xref: /linux/net/mac80211/mesh.c (revision f9ad6c160224a871e9437363709c1ba6e8604359)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2008, 2009 open80211s Ltd.
4  * Copyright (C) 2018-2026 Intel Corporation
5  * Authors:    Luis Carlos Cobo <luisca@cozybit.com>
6  * 	       Javier Cardona <javier@cozybit.com>
7  */
8 
9 #include <linux/slab.h>
10 #include <linux/unaligned.h>
11 #include <net/sock.h>
12 #include "ieee80211_i.h"
13 #include "mesh.h"
14 #include "wme.h"
15 #include "driver-ops.h"
16 
17 static int mesh_allocated;
18 static struct kmem_cache *rm_cache;
19 
20 bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
21 {
22 	return mgmt->u.action.action_code == WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
23 }
24 
25 void ieee80211s_init(void)
26 {
27 	mesh_allocated = 1;
28 	rm_cache = kmem_cache_create("mesh_rmc", sizeof(struct rmc_entry),
29 				     0, 0, NULL);
30 }
31 
32 void ieee80211s_stop(void)
33 {
34 	if (!mesh_allocated)
35 		return;
36 	kmem_cache_destroy(rm_cache);
37 }
38 
39 static void ieee80211_mesh_housekeeping_timer(struct timer_list *t)
40 {
41 	struct ieee80211_sub_if_data *sdata =
42 		timer_container_of(sdata, t, u.mesh.housekeeping_timer);
43 	struct ieee80211_local *local = sdata->local;
44 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
45 
46 	set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
47 
48 	wiphy_work_queue(local->hw.wiphy, &sdata->work);
49 }
50 
51 /**
52  * mesh_matches_local - check if the config of a mesh point matches ours
53  *
54  * @sdata: local mesh subif
55  * @ie: information elements of a management frame from the mesh peer
56  *
57  * This function checks if the mesh configuration of a mesh point matches the
58  * local mesh configuration, i.e. if both nodes belong to the same mesh network.
59  *
60  * Returns: %true if both nodes belong to the same mesh
61  */
62 bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
63 			struct ieee802_11_elems *ie)
64 {
65 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
66 	u32 basic_rates = 0;
67 	struct cfg80211_chan_def sta_chan_def;
68 	struct ieee80211_supported_band *sband;
69 	u32 vht_cap_info = 0;
70 
71 	/*
72 	 * As support for each feature is added, check for matching
73 	 * - On mesh config capabilities
74 	 *   - Power Save Support En
75 	 *   - Sync support enabled
76 	 *   - Sync support active
77 	 *   - Sync support required from peer
78 	 *   - MDA enabled
79 	 * - Power management control on fc
80 	 */
81 	if (!ie->mesh_config)
82 		return false;
83 
84 	if (!(ifmsh->mesh_id_len == ie->mesh_id_len &&
85 	     memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
86 	     (ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&
87 	     (ifmsh->mesh_pm_id == ie->mesh_config->meshconf_pmetric) &&
88 	     (ifmsh->mesh_cc_id == ie->mesh_config->meshconf_congest) &&
89 	     (ifmsh->mesh_sp_id == ie->mesh_config->meshconf_synch) &&
90 	     (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth)))
91 		return false;
92 
93 	sband = ieee80211_get_sband(sdata);
94 	if (!sband)
95 		return false;
96 
97 	ieee80211_sta_get_rates(sdata, ie, sband->band,
98 				&basic_rates);
99 
100 	if (sdata->vif.bss_conf.basic_rates != basic_rates)
101 		return false;
102 
103 	cfg80211_chandef_create(&sta_chan_def, sdata->vif.bss_conf.chanreq.oper.chan,
104 				NL80211_CHAN_NO_HT);
105 	ieee80211_chandef_ht_oper(ie->ht_operation, &sta_chan_def);
106 
107 	if (ie->vht_cap_elem)
108 		vht_cap_info = le32_to_cpu(ie->vht_cap_elem->vht_cap_info);
109 
110 	ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
111 				   ie->vht_operation, ie->ht_operation,
112 				   &sta_chan_def);
113 	ieee80211_chandef_he_6ghz_oper(sdata->local, ie->he_operation,
114 				       ie->eht_operation,
115 				       &sta_chan_def);
116 
117 	if (!cfg80211_chandef_compatible(&sdata->vif.bss_conf.chanreq.oper,
118 					 &sta_chan_def))
119 		return false;
120 
121 	return true;
122 }
123 
124 /**
125  * mesh_peer_accepts_plinks - check if an mp is willing to establish peer links
126  *
127  * @ie: information elements of a management frame from the mesh peer
128  *
129  * Returns: %true if the mesh peer is willing to establish peer links
130  */
131 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
132 {
133 	return (ie->mesh_config->meshconf_cap &
134 			IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS) != 0;
135 }
136 
137 /**
138  * mesh_accept_plinks_update - update accepting_plink in local mesh beacons
139  *
140  * @sdata: mesh interface in which mesh beacons are going to be updated
141  *
142  * Returns: beacon changed flag if the beacon content changed.
143  */
144 u64 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
145 {
146 	bool free_plinks;
147 	u64 changed = 0;
148 
149 	/* In case mesh_plink_free_count > 0 and mesh_plinktbl_capacity == 0,
150 	 * the mesh interface might be able to establish plinks with peers that
151 	 * are already on the table but are not on PLINK_ESTAB state. However,
152 	 * in general the mesh interface is not accepting peer link requests
153 	 * from new peers, and that must be reflected in the beacon
154 	 */
155 	free_plinks = mesh_plink_availables(sdata);
156 
157 	if (free_plinks != sdata->u.mesh.accepting_plinks) {
158 		sdata->u.mesh.accepting_plinks = free_plinks;
159 		changed = BSS_CHANGED_BEACON;
160 	}
161 
162 	return changed;
163 }
164 
165 /*
166  * mesh_sta_cleanup - clean up any mesh sta state
167  *
168  * @sta: mesh sta to clean up.
169  */
170 void mesh_sta_cleanup(struct sta_info *sta)
171 {
172 	struct ieee80211_sub_if_data *sdata = sta->sdata;
173 	u64 changed = mesh_plink_deactivate(sta);
174 
175 	if (changed)
176 		ieee80211_mbss_info_change_notify(sdata, changed);
177 }
178 
179 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
180 {
181 	int i;
182 
183 	sdata->u.mesh.rmc = kmalloc_obj(struct mesh_rmc);
184 	if (!sdata->u.mesh.rmc)
185 		return -ENOMEM;
186 	sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
187 	for (i = 0; i < RMC_BUCKETS; i++)
188 		INIT_HLIST_HEAD(&sdata->u.mesh.rmc->bucket[i]);
189 	return 0;
190 }
191 
192 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
193 {
194 	struct mesh_rmc *rmc = sdata->u.mesh.rmc;
195 	struct rmc_entry *p;
196 	struct hlist_node *n;
197 	int i;
198 
199 	if (!sdata->u.mesh.rmc)
200 		return;
201 
202 	for (i = 0; i < RMC_BUCKETS; i++) {
203 		hlist_for_each_entry_safe(p, n, &rmc->bucket[i], list) {
204 			hlist_del(&p->list);
205 			kmem_cache_free(rm_cache, p);
206 		}
207 	}
208 
209 	kfree(rmc);
210 	sdata->u.mesh.rmc = NULL;
211 }
212 
213 /**
214  * mesh_rmc_check - Check frame in recent multicast cache and add if absent.
215  *
216  * @sdata:	interface
217  * @sa:		source address
218  * @mesh_hdr:	mesh_header
219  *
220  * Returns: 0 if the frame is not in the cache, nonzero otherwise.
221  *
222  * Checks using the source address and the mesh sequence number if we have
223  * received this frame lately. If the frame is not in the cache, it is added to
224  * it.
