xref: /freebsd/sys/net80211/ieee80211_mesh.c (revision ef0cb5db0af0d5d5b75b74f8e534fe601b7176d7)
1 /*-
2  * Copyright (c) 2009 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Rui Paulo under sponsorship from the
6  * FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 #include <sys/cdefs.h>
30 #ifdef __FreeBSD__
31 __FBSDID("$FreeBSD$");
32 #endif
33 
34 /*
35  * IEEE 802.11s Mesh Point (MBSS) support.
36  *
37  * Based on March 2009, D3.0 802.11s draft spec.
38  */
39 #include "opt_inet.h"
40 #include "opt_wlan.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/malloc.h>
46 #include <sys/kernel.h>
47 
48 #include <sys/socket.h>
49 #include <sys/sockio.h>
50 #include <sys/endian.h>
51 #include <sys/errno.h>
52 #include <sys/proc.h>
53 #include <sys/sysctl.h>
54 
55 #include <net/bpf.h>
56 #include <net/if.h>
57 #include <net/if_var.h>
58 #include <net/if_media.h>
59 #include <net/if_llc.h>
60 #include <net/ethernet.h>
61 
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_action.h>
64 #ifdef IEEE80211_SUPPORT_SUPERG
65 #include <net80211/ieee80211_superg.h>
66 #endif
67 #include <net80211/ieee80211_input.h>
68 #include <net80211/ieee80211_mesh.h>
69 
70 static void	mesh_rt_flush_invalid(struct ieee80211vap *);
71 static int	mesh_select_proto_path(struct ieee80211vap *, const char *);
72 static int	mesh_select_proto_metric(struct ieee80211vap *, const char *);
73 static void	mesh_vattach(struct ieee80211vap *);
74 static int	mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
75 static void	mesh_rt_cleanup_cb(void *);
76 static void	mesh_gatemode_setup(struct ieee80211vap *);
77 static void	mesh_gatemode_cb(void *);
78 static void	mesh_linkchange(struct ieee80211_node *,
79 		    enum ieee80211_mesh_mlstate);
80 static void	mesh_checkid(void *, struct ieee80211_node *);
81 static uint32_t	mesh_generateid(struct ieee80211vap *);
82 static int	mesh_checkpseq(struct ieee80211vap *,
83 		    const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
84 static void	mesh_transmit_to_gate(struct ieee80211vap *, struct mbuf *,
85 		    struct ieee80211_mesh_route *);
86 static void	mesh_forward(struct ieee80211vap *, struct mbuf *,
87 		    const struct ieee80211_meshcntl *);
88 static int	mesh_input(struct ieee80211_node *, struct mbuf *,
89 		    const struct ieee80211_rx_stats *rxs, int, int);
90 static void	mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
91 		    const struct ieee80211_rx_stats *rxs, int, int);
92 static void	mesh_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
93 static void	mesh_peer_timeout_setup(struct ieee80211_node *);
94 static void	mesh_peer_timeout_backoff(struct ieee80211_node *);
95 static void	mesh_peer_timeout_cb(void *);
96 static __inline void
97 		mesh_peer_timeout_stop(struct ieee80211_node *);
98 static int	mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
99 static int	mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
100 static int	mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
101     		    const uint8_t *);
102 uint32_t	mesh_airtime_calc(struct ieee80211_node *);
103 
104 /*
105  * Timeout values come from the specification and are in milliseconds.
106  */
107 static SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
108     "IEEE 802.11s parameters");
109 static int	ieee80211_mesh_gateint = -1;
110 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, gateint, CTLTYPE_INT | CTLFLAG_RW,
111     &ieee80211_mesh_gateint, 0, ieee80211_sysctl_msecs_ticks, "I",
112     "mesh gate interval (ms)");
113 static int ieee80211_mesh_retrytimeout = -1;
114 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT | CTLFLAG_RW,
115     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
116     "Retry timeout (msec)");
117 static int ieee80211_mesh_holdingtimeout = -1;
118 
119 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT | CTLFLAG_RW,
120     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
121     "Holding state timeout (msec)");
122 static int ieee80211_mesh_confirmtimeout = -1;
123 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT | CTLFLAG_RW,
124     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
125     "Confirm state timeout (msec)");
126 static int ieee80211_mesh_backofftimeout = -1;
127 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, backofftimeout, CTLTYPE_INT | CTLFLAG_RW,
128     &ieee80211_mesh_backofftimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
129     "Backoff timeout (msec). This is to throutles peering forever when "
130     "not receiving answer or is rejected by a neighbor");
131 static int ieee80211_mesh_maxretries = 2;
132 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLFLAG_RW,
133     &ieee80211_mesh_maxretries, 0,
134     "Maximum retries during peer link establishment");
135 static int ieee80211_mesh_maxholding = 2;
136 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxholding, CTLFLAG_RW,
137     &ieee80211_mesh_maxholding, 0,
138     "Maximum times we are allowed to transition to HOLDING state before "
139     "backinoff during peer link establishment");
140 
141 static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
142 	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
143 
144 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
145 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
146 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
147 static	ieee80211_recv_action_func mesh_recv_action_meshlmetric;
148 static	ieee80211_recv_action_func mesh_recv_action_meshgate;
149 
150 static	ieee80211_send_action_func mesh_send_action_meshpeering_open;
151 static	ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
152 static	ieee80211_send_action_func mesh_send_action_meshpeering_close;
153 static	ieee80211_send_action_func mesh_send_action_meshlmetric;
154 static	ieee80211_send_action_func mesh_send_action_meshgate;
155 
156 static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
157 	.mpm_descr	= "AIRTIME",
158 	.mpm_ie		= IEEE80211_MESHCONF_METRIC_AIRTIME,
159 	.mpm_metric	= mesh_airtime_calc,
160 };
161 
162 static struct ieee80211_mesh_proto_path		mesh_proto_paths[4];
163 static struct ieee80211_mesh_proto_metric	mesh_proto_metrics[4];
164 
165 #define	RT_ENTRY_LOCK(rt)	mtx_lock(&(rt)->rt_lock)
166 #define	RT_ENTRY_LOCK_ASSERT(rt) mtx_assert(&(rt)->rt_lock, MA_OWNED)
167 #define	RT_ENTRY_UNLOCK(rt)	mtx_unlock(&(rt)->rt_lock)
168 
169 #define	MESH_RT_LOCK(ms)	mtx_lock(&(ms)->ms_rt_lock)
170 #define	MESH_RT_LOCK_ASSERT(ms)	mtx_assert(&(ms)->ms_rt_lock, MA_OWNED)
171 #define	MESH_RT_UNLOCK(ms)	mtx_unlock(&(ms)->ms_rt_lock)
172 
173 MALLOC_DEFINE(M_80211_MESH_PREQ, "80211preq", "802.11 MESH Path Request frame");
174 MALLOC_DEFINE(M_80211_MESH_PREP, "80211prep", "802.11 MESH Path Reply frame");
175 MALLOC_DEFINE(M_80211_MESH_PERR, "80211perr", "802.11 MESH Path Error frame");
176 
177 /* The longer one of the lifetime should be stored as new lifetime */
178 #define MESH_ROUTE_LIFETIME_MAX(a, b)	(a > b ? a : b)
179 
180 MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh_rt", "802.11s routing table");
181 MALLOC_DEFINE(M_80211_MESH_GT_RT, "80211mesh_gt", "802.11s known gates table");
182 
183 /*
184  * Helper functions to manipulate the Mesh routing table.
185  */
186 
187 static struct ieee80211_mesh_route *
188 mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
189     const uint8_t dest[IEEE80211_ADDR_LEN])
190 {
191 	struct ieee80211_mesh_route *rt;
192 
193 	MESH_RT_LOCK_ASSERT(ms);
194 
195 	TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
196 		if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
197 			return rt;
198 	}
199 	return NULL;
200 }
201 
202 static struct ieee80211_mesh_route *
203 mesh_rt_add_locked(struct ieee80211vap *vap,
204     const uint8_t dest[IEEE80211_ADDR_LEN])
205 {
206 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
207 	struct ieee80211_mesh_route *rt;
208 
209 	KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
210 	    ("%s: adding broadcast to the routing table", __func__));
211 
212 	MESH_RT_LOCK_ASSERT(ms);
213 
214 	rt = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_route)) +
215 	    ms->ms_ppath->mpp_privlen, M_80211_MESH_RT,
216 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
217 	if (rt != NULL) {
218 		rt->rt_vap = vap;
219 		IEEE80211_ADDR_COPY(rt->rt_dest, dest);
220 		rt->rt_priv = (void *)ALIGN(&rt[1]);
221 		mtx_init(&rt->rt_lock, "MBSS_RT", "802.11s route entry", MTX_DEF);
222 		callout_init(&rt->rt_discovery, 1);
223 		rt->rt_updtime = ticks;	/* create time */
224 		TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
225 	}
226 	return rt;
227 }
228 
229 struct ieee80211_mesh_route *
230 ieee80211_mesh_rt_find(struct ieee80211vap *vap,
231     const uint8_t dest[IEEE80211_ADDR_LEN])
232 {
233 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
234 	struct ieee80211_mesh_route *rt;
235 
236 	MESH_RT_LOCK(ms);
237 	rt = mesh_rt_find_locked(ms, dest);
238 	MESH_RT_UNLOCK(ms);
239 	return rt;
240 }
241 
242 struct ieee80211_mesh_route *
243 ieee80211_mesh_rt_add(struct ieee80211vap *vap,
244     const uint8_t dest[IEEE80211_ADDR_LEN])
245 {
246 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
247 	struct ieee80211_mesh_route *rt;
248 
249 	KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
250 	    ("%s: duplicate entry in the routing table", __func__));
251 	KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
252 	    ("%s: adding self to the routing table", __func__));
253 
254 	MESH_RT_LOCK(ms);
255 	rt = mesh_rt_add_locked(vap, dest);
256 	MESH_RT_UNLOCK(ms);
257 	return rt;
258 }
259 
260 /*
261  * Update the route lifetime and returns the updated lifetime.
262  * If new_lifetime is zero and route is timedout it will be invalidated.
263  * new_lifetime is in msec
264  */
265 int
266 ieee80211_mesh_rt_update(struct ieee80211_mesh_route *rt, int new_lifetime)
267 {
268 	int timesince, now;
269 	uint32_t lifetime = 0;
270 
271 	KASSERT(rt != NULL, ("route is NULL"));
272 
273 	now = ticks;
274 	RT_ENTRY_LOCK(rt);
275 
276 	/* dont clobber a proxy entry gated by us */
277 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY && rt->rt_nhops == 0) {
278 		RT_ENTRY_UNLOCK(rt);
279 		return rt->rt_lifetime;
280 	}
281 
282 	timesince = ticks_to_msecs(now - rt->rt_updtime);
283 	rt->rt_updtime = now;
284 	if (timesince >= rt->rt_lifetime) {
285 		if (new_lifetime != 0) {
286 			rt->rt_lifetime = new_lifetime;
287 		}
288 		else {
289 			rt->rt_flags &= ~IEEE80211_MESHRT_FLAGS_VALID;
290 			rt->rt_lifetime = 0;
291 		}
292 	} else {
293 		/* update what is left of lifetime */
294 		rt->rt_lifetime = rt->rt_lifetime - timesince;
295 		rt->rt_lifetime  = MESH_ROUTE_LIFETIME_MAX(
296 			new_lifetime, rt->rt_lifetime);
297 	}
298 	lifetime = rt->rt_lifetime;
299 	RT_ENTRY_UNLOCK(rt);
300 
301 	return lifetime;
302 }
303 
304 /*
305  * Add a proxy route (as needed) for the specified destination.
306  */
307 void
308 ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
309     const uint8_t dest[IEEE80211_ADDR_LEN])
310 {
311 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
312 	struct ieee80211_mesh_route *rt;
313 
314 	MESH_RT_LOCK(ms);
315 	rt = mesh_rt_find_locked(ms, dest);
316 	if (rt == NULL) {
317 		rt = mesh_rt_add_locked(vap, dest);
318 		if (rt == NULL) {
319 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
320 			    "%s", "unable to add proxy entry");
321 			vap->iv_stats.is_mesh_rtaddfailed++;
322 		} else {
323 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
324 			    "%s", "add proxy entry");
325 			IEEE80211_ADDR_COPY(rt->rt_mesh_gate, vap->iv_myaddr);
326 			IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
327 			rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
328 				     |  IEEE80211_MESHRT_FLAGS_PROXY;
329 		}
330 	} else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
331 		KASSERT(rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY,
332 		    ("no proxy flag for poxy entry"));
333 		struct ieee80211com *ic = vap->iv_ic;
334 		/*
335 		 * Fix existing entry created by received frames from
336 		 * stations that have some memory of dest.  We also
337 		 * flush any frames held on the staging queue; delivering
338 		 * them is too much trouble right now.
339 		 */
340 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
341 		    "%s", "fix proxy entry");
342 		IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
343 		rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
344 			     |  IEEE80211_MESHRT_FLAGS_PROXY;
345 		/* XXX belongs in hwmp */
346 		ieee80211_ageq_drain_node(&ic->ic_stageq,
347 		   (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
348 		/* XXX stat? */
349 	}
350 	MESH_RT_UNLOCK(ms);
351 }
352 
353 static __inline void
354 mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
355 {
356 	TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
357 	/*
358 	 * Grab the lock before destroying it, to be sure no one else
359 	 * is holding the route.
360 	 */
361 	RT_ENTRY_LOCK(rt);
362 	callout_drain(&rt->rt_discovery);
363 	mtx_destroy(&rt->rt_lock);
364 	IEEE80211_FREE(rt, M_80211_MESH_RT);
365 }
366 
367 void
368 ieee80211_mesh_rt_del(struct ieee80211vap *vap,
369     const uint8_t dest[IEEE80211_ADDR_LEN])
370 {
371 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
372 	struct ieee80211_mesh_route *rt, *next;
373 
374 	MESH_RT_LOCK(ms);
375 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
376 		if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
377 			if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
378 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
379 				    IEEE80211_REASON_MESH_PERR_NO_PROXY);
380 			} else {
381 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
382 				    IEEE80211_REASON_MESH_PERR_DEST_UNREACH);
383 			}
384 			mesh_rt_del(ms, rt);
385 			MESH_RT_UNLOCK(ms);
386 			return;
387 		}
388 	}
389 	MESH_RT_UNLOCK(ms);
390 }
391 
392 void
393 ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
394 {
395 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
396 	struct ieee80211_mesh_route *rt, *next;
397 
398 	if (ms == NULL)
399 		return;
400 	MESH_RT_LOCK(ms);
401 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next)
402 		mesh_rt_del(ms, rt);
403 	MESH_RT_UNLOCK(ms);
404 }
405 
406 void
407 ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
408     const uint8_t peer[IEEE80211_ADDR_LEN])
409 {
410 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
411 	struct ieee80211_mesh_route *rt, *next;
412 
413 	MESH_RT_LOCK(ms);
414 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
415 		if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
416 			mesh_rt_del(ms, rt);
417 	}
418 	MESH_RT_UNLOCK(ms);
419 }
420 
421 /*
422  * Flush expired routing entries, i.e. those in invalid state for
423  * some time.
424  */
425 static void
426 mesh_rt_flush_invalid(struct ieee80211vap *vap)
427 {
428 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
429 	struct ieee80211_mesh_route *rt, *next;
430 
431 	if (ms == NULL)
432 		return;
433 	MESH_RT_LOCK(ms);
434 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
435 		/* Discover paths will be deleted by their own callout */
436 		if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_DISCOVER)
437 			continue;
438 		ieee80211_mesh_rt_update(rt, 0);
439 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
440 			mesh_rt_del(ms, rt);
441 	}
442 	MESH_RT_UNLOCK(ms);
443 }
444 
445 #define	N(a)	(sizeof(a) / sizeof(a[0]))
446 int
447 ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
448 {
449 	int i, firstempty = -1;
450 
451 	for (i = 0; i < N(mesh_proto_paths); i++) {
452 		if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
453 		    IEEE80211_MESH_PROTO_DSZ) == 0)
454 			return EEXIST;
455 		if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
456 			firstempty = i;
457 	}
458 	if (firstempty < 0)
459 		return ENOSPC;
460 	memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
461 	mesh_proto_paths[firstempty].mpp_active = 1;
462 	return 0;
463 }
464 
465 int
466 ieee80211_mesh_register_proto_metric(const struct
467     ieee80211_mesh_proto_metric *mpm)
468 {
469 	int i, firstempty = -1;
470 
471 	for (i = 0; i < N(mesh_proto_metrics); i++) {
472 		if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
473 		    IEEE80211_MESH_PROTO_DSZ) == 0)
474 			return EEXIST;
475 		if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
476 			firstempty = i;
477 	}
478 	if (firstempty < 0)
479 		return ENOSPC;
480 	memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
481 	mesh_proto_metrics[firstempty].mpm_active = 1;
482 	return 0;
483 }
484 
485 static int
486 mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
487 {
488 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
489 	int i;
490 
491 	for (i = 0; i < N(mesh_proto_paths); i++) {
492 		if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
493 			ms->ms_ppath = &mesh_proto_paths[i];
494 			return 0;
495 		}
496 	}
497 	return ENOENT;
498 }
499 
500 static int
501 mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
502 {
503 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
504 	int i;
505 
506 	for (i = 0; i < N(mesh_proto_metrics); i++) {
507 		if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
508 			ms->ms_pmetric = &mesh_proto_metrics[i];
509 			return 0;
510 		}
511 	}
512 	return ENOENT;
513 }
514 #undef	N
515 
516 static void
517 mesh_gatemode_setup(struct ieee80211vap *vap)
518 {
519 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
520 
521 	/*
522 	 * NB: When a mesh gate is running as a ROOT it shall
523 	 * not send out periodic GANNs but instead mark the
524 	 * mesh gate flag for the corresponding proactive PREQ
525 	 * and RANN frames.
