The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_mesh.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*- 
    2  * Copyright (c) 2009 The FreeBSD Foundation 
    3  * All rights reserved. 
    4  * 
    5  * This software was developed by Rui Paulo under sponsorship from the
    6  * FreeBSD Foundation. 
    7  *  
    8  * Redistribution and use in source and binary forms, with or without 
    9  * modification, are permitted provided that the following conditions 
   10  * are met: 
   11  * 1. Redistributions of source code must retain the above copyright 
   12  *    notice, this list of conditions and the following disclaimer. 
   13  * 2. Redistributions in binary form must reproduce the above copyright 
   14  *    notice, this list of conditions and the following disclaimer in the 
   15  *    documentation and/or other materials provided with the distribution. 
   16  * 
   17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
   20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 
   21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
   25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
   26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
   27  * SUCH DAMAGE. 
   28  */ 
   29 #include <sys/cdefs.h>
   30 #ifdef __FreeBSD__
   31 __FBSDID("$FreeBSD: releng/9.0/sys/net80211/ieee80211_mesh.c 221418 2011-05-04 02:23:59Z adrian $");
   32 #endif
   33 
   34 /*
   35  * IEEE 802.11s Mesh Point (MBSS) support.
   36  *
   37  * Based on March 2009, D3.0 802.11s draft spec.
   38  */
   39 #include "opt_inet.h"
   40 #include "opt_wlan.h"
   41 
   42 #include <sys/param.h>
   43 #include <sys/systm.h> 
   44 #include <sys/mbuf.h>   
   45 #include <sys/malloc.h>
   46 #include <sys/kernel.h>
   47 
   48 #include <sys/socket.h>
   49 #include <sys/sockio.h>
   50 #include <sys/endian.h>
   51 #include <sys/errno.h>
   52 #include <sys/proc.h>
   53 #include <sys/sysctl.h>
   54 
   55 #include <net/if.h>
   56 #include <net/if_media.h>
   57 #include <net/if_llc.h>
   58 #include <net/ethernet.h>
   59 
   60 #include <net80211/ieee80211_var.h>
   61 #include <net80211/ieee80211_action.h>
   62 #include <net80211/ieee80211_input.h>
   63 #include <net80211/ieee80211_mesh.h>
   64 
   65 static void     mesh_rt_flush_invalid(struct ieee80211vap *);
   66 static int      mesh_select_proto_path(struct ieee80211vap *, const char *);
   67 static int      mesh_select_proto_metric(struct ieee80211vap *, const char *);
   68 static void     mesh_vattach(struct ieee80211vap *);
   69 static int      mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
   70 static void     mesh_rt_cleanup_cb(void *);
   71 static void     mesh_linkchange(struct ieee80211_node *,
   72                     enum ieee80211_mesh_mlstate);
   73 static void     mesh_checkid(void *, struct ieee80211_node *);
   74 static uint32_t mesh_generateid(struct ieee80211vap *);
   75 static int      mesh_checkpseq(struct ieee80211vap *,
   76                     const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
   77 static struct ieee80211_node *
   78                 mesh_find_txnode(struct ieee80211vap *,
   79                     const uint8_t [IEEE80211_ADDR_LEN]);
   80 static void     mesh_forward(struct ieee80211vap *, struct mbuf *,
   81                     const struct ieee80211_meshcntl *);
   82 static int      mesh_input(struct ieee80211_node *, struct mbuf *, int, int);
   83 static void     mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
   84                     int, int);
   85 static void     mesh_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
   86 static void     mesh_peer_timeout_setup(struct ieee80211_node *);
   87 static void     mesh_peer_timeout_backoff(struct ieee80211_node *);
   88 static void     mesh_peer_timeout_cb(void *);
   89 static __inline void
   90                 mesh_peer_timeout_stop(struct ieee80211_node *);
   91 static int      mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
   92 static int      mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
   93 static int      mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
   94                     const uint8_t *);
   95 uint32_t        mesh_airtime_calc(struct ieee80211_node *);
   96 
   97 /*
   98  * Timeout values come from the specification and are in milliseconds.
   99  */
  100 SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
  101     "IEEE 802.11s parameters");
  102 static int ieee80211_mesh_retrytimeout = -1;
  103 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT | CTLFLAG_RW,
  104     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
  105     "Retry timeout (msec)");
  106 static int ieee80211_mesh_holdingtimeout = -1;
  107 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT | CTLFLAG_RW,
  108     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
  109     "Holding state timeout (msec)");
  110 static int ieee80211_mesh_confirmtimeout = -1;
  111 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT | CTLFLAG_RW,
  112     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
  113     "Confirm state timeout (msec)");
  114 static int ieee80211_mesh_maxretries = 2;
  115 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLTYPE_INT | CTLFLAG_RW,
  116     &ieee80211_mesh_maxretries, 0,
  117     "Maximum retries during peer link establishment");
  118 
  119 static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
  120         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
  121 
  122 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
  123 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
  124 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
  125 static  ieee80211_recv_action_func mesh_recv_action_meshlmetric_req;
  126 static  ieee80211_recv_action_func mesh_recv_action_meshlmetric_rep;
  127 
  128 static  ieee80211_send_action_func mesh_send_action_meshpeering_open;
  129 static  ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
  130 static  ieee80211_send_action_func mesh_send_action_meshpeering_close;
  131 static  ieee80211_send_action_func mesh_send_action_meshlink_request;
  132 static  ieee80211_send_action_func mesh_send_action_meshlink_reply;
  133 
  134 static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
  135         .mpm_descr      = "AIRTIME",
  136         .mpm_ie         = IEEE80211_MESHCONF_METRIC_AIRTIME,
  137         .mpm_metric     = mesh_airtime_calc,
  138 };
  139 
  140 static struct ieee80211_mesh_proto_path         mesh_proto_paths[4];
  141 static struct ieee80211_mesh_proto_metric       mesh_proto_metrics[4];
  142 
  143 #define MESH_RT_LOCK(ms)        mtx_lock(&(ms)->ms_rt_lock)
  144 #define MESH_RT_LOCK_ASSERT(ms) mtx_assert(&(ms)->ms_rt_lock, MA_OWNED)
  145 #define MESH_RT_UNLOCK(ms)      mtx_unlock(&(ms)->ms_rt_lock)
  146 
  147 MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh", "802.11s routing table");
  148 
  149 /*
  150  * Helper functions to manipulate the Mesh routing table.
  151  */
  152 
  153 static struct ieee80211_mesh_route *
  154 mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
  155     const uint8_t dest[IEEE80211_ADDR_LEN])
  156 {
  157         struct ieee80211_mesh_route *rt;
  158 
  159         MESH_RT_LOCK_ASSERT(ms);
  160 
  161         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
  162                 if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
  163                         return rt;
  164         }
  165         return NULL;
  166 }
  167 
  168 static struct ieee80211_mesh_route *
  169 mesh_rt_add_locked(struct ieee80211_mesh_state *ms,
  170     const uint8_t dest[IEEE80211_ADDR_LEN])
  171 {
  172         struct ieee80211_mesh_route *rt;
  173 
  174         KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
  175             ("%s: adding broadcast to the routing table", __func__));
  176 
  177         MESH_RT_LOCK_ASSERT(ms);
  178 
  179         rt = malloc(ALIGN(sizeof(struct ieee80211_mesh_route)) +
  180             ms->ms_ppath->mpp_privlen, M_80211_MESH_RT, M_NOWAIT | M_ZERO);
  181         if (rt != NULL) {
  182                 IEEE80211_ADDR_COPY(rt->rt_dest, dest);
  183                 rt->rt_priv = (void *)ALIGN(&rt[1]);
  184                 rt->rt_crtime = ticks;
  185                 TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
  186         }
  187         return rt;
  188 }
  189 
  190 struct ieee80211_mesh_route *
  191 ieee80211_mesh_rt_find(struct ieee80211vap *vap,
  192     const uint8_t dest[IEEE80211_ADDR_LEN])
  193 {
  194         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  195         struct ieee80211_mesh_route *rt;
  196 
  197         MESH_RT_LOCK(ms);
  198         rt = mesh_rt_find_locked(ms, dest);
  199         MESH_RT_UNLOCK(ms);
  200         return rt;
  201 }
  202 
  203 struct ieee80211_mesh_route *
  204 ieee80211_mesh_rt_add(struct ieee80211vap *vap,
  205     const uint8_t dest[IEEE80211_ADDR_LEN])
  206 {
  207         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  208         struct ieee80211_mesh_route *rt;
  209 
  210         KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
  211             ("%s: duplicate entry in the routing table", __func__));
  212         KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
  213             ("%s: adding self to the routing table", __func__));
  214 
  215         MESH_RT_LOCK(ms);
  216         rt = mesh_rt_add_locked(ms, dest);
  217         MESH_RT_UNLOCK(ms);
  218         return rt;
  219 }
  220 
  221 /*
  222  * Add a proxy route (as needed) for the specified destination.
  223  */
  224 void
  225 ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
  226     const uint8_t dest[IEEE80211_ADDR_LEN])
  227 {
  228         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  229         struct ieee80211_mesh_route *rt;
  230 
  231         MESH_RT_LOCK(ms);
  232         rt = mesh_rt_find_locked(ms, dest);
  233         if (rt == NULL) {
  234                 rt = mesh_rt_add_locked(ms, dest);
  235                 if (rt == NULL) {
  236                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
  237                             "%s", "unable to add proxy entry");
  238                         vap->iv_stats.is_mesh_rtaddfailed++;
  239                 } else {
  240                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
  241                             "%s", "add proxy entry");
  242                         IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
  243                         rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
  244                                      |  IEEE80211_MESHRT_FLAGS_PROXY;
  245                 }
  246         /* XXX assert PROXY? */
  247         } else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
  248                 struct ieee80211com *ic = vap->iv_ic;
  249                 /*
  250                  * Fix existing entry created by received frames from
  251                  * stations that have some memory of dest.  We also
  252                  * flush any frames held on the staging queue; delivering
  253                  * them is too much trouble right now.
  254                  */
  255                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
  256                     "%s", "fix proxy entry");
  257                 IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
  258                 rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
  259                              |  IEEE80211_MESHRT_FLAGS_PROXY;
  260                 /* XXX belongs in hwmp */
  261                 ieee80211_ageq_drain_node(&ic->ic_stageq,
  262                    (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
  263                 /* XXX stat? */
  264         }
  265         MESH_RT_UNLOCK(ms);
  266 }
  267 
  268 static __inline void
  269 mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
  270 {
  271         TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
  272         free(rt, M_80211_MESH_RT);
  273 }
  274 
  275 void
  276 ieee80211_mesh_rt_del(struct ieee80211vap *vap,
  277     const uint8_t dest[IEEE80211_ADDR_LEN])
  278 {
  279         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  280         struct ieee80211_mesh_route *rt, *next;
  281 
  282         MESH_RT_LOCK(ms);
  283         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
  284                 if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
  285                         mesh_rt_del(ms, rt);
  286                         MESH_RT_UNLOCK(ms);
  287                         return;
  288                 }
  289         }
  290         MESH_RT_UNLOCK(ms);
  291 }
  292 
  293 void
  294 ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
  295 {
  296         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  297         struct ieee80211_mesh_route *rt, *next;
  298 
  299         if (ms == NULL)
  300                 return;
  301         MESH_RT_LOCK(ms);
  302         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next)
  303                 mesh_rt_del(ms, rt);
  304         MESH_RT_UNLOCK(ms);
  305 }
  306 
  307 void
  308 ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
  309     const uint8_t peer[IEEE80211_ADDR_LEN])
  310 {
  311         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  312         struct ieee80211_mesh_route *rt, *next;
  313 
  314         MESH_RT_LOCK(ms);
  315         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
  316                 if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
  317                         mesh_rt_del(ms, rt);
  318         }
  319         MESH_RT_UNLOCK(ms);
  320 }
  321 
  322 /*
  323  * Flush expired routing entries, i.e. those in invalid state for
  324  * some time.