225  */
226 int mesh_rmc_check(struct ieee80211_sub_if_data *sdata,
227 		   const u8 *sa, struct ieee80211s_hdr *mesh_hdr)
228 {
229 	struct mesh_rmc *rmc = sdata->u.mesh.rmc;
230 	u32 seqnum = 0;
231 	int entries = 0;
232 	u8 idx;
233 	struct rmc_entry *p;
234 	struct hlist_node *n;
235 
236 	if (!rmc)
237 		return -1;
238 
239 	/* Don't care about endianness since only match matters */
240 	memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum));
241 	idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask;
242 	hlist_for_each_entry_safe(p, n, &rmc->bucket[idx], list) {
243 		++entries;
244 		if (time_after(jiffies, p->exp_time) ||
245 		    entries == RMC_QUEUE_MAX_LEN) {
246 			hlist_del(&p->list);
247 			kmem_cache_free(rm_cache, p);
248 			--entries;
249 		} else if ((seqnum == p->seqnum) && ether_addr_equal(sa, p->sa))
250 			return -1;
251 	}
252 
253 	p = kmem_cache_alloc(rm_cache, GFP_ATOMIC);
254 	if (!p)
255 		return 0;
256 
257 	p->seqnum = seqnum;
258 	p->exp_time = jiffies + RMC_TIMEOUT;
259 	memcpy(p->sa, sa, ETH_ALEN);
260 	hlist_add_head(&p->list, &rmc->bucket[idx]);
261 	return 0;
262 }
263 
264 int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata,
265 			 struct sk_buff *skb)
266 {
267 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
268 	u8 *pos, neighbors;
269 	u8 meshconf_len = sizeof(struct ieee80211_meshconf_ie);
270 	bool is_connected_to_gate = ifmsh->num_gates > 0 ||
271 		ifmsh->mshcfg.dot11MeshGateAnnouncementProtocol ||
272 		ifmsh->mshcfg.dot11MeshConnectedToMeshGate;
273 	bool is_connected_to_as = ifmsh->mshcfg.dot11MeshConnectedToAuthServer;
274 
275 	if (skb_tailroom(skb) < 2 + meshconf_len)
276 		return -ENOMEM;
277 
278 	pos = skb_put(skb, 2 + meshconf_len);
279 	*pos++ = WLAN_EID_MESH_CONFIG;
280 	*pos++ = meshconf_len;
281 
282 	/* save a pointer for quick updates in pre-tbtt */
283 	ifmsh->meshconf_offset = pos - skb->data;
284 
285 	/* Active path selection protocol ID */
286 	*pos++ = ifmsh->mesh_pp_id;
287 	/* Active path selection metric ID   */
288 	*pos++ = ifmsh->mesh_pm_id;
289 	/* Congestion control mode identifier */
290 	*pos++ = ifmsh->mesh_cc_id;
291 	/* Synchronization protocol identifier */
292 	*pos++ = ifmsh->mesh_sp_id;
293 	/* Authentication Protocol identifier */
294 	*pos++ = ifmsh->mesh_auth_id;
295 	/* Mesh Formation Info - number of neighbors */
296 	neighbors = atomic_read(&ifmsh->estab_plinks);
297 	neighbors = min_t(int, neighbors, IEEE80211_MAX_MESH_PEERINGS);
298 	*pos++ = (is_connected_to_as << 7) |
299 		 (neighbors << 1) |
300 		 is_connected_to_gate;
301 	/* Mesh capability */
302 	*pos = 0x00;
303 	*pos |= ifmsh->mshcfg.dot11MeshForwarding ?
304 			IEEE80211_MESHCONF_CAPAB_FORWARDING : 0x00;
305 	*pos |= ifmsh->accepting_plinks ?
306 			IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
307 	/* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
308 	*pos |= ifmsh->ps_peers_deep_sleep ?
309 			IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00;
310 	return 0;
311 }
312 
313 int mesh_add_meshid_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
314 {
315 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
316 	u8 *pos;
317 
318 	if (skb_tailroom(skb) < 2 + ifmsh->mesh_id_len)
319 		return -ENOMEM;
320 
321 	pos = skb_put(skb, 2 + ifmsh->mesh_id_len);
322 	*pos++ = WLAN_EID_MESH_ID;
323 	*pos++ = ifmsh->mesh_id_len;
324 	if (ifmsh->mesh_id_len)
325 		memcpy(pos, ifmsh->mesh_id, ifmsh->mesh_id_len);
326 
327 	return 0;
328 }
329 
330 static int mesh_add_awake_window_ie(struct ieee80211_sub_if_data *sdata,
331 				    struct sk_buff *skb)
332 {
333 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
334 	u8 *pos;
335 
336 	/* see IEEE802.11-2012 13.14.6 */
337 	if (ifmsh->ps_peers_light_sleep == 0 &&
338 	    ifmsh->ps_peers_deep_sleep == 0 &&
339 	    ifmsh->nonpeer_pm == NL80211_MESH_POWER_ACTIVE)
340 		return 0;
341 
342 	if (skb_tailroom(skb) < 4)
343 		return -ENOMEM;
344 
345 	pos = skb_put(skb, 2 + 2);
346 	*pos++ = WLAN_EID_MESH_AWAKE_WINDOW;
347 	*pos++ = 2;
348 	put_unaligned_le16(ifmsh->mshcfg.dot11MeshAwakeWindowDuration, pos);
349 
350 	return 0;
351 }
352 
353 int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
354 			struct sk_buff *skb)
355 {
356 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
357 	u8 offset, len;
358 	const u8 *data;
359 
360 	if (!ifmsh->ie || !ifmsh->ie_len)
361 		return 0;
362 
363 	/* fast-forward to vendor IEs */
364 	offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
365 
366 	if (offset < ifmsh->ie_len) {
367 		len = ifmsh->ie_len - offset;
368 		data = ifmsh->ie + offset;
369 		if (skb_tailroom(skb) < len)
370 			return -ENOMEM;
371 		skb_put_data(skb, data, len);
372 	}
373 
374 	return 0;
375 }
376 
377 int mesh_add_rsn_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
378 {
379 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
380 	u8 len = 0;
381 	const u8 *data;
382 
383 	if (!ifmsh->ie || !ifmsh->ie_len)
384 		return 0;
385 
386 	/* find RSN IE */
387 	data = cfg80211_find_ie(WLAN_EID_RSN, ifmsh->ie, ifmsh->ie_len);
388 	if (!data)
389 		return 0;
390 
391 	len = data[1] + 2;
392 
393 	if (skb_tailroom(skb) < len)
394 		return -ENOMEM;
395 	skb_put_data(skb, data, len);
396 
397 	return 0;
398 }
399 
400 static int mesh_add_ds_params_ie(struct ieee80211_sub_if_data *sdata,
401 				 struct sk_buff *skb)
402 {
403 	struct ieee80211_chanctx_conf *chanctx_conf;
404 	struct ieee80211_channel *chan;
405 	u8 *pos;
406 
407 	if (skb_tailroom(skb) < 3)
408 		return -ENOMEM;
409 
410 	rcu_read_lock();
411 	chanctx_conf = rcu_dereference(sdata->vif.bss_conf.chanctx_conf);
412 	if (WARN_ON(!chanctx_conf)) {
413 		rcu_read_unlock();
414 		return -EINVAL;
415 	}
416 	chan = chanctx_conf->def.chan;
417 	rcu_read_unlock();
418 
419 	pos = skb_put(skb, 2 + 1);
420 	*pos++ = WLAN_EID_DS_PARAMS;
421 	*pos++ = 1;
422 	*pos++ = ieee80211_frequency_to_channel(chan->center_freq);
423 
424 	return 0;
425 }
426 
427 int mesh_add_ht_cap_ie(struct ieee80211_sub_if_data *sdata,
428 		       struct sk_buff *skb)
429 {
430 	struct ieee80211_supported_band *sband;
431 	u8 *pos;
432 
433 	sband = ieee80211_get_sband(sdata);
434 	if (!sband)
435 		return -EINVAL;
436 
437 	/* HT not allowed in 6 GHz */
438 	if (sband->band == NL80211_BAND_6GHZ)
439 		return 0;
440 
441 	if (!sband->ht_cap.ht_supported ||
442 	    sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
443 		return 0;
444 
445 	if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_cap))
446 		return -ENOMEM;
447 
448 	pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_cap));
449 	ieee80211_ie_build_ht_cap(pos, &sband->ht_cap, sband->ht_cap.cap);
450 
451 	return 0;
452 }
453 
454 int mesh_add_ht_oper_ie(struct ieee80211_sub_if_data *sdata,
455 			struct sk_buff *skb)
456 {
457 	struct ieee80211_local *local = sdata->local;
458 	struct ieee80211_chanctx_conf *chanctx_conf;
459 	struct ieee80211_channel *channel;
460 	struct ieee80211_supported_band *sband;
