame format:
2747 		 *   [1] category
2748 		 *   [1] action
2749 		 *   [2] capabilities
2750 		 *   [tlv] rates
2751 		 *   [tlv] xrates
2752 		 *   [tlv] mesh id
2753 		 *   [tlv] mesh conf
2754 		 *   [tlv] mesh peer link mgmt
2755 		 */
2756 		*frm++ = category;
2757 		*frm++ = action;
2758 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2759 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2760 		frm = ieee80211_add_rates(frm, rs);
2761 		frm = ieee80211_add_xrates(frm, rs);
2762 		frm = ieee80211_add_meshid(frm, vap);
2763 		frm = ieee80211_add_meshconf(frm, vap);
2764 		frm = ieee80211_add_meshpeer(frm, IEEE80211_ACTION_MESHPEERING_OPEN,
2765 		    args[0], 0, 0);
2766 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2767 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2768 	} else {
2769 		vap->iv_stats.is_tx_nobuf++;
2770 		ieee80211_free_node(ni);
2771 		return ENOMEM;
2772 	}
2773 }
2774 
2775 static int
2776 mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
2777 	int category, int action, void *args0)
2778 {
2779 	struct ieee80211vap *vap = ni->ni_vap;
2780 	struct ieee80211com *ic = ni->ni_ic;
2781 	uint16_t *args = args0;
2782 	const struct ieee80211_rateset *rs;
2783 	struct mbuf *m;
2784 	uint8_t *frm;
2785 
2786 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2787 	    "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
2788 	    args[0], args[1]);
2789 
2790 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2791 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2792 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2793 	ieee80211_ref_node(ni);
2794 
2795 	m = ieee80211_getmgtframe(&frm,
2796 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2797 	    sizeof(uint16_t)	/* action+category */
2798 	    + sizeof(uint16_t)	/* capabilites */
2799 	    + sizeof(uint16_t)	/* status code */
2800 	    + sizeof(uint16_t)	/* AID */
2801 	    + 2 + IEEE80211_RATE_SIZE
2802 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2803 	    + 2 + IEEE80211_MESHID_LEN
2804 	    + sizeof(struct ieee80211_meshconf_ie)
2805 	    + sizeof(struct ieee80211_meshpeer_ie)
2806 	);
2807 	if (m != NULL) {
2808 		/*
2809 		 * mesh peer confirm action frame format:
2810 		 *   [1] category
2811 		 *   [1] action
2812 		 *   [2] capabilities
2813 		 *   [2] status code
2814 		 *   [2] association id (peer ID)
2815 		 *   [tlv] rates
2816 		 *   [tlv] xrates
2817 		 *   [tlv] mesh id
2818 		 *   [tlv] mesh conf
2819 		 *   [tlv] mesh peer link mgmt
2820 		 */
2821 		*frm++ = category;
2822 		*frm++ = action;
2823 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2824 		ADDSHORT(frm, 0);		/* status code */
2825 		ADDSHORT(frm, args[1]);		/* AID */
2826 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2827 		frm = ieee80211_add_rates(frm, rs);
2828 		frm = ieee80211_add_xrates(frm, rs);
2829 		frm = ieee80211_add_meshid(frm, vap);
2830 		frm = ieee80211_add_meshconf(frm, vap);
2831 		frm = ieee80211_add_meshpeer(frm,
2832 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2833 		    args[0], args[1], 0);
2834 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2835 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2836 	} else {
2837 		vap->iv_stats.is_tx_nobuf++;
2838 		ieee80211_free_node(ni);
2839 		return ENOMEM;
2840 	}
2841 }
2842 
2843 static int
2844 mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
2845 	int category, int action, void *args0)
2846 {
2847 	struct ieee80211vap *vap = ni->ni_vap;
2848 	struct ieee80211com *ic = ni->ni_ic;
2849 	uint16_t *args = args0;
2850 	struct mbuf *m;
2851 	uint8_t *frm;
2852 
2853 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2854 	    "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d (%s)",
2855 	    args[0], args[1], args[2], ieee80211_reason_to_string(args[2]));
2856 