526 	 */
527 	if (ms->ms_flags & IEEE80211_MESHFLAGS_ROOT ||
528 	    (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) == 0) {
529 		callout_drain(&ms->ms_gatetimer);
530 		return ;
531 	}
532 	callout_reset(&ms->ms_gatetimer, ieee80211_mesh_gateint,
533 	    mesh_gatemode_cb, vap);
534 }
535 
536 static void
537 mesh_gatemode_cb(void *arg)
538 {
539 	struct ieee80211vap *vap = (struct ieee80211vap *)arg;
540 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
541 	struct ieee80211_meshgann_ie gann;
542 
543 	gann.gann_flags = 0; /* Reserved */
544 	gann.gann_hopcount = 0;
545 	gann.gann_ttl = ms->ms_ttl;
546 	IEEE80211_ADDR_COPY(gann.gann_addr, vap->iv_myaddr);
547 	gann.gann_seq = ms->ms_gateseq++;
548 	gann.gann_interval = ieee80211_mesh_gateint;
549 
550 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH, vap->iv_bss,
551 	    "send broadcast GANN (seq %u)", gann.gann_seq);
552 
553 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
554 	    IEEE80211_ACTION_MESH_GANN, &gann);
555 	mesh_gatemode_setup(vap);
556 }
557 
558 static void
559 ieee80211_mesh_init(void)
560 {
561 
562 	memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
563 	memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
564 
565 	/*
566 	 * Setup mesh parameters that depends on the clock frequency.
567 	 */
568 	ieee80211_mesh_gateint = msecs_to_ticks(10000);
569 	ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
570 	ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
571 	ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
572 	ieee80211_mesh_backofftimeout = msecs_to_ticks(5000);
573 
574 	/*
575 	 * Register action frame handlers.
576 	 */
577 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
578 	    IEEE80211_ACTION_MESHPEERING_OPEN,
579 	    mesh_recv_action_meshpeering_open);
580 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
581 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
582 	    mesh_recv_action_meshpeering_confirm);
583 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
584 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
585 	    mesh_recv_action_meshpeering_close);
586 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
587 	    IEEE80211_ACTION_MESH_LMETRIC, mesh_recv_action_meshlmetric);
588 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
589 	    IEEE80211_ACTION_MESH_GANN, mesh_recv_action_meshgate);
590 
591 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
592 	    IEEE80211_ACTION_MESHPEERING_OPEN,
593 	    mesh_send_action_meshpeering_open);
594 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
595 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
596 	    mesh_send_action_meshpeering_confirm);
597 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
598 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
599 	    mesh_send_action_meshpeering_close);
600 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
601 	    IEEE80211_ACTION_MESH_LMETRIC,
602 	    mesh_send_action_meshlmetric);
603 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
604 	    IEEE80211_ACTION_MESH_GANN,
605 	    mesh_send_action_meshgate);
606 
607 	/*
608 	 * Register Airtime Link Metric.
609 	 */
610 	ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
611 
612 }
613 SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
614 
615 void
616 ieee80211_mesh_attach(struct ieee80211com *ic)
617 {
618 	ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
619 }
620 
621 void
622 ieee80211_mesh_detach(struct ieee80211com *ic)
623 {
624 }
625 
626 static void
627 mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
628 {
629 	struct ieee80211com *ic = ni->ni_ic;
630 	uint16_t args[3];
631 
632 	if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
633 		args[0] = ni->ni_mlpid;
634 		args[1] = ni->ni_mllid;
635 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
636 		ieee80211_send_action(ni,
637 		    IEEE80211_ACTION_CAT_SELF_PROT,
638 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
639 		    args);
640 	}
641 	callout_drain(&ni->ni_mltimer);
642 	/* XXX belongs in hwmp */
643 	ieee80211_ageq_drain_node(&ic->ic_stageq,
644 	   (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
645 }
646 
647 static void
648 mesh_vdetach(struct ieee80211vap *vap)
649 {
650 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
651 
652 	callout_drain(&ms->ms_cleantimer);
653 	ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
654 	    NULL);
655 	ieee80211_mesh_rt_flush(vap);
656 	mtx_destroy(&ms->ms_rt_lock);
657 	ms->ms_ppath->mpp_vdetach(vap);
658 	IEEE80211_FREE(vap->iv_mesh, M_80211_VAP);
659 	vap->iv_mesh = NULL;
660 }
661 
662 static void
663 mesh_vattach(struct ieee80211vap *vap)
664 {
665 	struct ieee80211_mesh_state *ms;
666 	vap->iv_newstate = mesh_newstate;
667 	vap->iv_input = mesh_input;
668 	vap->iv_opdetach = mesh_vdetach;
669 	vap->iv_recv_mgmt = mesh_recv_mgmt;
670 	vap->iv_recv_ctl = mesh_recv_ctl;
671 	ms = IEEE80211_MALLOC(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
672 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
673 	if (ms == NULL) {
674 		printf("%s: couldn't alloc MBSS state\n", __func__);
675 		return;
676 	}
677 	vap->iv_mesh = ms;
678 	ms->ms_seq = 0;
679 	ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
680 	ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
681 	TAILQ_INIT(&ms->ms_known_gates);
682 	TAILQ_INIT(&ms->ms_routes);
683 	mtx_init(&ms->ms_rt_lock, "MBSS", "802.11s routing table", MTX_DEF);
684 	callout_init(&ms->ms_cleantimer, 1);
685 	callout_init(&ms->ms_gatetimer, 1);
686 	ms->ms_gateseq = 0;
687 	mesh_select_proto_metric(vap, "AIRTIME");
688 	KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
689 	mesh_select_proto_path(vap, "HWMP");
690 	KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
691 	ms->ms_ppath->mpp_vattach(vap);
692 }
693 
694 /*
695  * IEEE80211_M_MBSS vap state machine handler.
696  */
697 static int
698 mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
699 {
700 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
701 	struct ieee80211com *ic = vap->iv_ic;
702 	struct ieee80211_node *ni;
703 	enum ieee80211_state ostate;
704 
705 	IEEE80211_LOCK_ASSERT(ic);
706 
707 	ostate = vap->iv_state;
708 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
709 	    __func__, ieee80211_state_name[ostate],
710 	    ieee80211_state_name[nstate], arg);
711 	vap->iv_state = nstate;		/* state transition */
712 	if (ostate != IEEE80211_S_SCAN)
713 		ieee80211_cancel_scan(vap);	/* background scan */
714 	ni = vap->iv_bss;			/* NB: no reference held */
715 	if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN) {
716 		callout_drain(&ms->ms_cleantimer);
717 		callout_drain(&ms->ms_gatetimer);
718 	}
719 	switch (nstate) {
720 	case IEEE80211_S_INIT:
721 		switch (ostate) {
722 		case IEEE80211_S_SCAN:
723 			ieee80211_cancel_scan(vap);
724 			break;
725 		case IEEE80211_S_CAC:
726 			ieee80211_dfs_cac_stop(vap);
727 			break;
728 		case IEEE80211_S_RUN:
729 			ieee80211_iterate_nodes(&ic->ic_sta,
730 			    mesh_vdetach_peers, NULL);
731 			break;
732 		default:
733 			break;
734 		}
735 		if (ostate != IEEE80211_S_INIT) {
736 			/* NB: optimize INIT -> INIT case */
737 			ieee80211_reset_bss(vap);
738 			ieee80211_mesh_rt_flush(vap);
739 		}
740 		break;
741 	case IEEE80211_S_SCAN:
742 		switch (ostate) {
743 		case IEEE80211_S_INIT:
744 			if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
745 			    !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
746 			    ms->ms_idlen != 0) {
747 				/*
748 				 * Already have a channel and a mesh ID; bypass
749 				 * the scan and startup immediately.
750 				 */
751 				ieee80211_create_ibss(vap, vap->iv_des_chan);
752 				break;
753 			}
754 			/*
755 			 * Initiate a scan.  We can come here as a result
756 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
757 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
758 			 * and the scan request parameters will be present
759 			 * in iv_scanreq.  Otherwise we do the default.
760 			*/
761 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
762 				ieee80211_check_scan(vap,
763 				    vap->iv_scanreq_flags,
764 				    vap->iv_scanreq_duration,
765 				    vap->iv_scanreq_mindwell,
766 				    vap->iv_scanreq_maxdwell,
767 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
768 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
769 			} else
770 				ieee80211_check_scan_current(vap);
771 			break;
772 		default:
773 			break;
774 		}
775 		break;
776 	case IEEE80211_S_CAC:
777 		/*
778 		 * Start CAC on a DFS channel.  We come here when starting
779 		 * a bss on a DFS channel (see ieee80211_create_ibss).
780 		 */
781 		ieee80211_dfs_cac_start(vap);
782 		break;
783 	case IEEE80211_S_RUN:
784 		switch (ostate) {
785 		case IEEE80211_S_INIT:
786 			/*
787 			 * Already have a channel; bypass the
788 			 * scan and startup immediately.
789 			 * Note that ieee80211_create_ibss will call
790 			 * back to do a RUN->RUN state change.
791 			 */
792 			ieee80211_create_ibss(vap,
793 			    ieee80211_ht_adjust_channel(ic,
794 				ic->ic_curchan, vap->iv_flags_ht));
795 			/* NB: iv_bss is changed on return */
796 			break;
797 		case IEEE80211_S_CAC:
798 			/*
799 			 * NB: This is the normal state change when CAC
800 			 * expires and no radar was detected; no need to
801 			 * clear the CAC timer as it's already expired.
802 			 */
803 			/* fall thru... */
804 		case IEEE80211_S_CSA:
805 #if 0
806 			/*
807 			 * Shorten inactivity timer of associated stations
808 			 * to weed out sta's that don't follow a CSA.
809 			 */
810 			ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
811 #endif
812 			/*
813 			 * Update bss node channel to reflect where
814 			 * we landed after CSA.
815 			 */
816 			ieee80211_node_set_chan(vap->iv_bss,
817 			    ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
818 				ieee80211_htchanflags(vap->iv_bss->ni_chan)));
819 			/* XXX bypass debug msgs */
820 			break;
821 		case IEEE80211_S_SCAN:
822 		case IEEE80211_S_RUN:
823 #ifdef IEEE80211_DEBUG
824 			if (ieee80211_msg_debug(vap)) {
825 				struct ieee80211_node *ni = vap->iv_bss;
826 				ieee80211_note(vap,
827 				    "synchronized with %s meshid ",
828 				    ether_sprintf(ni->ni_meshid));
829 				ieee80211_print_essid(ni->ni_meshid,
830 				    ni->ni_meshidlen);
831 				/* XXX MCS/HT */
832 				printf(" channel %d\n",
833 				    ieee80211_chan2ieee(ic, ic->ic_curchan));
834 			}
835 #endif
836 			break;
837 		default:
838 			break;
839 		}
840 		ieee80211_node_authorize(vap->iv_bss);
841 		callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
842                     mesh_rt_cleanup_cb, vap);
843 		mesh_gatemode_setup(vap);
844 		break;
845 	default:
846 		break;
847 	}
848 	/* NB: ostate not nstate */
849 	ms->ms_ppath->mpp_newstate(vap, ostate, arg);
850 	return 0;
851 }
852 
853 static void
854 mesh_rt_cleanup_cb(void *arg)
855 {
856 	struct ieee80211vap *vap = arg;
857 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
858 
859 	mesh_rt_flush_invalid(vap);
860 	callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
861 	    mesh_rt_cleanup_cb, vap);
862 }
863 
864 /*
865  * Mark a mesh STA as gate and return a pointer to it.
866  * If this is first time, we create a new gate route.
867  * Always update the path route to this mesh gate.
868  */
869 struct ieee80211_mesh_gate_route *
870 ieee80211_mesh_mark_gate(struct ieee80211vap *vap, const uint8_t *addr,
871     struct ieee80211_mesh_route *rt)
872 {
873 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
874 	struct ieee80211_mesh_gate_route *gr = NULL, *next;
875 	int found = 0;
876 
877 	MESH_RT_LOCK(ms);
878 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
879 		if (IEEE80211_ADDR_EQ(gr->gr_addr, addr)) {
880 			found = 1;
881 			break;
882 		}
883 	}
884 
885 	if (!found) {
886 		/* New mesh gate add it to known table. */
887 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, addr,
888 		    "%s", "stored new gate information from pro-PREQ.");
889 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
890 		    M_80211_MESH_GT_RT,
891 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
892 		IEEE80211_ADDR_COPY(gr->gr_addr, addr);
893 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
894 	}
895 	gr->gr_route = rt;
896 	/* TODO: link from path route to gate route */
897 	MESH_RT_UNLOCK(ms);
898 
899 	return gr;
900 }
901 
902 
903 /*
904  * Helper function to note the Mesh Peer Link FSM change.
905  */
906 static void
907 mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
908 {
909 	struct ieee80211vap *vap = ni->ni_vap;
910 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
911 #ifdef IEEE80211_DEBUG
912 	static const char *meshlinkstates[] = {
913 		[IEEE80211_NODE_MESH_IDLE]		= "IDLE",
914 		[IEEE80211_NODE_MESH_OPENSNT]		= "OPEN SENT",
915 		[IEEE80211_NODE_MESH_OPENRCV]		= "OPEN RECEIVED",
916 		[IEEE80211_NODE_MESH_CONFIRMRCV]	= "CONFIRM RECEIVED",
917 		[IEEE80211_NODE_MESH_ESTABLISHED]	= "ESTABLISHED",
918 		[IEEE80211_NODE_MESH_HOLDING]		= "HOLDING"
919 	};
920 #endif
921 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
922 	    ni, "peer link: %s -> %s",
923 	    meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
924 
925 	/* track neighbor count */
926 	if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
927 	    ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
928 		KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
929 		ms->ms_neighbors++;
930 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
931 	} else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
932 	    state != IEEE80211_NODE_MESH_ESTABLISHED) {
933 		KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
934 		ms->ms_neighbors--;
935 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
936 	}
937 	ni->ni_mlstate = state;
938 	switch (state) {
939 	case IEEE80211_NODE_MESH_HOLDING:
940 		ms->ms_ppath->mpp_peerdown(ni);
941 		break;
942 	case IEEE80211_NODE_MESH_ESTABLISHED:
943 		ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
944 		break;
945 	default:
946 		break;
947 	}
948 }
949 
950 /*
951  * Helper function to generate a unique local ID required for mesh
952  * peer establishment.
953  */
954 static void
955 mesh_checkid(void *arg, struct ieee80211_node *ni)
956 {
957 	uint16_t *r = arg;
958 
959 	if (*r == ni->ni_mllid)
960 		*(uint16_t *)arg = 0;
961 }
962 
963 static uint32_t
964 mesh_generateid(struct ieee80211vap *vap)
965 {
966 	int maxiter = 4;
967 	uint16_t r;
968 
969 	do {
970 		get_random_bytes(&r, 2);
971 		ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
972 		maxiter--;
973 	} while (r == 0 && maxiter > 0);
974 	return r;
975 }
976 
977 /*
978  * Verifies if we already received this packet by checking its
979  * sequence number.
980  * Returns 0 if the frame is to be accepted, 1 otherwise.