461 	struct ieee80211_sta_ht_cap *ht_cap;
462 	u8 *pos;
463 
464 	rcu_read_lock();
465 	chanctx_conf = rcu_dereference(sdata->vif.bss_conf.chanctx_conf);
466 	if (WARN_ON(!chanctx_conf)) {
467 		rcu_read_unlock();
468 		return -EINVAL;
469 	}
470 	channel = chanctx_conf->def.chan;
471 	rcu_read_unlock();
472 
473 	sband = local->hw.wiphy->bands[channel->band];
474 	ht_cap = &sband->ht_cap;
475 
476 	/* HT not allowed in 6 GHz */
477 	if (sband->band == NL80211_BAND_6GHZ)
478 		return 0;
479 
480 	if (!ht_cap->ht_supported ||
481 	    sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
482 		return 0;
483 
484 	if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_operation))
485 		return -ENOMEM;
486 
487 	pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_operation));
488 	ieee80211_ie_build_ht_oper(pos, ht_cap, &sdata->vif.bss_conf.chanreq.oper,
489 				   sdata->vif.bss_conf.ht_operation_mode,
490 				   false);
491 
492 	return 0;
493 }
494 
495 int mesh_add_vht_cap_ie(struct ieee80211_sub_if_data *sdata,
496 			struct sk_buff *skb)
497 {
498 	struct ieee80211_supported_band *sband;
499 	u8 *pos;
500 
501 	sband = ieee80211_get_sband(sdata);
502 	if (!sband)
503 		return -EINVAL;
504 
505 	/* VHT not allowed in 6 GHz */
506 	if (sband->band == NL80211_BAND_6GHZ)
507 		return 0;
508 
509 	if (!sband->vht_cap.vht_supported ||
510 	    sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
511 		return 0;
512 
513 	if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_vht_cap))
514 		return -ENOMEM;
515 
516 	pos = skb_put(skb, 2 + sizeof(struct ieee80211_vht_cap));
517 	ieee80211_ie_build_vht_cap(pos, &sband->vht_cap, sband->vht_cap.cap);
518 
519 	return 0;
520 }
521 
522 int mesh_add_vht_oper_ie(struct ieee80211_sub_if_data *sdata,
523 			 struct sk_buff *skb)
524 {
525 	struct ieee80211_local *local = sdata->local;
526 	struct ieee80211_chanctx_conf *chanctx_conf;
527 	struct ieee80211_channel *channel;
528 	struct ieee80211_supported_band *sband;
529 	struct ieee80211_sta_vht_cap *vht_cap;
530 	u8 *pos;
531 
532 	rcu_read_lock();
533 	chanctx_conf = rcu_dereference(sdata->vif.bss_conf.chanctx_conf);
534 	if (WARN_ON(!chanctx_conf)) {
535 		rcu_read_unlock();
536 		return -EINVAL;
537 	}
538 	channel = chanctx_conf->def.chan;
539 	rcu_read_unlock();
540 
541 	sband = local->hw.wiphy->bands[channel->band];
542 	vht_cap = &sband->vht_cap;
543 
544 	/* VHT not allowed in 6 GHz */
545 	if (sband->band == NL80211_BAND_6GHZ)
546 		return 0;
547 
548 	if (!vht_cap->vht_supported ||
549 	    sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
550 		return 0;
551 
552 	if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_vht_operation))
553 		return -ENOMEM;
554 
555 	pos = skb_put(skb, 2 + sizeof(struct ieee80211_vht_operation));
556 	ieee80211_ie_build_vht_oper(pos, vht_cap,
557 				    &sdata->vif.bss_conf.chanreq.oper);
558 
559 	return 0;
560 }
561 
562 int mesh_add_he_cap_ie(struct ieee80211_sub_if_data *sdata,
563 		       struct sk_buff *skb, u8 ie_len)
564 {
565 	struct ieee80211_supported_band *sband;
566 
567 	sband = ieee80211_get_sband(sdata);
568 	if (!sband)
569 		return -EINVAL;
570 
571 	if (sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
572 		return 0;
573 
574 	return ieee80211_put_he_cap(skb, sdata, sband, NULL);
575 }
576 
577 int mesh_add_he_oper_ie(struct ieee80211_sub_if_data *sdata,
578 			struct sk_buff *skb)
579 {
580 	const struct ieee80211_sta_he_cap *he_cap;
581 	struct ieee80211_supported_band *sband;
582 	u32 len;
583 	u8 *pos;
584 
585 	sband = ieee80211_get_sband(sdata);
586 	if (!sband)
587 		return -EINVAL;
588 
589 	he_cap = ieee80211_get_he_iftype_cap(sband, NL80211_IFTYPE_MESH_POINT);
590 	if (!he_cap ||
591 	    sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
592 		return 0;
593 
594 	len = 2 + 1 + sizeof(struct ieee80211_he_operation);
595 	if (sdata->vif.bss_conf.chanreq.oper.chan->band == NL80211_BAND_6GHZ)
596 		len += sizeof(struct ieee80211_he_6ghz_oper);
597 
598 	if (skb_tailroom(skb) < len)
599 		return -ENOMEM;
600 
601 	pos = skb_put(skb, len);
602 	ieee80211_ie_build_he_oper(pos, &sdata->vif.bss_conf.chanreq.oper);
603 
604 	return 0;
605 }
606 
607 int mesh_add_he_6ghz_cap_ie(struct ieee80211_sub_if_data *sdata,
608 			    struct sk_buff *skb)
609 {
610 	struct ieee80211_supported_band *sband;
611 	const struct ieee80211_sband_iftype_data *iftd;
612 
613 	sband = ieee80211_get_sband(sdata);
614 	if (!sband)
615 		return -EINVAL;
616 
617 	if (sband->band != NL80211_BAND_6GHZ)
618 		return 0;
619 
620 	iftd = ieee80211_get_sband_iftype_data(sband,
621 					       NL80211_IFTYPE_MESH_POINT);
622 	/* The device doesn't support HE in mesh mode or at all */
623 	if (!iftd)
624 		return 0;
625 
626 	ieee80211_put_he_6ghz_cap(skb, sdata, sdata->deflink.smps_mode);
627 	return 0;
628 }
629 
630 int mesh_add_eht_cap_ie(struct ieee80211_sub_if_data *sdata,
631 			struct sk_buff *skb, u8 ie_len)
632 {
633 	struct ieee80211_supported_band *sband;
634 
635 	sband = ieee80211_get_sband(sdata);
636 	if (!sband)
637 		return -EINVAL;
638 
639 	if (sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
640 		return 0;
641 
642 	return ieee80211_put_eht_cap(skb, sdata, sband, NULL);
643 }
644 
645 int mesh_add_eht_oper_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
646 {
647 	const struct ieee80211_sta_eht_cap *eht_cap;
648 	struct ieee80211_supported_band *sband;
649 	u32 len;
650 	u8 *pos;
651 
652 	sband = ieee80211_get_sband(sdata);
653 	if (!sband)
654 		return -EINVAL;
655 
656 	eht_cap = ieee80211_get_eht_iftype_cap(sband, NL80211_IFTYPE_MESH_POINT);
657 	if (!eht_cap ||
658 	    sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
659 		return 0;
660 
661 	len = 2 + 1 + offsetof(struct ieee80211_eht_operation, optional) +
662 		      offsetof(struct ieee80211_eht_operation_info, optional);
663 
664 	if (skb_tailroom(skb) < len)
665 		return -ENOMEM;
666 
667 	pos = skb_put(skb, len);
668 	ieee80211_ie_build_eht_oper(pos, &sdata->vif.bss_conf.chanreq.oper, eht_cap);
669 
670 	return 0;
671 }
672 
673 static void ieee80211_mesh_path_timer(struct timer_list *t)
674 {
675 	struct ieee80211_sub_if_data *sdata =
676 		timer_container_of(sdata, t, u.mesh.mesh_path_timer);
677 
678 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
679 }
680 
681 static void ieee80211_mesh_path_root_timer(struct timer_list *t)
682 {
683 	struct ieee80211_sub_if_data *sdata =
684 		timer_container_of(sdata, t, u.mesh.mesh_path_root_timer);
685 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
686 
687 	set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
688 
689 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
690 }
691 
692 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
693 {
694 	if (ifmsh->mshcfg.dot11MeshHWMPRootMode > IEEE80211_ROOTMODE_ROOT)
695 		set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
696 	else {
697 		clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