  325  */
  326 static void
  327 mesh_rt_flush_invalid(struct ieee80211vap *vap)
  328 {
  329         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  330         struct ieee80211_mesh_route *rt, *next;
  331 
  332         if (ms == NULL)
  333                 return;
  334         MESH_RT_LOCK(ms);
  335         TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
  336                 if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 &&
  337                     ticks - rt->rt_crtime >= ms->ms_ppath->mpp_inact)
  338                         mesh_rt_del(ms, rt);
  339         }
  340         MESH_RT_UNLOCK(ms);
  341 }
  342 
  343 #define N(a)    (sizeof(a) / sizeof(a[0]))
  344 int
  345 ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
  346 {
  347         int i, firstempty = -1;
  348 
  349         for (i = 0; i < N(mesh_proto_paths); i++) {
  350                 if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
  351                     IEEE80211_MESH_PROTO_DSZ) == 0)
  352                         return EEXIST;
  353                 if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
  354                         firstempty = i;
  355         }
  356         if (firstempty < 0)
  357                 return ENOSPC;
  358         memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
  359         mesh_proto_paths[firstempty].mpp_active = 1;
  360         return 0;
  361 }
  362 
  363 int
  364 ieee80211_mesh_register_proto_metric(const struct
  365     ieee80211_mesh_proto_metric *mpm)
  366 {
  367         int i, firstempty = -1;
  368 
  369         for (i = 0; i < N(mesh_proto_metrics); i++) {
  370                 if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
  371                     IEEE80211_MESH_PROTO_DSZ) == 0)
  372                         return EEXIST;
  373                 if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
  374                         firstempty = i;
  375         }
  376         if (firstempty < 0)
  377                 return ENOSPC;
  378         memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
  379         mesh_proto_metrics[firstempty].mpm_active = 1;
  380         return 0;
  381 }
  382 
  383 static int
  384 mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
  385 {
  386         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  387         int i;
  388 
  389         for (i = 0; i < N(mesh_proto_paths); i++) {
  390                 if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
  391                         ms->ms_ppath = &mesh_proto_paths[i];
  392                         return 0;
  393                 }
  394         }
  395         return ENOENT;
  396 }
  397 
  398 static int
  399 mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
  400 {
  401         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  402         int i;
  403 
  404         for (i = 0; i < N(mesh_proto_metrics); i++) {
  405                 if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
  406                         ms->ms_pmetric = &mesh_proto_metrics[i];
  407                         return 0;
  408                 }
  409         }
  410         return ENOENT;
  411 }
  412 #undef  N
  413 
  414 static void
  415 ieee80211_mesh_init(void)
  416 {
  417 
  418         memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
  419         memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
  420 
  421         /*
  422          * Setup mesh parameters that depends on the clock frequency.
  423          */
  424         ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
  425         ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
  426         ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
  427 
  428         /*
  429          * Register action frame handlers.
  430          */
  431         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
  432             IEEE80211_ACTION_MESHPEERING_OPEN,
  433             mesh_recv_action_meshpeering_open);
  434         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
  435             IEEE80211_ACTION_MESHPEERING_CONFIRM,
  436             mesh_recv_action_meshpeering_confirm);
  437         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
  438             IEEE80211_ACTION_MESHPEERING_CLOSE,
  439             mesh_recv_action_meshpeering_close);
  440         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
  441             IEEE80211_ACTION_MESHLMETRIC_REQ, mesh_recv_action_meshlmetric_req);
  442         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
  443             IEEE80211_ACTION_MESHLMETRIC_REP, mesh_recv_action_meshlmetric_rep);
  444 
  445         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING, 
  446             IEEE80211_ACTION_MESHPEERING_OPEN,
  447             mesh_send_action_meshpeering_open);
  448         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING, 
  449             IEEE80211_ACTION_MESHPEERING_CONFIRM,
  450             mesh_send_action_meshpeering_confirm);
  451         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING, 
  452             IEEE80211_ACTION_MESHPEERING_CLOSE,
  453             mesh_send_action_meshpeering_close);
  454         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC, 
  455             IEEE80211_ACTION_MESHLMETRIC_REQ,
  456             mesh_send_action_meshlink_request);
  457         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC, 
  458             IEEE80211_ACTION_MESHLMETRIC_REP,
  459             mesh_send_action_meshlink_reply);
  460 
  461         /*
  462          * Register Airtime Link Metric.
  463          */
  464         ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
  465 
  466 }
  467 SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
  468 
  469 void
  470 ieee80211_mesh_attach(struct ieee80211com *ic)
  471 {
  472         ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
  473 }
  474 
  475 void
  476 ieee80211_mesh_detach(struct ieee80211com *ic)
  477 {
  478 }
  479 
  480 static void
  481 mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
  482 {
  483         struct ieee80211com *ic = ni->ni_ic;
  484         uint16_t args[3];
  485 
  486         if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
  487                 args[0] = ni->ni_mlpid;
  488                 args[1] = ni->ni_mllid;
  489                 args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
  490                 ieee80211_send_action(ni,
  491                     IEEE80211_ACTION_CAT_MESHPEERING,
  492                     IEEE80211_ACTION_MESHPEERING_CLOSE,
  493                     args);
  494         }
  495         callout_drain(&ni->ni_mltimer);
  496         /* XXX belongs in hwmp */
  497         ieee80211_ageq_drain_node(&ic->ic_stageq,
  498            (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
  499 }
  500 
  501 static void
  502 mesh_vdetach(struct ieee80211vap *vap)
  503 {
  504         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  505 
  506         callout_drain(&ms->ms_cleantimer);
  507         ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
  508             NULL);
  509         ieee80211_mesh_rt_flush(vap);
  510         mtx_destroy(&ms->ms_rt_lock);
  511         ms->ms_ppath->mpp_vdetach(vap);
  512         free(vap->iv_mesh, M_80211_VAP);
  513         vap->iv_mesh = NULL;
  514 }
  515 
  516 static void
  517 mesh_vattach(struct ieee80211vap *vap)
  518 {
  519         struct ieee80211_mesh_state *ms;
  520         vap->iv_newstate = mesh_newstate;
  521         vap->iv_input = mesh_input;
  522         vap->iv_opdetach = mesh_vdetach;
  523         vap->iv_recv_mgmt = mesh_recv_mgmt;
  524         vap->iv_recv_ctl = mesh_recv_ctl;
  525         ms = malloc(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
  526             M_NOWAIT | M_ZERO);
  527         if (ms == NULL) {
  528                 printf("%s: couldn't alloc MBSS state\n", __func__);
  529                 return;
  530         }
  531         vap->iv_mesh = ms;
  532         ms->ms_seq = 0;
  533         ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
  534         ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
  535         TAILQ_INIT(&ms->ms_routes);
  536         mtx_init(&ms->ms_rt_lock, "MBSS", "802.11s routing table", MTX_DEF);
  537         callout_init(&ms->ms_cleantimer, CALLOUT_MPSAFE);
  538         mesh_select_proto_metric(vap, "AIRTIME");
  539         KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
  540         mesh_select_proto_path(vap, "HWMP");
  541         KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
  542         ms->ms_ppath->mpp_vattach(vap);
  543 }
  544 
  545 /*
  546  * IEEE80211_M_MBSS vap state machine handler.
  547  */
  548 static int
  549 mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  550 {
  551         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  552         struct ieee80211com *ic = vap->iv_ic;
  553         struct ieee80211_node *ni;
  554         enum ieee80211_state ostate;
  555 
  556         IEEE80211_LOCK_ASSERT(ic);
  557 
  558         ostate = vap->iv_state;
  559         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
  560             __func__, ieee80211_state_name[ostate],
  561             ieee80211_state_name[nstate], arg);
  562         vap->iv_state = nstate;         /* state transition */
  563         if (ostate != IEEE80211_S_SCAN)
  564                 ieee80211_cancel_scan(vap);     /* background scan */
  565         ni = vap->iv_bss;                       /* NB: no reference held */
  566         if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN)
  567                 callout_drain(&ms->ms_cleantimer);
  568         switch (nstate) {
  569         case IEEE80211_S_INIT:
  570                 switch (ostate) {
  571                 case IEEE80211_S_SCAN:
  572                         ieee80211_cancel_scan(vap);
  573                         break;
  574                 case IEEE80211_S_CAC:
  575                         ieee80211_dfs_cac_stop(vap);
  576                         break;
  577                 case IEEE80211_S_RUN:
  578                         ieee80211_iterate_nodes(&ic->ic_sta,
  579                             mesh_vdetach_peers, NULL);
  580                         break;
  581                 default:
  582                         break;
  583                 }
  584                 if (ostate != IEEE80211_S_INIT) {
  585                         /* NB: optimize INIT -> INIT case */
  586                         ieee80211_reset_bss(vap);
  587                         ieee80211_mesh_rt_flush(vap);
  588                 }
  589                 break;
  590         case IEEE80211_S_SCAN:
  591                 switch (ostate) {
  592                 case IEEE80211_S_INIT:
  593                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
  594                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
  595                             ms->ms_idlen != 0) {
  596                                 /*
  597                                  * Already have a channel and a mesh ID; bypass
  598                                  * the scan and startup immediately.
  599                                  */
  600                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
  601                                 break;
  602                         }
  603                         /*
  604                          * Initiate a scan.  We can come here as a result
  605                          * of an IEEE80211_IOC_SCAN_REQ too in which case
  606                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
  607                          * and the scan request parameters will be present
  608                          * in iv_scanreq.  Otherwise we do the default.
  609                         */
  610                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
  611                                 ieee80211_check_scan(vap,
  612                                     vap->iv_scanreq_flags,
  613                                     vap->iv_scanreq_duration,
  614                                     vap->iv_scanreq_mindwell,
  615                                     vap->iv_scanreq_maxdwell,
  616                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
  617                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
  618                         } else
  619                                 ieee80211_check_scan_current(vap);
  620                         break;
  621                 default:
  622                         break;
  623                 }
  624                 break;
  625         case IEEE80211_S_CAC:
  626                 /*
  627                  * Start CAC on a DFS channel.  We come here when starting
  628                  * a bss on a DFS channel (see ieee80211_create_ibss).
  629                  */
  630                 ieee80211_dfs_cac_start(vap);
  631                 break;
  632         case IEEE80211_S_RUN:
  633                 switch (ostate) {
  634                 case IEEE80211_S_INIT:
  635                         /*
  636                          * Already have a channel; bypass the
  637                          * scan and startup immediately.
  638                          * Note that ieee80211_create_ibss will call
  639                          * back to do a RUN->RUN state change.
  640                          */
  641                         ieee80211_create_ibss(vap,
  642                             ieee80211_ht_adjust_channel(ic,
  643                                 ic->ic_curchan, vap->iv_flags_ht));
  644                         /* NB: iv_bss is changed on return */
  645                         break;
  646                 case IEEE80211_S_CAC:
  647                         /*
  648                          * NB: This is the normal state change when CAC
  649                          * expires and no radar was detected; no need to
  650                          * clear the CAC timer as it's already expired.
  651                          */
  652                         /* fall thru... */
  653                 case IEEE80211_S_CSA:
  654 #if 0
  655                         /*
  656                          * Shorten inactivity timer of associated stations
  657                          * to weed out sta's that don't follow a CSA.
  658                          */
  659                         ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
  660 #endif
  661                         /*
  662                          * Update bss node channel to reflect where
  663                          * we landed after CSA.
  664                          */
  665                         ieee80211_node_set_chan(vap->iv_bss,
  666                             ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
  667                                 ieee80211_htchanflags(vap->iv_bss->ni_chan)));
  668                         /* XXX bypass debug msgs */
  669                         break;
  670                 case IEEE80211_S_SCAN:
  671                 case IEEE80211_S_RUN:
  672 #ifdef IEEE80211_DEBUG
  673                         if (ieee80211_msg_debug(vap)) {
  674                                 struct ieee80211_node *ni = vap->iv_bss;
  675                                 ieee80211_note(vap,
  676                                     "synchronized with %s meshid ",
  677                                     ether_sprintf(ni->ni_meshid));
  678                                 ieee80211_print_essid(ni->ni_meshid,
  679                                     ni->ni_meshidlen);
  680                                 /* XXX MCS/HT */
  681                                 printf(" channel %d\n",
  682                                     ieee80211_chan2ieee(ic, ic->ic_curchan));
  683                         }
  684 #endif
  685                         break;
  686                 default:
  687                         break;
  688                 }
  689                 ieee80211_node_authorize(vap->iv_bss);
  690                 callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
  691                     mesh_rt_cleanup_cb, vap);
  692                 break;
  693         default:
  694                 break;
  695         }
  696         /* NB: ostate not nstate */
  697         ms->ms_ppath->mpp_newstate(vap, ostate, arg);
  698         return 0;
  699 }
  700 
  701 static void
  702 mesh_rt_cleanup_cb(void *arg)
  703 {
  704         struct ieee80211vap *vap = arg;
  705         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  706 
  707         mesh_rt_flush_invalid(vap);
  708         callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
  709             mesh_rt_cleanup_cb, vap);
  710 }
  711 
  712 
  713 /*
  714  * Helper function to note the Mesh Peer Link FSM change.
  715  */
  716 static void
  717 mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
  718 {
  719         struct ieee80211vap *vap = ni->ni_vap;
  720         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  721 #ifdef IEEE80211_DEBUG
  722         static const char *meshlinkstates[] = {
  723                 [IEEE80211_NODE_MESH_IDLE]              = "IDLE",
  724                 [IEEE80211_NODE_MESH_OPENSNT]           = "OPEN SENT",
  725                 [IEEE80211_NODE_MESH_OPENRCV]           = "OPEN RECEIVED",
  726                 [IEEE80211_NODE_MESH_CONFIRMRCV]        = "CONFIRM RECEIVED",
  727                 [IEEE80211_NODE_MESH_ESTABLISHED]       = "ESTABLISHED",
  728                 [IEEE80211_NODE_MESH_HOLDING]           = "HOLDING"
  729         };
  730 #endif
  731         IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
  732             ni, "peer link: %s -> %s",
  733             meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
  734 
  735         /* track neighbor count */
  736         if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
  737             ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
  738                 KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
  739                 ms->ms_neighbors++;
  740                 ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
  741         } else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
  742             state != IEEE80211_NODE_MESH_ESTABLISHED) {
  743                 KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
  744                 ms->ms_neighbors--;
  745                 ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
  746         }
  747         ni->ni_mlstate = state;
  748         switch (state) {
  749         case IEEE80211_NODE_MESH_HOLDING:
  750                 ms->ms_ppath->mpp_peerdown(ni);
  751                 break;
  752         case IEEE80211_NODE_MESH_ESTABLISHED:
  753                 ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
  754                 break;
  755         default:
  756                 break;
  757         }
  758 }
  759 
  760 /*
  761  * Helper function to generate a unique local ID required for mesh
  762  * peer establishment.