981  */
982 static int
983 mesh_checkpseq(struct ieee80211vap *vap,
984     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
985 {
986 	struct ieee80211_mesh_route *rt;
987 
988 	rt = ieee80211_mesh_rt_find(vap, source);
989 	if (rt == NULL) {
990 		rt = ieee80211_mesh_rt_add(vap, source);
991 		if (rt == NULL) {
992 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
993 			    "%s", "add mcast route failed");
994 			vap->iv_stats.is_mesh_rtaddfailed++;
995 			return 1;
996 		}
997 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
998 		    "add mcast route, mesh seqno %d", seq);
999 		rt->rt_lastmseq = seq;
1000 		return 0;
1001 	}
1002 	if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
1003 		return 1;
1004 	} else {
1005 		rt->rt_lastmseq = seq;
1006 		return 0;
1007 	}
1008 }
1009 
1010 /*
1011  * Iterate the routing table and locate the next hop.
1012  */
1013 struct ieee80211_node *
1014 ieee80211_mesh_find_txnode(struct ieee80211vap *vap,
1015     const uint8_t dest[IEEE80211_ADDR_LEN])
1016 {
1017 	struct ieee80211_mesh_route *rt;
1018 
1019 	rt = ieee80211_mesh_rt_find(vap, dest);
1020 	if (rt == NULL)
1021 		return NULL;
1022 	if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1023 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1024 		    "%s: !valid, flags 0x%x", __func__, rt->rt_flags);
1025 		/* XXX stat */
1026 		return NULL;
1027 	}
1028 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
1029 		rt = ieee80211_mesh_rt_find(vap, rt->rt_mesh_gate);
1030 		if (rt == NULL) return NULL;
1031 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1032 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1033 			    "%s: meshgate !valid, flags 0x%x", __func__,
1034 			    rt->rt_flags);
1035 			/* XXX stat */
1036 			return NULL;
1037 		}
1038 	}
1039 	return ieee80211_find_txnode(vap, rt->rt_nexthop);
1040 }
1041 
1042 static void
1043 mesh_transmit_to_gate(struct ieee80211vap *vap, struct mbuf *m,
1044     struct ieee80211_mesh_route *rt_gate)
1045 {
1046 	struct ifnet *ifp = vap->iv_ifp;
1047 	struct ieee80211_node *ni;
1048 
1049 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1050 
1051 	ni = ieee80211_mesh_find_txnode(vap, rt_gate->rt_dest);
1052 	if (ni == NULL) {
1053 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1054 		m_freem(m);
1055 		return;
1056 	}
1057 
1058 	/*
1059 	 * Send through the VAP packet transmit path.
1060 	 * This consumes the node ref grabbed above and
1061 	 * the mbuf, regardless of whether there's a problem
1062 	 * or not.
1063 	 */
1064 	(void) ieee80211_vap_pkt_send_dest(vap, m, ni);
1065 }
1066 
1067 /*
1068  * Forward the queued frames to known valid mesh gates.
1069  * Assume destination to be outside the MBSS (i.e. proxy entry),
1070  * If no valid mesh gates are known silently discard queued frames.
1071  * After transmitting frames to all known valid mesh gates, this route
1072  * will be marked invalid, and a new path discovery will happen in the hopes
1073  * that (at least) one of the mesh gates have a new proxy entry for us to use.
1074  */
1075 void
1076 ieee80211_mesh_forward_to_gates(struct ieee80211vap *vap,
1077     struct ieee80211_mesh_route *rt_dest)
1078 {
1079 	struct ieee80211com *ic = vap->iv_ic;
1080 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1081 	struct ieee80211_mesh_route *rt_gate;
1082 	struct ieee80211_mesh_gate_route *gr = NULL, *gr_next;
1083 	struct mbuf *m, *mcopy, *next;
1084 
1085 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1086 
1087 	KASSERT( rt_dest->rt_flags == IEEE80211_MESHRT_FLAGS_DISCOVER,
1088 	    ("Route is not marked with IEEE80211_MESHRT_FLAGS_DISCOVER"));
1089 
1090 	/* XXX: send to more than one valid mash gate */
1091 	MESH_RT_LOCK(ms);
1092 
1093 	m = ieee80211_ageq_remove(&ic->ic_stageq,
1094 	    (struct ieee80211_node *)(uintptr_t)
1095 	    ieee80211_mac_hash(ic, rt_dest->rt_dest));
1096 
1097 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, gr_next) {
1098 		rt_gate = gr->gr_route;
1099 		if (rt_gate == NULL) {
1100 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1101 				rt_dest->rt_dest,
1102 				"mesh gate with no path %6D",
1103 				gr->gr_addr, ":");
1104 			continue;
1105 		}
1106 		if ((rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
1107 			continue;
1108 		KASSERT(rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_GATE,
1109 		    ("route not marked as a mesh gate"));
1110 		KASSERT((rt_gate->rt_flags &
1111 			IEEE80211_MESHRT_FLAGS_PROXY) == 0,
1112 			("found mesh gate that is also marked porxy"));
1113 		/*
1114 		 * convert route to a proxy route gated by the current
1115 		 * mesh gate, this is needed so encap can built data
1116 		 * frame with correct address.
1117 		 */
1118 		rt_dest->rt_flags = IEEE80211_MESHRT_FLAGS_PROXY |
1119 			IEEE80211_MESHRT_FLAGS_VALID;
1120 		rt_dest->rt_ext_seq = 1; /* random value */
1121 		IEEE80211_ADDR_COPY(rt_dest->rt_mesh_gate, rt_gate->rt_dest);
1122 		IEEE80211_ADDR_COPY(rt_dest->rt_nexthop, rt_gate->rt_nexthop);
1123 		rt_dest->rt_metric = rt_gate->rt_metric;
1124 		rt_dest->rt_nhops = rt_gate->rt_nhops;
1125 		ieee80211_mesh_rt_update(rt_dest, ms->ms_ppath->mpp_inact);
1126 		MESH_RT_UNLOCK(ms);
1127 		/* XXX: lock?? */
1128 		mcopy = m_dup(m, M_NOWAIT);
1129 		for (; mcopy != NULL; mcopy = next) {
1130 			next = mcopy->m_nextpkt;
1131 			mcopy->m_nextpkt = NULL;
1132 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1133 			    rt_dest->rt_dest,
1134 			    "flush queued frame %p len %d", mcopy,
1135 			    mcopy->m_pkthdr.len);
1136 			mesh_transmit_to_gate(vap, mcopy, rt_gate);
1137 		}
1138 		MESH_RT_LOCK(ms);
1139 	}
1140 	rt_dest->rt_flags = 0; /* Mark invalid */
1141 	m_freem(m);
1142 	MESH_RT_UNLOCK(ms);
1143 }
1144 
1145 /*
1146  * Forward the specified frame.
1147  * Decrement the TTL and set TA to our MAC address.
1148  */
1149 static void
1150 mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
1151     const struct ieee80211_meshcntl *mc)
1152 {
1153 	struct ieee80211com *ic = vap->iv_ic;
1154 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1155 	struct ifnet *ifp = vap->iv_ifp;
1156 	const struct ieee80211_frame *wh =
1157 	    mtod(m, const struct ieee80211_frame *);
1158 	struct mbuf *mcopy;
1159 	struct ieee80211_meshcntl *mccopy;
1160 	struct ieee80211_frame *whcopy;
1161 	struct ieee80211_node *ni;
1162 	int err;
1163 
1164 	/* This is called from the RX path - don't hold this lock */
1165 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1166 
1167 	/*
1168 	 * mesh ttl of 1 means we are the last one receving it,
1169 	 * according to amendment we decrement and then check if
1170 	 * 0, if so we dont forward.
1171 	 */
1172 	if (mc->mc_ttl < 1) {
1173 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1174 		    "%s", "frame not fwd'd, ttl 1");
1175 		vap->iv_stats.is_mesh_fwd_ttl++;
1176 		return;
1177 	}
1178 	if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
1179 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1180 		    "%s", "frame not fwd'd, fwding disabled");
1181 		vap->iv_stats.is_mesh_fwd_disabled++;
1182 		return;
1183 	}
1184 	mcopy = m_dup(m, M_NOWAIT);
1185 	if (mcopy == NULL) {
1186 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1187 		    "%s", "frame not fwd'd, cannot dup");
1188 		vap->iv_stats.is_mesh_fwd_nobuf++;
1189 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1190 		return;
1191 	}
1192 	mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
1193 	    sizeof(struct ieee80211_meshcntl));
1194 	if (mcopy == NULL) {
1195 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1196 		    "%s", "frame not fwd'd, too short");
1197 		vap->iv_stats.is_mesh_fwd_tooshort++;
1198 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1199 		m_freem(mcopy);
1200 		return;
1201 	}
1202 	whcopy = mtod(mcopy, struct ieee80211_frame *);
1203 	mccopy = (struct ieee80211_meshcntl *)
1204 	    (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
1205 	/* XXX clear other bits? */
1206 	whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
1207 	IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
1208 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1209 		ni = ieee80211_ref_node(vap->iv_bss);
1210 		mcopy->m_flags |= M_MCAST;
1211 	} else {
1212 		ni = ieee80211_mesh_find_txnode(vap, whcopy->i_addr3);
1213 		if (ni == NULL) {
1214 			/*
1215 			 * [Optional] any of the following three actions:
1216 			 * o silently discard
1217 			 * o trigger a path discovery
1218 			 * o inform TA that meshDA is unknown.
1219 			 */
1220 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1221 			    "%s", "frame not fwd'd, no path");
1222 			ms->ms_ppath->mpp_senderror(vap, whcopy->i_addr3, NULL,
1223 			    IEEE80211_REASON_MESH_PERR_NO_FI);
1224 			vap->iv_stats.is_mesh_fwd_nopath++;
1225 			m_freem(mcopy);
1226 			return;
1227 		}
1228 		IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
1229 	}
1230 	KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
1231 	mccopy->mc_ttl--;
1232 
1233 	/* XXX calculate priority so drivers can find the tx queue */
1234 	M_WME_SETAC(mcopy, WME_AC_BE);
1235 
1236 	/* XXX do we know m_nextpkt is NULL? */
1237 	mcopy->m_pkthdr.rcvif = (void *) ni;
1238 
1239 	/*
1240 	 * XXX this bypasses all of the VAP TX handling; it passes frames
1241 	 * directly to the parent interface.
1242 	 *
1243 	 * Because of this, there's no TX lock being held as there's no
1244 	 * encaps state being used.
1245 	 *
1246 	 * Doing a direct parent transmit may not be the correct thing
1247 	 * to do here; we'll have to re-think this soon.
1248 	 */
1249 	IEEE80211_TX_LOCK(ic);
1250 	err = ieee80211_parent_xmitpkt(ic, mcopy);
1251 	IEEE80211_TX_UNLOCK(ic);
1252 	if (err != 0) {
1253 		/* NB: IFQ_HANDOFF reclaims mbuf */
1254 		ieee80211_free_node(ni);
1255 	} else {
1256 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1257 	}
1258 }
1259 
1260 static struct mbuf *
1261 mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
1262 {
1263 #define	WHDIR(wh)	((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
1264 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1265 	uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
1266 		  sizeof(struct ieee80211_meshcntl_ae10)];
1267 	const struct ieee80211_qosframe_addr4 *wh;
1268 	const struct ieee80211_meshcntl_ae10 *mc;
1269 	struct ether_header *eh;
1270 	struct llc *llc;
1271 	int ae;
1272 
1273 	if (m->m_len < hdrlen + sizeof(*llc) &&
1274 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
1275 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
1276 		    "discard data frame: %s", "m_pullup failed");
1277 		vap->iv_stats.is_rx_tooshort++;
1278 		return NULL;
1279 	}
1280 	memcpy(b, mtod(m, caddr_t), hdrlen);
1281 	wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
1282 	mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
1283 	KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
1284 		WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
1285 	    ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1286 
1287 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
1288 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
1289 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
1290 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
1291 	    /* NB: preserve AppleTalk frames that have a native SNAP hdr */
1292 	    !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
1293 	      llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
1294 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
1295 		llc = NULL;
1296 	} else {
1297 		m_adj(m, hdrlen - sizeof(*eh));
1298 	}
1299 	eh = mtod(m, struct ether_header *);
1300 	ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1301 	if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
1302 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
1303 		if (ae == IEEE80211_MESH_AE_00) {
1304 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
1305 		} else if (ae == IEEE80211_MESH_AE_01) {
1306 			IEEE80211_ADDR_COPY(eh->ether_shost,
1307 			    MC01(mc)->mc_addr4);
1308 		} else {
1309 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1310 			    (const struct ieee80211_frame *)wh, NULL,
1311 			    "bad AE %d", ae);
1312 			vap->iv_stats.is_mesh_badae++;
1313 			m_freem(m);
1314 			return NULL;
1315 		}
1316 	} else {
1317 		if (ae == IEEE80211_MESH_AE_00) {
1318 			IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
1319 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
1320 		} else if (ae == IEEE80211_MESH_AE_10) {
1321 			IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr5);
1322 			IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr6);
1323 		} else {
1324 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1325 			    (const struct ieee80211_frame *)wh, NULL,
1326 			    "bad AE %d", ae);
1327 			vap->iv_stats.is_mesh_badae++;
1328 			m_freem(m);
1329 			return NULL;
1330 		}
1331 	}
1332 #ifndef __NO_STRICT_ALIGNMENT
1333 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
1334 		m = ieee80211_realign(vap, m, sizeof(*eh));
1335 		if (m == NULL)
1336 			return NULL;
1337 	}
1338 #endif /* !__NO_STRICT_ALIGNMENT */
1339 	if (llc != NULL) {
1340 		eh = mtod(m, struct ether_header *);
1341 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
1342 	}
1343 	return m;
1344 #undef	WDIR
1345 #undef	MC01
1346 }
1347 
1348 /*
1349  * Return non-zero if the unicast mesh data frame should be processed
1350  * locally.  Frames that are not proxy'd have our address, otherwise
1351  * we need to consult the routing table to look for a proxy entry.
1352  */
1353 static __inline int
1354 mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
1355     const struct ieee80211_meshcntl *mc)
1356 {
1357 	int ae = mc->mc_flags & 3;
1358 
1359 	KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
1360 	    ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1361 	KASSERT(ae == IEEE80211_MESH_AE_00 || ae == IEEE80211_MESH_AE_10,
1362 	    ("bad AE %d", ae));
1363 	if (ae == IEEE80211_MESH_AE_10) {	/* ucast w/ proxy */
1364 		const struct ieee80211_meshcntl_ae10 *mc10 =
1365 		    (const struct ieee80211_meshcntl_ae10 *) mc;
1366 		struct ieee80211_mesh_route *rt =
1367 		    ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1368 		/* check for proxy route to ourself */
1369 		return (rt != NULL &&
1370 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
1371 	} else					/* ucast w/o proxy */
1372 		return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
1373 }
1374 
1375 /*
1376  * Verifies transmitter, updates lifetime, precursor list and forwards data.
1377  * > 0 means we have forwarded data and no need to process locally
1378  * == 0 means we want to process locally (and we may have forwarded data
1379  * < 0 means there was an error and data should be discarded
1380  */
1381 static int
1382 mesh_recv_indiv_data_to_fwrd(struct ieee80211vap *vap, struct mbuf *m,
1383     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1384 {
1385 	struct ieee80211_qosframe_addr4 *qwh;
1386 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1387 	struct ieee80211_mesh_route *rt_meshda, *rt_meshsa;
1388 
1389 	/* This is called from the RX path - don't hold this lock */
1390 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1391 
1392 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1393 
1394 	/*
1395 	 * TODO:
1396 	 * o verify addr2 is  a legitimate transmitter
1397 	 * o lifetime of precursor of addr3 (addr2) is max(init, curr)
1398 	 * o lifetime of precursor of addr4 (nexthop) is max(init, curr)
1399 	 */
1400 
1401 	/* set lifetime of addr3 (meshDA) to initial value */
1402 	rt_meshda = ieee80211_mesh_rt_find(vap, qwh->i_addr3);
1403 	if (rt_meshda == NULL) {
1404 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, qwh->i_addr2,
1405 		    "no route to meshDA(%6D)", qwh->i_addr3, ":");
1406 		/*
1407 		 * [Optional] any of the following three actions:
1408 		 * o silently discard 				[X]
1409 		 * o trigger a path discovery			[ ]
1410 		 * o inform TA that meshDA is unknown.		[ ]
1411 		 */
1412 		/* XXX: stats */
1413 		return (-1);
1414 	}
1415 
1416 	ieee80211_mesh_rt_update(rt_meshda, ticks_to_msecs(
1417 	    ms->ms_ppath->mpp_inact));
1418 
1419 	/* set lifetime of addr4 (meshSA) to initial value */
1420 	rt_meshsa = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1421 	KASSERT(rt_meshsa != NULL, ("no route"));
1422 	ieee80211_mesh_rt_update(rt_meshsa, ticks_to_msecs(
1423 	    ms->ms_ppath->mpp_inact));
1424 
1425 	mesh_forward(vap, m, mc);
1426 	return (1); /* dont process locally */
1427 }
1428 
1429 /*
1430  * Verifies transmitter, updates lifetime, precursor list and process data
1431  * locally, if data is proxy with AE = 10 it could mean data should go
1432  * on another mesh path or data should be forwarded to the DS.