698 		/* stop running timer */
699 		timer_delete_sync(&ifmsh->mesh_path_root_timer);
700 	}
701 }
702 
703 static void
704 ieee80211_mesh_update_bss_params(struct ieee80211_sub_if_data *sdata,
705 				 u8 *ie, u8 ie_len)
706 {
707 	struct ieee80211_supported_band *sband;
708 	const struct element *cap;
709 	const struct ieee80211_he_operation *he_oper = NULL;
710 
711 	sband = ieee80211_get_sband(sdata);
712 	if (!sband)
713 		return;
714 
715 	if (!ieee80211_get_he_iftype_cap(sband, NL80211_IFTYPE_MESH_POINT) ||
716 	    sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
717 		return;
718 
719 	sdata->vif.bss_conf.he_support = true;
720 
721 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ie_len);
722 	if (cap && cap->datalen >= 1 + sizeof(*he_oper) &&
723 	    cap->datalen >= 1 + ieee80211_he_oper_size(cap->data + 1))
724 		he_oper = (void *)(cap->data + 1);
725 
726 	if (he_oper)
727 		sdata->vif.bss_conf.he_oper.params =
728 			__le32_to_cpu(he_oper->he_oper_params);
729 
730 	sdata->vif.bss_conf.eht_support =
731 		!!ieee80211_get_eht_iftype_cap(sband, NL80211_IFTYPE_MESH_POINT);
732 }
733 
734 bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
735 			      struct sk_buff *skb, u32 ctrl_flags)
736 {
737 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
738 	struct ieee80211_mesh_fast_tx_key key = {
739 		.type = MESH_FAST_TX_TYPE_LOCAL
740 	};
741 	struct ieee80211_mesh_fast_tx *entry;
742 	struct ieee80211s_hdr *meshhdr;
743 	u8 sa[ETH_ALEN] __aligned(2);
744 	struct tid_ampdu_tx *tid_tx;
745 	struct sta_info *sta;
746 	bool copy_sa = false;
747 	u16 ethertype;
748 	u8 tid;
749 
750 	if (ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP)
751 		return false;
752 
753 	if (ifmsh->mshcfg.dot11MeshNolearn)
754 		return false;
755 
756 	/* Add support for these cases later */
757 	if (ifmsh->ps_peers_light_sleep || ifmsh->ps_peers_deep_sleep)
758 		return false;
759 
760 	if (is_multicast_ether_addr(skb->data))
761 		return false;
762 
763 	ethertype = (skb->data[12] << 8) | skb->data[13];
764 	if (ethertype < ETH_P_802_3_MIN)
765 		return false;
766 
767 	if (sk_requests_wifi_status(skb->sk))
768 		return false;
769 
770 	if (skb->ip_summed == CHECKSUM_PARTIAL) {
771 		skb_set_transport_header(skb, skb_checksum_start_offset(skb));
772 		if (skb_checksum_help(skb))
773 			return false;
774 	}
775 
776 	ether_addr_copy(key.addr, skb->data);
777 	if (!ether_addr_equal(skb->data + ETH_ALEN, sdata->vif.addr))
778 		key.type = MESH_FAST_TX_TYPE_PROXIED;
779 	entry = mesh_fast_tx_get(sdata, &key);
780 	if (!entry)
781 		return false;
782 
783 	if (skb_headroom(skb) < entry->hdrlen + entry->fast_tx.hdr_len)
784 		return false;
785 
786 	sta = rcu_dereference(entry->mpath->next_hop);
787 	if (!sta)
788 		return false;
789 
790 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
791 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
792 	if (tid_tx) {
793 		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
794 			return false;
795 		if (tid_tx->timeout)
796 			tid_tx->last_tx = jiffies;
797 	}
798 
799 	skb = skb_share_check(skb, GFP_ATOMIC);
800 	if (!skb)
801 		return true;
802 
803 	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
804 
805 	meshhdr = (struct ieee80211s_hdr *)entry->hdr;
806 	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
807 		/* preserve SA from eth header for 6-addr frames */
808 		ether_addr_copy(sa, skb->data + ETH_ALEN);
809 		copy_sa = true;
810 	}
811 
812 	memcpy(skb_push(skb, entry->hdrlen - 2 * ETH_ALEN), entry->hdr,
813 	       entry->hdrlen);
814 
815 	meshhdr = (struct ieee80211s_hdr *)skb->data;
816 	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
817 			   &meshhdr->seqnum);
818 	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
819 	if (copy_sa)
820 	    ether_addr_copy(meshhdr->eaddr2, sa);
821 
822 	skb_push(skb, 2 * ETH_ALEN);
823 	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
824 			      entry->mpath->dst, sdata->vif.addr);
825 
826 	return true;
827 }
828 
829 /**
830  * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
831  * @hdr:	802.11 frame header
832  * @fc:		frame control field
833  * @meshda:	destination address in the mesh
834  * @meshsa:	source address in the mesh.  Same as TA, as frame is
835  *              locally originated.
836  *
837  * Returns: the length of the 802.11 frame header (excludes mesh control header)
838  */
839 int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
840 				  const u8 *meshda, const u8 *meshsa)
841 {
842 	if (is_multicast_ether_addr(meshda)) {
843 		*fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
844 		/* DA TA SA */
845 		memcpy(hdr->addr1, meshda, ETH_ALEN);
846 		memcpy(hdr->addr2, meshsa, ETH_ALEN);
847 		memcpy(hdr->addr3, meshsa, ETH_ALEN);
848 		return 24;
849 	} else {
850 		*fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
851 		/* RA TA DA SA */
852 		eth_zero_addr(hdr->addr1);   /* RA is resolved later */
853 		memcpy(hdr->addr2, meshsa, ETH_ALEN);
854 		memcpy(hdr->addr3, meshda, ETH_ALEN);
855 		memcpy(hdr->addr4, meshsa, ETH_ALEN);
856 		return 30;
857 	}
858 }
859 
860 /**
861  * ieee80211_new_mesh_header - create a new mesh header
862  * @sdata:	mesh interface to be used
863  * @meshhdr:    uninitialized mesh header
864  * @addr4or5:   1st address in the ae header, which may correspond to address 4
865  *              (if addr6 is NULL) or address 5 (if addr6 is present). It may
866  *              be NULL.
867  * @addr6:	2nd address in the ae header, which corresponds to addr6 of the
868  *              mesh frame
869  *
870  * Returns: the header length
871  */
872 unsigned int ieee80211_new_mesh_header(struct ieee80211_sub_if_data *sdata,
873 				       struct ieee80211s_hdr *meshhdr,
874 				       const char *addr4or5, const char *addr6)
875 {
876 	if (WARN_ON(!addr4or5 && addr6))
877 		return 0;
878 
879 	memset(meshhdr, 0, sizeof(*meshhdr));
880 
881 	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
882 
883 	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
884 			   &meshhdr->seqnum);
885 	if (addr4or5 && !addr6) {
886 		meshhdr->flags |= MESH_FLAGS_AE_A4;
887 		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);
888 		return 2 * ETH_ALEN;
889 	} else if (addr4or5 && addr6) {
890 		meshhdr->flags |= MESH_FLAGS_AE_A5_A6;
891 		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);
892 		memcpy(meshhdr->eaddr2, addr6, ETH_ALEN);
893 		return 3 * ETH_ALEN;
894 	}
895 
896 	return ETH_ALEN;
897 }
898 
899 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata)
900 {
901 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
902 	u64 changed;
903 
904 	if (ifmsh->mshcfg.plink_timeout > 0)
905 		ieee80211_sta_expire(sdata, ifmsh->mshcfg.plink_timeout * HZ);
906 	mesh_path_expire(sdata);
907 
908 	changed = mesh_accept_plinks_update(sdata);
909 	ieee80211_mbss_info_change_notify(sdata, changed);
910 
911 	mesh_fast_tx_gc(sdata);
912 
913 	mod_timer(&ifmsh->housekeeping_timer,
914 		  round_jiffies(jiffies +
