1/*
2 * Copyright (c) 2008, 2009 open80211s Ltd.
3 * Authors:    Luis Carlos Cobo <luisca@cozybit.com>
4 * 	       Javier Cardona <javier@cozybit.com>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <linux/slab.h>
12#include <asm/unaligned.h>
13#include "ieee80211_i.h"
14#include "mesh.h"
15#include "driver-ops.h"
16
17static int mesh_allocated;
18static struct kmem_cache *rm_cache;
19
20bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
21{
22	return (mgmt->u.action.u.mesh_action.action_code ==
23			WLAN_MESH_ACTION_HWMP_PATH_SELECTION);
24}
25
26void ieee80211s_init(void)
27{
28	mesh_pathtbl_init();
29	mesh_allocated = 1;
30	rm_cache = kmem_cache_create("mesh_rmc", sizeof(struct rmc_entry),
31				     0, 0, NULL);
32}
33
34void ieee80211s_stop(void)
35{
36	if (!mesh_allocated)
37		return;
38	mesh_pathtbl_unregister();
39	kmem_cache_destroy(rm_cache);
40}
41
42static void ieee80211_mesh_housekeeping_timer(unsigned long data)
43{
44	struct ieee80211_sub_if_data *sdata = (void *) data;
45	struct ieee80211_local *local = sdata->local;
46	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
47
48	set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
49
50	ieee80211_queue_work(&local->hw, &sdata->work);
51}
52
53/**
54 * mesh_matches_local - check if the config of a mesh point matches ours
55 *
56 * @sdata: local mesh subif
57 * @ie: information elements of a management frame from the mesh peer
58 *
59 * This function checks if the mesh configuration of a mesh point matches the
60 * local mesh configuration, i.e. if both nodes belong to the same mesh network.
61 */
62bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
63			struct ieee802_11_elems *ie)
64{
65	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
66	u32 basic_rates = 0;
67	struct cfg80211_chan_def sta_chan_def;
68
69	/*
70	 * As support for each feature is added, check for matching
71	 * - On mesh config capabilities
72	 *   - Power Save Support En
73	 *   - Sync support enabled
74	 *   - Sync support active
75	 *   - Sync support required from peer
76	 *   - MDA enabled
77	 * - Power management control on fc
78	 */
79	if (!(ifmsh->mesh_id_len == ie->mesh_id_len &&
80	     memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
81	     (ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&
82	     (ifmsh->mesh_pm_id == ie->mesh_config->meshconf_pmetric) &&
83	     (ifmsh->mesh_cc_id == ie->mesh_config->meshconf_congest) &&
84	     (ifmsh->mesh_sp_id == ie->mesh_config->meshconf_synch) &&
85	     (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth)))
86		return false;
87
88	ieee80211_sta_get_rates(sdata, ie, ieee80211_get_sdata_band(sdata),
89				&basic_rates);
90
91	if (sdata->vif.bss_conf.basic_rates != basic_rates)
92		return false;
93
94	ieee80211_ht_oper_to_chandef(sdata->vif.bss_conf.chandef.chan,
95				     ie->ht_operation, &sta_chan_def);
96
97	if (!cfg80211_chandef_compatible(&sdata->vif.bss_conf.chandef,
98					 &sta_chan_def))
99		return false;
100
101	return true;
102}
103
104/**
105 * mesh_peer_accepts_plinks - check if an mp is willing to establish peer links
106 *
107 * @ie: information elements of a management frame from the mesh peer
108 */
109bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
110{
111	return (ie->mesh_config->meshconf_cap &
112			IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS) != 0;
113}
114
115/**
116 * mesh_accept_plinks_update - update accepting_plink in local mesh beacons
117 *
118 * @sdata: mesh interface in which mesh beacons are going to be updated
119 *
120 * Returns: beacon changed flag if the beacon content changed.
121 */
122u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
123{
124	bool free_plinks;
125	u32 changed = 0;
126
127	/* In case mesh_plink_free_count > 0 and mesh_plinktbl_capacity == 0,
128	 * the mesh interface might be able to establish plinks with peers that
129	 * are already on the table but are not on PLINK_ESTAB state. However,
130	 * in general the mesh interface is not accepting peer link requests
131	 * from new peers, and that must be reflected in the beacon
132	 */
133	free_plinks = mesh_plink_availables(sdata);
134
135	if (free_plinks != sdata->u.mesh.accepting_plinks) {
136		sdata->u.mesh.accepting_plinks = free_plinks;
137		changed = BSS_CHANGED_BEACON;
138	}
139
140	return changed;
141}
142
143/*
144 * mesh_sta_cleanup - clean up any mesh sta state
145 *
146 * @sta: mesh sta to clean up.
147 */
148void mesh_sta_cleanup(struct sta_info *sta)
149{
150	struct ieee80211_sub_if_data *sdata = sta->sdata;
151	u32 changed;
152
153	/*
154	 * maybe userspace handles peer allocation and peering, but in either
155	 * case the beacon is still generated by the kernel and we might need
156	 * an update.
157	 */
158	changed = mesh_accept_plinks_update(sdata);
159	if (!sdata->u.mesh.user_mpm) {
160		changed |= mesh_plink_deactivate(sta);
161		del_timer_sync(&sta->plink_timer);
162	}
163
164	/* make sure no readers can access nexthop sta from here on */
165	mesh_path_flush_by_nexthop(sta);
166	synchronize_net();
167
168	if (changed)
169		ieee80211_mbss_info_change_notify(sdata, changed);
170}
171
172int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
173{
174	int i;
175
176	sdata->u.mesh.rmc = kmalloc(sizeof(struct mesh_rmc), GFP_KERNEL);
177	if (!sdata->u.mesh.rmc)
178		return -ENOMEM;
179	sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
180	for (i = 0; i < RMC_BUCKETS; i++)
181		INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i]);
182	return 0;
183}
184
185void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
186{
187	struct mesh_rmc *rmc = sdata->u.mesh.rmc;
188	struct rmc_entry *p, *n;
189	int i;
190
191	if (!sdata->u.mesh.rmc)
192		return;
193
194	for (i = 0; i < RMC_BUCKETS; i++) {
195		list_for_each_entry_safe(p, n, &rmc->bucket[i], list) {
196			list_del(&p->list);
197			kmem_cache_free(rm_cache, p);
198		}
199	}
200
201	kfree(rmc);
202	sdata->u.mesh.rmc = NULL;
203}
204
205/**
206 * mesh_rmc_check - Check frame in recent multicast cache and add if absent.