1433  *
1434  * > 0 means we have forwarded data and no need to process locally
1435  * == 0 means we want to process locally (and we may have forwarded data
1436  * < 0 means there was an error and data should be discarded
1437  */
1438 static int
1439 mesh_recv_indiv_data_to_me(struct ieee80211vap *vap, struct mbuf *m,
1440     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1441 {
1442 	struct ieee80211_qosframe_addr4 *qwh;
1443 	const struct ieee80211_meshcntl_ae10 *mc10;
1444 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1445 	struct ieee80211_mesh_route *rt;
1446 	int ae;
1447 
1448 	/* This is called from the RX path - don't hold this lock */
1449 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1450 
1451 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1452 	mc10 = (const struct ieee80211_meshcntl_ae10 *)mc;
1453 
1454 	/*
1455 	 * TODO:
1456 	 * o verify addr2 is  a legitimate transmitter
1457 	 * o lifetime of precursor entry is max(init, curr)
1458 	 */
1459 
1460 	/* set lifetime of addr4 (meshSA) to initial value */
1461 	rt = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1462 	KASSERT(rt != NULL, ("no route"));
1463 	ieee80211_mesh_rt_update(rt, ticks_to_msecs(ms->ms_ppath->mpp_inact));
1464 	rt = NULL;
1465 
1466 	ae = mc10->mc_flags & IEEE80211_MESH_AE_MASK;
1467 	KASSERT(ae == IEEE80211_MESH_AE_00 ||
1468 	    ae == IEEE80211_MESH_AE_10, ("bad AE %d", ae));
1469 	if (ae == IEEE80211_MESH_AE_10) {
1470 		if (IEEE80211_ADDR_EQ(mc10->mc_addr5, qwh->i_addr3)) {
1471 			return (0); /* process locally */
1472 		}
1473 
1474 		rt =  ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1475 		if (rt != NULL &&
1476 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) &&
1477 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) == 0) {
1478 			/*
1479 			 * Forward on another mesh-path, according to
1480 			 * amendment as specified in 9.32.4.1
1481 			 */
1482 			IEEE80211_ADDR_COPY(qwh->i_addr3, mc10->mc_addr5);
1483 			mesh_forward(vap, m,
1484 			    (const struct ieee80211_meshcntl *)mc10);
1485 			return (1); /* dont process locally */
1486 		}
1487 		/*
1488 		 * All other cases: forward of MSDUs from the MBSS to DS indiv.
1489 		 * addressed according to 13.11.3.2.
1490 		 */
1491 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT, qwh->i_addr2,
1492 		    "forward frame to DS, SA(%6D) DA(%6D)",
1493 		    mc10->mc_addr6, ":", mc10->mc_addr5, ":");
1494 	}
1495 	return (0); /* process locally */
1496 }
1497 
1498 /*
1499  * Try to forward the group addressed data on to other mesh STAs, and
1500  * also to the DS.
1501  *
1502  * > 0 means we have forwarded data and no need to process locally
1503  * == 0 means we want to process locally (and we may have forwarded data
1504  * < 0 means there was an error and data should be discarded
1505  */
1506 static int
1507 mesh_recv_group_data(struct ieee80211vap *vap, struct mbuf *m,
1508     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1509 {
1510 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1511 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1512 
1513 	/* This is called from the RX path - don't hold this lock */
1514 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1515 
1516 	mesh_forward(vap, m, mc);
1517 
1518 	if(mc->mc_ttl > 0) {
1519 		if (mc->mc_flags & IEEE80211_MESH_AE_01) {
1520 			/*
1521 			 * Forward of MSDUs from the MBSS to DS group addressed
1522 			 * (according to 13.11.3.2)
1523 			 * This happens by delivering the packet, and a bridge
1524 			 * will sent it on another port member.
1525 			 */
1526 			if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE &&
1527 			    ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
1528 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH,
1529 				    MC01(mc)->mc_addr4, "%s",
1530 				    "forward from MBSS to the DS");
1531 		}
1532 	}
1533 	return (0); /* process locally */
1534 #undef	MC01
1535 }
1536 
1537 static int
1538 mesh_input(struct ieee80211_node *ni, struct mbuf *m,
1539     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1540 {
1541 #define	HAS_SEQ(type)	((type & 0x4) == 0)
1542 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1543 #define	MC10(mc)	((const struct ieee80211_meshcntl_ae10 *)mc)
1544 	struct ieee80211vap *vap = ni->ni_vap;
1545 	struct ieee80211com *ic = ni->ni_ic;
1546 	struct ifnet *ifp = vap->iv_ifp;
1547 	struct ieee80211_frame *wh;
1548 	const struct ieee80211_meshcntl *mc;
1549 	int hdrspace, meshdrlen, need_tap, error;
1550 	uint8_t dir, type, subtype, ae;
1551 	uint32_t seq;
1552 	const uint8_t *addr;
1553 	uint8_t qos[2];
1554 	ieee80211_seq rxseq;
1555 
1556 	KASSERT(ni != NULL, ("null node"));
1557 	ni->ni_inact = ni->ni_inact_reload;
1558 
1559 	need_tap = 1;			/* mbuf need to be tapped. */
1560 	type = -1;			/* undefined */
1561 
1562 	/* This is called from the RX path - don't hold this lock */
1563 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1564 
1565 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
1566 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1567 		    ni->ni_macaddr, NULL,
1568 		    "too short (1): len %u", m->m_pkthdr.len);
1569 		vap->iv_stats.is_rx_tooshort++;
1570 		goto out;
1571 	}
1572 	/*
1573 	 * Bit of a cheat here, we use a pointer for a 3-address
1574 	 * frame format but don't reference fields past outside
1575 	 * ieee80211_frame_min w/o first validating the data is
1576 	 * present.
1577 	*/
1578 	wh = mtod(m, struct ieee80211_frame *);
1579 
1580 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1581 	    IEEE80211_FC0_VERSION_0) {
1582 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1583 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
1584 		vap->iv_stats.is_rx_badversion++;
1585 		goto err;
1586 	}
1587 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1588 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1589 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1590 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1591 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1592 		ni->ni_noise = nf;
1593 		if (HAS_SEQ(type)) {
1594 			uint8_t tid = ieee80211_gettid(wh);
1595 
1596 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
1597 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
1598 				ic->ic_wme.wme_hipri_traffic++;
1599 			rxseq = le16toh(*(uint16_t *)wh->i_seq);
1600 			if (! ieee80211_check_rxseq(ni, wh)) {
1601 				/* duplicate, discard */
1602 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1603 				    wh->i_addr1, "duplicate",
1604 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
1605 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
1606 				    ni->ni_rxseqs[tid] >>
1607 				    IEEE80211_SEQ_SEQ_SHIFT,
1608 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
1609 				    ni->ni_rxseqs[tid] &
1610 				    IEEE80211_SEQ_FRAG_MASK,
1611 				    tid);
1612 				vap->iv_stats.is_rx_dup++;
1613 				IEEE80211_NODE_STAT(ni, rx_dup);
1614 				goto out;
1615 			}
1616 			ni->ni_rxseqs[tid] = rxseq;
1617 		}
1618 	}
1619 #ifdef IEEE80211_DEBUG
1620 	/*
1621 	 * It's easier, but too expensive, to simulate different mesh
1622 	 * topologies by consulting the ACL policy very early, so do this
1623 	 * only under DEBUG.
1624 	 *
1625 	 * NB: this check is also done upon peering link initiation.
1626 	 */
1627 	if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1628 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1629 		    wh, NULL, "%s", "disallowed by ACL");
1630 		vap->iv_stats.is_rx_acl++;
1631 		goto out;
1632 	}
1633 #endif
1634 	switch (type) {
1635 	case IEEE80211_FC0_TYPE_DATA:
1636 		if (ni == vap->iv_bss)
1637 			goto out;
1638 		if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
1639 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1640 			    ni->ni_macaddr, NULL,
1641 			    "peer link not yet established (%d)",
1642 			    ni->ni_mlstate);
1643 			vap->iv_stats.is_mesh_nolink++;
1644 			goto out;
1645 		}
1646 		if (dir != IEEE80211_FC1_DIR_FROMDS &&
1647 		    dir != IEEE80211_FC1_DIR_DSTODS) {
1648 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1649 			    wh, "data", "incorrect dir 0x%x", dir);
1650 			vap->iv_stats.is_rx_wrongdir++;
1651 			goto err;
1652 		}
1653 
1654 		/* All Mesh data frames are QoS subtype */
1655 		if (!HAS_SEQ(type)) {
1656 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1657 			    wh, "data", "incorrect subtype 0x%x", subtype);
1658 			vap->iv_stats.is_rx_badsubtype++;
1659 			goto err;
1660 		}
1661 
1662 		/*
1663 		 * Next up, any fragmentation.
1664 		 * XXX: we defrag before we even try to forward,
1665 		 * Mesh Control field is not present in sub-sequent
1666 		 * fragmented frames. This is in contrast to Draft 4.0.
1667 		 */
1668 		hdrspace = ieee80211_hdrspace(ic, wh);
1669 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1670 			m = ieee80211_defrag(ni, m, hdrspace);
1671 			if (m == NULL) {
1672 				/* Fragment dropped or frame not complete yet */
1673 				goto out;
1674 			}
1675 		}
1676 		wh = mtod(m, struct ieee80211_frame *); /* NB: after defrag */
1677 
1678 		/*
1679 		 * Now we have a complete Mesh Data frame.
1680 		 */
1681 
1682 		/*
1683 		 * Only fromDStoDS data frames use 4 address qos frames
1684 		 * as specified in amendment. Otherwise addr4 is located
1685 		 * in the Mesh Control field and a 3 address qos frame
1686 		 * is used.
1687 		 */
1688 		if (IEEE80211_IS_DSTODS(wh))
1689 			*(uint16_t *)qos = *(uint16_t *)
1690 			    ((struct ieee80211_qosframe_addr4 *)wh)->i_qos;
1691 		else
1692 			*(uint16_t *)qos = *(uint16_t *)
1693 			    ((struct ieee80211_qosframe *)wh)->i_qos;
1694 
1695 		/*
1696 		 * NB: The mesh STA sets the Mesh Control Present
1697 		 * subfield to 1 in the Mesh Data frame containing
1698 		 * an unfragmented MSDU, an A-MSDU, or the first
1699 		 * fragment of an MSDU.
1700 		 * After defrag it should always be present.
1701 		 */
1702 		if (!(qos[1] & IEEE80211_QOS_MC)) {
1703 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1704 			    ni->ni_macaddr, NULL,
1705 			    "%s", "Mesh control field not present");
1706 			vap->iv_stats.is_rx_elem_missing++; /* XXX: kinda */
1707 			goto err;
1708 		}
1709 
1710 		/* pull up enough to get to the mesh control */
1711 		if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
1712 		    (m = m_pullup(m, hdrspace +
1713 		        sizeof(struct ieee80211_meshcntl))) == NULL) {
1714 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1715 			    ni->ni_macaddr, NULL,
1716 			    "data too short: expecting %u", hdrspace);
1717 			vap->iv_stats.is_rx_tooshort++;
1718 			goto out;		/* XXX */
1719 		}
1720 		/*
1721 		 * Now calculate the full extent of the headers. Note
1722 		 * mesh_decap will pull up anything we didn't get
1723 		 * above when it strips the 802.11 headers.
1724 		 */
1725 		mc = (const struct ieee80211_meshcntl *)
1726 		    (mtod(m, const uint8_t *) + hdrspace);
1727 		ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1728 		meshdrlen = sizeof(struct ieee80211_meshcntl) +
1729 		    ae * IEEE80211_ADDR_LEN;
1730 		hdrspace += meshdrlen;
1731 
1732 		/* pull complete hdrspace = ieee80211_hdrspace + meshcontrol */
1733 		if ((meshdrlen > sizeof(struct ieee80211_meshcntl)) &&
1734 		    (m->m_len < hdrspace) &&
1735 		    ((m = m_pullup(m, hdrspace)) == NULL)) {
1736 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1737 			    ni->ni_macaddr, NULL,
1738 			    "data too short: expecting %u", hdrspace);
1739 			vap->iv_stats.is_rx_tooshort++;
1740 			goto out;		/* XXX */
1741 		}
1742 		/* XXX: are we sure there is no reallocating after m_pullup? */
1743 
1744 		seq = LE_READ_4(mc->mc_seq);
1745 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1746 			addr = wh->i_addr3;
1747 		else if (ae == IEEE80211_MESH_AE_01)
1748 			addr = MC01(mc)->mc_addr4;
1749 		else
1750 			addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
1751 		if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
1752 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1753 			    addr, "data", "%s", "not to me");
1754 			vap->iv_stats.is_rx_wrongbss++;	/* XXX kinda */
1755 			goto out;
1756 		}
1757 		if (mesh_checkpseq(vap, addr, seq) != 0) {
1758 			vap->iv_stats.is_rx_dup++;
1759 			goto out;
1760 		}
1761 
1762 		/* This code "routes" the frame to the right control path */
1763 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1764 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr3))
1765 				error =
1766 				    mesh_recv_indiv_data_to_me(vap, m, wh, mc);
1767 			else if (IEEE80211_IS_MULTICAST(wh->i_addr3))
1768 				error = mesh_recv_group_data(vap, m, wh, mc);
1769 			else
1770 				error = mesh_recv_indiv_data_to_fwrd(vap, m,
1771 				    wh, mc);
1772 		} else
1773 			error = mesh_recv_group_data(vap, m, wh, mc);
1774 		if (error < 0)
1775 			goto err;
1776 		else if (error > 0)
1777 			goto out;
1778 
1779 		if (ieee80211_radiotap_active_vap(vap))
1780 			ieee80211_radiotap_rx(vap, m);
1781 		need_tap = 0;
1782 
1783 		/*
1784 		 * Finally, strip the 802.11 header.
1785 		 */
1786 		m = mesh_decap(vap, m, hdrspace, meshdrlen);
1787 		if (m == NULL) {
1788 			/* XXX mask bit to check for both */
1789 			/* don't count Null data frames as errors */
1790 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
1791 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
1792 				goto out;
1793 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1794 			    ni->ni_macaddr, "data", "%s", "decap error");
1795 			vap->iv_stats.is_rx_decap++;
1796 			IEEE80211_NODE_STAT(ni, rx_decap);
1797 			goto err;
1798 		}
1799 		if (qos[0] & IEEE80211_QOS_AMSDU) {
1800 			m = ieee80211_decap_amsdu(ni, m);
1801 			if (m == NULL)
1802 				return IEEE80211_FC0_TYPE_DATA;
1803 		}
1804 		ieee80211_deliver_data(vap, ni, m);
1805 		return type;
1806 	case IEEE80211_FC0_TYPE_MGT:
1807 		vap->iv_stats.is_rx_mgmt++;
1808 		IEEE80211_NODE_STAT(ni, rx_mgmt);
1809 		if (dir != IEEE80211_FC1_DIR_NODS) {
1810 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1811 			    wh, "mgt", "incorrect dir 0x%x", dir);
1812 			vap->iv_stats.is_rx_wrongdir++;
1813 			goto err;
1814 		}
1815 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
1816 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1817 			    ni->ni_macaddr, "mgt", "too short: len %u",
1818 			    m->m_pkthdr.len);
1819 			vap->iv_stats.is_rx_tooshort++;
1820 			goto out;
1821 		}
1822 #ifdef IEEE80211_DEBUG
1823 		if ((ieee80211_msg_debug(vap) &&
1824 		    (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
1825 		    ieee80211_msg_dumppkts(vap)) {
1826 			if_printf(ifp, "received %s from %s rssi %d\n",
1827 			    ieee80211_mgt_subtype_name[subtype >>
1828 			    IEEE80211_FC0_SUBTYPE_SHIFT],
1829 			    ether_sprintf(wh->i_addr2), rssi);
1830 		}
1831 #endif
1832 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1833 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1834 			    wh, NULL, "%s", "WEP set but not permitted");
1835 			vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
1836 			goto out;
1837 		}
1838 		vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
1839 		goto out;
1840 	case IEEE80211_FC0_TYPE_CTL:
1841 		vap->iv_stats.is_rx_ctl++;
1842 		IEEE80211_NODE_STAT(ni, rx_ctrl);
1843 		goto out;
1844 	default:
1845 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1846 		    wh, "bad", "frame type 0x%x", type);
1847 		/* should not come here */
1848 		break;
1849 	}
1850 err:
1851 	if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1852 out:
1853 	if (m != NULL) {
1854 		if (need_tap && ieee80211_radiotap_active_vap(vap))
1855 			ieee80211_radiotap_rx(vap, m);
1856 		m_freem(m);
1857 	}
1858 	return type;
1859 #undef	HAS_SEQ
1860 #undef	MC01
1861 #undef	MC10
1862 }
1863 
1864 static void
1865 mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1866     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1867 {
1868 	struct ieee80211vap *vap = ni->ni_vap;
1869 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1870 	struct ieee80211com *ic = ni->ni_ic;
1871 	struct ieee80211_channel *rxchan = ic->ic_curchan;
1872 	struct ieee80211_frame *wh;
1873 	struct ieee80211_mesh_route *rt;
1874 	uint8_t *frm, *efrm;
1875 
1876 	wh = mtod(m0, struct ieee80211_frame *);
1877 	frm = (uint8_t *)&wh[1];
1878 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1879 	switch (subtype) {
1880 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1881 	case IEEE80211_FC0_SUBTYPE_BEACON:
1882 	{
1883 		struct ieee80211_scanparams scan;
1884 		struct ieee80211_channel *c;
1885 		/*
1886 		 * We process beacon/probe response
1887 		 * frames to discover neighbors.