  763  */
  764 static void
  765 mesh_checkid(void *arg, struct ieee80211_node *ni)
  766 {
  767         uint16_t *r = arg;
  768         
  769         if (*r == ni->ni_mllid)
  770                 *(uint16_t *)arg = 0;
  771 }
  772 
  773 static uint32_t
  774 mesh_generateid(struct ieee80211vap *vap)
  775 {
  776         int maxiter = 4;
  777         uint16_t r;
  778 
  779         do {
  780                 get_random_bytes(&r, 2);
  781                 ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
  782                 maxiter--;
  783         } while (r == 0 && maxiter > 0);
  784         return r;
  785 }
  786 
  787 /*
  788  * Verifies if we already received this packet by checking its
  789  * sequence number.
  790  * Returns 0 if the frame is to be accepted, 1 otherwise.
  791  */
  792 static int
  793 mesh_checkpseq(struct ieee80211vap *vap,
  794     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
  795 {
  796         struct ieee80211_mesh_route *rt;
  797 
  798         rt = ieee80211_mesh_rt_find(vap, source);
  799         if (rt == NULL) {
  800                 rt = ieee80211_mesh_rt_add(vap, source);
  801                 if (rt == NULL) {
  802                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
  803                             "%s", "add mcast route failed");
  804                         vap->iv_stats.is_mesh_rtaddfailed++;
  805                         return 1;
  806                 }
  807                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
  808                     "add mcast route, mesh seqno %d", seq);
  809                 rt->rt_lastmseq = seq;
  810                 return 0;
  811         }
  812         if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
  813                 return 1;
  814         } else {
  815                 rt->rt_lastmseq = seq;
  816                 return 0;
  817         }
  818 }
  819 
  820 /*
  821  * Iterate the routing table and locate the next hop.
  822  */
  823 static struct ieee80211_node *
  824 mesh_find_txnode(struct ieee80211vap *vap,
  825     const uint8_t dest[IEEE80211_ADDR_LEN])
  826 {
  827         struct ieee80211_mesh_route *rt;
  828 
  829         rt = ieee80211_mesh_rt_find(vap, dest);
  830         if (rt == NULL)
  831                 return NULL;
  832         if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 ||
  833             (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY)) {
  834                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
  835                     "%s: !valid or proxy, flags 0x%x", __func__, rt->rt_flags);
  836                 /* XXX stat */
  837                 return NULL;
  838         }
  839         return ieee80211_find_txnode(vap, rt->rt_nexthop);
  840 }
  841 
  842 /*
  843  * Forward the specified frame.
  844  * Decrement the TTL and set TA to our MAC address.
  845  */
  846 static void
  847 mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
  848     const struct ieee80211_meshcntl *mc)
  849 {
  850         struct ieee80211com *ic = vap->iv_ic;
  851         struct ieee80211_mesh_state *ms = vap->iv_mesh;
  852         struct ifnet *ifp = vap->iv_ifp;
  853         struct ifnet *parent = ic->ic_ifp;
  854         const struct ieee80211_frame *wh =
  855             mtod(m, const struct ieee80211_frame *);
  856         struct mbuf *mcopy;
  857         struct ieee80211_meshcntl *mccopy;
  858         struct ieee80211_frame *whcopy;
  859         struct ieee80211_node *ni;
  860         int err;
  861 
  862         if (mc->mc_ttl == 0) {
  863                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
  864                     "%s", "frame not fwd'd, ttl 0");
  865                 vap->iv_stats.is_mesh_fwd_ttl++;
  866                 return;
  867         }
  868         if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
  869                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
  870                     "%s", "frame not fwd'd, fwding disabled");
  871                 vap->iv_stats.is_mesh_fwd_disabled++;
  872                 return;
  873         }
  874         mcopy = m_dup(m, M_DONTWAIT);
  875         if (mcopy == NULL) {
  876                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
  877                     "%s", "frame not fwd'd, cannot dup");
  878                 vap->iv_stats.is_mesh_fwd_nobuf++;
  879                 ifp->if_oerrors++;
  880                 return;
  881         }
  882         mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
  883             sizeof(struct ieee80211_meshcntl));
  884         if (mcopy == NULL) {
  885                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
  886                     "%s", "frame not fwd'd, too short");
  887                 vap->iv_stats.is_mesh_fwd_tooshort++;
  888                 ifp->if_oerrors++;
  889                 m_freem(mcopy);
  890                 return;
  891         }
  892         whcopy = mtod(mcopy, struct ieee80211_frame *);
  893         mccopy = (struct ieee80211_meshcntl *)
  894             (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
  895         /* XXX clear other bits? */
  896         whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
  897         IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
  898         if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  899                 ni = ieee80211_ref_node(vap->iv_bss);
  900                 mcopy->m_flags |= M_MCAST;
  901         } else {
  902                 ni = mesh_find_txnode(vap, whcopy->i_addr3);
  903                 if (ni == NULL) {
  904                         IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
  905                             "%s", "frame not fwd'd, no path");
  906                         vap->iv_stats.is_mesh_fwd_nopath++;
  907                         m_freem(mcopy);
  908                         return;
  909                 }
  910                 IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
  911         }
  912         KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
  913         mccopy->mc_ttl--;
  914 
  915         /* XXX calculate priority so drivers can find the tx queue */
  916         M_WME_SETAC(mcopy, WME_AC_BE);
  917 
  918         /* XXX do we know m_nextpkt is NULL? */
  919         mcopy->m_pkthdr.rcvif = (void *) ni;
  920         err = parent->if_transmit(parent, mcopy);
  921         if (err != 0) {
  922                 /* NB: IFQ_HANDOFF reclaims mbuf */
  923                 ieee80211_free_node(ni);
  924         } else {
  925                 ifp->if_opackets++;
  926         }
  927 }
  928 
  929 static struct mbuf *
  930 mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
  931 {
  932 #define WHDIR(wh) ((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
  933         uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
  934                   sizeof(struct ieee80211_meshcntl_ae11)];
  935         const struct ieee80211_qosframe_addr4 *wh;
  936         const struct ieee80211_meshcntl_ae10 *mc;
  937         struct ether_header *eh;
  938         struct llc *llc;
  939         int ae;
  940 
  941         if (m->m_len < hdrlen + sizeof(*llc) &&
  942             (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
  943                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
  944                     "discard data frame: %s", "m_pullup failed");
  945                 vap->iv_stats.is_rx_tooshort++;
  946                 return NULL;
  947         }
  948         memcpy(b, mtod(m, caddr_t), hdrlen);
  949         wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
  950         mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
  951         KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
  952                 WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
  953             ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
  954 
  955         llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
  956         if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
  957             llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
  958             llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
  959             /* NB: preserve AppleTalk frames that have a native SNAP hdr */
  960             !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
  961               llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
  962                 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
  963                 llc = NULL;
  964         } else {
  965                 m_adj(m, hdrlen - sizeof(*eh));
  966         }
  967         eh = mtod(m, struct ether_header *);
  968         ae = mc->mc_flags & 3;
  969         if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
  970                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
  971                 if (ae == 0) {
  972                         IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
  973                 } else if (ae == 1) {
  974                         IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr4);
  975                 } else {
  976                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  977                             (const struct ieee80211_frame *)wh, NULL,
  978                             "bad AE %d", ae);
  979                         vap->iv_stats.is_mesh_badae++;
  980                         m_freem(m);
  981                         return NULL;
  982                 }
  983         } else {
  984                 if (ae == 0) {
  985                         IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
  986                         IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
  987                 } else if (ae == 2) {
  988                         IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr4);
  989                         IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr5);
  990                 } else {
  991                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  992                             (const struct ieee80211_frame *)wh, NULL,
  993                             "bad AE %d", ae);
  994                         vap->iv_stats.is_mesh_badae++;
  995                         m_freem(m);
  996                         return NULL;
  997                 }
  998         }
  999 #ifdef ALIGNED_POINTER
 1000         if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
 1001                 m = ieee80211_realign(vap, m, sizeof(*eh));
 1002                 if (m == NULL)
 1003                         return NULL;
 1004         }
 1005 #endif /* ALIGNED_POINTER */
 1006         if (llc != NULL) {
 1007                 eh = mtod(m, struct ether_header *);
 1008                 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
 1009         }
 1010         return m;
 1011 #undef WDIR
 1012 }
 1013 
 1014 /*
 1015  * Return non-zero if the unicast mesh data frame should be processed
 1016  * locally.  Frames that are not proxy'd have our address, otherwise
 1017  * we need to consult the routing table to look for a proxy entry.
 1018  */
 1019 static __inline int
 1020 mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
 1021     const struct ieee80211_meshcntl *mc)
 1022 {
 1023         int ae = mc->mc_flags & 3;
 1024 
 1025         KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
 1026             ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
 1027         KASSERT(ae == 0 || ae == 2, ("bad AE %d", ae));
 1028         if (ae == 2) {                          /* ucast w/ proxy */
 1029                 const struct ieee80211_meshcntl_ae10 *mc10 =
 1030                     (const struct ieee80211_meshcntl_ae10 *) mc;
 1031                 struct ieee80211_mesh_route *rt =
 1032                     ieee80211_mesh_rt_find(vap, mc10->mc_addr4);
 1033                 /* check for proxy route to ourself */
 1034                 return (rt != NULL &&
 1035                     (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
 1036         } else                                  /* ucast w/o proxy */
 1037                 return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
 1038 }
 1039 
 1040 static int
 1041 mesh_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
 1042 {
 1043 #define HAS_SEQ(type)   ((type & 0x4) == 0)
 1044         struct ieee80211vap *vap = ni->ni_vap;
 1045         struct ieee80211com *ic = ni->ni_ic;
 1046         struct ifnet *ifp = vap->iv_ifp;
 1047         struct ieee80211_frame *wh;
 1048         const struct ieee80211_meshcntl *mc;
 1049         int hdrspace, meshdrlen, need_tap;
 1050         uint8_t dir, type, subtype, qos;
 1051         uint32_t seq;
 1052         uint8_t *addr;
 1053         ieee80211_seq rxseq;
 1054 
 1055         KASSERT(ni != NULL, ("null node"));
 1056         ni->ni_inact = ni->ni_inact_reload;
 1057 
 1058         need_tap = 1;                   /* mbuf need to be tapped. */
 1059         type = -1;                      /* undefined */
 1060 
 1061         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
 1062                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 1063                     ni->ni_macaddr, NULL,
 1064                     "too short (1): len %u", m->m_pkthdr.len);
 1065                 vap->iv_stats.is_rx_tooshort++;
 1066                 goto out;
 1067         }
 1068         /*
 1069          * Bit of a cheat here, we use a pointer for a 3-address
 1070          * frame format but don't reference fields past outside
 1071          * ieee80211_frame_min w/o first validating the data is
 1072          * present.
 1073         */
 1074         wh = mtod(m, struct ieee80211_frame *);
 1075 
 1076         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 1077             IEEE80211_FC0_VERSION_0) {
 1078                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 1079                     ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
 1080                 vap->iv_stats.is_rx_badversion++;
 1081                 goto err;
 1082         }
 1083         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 1084         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 1085         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 1086         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 1087                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 1088                 ni->ni_noise = nf;
 1089                 if (HAS_SEQ(type)) {
 1090                         uint8_t tid = ieee80211_gettid(wh);
 1091 
 1092                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
 1093                             TID_TO_WME_AC(tid) >= WME_AC_VI)
 1094                                 ic->ic_wme.wme_hipri_traffic++;
 1095                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
 1096                         if (! ieee80211_check_rxseq(ni, wh)) {
 1097                                 /* duplicate, discard */
 1098                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 1099                                     wh->i_addr1, "duplicate",
 1100                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
 1101                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
 1102                                     ni->ni_rxseqs[tid] >>
 1103                                     IEEE80211_SEQ_SEQ_SHIFT,
 1104                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
 1105                                     ni->ni_rxseqs[tid] &
 1106                                     IEEE80211_SEQ_FRAG_MASK,
 1107                                     tid);
 1108                                 vap->iv_stats.is_rx_dup++;
 1109                                 IEEE80211_NODE_STAT(ni, rx_dup);
 1110                                 goto out;
 1111                         }
 1112                         ni->ni_rxseqs[tid] = rxseq;
 1113                 }
 1114         }
 1115 #ifdef IEEE80211_DEBUG
 1116         /*
 1117          * It's easier, but too expensive, to simulate different mesh
 1118          * topologies by consulting the ACL policy very early, so do this
 1119          * only under DEBUG.
