xref: /openbmc/linux/net/mac80211/mesh.c (revision 5d4a2e29)
1 /*
2  * Copyright (c) 2008, 2009 open80211s Ltd.
3  * Authors:    Luis Carlos Cobo <luisca@cozybit.com>
4  * 	       Javier Cardona <javier@cozybit.com>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10 
11 #include <linux/slab.h>
12 #include <asm/unaligned.h>
13 #include "ieee80211_i.h"
14 #include "mesh.h"
15 
16 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
17 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
18 #define IEEE80211_MESH_RANN_INTERVAL	     (1 * HZ)
19 
20 #define MESHCONF_CAPAB_ACCEPT_PLINKS 0x01
21 #define MESHCONF_CAPAB_FORWARDING    0x08
22 
23 #define TMR_RUNNING_HK	0
24 #define TMR_RUNNING_MP	1
25 #define TMR_RUNNING_MPR	2
26 
27 int mesh_allocated;
28 static struct kmem_cache *rm_cache;
29 
30 void ieee80211s_init(void)
31 {
32 	mesh_pathtbl_init();
33 	mesh_allocated = 1;
34 	rm_cache = kmem_cache_create("mesh_rmc", sizeof(struct rmc_entry),
35 				     0, 0, NULL);
36 }
37 
38 void ieee80211s_stop(void)
39 {
40 	mesh_pathtbl_unregister();
41 	kmem_cache_destroy(rm_cache);
42 }
43 
44 static void ieee80211_mesh_housekeeping_timer(unsigned long data)
45 {
46 	struct ieee80211_sub_if_data *sdata = (void *) data;
47 	struct ieee80211_local *local = sdata->local;
48 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
49 
50 	set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
51 
52 	if (local->quiescing) {
53 		set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
54 		return;
55 	}
56 
57 	ieee80211_queue_work(&local->hw, &ifmsh->work);
58 }
59 
60 /**
61  * mesh_matches_local - check if the config of a mesh point matches ours
62  *
63  * @ie: information elements of a management frame from the mesh peer
64  * @sdata: local mesh subif
65  *
66  * This function checks if the mesh configuration of a mesh point matches the
67  * local mesh configuration, i.e. if both nodes belong to the same mesh network.
68  */
69 bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_data *sdata)
70 {
71 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
72 
73 	/*
74 	 * As support for each feature is added, check for matching
75 	 * - On mesh config capabilities
76 	 *   - Power Save Support En
77 	 *   - Sync support enabled
78 	 *   - Sync support active
79 	 *   - Sync support required from peer
80 	 *   - MDA enabled
81 	 * - Power management control on fc
82 	 */
83 	if (ifmsh->mesh_id_len == ie->mesh_id_len &&
84 		memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
85 		(ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&
86 		(ifmsh->mesh_pm_id == ie->mesh_config->meshconf_pmetric) &&
87 		(ifmsh->mesh_cc_id == ie->mesh_config->meshconf_congest) &&
88 		(ifmsh->mesh_sp_id == ie->mesh_config->meshconf_synch) &&
89 		(ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth))
90 		return true;
91 
92 	return false;
93 }
94 
95 /**
96  * mesh_peer_accepts_plinks - check if an mp is willing to establish peer links
97  *
98  * @ie: information elements of a management frame from the mesh peer
99  */
100 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
101 {
102 	return (ie->mesh_config->meshconf_cap &
103 	    MESHCONF_CAPAB_ACCEPT_PLINKS) != 0;
104 }
105 
106 /**
107  * mesh_accept_plinks_update: update accepting_plink in local mesh beacons
108  *
109  * @sdata: mesh interface in which mesh beacons are going to be updated