915 				IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
916 }
917 
918 static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
919 {
920 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
921 	u32 interval;
922 
923 	mesh_path_tx_root_frame(sdata);
924 
925 	if (ifmsh->mshcfg.dot11MeshHWMPRootMode == IEEE80211_PROACTIVE_RANN)
926 		interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
927 	else
928 		interval = ifmsh->mshcfg.dot11MeshHWMProotInterval;
929 
930 	mod_timer(&ifmsh->mesh_path_root_timer,
931 		  round_jiffies(TU_TO_EXP_TIME(interval)));
932 }
933 
934 static int
935 ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
936 {
937 	struct beacon_data *bcn;
938 	int head_len, tail_len;
939 	struct sk_buff *skb;
940 	struct ieee80211_mgmt *mgmt;
941 	struct mesh_csa_settings *csa;
942 	const struct ieee80211_supported_band *sband;
943 	u8 ie_len_he_cap, ie_len_eht_cap;
944 	u8 *pos;
945 	struct ieee80211_sub_if_data *sdata;
946 	int hdr_len = offsetofend(struct ieee80211_mgmt, u.beacon);
947 
948 	sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
949 
950 	sband = ieee80211_get_sband(sdata);
951 
952 	ie_len_he_cap = ieee80211_ie_len_he_cap(sdata);
953 	ie_len_eht_cap = ieee80211_ie_len_eht_cap(sdata);
954 	head_len = hdr_len +
955 		   2 + /* NULL SSID */
956 		   /* Channel Switch Announcement */
957 		   2 + sizeof(struct ieee80211_channel_sw_ie) +
958 		   /* Mesh Channel Switch Parameters */
959 		   2 + sizeof(struct ieee80211_mesh_chansw_params_ie) +
960 		   /* Channel Switch Wrapper + Wide Bandwidth CSA IE */
961 		   2 + 2 + sizeof(struct ieee80211_wide_bw_chansw_ie) +
962 		   2 + sizeof(struct ieee80211_sec_chan_offs_ie) +
963 		   2 + 8 + /* supported rates */
964 		   2 + 3; /* DS params */
965 	tail_len = 2 + (IEEE80211_MAX_SUPP_RATES - 8) +
966 		   2 + sizeof(struct ieee80211_ht_cap) +
967 		   2 + sizeof(struct ieee80211_ht_operation) +
968 		   2 + ifmsh->mesh_id_len +
969 		   2 + sizeof(struct ieee80211_meshconf_ie) +
970 		   2 + sizeof(__le16) + /* awake window */
971 		   2 + sizeof(struct ieee80211_vht_cap) +
972 		   2 + sizeof(struct ieee80211_vht_operation) +
973 		   ie_len_he_cap +
974 		   2 + 1 + sizeof(struct ieee80211_he_operation) +
975 			   sizeof(struct ieee80211_he_6ghz_oper) +
976 		   2 + 1 + sizeof(struct ieee80211_he_6ghz_capa) +
977 		   ie_len_eht_cap +
978 		   2 + 1 + offsetof(struct ieee80211_eht_operation, optional) +
979 			   offsetof(struct ieee80211_eht_operation_info, optional) +
980 		   ifmsh->ie_len;
981 
982 	bcn = kzalloc(sizeof(*bcn) + head_len + tail_len, GFP_KERNEL);
983 	/* need an skb for IE builders to operate on */
984 	skb = __dev_alloc_skb(max(head_len, tail_len), GFP_KERNEL);
985 
986 	if (!bcn || !skb)
987 		goto out_free;
988 
989 	/*
990 	 * pointers go into the block we allocated,
991 	 * memory is | beacon_data | head | tail |
992 	 */
993 	bcn->head = ((u8 *) bcn) + sizeof(*bcn);
994 
995 	/* fill in the head */
996 	mgmt = skb_put_zero(skb, hdr_len);
997 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
998 					  IEEE80211_STYPE_BEACON);
999 	eth_broadcast_addr(mgmt->da);
1000 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1001 	memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
1002 	ieee80211_mps_set_frame_flags(sdata, NULL, (void *) mgmt);
1003 	mgmt->u.beacon.beacon_int =
1004 		cpu_to_le16(sdata->vif.bss_conf.beacon_int);
1005 	mgmt->u.beacon.capab_info |= cpu_to_le16(
1006 		sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
1007 
1008 	pos = skb_put(skb, 2);
1009 	*pos++ = WLAN_EID_SSID;
1010 	*pos++ = 0x0;
1011 
1012 	rcu_read_lock();
1013 	csa = rcu_dereference(ifmsh->csa);
1014 	if (csa) {
1015 		enum nl80211_channel_type ct;
1016 		struct cfg80211_chan_def *chandef;
1017 		int ie_len = 2 + sizeof(struct ieee80211_channel_sw_ie) +
1018 			     2 + sizeof(struct ieee80211_mesh_chansw_params_ie);
1019 
1020 		pos = skb_put_zero(skb, ie_len);
1021 		*pos++ = WLAN_EID_CHANNEL_SWITCH;
1022 		*pos++ = 3;
1023 		*pos++ = 0x0;
1024 		*pos++ = ieee80211_frequency_to_channel(
1025 				csa->settings.chandef.chan->center_freq);
1026 		bcn->cntdwn_current_counter = csa->settings.count;
1027 		bcn->cntdwn_counter_offsets[0] = hdr_len + 6;
1028 		*pos++ = csa->settings.count;
1029 		*pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
1030 		*pos++ = 6;
1031 		if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_INIT) {
1032 			*pos++ = ifmsh->mshcfg.dot11MeshTTL;
1033 			*pos |= WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
1034 		} else {
1035 			*pos++ = ifmsh->chsw_ttl;
1036 		}
1037 		*pos++ |= csa->settings.block_tx ?
1038 			  WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
1039 		put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos);
1040 		pos += 2;
1041 		put_unaligned_le16(ifmsh->pre_value, pos);
1042 		pos += 2;
1043 
1044 		switch (csa->settings.chandef.width) {
1045 		case NL80211_CHAN_WIDTH_40:
1046 			ie_len = 2 + sizeof(struct ieee80211_sec_chan_offs_ie);
1047 			pos = skb_put_zero(skb, ie_len);
1048 
1049 			*pos++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET; /* EID */
1050 			*pos++ = 1;				    /* len */
1051 			ct = cfg80211_get_chandef_type(&csa->settings.chandef);
1052 			if (ct == NL80211_CHAN_HT40PLUS)
1053 				*pos++ = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
1054 			else
1055 				*pos++ = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
1056 			break;
1057 		case NL80211_CHAN_WIDTH_80:
1058 		case NL80211_CHAN_WIDTH_80P80:
1059 		case NL80211_CHAN_WIDTH_160:
1060 			/* Channel Switch Wrapper + Wide Bandwidth CSA IE */
1061 			ie_len = 2 + 2 +
1062 				 sizeof(struct ieee80211_wide_bw_chansw_ie);
1063 			pos = skb_put_zero(skb, ie_len);
1064 
1065 			*pos++ = WLAN_EID_CHANNEL_SWITCH_WRAPPER; /* EID */
1066 			*pos++ = 5;				  /* len */
1067 			/* put sub IE */
1068 			chandef = &csa->settings.chandef;
1069 			ieee80211_ie_build_wide_bw_cs(pos, chandef);
1070 			break;
1071 		default:
1072 			break;
1073 		}
1074 	}
1075 	rcu_read_unlock();
1076 
1077 	if (ieee80211_put_srates_elem(skb, sband,
1078 				      sdata->vif.bss_conf.basic_rates,
1079 				      0, WLAN_EID_SUPP_RATES) ||
1080 	    mesh_add_ds_params_ie(sdata, skb))
1081 		goto out_free;
1082 
1083 	bcn->head_len = skb->len;
1084 	memcpy(bcn->head, skb->data, bcn->head_len);
1085 
1086 	/* now the tail */
1087 	skb_trim(skb, 0);
1088 	bcn->tail = bcn->head + bcn->head_len;
1089 
1090 	if (ieee80211_put_srates_elem(skb, sband,
1091 				      sdata->vif.bss_conf.basic_rates,
1092 				      0, WLAN_EID_EXT_SUPP_RATES) ||
1093 	    mesh_add_rsn_ie(sdata, skb) ||
1094 	    mesh_add_ht_cap_ie(sdata, skb) ||
1095 	    mesh_add_ht_oper_ie(sdata, skb) ||
1096 	    mesh_add_meshid_ie(sdata, skb) ||
1097 	    mesh_add_meshconf_ie(sdata, skb) ||
1098 	    mesh_add_awake_window_ie(sdata, skb) ||
1099 	    mesh_add_vht_cap_ie(sdata, skb) ||
1100 	    mesh_add_vht_oper_ie(sdata, skb) ||