207 *
208 * @sdata:	interface
209 * @sa:		source address
210 * @mesh_hdr:	mesh_header
211 *
212 * Returns: 0 if the frame is not in the cache, nonzero otherwise.
213 *
214 * Checks using the source address and the mesh sequence number if we have
215 * received this frame lately. If the frame is not in the cache, it is added to
216 * it.
217 */
218int mesh_rmc_check(struct ieee80211_sub_if_data *sdata,
219		   const u8 *sa, struct ieee80211s_hdr *mesh_hdr)
220{
221	struct mesh_rmc *rmc = sdata->u.mesh.rmc;
222	u32 seqnum = 0;
223	int entries = 0;
224	u8 idx;
225	struct rmc_entry *p, *n;
226
227	/* Don't care about endianness since only match matters */
228	memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum));
229	idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask;
230	list_for_each_entry_safe(p, n, &rmc->bucket[idx], list) {
231		++entries;
232		if (time_after(jiffies, p->exp_time) ||
233		    entries == RMC_QUEUE_MAX_LEN) {
234			list_del(&p->list);
235			kmem_cache_free(rm_cache, p);
236			--entries;
237		} else if ((seqnum == p->seqnum) && ether_addr_equal(sa, p->sa))
238			return -1;
239	}
240
241	p = kmem_cache_alloc(rm_cache, GFP_ATOMIC);
242	if (!p)
243		return 0;
244
245	p->seqnum = seqnum;
246	p->exp_time = jiffies + RMC_TIMEOUT;
247	memcpy(p->sa, sa, ETH_ALEN);
248	list_add(&p->list, &rmc->bucket[idx]);
249	return 0;
250}
251
252int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata,
253			 struct sk_buff *skb)
254{
255	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
256	u8 *pos, neighbors;
257	u8 meshconf_len = sizeof(struct ieee80211_meshconf_ie);
258
259	if (skb_tailroom(skb) < 2 + meshconf_len)
260		return -ENOMEM;
261
262	pos = skb_put(skb, 2 + meshconf_len);
263	*pos++ = WLAN_EID_MESH_CONFIG;
264	*pos++ = meshconf_len;
265
266	/* save a pointer for quick updates in pre-tbtt */
267	ifmsh->meshconf_offset = pos - skb->data;
268
269	/* Active path selection protocol ID */
270	*pos++ = ifmsh->mesh_pp_id;
271	/* Active path selection metric ID   */
272	*pos++ = ifmsh->mesh_pm_id;
273	/* Congestion control mode identifier */
274	*pos++ = ifmsh->mesh_cc_id;
275	/* Synchronization protocol identifier */
276	*pos++ = ifmsh->mesh_sp_id;
277	/* Authentication Protocol identifier */
278	*pos++ = ifmsh->mesh_auth_id;
279	/* Mesh Formation Info - number of neighbors */
280	neighbors = atomic_read(&ifmsh->estab_plinks);
281	neighbors = min_t(int, neighbors, IEEE80211_MAX_MESH_PEERINGS);
282	*pos++ = neighbors << 1;
283	/* Mesh capability */
284	*pos = 0x00;
285	*pos |= ifmsh->mshcfg.dot11MeshForwarding ?
286			IEEE80211_MESHCONF_CAPAB_FORWARDING : 0x00;
287	*pos |= ifmsh->accepting_plinks ?
288			IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
289	/* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
290	*pos |= ifmsh->ps_peers_deep_sleep ?
291			IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00;
292	*pos++ |= ifmsh->adjusting_tbtt ?