2857 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2858 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2859 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2860 	ieee80211_ref_node(ni);
2861 
2862 	m = ieee80211_getmgtframe(&frm,
2863 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2864 	    sizeof(uint16_t)	/* action+category */
2865 	    + sizeof(uint16_t)	/* reason code */
2866 	    + 2 + IEEE80211_MESHID_LEN
2867 	    + sizeof(struct ieee80211_meshpeer_ie)
2868 	);
2869 	if (m != NULL) {
2870 		/*
2871 		 * mesh peer close action frame format:
2872 		 *   [1] category
2873 		 *   [1] action
2874 		 *   [tlv] mesh id
2875 		 *   [tlv] mesh peer link mgmt
2876 		 */
2877 		*frm++ = category;
2878 		*frm++ = action;
2879 		frm = ieee80211_add_meshid(frm, vap);
2880 		frm = ieee80211_add_meshpeer(frm,
2881 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2882 		    args[0], args[1], args[2]);
2883 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2884 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2885 	} else {
2886 		vap->iv_stats.is_tx_nobuf++;
2887 		ieee80211_free_node(ni);
2888 		return ENOMEM;
2889 	}
2890 }
2891 
2892 static int
2893 mesh_send_action_meshlmetric(struct ieee80211_node *ni,
2894 	int category, int action, void *arg0)
2895 {
2896 	struct ieee80211vap *vap = ni->ni_vap;
2897 	struct ieee80211com *ic = ni->ni_ic;
2898 	struct ieee80211_meshlmetric_ie *ie = arg0;
2899 	struct mbuf *m;
2900 	uint8_t *frm;
2901 
2902 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2903 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2904 		    ni, "%s", "send LINK METRIC REQUEST action");
2905 	} else {
2906 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2907 		    ni, "send LINK METRIC REPLY action: metric 0x%x",
2908 		    ie->lm_metric);
2909 	}
2910 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2911 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2912 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2913 	ieee80211_ref_node(ni);
2914 
2915 	m = ieee80211_getmgtframe(&frm,
2916 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2917 	    sizeof(uint16_t) +	/* action+category */
2918 	    sizeof(struct ieee80211_meshlmetric_ie)
2919 	);
2920 	if (m != NULL) {
2921 		/*
2922 		 * mesh link metric
2923 		 *   [1] category
2924 		 *   [1] action
2925 		 *   [tlv] mesh link metric
2926 		 */
2927 		*frm++ = category;
2928 		*frm++ = action;
2929 		frm = ieee80211_add_meshlmetric(frm,
2930 		    ie->lm_flags, ie->lm_metric);
2931 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2932 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2933 	} else {
2934 		vap->iv_stats.is_tx_nobuf++;
2935 		ieee80211_free_node(ni);
2936 		return ENOMEM;
2937 	}
2938 }
2939 
2940 static int
2941 mesh_send_action_meshgate(struct ieee80211_node *ni,
2942 	int category, int action, void *arg0)
2943 {
2944 	struct ieee80211vap *vap = ni->ni_vap;
2945 	struct ieee80211com *ic = ni->ni_ic;
2946 	struct ieee80211_meshgann_ie *ie = arg0;
2947 	struct mbuf *m;
2948 	uint8_t *frm;
2949 
2950 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2951 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2952 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2953 	ieee80211_ref_node(ni);
2954 
2955 	m = ieee80211_getmgtframe(&frm,
2956 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2957 	    sizeof(uint16_t) +	/* action+category */
2958 	    IEEE80211_MESHGANN_BASE_SZ
2959 	);
2960 	if (m != NULL) {
2961 		/*
2962 		 * mesh link metric
2963 		 *   [1] category
2964 		 *   [1] action
2965 		 *   [tlv] mesh gate annoucement
2966 		 */
2967 		*frm++ = category;
2968 		*frm++ = action;
2969 		frm = ieee80211_add_meshgate(frm, ie);
2970 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2971 		return mesh_send_action(ni, vap->iv_myaddr, broadcastaddr, m);
2972 	} else {