1101 	    mesh_add_he_cap_ie(sdata, skb, ie_len_he_cap) ||
1102 	    mesh_add_he_oper_ie(sdata, skb) ||
1103 	    mesh_add_he_6ghz_cap_ie(sdata, skb) ||
1104 	    mesh_add_eht_cap_ie(sdata, skb, ie_len_eht_cap) ||
1105 	    mesh_add_eht_oper_ie(sdata, skb) ||
1106 	    mesh_add_vendor_ies(sdata, skb))
1107 		goto out_free;
1108 
1109 	bcn->tail_len = skb->len;
1110 	memcpy(bcn->tail, skb->data, bcn->tail_len);
1111 	ieee80211_mesh_update_bss_params(sdata, bcn->tail, bcn->tail_len);
1112 	bcn->meshconf = (struct ieee80211_meshconf_ie *)
1113 					(bcn->tail + ifmsh->meshconf_offset);
1114 
1115 	dev_kfree_skb(skb);
1116 	rcu_assign_pointer(ifmsh->beacon, bcn);
1117 	return 0;
1118 out_free:
1119 	kfree(bcn);
1120 	dev_kfree_skb(skb);
1121 	return -ENOMEM;
1122 }
1123 
1124 static int
1125 ieee80211_mesh_rebuild_beacon(struct ieee80211_sub_if_data *sdata)
1126 {
1127 	struct beacon_data *old_bcn;
1128 	int ret;
1129 
1130 	old_bcn = sdata_dereference(sdata->u.mesh.beacon, sdata);
1131 	ret = ieee80211_mesh_build_beacon(&sdata->u.mesh);
1132 	if (ret)
1133 		/* just reuse old beacon */
1134 		return ret;
1135 
1136 	if (old_bcn)
1137 		kfree_rcu(old_bcn, rcu_head);
1138 	return 0;
1139 }
1140 
1141 void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
1142 				       u64 changed)
1143 {
1144 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1145 	unsigned long bits[] = { BITMAP_FROM_U64(changed) };
1146 	u32 bit;
1147 
1148 	if (!changed)
1149 		return;
1150 
1151 	/* if we race with running work, worst case this work becomes a noop */
1152 	for_each_set_bit(bit, bits, sizeof(changed) * BITS_PER_BYTE)
1153 		set_bit(bit, ifmsh->mbss_changed);
1154 	set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
1155 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
1156 }
1157 
1158 int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
1159 {
1160 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1161 	struct ieee80211_local *local = sdata->local;
1162 	u64 changed = BSS_CHANGED_BEACON |
1163 		      BSS_CHANGED_BEACON_ENABLED |
1164 		      BSS_CHANGED_HT |
1165 		      BSS_CHANGED_BASIC_RATES |
1166 		      BSS_CHANGED_BEACON_INT |
1167 		      BSS_CHANGED_MCAST_RATE;
1168 
1169 	local->fif_other_bss++;
1170 	/* mesh ifaces must set allmulti to forward mcast traffic */
1171 	atomic_inc(&local->iff_allmultis);
1172 	ieee80211_configure_filter(local);
1173 
1174 	ifmsh->mesh_cc_id = 0;	/* Disabled */
1175 	/* register sync ops from extensible synchronization framework */
1176 	ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
1177 	ifmsh->sync_offset_clockdrift_max = 0;
1178 	set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
1179 	ieee80211_mesh_root_setup(ifmsh);
1180 	wiphy_work_queue(local->hw.wiphy, &sdata->work);
1181 	sdata->vif.bss_conf.ht_operation_mode =
1182 				ifmsh->mshcfg.ht_opmode;
1183 	sdata->vif.bss_conf.enable_beacon = true;
1184 
1185 	changed |= ieee80211_mps_local_status_update(sdata);
1186 
1187 	if (ieee80211_mesh_build_beacon(ifmsh)) {
1188 		ieee80211_stop_mesh(sdata);
1189 		return -ENOMEM;
1190 	}
1191 
1192 	ieee80211_recalc_dtim(sdata, drv_get_tsf(local, sdata));
1193 	ieee80211_link_info_change_notify(sdata, &sdata->deflink, changed);
1194 
1195 	netif_carrier_on(sdata->dev);
1196 	return 0;
1197 }
1198 
1199 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
1200 {
1201 	struct ieee80211_local *local = sdata->local;
1202 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1203 	struct beacon_data *bcn;
1204 
1205 	netif_carrier_off(sdata->dev);
1206 
1207 	/* flush STAs and mpaths on this iface */
1208 	sta_info_flush(sdata, -1);
1209 	ieee80211_free_keys(sdata, true);
1210 	mesh_path_flush_by_iface(sdata);
1211 
1212 	/* stop the beacon */
1213 	ifmsh->mesh_id_len = 0;
1214 	sdata->vif.bss_conf.enable_beacon = false;
1215 	sdata->beacon_rate_set = false;
1216 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
1217 	ieee80211_link_info_change_notify(sdata, &sdata->deflink,
1218 					  BSS_CHANGED_BEACON_ENABLED);
1219 
1220 	/* remove beacon */
1221 	bcn = sdata_dereference(ifmsh->beacon, sdata);
1222 	RCU_INIT_POINTER(ifmsh->beacon, NULL);
1223 	kfree_rcu(bcn, rcu_head);
1224 
1225 	/* free all potentially still buffered group-addressed frames */
1226 	local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
1227 	skb_queue_purge(&ifmsh->ps.bc_buf);
1228 
1229 	timer_delete_sync(&sdata->u.mesh.housekeeping_timer);
1230 	timer_delete_sync(&sdata->u.mesh.mesh_path_root_timer);
1231 	timer_delete_sync(&sdata->u.mesh.mesh_path_timer);
1232 
1233 	/* clear any mesh work (for next join) we may have accrued */
1234 	ifmsh->wrkq_flags = 0;
1235 	memset(ifmsh->mbss_changed, 0, sizeof(ifmsh->mbss_changed));
1236 
1237 	local->fif_other_bss--;
1238 	atomic_dec(&local->iff_allmultis);
1239 	ieee80211_configure_filter(local);
1240 }
1241 
1242 static void ieee80211_mesh_csa_mark_radar(struct ieee80211_sub_if_data *sdata)
1243 {
1244 	int err;
1245 
1246 	/* if the current channel is a DFS channel, mark the channel as
1247 	 * unavailable.
1248 	 */
1249 	err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
1250 					    &sdata->vif.bss_conf.chanreq.oper,
1251 					    NL80211_IFTYPE_MESH_POINT);
1252 	if (err > 0)
1253 		cfg80211_radar_event(sdata->local->hw.wiphy,
1254 				     &sdata->vif.bss_conf.chanreq.oper,
1255 				     GFP_ATOMIC);
1256 }
1257 
1258 static bool
1259 ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
1260 				 struct ieee802_11_elems *elems, bool beacon)
1261 {
1262 	struct cfg80211_csa_settings params;
1263 	struct ieee80211_csa_ie csa_ie;
1264 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1265 	struct ieee80211_supported_band *sband;
1266 	int err;
1267 	struct ieee80211_conn_settings conn = ieee80211_conn_settings_unlimited;
1268 	u32 vht_cap_info = 0;
1269 
1270 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
1271 
1272 	sband = ieee80211_get_sband(sdata);
1273 	if (!sband)
1274 		return false;
1275 
1276 	switch (sdata->vif.bss_conf.chanreq.oper.width) {
1277 	case NL80211_CHAN_WIDTH_20_NOHT:
1278 		conn.mode = IEEE80211_CONN_MODE_LEGACY;
1279 		conn.bw_limit = IEEE80211_CONN_BW_LIMIT_20;
1280 		break;
1281 	case NL80211_CHAN_WIDTH_20:
1282 		conn.mode = IEEE80211_CONN_MODE_HT;
1283 		conn.bw_limit = IEEE80211_CONN_BW_LIMIT_20;
1284 		break;
1285 	case NL80211_CHAN_WIDTH_40:
1286 		conn.mode = IEEE80211_CONN_MODE_HT;
1287 		conn.bw_limit = IEEE80211_CONN_BW_LIMIT_40;
1288 		break;
1289 	default:
1290 		break;
1291 	}
1292 
1293 	if (elems->vht_cap_elem)
1294 		vht_cap_info =
1295 			le32_to_cpu(elems->vht_cap_elem->vht_cap_info);
1296 
1297 	memset(&params, 0, sizeof(params));
1298 	err = ieee80211_parse_ch_switch_ie(sdata, elems, sband->band,
1299 					   vht_cap_info, &conn,
1300 					   sdata->vif.addr, false,
1301 					   &csa_ie);
1302 	if (err < 0)
1303 		return false;
1304 	if (err)
1305 		return false;
1306 
1307 	/* Mark the channel unavailable if the reason for the switch is
1308 	 * regulatory.