293			IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00;
294	*pos++ = 0x00;
295
296	return 0;
297}
298
299int mesh_add_meshid_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
300{
301	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
302	u8 *pos;
303
304	if (skb_tailroom(skb) < 2 + ifmsh->mesh_id_len)
305		return -ENOMEM;
306
307	pos = skb_put(skb, 2 + ifmsh->mesh_id_len);
308	*pos++ = WLAN_EID_MESH_ID;
309	*pos++ = ifmsh->mesh_id_len;
310	if (ifmsh->mesh_id_len)
311		memcpy(pos, ifmsh->mesh_id, ifmsh->mesh_id_len);
312
313	return 0;
314}
315
316static int mesh_add_awake_window_ie(struct ieee80211_sub_if_data *sdata,
317				    struct sk_buff *skb)
318{
319	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
320	u8 *pos;
321
322	/* see IEEE802.11-2012 13.14.6 */
323	if (ifmsh->ps_peers_light_sleep == 0 &&
324	    ifmsh->ps_peers_deep_sleep == 0 &&
325	    ifmsh->nonpeer_pm == NL80211_MESH_POWER_ACTIVE)
326		return 0;
327
328	if (skb_tailroom(skb) < 4)
329		return -ENOMEM;
330
331	pos = skb_put(skb, 2 + 2);
332	*pos++ = WLAN_EID_MESH_AWAKE_WINDOW;
333	*pos++ = 2;
334	put_unaligned_le16(ifmsh->mshcfg.dot11MeshAwakeWindowDuration, pos);
335
336	return 0;
337}
338
339int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
340			struct sk_buff *skb)
341{
342	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
343	u8 offset, len;
344	const u8 *data;
345
346	if (!ifmsh->ie || !ifmsh->ie_len)
347		return 0;
348
349	/* fast-forward to vendor IEs */
350	offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
351
352	if (offset) {
353		len = ifmsh->ie_len - offset;
354		data = ifmsh->ie + offset;
355		if (skb_tailroom(skb) < len)
356			return -ENOMEM;
357		memcpy(skb_put(skb, len), data, len);
358	}
359
360	return 0;
361}
362
363int mesh_add_rsn_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
364{
365	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
366	u8 len = 0;
367	const u8 *data;
368
369	if (!ifmsh->ie || !ifmsh->ie_len)
370		return 0;
371
372	/* find RSN IE */
373	data = cfg80211_find_ie(WLAN_EID_RSN, ifmsh->ie, ifmsh->ie_len);
374	if (!data)
375		return 0;
376
377	len = data[1] + 2;
378
379	if (skb_tailroom(skb) < len)
380		return -ENOMEM;
381	memcpy(skb_put(skb, len), data, len);
382
383	return 0;
384}
385
386static int mesh_add_ds_params_ie(struct ieee80211_sub_if_data *sdata,
387				 struct sk_buff *skb)
388{
389	struct ieee80211_chanctx_conf *chanctx_conf;
390	struct ieee80211_channel *chan;
391	u8 *pos;
392
393	if (skb_tailroom(skb) < 3)
394		return -ENOMEM;
395
396	rcu_read_lock();
397	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
398	if (WARN_ON(!chanctx_conf)) {
399		rcu_read_unlock();
400		return -EINVAL;
401	}
402	chan = chanctx_conf->def.chan;
403	rcu_read_unlock();
404
405	pos = skb_put(skb, 2 + 1);
406	*pos++ = WLAN_EID_DS_PARAMS;
407	*pos++ = 1;
408	*pos++ = ieee80211_frequency_to_channel(chan->center_freq);
409
410	return 0;
411}
412
413int mesh_add_ht_cap_ie(struct ieee80211_sub_if_data *sdata,
414		       struct sk_buff *skb)
415{
416	struct ieee80211_local *local = sdata->local;
417	enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
418	struct ieee80211_supported_band *sband;
419	u8 *pos;
420
421	sband = local->hw.wiphy->bands[band];
422	if (!sband->ht_cap.ht_supported ||
423	    sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
424	    sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_5 ||
425	    sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_10)
426		return 0;
427
428	if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_cap))
429		return -ENOMEM;
430
431	pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_cap));
432	ieee80211_ie_build_ht_cap(pos, &sband->ht_cap, sband->ht_cap.cap);
433
434	return 0;
435}
436
437int mesh_add_ht_oper_ie(struct ieee80211_sub_if_data *sdata,
438			struct sk_buff *skb)
439{
440	struct ieee80211_local *local = sdata->local;
441	struct ieee80211_chanctx_conf *chanctx_conf;
442	struct ieee80211_channel *channel;
443	enum nl80211_channel_type channel_type =
444		cfg80211_get_chandef_type(&sdata->vif.bss_conf.chandef);
445	struct ieee80211_supported_band *sband;
446	struct ieee80211_sta_ht_cap *ht_cap;
447	u8 *pos;
448
449	rcu_read_lock();
450	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
451	if (WARN_ON(!chanctx_conf)) {
452		rcu_read_unlock();
453		return -EINVAL;
454	}
455	channel = chanctx_conf->def.chan;
456	rcu_read_unlock();
457
458	sband = local->hw.wiphy->bands[channel->band];
459	ht_cap = &sband->ht_cap;
460
461	if (!ht_cap->ht_supported || channel_type == NL80211_CHAN_NO_HT)
462		return 0;
463
464	if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_operation))
465		return -ENOMEM;
466
467	pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_operation));
468	ieee80211_ie_build_ht_oper(pos, ht_cap, &sdata->vif.bss_conf.chandef,
469				   sdata->vif.bss_conf.ht_operation_mode);
470
471	return 0;
472}
473
474static void ieee80211_mesh_path_timer(unsigned long data)
475{
476	struct ieee80211_sub_if_data *sdata =
477		(struct ieee80211_sub_if_data *) data;
478
479	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
480}
481
482static void ieee80211_mesh_path_root_timer(unsigned long data)
483{
484	struct ieee80211_sub_if_data *sdata =
485		(struct ieee80211_sub_if_data *) data;
486	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
487
488	set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
489
490	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
491}
492
493void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
494{
495	if (ifmsh->mshcfg.dot11MeshHWMPRootMode > IEEE80211_ROOTMODE_ROOT)
496		set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
497	else {
498		clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
499		/* stop running timer */
500		del_timer_sync(&ifmsh->mesh_path_root_timer);
501	}
502}
503
504/**
505 * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
506 * @hdr:	802.11 frame header
507 * @fc:		frame control field
508 * @meshda:	destination address in the mesh
509 * @meshsa:	source address address in the mesh.  Same as TA, as frame is
510 *              locally originated.
511 *
512 * Return the length of the 802.11 (does not include a mesh control header)
513 */
514int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
515				  const u8 *meshda, const u8 *meshsa)
516{
517	if (is_multicast_ether_addr(meshda)) {
518		*fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
519		/* DA TA SA */
520		memcpy(hdr->addr1, meshda, ETH_ALEN);
521		memcpy(hdr->addr2, meshsa, ETH_ALEN);
522		memcpy(hdr->addr3, meshsa, ETH_ALEN);
523		return 24;
524	} else {
525		*fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
526		/* RA TA DA SA */
527		eth_zero_addr(hdr->addr1);   /* RA is resolved later */
528		memcpy(hdr->addr2, meshsa, ETH_ALEN);
529		memcpy(hdr->addr3, meshda, ETH_ALEN);
530		memcpy(hdr->addr4, meshsa, ETH_ALEN);
531		return 30;
532	}
533}
534
535/**
536 * ieee80211_new_mesh_header - create a new mesh header
537 * @sdata:	mesh interface to be used
538 * @meshhdr:    uninitialized mesh header
539 * @addr4or5:   1st address in the ae header, which may correspond to address 4
540 *              (if addr6 is NULL) or address 5 (if addr6 is present). It may
541 *              be NULL.