2973 		vap->iv_stats.is_tx_nobuf++;
2974 		ieee80211_free_node(ni);
2975 		return ENOMEM;
2976 	}
2977 }
2978 
2979 static void
2980 mesh_peer_timeout_setup(struct ieee80211_node *ni)
2981 {
2982 	switch (ni->ni_mlstate) {
2983 	case IEEE80211_NODE_MESH_HOLDING:
2984 		ni->ni_mltval = ieee80211_mesh_holdingtimeout;
2985 		break;
2986 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2987 		ni->ni_mltval = ieee80211_mesh_confirmtimeout;
2988 		break;
2989 	case IEEE80211_NODE_MESH_IDLE:
2990 		ni->ni_mltval = 0;
2991 		break;
2992 	default:
2993 		ni->ni_mltval = ieee80211_mesh_retrytimeout;
2994 		break;
2995 	}
2996 	if (ni->ni_mltval)
2997 		callout_reset(&ni->ni_mltimer, ni->ni_mltval,
2998 		    mesh_peer_timeout_cb, ni);
2999 }
3000 
3001 /*
3002  * Same as above but backoffs timer statisically 50%.
3003  */
3004 static void
3005 mesh_peer_timeout_backoff(struct ieee80211_node *ni)
3006 {
3007 	uint32_t r;
3008 
3009 	r = arc4random();
3010 	ni->ni_mltval += r % ni->ni_mltval;
3011 	callout_reset(&ni->ni_mltimer, ni->ni_mltval, mesh_peer_timeout_cb,
3012 	    ni);
3013 }
3014 
3015 static __inline void
3016 mesh_peer_timeout_stop(struct ieee80211_node *ni)
3017 {
3018 	callout_drain(&ni->ni_mltimer);
3019 }
3020 
3021 static void
3022 mesh_peer_backoff_cb(void *arg)
3023 {
3024 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3025 
3026 	/* After backoff timeout, try to peer automatically again. */
3027 	ni->ni_mlhcnt = 0;
3028 }
3029 
3030 /*
3031  * Mesh Peer Link Management FSM timeout handling.
3032  */
3033 static void
3034 mesh_peer_timeout_cb(void *arg)
3035 {
3036 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3037 	uint16_t args[3];
3038 
3039 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
3040 	    ni, "mesh link timeout, state %d, retry counter %d",
3041 	    ni->ni_mlstate, ni->ni_mlrcnt);
3042 
3043 	switch (ni->ni_mlstate) {
3044 	case IEEE80211_NODE_MESH_IDLE:
3045 	case IEEE80211_NODE_MESH_ESTABLISHED:
3046 		break;
3047 	case IEEE80211_NODE_MESH_OPENSNT:
3048 	case IEEE80211_NODE_MESH_OPENRCV:
3049 		if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
3050 			args[0] = ni->ni_mlpid;
3051 			args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
3052 			ieee80211_send_action(ni,
3053 			    IEEE80211_ACTION_CAT_SELF_PROT,
3054 			    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3055 			ni->ni_mlrcnt = 0;
3056 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3057 			mesh_peer_timeout_setup(ni);
3058 		} else {
3059 			args[0] = ni->ni_mlpid;
3060 			ieee80211_send_action(ni,
3061 			    IEEE80211_ACTION_CAT_SELF_PROT,
3062 			    IEEE80211_ACTION_MESHPEERING_OPEN, args);
3063 			ni->ni_mlrcnt++;
3064 			mesh_peer_timeout_backoff(ni);
3065 		}
3066 		break;
3067 	case IEEE80211_NODE_MESH_CONFIRMRCV:
3068 		args[0] = ni->ni_mlpid;
3069 		args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
3070 		ieee80211_send_action(ni,
3071 		    IEEE80211_ACTION_CAT_SELF_PROT,
3072 		    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3073 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3074 		mesh_peer_timeout_setup(ni);
3075 		break;
3076 	case IEEE80211_NODE_MESH_HOLDING:
3077 		ni->ni_mlhcnt++;
3078 		if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
3079 			callout_reset(&ni->ni_mlhtimer,
3080 			    ieee80211_mesh_backofftimeout,
3081 			    mesh_peer_backoff_cb, ni);
3082 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
3083 		break;
3084 	}
3085 }
3086 
3087 static int
3088 mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
3089 {
3090 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3091 
3092 	if (ie == NULL || ie[1] != ms->ms_idlen)
3093 		return 1;
3094 	return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
3095 }
3096 
3097 /*
3098  * Check if we are using the same algorithms for this mesh.