1888 		 */
1889 		if (rxs != NULL) {
1890 			c = ieee80211_lookup_channel_rxstatus(vap, rxs);
1891 			if (c != NULL)
1892 				rxchan = c;
1893 		}
1894 		if (ieee80211_parse_beacon(ni, m0, rxchan, &scan) != 0)
1895 			return;
1896 		/*
1897 		 * Count frame now that we know it's to be processed.
1898 		 */
1899 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1900 			vap->iv_stats.is_rx_beacon++;	/* XXX remove */
1901 			IEEE80211_NODE_STAT(ni, rx_beacons);
1902 		} else
1903 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1904 		/*
1905 		 * If scanning, just pass information to the scan module.
1906 		 */
1907 		if (ic->ic_flags & IEEE80211_F_SCAN) {
1908 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1909 				/*
1910 				 * Actively scanning a channel marked passive;
1911 				 * send a probe request now that we know there
1912 				 * is 802.11 traffic present.
1913 				 *
1914 				 * XXX check if the beacon we recv'd gives
1915 				 * us what we need and suppress the probe req
1916 				 */
1917 				ieee80211_probe_curchan(vap, 1);
1918 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1919 			}
1920 			ieee80211_add_scan(vap, rxchan, &scan, wh,
1921 			    subtype, rssi, nf);
1922 			return;
1923 		}
1924 
1925 		/* The rest of this code assumes we are running */
1926 		if (vap->iv_state != IEEE80211_S_RUN)
1927 			return;
1928 		/*
1929 		 * Ignore non-mesh STAs.
1930 		 */
1931 		if ((scan.capinfo &
1932 		     (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
1933 		    scan.meshid == NULL || scan.meshconf == NULL) {
1934 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1935 			    wh, "beacon", "%s", "not a mesh sta");
1936 			vap->iv_stats.is_mesh_wrongmesh++;
1937 			return;
1938 		}
1939 		/*
1940 		 * Ignore STAs for other mesh networks.
1941 		 */
1942 		if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
1943 		    mesh_verify_meshconf(vap, scan.meshconf)) {
1944 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1945 			    wh, "beacon", "%s", "not for our mesh");
1946 			vap->iv_stats.is_mesh_wrongmesh++;
1947 			return;
1948 		}
1949 		/*
1950 		 * Peer only based on the current ACL policy.
1951 		 */
1952 		if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1953 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1954 			    wh, NULL, "%s", "disallowed by ACL");
1955 			vap->iv_stats.is_rx_acl++;
1956 			return;
1957 		}
1958 		/*
1959 		 * Do neighbor discovery.
1960 		 */
1961 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
1962 			/*
1963 			 * Create a new entry in the neighbor table.
1964 			 */
1965 			ni = ieee80211_add_neighbor(vap, wh, &scan);
1966 		}
1967 		/*
1968 		 * Automatically peer with discovered nodes if possible.
1969 		 */
1970 		if (ni != vap->iv_bss &&
1971 		    (ms->ms_flags & IEEE80211_MESHFLAGS_AP)) {
1972 			switch (ni->ni_mlstate) {
1973 			case IEEE80211_NODE_MESH_IDLE:
1974 			{
1975 				uint16_t args[1];
1976 
1977 				/* Wait for backoff callout to reset counter */
1978 				if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
1979 					return;
1980 
1981 				ni->ni_mlpid = mesh_generateid(vap);
1982 				if (ni->ni_mlpid == 0)
1983 					return;
1984 				mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
1985 				args[0] = ni->ni_mlpid;
1986 				ieee80211_send_action(ni,
1987 				IEEE80211_ACTION_CAT_SELF_PROT,
1988 				IEEE80211_ACTION_MESHPEERING_OPEN, args);
1989 				ni->ni_mlrcnt = 0;
1990 				mesh_peer_timeout_setup(ni);
1991 				break;
1992 			}
1993 			case IEEE80211_NODE_MESH_ESTABLISHED:
1994 			{
1995 				/*
1996 				 * Valid beacon from a peer mesh STA
1997 				 * bump TA lifetime
1998 				 */
1999 				rt = ieee80211_mesh_rt_find(vap, wh->i_addr2);
2000 				if(rt != NULL) {
2001 					ieee80211_mesh_rt_update(rt,
2002 					    ticks_to_msecs(
2003 					    ms->ms_ppath->mpp_inact));
2004 				}
2005 				break;
2006 			}
2007 			default:
2008 				break; /* ignore */
2009 			}
2010 		}
2011 		break;
2012 	}
2013 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2014 	{
2015 		uint8_t *ssid, *meshid, *rates, *xrates;
2016 		uint8_t *sfrm;
2017 
2018 		if (vap->iv_state != IEEE80211_S_RUN) {
2019 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2020 			    wh, NULL, "wrong state %s",
2021 			    ieee80211_state_name[vap->iv_state]);
2022 			vap->iv_stats.is_rx_mgtdiscard++;
2023 			return;
2024 		}
2025 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2026 			/* frame must be directed */
2027 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2028 			    wh, NULL, "%s", "not unicast");
2029 			vap->iv_stats.is_rx_mgtdiscard++;	/* XXX stat */
2030 			return;
2031 		}
2032 		/*
2033 		 * prreq frame format
2034 		 *      [tlv] ssid
2035 		 *      [tlv] supported rates
2036 		 *      [tlv] extended supported rates
2037 		 *	[tlv] mesh id
2038 		 */
2039 		ssid = meshid = rates = xrates = NULL;
2040 		sfrm = frm;
2041 		while (efrm - frm > 1) {
2042 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2043 			switch (*frm) {
2044 			case IEEE80211_ELEMID_SSID:
2045 				ssid = frm;
2046 				break;
2047 			case IEEE80211_ELEMID_RATES:
2048 				rates = frm;
2049 				break;
2050 			case IEEE80211_ELEMID_XRATES:
2051 				xrates = frm;
2052 				break;
2053 			case IEEE80211_ELEMID_MESHID:
2054 				meshid = frm;
2055 				break;
2056 			}
2057 			frm += frm[1] + 2;
2058 		}
2059 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2060 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2061 		if (xrates != NULL)
2062 			IEEE80211_VERIFY_ELEMENT(xrates,
2063 			    IEEE80211_RATE_MAXSIZE - rates[1], return);
2064 		if (meshid != NULL) {
2065 			IEEE80211_VERIFY_ELEMENT(meshid,
2066 			    IEEE80211_MESHID_LEN, return);
2067 			/* NB: meshid, not ssid */
2068 			IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
2069 		}
2070 
2071 		/* XXX find a better class or define it's own */
2072 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
2073 		    "%s", "recv probe req");
2074 		/*
2075 		 * Some legacy 11b clients cannot hack a complete
2076 		 * probe response frame.  When the request includes
2077 		 * only a bare-bones rate set, communicate this to
2078 		 * the transmit side.
2079 		 */
2080 		ieee80211_send_proberesp(vap, wh->i_addr2, 0);
2081 		break;
2082 	}
2083 
2084 	case IEEE80211_FC0_SUBTYPE_ACTION:
2085 	case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2086 		if (ni == vap->iv_bss) {
2087 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2088 			    wh, NULL, "%s", "unknown node");
2089 			vap->iv_stats.is_rx_mgtdiscard++;
2090 		} else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2091 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2092 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2093 			    wh, NULL, "%s", "not for us");
2094 			vap->iv_stats.is_rx_mgtdiscard++;
2095 		} else if (vap->iv_state != IEEE80211_S_RUN) {
2096 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2097 			    wh, NULL, "wrong state %s",
2098 			    ieee80211_state_name[vap->iv_state]);
2099 			vap->iv_stats.is_rx_mgtdiscard++;
2100 		} else {
2101 			if (ieee80211_parse_action(ni, m0) == 0)
2102 				(void)ic->ic_recv_action(ni, wh, frm, efrm);
2103 		}
2104 		break;
2105 
2106 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2107 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2108 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2109 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2110 	case IEEE80211_FC0_SUBTYPE_ATIM:
2111 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
2112 	case IEEE80211_FC0_SUBTYPE_AUTH:
2113 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
2114 		IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2115 		    wh, NULL, "%s", "not handled");
2116 		vap->iv_stats.is_rx_mgtdiscard++;
2117 		break;
2118 
2119 	default:
2120 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2121 		    wh, "mgt", "subtype 0x%x not handled", subtype);
2122 		vap->iv_stats.is_rx_badsubtype++;
2123 		break;
2124 	}
2125 }
2126 
2127 static void
2128 mesh_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2129 {
2130 
2131 	switch (subtype) {
2132 	case IEEE80211_FC0_SUBTYPE_BAR:
2133 		ieee80211_recv_bar(ni, m);
2134 		break;
2135 	}
2136 }
2137 
2138 /*
2139  * Parse meshpeering action ie's for MPM frames
2140  */
2141 static const struct ieee80211_meshpeer_ie *
2142 mesh_parse_meshpeering_action(struct ieee80211_node *ni,
2143 	const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2144 	const uint8_t *frm, const uint8_t *efrm,
2145 	struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
2146 {
2147 	struct ieee80211vap *vap = ni->ni_vap;
2148 	const struct ieee80211_meshpeer_ie *mpie;
2149 	uint16_t args[3];
2150 	const uint8_t *meshid, *meshconf, *meshpeer;
2151 	uint8_t sendclose = 0; /* 1 = MPM frame rejected, close will be sent */
2152 
2153 	meshid = meshconf = meshpeer = NULL;
2154 	while (efrm - frm > 1) {
2155 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
2156 		switch (*frm) {
2157 		case IEEE80211_ELEMID_MESHID:
2158 			meshid = frm;
2159 			break;
2160 		case IEEE80211_ELEMID_MESHCONF:
2161 			meshconf = frm;
2162 			break;
2163 		case IEEE80211_ELEMID_MESHPEER:
2164 			meshpeer = frm;
2165 			mpie = (const struct ieee80211_meshpeer_ie *) frm;
2166 			memset(mp, 0, sizeof(*mp));
2167 			mp->peer_len = mpie->peer_len;
2168 			mp->peer_proto = LE_READ_2(&mpie->peer_proto);
2169 			mp->peer_llinkid = LE_READ_2(&mpie->peer_llinkid);
2170 			switch (subtype) {
2171 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2172 				mp->peer_linkid =
2173 				    LE_READ_2(&mpie->peer_linkid);
2174 				break;
2175 			case IEEE80211_ACTION_MESHPEERING_CLOSE:
2176 				/* NB: peer link ID is optional */
2177 				if (mpie->peer_len ==
2178 				    (IEEE80211_MPM_BASE_SZ + 2)) {
2179 					mp->peer_linkid = 0;
2180 					mp->peer_rcode =
2181 					    LE_READ_2(&mpie->peer_linkid);
2182 				} else {
2183 					mp->peer_linkid =
2184 					    LE_READ_2(&mpie->peer_linkid);
2185 					mp->peer_rcode =
2186 					    LE_READ_2(&mpie->peer_rcode);
2187 				}
2188 				break;
2189 			}
2190 			break;
2191 		}
2192 		frm += frm[1] + 2;
2193 	}
2194 
2195 	/*
2196 	 * Verify the contents of the frame.
2197 	 * If it fails validation, close the peer link.
2198 	 */
2199 	if (mesh_verify_meshpeer(vap, subtype, (const uint8_t *)mp)) {
2200 		sendclose = 1;
2201 		IEEE80211_DISCARD(vap,
2202 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2203 		    wh, NULL, "%s", "MPM validation failed");
2204 	}
2205 
2206 	/* If meshid is not the same reject any frames type. */
2207 	if (sendclose == 0 && mesh_verify_meshid(vap, meshid)) {
2208 		sendclose = 1;
2209 		IEEE80211_DISCARD(vap,
2210 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2211 		    wh, NULL, "%s", "not for our mesh");
2212 		if (subtype == IEEE80211_ACTION_MESHPEERING_CLOSE) {
2213 			/*
2214 			 * Standard not clear about this, if we dont ignore
2215 			 * there will be an endless loop between nodes sending
2216 			 * CLOSE frames between each other with wrong meshid.
2217 			 * Discard and timers will bring FSM to IDLE state.
2218 			 */
2219 			return NULL;
2220 		}
2221 	}
2222 
2223 	/*
2224 	 * Close frames are accepted if meshid is the same.
2225 	 * Verify the other two types.