542 * @addr6:	2nd address in the ae header, which corresponds to addr6 of the
543 *              mesh frame
544 *
545 * Return the header length.
546 */
547int ieee80211_new_mesh_header(struct ieee80211_sub_if_data *sdata,
548			      struct ieee80211s_hdr *meshhdr,
549			      const char *addr4or5, const char *addr6)
550{
551	if (WARN_ON(!addr4or5 && addr6))
552		return 0;
553
554	memset(meshhdr, 0, sizeof(*meshhdr));
555
556	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
557
558	/* FIXME: racy -- TX on multiple queues can be concurrent */
559	put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
560	sdata->u.mesh.mesh_seqnum++;
561
562	if (addr4or5 && !addr6) {
563		meshhdr->flags |= MESH_FLAGS_AE_A4;
564		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);
565		return 2 * ETH_ALEN;
566	} else if (addr4or5 && addr6) {
567		meshhdr->flags |= MESH_FLAGS_AE_A5_A6;
568		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);
569		memcpy(meshhdr->eaddr2, addr6, ETH_ALEN);
570		return 3 * ETH_ALEN;
571	}
572
573	return ETH_ALEN;
574}
575
576static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata)
577{
578	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
579	u32 changed;
580
581	if (ifmsh->mshcfg.plink_timeout > 0)
582		ieee80211_sta_expire(sdata, ifmsh->mshcfg.plink_timeout * HZ);
583	mesh_path_expire(sdata);
584
585	changed = mesh_accept_plinks_update(sdata);
586	ieee80211_mbss_info_change_notify(sdata, changed);
587
588	mod_timer(&ifmsh->housekeeping_timer,
589		  round_jiffies(jiffies +
590				IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
591}
592
593static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
594{
595	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
596	u32 interval;
597
598	mesh_path_tx_root_frame(sdata);
599
600	if (ifmsh->mshcfg.dot11MeshHWMPRootMode == IEEE80211_PROACTIVE_RANN)
601		interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
602	else
603		interval = ifmsh->mshcfg.dot11MeshHWMProotInterval;
604
605	mod_timer(&ifmsh->mesh_path_root_timer,
606		  round_jiffies(TU_TO_EXP_TIME(interval)));
607}
608
609static int
610ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
611{
612	struct beacon_data *bcn;
613	int head_len, tail_len;
614	struct sk_buff *skb;
615	struct ieee80211_mgmt *mgmt;
616	struct ieee80211_chanctx_conf *chanctx_conf;
617	struct mesh_csa_settings *csa;
618	enum ieee80211_band band;
619	u8 *pos;
620	struct ieee80211_sub_if_data *sdata;
621	int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
622		      sizeof(mgmt->u.beacon);
623
624	sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
625	rcu_read_lock();
626	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
627	band = chanctx_conf->def.chan->band;
628	rcu_read_unlock();
629
630	head_len = hdr_len +
631		   2 + /* NULL SSID */
632		   /* Channel Switch Announcement */
633		   2 + sizeof(struct ieee80211_channel_sw_ie) +
634		   /* Mesh Channel Swith Parameters */
635		   2 + sizeof(struct ieee80211_mesh_chansw_params_ie) +
636		   2 + 8 + /* supported rates */
637		   2 + 3; /* DS params */
638	tail_len = 2 + (IEEE80211_MAX_SUPP_RATES - 8) +
639		   2 + sizeof(struct ieee80211_ht_cap) +
640		   2 + sizeof(struct ieee80211_ht_operation) +
641		   2 + ifmsh->mesh_id_len +
642		   2 + sizeof(struct ieee80211_meshconf_ie) +
643		   2 + sizeof(__le16) + /* awake window */
644		   ifmsh->ie_len;
645
646	bcn = kzalloc(sizeof(*bcn) + head_len + tail_len, GFP_KERNEL);
647	/* need an skb for IE builders to operate on */
648	skb = dev_alloc_skb(max(head_len, tail_len));
649
650	if (!bcn || !skb)
651		goto out_free;
652
653	/*
654	 * pointers go into the block we allocated,
655	 * memory is | beacon_data | head | tail |
656	 */
657	bcn->head = ((u8 *) bcn) + sizeof(*bcn);
658
659	/* fill in the head */
660	mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
661	memset(mgmt, 0, hdr_len);
662	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
663					  IEEE80211_STYPE_BEACON);
664	eth_broadcast_addr(mgmt->da);
665	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
666	memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
667	ieee80211_mps_set_frame_flags(sdata, NULL, (void *) mgmt);
668	mgmt->u.beacon.beacon_int =
669		cpu_to_le16(sdata->vif.bss_conf.beacon_int);
670	mgmt->u.beacon.capab_info |= cpu_to_le16(
671		sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
672
673	pos = skb_put(skb, 2);
674	*pos++ = WLAN_EID_SSID;
675	*pos++ = 0x0;
676
677	rcu_read_lock();
678	csa = rcu_dereference(ifmsh->csa);
679	if (csa) {
680		pos = skb_put(skb, 13);
681		memset(pos, 0, 13);
682		*pos++ = WLAN_EID_CHANNEL_SWITCH;
683		*pos++ = 3;
684		*pos++ = 0x0;
685		*pos++ = ieee80211_frequency_to_channel(
686				csa->settings.chandef.chan->center_freq);
687		bcn->csa_current_counter = csa->settings.count;
688		bcn->csa_counter_offsets[0] = hdr_len + 6;
689		*pos++ = csa->settings.count;
690		*pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
691		*pos++ = 6;
692		if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_INIT) {
693			*pos++ = ifmsh->mshcfg.dot11MeshTTL;
694			*pos |= WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
695		} else {
696			*pos++ = ifmsh->chsw_ttl;
697		}
698		*pos++ |= csa->settings.block_tx ?