 1120          *
 1121          * NB: this check is also done upon peering link initiation.
 1122          */
 1123         if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
 1124                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
 1125                     wh, NULL, "%s", "disallowed by ACL");
 1126                 vap->iv_stats.is_rx_acl++;
 1127                 goto out;
 1128         }
 1129 #endif
 1130         switch (type) {
 1131         case IEEE80211_FC0_TYPE_DATA:
 1132                 if (ni == vap->iv_bss)
 1133                         goto out;
 1134                 if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
 1135                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
 1136                             ni->ni_macaddr, NULL,
 1137                             "peer link not yet established (%d)",
 1138                             ni->ni_mlstate);
 1139                         vap->iv_stats.is_mesh_nolink++;
 1140                         goto out;
 1141                 }       
 1142                 if (dir != IEEE80211_FC1_DIR_FROMDS &&
 1143                     dir != IEEE80211_FC1_DIR_DSTODS) {
 1144                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1145                             wh, "data", "incorrect dir 0x%x", dir);
 1146                         vap->iv_stats.is_rx_wrongdir++;
 1147                         goto err;
 1148                 }
 1149                 /* pull up enough to get to the mesh control */
 1150                 hdrspace = ieee80211_hdrspace(ic, wh);
 1151                 if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
 1152                     (m = m_pullup(m, hdrspace +
 1153                         sizeof(struct ieee80211_meshcntl))) == NULL) {
 1154                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 1155                             ni->ni_macaddr, NULL,
 1156                             "data too short: expecting %u", hdrspace);
 1157                         vap->iv_stats.is_rx_tooshort++;
 1158                         goto out;               /* XXX */
 1159                 }
 1160                 /*
 1161                  * Now calculate the full extent of the headers. Note
 1162                  * mesh_decap will pull up anything we didn't get
 1163                  * above when it strips the 802.11 headers.
 1164                  */
 1165                 mc = (const struct ieee80211_meshcntl *)
 1166                     (mtod(m, const uint8_t *) + hdrspace);
 1167                 meshdrlen = sizeof(struct ieee80211_meshcntl) +
 1168                     (mc->mc_flags & 3) * IEEE80211_ADDR_LEN;
 1169                 hdrspace += meshdrlen;
 1170                 seq = LE_READ_4(mc->mc_seq);
 1171                 if (IEEE80211_IS_MULTICAST(wh->i_addr1))
 1172                         addr = wh->i_addr3;
 1173                 else
 1174                         addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
 1175                 if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
 1176                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 1177                             addr, "data", "%s", "not to me");
 1178                         vap->iv_stats.is_rx_wrongbss++; /* XXX kinda */
 1179                         goto out;
 1180                 }
 1181                 if (mesh_checkpseq(vap, addr, seq) != 0) {
 1182                         vap->iv_stats.is_rx_dup++;
 1183                         goto out;
 1184                 }
 1185 
 1186                 /*
 1187                  * Potentially forward packet.  See table s36 (p140)
 1188                  * for the rules.  XXX tap fwd'd packets not for us?
 1189                  */
 1190                 if (dir == IEEE80211_FC1_DIR_FROMDS ||
 1191                     !mesh_isucastforme(vap, wh, mc)) {
 1192                         mesh_forward(vap, m, mc);
 1193                         if (dir == IEEE80211_FC1_DIR_DSTODS)
 1194                                 goto out;
 1195                         /* NB: fall thru to deliver mcast frames locally */
 1196                 }
 1197 
 1198                 /*
 1199                  * Save QoS bits for use below--before we strip the header.
 1200                  */
 1201                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
 1202                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
 1203                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
 1204                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
 1205                 } else
 1206                         qos = 0;
 1207                 /*
 1208                  * Next up, any fragmentation.
 1209                  */
 1210                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1211                         m = ieee80211_defrag(ni, m, hdrspace);
 1212                         if (m == NULL) {
 1213                                 /* Fragment dropped or frame not complete yet */
 1214                                 goto out;
 1215                         }
 1216                 }
 1217                 wh = NULL;              /* no longer valid, catch any uses */
 1218 
 1219                 if (ieee80211_radiotap_active_vap(vap))
 1220                         ieee80211_radiotap_rx(vap, m);
 1221                 need_tap = 0;
 1222 
 1223                 /*
 1224                  * Finally, strip the 802.11 header.
 1225                  */
 1226                 m = mesh_decap(vap, m, hdrspace, meshdrlen);
 1227                 if (m == NULL) {
 1228                         /* XXX mask bit to check for both */
 1229                         /* don't count Null data frames as errors */
 1230                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
 1231                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
 1232                                 goto out;
 1233                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 1234                             ni->ni_macaddr, "data", "%s", "decap error");
 1235                         vap->iv_stats.is_rx_decap++;
 1236                         IEEE80211_NODE_STAT(ni, rx_decap);
 1237                         goto err;
 1238                 }
 1239                 if (qos & IEEE80211_QOS_AMSDU) {
 1240                         m = ieee80211_decap_amsdu(ni, m);
 1241                         if (m == NULL)
 1242                                 return IEEE80211_FC0_TYPE_DATA;
 1243                 }
 1244                 ieee80211_deliver_data(vap, ni, m);
 1245                 return type;
 1246         case IEEE80211_FC0_TYPE_MGT:
 1247                 vap->iv_stats.is_rx_mgmt++;
 1248                 IEEE80211_NODE_STAT(ni, rx_mgmt);
 1249                 if (dir != IEEE80211_FC1_DIR_NODS) {
 1250                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1251                             wh, "mgt", "incorrect dir 0x%x", dir);
 1252                         vap->iv_stats.is_rx_wrongdir++;
 1253                         goto err;
 1254                 }
 1255                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 1256                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 1257                             ni->ni_macaddr, "mgt", "too short: len %u",
 1258                             m->m_pkthdr.len);
 1259                         vap->iv_stats.is_rx_tooshort++;
 1260                         goto out;
 1261                 }
 1262 #ifdef IEEE80211_DEBUG
 1263                 if ((ieee80211_msg_debug(vap) && 
 1264                     (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
 1265                     ieee80211_msg_dumppkts(vap)) {
 1266                         if_printf(ifp, "received %s from %s rssi %d\n",
 1267                             ieee80211_mgt_subtype_name[subtype >>
 1268                             IEEE80211_FC0_SUBTYPE_SHIFT],
 1269                             ether_sprintf(wh->i_addr2), rssi);
 1270                 }
 1271 #endif
 1272                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 1273                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1274                             wh, NULL, "%s", "WEP set but not permitted");
 1275                         vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
 1276                         goto out;
 1277                 }
 1278                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
 1279                 goto out;
 1280         case IEEE80211_FC0_TYPE_CTL:
 1281                 vap->iv_stats.is_rx_ctl++;
 1282                 IEEE80211_NODE_STAT(ni, rx_ctrl);
 1283                 goto out;
 1284         default:
 1285                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 1286                     wh, "bad", "frame type 0x%x", type);
 1287                 /* should not come here */
 1288                 break;
 1289         }
 1290 err:
 1291         ifp->if_ierrors++;
 1292 out:
 1293         if (m != NULL) {
 1294                 if (need_tap && ieee80211_radiotap_active_vap(vap))
 1295                         ieee80211_radiotap_rx(vap, m);
 1296                 m_freem(m);
 1297         }
 1298         return type;
 1299 }
 1300 
 1301 static void
 1302 mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
 1303     int rssi, int nf)
 1304 {
 1305         struct ieee80211vap *vap = ni->ni_vap;
 1306         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 1307         struct ieee80211com *ic = ni->ni_ic;
 1308         struct ieee80211_frame *wh;
 1309         uint8_t *frm, *efrm;
 1310 
 1311         wh = mtod(m0, struct ieee80211_frame *);
 1312         frm = (uint8_t *)&wh[1];
 1313         efrm = mtod(m0, uint8_t *) + m0->m_len;
 1314         switch (subtype) {
 1315         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 1316         case IEEE80211_FC0_SUBTYPE_BEACON:
 1317         {
 1318                 struct ieee80211_scanparams scan;
 1319                 /*
 1320                  * We process beacon/probe response
 1321                  * frames to discover neighbors.
 1322                  */
 1323                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
 1324                         return;
 1325                 /*
 1326                  * Count frame now that we know it's to be processed.
 1327                  */
 1328                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
 1329                         vap->iv_stats.is_rx_beacon++;   /* XXX remove */
 1330                         IEEE80211_NODE_STAT(ni, rx_beacons);
 1331                 } else
 1332                         IEEE80211_NODE_STAT(ni, rx_proberesp);
 1333                 /*
 1334                  * If scanning, just pass information to the scan module.
 1335                  */
 1336                 if (ic->ic_flags & IEEE80211_F_SCAN) {
 1337                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
 1338                                 /*
 1339                                  * Actively scanning a channel marked passive;
 1340                                  * send a probe request now that we know there
 1341                                  * is 802.11 traffic present.
 1342                                  *
 1343                                  * XXX check if the beacon we recv'd gives
 1344                                  * us what we need and suppress the probe req
 1345                                  */
 1346                                 ieee80211_probe_curchan(vap, 1);
 1347                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 1348                         }
 1349                         ieee80211_add_scan(vap, &scan, wh,
 1350                             subtype, rssi, nf);
 1351                         return;
 1352                 }
 1353 
 1354                 /* The rest of this code assumes we are running */
 1355                 if (vap->iv_state != IEEE80211_S_RUN)
 1356                         return;
 1357                 /*
 1358                  * Ignore non-mesh STAs.
 1359                  */
 1360                 if ((scan.capinfo &
 1361                      (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
 1362                     scan.meshid == NULL || scan.meshconf == NULL) {
 1363                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1364                             wh, "beacon", "%s", "not a mesh sta");
 1365                         vap->iv_stats.is_mesh_wrongmesh++;
 1366                         return;
 1367                 }
 1368                 /*
 1369                  * Ignore STAs for other mesh networks.
 1370                  */
 1371                 if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
 1372                     mesh_verify_meshconf(vap, scan.meshconf)) {
 1373                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1374                             wh, "beacon", "%s", "not for our mesh");
 1375                         vap->iv_stats.is_mesh_wrongmesh++;
 1376                         return;
 1377                 }
 1378                 /*
 1379                  * Peer only based on the current ACL policy.
 1380                  */
 1381                 if (vap->iv_acl != NULL &&
 1382                     !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
 1383                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
 1384                             wh, NULL, "%s", "disallowed by ACL");
 1385                         vap->iv_stats.is_rx_acl++;
 1386                         return;
 1387                 }
 1388                 /*
 1389                  * Do neighbor discovery.
 1390                  */
 1391                 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
 1392                         /*
 1393                          * Create a new entry in the neighbor table.
 1394                          */
 1395                         ni = ieee80211_add_neighbor(vap, wh, &scan);
 1396                 }
 1397                 /*
 1398                  * Automatically peer with discovered nodes if possible.
 1399                  * XXX backoff on repeated failure
 1400                  */
 1401                 if (ni != vap->iv_bss &&
 1402                     (ms->ms_flags & IEEE80211_MESHFLAGS_AP) &&
 1403                     ni->ni_mlstate == IEEE80211_NODE_MESH_IDLE) {
 1404                         uint16_t args[1];
 1405 
 1406                         ni->ni_mlpid = mesh_generateid(vap);
 1407                         if (ni->ni_mlpid == 0)
 1408                                 return;
 1409                         mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
 1410                         args[0] = ni->ni_mlpid;
 1411                         ieee80211_send_action(ni,
 1412                             IEEE80211_ACTION_CAT_MESHPEERING,
 1413                             IEEE80211_ACTION_MESHPEERING_OPEN, args);
 1414                         ni->ni_mlrcnt = 0;
 1415                         mesh_peer_timeout_setup(ni);
 1416                 }
 1417                 break;
 1418         }
 1419         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 1420         {
 1421                 uint8_t *ssid, *meshid, *rates, *xrates;
 1422                 uint8_t *sfrm;
 1423 
 1424                 if (vap->iv_state != IEEE80211_S_RUN) {
 1425                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1426                             wh, NULL, "wrong state %s",
 1427                             ieee80211_state_name[vap->iv_state]);
 1428                         vap->iv_stats.is_rx_mgtdiscard++;
 1429                         return;
 1430                 }
 1431                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
 1432                         /* frame must be directed */
 1433                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1434                             wh, NULL, "%s", "not unicast");
 1435                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
 1436                         return;
 1437                 }
 1438                 /*
 1439                  * prreq frame format
 1440                  *      [tlv] ssid
 1441                  *      [tlv] supported rates
 1442                  *      [tlv] extended supported rates
 1443                  *      [tlv] mesh id
 1444                  */
 1445                 ssid = meshid = rates = xrates = NULL;
 1446                 sfrm = frm;
 1447                 while (efrm - frm > 1) {
 1448                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 1449                         switch (*frm) {
 1450                         case IEEE80211_ELEMID_SSID:
 1451                                 ssid = frm;
 1452                                 break;
 1453                         case IEEE80211_ELEMID_RATES:
 1454                                 rates = frm;
 1455                                 break;
 1456                         case IEEE80211_ELEMID_XRATES:
 1457                                 xrates = frm;
 1458                                 break;
 1459                         case IEEE80211_ELEMID_MESHID:
 1460                                 meshid = frm;
 1461                                 break;
 1462                         }
 1463                         frm += frm[1] + 2;
 1464                 }
 1465                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
 1466                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
 1467                 if (xrates != NULL)
 1468                         IEEE80211_VERIFY_ELEMENT(xrates,
 1469                             IEEE80211_RATE_MAXSIZE - rates[1], return);
 1470                 if (meshid != NULL) {
 1471                         IEEE80211_VERIFY_ELEMENT(meshid,
 1472                             IEEE80211_MESHID_LEN, return);
 1473                         /* NB: meshid, not ssid */
 1474                         IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
 1475                 }
 1476 
 1477                 /* XXX find a better class or define it's own */
 1478                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
 1479                     "%s", "recv probe req");
 1480                 /*
 1481                  * Some legacy 11b clients cannot hack a complete
 1482                  * probe response frame.  When the request includes
 1483                  * only a bare-bones rate set, communicate this to
 1484                  * the transmit side.