110  */
111 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
112 {
113 	bool free_plinks;
114 
115 	/* In case mesh_plink_free_count > 0 and mesh_plinktbl_capacity == 0,
116 	 * the mesh interface might be able to establish plinks with peers that
117 	 * are already on the table but are not on PLINK_ESTAB state. However,
118 	 * in general the mesh interface is not accepting peer link requests
119 	 * from new peers, and that must be reflected in the beacon
120 	 */
121 	free_plinks = mesh_plink_availables(sdata);
122 
123 	if (free_plinks != sdata->u.mesh.accepting_plinks)
124 		ieee80211_mesh_housekeeping_timer((unsigned long) sdata);
125 }
126 
127 void mesh_ids_set_default(struct ieee80211_if_mesh *sta)
128 {
129 	sta->mesh_pp_id = 0;	/* HWMP */
130 	sta->mesh_pm_id = 0;	/* Airtime */
131 	sta->mesh_cc_id = 0;	/* Disabled */
132 	sta->mesh_sp_id = 0;	/* Neighbor Offset */
133 	sta->mesh_auth_id = 0;	/* Disabled */
134 }
135 
136 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
137 {
138 	int i;
139 
140 	sdata->u.mesh.rmc = kmalloc(sizeof(struct mesh_rmc), GFP_KERNEL);
141 	if (!sdata->u.mesh.rmc)
142 		return -ENOMEM;
143 	sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
144 	for (i = 0; i < RMC_BUCKETS; i++)
145 		INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i].list);
146 	return 0;
147 }
148 
149 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
150 {
151 	struct mesh_rmc *rmc = sdata->u.mesh.rmc;
152 	struct rmc_entry *p, *n;
153 	int i;
154 
155 	if (!sdata->u.mesh.rmc)
156 		return;
157 
158 	for (i = 0; i < RMC_BUCKETS; i++)
159 		list_for_each_entry_safe(p, n, &rmc->bucket[i].list, list) {
160 			list_del(&p->list);
161 			kmem_cache_free(rm_cache, p);
162 		}
163 
164 	kfree(rmc);
165 	sdata->u.mesh.rmc = NULL;
166 }
167 
168 /**
169  * mesh_rmc_check - Check frame in recent multicast cache and add if absent.
170  *
171  * @sa:		source address
172  * @mesh_hdr:	mesh_header
173  *
174  * Returns: 0 if the frame is not in the cache, nonzero otherwise.
175  *
176  * Checks using the source address and the mesh sequence number if we have
177  * received this frame lately. If the frame is not in the cache, it is added to
178  * it.
179  */
180 int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
181 		   struct ieee80211_sub_if_data *sdata)
182 {
183 	struct mesh_rmc *rmc = sdata->u.mesh.rmc;
184 	u32 seqnum = 0;
185 	int entries = 0;
186 	u8 idx;
187 	struct rmc_entry *p, *n;
188 
189 	/* Don't care about endianness since only match matters */
190 	memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum));
191 	idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask;
192 	list_for_each_entry_safe(p, n, &rmc->bucket[idx].list, list) {
193 		++entries;
194 		if (time_after(jiffies, p->exp_time) ||
195 				(entries == RMC_QUEUE_MAX_LEN)) {
196 			list_del(&p->list);
197 			kmem_cache_free(rm_cache, p);
198 			--entries;
199 		} else if ((seqnum == p->seqnum) &&
200 			   (memcmp(sa, p->sa, ETH_ALEN) == 0))
201 			return -1;
202 	}
203 
204 	p = kmem_cache_alloc(rm_cache, GFP_ATOMIC);
205 	if (!p) {
206 		printk(KERN_DEBUG "o11s: could not allocate RMC entry\n");
207 		return 0;
208 	}
209 	p->seqnum = seqnum;
210 	p->exp_time = jiffies + RMC_TIMEOUT;
211 	memcpy(p->sa, sa, ETH_ALEN);
212 	list_add(&p->list, &rmc->bucket[idx].list);
213 	return 0;
214 }