3099  */
3100 static int
3101 mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
3102 {
3103 	const struct ieee80211_meshconf_ie *meshconf =
3104 	    (const struct ieee80211_meshconf_ie *) ie;
3105 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3106 
3107 	if (meshconf == NULL)
3108 		return 1;
3109 	if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
3110 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3111 		    "unknown path selection algorithm: 0x%x\n",
3112 		    meshconf->conf_pselid);
3113 		return 1;
3114 	}
3115 	if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
3116 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3117 		    "unknown path metric algorithm: 0x%x\n",
3118 		    meshconf->conf_pmetid);
3119 		return 1;
3120 	}
3121 	if (meshconf->conf_ccid != 0) {
3122 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3123 		    "unknown congestion control algorithm: 0x%x\n",
3124 		    meshconf->conf_ccid);
3125 		return 1;
3126 	}
3127 	if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
3128 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3129 		    "unknown sync algorithm: 0x%x\n",
3130 		    meshconf->conf_syncid);
3131 		return 1;
3132 	}
3133 	if (meshconf->conf_authid != 0) {
3134 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3135 		    "unknown auth auth algorithm: 0x%x\n",
3136 		    meshconf->conf_pselid);
3137 		return 1;
3138 	}
3139 	/* Not accepting peers */
3140 	if (!(meshconf->conf_cap & IEEE80211_MESHCONF_CAP_AP)) {
3141 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3142 		    "not accepting peers: 0x%x\n", meshconf->conf_cap);
3143 		return 1;
3144 	}
3145 	return 0;
3146 }
3147 
3148 static int
3149 mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
3150     const uint8_t *ie)
3151 {
3152 	const struct ieee80211_meshpeer_ie *meshpeer =
3153 	    (const struct ieee80211_meshpeer_ie *) ie;
3154 
3155 	if (meshpeer == NULL ||
3156 	    meshpeer->peer_len < IEEE80211_MPM_BASE_SZ ||
3157 	    meshpeer->peer_len > IEEE80211_MPM_MAX_SZ)
3158 		return 1;
3159 	if (meshpeer->peer_proto != IEEE80211_MPPID_MPM) {
3160 		IEEE80211_DPRINTF(vap,
3161 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
3162 		    "Only MPM protocol is supported (proto: 0x%02X)",
3163 		    meshpeer->peer_proto);
3164 		return 1;
3165 	}
3166 	switch (subtype) {
3167 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3168 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ)
3169 			return 1;
3170 		break;
3171 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3172 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ + 2)
3173 			return 1;
3174 		break;
3175 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3176 		if (meshpeer->peer_len < IEEE80211_MPM_BASE_SZ + 2)
3177 			return 1;
3178 		if (meshpeer->peer_len == (IEEE80211_MPM_BASE_SZ + 2) &&
3179 		    meshpeer->peer_linkid != 0)
3180 			return 1;
3181 		if (meshpeer->peer_rcode == 0)
3182 			return 1;
3183 		break;
3184 	}
3185 	return 0;
3186 }
3187 
3188 /*
3189  * Add a Mesh ID IE to a frame.