 1485                  */
 1486                 ieee80211_send_proberesp(vap, wh->i_addr2, 0);
 1487                 break;
 1488         }
 1489 
 1490         case IEEE80211_FC0_SUBTYPE_ACTION:
 1491         case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
 1492                 if (ni == vap->iv_bss) {
 1493                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1494                             wh, NULL, "%s", "unknown node");
 1495                         vap->iv_stats.is_rx_mgtdiscard++;
 1496                 } else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
 1497                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1498                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1499                             wh, NULL, "%s", "not for us");
 1500                         vap->iv_stats.is_rx_mgtdiscard++;
 1501                 } else if (vap->iv_state != IEEE80211_S_RUN) {
 1502                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1503                             wh, NULL, "wrong state %s",
 1504                             ieee80211_state_name[vap->iv_state]);
 1505                         vap->iv_stats.is_rx_mgtdiscard++;
 1506                 } else {
 1507                         if (ieee80211_parse_action(ni, m0) == 0)
 1508                                 (void)ic->ic_recv_action(ni, wh, frm, efrm);
 1509                 }
 1510                 break;
 1511 
 1512         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
 1513         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
 1514         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
 1515         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
 1516         case IEEE80211_FC0_SUBTYPE_ATIM:
 1517         case IEEE80211_FC0_SUBTYPE_DISASSOC:
 1518         case IEEE80211_FC0_SUBTYPE_AUTH:
 1519         case IEEE80211_FC0_SUBTYPE_DEAUTH:
 1520                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1521                     wh, NULL, "%s", "not handled");
 1522                 vap->iv_stats.is_rx_mgtdiscard++;
 1523                 break;
 1524 
 1525         default:
 1526                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 1527                     wh, "mgt", "subtype 0x%x not handled", subtype);
 1528                 vap->iv_stats.is_rx_badsubtype++;
 1529                 break;
 1530         }
 1531 }
 1532 
 1533 static void
 1534 mesh_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
 1535 {
 1536 
 1537         switch (subtype) {
 1538         case IEEE80211_FC0_SUBTYPE_BAR:
 1539                 ieee80211_recv_bar(ni, m);
 1540                 break;
 1541         }
 1542 }
 1543 
 1544 /*
 1545  * Parse meshpeering action ie's for open+confirm frames; the
 1546  * important bits are returned in the supplied structure.
 1547  */
 1548 static const struct ieee80211_meshpeer_ie *
 1549 mesh_parse_meshpeering_action(struct ieee80211_node *ni,
 1550         const struct ieee80211_frame *wh,       /* XXX for VERIFY_LENGTH */
 1551         const uint8_t *frm, const uint8_t *efrm,
 1552         struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
 1553 {
 1554         struct ieee80211vap *vap = ni->ni_vap;
 1555         const struct ieee80211_meshpeer_ie *mpie;
 1556         const uint8_t *meshid, *meshconf, *meshpeer;
 1557 
 1558         meshid = meshconf = meshpeer = NULL;
 1559         while (efrm - frm > 1) {
 1560                 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
 1561                 switch (*frm) {
 1562                 case IEEE80211_ELEMID_MESHID:
 1563                         meshid = frm;
 1564                         break;
 1565                 case IEEE80211_ELEMID_MESHCONF:
 1566                         meshconf = frm;
 1567                         break;
 1568                 case IEEE80211_ELEMID_MESHPEER:
 1569                         meshpeer = frm;
 1570                         mpie = (const struct ieee80211_meshpeer_ie *) frm;
 1571                         memset(mp, 0, sizeof(*mp));
 1572                         mp->peer_llinkid = LE_READ_2(&mpie->peer_llinkid);
 1573                         /* NB: peer link ID is optional on these frames */
 1574                         if (subtype == IEEE80211_MESH_PEER_LINK_CLOSE &&
 1575                             mpie->peer_len == 8) {
 1576                                 mp->peer_linkid = 0;
 1577                                 mp->peer_rcode = LE_READ_2(&mpie->peer_linkid);
 1578                         } else {
 1579                                 mp->peer_linkid = LE_READ_2(&mpie->peer_linkid);
 1580                                 mp->peer_rcode = LE_READ_2(&mpie->peer_rcode);
 1581                         }
 1582                         break;
 1583                 }
 1584                 frm += frm[1] + 2;
 1585         }
 1586 
 1587         /*
 1588          * Verify the contents of the frame. Action frames with
 1589          * close subtype don't have a Mesh Configuration IE.
 1590          * If if fails validation, close the peer link.
 1591          */
 1592         KASSERT(meshpeer != NULL &&
 1593             subtype != IEEE80211_ACTION_MESHPEERING_CLOSE,
 1594             ("parsing close action"));
 1595 
 1596         if (mesh_verify_meshid(vap, meshid) ||
 1597             mesh_verify_meshpeer(vap, subtype, meshpeer) ||
 1598             mesh_verify_meshconf(vap, meshconf)) {
 1599                 uint16_t args[3];
 1600 
 1601                 IEEE80211_DISCARD(vap,
 1602                     IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
 1603                     wh, NULL, "%s", "not for our mesh");
 1604                 vap->iv_stats.is_rx_mgtdiscard++;
 1605                 switch (ni->ni_mlstate) {
 1606                 case IEEE80211_NODE_MESH_IDLE:
 1607                 case IEEE80211_NODE_MESH_ESTABLISHED:
 1608                 case IEEE80211_NODE_MESH_HOLDING:
 1609                         /* ignore */
 1610                         break;
 1611                 case IEEE80211_NODE_MESH_OPENSNT:
 1612                 case IEEE80211_NODE_MESH_OPENRCV:
 1613                 case IEEE80211_NODE_MESH_CONFIRMRCV:
 1614                         args[0] = ni->ni_mlpid;
 1615                         args[1] = ni->ni_mllid;
 1616                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
 1617                         ieee80211_send_action(ni,
 1618                             IEEE80211_ACTION_CAT_MESHPEERING,
 1619                             IEEE80211_ACTION_MESHPEERING_CLOSE,
 1620                             args);
 1621                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
 1622                         mesh_peer_timeout_setup(ni);
 1623                         break;
 1624                 }
 1625                 return NULL;
 1626         }
 1627         return (const struct ieee80211_meshpeer_ie *) mp;
 1628 }
 1629 
 1630 static int
 1631 mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
 1632         const struct ieee80211_frame *wh,
 1633         const uint8_t *frm, const uint8_t *efrm)
 1634 {
 1635         struct ieee80211vap *vap = ni->ni_vap;
 1636         struct ieee80211_meshpeer_ie ie;
 1637         const struct ieee80211_meshpeer_ie *meshpeer;
 1638         uint16_t args[3];
 1639 
 1640         /* +2+2 for action + code + capabilites */
 1641         meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
 1642             IEEE80211_ACTION_MESHPEERING_OPEN);
 1643         if (meshpeer == NULL) {
 1644                 return 0;
 1645         }
 1646 
 1647         /* XXX move up */
 1648         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
 1649             "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
 1650 
 1651         switch (ni->ni_mlstate) {
 1652         case IEEE80211_NODE_MESH_IDLE:
 1653                 mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
 1654                 ni->ni_mllid = meshpeer->peer_llinkid;
 1655                 ni->ni_mlpid = mesh_generateid(vap);
 1656                 if (ni->ni_mlpid == 0)
 1657                         return 0;               /* XXX */
 1658                 args[0] = ni->ni_mlpid;
 1659                 /* Announce we're open too... */
 1660                 ieee80211_send_action(ni,
 1661                     IEEE80211_ACTION_CAT_MESHPEERING,
 1662                     IEEE80211_ACTION_MESHPEERING_OPEN, args);
 1663                 /* ...and confirm the link. */
 1664                 args[0] = ni->ni_mlpid;
 1665                 args[1] = ni->ni_mllid;
 1666                 ieee80211_send_action(ni,
 1667                     IEEE80211_ACTION_CAT_MESHPEERING,
 1668                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
 1669                     args);
 1670                 mesh_peer_timeout_setup(ni);
 1671                 break;
 1672         case IEEE80211_NODE_MESH_OPENRCV:
 1673                 /* Wrong Link ID */
 1674                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
 1675                         args[0] = ni->ni_mllid;
 1676                         args[1] = ni->ni_mlpid;
 1677                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
 1678                         ieee80211_send_action(ni,
 1679                             IEEE80211_ACTION_CAT_MESHPEERING,
 1680                             IEEE80211_ACTION_MESHPEERING_CLOSE,
 1681                             args);
 1682                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
 1683                         mesh_peer_timeout_setup(ni);
 1684                         break;
 1685                 }
 1686                 /* Duplicate open, confirm again. */
 1687                 args[0] = ni->ni_mlpid;
 1688                 args[1] = ni->ni_mllid;
 1689                 ieee80211_send_action(ni,
 1690                     IEEE80211_ACTION_CAT_MESHPEERING,
 1691                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
 1692                     args);
 1693                 break;
 1694         case IEEE80211_NODE_MESH_OPENSNT:
 1695                 ni->ni_mllid = meshpeer->peer_llinkid;
 1696                 mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
 1697                 args[0] = ni->ni_mlpid;
 1698                 args[1] = ni->ni_mllid;
 1699                 ieee80211_send_action(ni,
 1700                     IEEE80211_ACTION_CAT_MESHPEERING,
 1701                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
 1702                     args);
 1703                 /* NB: don't setup/clear any timeout */
 1704                 break;
 1705         case IEEE80211_NODE_MESH_CONFIRMRCV:
 1706                 if (ni->ni_mlpid != meshpeer->peer_linkid ||
 1707                     ni->ni_mllid != meshpeer->peer_llinkid) {
 1708                         args[0] = ni->ni_mlpid;
 1709                         args[1] = ni->ni_mllid;
 1710                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
 1711                         ieee80211_send_action(ni,
 1712                             IEEE80211_ACTION_CAT_MESHPEERING,
 1713                             IEEE80211_ACTION_MESHPEERING_CLOSE,
 1714                             args);
 1715                         mesh_linkchange(ni,
 1716                             IEEE80211_NODE_MESH_HOLDING);
 1717                         mesh_peer_timeout_setup(ni);
 1718                         break;
 1719                 }
 1720                 mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
 1721                 ni->ni_mllid = meshpeer->peer_llinkid;
 1722                 args[0] = ni->ni_mlpid;
 1723                 args[1] = ni->ni_mllid;
 1724                 ieee80211_send_action(ni,
 1725                     IEEE80211_ACTION_CAT_MESHPEERING,
 1726                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
 1727                     args);
 1728                 mesh_peer_timeout_stop(ni);
 1729                 break;
 1730         case IEEE80211_NODE_MESH_ESTABLISHED:
 1731                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
 1732                         args[0] = ni->ni_mllid;
 1733                         args[1] = ni->ni_mlpid;
 1734                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
 1735                         ieee80211_send_action(ni,
 1736                             IEEE80211_ACTION_CAT_MESHPEERING,
 1737                             IEEE80211_ACTION_MESHPEERING_CLOSE,
 1738                             args);
 1739                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
 1740                         mesh_peer_timeout_setup(ni);
 1741                         break;
 1742                 }
 1743                 args[0] = ni->ni_mlpid;
 1744                 args[1] = ni->ni_mllid;
 1745                 ieee80211_send_action(ni,
 1746                     IEEE80211_ACTION_CAT_MESHPEERING,
 1747                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
 1748                     args);
 1749                 break;
 1750         case IEEE80211_NODE_MESH_HOLDING:
 1751                 args[0] = ni->ni_mlpid;
 1752                 args[1] = meshpeer->peer_llinkid;
 1753                 args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
 1754                 ieee80211_send_action(ni,
 1755                     IEEE80211_ACTION_CAT_MESHPEERING,
 1756                     IEEE80211_ACTION_MESHPEERING_CLOSE,
 1757                     args);
 1758                 break;
 1759         }
 1760         return 0;
 1761 }
 1762 
 1763 static int
 1764 mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
 1765         const struct ieee80211_frame *wh,
 1766         const uint8_t *frm, const uint8_t *efrm)
 1767 {