215 
216 void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
217 {
218 	struct ieee80211_local *local = sdata->local;
219 	struct ieee80211_supported_band *sband;
220 	u8 *pos;
221 	int len, i, rate;
222 	u8 neighbors;
223 
224 	sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
225 	len = sband->n_bitrates;
226 	if (len > 8)
227 		len = 8;
228 	pos = skb_put(skb, len + 2);
229 	*pos++ = WLAN_EID_SUPP_RATES;
230 	*pos++ = len;
231 	for (i = 0; i < len; i++) {
232 		rate = sband->bitrates[i].bitrate;
233 		*pos++ = (u8) (rate / 5);
234 	}
235 
236 	if (sband->n_bitrates > len) {
237 		pos = skb_put(skb, sband->n_bitrates - len + 2);
238 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
239 		*pos++ = sband->n_bitrates - len;
240 		for (i = len; i < sband->n_bitrates; i++) {
241 			rate = sband->bitrates[i].bitrate;
242 			*pos++ = (u8) (rate / 5);
243 		}
244 	}
245 
246 	if (sband->band == IEEE80211_BAND_2GHZ) {
247 		pos = skb_put(skb, 2 + 1);
248 		*pos++ = WLAN_EID_DS_PARAMS;
249 		*pos++ = 1;
250 		*pos++ = ieee80211_frequency_to_channel(local->hw.conf.channel->center_freq);
251 	}
252 
253 	pos = skb_put(skb, 2 + sdata->u.mesh.mesh_id_len);
254 	*pos++ = WLAN_EID_MESH_ID;
255 	*pos++ = sdata->u.mesh.mesh_id_len;
256 	if (sdata->u.mesh.mesh_id_len)
257 		memcpy(pos, sdata->u.mesh.mesh_id, sdata->u.mesh.mesh_id_len);
258 
259 	pos = skb_put(skb, 2 + sizeof(struct ieee80211_meshconf_ie));
260 	*pos++ = WLAN_EID_MESH_CONFIG;
261 	*pos++ = sizeof(struct ieee80211_meshconf_ie);
262 
263 	/* Active path selection protocol ID */
264 	*pos++ = sdata->u.mesh.mesh_pp_id;
265 
266 	/* Active path selection metric ID   */
267 	*pos++ = sdata->u.mesh.mesh_pm_id;
268 
269 	/* Congestion control mode identifier */
270 	*pos++ = sdata->u.mesh.mesh_cc_id;
271 
272 	/* Synchronization protocol identifier */
273 	*pos++ = sdata->u.mesh.mesh_sp_id;
274 
275 	/* Authentication Protocol identifier */
276 	*pos++ = sdata->u.mesh.mesh_auth_id;
277 
278 	/* Mesh Formation Info - number of neighbors */
279 	neighbors = atomic_read(&sdata->u.mesh.mshstats.estab_plinks);
280 	/* Number of neighbor mesh STAs or 15 whichever is smaller */
281 	neighbors = (neighbors > 15) ? 15 : neighbors;
282 	*pos++ = neighbors << 1;
283 
284 	/* Mesh capability */
285 	sdata->u.mesh.accepting_plinks = mesh_plink_availables(sdata);
286 	*pos = MESHCONF_CAPAB_FORWARDING;
287 	*pos++ |= sdata->u.mesh.accepting_plinks ?
288 	    MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
289 	*pos++ = 0x00;
290 }
291 
292 u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata, struct mesh_table *tbl)
293 {
294 	/* Use last four bytes of hw addr and interface index as hash index */
295 	return jhash_2words(*(u32 *)(addr+2), sdata->dev->ifindex, tbl->hash_rnd)
296 		& tbl->hash_mask;
297 }
298 
299 struct mesh_table *mesh_table_alloc(int size_order)
300 {
301 	int i;
302 	struct mesh_table *newtbl;
303 
304 	newtbl = kmalloc(sizeof(struct mesh_table), GFP_KERNEL);
305 	if (!newtbl)
306 		return NULL;
307 
308 	newtbl->hash_buckets = kzalloc(sizeof(struct hlist_head) *
309 			(1 << size_order), GFP_KERNEL);
310 
311 	if (!newtbl->hash_buckets) {
312 		kfree(newtbl);
313 		return NULL;
314 	}
315 
316 	newtbl->hashwlock = kmalloc(sizeof(spinlock_t) *
317 			(1 << size_order), GFP_KERNEL);
318 	if (!newtbl->hashwlock) {
319 		kfree(newtbl->hash_buckets);