699			  WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
700		put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos);
701		pos += 2;
702		put_unaligned_le16(ifmsh->pre_value, pos);
703		pos += 2;
704	}
705	rcu_read_unlock();
706
707	if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
708	    mesh_add_ds_params_ie(sdata, skb))
709		goto out_free;
710
711	bcn->head_len = skb->len;
712	memcpy(bcn->head, skb->data, bcn->head_len);
713
714	/* now the tail */
715	skb_trim(skb, 0);
716	bcn->tail = bcn->head + bcn->head_len;
717
718	if (ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
719	    mesh_add_rsn_ie(sdata, skb) ||
720	    mesh_add_ht_cap_ie(sdata, skb) ||
721	    mesh_add_ht_oper_ie(sdata, skb) ||
722	    mesh_add_meshid_ie(sdata, skb) ||
723	    mesh_add_meshconf_ie(sdata, skb) ||
724	    mesh_add_awake_window_ie(sdata, skb) ||
725	    mesh_add_vendor_ies(sdata, skb))
726		goto out_free;
727
728	bcn->tail_len = skb->len;
729	memcpy(bcn->tail, skb->data, bcn->tail_len);
730	bcn->meshconf = (struct ieee80211_meshconf_ie *)
731					(bcn->tail + ifmsh->meshconf_offset);
732
733	dev_kfree_skb(skb);
734	rcu_assign_pointer(ifmsh->beacon, bcn);
735	return 0;
736out_free:
737	kfree(bcn);
738	dev_kfree_skb(skb);
739	return -ENOMEM;
740}
741
742static int
743ieee80211_mesh_rebuild_beacon(struct ieee80211_sub_if_data *sdata)
744{
745	struct beacon_data *old_bcn;
746	int ret;
747
748	old_bcn = rcu_dereference_protected(sdata->u.mesh.beacon,
749					    lockdep_is_held(&sdata->wdev.mtx));
750	ret = ieee80211_mesh_build_beacon(&sdata->u.mesh);
751	if (ret)
752		/* just reuse old beacon */
753		return ret;
754
755	if (old_bcn)
756		kfree_rcu(old_bcn, rcu_head);
757	return 0;
758}
759
760void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
761				       u32 changed)
762{
763	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
764	unsigned long bits = changed;
765	u32 bit;
766
767	if (!bits)
768		return;
769
770	/* if we race with running work, worst case this work becomes a noop */
771	for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
772		set_bit(bit, &ifmsh->mbss_changed);
773	set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
774	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
775}
776
777int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
778{
779	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
780	struct ieee80211_local *local = sdata->local;
781	u32 changed = BSS_CHANGED_BEACON |
782		      BSS_CHANGED_BEACON_ENABLED |
783		      BSS_CHANGED_HT |
784		      BSS_CHANGED_BASIC_RATES |
785		      BSS_CHANGED_BEACON_INT;
786
787	local->fif_other_bss++;
788	/* mesh ifaces must set allmulti to forward mcast traffic */
789	atomic_inc(&local->iff_allmultis);
790	ieee80211_configure_filter(local);
791
792	ifmsh->mesh_cc_id = 0;	/* Disabled */
793	/* register sync ops from extensible synchronization framework */
794	ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
795	ifmsh->adjusting_tbtt = false;
796	ifmsh->sync_offset_clockdrift_max = 0;
797	set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
798	ieee80211_mesh_root_setup(ifmsh);
799	ieee80211_queue_work(&local->hw, &sdata->work);
800	sdata->vif.bss_conf.ht_operation_mode =
801				ifmsh->mshcfg.ht_opmode;
802	sdata->vif.bss_conf.enable_beacon = true;
803
804	changed |= ieee80211_mps_local_status_update(sdata);
805
806	if (ieee80211_mesh_build_beacon(ifmsh)) {
807		ieee80211_stop_mesh(sdata);
808		return -ENOMEM;
809	}
810
811	ieee80211_recalc_dtim(local, sdata);
812	ieee80211_bss_info_change_notify(sdata, changed);
813
814	netif_carrier_on(sdata->dev);
815	return 0;
816}
817
818void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
819{
820	struct ieee80211_local *local = sdata->local;
821	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
822	struct beacon_data *bcn;
823
824	netif_carrier_off(sdata->dev);
825
826	/* stop the beacon */
827	ifmsh->mesh_id_len = 0;
828	sdata->vif.bss_conf.enable_beacon = false;
829	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
830	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
831	bcn = rcu_dereference_protected(ifmsh->beacon,
832					lockdep_is_held(&sdata->wdev.mtx));
833	RCU_INIT_POINTER(ifmsh->beacon, NULL);
834	kfree_rcu(bcn, rcu_head);
835
836	/* flush STAs and mpaths on this iface */
837	sta_info_flush(sdata);
838	mesh_path_flush_by_iface(sdata);
839
840	/* free all potentially still buffered group-addressed frames */
841	local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
842	skb_queue_purge(&ifmsh->ps.bc_buf);
843
844	del_timer_sync(&sdata->u.mesh.housekeeping_timer);
845	del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
846	del_timer_sync(&sdata->u.mesh.mesh_path_timer);
847
848	/* clear any mesh work (for next join) we may have accrued */
849	ifmsh->wrkq_flags = 0;
850	ifmsh->mbss_changed = 0;
851
852	local->fif_other_bss--;
853	atomic_dec(&local->iff_allmultis);
854	ieee80211_configure_filter(local);
855}
856
857static bool
858ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
859				 struct ieee802_11_elems *elems, bool beacon)
860{
861	struct cfg80211_csa_settings params;
862	struct ieee80211_csa_ie csa_ie;
863	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
864	enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
865	int err;
866	u32 sta_flags;
867
868	sdata_assert_lock(sdata);
869
870	sta_flags = IEEE80211_STA_DISABLE_VHT;
871	switch (sdata->vif.bss_conf.chandef.width) {
872	case NL80211_CHAN_WIDTH_20_NOHT:
873		sta_flags |= IEEE80211_STA_DISABLE_HT;
874	case NL80211_CHAN_WIDTH_20:
875		sta_flags |= IEEE80211_STA_DISABLE_40MHZ;
876		break;
877	default:
878		break;
879	}
880
881	memset(&params, 0, sizeof(params));
882	memset(&csa_ie, 0, sizeof(csa_ie));
883	err = ieee80211_parse_ch_switch_ie(sdata, elems, band,
884					   sta_flags, sdata->vif.addr,
885					   &csa_ie);
886	if (err < 0)
887		return false;
888	if (err)
889		return false;
890
891	params.chandef = csa_ie.chandef;
892	params.count = csa_ie.count;
893
894	if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, &params.chandef,
895				     IEEE80211_CHAN_DISABLED)) {
896		sdata_info(sdata,
897			   "mesh STA %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), aborting\n",
898			   sdata->vif.addr,
899			   params.chandef.chan->center_freq,
900			   params.chandef.width,
901			   params.chandef.center_freq1,
902			   params.chandef.center_freq2);
903		return false;
904	}
905
906	err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
907					    &params.chandef,
908					    NL80211_IFTYPE_MESH_POINT);
909	if (err < 0)
910		return false;
911	if (err > 0)
912		/* TODO: DFS not (yet) supported */
913		return false;
914
915	params.radar_required = err;
916
917	if (cfg80211_chandef_identical(&params.chandef,
918				       &sdata->vif.bss_conf.chandef)) {
919		mcsa_dbg(sdata,
920			 "received csa with an identical chandef, ignoring\n");
921		return true;
922	}
923
924	mcsa_dbg(sdata,
925		 "received channel switch announcement to go to channel %d MHz\n",
926		 params.chandef.chan->center_freq);
927
928	params.block_tx = csa_ie.mode & WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT;
929	if (beacon) {
930		ifmsh->chsw_ttl = csa_ie.ttl - 1;
931		if (ifmsh->pre_value >= csa_ie.pre_value)
932			return false;
933		ifmsh->pre_value = csa_ie.pre_value;
934	}
935
936	if (ifmsh->chsw_ttl >= ifmsh->mshcfg.dot11MeshTTL)
937		return false;
938
939	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_REPEATER;
940
941	if (ieee80211_channel_switch(sdata->local->hw.wiphy, sdata->dev,
942				     &params) < 0)
943		return false;
944
945	return true;
946}
947
948static void
949ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
950			    struct ieee80211_mgmt *mgmt, size_t len)
951{
952	struct ieee80211_local *local = sdata->local;
953	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
954	struct sk_buff *presp;
955	struct beacon_data *bcn;
956	struct ieee80211_mgmt *hdr;
957	struct ieee802_11_elems elems;
958	size_t baselen;
959	u8 *pos;
960
961	pos = mgmt->u.probe_req.variable;
962	baselen = (u8 *) pos - (u8 *) mgmt;
963	if (baselen > len)
964		return;
965
966	ieee802_11_parse_elems(pos, len - baselen, false, &elems);
967
968	if (!elems.mesh_id)
969		return;
970
971	/* 802.11-2012 10.1.4.3.2 */
972	if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
973	     !is_broadcast_ether_addr(mgmt->da)) ||
974	    elems.ssid_len != 0)
975		return;
976
977	if (elems.mesh_id_len != 0 &&
978	    (elems.mesh_id_len != ifmsh->mesh_id_len ||
979	     memcmp(elems.mesh_id, ifmsh->mesh_id, ifmsh->mesh_id_len)))
980		return;
981
982	rcu_read_lock();
983	bcn = rcu_dereference(ifmsh->beacon);
984
985	if (!bcn)
986		goto out;
987
988	presp = dev_alloc_skb(local->tx_headroom +
989			      bcn->head_len + bcn->tail_len);
990	if (!presp)
991		goto out;
992
993	skb_reserve(presp, local->tx_headroom);
994	memcpy(skb_put(presp, bcn->head_len), bcn->head, bcn->head_len);
995	memcpy(skb_put(presp, bcn->tail_len), bcn->tail, bcn->tail_len);
996	hdr = (struct ieee80211_mgmt *) presp->data;
997	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
998					 IEEE80211_STYPE_PROBE_RESP);
999	memcpy(hdr->da, mgmt->sa, ETH_ALEN);
1000	IEEE80211_SKB_CB(presp)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1001	ieee80211_tx_skb(sdata, presp);
1002out:
1003	rcu_read_unlock();
1004}
1005
1006static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
1007					u16 stype,
1008					struct ieee80211_mgmt *mgmt,
1009					size_t len,
1010					struct ieee80211_rx_status *rx_status)
1011{
1012	struct ieee80211_local *local = sdata->local;
1013	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1014	struct ieee802_11_elems elems;
1015	struct ieee80211_channel *channel;
1016	size_t baselen;
1017	int freq;
1018	enum ieee80211_band band = rx_status->band;
1019
1020	/* ignore ProbeResp to foreign address */
1021	if (stype == IEEE80211_STYPE_PROBE_RESP &&
1022	    !ether_addr_equal(mgmt->da, sdata->vif.addr))
1023		return;