 1768         struct ieee80211vap *vap = ni->ni_vap;
 1769         struct ieee80211_meshpeer_ie ie;
 1770         const struct ieee80211_meshpeer_ie *meshpeer;
 1771         uint16_t args[3];
 1772 
 1773         /* +2+2+2+2 for action + code + capabilites + status code + AID */
 1774         meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
 1775             IEEE80211_ACTION_MESHPEERING_CONFIRM);
 1776         if (meshpeer == NULL) {
 1777                 return 0;
 1778         }
 1779 
 1780         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
 1781             "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
 1782             meshpeer->peer_llinkid, meshpeer->peer_linkid);
 1783 
 1784         switch (ni->ni_mlstate) {
 1785         case IEEE80211_NODE_MESH_OPENRCV:
 1786                 mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
 1787                 mesh_peer_timeout_stop(ni);
 1788                 break;
 1789         case IEEE80211_NODE_MESH_OPENSNT:
 1790                 mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
 1791                 break;
 1792         case IEEE80211_NODE_MESH_HOLDING:
 1793                 args[0] = ni->ni_mlpid;
 1794                 args[1] = meshpeer->peer_llinkid;
 1795                 args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
 1796                 ieee80211_send_action(ni,
 1797                     IEEE80211_ACTION_CAT_MESHPEERING,
 1798                     IEEE80211_ACTION_MESHPEERING_CLOSE,
 1799                     args);
 1800                 break;
 1801         case IEEE80211_NODE_MESH_CONFIRMRCV:
 1802                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
 1803                         args[0] = ni->ni_mlpid;
 1804                         args[1] = ni->ni_mllid;
 1805                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
 1806                         ieee80211_send_action(ni,
 1807                             IEEE80211_ACTION_CAT_MESHPEERING,
 1808                             IEEE80211_ACTION_MESHPEERING_CLOSE,
 1809                             args);
 1810                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
 1811                         mesh_peer_timeout_setup(ni);
 1812                 }
 1813                 break;
 1814         default:
 1815                 IEEE80211_DISCARD(vap,
 1816                     IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
 1817                     wh, NULL, "received confirm in invalid state %d",
 1818                     ni->ni_mlstate);
 1819                 vap->iv_stats.is_rx_mgtdiscard++;
 1820                 break;
 1821         }
 1822         return 0;
 1823 }
 1824 
 1825 static int
 1826 mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
 1827         const struct ieee80211_frame *wh,
 1828         const uint8_t *frm, const uint8_t *efrm)
 1829 {
 1830         uint16_t args[3];
 1831 
 1832         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
 1833             ni, "%s", "recv PEER CLOSE");
 1834 
 1835         switch (ni->ni_mlstate) {
 1836         case IEEE80211_NODE_MESH_IDLE:
 1837                 /* ignore */
 1838                 break;
 1839         case IEEE80211_NODE_MESH_OPENRCV:
 1840         case IEEE80211_NODE_MESH_OPENSNT:
 1841         case IEEE80211_NODE_MESH_CONFIRMRCV:
 1842         case IEEE80211_NODE_MESH_ESTABLISHED:
 1843                 args[0] = ni->ni_mlpid;
 1844                 args[1] = ni->ni_mllid;
 1845                 args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
 1846                 ieee80211_send_action(ni,
 1847                     IEEE80211_ACTION_CAT_MESHPEERING,
 1848                     IEEE80211_ACTION_MESHPEERING_CLOSE,
 1849                     args);
 1850                 mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
 1851                 mesh_peer_timeout_setup(ni);
 1852                 break;
 1853         case IEEE80211_NODE_MESH_HOLDING:
 1854                 mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
 1855                 mesh_peer_timeout_setup(ni);
 1856                 break;
 1857         }
 1858         return 0;
 1859 }
 1860 
 1861 /*
 1862  * Link Metric handling.
 1863  */
 1864 static int
 1865 mesh_recv_action_meshlmetric_req(struct ieee80211_node *ni,
 1866         const struct ieee80211_frame *wh,
 1867         const uint8_t *frm, const uint8_t *efrm)
 1868 {
 1869         uint32_t metric;
 1870 
 1871         metric = mesh_airtime_calc(ni);
 1872         ieee80211_send_action(ni,
 1873             IEEE80211_ACTION_CAT_MESHLMETRIC,
 1874             IEEE80211_ACTION_MESHLMETRIC_REP,
 1875             &metric);
 1876         return 0;
 1877 }
 1878 
 1879 static int
 1880 mesh_recv_action_meshlmetric_rep(struct ieee80211_node *ni,
 1881         const struct ieee80211_frame *wh,
 1882         const uint8_t *frm, const uint8_t *efrm)
 1883 {
 1884         return 0;
 1885 }
 1886 
 1887 static int
 1888 mesh_send_action(struct ieee80211_node *ni, struct mbuf *m)
 1889 {
 1890         struct ieee80211_bpf_params params;
 1891 
 1892         memset(&params, 0, sizeof(params));
 1893         params.ibp_pri = WME_AC_VO;
 1894         params.ibp_rate0 = ni->ni_txparms->mgmtrate;
 1895         /* XXX ucast/mcast */
 1896         params.ibp_try0 = ni->ni_txparms->maxretry;
 1897         params.ibp_power = ni->ni_txpower;
 1898         return ieee80211_mgmt_output(ni, m, IEEE80211_FC0_SUBTYPE_ACTION,
 1899              &params);
 1900 }
 1901 
 1902 #define ADDSHORT(frm, v) do {                   \
 1903         frm[0] = (v) & 0xff;                    \
 1904         frm[1] = (v) >> 8;                      \
 1905         frm += 2;                               \
 1906 } while (0)
 1907 #define ADDWORD(frm, v) do {                    \
 1908         frm[0] = (v) & 0xff;                    \
 1909         frm[1] = ((v) >> 8) & 0xff;             \
 1910         frm[2] = ((v) >> 16) & 0xff;            \
 1911         frm[3] = ((v) >> 24) & 0xff;            \
 1912         frm += 4;                               \
 1913 } while (0)
 1914 
 1915 static int
 1916 mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
 1917         int category, int action, void *args0)
 1918 {
 1919         struct ieee80211vap *vap = ni->ni_vap;
 1920         struct ieee80211com *ic = ni->ni_ic;
 1921         uint16_t *args = args0;
 1922         const struct ieee80211_rateset *rs;
 1923         struct mbuf *m;
 1924         uint8_t *frm;
 1925 
 1926         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
 1927             "send PEER OPEN action: localid 0x%x", args[0]);
 1928 
 1929         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
 1930             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
 1931             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
 1932         ieee80211_ref_node(ni);
 1933 
 1934         m = ieee80211_getmgtframe(&frm,
 1935             ic->ic_headroom + sizeof(struct ieee80211_frame),
 1936             sizeof(uint16_t)    /* action+category */
 1937             + sizeof(uint16_t)  /* capabilites */
 1938             + 2 + IEEE80211_RATE_SIZE    
 1939             + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)         
 1940             + 2 + IEEE80211_MESHID_LEN
 1941             + sizeof(struct ieee80211_meshconf_ie)       
 1942             + sizeof(struct ieee80211_meshpeer_ie)
 1943         );
 1944         if (m != NULL) {
 1945                 /*
 1946                  * mesh peer open action frame format:
 1947                  *   [1] category
 1948                  *   [1] action
 1949                  *   [2] capabilities
 1950                  *   [tlv] rates
 1951                  *   [tlv] xrates
 1952                  *   [tlv] mesh id
 1953                  *   [tlv] mesh conf
 1954                  *   [tlv] mesh peer link mgmt
 1955                  */
 1956                 *frm++ = category;
 1957                 *frm++ = action;
 1958                 ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
 1959                 rs = ieee80211_get_suprates(ic, ic->ic_curchan);
 1960                 frm = ieee80211_add_rates(frm, rs);
 1961                 frm = ieee80211_add_xrates(frm, rs);
 1962                 frm = ieee80211_add_meshid(frm, vap);
 1963                 frm = ieee80211_add_meshconf(frm, vap);
 1964                 frm = ieee80211_add_meshpeer(frm, IEEE80211_MESH_PEER_LINK_OPEN,
 1965                     args[0], 0, 0);
 1966                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
 1967                 return mesh_send_action(ni, m);
 1968         } else {
 1969                 vap->iv_stats.is_tx_nobuf++;
 1970                 ieee80211_free_node(ni);
 1971                 return ENOMEM;
 1972         }
 1973 }
 1974 
 1975 static int
 1976 mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
 1977         int category, int action, void *args0)
 1978 {
 1979         struct ieee80211vap *vap = ni->ni_vap;
 1980         struct ieee80211com *ic = ni->ni_ic;
 1981         uint16_t *args = args0;
 1982         const struct ieee80211_rateset *rs;
 1983         struct mbuf *m;
 1984         uint8_t *frm;
 1985 
 1986         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
 1987             "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
 1988             args[0], args[1]);
 1989 
 1990         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
 1991             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
 1992             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
 1993         ieee80211_ref_node(ni);
 1994 
 1995         m = ieee80211_getmgtframe(&frm,
 1996             ic->ic_headroom + sizeof(struct ieee80211_frame),
 1997             sizeof(uint16_t)    /* action+category */
 1998             + sizeof(uint16_t)  /* capabilites */
 1999             + sizeof(uint16_t)  /* status code */
 2000             + sizeof(uint16_t)  /* AID */
 2001             + 2 + IEEE80211_RATE_SIZE    
 2002             + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)         
 2003             + 2 + IEEE80211_MESHID_LEN
 2004             + sizeof(struct ieee80211_meshconf_ie)       
 2005             + sizeof(struct ieee80211_meshpeer_ie)
 2006         );
 2007         if (m != NULL) {
 2008                 /*
 2009                  * mesh peer confirm action frame format:
 2010                  *   [1] category
 2011                  *   [1] action
 2012                  *   [2] capabilities
 2013                  *   [2] status code
 2014                  *   [2] association id (peer ID)
 2015                  *   [tlv] rates
 2016                  *   [tlv] xrates
 2017                  *   [tlv] mesh id
 2018                  *   [tlv] mesh conf
 2019                  *   [tlv] mesh peer link mgmt
 2020                  */
 2021                 *frm++ = category;
 2022                 *frm++ = action;
 2023                 ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
 2024                 ADDSHORT(frm, 0);               /* status code */
 2025                 ADDSHORT(frm, args[1]);         /* AID */
 2026                 rs = ieee80211_get_suprates(ic, ic->ic_curchan);
 2027                 frm = ieee80211_add_rates(frm, rs);
 2028                 frm = ieee80211_add_xrates(frm, rs);
 2029                 frm = ieee80211_add_meshid(frm, vap);
 2030                 frm = ieee80211_add_meshconf(frm, vap);
 2031                 frm = ieee80211_add_meshpeer(frm,
 2032                     IEEE80211_MESH_PEER_LINK_CONFIRM,
 2033                     args[0], args[1], 0);
 2034                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
 2035                 return mesh_send_action(ni, m);
 2036         } else {
 2037                 vap->iv_stats.is_tx_nobuf++;
 2038                 ieee80211_free_node(ni);
 2039                 return ENOMEM;
 2040         }
 2041 }
 2042 
 2043 static int
 2044 mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
 2045         int category, int action, void *args0)
 2046 {
 2047         struct ieee80211vap *vap = ni->ni_vap;
 2048         struct ieee80211com *ic = ni->ni_ic;
 2049         uint16_t *args = args0;
 2050         struct mbuf *m;
 2051         uint8_t *frm;
 2052 
 2053         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
 2054             "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d",
 2055             args[0], args[1], args[2]);
 2056 
 2057         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
 2058             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
 2059             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
 2060         ieee80211_ref_node(ni);
 2061 
 2062         m = ieee80211_getmgtframe(&frm,
 2063             ic->ic_headroom + sizeof(struct ieee80211_frame),
 2064             sizeof(uint16_t)    /* action+category */
 2065             + sizeof(uint16_t)  /* reason code */
 2066             + 2 + IEEE80211_MESHID_LEN
 2067             + sizeof(struct ieee80211_meshpeer_ie) 
 2068         );
 2069         if (m != NULL) {
 2070                 /*
 2071                  * mesh peer close action frame format:
 2072                  *   [1] category
 2073                  *   [1] action
 2074                  *   [2] reason code
 2075                  *   [tlv] mesh id
 2076                  *   [tlv] mesh peer link mgmt
 2077                  */
 2078                 *frm++ = category;
 2079                 *frm++ = action;
 2080                 ADDSHORT(frm, args[2]);         /* reason code */
 2081                 frm = ieee80211_add_meshid(frm, vap);
 2082                 frm = ieee80211_add_meshpeer(frm,
 2083                     IEEE80211_MESH_PEER_LINK_CLOSE,