320 		kfree(newtbl);
321 		return NULL;
322 	}
323 
324 	newtbl->size_order = size_order;
325 	newtbl->hash_mask = (1 << size_order) - 1;
326 	atomic_set(&newtbl->entries,  0);
327 	get_random_bytes(&newtbl->hash_rnd,
328 			sizeof(newtbl->hash_rnd));
329 	for (i = 0; i <= newtbl->hash_mask; i++)
330 		spin_lock_init(&newtbl->hashwlock[i]);
331 
332 	return newtbl;
333 }
334 
335 
336 static void ieee80211_mesh_path_timer(unsigned long data)
337 {
338 	struct ieee80211_sub_if_data *sdata =
339 		(struct ieee80211_sub_if_data *) data;
340 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
341 	struct ieee80211_local *local = sdata->local;
342 
343 	if (local->quiescing) {
344 		set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
345 		return;
346 	}
347 
348 	ieee80211_queue_work(&local->hw, &ifmsh->work);
349 }
350 
351 static void ieee80211_mesh_path_root_timer(unsigned long data)
352 {
353 	struct ieee80211_sub_if_data *sdata =
354 		(struct ieee80211_sub_if_data *) data;
355 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
356 	struct ieee80211_local *local = sdata->local;
357 
358 	set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
359 
360 	if (local->quiescing) {
361 		set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
362 		return;
363 	}
364 
365 	ieee80211_queue_work(&local->hw, &ifmsh->work);
366 }
367 
368 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
369 {
370 	if (ifmsh->mshcfg.dot11MeshHWMPRootMode)
371 		set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
372 	else {
373 		clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
374 		/* stop running timer */
375 		del_timer_sync(&ifmsh->mesh_path_root_timer);
376 	}
377 }
378 
379 /**
380  * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
381  * @hdr:    	802.11 frame header
382  * @fc:		frame control field
383  * @meshda:	destination address in the mesh
384  * @meshsa:	source address address in the mesh.  Same as TA, as frame is
385  *              locally originated.
386  *
387  * Return the length of the 802.11 (does not include a mesh control header)
388  */
389 int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
390 				  const u8 *meshda, const u8 *meshsa)
391 {
392 	if (is_multicast_ether_addr(meshda)) {
393 		*fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
394 		/* DA TA SA */
395 		memcpy(hdr->addr1, meshda, ETH_ALEN);
396 		memcpy(hdr->addr2, meshsa, ETH_ALEN);
397 		memcpy(hdr->addr3, meshsa, ETH_ALEN);
398 		return 24;
399 	} else {
400 		*fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
401 				IEEE80211_FCTL_TODS);
402 		/* RA TA DA SA */
403 		memset(hdr->addr1, 0, ETH_ALEN);   /* RA is resolved later */
404 		memcpy(hdr->addr2, meshsa, ETH_ALEN);
405 		memcpy(hdr->addr3, meshda, ETH_ALEN);
406 		memcpy(hdr->addr4, meshsa, ETH_ALEN);
407 		return 30;
408 	}
409 }
410 
411 /**
412  * ieee80211_new_mesh_header - create a new mesh header
413  * @meshhdr:    uninitialized mesh header
414  * @sdata:	mesh interface to be used
415  * @addr4:	addr4 of the mesh frame (1st in ae header)
416  *              may be NULL
417  * @addr5:	addr5 of the mesh frame (1st or 2nd in ae header)
418  *              may be NULL unless addr6 is present
419  * @addr6:	addr6 of the mesh frame (2nd or 3rd in ae header)
420  * 		may be NULL unless addr5 is present
421  *
422  * Return the header length.