3190  */
3191 uint8_t *
3192 ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
3193 {
3194 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3195 
3196 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
3197 
3198 	*frm++ = IEEE80211_ELEMID_MESHID;
3199 	*frm++ = ms->ms_idlen;
3200 	memcpy(frm, ms->ms_id, ms->ms_idlen);
3201 	return frm + ms->ms_idlen;
3202 }
3203 
3204 /*
3205  * Add a Mesh Configuration IE to a frame.
3206  * For now just use HWMP routing, Airtime link metric, Null Congestion
3207  * Signaling, Null Sync Protocol and Null Authentication.
3208  */
3209 uint8_t *
3210 ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
3211 {
3212 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3213 	uint16_t caps;
3214 
3215 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3216 
3217 	*frm++ = IEEE80211_ELEMID_MESHCONF;
3218 	*frm++ = IEEE80211_MESH_CONF_SZ;
3219 	*frm++ = ms->ms_ppath->mpp_ie;		/* path selection */
3220 	*frm++ = ms->ms_pmetric->mpm_ie;	/* link metric */
3221 	*frm++ = IEEE80211_MESHCONF_CC_DISABLED;
3222 	*frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
3223 	*frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
3224 	/* NB: set the number of neighbors before the rest */
3225 	*frm = (ms->ms_neighbors > IEEE80211_MESH_MAX_NEIGHBORS ?
3226 	    IEEE80211_MESH_MAX_NEIGHBORS : ms->ms_neighbors) << 1;
3227 	if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE)
3228 		*frm |= IEEE80211_MESHCONF_FORM_GATE;
3229 	frm += 1;
3230 	caps = 0;
3231 	if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
3232 		caps |= IEEE80211_MESHCONF_CAP_AP;
3233 	if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
3234 		caps |= IEEE80211_MESHCONF_CAP_FWRD;
3235 	*frm++ = caps;
3236 	return frm;
3237 }
3238 
3239 /*
3240  * Add a Mesh Peer Management IE to a frame.
3241  */
3242 uint8_t *
3243 ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
3244     uint16_t peerid, uint16_t reason)
3245 {
3246 
3247 	KASSERT(localid != 0, ("localid == 0"));
3248 
3249 	*frm++ = IEEE80211_ELEMID_MESHPEER;
3250 	switch (subtype) {
3251 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3252 		*frm++ = IEEE80211_MPM_BASE_SZ;		/* length */
3253 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3254 		ADDSHORT(frm, localid);			/* local ID */
3255 		break;
3256 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3257 		KASSERT(peerid != 0, ("sending peer confirm without peer id"));
3258 		*frm++ = IEEE80211_MPM_BASE_SZ + 2;	/* length */
3259 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3260 		ADDSHORT(frm, localid);			/* local ID */
3261 		ADDSHORT(frm, peerid);			/* peer ID */
3262 		break;
3263 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3264 		if (peerid)
3265 			*frm++ = IEEE80211_MPM_MAX_SZ;	/* length */
3266 		else
3267 			*frm++ = IEEE80211_MPM_BASE_SZ + 2; /* length */
3268 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3269 		ADDSHORT(frm, localid);	/* local ID */
3270 		if (peerid)
3271 			ADDSHORT(frm, peerid);	/* peer ID */
3272 		ADDSHORT(frm, reason);
3273 		break;
3274 	}
3275 	return frm;
3276 }
3277 
3278 /*
3279  * Compute an Airtime Link Metric for the link with this node.
3280  *
3281  * Based on Draft 3.0 spec (11B.10, p.149).
3282  */
3283 /*
3284  * Max 802.11s overhead.