1024
1025	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
1026	if (baselen > len)
1027		return;
1028
1029	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
1030			       false, &elems);
1031
1032	/* ignore non-mesh or secure / unsecure mismatch */
1033	if ((!elems.mesh_id || !elems.mesh_config) ||
1034	    (elems.rsn && sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) ||
1035	    (!elems.rsn && sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE))
1036		return;
1037
1038	if (elems.ds_params)
1039		freq = ieee80211_channel_to_frequency(elems.ds_params[0], band);
1040	else
1041		freq = rx_status->freq;
1042
1043	channel = ieee80211_get_channel(local->hw.wiphy, freq);
1044
1045	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
1046		return;
1047
1048	if (mesh_matches_local(sdata, &elems))
1049		mesh_neighbour_update(sdata, mgmt->sa, &elems);
1050
1051	if (ifmsh->sync_ops)
1052		ifmsh->sync_ops->rx_bcn_presp(sdata,
1053			stype, mgmt, &elems, rx_status);
1054
1055	if (ifmsh->csa_role != IEEE80211_MESH_CSA_ROLE_INIT &&
1056	    !sdata->vif.csa_active)
1057		ieee80211_mesh_process_chnswitch(sdata, &elems, true);
1058}
1059
1060int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
1061{
1062	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1063	struct mesh_csa_settings *tmp_csa_settings;
1064	int ret = 0;
1065	int changed = 0;
1066
1067	/* Reset the TTL value and Initiator flag */
1068	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
1069	ifmsh->chsw_ttl = 0;
1070
1071	/* Remove the CSA and MCSP elements from the beacon */
1072	tmp_csa_settings = rcu_dereference(ifmsh->csa);
1073	RCU_INIT_POINTER(ifmsh->csa, NULL);
1074	if (tmp_csa_settings)
1075		kfree_rcu(tmp_csa_settings, rcu_head);
1076	ret = ieee80211_mesh_rebuild_beacon(sdata);
1077	if (ret)
1078		return -EINVAL;
1079
1080	changed |= BSS_CHANGED_BEACON;
1081
1082	mcsa_dbg(sdata, "complete switching to center freq %d MHz",
1083		 sdata->vif.bss_conf.chandef.chan->center_freq);
1084	return changed;
1085}
1086
1087int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
1088			      struct cfg80211_csa_settings *csa_settings)
1089{
1090	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1091	struct mesh_csa_settings *tmp_csa_settings;
1092	int ret = 0;
1093
1094	tmp_csa_settings = kmalloc(sizeof(*tmp_csa_settings),
1095				   GFP_ATOMIC);
1096	if (!tmp_csa_settings)
1097		return -ENOMEM;
1098
1099	memcpy(&tmp_csa_settings->settings, csa_settings,
1100	       sizeof(struct cfg80211_csa_settings));
1101
1102	rcu_assign_pointer(ifmsh->csa, tmp_csa_settings);
1103
1104	ret = ieee80211_mesh_rebuild_beacon(sdata);
1105	if (ret) {
1106		tmp_csa_settings = rcu_dereference(ifmsh->csa);
1107		RCU_INIT_POINTER(ifmsh->csa, NULL);
1108		kfree_rcu(tmp_csa_settings, rcu_head);
1109		return ret;
1110	}
1111
1112	return BSS_CHANGED_BEACON;
1113}
1114
1115static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
1116			       struct ieee80211_mgmt *mgmt, size_t len)
1117{
1118	struct ieee80211_mgmt *mgmt_fwd;
1119	struct sk_buff *skb;
1120	struct ieee80211_local *local = sdata->local;
1121	u8 *pos = mgmt->u.action.u.chan_switch.variable;
1122	size_t offset_ttl;
1123
1124	skb = dev_alloc_skb(local->tx_headroom + len);
1125	if (!skb)
1126		return -ENOMEM;
1127	skb_reserve(skb, local->tx_headroom);
1128	mgmt_fwd = (struct ieee80211_mgmt *) skb_put(skb, len);
1129
1130	/* offset_ttl is based on whether the secondary channel
1131	 * offset is available or not. Subtract 1 from the mesh TTL
1132	 * and disable the initiator flag before forwarding.
1133	 */
1134	offset_ttl = (len < 42) ? 7 : 10;
1135	*(pos + offset_ttl) -= 1;
1136	*(pos + offset_ttl + 1) &= ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
1137
1138	memcpy(mgmt_fwd, mgmt, len);
1139	eth_broadcast_addr(mgmt_fwd->da);
1140	memcpy(mgmt_fwd->sa, sdata->vif.addr, ETH_ALEN);
1141	memcpy(mgmt_fwd->bssid, sdata->vif.addr, ETH_ALEN);
1142
1143	ieee80211_tx_skb(sdata, skb);
1144	return 0;
1145}
1146
1147static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
1148			      struct ieee80211_mgmt *mgmt, size_t len)
1149{
1150	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1151	struct ieee802_11_elems elems;
1152	u16 pre_value;
1153	bool fwd_csa = true;
1154	size_t baselen;
1155	u8 *pos;
1156
1157	if (mgmt->u.action.u.measurement.action_code !=
1158	    WLAN_ACTION_SPCT_CHL_SWITCH)
1159		return;
1160
1161	pos = mgmt->u.action.u.chan_switch.variable;
1162	baselen = offsetof(struct ieee80211_mgmt,
1163			   u.action.u.chan_switch.variable);
1164	ieee802_11_parse_elems(pos, len - baselen, false, &elems);
1165
1166	ifmsh->chsw_ttl = elems.mesh_chansw_params_ie->mesh_ttl;
1167	if (!--ifmsh->chsw_ttl)
1168		fwd_csa = false;
1169
1170	pre_value = le16_to_cpu(elems.mesh_chansw_params_ie->mesh_pre_value);
1171	if (ifmsh->pre_value >= pre_value)
1172		return;
1173
1174	ifmsh->pre_value = pre_value;
1175
1176	if (!sdata->vif.csa_active &&
1177	    !ieee80211_mesh_process_chnswitch(sdata, &elems, false)) {