423  */
424 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
425 		struct ieee80211_sub_if_data *sdata, char *addr4,
426 		char *addr5, char *addr6)
427 {
428 	int aelen = 0;
429 	memset(meshhdr, 0, sizeof(*meshhdr));
430 	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
431 	put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
432 	sdata->u.mesh.mesh_seqnum++;
433 	if (addr4) {
434 		meshhdr->flags |= MESH_FLAGS_AE_A4;
435 		aelen += ETH_ALEN;
436 		memcpy(meshhdr->eaddr1, addr4, ETH_ALEN);
437 	}
438 	if (addr5 && addr6) {
439 		meshhdr->flags |= MESH_FLAGS_AE_A5_A6;
440 		aelen += 2 * ETH_ALEN;
441 		if (!addr4) {
442 			memcpy(meshhdr->eaddr1, addr5, ETH_ALEN);
443 			memcpy(meshhdr->eaddr2, addr6, ETH_ALEN);
444 		} else {
445 			memcpy(meshhdr->eaddr2, addr5, ETH_ALEN);
446 			memcpy(meshhdr->eaddr3, addr6, ETH_ALEN);
447 		}
448 	}
449 	return 6 + aelen;
450 }
451 
452 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
453 			   struct ieee80211_if_mesh *ifmsh)
454 {
455 	bool free_plinks;
456 
457 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
458 	printk(KERN_DEBUG "%s: running mesh housekeeping\n",
459 	       sdata->name);
460 #endif
461 
462 	ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
463 	mesh_path_expire(sdata);
464 
465 	free_plinks = mesh_plink_availables(sdata);
466 	if (free_plinks != sdata->u.mesh.accepting_plinks)
467 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
468 
469 	mod_timer(&ifmsh->housekeeping_timer,
470 		  round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
471 }
472 
473 static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
474 {
475 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
476 
477 	mesh_path_tx_root_frame(sdata);
478 	mod_timer(&ifmsh->mesh_path_root_timer,
479 		  round_jiffies(jiffies + IEEE80211_MESH_RANN_INTERVAL));
480 }
481 
482 #ifdef CONFIG_PM
483 void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
484 {
485 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
486 
487 	/* might restart the timer but that doesn't matter */
488 	cancel_work_sync(&ifmsh->work);
489 
490 	/* use atomic bitops in case both timers fire at the same time */
491 
492 	if (del_timer_sync(&ifmsh->housekeeping_timer))
493 		set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
494 	if (del_timer_sync(&ifmsh->mesh_path_timer))
495 		set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
496 	if (del_timer_sync(&ifmsh->mesh_path_root_timer))
497 		set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
498 }
499 
500 void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
501 {
502 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
503 
504 	if (test_and_clear_bit(TMR_RUNNING_HK, &ifmsh->timers_running))
505 		add_timer(&ifmsh->housekeeping_timer);
506 	if (test_and_clear_bit(TMR_RUNNING_MP, &ifmsh->timers_running))
507 		add_timer(&ifmsh->mesh_path_timer);
508 	if (test_and_clear_bit(TMR_RUNNING_MPR, &ifmsh->timers_running))
509 		add_timer(&ifmsh->mesh_path_root_timer);
510 	ieee80211_mesh_root_setup(ifmsh);
511 }
512 #endif
513 
514 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
515 {
516 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
517 	struct ieee80211_local *local = sdata->local;
518 
519 	set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
520 	ieee80211_mesh_root_setup(ifmsh);
521 	ieee80211_queue_work(&local->hw, &ifmsh->work);
522 	sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
523 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
524 						BSS_CHANGED_BEACON_ENABLED |
525 						BSS_CHANGED_BEACON_INT);
526 }
527 
528 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
529 {
530 	del_timer_sync(&sdata->u.mesh.housekeeping_timer);
531 	del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
532 	/*
533 	 * If the timer fired while we waited for it, it will have
534 	 * requeued the work. Now the work will be running again
535 	 * but will not rearm the timer again because it checks
536 	 * whether the interface is running, which, at this point,
537 	 * it no longer is.
538 	 */
539 	cancel_work_sync(&sdata->u.mesh.work);
540 
541 	/*
542 	 * When we get here, the interface is marked down.
543 	 * Call synchronize_rcu() to wait for the RX path
544 	 * should it be using the interface and enqueuing
545 	 * frames at this very time on another CPU.