2226 	 */
2227 	if (sendclose == 0 && subtype != IEEE80211_ACTION_MESHPEERING_CLOSE &&
2228 	    mesh_verify_meshconf(vap, meshconf)) {
2229 		sendclose = 1;
2230 		IEEE80211_DISCARD(vap,
2231 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2232 		    wh, NULL, "%s", "configuration missmatch");
2233 	}
2234 
2235 	if (sendclose) {
2236 		vap->iv_stats.is_rx_mgtdiscard++;
2237 		switch (ni->ni_mlstate) {
2238 		case IEEE80211_NODE_MESH_IDLE:
2239 		case IEEE80211_NODE_MESH_ESTABLISHED:
2240 		case IEEE80211_NODE_MESH_HOLDING:
2241 			/* ignore */
2242 			break;
2243 		case IEEE80211_NODE_MESH_OPENSNT:
2244 		case IEEE80211_NODE_MESH_OPENRCV:
2245 		case IEEE80211_NODE_MESH_CONFIRMRCV:
2246 			args[0] = ni->ni_mlpid;
2247 			args[1] = ni->ni_mllid;
2248 			/* Reason codes for rejection */
2249 			switch (subtype) {
2250 			case IEEE80211_ACTION_MESHPEERING_OPEN:
2251 				args[2] = IEEE80211_REASON_MESH_CPVIOLATION;
2252 				break;
2253 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2254 				args[2] = IEEE80211_REASON_MESH_INCONS_PARAMS;
2255 				break;
2256 			}
2257 			ieee80211_send_action(ni,
2258 			    IEEE80211_ACTION_CAT_SELF_PROT,
2259 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2260 			    args);
2261 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2262 			mesh_peer_timeout_setup(ni);
2263 			break;
2264 		}
2265 		return NULL;
2266 	}
2267 
2268 	return (const struct ieee80211_meshpeer_ie *) mp;
2269 }
2270 
2271 static int
2272 mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
2273 	const struct ieee80211_frame *wh,
2274 	const uint8_t *frm, const uint8_t *efrm)
2275 {
2276 	struct ieee80211vap *vap = ni->ni_vap;
2277 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2278 	struct ieee80211_meshpeer_ie ie;
2279 	const struct ieee80211_meshpeer_ie *meshpeer;
2280 	uint16_t args[3];
2281 
2282 	/* +2+2 for action + code + capabilites */
2283 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
2284 	    IEEE80211_ACTION_MESHPEERING_OPEN);
2285 	if (meshpeer == NULL) {
2286 		return 0;
2287 	}
2288 
2289 	/* XXX move up */
2290 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2291 	    "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
2292 
2293 	switch (ni->ni_mlstate) {
2294 	case IEEE80211_NODE_MESH_IDLE:
2295 		/* Reject open request if reached our maximum neighbor count */
2296 		if (ms->ms_neighbors >= IEEE80211_MESH_MAX_NEIGHBORS) {
2297 			args[0] = meshpeer->peer_llinkid;
2298 			args[1] = 0;
2299 			args[2] = IEEE80211_REASON_MESH_MAX_PEERS;
2300 			ieee80211_send_action(ni,
2301 			    IEEE80211_ACTION_CAT_SELF_PROT,
2302 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2303 			    args);
2304 			/* stay in IDLE state */
2305 			return (0);
2306 		}
2307 		/* Open frame accepted */
2308 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2309 		ni->ni_mllid = meshpeer->peer_llinkid;
2310 		ni->ni_mlpid = mesh_generateid(vap);
2311 		if (ni->ni_mlpid == 0)
2312 			return 0;		/* XXX */
2313 		args[0] = ni->ni_mlpid;
2314 		/* Announce we're open too... */
2315 		ieee80211_send_action(ni,
2316 		    IEEE80211_ACTION_CAT_SELF_PROT,
2317 		    IEEE80211_ACTION_MESHPEERING_OPEN, args);
2318 		/* ...and confirm the link. */
2319 		args[0] = ni->ni_mlpid;
2320 		args[1] = ni->ni_mllid;
2321 		ieee80211_send_action(ni,
2322 		    IEEE80211_ACTION_CAT_SELF_PROT,
2323 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2324 		    args);
2325 		mesh_peer_timeout_setup(ni);
2326 		break;
2327 	case IEEE80211_NODE_MESH_OPENRCV:
2328 		/* Wrong Link ID */
2329 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2330 			args[0] = ni->ni_mllid;
2331 			args[1] = ni->ni_mlpid;
2332 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2333 			ieee80211_send_action(ni,
2334 			    IEEE80211_ACTION_CAT_SELF_PROT,
2335 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2336 			    args);
2337 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2338 			mesh_peer_timeout_setup(ni);
2339 			break;
2340 		}
2341 		/* Duplicate open, confirm again. */
2342 		args[0] = ni->ni_mlpid;
2343 		args[1] = ni->ni_mllid;
2344 		ieee80211_send_action(ni,
2345 		    IEEE80211_ACTION_CAT_SELF_PROT,
2346 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2347 		    args);
2348 		break;
2349 	case IEEE80211_NODE_MESH_OPENSNT:
2350 		ni->ni_mllid = meshpeer->peer_llinkid;
2351 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2352 		args[0] = ni->ni_mlpid;
2353 		args[1] = ni->ni_mllid;
2354 		ieee80211_send_action(ni,
2355 		    IEEE80211_ACTION_CAT_SELF_PROT,
2356 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2357 		    args);
2358 		/* NB: don't setup/clear any timeout */
2359 		break;
2360 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2361 		if (ni->ni_mlpid != meshpeer->peer_linkid ||
2362 		    ni->ni_mllid != meshpeer->peer_llinkid) {
2363 			args[0] = ni->ni_mlpid;
2364 			args[1] = ni->ni_mllid;
2365 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2366 			ieee80211_send_action(ni,
2367 			    IEEE80211_ACTION_CAT_SELF_PROT,
2368 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2369 			    args);
2370 			mesh_linkchange(ni,
2371 			    IEEE80211_NODE_MESH_HOLDING);
2372 			mesh_peer_timeout_setup(ni);
2373 			break;
2374 		}
2375 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2376 		ni->ni_mllid = meshpeer->peer_llinkid;
2377 		args[0] = ni->ni_mlpid;
2378 		args[1] = ni->ni_mllid;
2379 		ieee80211_send_action(ni,
2380 		    IEEE80211_ACTION_CAT_SELF_PROT,
2381 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2382 		    args);
2383 		mesh_peer_timeout_stop(ni);
2384 		break;
2385 	case IEEE80211_NODE_MESH_ESTABLISHED:
2386 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2387 			args[0] = ni->ni_mllid;
2388 			args[1] = ni->ni_mlpid;
2389 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2390 			ieee80211_send_action(ni,
2391 			    IEEE80211_ACTION_CAT_SELF_PROT,
2392 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2393 			    args);
2394 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2395 			mesh_peer_timeout_setup(ni);
2396 			break;
2397 		}
2398 		args[0] = ni->ni_mlpid;
2399 		args[1] = ni->ni_mllid;
2400 		ieee80211_send_action(ni,
2401 		    IEEE80211_ACTION_CAT_SELF_PROT,
2402 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2403 		    args);
2404 		break;
2405 	case IEEE80211_NODE_MESH_HOLDING:
2406 		args[0] = ni->ni_mlpid;
2407 		args[1] = meshpeer->peer_llinkid;
2408 		/* Standard not clear about what the reaason code should be */
2409 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2410 		ieee80211_send_action(ni,
2411 		    IEEE80211_ACTION_CAT_SELF_PROT,
2412 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2413 		    args);
2414 		break;
2415 	}
2416 	return 0;
2417 }
2418 
2419 static int
2420 mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
2421 	const struct ieee80211_frame *wh,
2422 	const uint8_t *frm, const uint8_t *efrm)
2423 {
2424 	struct ieee80211vap *vap = ni->ni_vap;
2425 	struct ieee80211_meshpeer_ie ie;
2426 	const struct ieee80211_meshpeer_ie *meshpeer;
2427 	uint16_t args[3];
2428 
2429 	/* +2+2+2+2 for action + code + capabilites + status code + AID */
2430 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
2431 	    IEEE80211_ACTION_MESHPEERING_CONFIRM);
2432 	if (meshpeer == NULL) {
2433 		return 0;
2434 	}
2435 
2436 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2437 	    "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
2438 	    meshpeer->peer_llinkid, meshpeer->peer_linkid);
2439 
2440 	switch (ni->ni_mlstate) {
2441 	case IEEE80211_NODE_MESH_OPENRCV:
2442 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2443 		mesh_peer_timeout_stop(ni);
2444 		break;
2445 	case IEEE80211_NODE_MESH_OPENSNT:
2446 		mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
2447 		mesh_peer_timeout_setup(ni);
2448 		break;
2449 	case IEEE80211_NODE_MESH_HOLDING:
2450 		args[0] = ni->ni_mlpid;
2451 		args[1] = meshpeer->peer_llinkid;
2452 		/* Standard not clear about what the reaason code should be */
2453 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2454 		ieee80211_send_action(ni,
2455 		    IEEE80211_ACTION_CAT_SELF_PROT,
2456 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2457 		    args);
2458 		break;
2459 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2460 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2461 			args[0] = ni->ni_mlpid;
2462 			args[1] = ni->ni_mllid;
2463 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2464 			ieee80211_send_action(ni,
2465 			    IEEE80211_ACTION_CAT_SELF_PROT,
2466 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2467 			    args);
2468 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2469 			mesh_peer_timeout_setup(ni);
2470 		}
2471 		break;
2472 	default:
2473 		IEEE80211_DISCARD(vap,
2474 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2475 		    wh, NULL, "received confirm in invalid state %d",
2476 		    ni->ni_mlstate);
2477 		vap->iv_stats.is_rx_mgtdiscard++;
2478 		break;
2479 	}
2480 	return 0;
2481 }
2482 
2483 static int
2484 mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
2485 	const struct ieee80211_frame *wh,
2486 	const uint8_t *frm, const uint8_t *efrm)
2487 {
2488 	struct ieee80211_meshpeer_ie ie;
2489 	const struct ieee80211_meshpeer_ie *meshpeer;
2490 	uint16_t args[3];
2491 
2492 	/* +2 for action + code */
2493 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2, efrm, &ie,
2494 	    IEEE80211_ACTION_MESHPEERING_CLOSE);
2495 	if (meshpeer == NULL) {
2496 		return 0;
2497 	}
2498 
2499 	/*
2500 	 * XXX: check reason code, for example we could receive
2501 	 * IEEE80211_REASON_MESH_MAX_PEERS then we should not attempt
2502 	 * to peer again.
2503 	 */
2504 
2505 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2506 	    ni, "%s", "recv PEER CLOSE");
2507 
2508 	switch (ni->ni_mlstate) {
2509 	case IEEE80211_NODE_MESH_IDLE:
2510 		/* ignore */
2511 		break;
2512 	case IEEE80211_NODE_MESH_OPENRCV:
2513 	case IEEE80211_NODE_MESH_OPENSNT:
2514 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2515 	case IEEE80211_NODE_MESH_ESTABLISHED:
2516 		args[0] = ni->ni_mlpid;
2517 		args[1] = ni->ni_mllid;
2518 		args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
2519 		ieee80211_send_action(ni,
2520 		    IEEE80211_ACTION_CAT_SELF_PROT,
2521 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2522 		    args);
2523 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2524 		mesh_peer_timeout_setup(ni);
2525 		break;
2526 	case IEEE80211_NODE_MESH_HOLDING:
2527 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
2528 		mesh_peer_timeout_stop(ni);
2529 		break;
2530 	}
2531 	return 0;
2532 }
2533 
2534 /*
2535  * Link Metric handling.
2536  */
2537 static int
2538 mesh_recv_action_meshlmetric(struct ieee80211_node *ni,
2539 	const struct ieee80211_frame *wh,
2540 	const uint8_t *frm, const uint8_t *efrm)
2541 {
2542 	const struct ieee80211_meshlmetric_ie *ie =
2543 	    (const struct ieee80211_meshlmetric_ie *)
2544 	    (frm+2); /* action + code */
2545 	struct ieee80211_meshlmetric_ie lm_rep;
2546 
2547 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2548 		lm_rep.lm_flags = 0;
2549 		lm_rep.lm_metric = mesh_airtime_calc(ni);
2550 		ieee80211_send_action(ni,
2551 		    IEEE80211_ACTION_CAT_MESH,
2552 		    IEEE80211_ACTION_MESH_LMETRIC,
2553 		    &lm_rep);
2554 	}
2555 	/* XXX: else do nothing for now */
2556 	return 0;
2557 }
2558 
2559 /*
2560  * Parse meshgate action ie's for GANN frames.
2561  * Returns -1 if parsing fails, otherwise 0.
2562  */
2563 static int
2564 mesh_parse_meshgate_action(struct ieee80211_node *ni,
2565     const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2566     struct ieee80211_meshgann_ie *ie, const uint8_t *frm, const uint8_t *efrm)
2567 {
2568 	struct ieee80211vap *vap = ni->ni_vap;
2569 	const struct ieee80211_meshgann_ie *gannie;
2570 
2571 	while (efrm - frm > 1) {
2572 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return -1);
2573 		switch (*frm) {
2574 		case IEEE80211_ELEMID_MESHGANN:
2575 			gannie = (const struct ieee80211_meshgann_ie *) frm;
2576 			memset(ie, 0, sizeof(*ie));
2577 			ie->gann_ie = gannie->gann_ie;
2578 			ie->gann_len = gannie->gann_len;
2579 			ie->gann_flags = gannie->gann_flags;
2580 			ie->gann_hopcount = gannie->gann_hopcount;
2581 			ie->gann_ttl = gannie->gann_ttl;
2582 			IEEE80211_ADDR_COPY(ie->gann_addr, gannie->gann_addr);
2583 			ie->gann_seq = LE_READ_4(&gannie->gann_seq);
2584 			ie->gann_interval = LE_READ_2(&gannie->gann_interval);
2585 			break;
2586 		}
2587 		frm += frm[1] + 2;
2588 	}
2589 
2590 	return 0;
2591 }
2592 
2593 /*
2594  * Mesh Gate Announcement handling.
2595  */
2596 static int
2597 mesh_recv_action_meshgate(struct ieee80211_node *ni,
2598 	const struct ieee80211_frame *wh,
2599 	const uint8_t *frm, const uint8_t *efrm)
2600 {
2601 	struct ieee80211vap *vap = ni->ni_vap;
2602 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2603 	struct ieee80211_mesh_gate_route *gr, *next;
2604 	struct ieee80211_mesh_route *rt_gate;
2605 	struct ieee80211_meshgann_ie pgann;
2606 	struct ieee80211_meshgann_ie ie;
2607 	int found = 0;
2608 
2609 	/* +2 for action + code */
2610 	if (mesh_parse_meshgate_action(ni, wh, &ie, frm+2, efrm) != 0) {
2611 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2612 		    ni->ni_macaddr, NULL, "%s",
2613 		    "GANN parsing failed");
2614 		vap->iv_stats.is_rx_mgtdiscard++;
2615 		return (0);
2616 	}
2617 
2618 	if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ie.gann_addr))
2619 		return 0;
2620 
2621 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ni->ni_macaddr,
2622 	    "received GANN, meshgate: %6D (seq %u)", ie.gann_addr, ":",
2623 	    ie.gann_seq);
2624 
2625 	if (ms == NULL)
2626 		return (0);
2627 	MESH_RT_LOCK(ms);
2628 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
2629 		if (!IEEE80211_ADDR_EQ(gr->gr_addr, ie.gann_addr))
2630 			continue;
2631 		if (ie.gann_seq <= gr->gr_lastseq) {
2632 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2633 			    ni->ni_macaddr, NULL,
2634 			    "GANN old seqno %u <= %u",
2635 			    ie.gann_seq, gr->gr_lastseq);
2636 			MESH_RT_UNLOCK(ms);
2637 			return (0);
2638 		}
2639 		/* corresponding mesh gate found & GANN accepted */
2640 		found = 1;
2641 		break;
2642 
2643 	}
2644 	if (found == 0) {
2645 		/* this GANN is from a new mesh Gate add it to known table. */
2646 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2647 		    "stored new GANN information, seq %u.", ie.gann_seq);
2648 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
2649 		    M_80211_MESH_GT_RT,
2650 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
2651 		IEEE80211_ADDR_COPY(gr->gr_addr, ie.gann_addr);
2652 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
2653 	}
2654 	gr->gr_lastseq = ie.gann_seq;
2655 
2656 	/* check if we have a path to this gate */
2657 	rt_gate = mesh_rt_find_locked(ms, gr->gr_addr);
2658 	if (rt_gate != NULL &&
2659 	    rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) {
2660 		gr->gr_route = rt_gate;
2661 		rt_gate->rt_flags |= IEEE80211_MESHRT_FLAGS_GATE;
2662 	}
2663 
2664 	MESH_RT_UNLOCK(ms);
2665 
2666 	/* popagate only if decremented ttl >= 1 && forwarding is enabled */
2667 	if ((ie.gann_ttl - 1) < 1 && !(ms->ms_flags & IEEE80211_MESHFLAGS_FWD))
2668 		return 0;
2669 		pgann.gann_flags = ie.gann_flags; /* Reserved */
2670 	pgann.gann_hopcount = ie.gann_hopcount + 1;
2671 	pgann.gann_ttl = ie.gann_ttl - 1;
2672 	IEEE80211_ADDR_COPY(pgann.gann_addr, ie.gann_addr);
2673 	pgann.gann_seq = ie.gann_seq;
2674 	pgann.gann_interval = ie.gann_interval;
2675 
2676 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2677 	    "%s", "propagate GANN");
2678 
2679 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
2680 	    IEEE80211_ACTION_MESH_GANN, &pgann);
2681 
2682 	return 0;
2683 }
2684 
2685 static int
2686 mesh_send_action(struct ieee80211_node *ni,
2687     const uint8_t sa[IEEE80211_ADDR_LEN],
2688     const uint8_t da[IEEE80211_ADDR_LEN],
2689     struct mbuf *m)
2690 {
2691 	struct ieee80211vap *vap = ni->ni_vap;
2692 	struct ieee80211com *ic = ni->ni_ic;
2693 	struct ieee80211_bpf_params params;
2694 	struct ieee80211_frame *wh;
2695 	int ret;
2696 
2697 	KASSERT(ni != NULL, ("null node"));
2698 
2699 	if (vap->iv_state == IEEE80211_S_CAC) {
2700 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
2701 		    "block %s frame in CAC state", "Mesh action");
2702 		vap->iv_stats.is_tx_badstate++;
2703 		ieee80211_free_node(ni);
2704 		m_freem(m);
2705 		return EIO;		/* XXX */
2706 	}
2707 
2708 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_NOWAIT);
2709 	if (m == NULL) {
2710 		ieee80211_free_node(ni);
2711 		return ENOMEM;
2712 	}
2713 