1309 	 */
1310 	if (csa_ie.reason_code == WLAN_REASON_MESH_CHAN_REGULATORY)
1311 		ieee80211_mesh_csa_mark_radar(sdata);
1312 
1313 	params.chandef = csa_ie.chanreq.oper;
1314 	params.count = csa_ie.count;
1315 
1316 	if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, &params.chandef,
1317 				     IEEE80211_CHAN_DISABLED) ||
1318 	    !cfg80211_reg_can_beacon(sdata->local->hw.wiphy, &params.chandef,
1319 				     NL80211_IFTYPE_MESH_POINT)) {
1320 		sdata_info(sdata,
1321 			   "mesh STA %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), aborting\n",
1322 			   sdata->vif.addr,
1323 			   params.chandef.chan->center_freq,
1324 			   params.chandef.width,
1325 			   params.chandef.center_freq1,
1326 			   params.chandef.center_freq2);
1327 		return false;
1328 	}
1329 
1330 	err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
1331 					    &params.chandef,
1332 					    NL80211_IFTYPE_MESH_POINT);
1333 	if (err < 0)
1334 		return false;
1335 	if (err > 0 && !ifmsh->userspace_handles_dfs) {
1336 		sdata_info(sdata,
1337 			   "mesh STA %pM switches to channel requiring DFS (%d MHz, width:%d, CF1/2: %d/%d MHz), aborting\n",
1338 			   sdata->vif.addr,
1339 			   params.chandef.chan->center_freq,
1340 			   params.chandef.width,
1341 			   params.chandef.center_freq1,
1342 			   params.chandef.center_freq2);
1343 		return false;
1344 	}
1345 
1346 	params.radar_required = err;
1347 
1348 	if (cfg80211_chandef_identical(&params.chandef,
1349 				       &sdata->vif.bss_conf.chanreq.oper)) {
1350 		mcsa_dbg(sdata,
1351 			 "received csa with an identical chandef, ignoring\n");
1352 		return true;
1353 	}
1354 
1355 	mcsa_dbg(sdata,
1356 		 "received channel switch announcement to go to channel %d MHz\n",
1357 		 params.chandef.chan->center_freq);
1358 
1359 	params.block_tx = csa_ie.mode & WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT;
1360 	if (beacon) {
1361 		ifmsh->chsw_ttl = csa_ie.ttl - 1;
1362 		if (ifmsh->pre_value >= csa_ie.pre_value)
1363 			return false;
1364 		ifmsh->pre_value = csa_ie.pre_value;
1365 	}
1366 
1367 	if (ifmsh->chsw_ttl >= ifmsh->mshcfg.dot11MeshTTL)
1368 		return false;
1369 
1370 	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_REPEATER;
1371 
1372 	if (ieee80211_channel_switch(sdata->local->hw.wiphy, sdata->dev,
1373 				     &params) < 0)
1374 		return false;
1375 
1376 	return true;
1377 }
1378 
1379 static void
1380 ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
1381 			    struct ieee80211_mgmt *mgmt, size_t len)
1382 {
1383 	struct ieee80211_local *local = sdata->local;
1384 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1385 	struct sk_buff *presp;
1386 	struct beacon_data *bcn;
1387 	struct ieee80211_mgmt *hdr;
1388 	struct ieee802_11_elems *elems;
1389 	size_t baselen;
1390 	u8 *pos;
1391 
1392 	pos = mgmt->u.probe_req.variable;
1393 	baselen = (u8 *) pos - (u8 *) mgmt;
1394 	if (baselen > len)
1395 		return;
1396 
1397 	elems = ieee802_11_parse_elems(pos, len - baselen,
1398 				       IEEE80211_FTYPE_MGMT |
1399 				       IEEE80211_STYPE_PROBE_REQ,
1400 				       NULL);
1401 	if (!elems)
1402 		return;
1403 
1404 	if (!elems->mesh_id)
1405 		goto free;
1406 
1407 	/* 802.11-2012 10.1.4.3.2 */
1408 	if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
1409 	     !is_broadcast_ether_addr(mgmt->da)) ||
1410 	    elems->ssid_len != 0)
1411 		goto free;
1412 
1413 	if (elems->mesh_id_len != 0 &&
1414 	    (elems->mesh_id_len != ifmsh->mesh_id_len ||
1415 	     memcmp(elems->mesh_id, ifmsh->mesh_id, ifmsh->mesh_id_len)))
1416 		goto free;
1417 
1418 	rcu_read_lock();
1419 	bcn = rcu_dereference(ifmsh->beacon);
1420 
1421 	if (!bcn)
1422 		goto out;
1423 
1424 	presp = dev_alloc_skb(local->tx_headroom +
1425 			      bcn->head_len + bcn->tail_len);
1426 	if (!presp)
1427 		goto out;
1428 
1429 	skb_reserve(presp, local->tx_headroom);
1430 	skb_put_data(presp, bcn->head, bcn->head_len);
1431 	skb_put_data(presp, bcn->tail, bcn->tail_len);
1432 	hdr = (struct ieee80211_mgmt *) presp->data;
1433 	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1434 					 IEEE80211_STYPE_PROBE_RESP);
1435 	memcpy(hdr->da, mgmt->sa, ETH_ALEN);
1436 	IEEE80211_SKB_CB(presp)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1437 	ieee80211_tx_skb(sdata, presp);
1438 out:
1439 	rcu_read_unlock();
1440 free:
1441 	kfree(elems);
1442 }
1443 
1444 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
1445 					struct ieee80211_mgmt *mgmt,
1446 					size_t len,
1447 					struct ieee80211_rx_status *rx_status)
1448 {
1449 	u16 type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE;
1450 	struct ieee80211_local *local = sdata->local;
1451 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1452 	struct ieee802_11_elems *elems;
1453 	struct ieee80211_channel *channel;
1454 	size_t baselen;
1455 	int freq;
1456 	enum nl80211_band band = rx_status->band;
1457 
1458 	/* ignore ProbeResp to foreign address */
1459 	if (type == (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP) &&
1460 	    !ether_addr_equal(mgmt->da, sdata->vif.addr))
1461 		return;
1462 
1463 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
1464 	if (baselen > len)
1465 		return;
1466 
1467 	elems = ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
1468 				       len - baselen, type, NULL);
1469 	if (!elems)
1470 		return;
1471 
1472 	/* ignore non-mesh or secure / insecure mismatch */
1473 	if ((!elems->mesh_id || !elems->mesh_config) ||
1474 	    (elems->rsn && sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) ||
1475 	    (!elems->rsn && sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE))
1476 		goto free;
1477 
1478 	if (elems->ds_params)
1479 		freq = ieee80211_channel_to_frequency(elems->ds_params[0], band);
1480 	else
1481 		freq = rx_status->freq;
1482 
1483 	channel = ieee80211_get_channel(local->hw.wiphy, freq);
1484 
1485 	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
1486 		goto free;
1487 
1488 	if (mesh_matches_local(sdata, elems)) {
1489 		mpl_dbg(sdata, "rssi_threshold=%d,rx_status->signal=%d\n",
1490 			sdata->u.mesh.mshcfg.rssi_threshold, rx_status->signal);
1491 		if (!sdata->u.mesh.user_mpm ||
1492 		    sdata->u.mesh.mshcfg.rssi_threshold == 0 ||
1493 		    sdata->u.mesh.mshcfg.rssi_threshold < rx_status->signal)
1494 			mesh_neighbour_update(sdata, mgmt->sa, elems,
1495 					      rx_status);
1496 
1497 		if (ifmsh->csa_role != IEEE80211_MESH_CSA_ROLE_INIT &&
1498 		    !sdata->vif.bss_conf.csa_active)
1499 			ieee80211_mesh_process_chnswitch(sdata, elems, true);
1500 	}
1501 
1502 	if (ifmsh->sync_ops)
1503 		ifmsh->sync_ops->rx_bcn_presp(sdata,
1504 					      type & IEEE80211_FCTL_STYPE,
1505 					      mgmt, len,
1506 					      elems->mesh_config, rx_status);
1507 free:
1508 	kfree(elems);
1509 }
1510 
1511 int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata, u64 *changed)
1512 {
1513 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1514 	struct mesh_csa_settings *tmp_csa_settings;
1515 	int ret = 0;
1516 
1517 	/* Reset the TTL value and Initiator flag */
1518 	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
1519 	ifmsh->chsw_ttl = 0;
1520 
1521 	/* Remove the CSA and MCSP elements from the beacon */
1522 	tmp_csa_settings = sdata_dereference(ifmsh->csa, sdata);
1523 	RCU_INIT_POINTER(ifmsh->csa, NULL);
1524 	if (tmp_csa_settings)
1525 		kfree_rcu(tmp_csa_settings, rcu_head);
1526 	ret = ieee80211_mesh_rebuild_beacon(sdata);
1527 	if (ret)
1528 		return -EINVAL;
1529 
1530 	*changed |= BSS_CHANGED_BEACON;
1531 
1532 	mcsa_dbg(sdata, "complete switching to center freq %d MHz",
1533 		 sdata->vif.bss_conf.chanreq.oper.chan->center_freq);
1534 	return 0;
1535 }
1536 
1537 int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
1538 			      struct cfg80211_csa_settings *csa_settings,
1539 			      u64 *changed)
1540 {
1541 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1542 	struct mesh_csa_settings *tmp_csa_settings;
1543 	int ret = 0;
1544 