1178		mcsa_dbg(sdata, "Failed to process CSA action frame");
1179		return;
1180	}
1181
1182	/* forward or re-broadcast the CSA frame */
1183	if (fwd_csa) {
1184		if (mesh_fwd_csa_frame(sdata, mgmt, len) < 0)
1185			mcsa_dbg(sdata, "Failed to forward the CSA frame");
1186	}
1187}
1188
1189static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
1190					  struct ieee80211_mgmt *mgmt,
1191					  size_t len,
1192					  struct ieee80211_rx_status *rx_status)
1193{
1194	switch (mgmt->u.action.category) {
1195	case WLAN_CATEGORY_SELF_PROTECTED:
1196		switch (mgmt->u.action.u.self_prot.action_code) {
1197		case WLAN_SP_MESH_PEERING_OPEN:
1198		case WLAN_SP_MESH_PEERING_CLOSE:
1199		case WLAN_SP_MESH_PEERING_CONFIRM:
1200			mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
1201			break;
1202		}
1203		break;
1204	case WLAN_CATEGORY_MESH_ACTION:
1205		if (mesh_action_is_path_sel(mgmt))
1206			mesh_rx_path_sel_frame(sdata, mgmt, len);
1207		break;
1208	case WLAN_CATEGORY_SPECTRUM_MGMT:
1209		mesh_rx_csa_frame(sdata, mgmt, len);
1210		break;
1211	}
1212}
1213
1214void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1215				   struct sk_buff *skb)
1216{
1217	struct ieee80211_rx_status *rx_status;
1218	struct ieee80211_mgmt *mgmt;
1219	u16 stype;
1220
1221	sdata_lock(sdata);
1222
1223	/* mesh already went down */
1224	if (!sdata->u.mesh.mesh_id_len)
1225		goto out;
1226
1227	rx_status = IEEE80211_SKB_RXCB(skb);
1228	mgmt = (struct ieee80211_mgmt *) skb->data;
1229	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
1230
1231	switch (stype) {
1232	case IEEE80211_STYPE_PROBE_RESP:
1233	case IEEE80211_STYPE_BEACON:
1234		ieee80211_mesh_rx_bcn_presp(sdata, stype, mgmt, skb->len,
1235					    rx_status);
1236		break;
1237	case IEEE80211_STYPE_PROBE_REQ:
1238		ieee80211_mesh_rx_probe_req(sdata, mgmt, skb->len);
1239		break;
1240	case IEEE80211_STYPE_ACTION:
1241		ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
1242		break;
1243	}
1244out:
1245	sdata_unlock(sdata);
1246}
1247
1248static void mesh_bss_info_changed(struct ieee80211_sub_if_data *sdata)
1249{
1250	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1251	u32 bit, changed = 0;
1252
1253	for_each_set_bit(bit, &ifmsh->mbss_changed,
1254			 sizeof(changed) * BITS_PER_BYTE) {
1255		clear_bit(bit, &ifmsh->mbss_changed);
1256		changed |= BIT(bit);
1257	}
1258
1259	if (sdata->vif.bss_conf.enable_beacon &&
1260	    (changed & (BSS_CHANGED_BEACON |
1261			BSS_CHANGED_HT |
1262			BSS_CHANGED_BASIC_RATES |
1263			BSS_CHANGED_BEACON_INT)))
1264		if (ieee80211_mesh_rebuild_beacon(sdata))
1265			return;
1266
1267	ieee80211_bss_info_change_notify(sdata, changed);
1268}
1269
1270void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
1271{
1272	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1273
1274	sdata_lock(sdata);
1275
1276	/* mesh already went down */
1277	if (!sdata->u.mesh.mesh_id_len)
1278		goto out;
1279
1280	if (ifmsh->preq_queue_len &&
1281	    time_after(jiffies,
1282		       ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
1283		mesh_path_start_discovery(sdata);
1284
1285	if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
1286		mesh_mpath_table_grow();
1287
1288	if (test_and_clear_bit(MESH_WORK_GROW_MPP_TABLE, &ifmsh->wrkq_flags))
1289		mesh_mpp_table_grow();
1290
1291	if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
1292		ieee80211_mesh_housekeeping(sdata);
1293
1294	if (test_and_clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags))
1295		ieee80211_mesh_rootpath(sdata);
1296
1297	if (test_and_clear_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags))
1298		mesh_sync_adjust_tbtt(sdata);
1299
1300	if (test_and_clear_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags))
1301		mesh_bss_info_changed(sdata);
1302out:
1303	sdata_unlock(sdata);
1304}
1305
1306
1307void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
1308{
1309	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1310	static u8 zero_addr[ETH_ALEN] = {};
1311
1312	setup_timer(&ifmsh->housekeeping_timer,
1313		    ieee80211_mesh_housekeeping_timer,
1314		    (unsigned long) sdata);
1315
1316	ifmsh->accepting_plinks = true;
1317	atomic_set(&ifmsh->mpaths, 0);
1318	mesh_rmc_init(sdata);
1319	ifmsh->last_preq = jiffies;
1320	ifmsh->next_perr = jiffies;
1321	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
1322	/* Allocate all mesh structures when creating the first mesh interface. */
1323	if (!mesh_allocated)
1324		ieee80211s_init();
1325	setup_timer(&ifmsh->mesh_path_timer,
1326		    ieee80211_mesh_path_timer,
1327		    (unsigned long) sdata);
1328	setup_timer(&ifmsh->mesh_path_root_timer,
1329		    ieee80211_mesh_path_root_timer,
1330		    (unsigned long) sdata);
1331	INIT_LIST_HEAD(&ifmsh->preq_queue.list);
1332	skb_queue_head_init(&ifmsh->ps.bc_buf);
1333	spin_lock_init(&ifmsh->mesh_preq_queue_lock);
1334	spin_lock_init(&ifmsh->sync_offset_lock);
1335	RCU_INIT_POINTER(ifmsh->beacon, NULL);
1336
1337	sdata->vif.bss_conf.bssid = zero_addr;
1338}
1339