 2084                     args[0], args[1], args[2]);
 2085                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
 2086                 return mesh_send_action(ni, m);
 2087         } else {
 2088                 vap->iv_stats.is_tx_nobuf++;
 2089                 ieee80211_free_node(ni);
 2090                 return ENOMEM;
 2091         }
 2092 }
 2093 
 2094 static int
 2095 mesh_send_action_meshlink_request(struct ieee80211_node *ni,
 2096         int category, int action, void *arg0)
 2097 {
 2098         struct ieee80211vap *vap = ni->ni_vap;
 2099         struct ieee80211com *ic = ni->ni_ic;
 2100         struct mbuf *m;
 2101         uint8_t *frm;
 2102 
 2103         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
 2104             "%s", "send LINK METRIC REQUEST action");
 2105 
 2106         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
 2107             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
 2108             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
 2109         ieee80211_ref_node(ni);
 2110 
 2111         m = ieee80211_getmgtframe(&frm,
 2112             ic->ic_headroom + sizeof(struct ieee80211_frame),
 2113             sizeof(uint16_t)    /* action+category */
 2114         );
 2115         if (m != NULL) {
 2116                 /*
 2117                  * mesh link metric request
 2118                  *   [1] category
 2119                  *   [1] action
 2120                  */
 2121                 *frm++ = category;
 2122                 *frm++ = action;
 2123                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
 2124                 return mesh_send_action(ni, m);
 2125         } else {
 2126                 vap->iv_stats.is_tx_nobuf++;
 2127                 ieee80211_free_node(ni);
 2128                 return ENOMEM;
 2129         }
 2130 }
 2131 
 2132 static int
 2133 mesh_send_action_meshlink_reply(struct ieee80211_node *ni,
 2134         int category, int action, void *args0)
 2135 {
 2136         struct ieee80211vap *vap = ni->ni_vap;
 2137         struct ieee80211com *ic = ni->ni_ic;
 2138         uint32_t *metric = args0;
 2139         struct mbuf *m;
 2140         uint8_t *frm;
 2141 
 2142         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
 2143             "send LINK METRIC REPLY action: metric 0x%x", *metric);
 2144 
 2145         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
 2146             "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
 2147             ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
 2148         ieee80211_ref_node(ni);
 2149 
 2150         m = ieee80211_getmgtframe(&frm,
 2151             ic->ic_headroom + sizeof(struct ieee80211_frame),
 2152             sizeof(uint16_t)    /* action+category */
 2153             + sizeof(struct ieee80211_meshlmetric_ie)
 2154         );
 2155         if (m != NULL) {
 2156                 /*
 2157                  * mesh link metric reply
 2158                  *   [1] category
 2159                  *   [1] action
 2160                  *   [tlv] mesh link metric
 2161                  */
 2162                 *frm++ = category;
 2163                 *frm++ = action;
 2164                 frm = ieee80211_add_meshlmetric(frm, *metric);
 2165                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
 2166                 return mesh_send_action(ni, m);
 2167         } else {
 2168                 vap->iv_stats.is_tx_nobuf++;
 2169                 ieee80211_free_node(ni);
 2170                 return ENOMEM;
 2171         }
 2172 }
 2173 
 2174 static void
 2175 mesh_peer_timeout_setup(struct ieee80211_node *ni)
 2176 {
 2177         switch (ni->ni_mlstate) {
 2178         case IEEE80211_NODE_MESH_HOLDING:
 2179                 ni->ni_mltval = ieee80211_mesh_holdingtimeout;
 2180                 break;
 2181         case IEEE80211_NODE_MESH_CONFIRMRCV:
 2182                 ni->ni_mltval = ieee80211_mesh_confirmtimeout;
 2183                 break;
 2184         case IEEE80211_NODE_MESH_IDLE:
 2185                 ni->ni_mltval = 0;
 2186                 break;
 2187         default:
 2188                 ni->ni_mltval = ieee80211_mesh_retrytimeout;
 2189                 break;
 2190         }
 2191         if (ni->ni_mltval)
 2192                 callout_reset(&ni->ni_mltimer, ni->ni_mltval,
 2193                     mesh_peer_timeout_cb, ni);
 2194 }
 2195 
 2196 /*
 2197  * Same as above but backoffs timer statisically 50%.
 2198  */
 2199 static void
 2200 mesh_peer_timeout_backoff(struct ieee80211_node *ni)
 2201 {
 2202         uint32_t r;
 2203         
 2204         r = arc4random();
 2205         ni->ni_mltval += r % ni->ni_mltval;
 2206         callout_reset(&ni->ni_mltimer, ni->ni_mltval, mesh_peer_timeout_cb,
 2207             ni);
 2208 }
 2209 
 2210 static __inline void
 2211 mesh_peer_timeout_stop(struct ieee80211_node *ni)
 2212 {
 2213         callout_drain(&ni->ni_mltimer);
 2214 }
 2215 
 2216 /*
 2217  * Mesh Peer Link Management FSM timeout handling.
 2218  */
 2219 static void
 2220 mesh_peer_timeout_cb(void *arg)
 2221 {
 2222         struct ieee80211_node *ni = (struct ieee80211_node *)arg;
 2223         uint16_t args[3];
 2224 
 2225         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
 2226             ni, "mesh link timeout, state %d, retry counter %d",
 2227             ni->ni_mlstate, ni->ni_mlrcnt);
 2228         
 2229         switch (ni->ni_mlstate) {
 2230         case IEEE80211_NODE_MESH_IDLE:
 2231         case IEEE80211_NODE_MESH_ESTABLISHED:
 2232                 break;
 2233         case IEEE80211_NODE_MESH_OPENSNT:
 2234         case IEEE80211_NODE_MESH_OPENRCV:
 2235                 if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
 2236                         args[0] = ni->ni_mlpid;
 2237                         args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
 2238                         ieee80211_send_action(ni,
 2239                             IEEE80211_ACTION_CAT_MESHPEERING,
 2240                             IEEE80211_ACTION_MESHPEERING_CLOSE, args);
 2241                         ni->ni_mlrcnt = 0;
 2242                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
 2243                         mesh_peer_timeout_setup(ni);
 2244                 } else {
 2245                         args[0] = ni->ni_mlpid;
 2246                         ieee80211_send_action(ni,
 2247                             IEEE80211_ACTION_CAT_MESHPEERING,
 2248                             IEEE80211_ACTION_MESHPEERING_OPEN, args);
 2249                         ni->ni_mlrcnt++;
 2250                         mesh_peer_timeout_backoff(ni);
 2251                 }
 2252                 break;
 2253         case IEEE80211_NODE_MESH_CONFIRMRCV:
 2254                 if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
 2255                         args[0] = ni->ni_mlpid;
 2256                         args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
 2257                         ieee80211_send_action(ni,
 2258                             IEEE80211_ACTION_CAT_MESHPEERING,
 2259                             IEEE80211_ACTION_MESHPEERING_CLOSE, args);
 2260                         ni->ni_mlrcnt = 0;
 2261                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
 2262                         mesh_peer_timeout_setup(ni);
 2263                 } else {
 2264                         ni->ni_mlrcnt++;
 2265                         mesh_peer_timeout_setup(ni);
 2266                 }
 2267                 break;
 2268         case IEEE80211_NODE_MESH_HOLDING:
 2269                 mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
 2270                 break;
 2271         }
 2272 }
 2273 
 2274 static int
 2275 mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
 2276 {
 2277         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 2278 
 2279         if (ie == NULL || ie[1] != ms->ms_idlen)
 2280                 return 1;
 2281         return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
 2282 }
 2283 
 2284 /*
 2285  * Check if we are using the same algorithms for this mesh.
 2286  */
 2287 static int
 2288 mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
 2289 {
 2290         const struct ieee80211_meshconf_ie *meshconf =
 2291             (const struct ieee80211_meshconf_ie *) ie;
 2292         const struct ieee80211_mesh_state *ms = vap->iv_mesh;
 2293         uint16_t cap;
 2294 
 2295         if (meshconf == NULL)
 2296                 return 1;
 2297         if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
 2298                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
 2299                     "unknown path selection algorithm: 0x%x\n",
 2300                     meshconf->conf_pselid);
 2301                 return 1;
 2302         }
 2303         if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
 2304                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
 2305                     "unknown path metric algorithm: 0x%x\n",
 2306                     meshconf->conf_pmetid);
 2307                 return 1;
 2308         }
 2309         if (meshconf->conf_ccid != 0) {
 2310                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
 2311                     "unknown congestion control algorithm: 0x%x\n",
 2312                     meshconf->conf_ccid);
 2313                 return 1;
 2314         }
 2315         if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
 2316                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
 2317                     "unknown sync algorithm: 0x%x\n",
 2318                     meshconf->conf_syncid);
 2319                 return 1;
 2320         }
 2321         if (meshconf->conf_authid != 0) {
 2322                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
 2323                     "unknown auth auth algorithm: 0x%x\n",
 2324                     meshconf->conf_pselid);
 2325                 return 1;
 2326         }
 2327         /* NB: conf_cap is only read correctly here */
 2328         cap = LE_READ_2(&meshconf->conf_cap);
 2329         /* Not accepting peers */
 2330         if (!(cap & IEEE80211_MESHCONF_CAP_AP)) {
 2331                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
 2332                     "not accepting peers: 0x%x\n", meshconf->conf_cap);
 2333                 return 1;
 2334         }
 2335         return 0;
 2336 }
 2337 
 2338 static int
 2339 mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
 2340     const uint8_t *ie)
 2341 {
 2342         const struct ieee80211_meshpeer_ie *meshpeer =
 2343             (const struct ieee80211_meshpeer_ie *) ie;
 2344 
 2345         if (meshpeer == NULL || meshpeer->peer_len < 6 ||
 2346             meshpeer->peer_len > 10)
 2347                 return 1;
 2348         switch (subtype) {
 2349         case IEEE80211_MESH_PEER_LINK_OPEN:
 2350                 if (meshpeer->peer_len != 6)
 2351                         return 1;
 2352                 break;
 2353         case IEEE80211_MESH_PEER_LINK_CONFIRM:
 2354                 if (meshpeer->peer_len != 8)
 2355                         return 1;
 2356                 break;
 2357         case IEEE80211_MESH_PEER_LINK_CLOSE:
 2358                 if (meshpeer->peer_len < 8)
 2359                         return 1;
 2360                 if (meshpeer->peer_len == 8 && meshpeer->peer_linkid != 0)
 2361                         return 1;
 2362                 if (meshpeer->peer_rcode == 0)
 2363                         return 1;
 2364                 break;
 2365         }
 2366         return 0;
 2367 }
 2368 
 2369 /*
 2370  * Add a Mesh ID IE to a frame.
 2371  */
 2372 uint8_t *
 2373 ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
 2374 {
 2375         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 2376 
 2377         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
 2378 
 2379         *frm++ = IEEE80211_ELEMID_MESHID;
 2380         *frm++ = ms->ms_idlen;
 2381         memcpy(frm, ms->ms_id, ms->ms_idlen);
 2382         return frm + ms->ms_idlen;
 2383 }
 2384 
 2385 /*
 2386  * Add a Mesh Configuration IE to a frame.
 2387  * For now just use HWMP routing, Airtime link metric, Null Congestion
 2388  * Signaling, Null Sync Protocol and Null Authentication.
 2389  */
 2390 uint8_t *
 2391 ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
 2392 {
 2393         const struct ieee80211_mesh_state *ms = vap->iv_mesh;
 2394         uint16_t caps;
 2395 
 2396         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
 2397 
 2398         *frm++ = IEEE80211_ELEMID_MESHCONF;
 2399         *frm++ = sizeof(struct ieee80211_meshconf_ie) - 2;
 2400         *frm++ = ms->ms_ppath->mpp_ie;          /* path selection */
 2401         *frm++ = ms->ms_pmetric->mpm_ie;        /* link metric */
 2402         *frm++ = IEEE80211_MESHCONF_CC_DISABLED;
 2403         *frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
 2404         *frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
 2405         /* NB: set the number of neighbors before the rest */
 2406         *frm = (ms->ms_neighbors > 15 ? 15 : ms->ms_neighbors) << 1;
 2407         if (ms->ms_flags & IEEE80211_MESHFLAGS_PORTAL)
 2408                 *frm |= IEEE80211_MESHCONF_FORM_MP;
 2409         frm += 1;
 2410         caps = 0;
 2411         if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
 2412                 caps |= IEEE80211_MESHCONF_CAP_AP;
 2413         if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
 2414                 caps |= IEEE80211_MESHCONF_CAP_FWRD;
 2415         ADDSHORT(frm, caps);
 2416         return frm;
 2417 }
 2418 
 2419 /*
 2420  * Add a Mesh Peer Management IE to a frame.