1545 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
1546 
1547 	tmp_csa_settings = kmalloc_obj(*tmp_csa_settings, GFP_ATOMIC);
1548 	if (!tmp_csa_settings)
1549 		return -ENOMEM;
1550 
1551 	memcpy(&tmp_csa_settings->settings, csa_settings,
1552 	       sizeof(struct cfg80211_csa_settings));
1553 
1554 	rcu_assign_pointer(ifmsh->csa, tmp_csa_settings);
1555 
1556 	ret = ieee80211_mesh_rebuild_beacon(sdata);
1557 	if (ret) {
1558 		tmp_csa_settings = rcu_dereference(ifmsh->csa);
1559 		RCU_INIT_POINTER(ifmsh->csa, NULL);
1560 		kfree_rcu(tmp_csa_settings, rcu_head);
1561 		return ret;
1562 	}
1563 
1564 	*changed |= BSS_CHANGED_BEACON;
1565 	return 0;
1566 }
1567 
1568 static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
1569 			       struct ieee80211_mgmt *mgmt, size_t len,
1570 			       struct ieee802_11_elems *elems)
1571 {
1572 	struct ieee80211_mgmt *mgmt_fwd;
1573 	struct sk_buff *skb;
1574 	struct ieee80211_local *local = sdata->local;
1575 
1576 	skb = dev_alloc_skb(local->tx_headroom + len);
1577 	if (!skb)
1578 		return -ENOMEM;
1579 	skb_reserve(skb, local->tx_headroom);
1580 	mgmt_fwd = skb_put(skb, len);
1581 
1582 	elems->mesh_chansw_params_ie->mesh_ttl--;
1583 	elems->mesh_chansw_params_ie->mesh_flags &=
1584 		~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
1585 
1586 	memcpy(mgmt_fwd, mgmt, len);
1587 	eth_broadcast_addr(mgmt_fwd->da);
1588 	memcpy(mgmt_fwd->sa, sdata->vif.addr, ETH_ALEN);
1589 	memcpy(mgmt_fwd->bssid, sdata->vif.addr, ETH_ALEN);
1590 
1591 	ieee80211_tx_skb(sdata, skb);
1592 	return 0;
1593 }
1594 
1595 static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
1596 			      struct ieee80211_mgmt *mgmt, size_t len)
1597 {
1598 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1599 	struct ieee802_11_elems *elems;
1600 	u16 pre_value;
1601 	bool fwd_csa = true;
1602 	size_t baselen;
1603 	u8 *pos;
1604 
1605 	if (mgmt->u.action.action_code != WLAN_ACTION_SPCT_CHL_SWITCH)
1606 		return;
1607 
1608 	pos = mgmt->u.action.chan_switch.variable;
1609 	baselen = offsetof(struct ieee80211_mgmt,
1610 			   u.action.chan_switch.variable);
1611 	elems = ieee802_11_parse_elems(pos, len - baselen,
1612 				       IEEE80211_FTYPE_MGMT |
1613 				       IEEE80211_STYPE_ACTION,
1614 				       NULL);
1615 	if (!elems)
1616 		return;
1617 
1618 	if (!mesh_matches_local(sdata, elems))
1619 		goto free;
1620 
1621 	if (!elems->mesh_chansw_params_ie)
1622 		goto free;
1623 
1624 	ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
1625 	if (!--ifmsh->chsw_ttl)
1626 		fwd_csa = false;
1627 
1628 	pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);
1629 	if (ifmsh->pre_value >= pre_value)
1630 		goto free;
1631 
1632 	ifmsh->pre_value = pre_value;
1633 
1634 	if (!sdata->vif.bss_conf.csa_active &&
1635 	    !ieee80211_mesh_process_chnswitch(sdata, elems, false)) {
1636 		mcsa_dbg(sdata, "Failed to process CSA action frame");
1637 		goto free;
1638 	}
1639 
1640 	/* forward or re-broadcast the CSA frame */
1641 	if (fwd_csa) {
1642 		if (mesh_fwd_csa_frame(sdata, mgmt, len, elems) < 0)
1643 			mcsa_dbg(sdata, "Failed to forward the CSA frame");
1644 	}
1645 free:
1646 	kfree(elems);
1647 }
1648 
1649 static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
1650 					  struct ieee80211_mgmt *mgmt,
1651 					  size_t len,
1652 					  struct ieee80211_rx_status *rx_status)
1653 {
1654 	switch (mgmt->u.action.category) {
1655 	case WLAN_CATEGORY_SELF_PROTECTED:
1656 		switch (mgmt->u.action.action_code) {
1657 		case WLAN_SP_MESH_PEERING_OPEN:
1658 		case WLAN_SP_MESH_PEERING_CLOSE:
1659 		case WLAN_SP_MESH_PEERING_CONFIRM:
1660 			mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
1661 			break;
1662 		}
1663 		break;
1664 	case WLAN_CATEGORY_MESH_ACTION:
1665 		if (mesh_action_is_path_sel(mgmt))
1666 			mesh_rx_path_sel_frame(sdata, mgmt, len);
1667 		break;
1668 	case WLAN_CATEGORY_SPECTRUM_MGMT:
1669 		mesh_rx_csa_frame(sdata, mgmt, len);
1670 		break;
1671 	}
1672 }
1673 
1674 void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1675 				   struct sk_buff *skb)
1676 {
1677 	struct ieee80211_rx_status *rx_status;
1678 	struct ieee80211_mgmt *mgmt;
1679 	u16 stype;
1680 
1681 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
1682 
1683 	/* mesh already went down */
1684 	if (!sdata->u.mesh.mesh_id_len)
1685 		return;
1686 
1687 	rx_status = IEEE80211_SKB_RXCB(skb);
1688 	mgmt = (struct ieee80211_mgmt *) skb->data;
1689 	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
1690 
1691 	switch (stype) {
1692 	case IEEE80211_STYPE_PROBE_RESP:
1693 	case IEEE80211_STYPE_BEACON:
1694 		ieee80211_mesh_rx_bcn_presp(sdata, mgmt, skb->len, rx_status);
1695 		break;
1696 	case IEEE80211_STYPE_PROBE_REQ:
1697 		ieee80211_mesh_rx_probe_req(sdata, mgmt, skb->len);
1698 		break;
1699 	case IEEE80211_STYPE_ACTION:
1700 		ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
1701 		break;
1702 	}
1703 }
1704 
1705 static void mesh_bss_info_changed(struct ieee80211_sub_if_data *sdata)
1706 {
1707 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1708 	u32 bit;
1709 	u64 changed = 0;
1710 
1711 	for_each_set_bit(bit, ifmsh->mbss_changed,
1712 			 sizeof(changed) * BITS_PER_BYTE) {
1713 		clear_bit(bit, ifmsh->mbss_changed);
1714 		changed |= BIT(bit);
1715 	}
1716 
1717 	if (sdata->vif.bss_conf.enable_beacon &&
1718 	    (changed & (BSS_CHANGED_BEACON |
1719 			BSS_CHANGED_HT |
1720 			BSS_CHANGED_BASIC_RATES |
1721 			BSS_CHANGED_BEACON_INT)))
1722 		if (ieee80211_mesh_rebuild_beacon(sdata))
1723 			return;
1724 
1725 	ieee80211_link_info_change_notify(sdata, &sdata->deflink, changed);
1726 }
1727 
1728 void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
1729 {
1730 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1731 
1732 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
1733 
1734 	/* mesh already went down */
1735 	if (!sdata->u.mesh.mesh_id_len)
1736 		return;
1737 
1738 	if (ifmsh->preq_queue_len &&
1739 	    time_after(jiffies,
1740 		       ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
1741 		mesh_path_start_discovery(sdata);
1742 
1743 	if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
1744 		ieee80211_mesh_housekeeping(sdata);
1745 
1746 	if (test_and_clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags))
1747 		ieee80211_mesh_rootpath(sdata);
1748 
1749 	if (test_and_clear_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags))
1750 		mesh_sync_adjust_tsf(sdata);
1751 
1752 	if (test_and_clear_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags))
1753 		mesh_bss_info_changed(sdata);
1754 }
1755 
1756 
1757 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
1758 {
1759 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1760 	static u8 zero_addr[ETH_ALEN] = {};
1761 
1762 	timer_setup(&ifmsh->housekeeping_timer,
1763 		    ieee80211_mesh_housekeeping_timer, 0);
1764 
1765 	ifmsh->accepting_plinks = true;
1766 	atomic_set(&ifmsh->mpaths, 0);
1767 	mesh_rmc_init(sdata);
1768 	ifmsh->last_preq = jiffies;
1769 	ifmsh->next_perr = jiffies;
1770 	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
1771 	ifmsh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
1772 	/* Allocate all mesh structures when creating the first mesh interface. */
1773 	if (!mesh_allocated)
1774 		ieee80211s_init();
1775 
1776 	mesh_pathtbl_init(sdata);
1777 
1778 	timer_setup(&ifmsh->mesh_path_timer, ieee80211_mesh_path_timer, 0);
1779 	timer_setup(&ifmsh->mesh_path_root_timer,
1780 		    ieee80211_mesh_path_root_timer, 0);
1781 	INIT_LIST_HEAD(&ifmsh->preq_queue.list);
1782 	skb_queue_head_init(&ifmsh->ps.bc_buf);
1783 	spin_lock_init(&ifmsh->mesh_preq_queue_lock);
1784 	spin_lock_init(&ifmsh->sync_offset_lock);
1785 	RCU_INIT_POINTER(ifmsh->beacon, NULL);
1786 
1787 	sdata->vif.bss_conf.bssid = zero_addr;
1788 }
1789 
1790 void ieee80211_mesh_teardown_sdata(struct ieee80211_sub_if_data *sdata)
1791 {
1792 	mesh_rmc_free(sdata);
1793 	mesh_pathtbl_unregister(sdata);
1794 }
1795