3285  */
3286 #define IEEE80211_MESH_MAXOVERHEAD \
3287 	(sizeof(struct ieee80211_qosframe_addr4) \
3288 	 + sizeof(struct ieee80211_meshcntl_ae10) \
3289 	+ sizeof(struct llc) \
3290 	+ IEEE80211_ADDR_LEN \
3291 	+ IEEE80211_WEP_IVLEN \
3292 	+ IEEE80211_WEP_KIDLEN \
3293 	+ IEEE80211_WEP_CRCLEN \
3294 	+ IEEE80211_WEP_MICLEN \
3295 	+ IEEE80211_CRC_LEN)
3296 uint32_t
3297 mesh_airtime_calc(struct ieee80211_node *ni)
3298 {
3299 #define M_BITS 8
3300 #define S_FACTOR (2 * M_BITS)
3301 	struct ieee80211com *ic = ni->ni_ic;
3302 	struct ifnet *ifp = ni->ni_vap->iv_ifp;
3303 	const static int nbits = 8192 << M_BITS;
3304 	uint32_t overhead, rate, errrate;
3305 	uint64_t res;
3306 
3307 	/* Time to transmit a frame */
3308 	rate = ni->ni_txrate;
3309 	overhead = ieee80211_compute_duration(ic->ic_rt,
3310 	    ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
3311 	/* Error rate in percentage */
3312 	/* XXX assuming small failures are ok */
3313 	errrate = (((ifp->if_get_counter(ifp, IFCOUNTER_OERRORS) +
3314 	    ifp->if_get_counter(ifp, IFCOUNTER_IERRORS)) / 100) << M_BITS)
3315 	    / 100;
3316 	res = (overhead + (nbits / rate)) *
3317 	    ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
3318 
3319 	return (uint32_t)(res >> S_FACTOR);
3320 #undef M_BITS
3321 #undef S_FACTOR
3322 }
3323 
3324 /*
3325  * Add a Mesh Link Metric report IE to a frame.
3326  */
3327 uint8_t *
3328 ieee80211_add_meshlmetric(uint8_t *frm, uint8_t flags, uint32_t metric)
3329 {
3330 	*frm++ = IEEE80211_ELEMID_MESHLINK;
3331 	*frm++ = 5;
3332 	*frm++ = flags;
3333 	ADDWORD(frm, metric);
3334 	return frm;
3335 }
3336 
3337 /*
3338  * Add a Mesh Gate Announcement IE to a frame.
3339  */
3340 uint8_t *
3341 ieee80211_add_meshgate(uint8_t *frm, struct ieee80211_meshgann_ie *ie)
3342 {
3343 	*frm++ = IEEE80211_ELEMID_MESHGANN; /* ie */
3344 	*frm++ = IEEE80211_MESHGANN_BASE_SZ; /* len */
3345 	*frm++ = ie->gann_flags;
3346 	*frm++ = ie->gann_hopcount;
3347 	*frm++ = ie->gann_ttl;
3348 	IEEE80211_ADDR_COPY(frm, ie->gann_addr);
3349 	frm += 6;
3350 	ADDWORD(frm, ie->gann_seq);
3351 	ADDSHORT(frm, ie->gann_interval);
3352 	return frm;
3353 }
3354 #undef ADDSHORT
3355 #undef ADDWORD
3356 
3357 /*
3358  * Initialize any mesh-specific node state.
3359  */
3360 void
3361 ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
3362 {
3363 	ni->ni_flags |= IEEE80211_NODE_QOS;
3364 	callout_init(&ni->ni_mltimer, 1);
3365 	callout_init(&ni->ni_mlhtimer, 1);
3366 }
3367 
3368 /*
3369  * Cleanup any mesh-specific node state.
3370  */
3371 void
3372 ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
3373 {
3374 	struct ieee80211vap *vap = ni->ni_vap;
3375 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3376 
3377 	callout_drain(&ni->ni_mltimer);
3378 	callout_drain(&ni->ni_mlhtimer);
3379 	/* NB: short-circuit callbacks after mesh_vdetach */
3380 	if (vap->iv_mesh != NULL)
3381 		ms->ms_ppath->mpp_peerdown(ni);
3382 }
3383 
3384 void
3385 ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
3386 {
3387 	ni->ni_meshidlen = ie[1];
3388 	memcpy(ni->ni_meshid, ie + 2, ie[1]);
3389 }
3390 
3391 /*
3392  * Setup mesh-specific node state on neighbor discovery.