2714 	IEEE80211_TX_LOCK(ic);
2715 	wh = mtod(m, struct ieee80211_frame *);
2716 	ieee80211_send_setup(ni, m,
2717 	     IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ACTION,
2718 	     IEEE80211_NONQOS_TID, sa, da, sa);
2719 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
2720 
2721 	memset(&params, 0, sizeof(params));
2722 	params.ibp_pri = WME_AC_VO;
2723 	params.ibp_rate0 = ni->ni_txparms->mgmtrate;
2724 	if (IEEE80211_IS_MULTICAST(da))
2725 		params.ibp_try0 = 1;
2726 	else
2727 		params.ibp_try0 = ni->ni_txparms->maxretry;
2728 	params.ibp_power = ni->ni_txpower;
2729 
2730 	IEEE80211_NODE_STAT(ni, tx_mgmt);
2731 
2732 	ret = ieee80211_raw_output(vap, ni, m, &params);
2733 	IEEE80211_TX_UNLOCK(ic);
2734 	return (ret);
2735 }
2736 
2737 #define	ADDSHORT(frm, v) do {			\
2738 	frm[0] = (v) & 0xff;			\
2739 	frm[1] = (v) >> 8;			\
2740 	frm += 2;				\
2741 } while (0)
2742 #define	ADDWORD(frm, v) do {			\
2743 	frm[0] = (v) & 0xff;			\
2744 	frm[1] = ((v) >> 8) & 0xff;		\
2745 	frm[2] = ((v) >> 16) & 0xff;		\
2746 	frm[3] = ((v) >> 24) & 0xff;		\
2747 	frm += 4;				\
2748 } while (0)
2749 
2750 static int
2751 mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
2752 	int category, int action, void *args0)
2753 {
2754 	struct ieee80211vap *vap = ni->ni_vap;
2755 	struct ieee80211com *ic = ni->ni_ic;
2756 	uint16_t *args = args0;
2757 	const struct ieee80211_rateset *rs;
2758 	struct mbuf *m;
2759 	uint8_t *frm;
2760 
2761 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2762 	    "send PEER OPEN action: localid 0x%x", args[0]);
2763 
2764 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2765 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2766 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2767 	ieee80211_ref_node(ni);
2768 
2769 	m = ieee80211_getmgtframe(&frm,
2770 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2771 	    sizeof(uint16_t)	/* action+category */
2772 	    + sizeof(uint16_t)	/* capabilites */
2773 	    + 2 + IEEE80211_RATE_SIZE
2774 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2775 	    + 2 + IEEE80211_MESHID_LEN
2776 	    + sizeof(struct ieee80211_meshconf_ie)
2777 	    + sizeof(struct ieee80211_meshpeer_ie)
2778 	);
2779 	if (m != NULL) {
2780 		/*
2781 		 * mesh peer open action frame format:
2782 		 *   [1] category
2783 		 *   [1] action
2784 		 *   [2] capabilities
2785 		 *   [tlv] rates
2786 		 *   [tlv] xrates
2787 		 *   [tlv] mesh id
2788 		 *   [tlv] mesh conf
2789 		 *   [tlv] mesh peer link mgmt
2790 		 */
2791 		*frm++ = category;
2792 		*frm++ = action;
2793 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2794 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2795 		frm = ieee80211_add_rates(frm, rs);
2796 		frm = ieee80211_add_xrates(frm, rs);
2797 		frm = ieee80211_add_meshid(frm, vap);
2798 		frm = ieee80211_add_meshconf(frm, vap);
2799 		frm = ieee80211_add_meshpeer(frm, IEEE80211_ACTION_MESHPEERING_OPEN,
2800 		    args[0], 0, 0);
2801 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2802 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2803 	} else {
2804 		vap->iv_stats.is_tx_nobuf++;
2805 		ieee80211_free_node(ni);
2806 		return ENOMEM;
2807 	}
2808 }
2809 
2810 static int
2811 mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
2812 	int category, int action, void *args0)
2813 {
2814 	struct ieee80211vap *vap = ni->ni_vap;
2815 	struct ieee80211com *ic = ni->ni_ic;
2816 	uint16_t *args = args0;
2817 	const struct ieee80211_rateset *rs;
2818 	struct mbuf *m;
2819 	uint8_t *frm;
2820 
2821 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2822 	    "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
2823 	    args[0], args[1]);
2824 
2825 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2826 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2827 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2828 	ieee80211_ref_node(ni);
2829 
2830 	m = ieee80211_getmgtframe(&frm,
2831 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2832 	    sizeof(uint16_t)	/* action+category */
2833 	    + sizeof(uint16_t)	/* capabilites */
2834 	    + sizeof(uint16_t)	/* status code */
2835 	    + sizeof(uint16_t)	/* AID */
2836 	    + 2 + IEEE80211_RATE_SIZE
2837 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2838 	    + 2 + IEEE80211_MESHID_LEN
2839 	    + sizeof(struct ieee80211_meshconf_ie)
2840 	    + sizeof(struct ieee80211_meshpeer_ie)
2841 	);
2842 	if (m != NULL) {
2843 		/*
2844 		 * mesh peer confirm action frame format:
2845 		 *   [1] category
2846 		 *   [1] action
2847 		 *   [2] capabilities
2848 		 *   [2] status code
2849 		 *   [2] association id (peer ID)
2850 		 *   [tlv] rates
2851 		 *   [tlv] xrates
2852 		 *   [tlv] mesh id
2853 		 *   [tlv] mesh conf
2854 		 *   [tlv] mesh peer link mgmt
2855 		 */
2856 		*frm++ = category;
2857 		*frm++ = action;
2858 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2859 		ADDSHORT(frm, 0);		/* status code */
2860 		ADDSHORT(frm, args[1]);		/* AID */
2861 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2862 		frm = ieee80211_add_rates(frm, rs);
2863 		frm = ieee80211_add_xrates(frm, rs);
2864 		frm = ieee80211_add_meshid(frm, vap);
2865 		frm = ieee80211_add_meshconf(frm, vap);
2866 		frm = ieee80211_add_meshpeer(frm,
2867 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2868 		    args[0], args[1], 0);
2869 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2870 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2871 	} else {
2872 		vap->iv_stats.is_tx_nobuf++;
2873 		ieee80211_free_node(ni);
2874 		return ENOMEM;
2875 	}
2876 }
2877 
2878 static int
2879 mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
2880 	int category, int action, void *args0)
2881 {
2882 	struct ieee80211vap *vap = ni->ni_vap;
2883 	struct ieee80211com *ic = ni->ni_ic;
2884 	uint16_t *args = args0;
2885 	struct mbuf *m;
2886 	uint8_t *frm;
2887 
2888 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2889 	    "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d",
2890 	    args[0], args[1], args[2]);
2891 
2892 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2893 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2894 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2895 	ieee80211_ref_node(ni);
2896 
2897 	m = ieee80211_getmgtframe(&frm,
2898 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2899 	    sizeof(uint16_t)	/* action+category */
2900 	    + sizeof(uint16_t)	/* reason code */
2901 	    + 2 + IEEE80211_MESHID_LEN
2902 	    + sizeof(struct ieee80211_meshpeer_ie)
2903 	);
2904 	if (m != NULL) {
2905 		/*
2906 		 * mesh peer close action frame format:
2907 		 *   [1] category
2908 		 *   [1] action
2909 		 *   [tlv] mesh id
2910 		 *   [tlv] mesh peer link mgmt
2911 		 */
2912 		*frm++ = category;
2913 		*frm++ = action;
2914 		frm = ieee80211_add_meshid(frm, vap);
2915 		frm = ieee80211_add_meshpeer(frm,
2916 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2917 		    args[0], args[1], args[2]);
2918 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2919 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2920 	} else {
2921 		vap->iv_stats.is_tx_nobuf++;
2922 		ieee80211_free_node(ni);
2923 		return ENOMEM;
2924 	}
2925 }
2926 
2927 static int
2928 mesh_send_action_meshlmetric(struct ieee80211_node *ni,
2929 	int category, int action, void *arg0)
2930 {
2931 	struct ieee80211vap *vap = ni->ni_vap;
2932 	struct ieee80211com *ic = ni->ni_ic;
2933 	struct ieee80211_meshlmetric_ie *ie = arg0;
2934 	struct mbuf *m;
2935 	uint8_t *frm;
2936 
2937 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2938 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2939 		    ni, "%s", "send LINK METRIC REQUEST action");
2940 	} else {
2941 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2942 		    ni, "send LINK METRIC REPLY action: metric 0x%x",
2943 		    ie->lm_metric);
2944 	}
2945 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2946 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2947 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2948 	ieee80211_ref_node(ni);
2949 
2950 	m = ieee80211_getmgtframe(&frm,
2951 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2952 	    sizeof(uint16_t) +	/* action+category */
2953 	    sizeof(struct ieee80211_meshlmetric_ie)
2954 	);
2955 	if (m != NULL) {
2956 		/*
2957 		 * mesh link metric
2958 		 *   [1] category
2959 		 *   [1] action
2960 		 *   [tlv] mesh link metric
2961 		 */
2962 		*frm++ = category;
2963 		*frm++ = action;
2964 		frm = ieee80211_add_meshlmetric(frm,
2965 		    ie->lm_flags, ie->lm_metric);
2966 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2967 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2968 	} else {
2969 		vap->iv_stats.is_tx_nobuf++;
2970 		ieee80211_free_node(ni);
2971 		return ENOMEM;
2972 	}
2973 }
2974 
2975 static int
2976 mesh_send_action_meshgate(struct ieee80211_node *ni,
2977 	int category, int action, void *arg0)
2978 {
2979 	struct ieee80211vap *vap = ni->ni_vap;
2980 	struct ieee80211com *ic = ni->ni_ic;
2981 	struct ieee80211_meshgann_ie *ie = arg0;
2982 	struct mbuf *m;
2983 	uint8_t *frm;
2984 
2985 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2986 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2987 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2988 	ieee80211_ref_node(ni);
2989 
2990 	m = ieee80211_getmgtframe(&frm,
2991 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2992 	    sizeof(uint16_t) +	/* action+category */
2993 	    IEEE80211_MESHGANN_BASE_SZ
2994 	);
2995 	if (m != NULL) {
2996 		/*
2997 		 * mesh link metric
2998 		 *   [1] category
2999 		 *   [1] action
3000 		 *   [tlv] mesh gate annoucement
3001 		 */
3002 		*frm++ = category;
3003 		*frm++ = action;
3004 		frm = ieee80211_add_meshgate(frm, ie);
3005 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
3006 		return mesh_send_action(ni, vap->iv_myaddr, broadcastaddr, m);
3007 	} else {
3008 		vap->iv_stats.is_tx_nobuf++;
3009 		ieee80211_free_node(ni);
3010 		return ENOMEM;
3011 	}
3012 }
3013 
3014 static void
3015 mesh_peer_timeout_setup(struct ieee80211_node *ni)
3016 {
3017 	switch (ni->ni_mlstate) {
3018 	case IEEE80211_NODE_MESH_HOLDING:
3019 		ni->ni_mltval = ieee80211_mesh_holdingtimeout;
3020 		break;
3021 	case IEEE80211_NODE_MESH_CONFIRMRCV:
3022 		ni->ni_mltval = ieee80211_mesh_confirmtimeout;
3023 		break;
3024 	case IEEE80211_NODE_MESH_IDLE:
3025 		ni->ni_mltval = 0;
3026 		break;
3027 	default:
3028 		ni->ni_mltval = ieee80211_mesh_retrytimeout;
3029 		break;
3030 	}
3031 	if (ni->ni_mltval)
3032 		callout_reset(&ni->ni_mltimer, ni->ni_mltval,
3033 		    mesh_peer_timeout_cb, ni);
3034 }
3035 
3036 /*
3037  * Same as above but backoffs timer statisically 50%.
3038  */
3039 static void
3040 mesh_peer_timeout_backoff(struct ieee80211_node *ni)
3041 {
3042 	uint32_t r;
3043 
3044 	r = arc4random();
3045 	ni->ni_mltval += r % ni->ni_mltval;
3046 	callout_reset(&ni->ni_mltimer, ni->ni_mltval, mesh_peer_timeout_cb,
3047 	    ni);
3048 }
3049 
3050 static __inline void
3051 mesh_peer_timeout_stop(struct ieee80211_node *ni)
3052 {
3053 	callout_drain(&ni->ni_mltimer);
3054 }
3055 
3056 static void
3057 mesh_peer_backoff_cb(void *arg)
3058 {
3059 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3060 
3061 	/* After backoff timeout, try to peer automatically again. */
3062 	ni->ni_mlhcnt = 0;
3063 }
3064 
3065 /*
3066  * Mesh Peer Link Management FSM timeout handling.
3067  */
3068 static void
3069 mesh_peer_timeout_cb(void *arg)
3070 {
3071 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3072 	uint16_t args[3];
3073 
3074 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
3075 	    ni, "mesh link timeout, state %d, retry counter %d",
3076 	    ni->ni_mlstate, ni->ni_mlrcnt);
3077 
3078 	switch (ni->ni_mlstate) {
3079 	case IEEE80211_NODE_MESH_IDLE:
3080 	case IEEE80211_NODE_MESH_ESTABLISHED:
3081 		break;
3082 	case IEEE80211_NODE_MESH_OPENSNT:
3083 	case IEEE80211_NODE_MESH_OPENRCV:
3084 		if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
3085 			args[0] = ni->ni_mlpid;
3086 			args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
3087 			ieee80211_send_action(ni,
3088 			    IEEE80211_ACTION_CAT_SELF_PROT,
3089 			    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3090 			ni->ni_mlrcnt = 0;
3091 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3092 			mesh_peer_timeout_setup(ni);
3093 		} else {
3094 			args[0] = ni->ni_mlpid;
3095 			ieee80211_send_action(ni,
3096 			    IEEE80211_ACTION_CAT_SELF_PROT,
3097 			    IEEE80211_ACTION_MESHPEERING_OPEN, args);
3098 			ni->ni_mlrcnt++;
3099 			mesh_peer_timeout_backoff(ni);
3100 		}
3101 		break;
3102 	case IEEE80211_NODE_MESH_CONFIRMRCV:
3103 		args[0] = ni->ni_mlpid;
3104 		args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
3105 		ieee80211_send_action(ni,
3106 		    IEEE80211_ACTION_CAT_SELF_PROT,
3107 		    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3108 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3109 		mesh_peer_timeout_setup(ni);
3110 		break;
3111 	case IEEE80211_NODE_MESH_HOLDING:
3112 		ni->ni_mlhcnt++;
3113 		if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
3114 			callout_reset(&ni->ni_mlhtimer,
3115 			    ieee80211_mesh_backofftimeout,
3116 			    mesh_peer_backoff_cb, ni);
3117 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
3118 		break;
3119 	}
3120 }
3121 
3122 static int
3123 mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
3124 {
3125 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3126 
3127 	if (ie == NULL || ie[1] != ms->ms_idlen)
3128 		return 1;
3129 	return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
3130 }
3131 
3132 /*
3133  * Check if we are using the same algorithms for this mesh.
3134  */
3135 static int
3136 mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
3137 {
3138 	const struct ieee80211_meshconf_ie *meshconf =
3139 	    (const struct ieee80211_meshconf_ie *) ie;
3140 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3141 
3142 	if (meshconf == NULL)
3143 		return 1;
3144 	if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
3145 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3146 		    "unknown path selection algorithm: 0x%x\n",
3147 		    meshconf->conf_pselid);
3148 		return 1;
3149 	}
3150 	if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
3151 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3152 		    "unknown path metric algorithm: 0x%x\n",
3153 		    meshconf->conf_pmetid);
3154 		return 1;
3155 	}
3156 	if (meshconf->conf_ccid != 0) {
3157 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3158 		    "unknown congestion control algorithm: 0x%x\n",
3159 		    meshconf->conf_ccid);
3160 		return 1;
3161 	}
3162 	if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
3163 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3164 		    "unknown sync algorithm: 0x%x\n",
3165 		    meshconf->conf_syncid);
3166 		return 1;
3167 	}
3168 	if (meshconf->conf_authid != 0) {
3169 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3170 		    "unknown auth auth algorithm: 0x%x\n",
3171 		    meshconf->conf_pselid);
3172 		return 1;
3173 	}
3174 	/* Not accepting peers */
3175 	if (!(meshconf->conf_cap & IEEE80211_MESHCONF_CAP_AP)) {
3176 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3177 		    "not accepting peers: 0x%x\n", meshconf->conf_cap);
3178 		return 1;
3179 	}
3180 	return 0;
3181 }
3182 
3183 static int
3184 mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
3185     const uint8_t *ie)
3186 {
3187 	const struct ieee80211_meshpeer_ie *meshpeer =
3188 	    (const struct ieee80211_meshpeer_ie *) ie;
3189 
3190 	if (meshpeer == NULL ||
3191 	    meshpeer->peer_len < IEEE80211_MPM_BASE_SZ ||
3192 	    meshpeer->peer_len > IEEE80211_MPM_MAX_SZ)
3193 		return 1;
3194 	if (meshpeer->peer_proto != IEEE80211_MPPID_MPM) {
3195 		IEEE80211_DPRINTF(vap,
3196 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
3197 		    "Only MPM protocol is supported (proto: 0x%02X)",
3198 		    meshpeer->peer_proto);
3199 		return 1;
3200 	}
3201 	switch (subtype) {
3202 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3203 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ)
3204 			return 1;
3205 		break;
3206 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3207 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ + 2)
3208 			return 1;
3209 		break;
3210 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3211 		if (meshpeer->peer_len < IEEE80211_MPM_BASE_SZ + 2)
3212 			return 1;
3213 		if (meshpeer->peer_len == (IEEE80211_MPM_BASE_SZ + 2) &&
3214 		    meshpeer->peer_linkid != 0)
3215 			return 1;
3216 		if (meshpeer->peer_rcode == 0)
3217 			return 1;
3218 		break;
3219 	}
3220 	return 0;
3221 }
3222 
3223 /*
3224  * Add a Mesh ID IE to a frame.