546 	 */
547 	rcu_barrier(); /* Wait for RX path and call_rcu()'s */
548 	skb_queue_purge(&sdata->u.mesh.skb_queue);
549 }
550 
551 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
552 					u16 stype,
553 					struct ieee80211_mgmt *mgmt,
554 					size_t len,
555 					struct ieee80211_rx_status *rx_status)
556 {
557 	struct ieee80211_local *local = sdata->local;
558 	struct ieee802_11_elems elems;
559 	struct ieee80211_channel *channel;
560 	u32 supp_rates = 0;
561 	size_t baselen;
562 	int freq;
563 	enum ieee80211_band band = rx_status->band;
564 
565 	/* ignore ProbeResp to foreign address */
566 	if (stype == IEEE80211_STYPE_PROBE_RESP &&
567 	    compare_ether_addr(mgmt->da, sdata->vif.addr))
568 		return;
569 
570 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
571 	if (baselen > len)
572 		return;
573 
574 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
575 			       &elems);
576 
577 	if (elems.ds_params && elems.ds_params_len == 1)
578 		freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
579 	else
580 		freq = rx_status->freq;
581 
582 	channel = ieee80211_get_channel(local->hw.wiphy, freq);
583 
584 	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
585 		return;
586 
587 	if (elems.mesh_id && elems.mesh_config &&
588 	    mesh_matches_local(&elems, sdata)) {
589 		supp_rates = ieee80211_sta_get_rates(local, &elems, band);
590 
591 		mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
592 				      mesh_peer_accepts_plinks(&elems));
593 	}
594 }
595 
596 static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
597 					  struct ieee80211_mgmt *mgmt,
598 					  size_t len,
599 					  struct ieee80211_rx_status *rx_status)
600 {
601 	switch (mgmt->u.action.category) {
602 	case WLAN_CATEGORY_MESH_PLINK:
603 		mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
604 		break;
605 	case WLAN_CATEGORY_MESH_PATH_SEL:
606 		mesh_rx_path_sel_frame(sdata, mgmt, len);
607 		break;
608 	}
609 }
610 
611 static void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
612 					  struct sk_buff *skb)
613 {
614 	struct ieee80211_rx_status *rx_status;
615 	struct ieee80211_if_mesh *ifmsh;
616 	struct ieee80211_mgmt *mgmt;
617 	u16 stype;
618 
619 	ifmsh = &sdata->u.mesh;
620 
621 	rx_status = IEEE80211_SKB_RXCB(skb);
622 	mgmt = (struct ieee80211_mgmt *) skb->data;
623 	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
624 
625 	switch (stype) {
626 	case IEEE80211_STYPE_PROBE_RESP:
627 	case IEEE80211_STYPE_BEACON:
628 		ieee80211_mesh_rx_bcn_presp(sdata, stype, mgmt, skb->len,
629 					    rx_status);
630 		break;
631 	case IEEE80211_STYPE_ACTION:
632 		ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
633 		break;
634 	}
635 
636 	kfree_skb(skb);
637 }
638 
639 static void ieee80211_mesh_work(struct work_struct *work)
640 {
641 	struct ieee80211_sub_if_data *sdata =
642 		container_of(work, struct ieee80211_sub_if_data, u.mesh.work);
643 	struct ieee80211_local *local = sdata->local;
644 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
645 	struct sk_buff *skb;
646 
647 	if (!ieee80211_sdata_running(sdata))
648 		return;
649 
650 	if (local->scanning)
651 		return;
652 
653 	while ((skb = skb_dequeue(&ifmsh->skb_queue)))
654 		ieee80211_mesh_rx_queued_mgmt(sdata, skb);
655 
656 	if (ifmsh->preq_queue_len &&
657 	    time_after(jiffies,
658 		       ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
659 		mesh_path_start_discovery(sdata);