3393  */
3394 void
3395 ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
3396 	const struct ieee80211_frame *wh,
3397 	const struct ieee80211_scanparams *sp)
3398 {
3399 	ieee80211_parse_meshid(ni, sp->meshid);
3400 }
3401 
3402 void
3403 ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
3404 	struct ieee80211_beacon_offsets *bo)
3405 {
3406 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3407 
3408 	if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
3409 		(void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
3410 		clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
3411 	}
3412 }
3413 
3414 static int
3415 mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3416 {
3417 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3418 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3419 	struct ieee80211_mesh_route *rt;
3420 	struct ieee80211req_mesh_route *imr;
3421 	size_t len, off;
3422 	uint8_t *p;
3423 	int error;
3424 
3425 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3426 		return ENOSYS;
3427 
3428 	error = 0;
3429 	switch (ireq->i_type) {
3430 	case IEEE80211_IOC_MESH_ID:
3431 		ireq->i_len = ms->ms_idlen;
3432 		memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
3433 		error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
3434 		break;
3435 	case IEEE80211_IOC_MESH_AP:
3436 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
3437 		break;
3438 	case IEEE80211_IOC_MESH_FWRD:
3439 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
3440 		break;
3441 	case IEEE80211_IOC_MESH_GATE:
3442 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) != 0;
3443 		break;
3444 	case IEEE80211_IOC_MESH_TTL:
3445 		ireq->i_val = ms->ms_ttl;
3446 		break;
3447 	case IEEE80211_IOC_MESH_RTCMD:
3448 		switch (ireq->i_val) {
3449 		case IEEE80211_MESH_RTCMD_LIST:
3450 			len = 0;
3451 			MESH_RT_LOCK(ms);
3452 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3453 				len += sizeof(*imr);
3454 			}
3455 			MESH_RT_UNLOCK(ms);
3456 			if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
3457 				ireq->i_len = len;
3458 				return ENOMEM;
3459 			}
3460 			ireq->i_len = len;
3461 			/* XXX M_WAIT? */
3462 			p = IEEE80211_MALLOC(len, M_TEMP,
3463 			    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
3464 			if (p == NULL)
3465 				return ENOMEM;
3466 			off = 0;
3467 			MESH_RT_LOCK(ms);
3468 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3469 				if (off >= len)
3470 					break;
3471 				imr = (struct ieee80211req_mesh_route *)
3472 				    (p + off);
3473 				IEEE80211_ADDR_COPY(imr->imr_dest,
3474 				    rt->rt_dest);
3475 				IEEE80211_ADDR_COPY(imr->imr_nexthop,
3476 				    rt->rt_nexthop);
3477 				imr->imr_metric = rt->rt_metric;
3478 				imr->imr_nhops = rt->rt_nhops;
3479 				imr->imr_lifetime =
3480 				    ieee80211_mesh_rt_update(rt, 0);
3481 				imr->imr_lastmseq = rt->rt_lastmseq;
3482 				imr->imr_flags = rt->rt_flags; /* last */
3483 				off += sizeof(*imr);
3484 			}
3485 			MESH_RT_UNLOCK(ms);
3486 			error = copyout(p, (uint8_t *)ireq->i_data,
3487 			    ireq->i_len);
3488 			IEEE80211_FREE(p, M_TEMP);
3489 			break;
3490 		case IEEE80211_MESH_RTCMD_FLUSH:
3491 		case IEEE80211_MESH_RTCMD_ADD:
3492 		case IEEE80211_MESH_RTCMD_DELETE:
3493 			return EINVAL;
3494 		default:
3495 			return ENOSYS;
3496 		}
3497 		break;
3498 	case IEEE80211_IOC_MESH_PR_METRIC:
3499 		len = strlen(ms->ms_pmetric->mpm_descr);
3500 		if (ireq->i_len < len)
3501 			return EINVAL;
3502 		ireq->i_len = len;
3503 		error = copyout(ms->ms_pmetric->mpm_descr,
3504 		    (uint8_t *)ireq->i_data, len);