 2421  */
 2422 uint8_t *
 2423 ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
 2424     uint16_t peerid, uint16_t reason)
 2425 {
 2426         /* XXX change for AH */
 2427         static const uint8_t meshpeerproto[4] = IEEE80211_MESH_PEER_PROTO;
 2428 
 2429         KASSERT(localid != 0, ("localid == 0"));
 2430 
 2431         *frm++ = IEEE80211_ELEMID_MESHPEER;
 2432         switch (subtype) {
 2433         case IEEE80211_MESH_PEER_LINK_OPEN:
 2434                 *frm++ = 6;             /* length */
 2435                 memcpy(frm, meshpeerproto, 4);
 2436                 frm += 4;
 2437                 ADDSHORT(frm, localid); /* local ID */
 2438                 break;
 2439         case IEEE80211_MESH_PEER_LINK_CONFIRM:
 2440                 KASSERT(peerid != 0, ("sending peer confirm without peer id"));
 2441                 *frm++ = 8;             /* length */
 2442                 memcpy(frm, meshpeerproto, 4);
 2443                 frm += 4;
 2444                 ADDSHORT(frm, localid); /* local ID */
 2445                 ADDSHORT(frm, peerid);  /* peer ID */
 2446                 break;
 2447         case IEEE80211_MESH_PEER_LINK_CLOSE:
 2448                 if (peerid)
 2449                         *frm++ = 10;    /* length */
 2450                 else
 2451                         *frm++ = 8;     /* length */
 2452                 memcpy(frm, meshpeerproto, 4);
 2453                 frm += 4;
 2454                 ADDSHORT(frm, localid); /* local ID */
 2455                 if (peerid)
 2456                         ADDSHORT(frm, peerid);  /* peer ID */
 2457                 ADDSHORT(frm, reason);
 2458                 break;
 2459         }
 2460         return frm;
 2461 }
 2462 
 2463 /*
 2464  * Compute an Airtime Link Metric for the link with this node.
 2465  *
 2466  * Based on Draft 3.0 spec (11B.10, p.149).
 2467  */
 2468 /*
 2469  * Max 802.11s overhead.
 2470  */
 2471 #define IEEE80211_MESH_MAXOVERHEAD \
 2472         (sizeof(struct ieee80211_qosframe_addr4) \
 2473          + sizeof(struct ieee80211_meshcntl_ae11) \
 2474         + sizeof(struct llc) \
 2475         + IEEE80211_ADDR_LEN \
 2476         + IEEE80211_WEP_IVLEN \
 2477         + IEEE80211_WEP_KIDLEN \
 2478         + IEEE80211_WEP_CRCLEN \
 2479         + IEEE80211_WEP_MICLEN \
 2480         + IEEE80211_CRC_LEN)
 2481 uint32_t
 2482 mesh_airtime_calc(struct ieee80211_node *ni)
 2483 {
 2484 #define M_BITS 8
 2485 #define S_FACTOR (2 * M_BITS)
 2486         struct ieee80211com *ic = ni->ni_ic;
 2487         struct ifnet *ifp = ni->ni_vap->iv_ifp;
 2488         const static int nbits = 8192 << M_BITS;
 2489         uint32_t overhead, rate, errrate;
 2490         uint64_t res;
 2491 
 2492         /* Time to transmit a frame */
 2493         rate = ni->ni_txrate;
 2494         overhead = ieee80211_compute_duration(ic->ic_rt,
 2495             ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
 2496         /* Error rate in percentage */
 2497         /* XXX assuming small failures are ok */
 2498         errrate = (((ifp->if_oerrors +
 2499             ifp->if_ierrors) / 100) << M_BITS) / 100;
 2500         res = (overhead + (nbits / rate)) *
 2501             ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
 2502 
 2503         return (uint32_t)(res >> S_FACTOR);
 2504 #undef M_BITS
 2505 #undef S_FACTOR
 2506 }
 2507 
 2508 /*
 2509  * Add a Mesh Link Metric report IE to a frame.
 2510  */
 2511 uint8_t *
 2512 ieee80211_add_meshlmetric(uint8_t *frm, uint32_t metric)
 2513 {
 2514         *frm++ = IEEE80211_ELEMID_MESHLINK;
 2515         *frm++ = 4;
 2516         ADDWORD(frm, metric);
 2517         return frm;
 2518 }
 2519 #undef ADDSHORT
 2520 #undef ADDWORD
 2521 
 2522 /*
 2523  * Initialize any mesh-specific node state.
 2524  */
 2525 void
 2526 ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
 2527 {
 2528         ni->ni_flags |= IEEE80211_NODE_QOS;
 2529         callout_init(&ni->ni_mltimer, CALLOUT_MPSAFE);
 2530 }
 2531 
 2532 /*
 2533  * Cleanup any mesh-specific node state.
 2534  */
 2535 void
 2536 ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
 2537 {
 2538         struct ieee80211vap *vap = ni->ni_vap;
 2539         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 2540 
 2541         callout_drain(&ni->ni_mltimer);
 2542         /* NB: short-circuit callbacks after mesh_vdetach */
 2543         if (vap->iv_mesh != NULL)
 2544                 ms->ms_ppath->mpp_peerdown(ni);
 2545 }
 2546 
 2547 void
 2548 ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
 2549 {
 2550         ni->ni_meshidlen = ie[1];
 2551         memcpy(ni->ni_meshid, ie + 2, ie[1]);
 2552 }
 2553 
 2554 /*
 2555  * Setup mesh-specific node state on neighbor discovery.
 2556  */
 2557 void
 2558 ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
 2559         const struct ieee80211_frame *wh,
 2560         const struct ieee80211_scanparams *sp)
 2561 {
 2562         ieee80211_parse_meshid(ni, sp->meshid);
 2563 }
 2564 
 2565 void
 2566 ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
 2567         struct ieee80211_beacon_offsets *bo)
 2568 {
 2569         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
 2570 
 2571         if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
 2572                 (void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
 2573                 clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
 2574         }
 2575 }
 2576 
 2577 static int
 2578 mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
 2579 {
 2580         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 2581         uint8_t tmpmeshid[IEEE80211_NWID_LEN];
 2582         struct ieee80211_mesh_route *rt;
 2583         struct ieee80211req_mesh_route *imr;
 2584         size_t len, off;
 2585         uint8_t *p;
 2586         int error;
 2587 
 2588         if (vap->iv_opmode != IEEE80211_M_MBSS)
 2589                 return ENOSYS;
 2590 
 2591         error = 0;
 2592         switch (ireq->i_type) {
 2593         case IEEE80211_IOC_MESH_ID:
 2594                 ireq->i_len = ms->ms_idlen;
 2595                 memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
 2596                 error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
 2597                 break;
 2598         case IEEE80211_IOC_MESH_AP:
 2599                 ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
 2600                 break;
 2601         case IEEE80211_IOC_MESH_FWRD:
 2602                 ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
 2603                 break;
 2604         case IEEE80211_IOC_MESH_TTL:
 2605                 ireq->i_val = ms->ms_ttl;
 2606                 break;
 2607         case IEEE80211_IOC_MESH_RTCMD:
 2608                 switch (ireq->i_val) {
 2609                 case IEEE80211_MESH_RTCMD_LIST:
 2610                         len = 0;
 2611                         MESH_RT_LOCK(ms);
 2612                         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
 2613                                 len += sizeof(*imr);
 2614                         }
 2615                         MESH_RT_UNLOCK(ms);
 2616                         if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
 2617                                 ireq->i_len = len;
 2618                                 return ENOMEM;
 2619                         }
 2620                         ireq->i_len = len;
 2621                         /* XXX M_WAIT? */
 2622                         p = malloc(len, M_TEMP, M_NOWAIT | M_ZERO);
 2623                         if (p == NULL)
 2624                                 return ENOMEM;
 2625                         off = 0;
 2626                         MESH_RT_LOCK(ms);
 2627                         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
 2628                                 if (off >= len)
 2629                                         break;
 2630                                 imr = (struct ieee80211req_mesh_route *)
 2631                                     (p + off);
 2632                                 imr->imr_flags = rt->rt_flags;
 2633                                 IEEE80211_ADDR_COPY(imr->imr_dest,
 2634                                     rt->rt_dest);
 2635                                 IEEE80211_ADDR_COPY(imr->imr_nexthop,
 2636                                     rt->rt_nexthop);
 2637                                 imr->imr_metric = rt->rt_metric;
 2638                                 imr->imr_nhops = rt->rt_nhops;
 2639                                 imr->imr_lifetime = rt->rt_lifetime;
 2640                                 imr->imr_lastmseq = rt->rt_lastmseq;
 2641                                 off += sizeof(*imr);
 2642                         }
 2643                         MESH_RT_UNLOCK(ms);
 2644                         error = copyout(p, (uint8_t *)ireq->i_data,
 2645                             ireq->i_len);
 2646                         free(p, M_TEMP);
 2647                         break;
 2648                 case IEEE80211_MESH_RTCMD_FLUSH:
 2649                 case IEEE80211_MESH_RTCMD_ADD:
 2650                 case IEEE80211_MESH_RTCMD_DELETE:
 2651                         return EINVAL;
 2652                 default:
 2653                         return ENOSYS;
 2654                 }
 2655                 break;
 2656         case IEEE80211_IOC_MESH_PR_METRIC:
 2657                 len = strlen(ms->ms_pmetric->mpm_descr);
 2658                 if (ireq->i_len < len)
 2659                         return EINVAL;
 2660                 ireq->i_len = len;
 2661                 error = copyout(ms->ms_pmetric->mpm_descr,
 2662                     (uint8_t *)ireq->i_data, len);
 2663                 break;
 2664         case IEEE80211_IOC_MESH_PR_PATH:
 2665                 len = strlen(ms->ms_ppath->mpp_descr);
 2666                 if (ireq->i_len < len)
 2667                         return EINVAL;
 2668                 ireq->i_len = len;
 2669                 error = copyout(ms->ms_ppath->mpp_descr,
 2670                     (uint8_t *)ireq->i_data, len);
 2671                 break;
 2672         default:
 2673                 return ENOSYS;
 2674         }
 2675 
 2676         return error;
 2677 }
 2678 IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
 2679 
 2680 static int
 2681 mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
 2682 {
 2683         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 2684         uint8_t tmpmeshid[IEEE80211_NWID_LEN];
 2685         uint8_t tmpaddr[IEEE80211_ADDR_LEN];
 2686         char tmpproto[IEEE80211_MESH_PROTO_DSZ];
 2687         int error;
 2688 
 2689         if (vap->iv_opmode != IEEE80211_M_MBSS)
 2690                 return ENOSYS;
 2691 
 2692         error = 0;
 2693         switch (ireq->i_type) {
 2694         case IEEE80211_IOC_MESH_ID:
 2695                 if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
 2696                         return EINVAL;
 2697                 error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
 2698                 if (error != 0)
 2699                         break;
 2700                 memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
 2701                 ms->ms_idlen = ireq->i_len;
 2702                 memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
 2703                 error = ENETRESET;
 2704                 break;
 2705         case IEEE80211_IOC_MESH_AP:
 2706                 if (ireq->i_val)
 2707                         ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
 2708                 else
 2709                         ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
 2710                 error = ENETRESET;
 2711                 break;
 2712         case IEEE80211_IOC_MESH_FWRD:
 2713                 if (ireq->i_val)
 2714                         ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
 2715                 else
 2716                         ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
 2717                 break;
 2718         case IEEE80211_IOC_MESH_TTL:
 2719                 ms->ms_ttl = (uint8_t) ireq->i_val;
 2720                 break;
 2721         case IEEE80211_IOC_MESH_RTCMD:
 2722                 switch (ireq->i_val) {
 2723                 case IEEE80211_MESH_RTCMD_LIST:
 2724                         return EINVAL;
 2725                 case IEEE80211_MESH_RTCMD_FLUSH:
 2726                         ieee80211_mesh_rt_flush(vap);
 2727                         break;
 2728                 case IEEE80211_MESH_RTCMD_ADD:
 2729                         if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||
 2730                             IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))
 2731                                 return EINVAL;
 2732                         error = copyin(ireq->i_data, &tmpaddr,
 2733                             IEEE80211_ADDR_LEN);
 2734                         if (error == 0)
 2735                                 ieee80211_mesh_discover(vap, tmpaddr, NULL);
 2736                         break;
 2737                 case IEEE80211_MESH_RTCMD_DELETE:
 2738                         ieee80211_mesh_rt_del(vap, ireq->i_data);
 2739                         break;
 2740                 default:
 2741                         return ENOSYS;
 2742                 }
 2743                 break;
 2744         case IEEE80211_IOC_MESH_PR_METRIC:
 2745                 error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
 2746                 if (error == 0) {
 2747                         error = mesh_select_proto_metric(vap, tmpproto);
 2748                         if (error == 0)
 2749                                 error = ENETRESET;
 2750                 }
 2751                 break;
 2752         case IEEE80211_IOC_MESH_PR_PATH:
 2753                 error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
 2754                 if (error == 0) {
 2755                         error = mesh_select_proto_path(vap, tmpproto);
 2756                         if (error == 0)
 2757                                 error = ENETRESET;
 2758                 }
 2759                 break;
 2760         default:
 2761                 return ENOSYS;
 2762         }
 2763         return error;
 2764 }
 2765 IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);

Cache object: 5b6c73b245efb1fc61a15e0b90f9e98f


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.