3225  */
3226 uint8_t *
3227 ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
3228 {
3229 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3230 
3231 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
3232 
3233 	*frm++ = IEEE80211_ELEMID_MESHID;
3234 	*frm++ = ms->ms_idlen;
3235 	memcpy(frm, ms->ms_id, ms->ms_idlen);
3236 	return frm + ms->ms_idlen;
3237 }
3238 
3239 /*
3240  * Add a Mesh Configuration IE to a frame.
3241  * For now just use HWMP routing, Airtime link metric, Null Congestion
3242  * Signaling, Null Sync Protocol and Null Authentication.
3243  */
3244 uint8_t *
3245 ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
3246 {
3247 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3248 	uint16_t caps;
3249 
3250 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3251 
3252 	*frm++ = IEEE80211_ELEMID_MESHCONF;
3253 	*frm++ = IEEE80211_MESH_CONF_SZ;
3254 	*frm++ = ms->ms_ppath->mpp_ie;		/* path selection */
3255 	*frm++ = ms->ms_pmetric->mpm_ie;	/* link metric */
3256 	*frm++ = IEEE80211_MESHCONF_CC_DISABLED;
3257 	*frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
3258 	*frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
3259 	/* NB: set the number of neighbors before the rest */
3260 	*frm = (ms->ms_neighbors > IEEE80211_MESH_MAX_NEIGHBORS ?
3261 	    IEEE80211_MESH_MAX_NEIGHBORS : ms->ms_neighbors) << 1;
3262 	if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE)
3263 		*frm |= IEEE80211_MESHCONF_FORM_GATE;
3264 	frm += 1;
3265 	caps = 0;
3266 	if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
3267 		caps |= IEEE80211_MESHCONF_CAP_AP;
3268 	if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
3269 		caps |= IEEE80211_MESHCONF_CAP_FWRD;
3270 	*frm++ = caps;
3271 	return frm;
3272 }
3273 
3274 /*
3275  * Add a Mesh Peer Management IE to a frame.
3276  */
3277 uint8_t *
3278 ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
3279     uint16_t peerid, uint16_t reason)
3280 {
3281 
3282 	KASSERT(localid != 0, ("localid == 0"));
3283 
3284 	*frm++ = IEEE80211_ELEMID_MESHPEER;
3285 	switch (subtype) {
3286 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3287 		*frm++ = IEEE80211_MPM_BASE_SZ;		/* length */
3288 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3289 		ADDSHORT(frm, localid);			/* local ID */
3290 		break;
3291 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3292 		KASSERT(peerid != 0, ("sending peer confirm without peer id"));
3293 		*frm++ = IEEE80211_MPM_BASE_SZ + 2;	/* length */
3294 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3295 		ADDSHORT(frm, localid);			/* local ID */
3296 		ADDSHORT(frm, peerid);			/* peer ID */
3297 		break;
3298 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3299 		if (peerid)
3300 			*frm++ = IEEE80211_MPM_MAX_SZ;	/* length */
3301 		else
3302 			*frm++ = IEEE80211_MPM_BASE_SZ + 2; /* length */
3303 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3304 		ADDSHORT(frm, localid);	/* local ID */
3305 		if (peerid)
3306 			ADDSHORT(frm, peerid);	/* peer ID */
3307 		ADDSHORT(frm, reason);
3308 		break;
3309 	}
3310 	return frm;
3311 }
3312 
3313 /*
3314  * Compute an Airtime Link Metric for the link with this node.
3315  *
3316  * Based on Draft 3.0 spec (11B.10, p.149).
3317  */
3318 /*
3319  * Max 802.11s overhead.
3320  */
3321 #define IEEE80211_MESH_MAXOVERHEAD \
3322 	(sizeof(struct ieee80211_qosframe_addr4) \
3323 	 + sizeof(struct ieee80211_meshcntl_ae10) \
3324 	+ sizeof(struct llc) \
3325 	+ IEEE80211_ADDR_LEN \
3326 	+ IEEE80211_WEP_IVLEN \
3327 	+ IEEE80211_WEP_KIDLEN \
3328 	+ IEEE80211_WEP_CRCLEN \
3329 	+ IEEE80211_WEP_MICLEN \
3330 	+ IEEE80211_CRC_LEN)
3331 uint32_t
3332 mesh_airtime_calc(struct ieee80211_node *ni)
3333 {
3334 #define M_BITS 8
3335 #define S_FACTOR (2 * M_BITS)
3336 	struct ieee80211com *ic = ni->ni_ic;
3337 	struct ifnet *ifp = ni->ni_vap->iv_ifp;
3338 	const static int nbits = 8192 << M_BITS;
3339 	uint32_t overhead, rate, errrate;
3340 	uint64_t res;
3341 
3342 	/* Time to transmit a frame */
3343 	rate = ni->ni_txrate;
3344 	overhead = ieee80211_compute_duration(ic->ic_rt,
3345 	    ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
3346 	/* Error rate in percentage */
3347 	/* XXX assuming small failures are ok */
3348 	errrate = (((ifp->if_get_counter(ifp, IFCOUNTER_OERRORS) +
3349 	    ifp->if_get_counter(ifp, IFCOUNTER_IERRORS)) / 100) << M_BITS)
3350 	    / 100;
3351 	res = (overhead + (nbits / rate)) *
3352 	    ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
3353 
3354 	return (uint32_t)(res >> S_FACTOR);
3355 #undef M_BITS
3356 #undef S_FACTOR
3357 }
3358 
3359 /*
3360  * Add a Mesh Link Metric report IE to a frame.
3361  */
3362 uint8_t *
3363 ieee80211_add_meshlmetric(uint8_t *frm, uint8_t flags, uint32_t metric)
3364 {
3365 	*frm++ = IEEE80211_ELEMID_MESHLINK;
3366 	*frm++ = 5;
3367 	*frm++ = flags;
3368 	ADDWORD(frm, metric);
3369 	return frm;
3370 }
3371 
3372 /*
3373  * Add a Mesh Gate Announcement IE to a frame.
3374  */
3375 uint8_t *
3376 ieee80211_add_meshgate(uint8_t *frm, struct ieee80211_meshgann_ie *ie)
3377 {
3378 	*frm++ = IEEE80211_ELEMID_MESHGANN; /* ie */
3379 	*frm++ = IEEE80211_MESHGANN_BASE_SZ; /* len */
3380 	*frm++ = ie->gann_flags;
3381 	*frm++ = ie->gann_hopcount;
3382 	*frm++ = ie->gann_ttl;
3383 	IEEE80211_ADDR_COPY(frm, ie->gann_addr);
3384 	frm += 6;
3385 	ADDWORD(frm, ie->gann_seq);
3386 	ADDSHORT(frm, ie->gann_interval);
3387 	return frm;
3388 }
3389 #undef ADDSHORT
3390 #undef ADDWORD
3391 
3392 /*
3393  * Initialize any mesh-specific node state.
3394  */
3395 void
3396 ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
3397 {
3398 	ni->ni_flags |= IEEE80211_NODE_QOS;
3399 	callout_init(&ni->ni_mltimer, 1);
3400 	callout_init(&ni->ni_mlhtimer, 1);
3401 }
3402 
3403 /*
3404  * Cleanup any mesh-specific node state.
3405  */
3406 void
3407 ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
3408 {
3409 	struct ieee80211vap *vap = ni->ni_vap;
3410 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3411 
3412 	callout_drain(&ni->ni_mltimer);
3413 	callout_drain(&ni->ni_mlhtimer);
3414 	/* NB: short-circuit callbacks after mesh_vdetach */
3415 	if (vap->iv_mesh != NULL)
3416 		ms->ms_ppath->mpp_peerdown(ni);
3417 }
3418 
3419 void
3420 ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
3421 {
3422 	ni->ni_meshidlen = ie[1];
3423 	memcpy(ni->ni_meshid, ie + 2, ie[1]);
3424 }
3425 
3426 /*
3427  * Setup mesh-specific node state on neighbor discovery.
3428  */
3429 void
3430 ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
3431 	const struct ieee80211_frame *wh,
3432 	const struct ieee80211_scanparams *sp)
3433 {
3434 	ieee80211_parse_meshid(ni, sp->meshid);
3435 }
3436 
3437 void
3438 ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
3439 	struct ieee80211_beacon_offsets *bo)
3440 {
3441 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3442 
3443 	if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
3444 		(void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
3445 		clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
3446 	}
3447 }
3448 
3449 static int
3450 mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3451 {
3452 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3453 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3454 	struct ieee80211_mesh_route *rt;
3455 	struct ieee80211req_mesh_route *imr;
3456 	size_t len, off;
3457 	uint8_t *p;
3458 	int error;
3459 
3460 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3461 		return ENOSYS;
3462 
3463 	error = 0;
3464 	switch (ireq->i_type) {
3465 	case IEEE80211_IOC_MESH_ID:
3466 		ireq->i_len = ms->ms_idlen;
3467 		memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
3468 		error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
3469 		break;
3470 	case IEEE80211_IOC_MESH_AP:
3471 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
3472 		break;
3473 	case IEEE80211_IOC_MESH_FWRD:
3474 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
3475 		break;
3476 	case IEEE80211_IOC_MESH_GATE:
3477 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) != 0;
3478 		break;
3479 	case IEEE80211_IOC_MESH_TTL:
3480 		ireq->i_val = ms->ms_ttl;
3481 		break;
3482 	case IEEE80211_IOC_MESH_RTCMD:
3483 		switch (ireq->i_val) {
3484 		case IEEE80211_MESH_RTCMD_LIST:
3485 			len = 0;
3486 			MESH_RT_LOCK(ms);
3487 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3488 				len += sizeof(*imr);
3489 			}
3490 			MESH_RT_UNLOCK(ms);
3491 			if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
3492 				ireq->i_len = len;
3493 				return ENOMEM;
3494 			}
3495 			ireq->i_len = len;
3496 			/* XXX M_WAIT? */
3497 			p = IEEE80211_MALLOC(len, M_TEMP,
3498 			    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
3499 			if (p == NULL)
3500 				return ENOMEM;
3501 			off = 0;
3502 			MESH_RT_LOCK(ms);
3503 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3504 				if (off >= len)
3505 					break;
3506 				imr = (struct ieee80211req_mesh_route *)
3507 				    (p + off);
3508 				IEEE80211_ADDR_COPY(imr->imr_dest,
3509 				    rt->rt_dest);
3510 				IEEE80211_ADDR_COPY(imr->imr_nexthop,
3511 				    rt->rt_nexthop);
3512 				imr->imr_metric = rt->rt_metric;
3513 				imr->imr_nhops = rt->rt_nhops;
3514 				imr->imr_lifetime =
3515 				    ieee80211_mesh_rt_update(rt, 0);
3516 				imr->imr_lastmseq = rt->rt_lastmseq;
3517 				imr->imr_flags = rt->rt_flags; /* last */
3518 				off += sizeof(*imr);
3519 			}
3520 			MESH_RT_UNLOCK(ms);
3521 			error = copyout(p, (uint8_t *)ireq->i_data,
3522 			    ireq->i_len);
3523 			IEEE80211_FREE(p, M_TEMP);
3524 			break;
3525 		case IEEE80211_MESH_RTCMD_FLUSH:
3526 		case IEEE80211_MESH_RTCMD_ADD:
3527 		case IEEE80211_MESH_RTCMD_DELETE:
3528 			return EINVAL;
3529 		default:
3530 			return ENOSYS;
3531 		}
3532 		break;
3533 	case IEEE80211_IOC_MESH_PR_METRIC:
3534 		len = strlen(ms->ms_pmetric->mpm_descr);
3535 		if (ireq->i_len < len)
3536 			return EINVAL;
3537 		ireq->i_len = len;
3538 		error = copyout(ms->ms_pmetric->mpm_descr,
3539 		    (uint8_t *)ireq->i_data, len);
3540 		break;
3541 	case IEEE80211_IOC_MESH_PR_PATH:
3542 		len = strlen(ms->ms_ppath->mpp_descr);
3543 		if (ireq->i_len < len)
3544 			return EINVAL;
3545 		ireq->i_len = len;
3546 		error = copyout(ms->ms_ppath->mpp_descr,
3547 		    (uint8_t *)ireq->i_data, len);
3548 		break;
3549 	default:
3550 		return ENOSYS;
3551 	}
3552 
3553 	return error;
3554 }
3555 IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
3556 
3557 static int
3558 mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3559 {
3560 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3561 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3562 	uint8_t tmpaddr[IEEE80211_ADDR_LEN];
3563 	char tmpproto[IEEE80211_MESH_PROTO_DSZ];
3564 	int error;
3565 
3566 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3567 		return ENOSYS;
3568 
3569 	error = 0;
3570 	switch (ireq->i_type) {
3571 	case IEEE80211_IOC_MESH_ID:
3572 		if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
3573 			return EINVAL;
3574 		error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
3575 		if (error != 0)
3576 			break;
3577 		memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
3578 		ms->ms_idlen = ireq->i_len;
3579 		memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
3580 		error = ENETRESET;
3581 		break;
3582 	case IEEE80211_IOC_MESH_AP:
3583 		if (ireq->i_val)
3584 			ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
3585 		else
3586 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
3587 		error = ENETRESET;
3588 		break;
3589 	case IEEE80211_IOC_MESH_FWRD:
3590 		if (ireq->i_val)
3591 			ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
3592 		else
3593 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
3594 		mesh_gatemode_setup(vap);
3595 		break;
3596 	case IEEE80211_IOC_MESH_GATE:
3597 		if (ireq->i_val)
3598 			ms->ms_flags |= IEEE80211_MESHFLAGS_GATE;
3599 		else
3600 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_GATE;
3601 		break;
3602 	case IEEE80211_IOC_MESH_TTL:
3603 		ms->ms_ttl = (uint8_t) ireq->i_val;
3604 		break;
3605 	case IEEE80211_IOC_MESH_RTCMD:
3606 		switch (ireq->i_val) {
3607 		case IEEE80211_MESH_RTCMD_LIST:
3608 			return EINVAL;
3609 		case IEEE80211_MESH_RTCMD_FLUSH:
3610 			ieee80211_mesh_rt_flush(vap);
3611 			break;
3612 		case IEEE80211_MESH_RTCMD_ADD:
3613 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||
3614 			    IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))
3615 				return EINVAL;
3616 			error = copyin(ireq->i_data, &tmpaddr,
3617 			    IEEE80211_ADDR_LEN);
3618 			if (error == 0)
3619 				ieee80211_mesh_discover(vap, tmpaddr, NULL);
3620 			break;
3621 		case IEEE80211_MESH_RTCMD_DELETE:
3622 			ieee80211_mesh_rt_del(vap, ireq->i_data);
3623 			break;
3624 		default:
3625 			return ENOSYS;
3626 		}
3627 		break;
3628 	case IEEE80211_IOC_MESH_PR_METRIC:
3629 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3630 		if (error == 0) {
3631 			error = mesh_select_proto_metric(vap, tmpproto);
3632 			if (error == 0)
3633 				error = ENETRESET;
3634 		}
3635 		break;
3636 	case IEEE80211_IOC_MESH_PR_PATH:
3637 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3638 		if (error == 0) {
3639 			error = mesh_select_proto_path(vap, tmpproto);
3640 			if (error == 0)
3641 				error = ENETRESET;
3642 		}
3643 		break;
3644 	default:
3645 		return ENOSYS;
3646 	}
3647 	return error;
3648 }
3649 IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);
3650