3505 		break;
3506 	case IEEE80211_IOC_MESH_PR_PATH:
3507 		len = strlen(ms->ms_ppath->mpp_descr);
3508 		if (ireq->i_len < len)
3509 			return EINVAL;
3510 		ireq->i_len = len;
3511 		error = copyout(ms->ms_ppath->mpp_descr,
3512 		    (uint8_t *)ireq->i_data, len);
3513 		break;
3514 	default:
3515 		return ENOSYS;
3516 	}
3517 
3518 	return error;
3519 }
3520 IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
3521 
3522 static int
3523 mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3524 {
3525 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3526 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3527 	uint8_t tmpaddr[IEEE80211_ADDR_LEN];
3528 	char tmpproto[IEEE80211_MESH_PROTO_DSZ];
3529 	int error;
3530 
3531 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3532 		return ENOSYS;
3533 
3534 	error = 0;
3535 	switch (ireq->i_type) {
3536 	case IEEE80211_IOC_MESH_ID:
3537 		if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
3538 			return EINVAL;
3539 		error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
3540 		if (error != 0)
3541 			break;
3542 		memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
3543 		ms->ms_idlen = ireq->i_len;
3544 		memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
3545 		error = ENETRESET;
3546 		break;
3547 	case IEEE80211_IOC_MESH_AP:
3548 		if (ireq->i_val)
3549 			ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
3550 		else
3551 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
3552 		error = ENETRESET;
3553 		break;
3554 	case IEEE80211_IOC_MESH_FWRD:
3555 		if (ireq->i_val)
3556 			ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
3557 		else
3558 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
3559 		mesh_gatemode_setup(vap);
3560 		break;
3561 	case IEEE80211_IOC_MESH_GATE:
3562 		if (ireq->i_val)
3563 			ms->ms_flags |= IEEE80211_MESHFLAGS_GATE;
3564 		else
3565 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_GATE;
3566 		break;
3567 	case IEEE80211_IOC_MESH_TTL:
3568 		ms->ms_ttl = (uint8_t) ireq->i_val;
3569 		break;
3570 	case IEEE80211_IOC_MESH_RTCMD:
3571 		switch (ireq->i_val) {
3572 		case IEEE80211_MESH_RTCMD_LIST:
3573 			return EINVAL;
3574 		case IEEE80211_MESH_RTCMD_FLUSH:
3575 			ieee80211_mesh_rt_flush(vap);
3576 			break;
3577 		case IEEE80211_MESH_RTCMD_ADD:
3578 			error = copyin(ireq->i_data, tmpaddr,
3579 			    IEEE80211_ADDR_LEN);
3580 			if (error != 0)
3581 				break;
3582 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, tmpaddr) ||
3583 			    IEEE80211_ADDR_EQ(broadcastaddr, tmpaddr))
3584 				return EINVAL;
3585 			ieee80211_mesh_discover(vap, tmpaddr, NULL);
3586 			break;
3587 		case IEEE80211_MESH_RTCMD_DELETE:
3588 			error = copyin(ireq->i_data, tmpaddr,
3589 			    IEEE80211_ADDR_LEN);
3590 			if (error != 0)
3591 				break;
3592 			ieee80211_mesh_rt_del(vap, tmpaddr);
3593 			break;
3594 		default:
3595 			return ENOSYS;
3596 		}
3597 		break;
3598 	case IEEE80211_IOC_MESH_PR_METRIC:
3599 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3600 		if (error == 0) {
3601 			error = mesh_select_proto_metric(vap, tmpproto);
3602 			if (error == 0)
3603 				error = ENETRESET;
3604 		}
3605 		break;
3606 	case IEEE80211_IOC_MESH_PR_PATH:
3607 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3608 		if (error == 0) {
3609 			error = mesh_select_proto_path(vap, tmpproto);
3610 			if (error == 0)
3611 				error = ENETRESET;
3612 		}
3613 		break;
3614 	default:
3615 		return ENOSYS;
3616 	}
3617 	return error;
3618 }
3619 IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);
3620