660 
661 	if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
662 		mesh_mpath_table_grow();
663 
664 	if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
665 		mesh_mpp_table_grow();
666 
667 	if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
668 		ieee80211_mesh_housekeeping(sdata, ifmsh);
669 
670 	if (test_and_clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags))
671 		ieee80211_mesh_rootpath(sdata);
672 }
673 
674 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
675 {
676 	struct ieee80211_sub_if_data *sdata;
677 
678 	rcu_read_lock();
679 	list_for_each_entry_rcu(sdata, &local->interfaces, list)
680 		if (ieee80211_vif_is_mesh(&sdata->vif))
681 			ieee80211_queue_work(&local->hw, &sdata->u.mesh.work);
682 	rcu_read_unlock();
683 }
684 
685 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
686 {
687 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
688 
689 	INIT_WORK(&ifmsh->work, ieee80211_mesh_work);
690 	setup_timer(&ifmsh->housekeeping_timer,
691 		    ieee80211_mesh_housekeeping_timer,
692 		    (unsigned long) sdata);
693 	skb_queue_head_init(&sdata->u.mesh.skb_queue);
694 
695 	ifmsh->mshcfg.dot11MeshRetryTimeout = MESH_RET_T;
696 	ifmsh->mshcfg.dot11MeshConfirmTimeout = MESH_CONF_T;
697 	ifmsh->mshcfg.dot11MeshHoldingTimeout = MESH_HOLD_T;
698 	ifmsh->mshcfg.dot11MeshMaxRetries = MESH_MAX_RETR;
699 	ifmsh->mshcfg.dot11MeshTTL = MESH_TTL;
700 	ifmsh->mshcfg.auto_open_plinks = true;
701 	ifmsh->mshcfg.dot11MeshMaxPeerLinks =
702 		MESH_MAX_ESTAB_PLINKS;
703 	ifmsh->mshcfg.dot11MeshHWMPactivePathTimeout =
704 		MESH_PATH_TIMEOUT;
705 	ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval =
706 		MESH_PREQ_MIN_INT;
707 	ifmsh->mshcfg.dot11MeshHWMPnetDiameterTraversalTime =
708 		MESH_DIAM_TRAVERSAL_TIME;
709 	ifmsh->mshcfg.dot11MeshHWMPmaxPREQretries =
710 		MESH_MAX_PREQ_RETRIES;
711 	ifmsh->mshcfg.path_refresh_time =
712 		MESH_PATH_REFRESH_TIME;
713 	ifmsh->mshcfg.min_discovery_timeout =
714 		MESH_MIN_DISCOVERY_TIMEOUT;
715 	ifmsh->accepting_plinks = true;
716 	ifmsh->preq_id = 0;
717 	ifmsh->sn = 0;
718 	atomic_set(&ifmsh->mpaths, 0);
719 	mesh_rmc_init(sdata);
720 	ifmsh->last_preq = jiffies;
721 	/* Allocate all mesh structures when creating the first mesh interface. */
722 	if (!mesh_allocated)
723 		ieee80211s_init();
724 	mesh_ids_set_default(ifmsh);
725 	setup_timer(&ifmsh->mesh_path_timer,
726 		    ieee80211_mesh_path_timer,
727 		    (unsigned long) sdata);
728 	setup_timer(&ifmsh->mesh_path_root_timer,
729 		    ieee80211_mesh_path_root_timer,
730 		    (unsigned long) sdata);
731 	INIT_LIST_HEAD(&ifmsh->preq_queue.list);
732 	spin_lock_init(&ifmsh->mesh_preq_queue_lock);
733 }
734 
735 ieee80211_rx_result
736 ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
737 {
738 	struct ieee80211_local *local = sdata->local;
739 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
740 	struct ieee80211_mgmt *mgmt;
741 	u16 fc;
742 
743 	if (skb->len < 24)
744 		return RX_DROP_MONITOR;
745 
746 	mgmt = (struct ieee80211_mgmt *) skb->data;
747 	fc = le16_to_cpu(mgmt->frame_control);
748 
749 	switch (fc & IEEE80211_FCTL_STYPE) {
750 	case IEEE80211_STYPE_ACTION:
751 	case IEEE80211_STYPE_PROBE_RESP:
752 	case IEEE80211_STYPE_BEACON:
753 		skb_queue_tail(&ifmsh->skb_queue, skb);
754 		ieee80211_queue_work(&local->hw, &ifmsh->work);
755 		return RX_QUEUED;
756 	}
757 
758 	return RX_CONTINUE;
759 }
760