mesh_plink.c 25.4 KB
Newer Older
1
/*
R
Rui Paulo 已提交
2
 * Copyright (c) 2008, 2009 open80211s Ltd.
3 4 5 6 7 8
 * Author:     Luis Carlos Cobo <luisca@cozybit.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
9
#include <linux/gfp.h>
J
Johannes Berg 已提交
10 11
#include <linux/kernel.h>
#include <linux/random.h>
12
#include "ieee80211_i.h"
J
Johannes Berg 已提交
13
#include "rate.h"
14 15 16
#include "mesh.h"

#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
17
#define mpl_dbg(fmt, args...)	pr_debug(fmt, ##args)
18 19 20 21
#else
#define mpl_dbg(fmt, args...)	do { (void)(0); } while (0)
#endif

22 23
#define PLINK_GET_LLID(p) (p + 2)
#define PLINK_GET_PLID(p) (p + 4)
24 25 26 27

#define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
				jiffies + HZ * t / 1000))

28 29 30 31 32
#define dot11MeshMaxRetries(s) (s->u.mesh.mshcfg.dot11MeshMaxRetries)
#define dot11MeshRetryTimeout(s) (s->u.mesh.mshcfg.dot11MeshRetryTimeout)
#define dot11MeshConfirmTimeout(s) (s->u.mesh.mshcfg.dot11MeshConfirmTimeout)
#define dot11MeshHoldingTimeout(s) (s->u.mesh.mshcfg.dot11MeshHoldingTimeout)
#define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
33

34 35
/* We only need a valid sta if user configured a minimum rssi_threshold. */
#define rssi_threshold_check(sta, sdata) \
36
		(sdata->u.mesh.mshcfg.rssi_threshold == 0 ||\
37 38
		(sta && (s8) -ewma_read(&sta->avg_signal) > \
		sdata->u.mesh.mshcfg.rssi_threshold))
39

40 41 42 43 44 45 46 47 48 49 50 51
enum plink_event {
	PLINK_UNDEFINED,
	OPN_ACPT,
	OPN_RJCT,
	OPN_IGNR,
	CNF_ACPT,
	CNF_RJCT,
	CNF_IGNR,
	CLS_ACPT,
	CLS_IGNR
};

52 53 54 55
static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
		enum ieee80211_self_protected_actioncode action,
		u8 *da, __le16 llid, __le16 plid, __le16 reason);

56 57 58
static inline
void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
{
59
	atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
60
	mesh_accept_plinks_update(sdata);
61 62 63 64 65
}

static inline
void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
{
66
	atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
67
	mesh_accept_plinks_update(sdata);
68 69 70 71 72
}

/**
 * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
 *
R
Rui Paulo 已提交
73
 * @sta: mesh peer link to restart
74
 *
75
 * Locking: this function must be called holding sta->lock
76 77 78
 */
static inline void mesh_plink_fsm_restart(struct sta_info *sta)
{
79
	sta->plink_state = NL80211_PLINK_LISTEN;
80 81
	sta->llid = sta->plid = sta->reason = 0;
	sta->plink_retries = 0;
82 83
}

84
/*
85
 * Allocate mesh sta entry and insert into station table
86
 */
87
static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
88
					 u8 *hw_addr)
89 90 91
{
	struct sta_info *sta;

92
	if (sdata->local->num_sta >= MESH_MAX_PLINKS)
J
Johannes Berg 已提交
93
		return NULL;
94

95
	sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
J
Johannes Berg 已提交
96 97
	if (!sta)
		return NULL;
98

99 100 101
	sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
	sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
	sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
102

J
Johannes Berg 已提交
103
	set_sta_flag(sta, WLAN_STA_WME);
104

105 106 107
	return sta;
}

108 109
/*
 * mesh_set_ht_prot_mode - set correct HT protection mode
110
 *
111 112 113 114 115 116
 * Section 9.23.3.5 of IEEE 80211-2012 describes the protection rules for HT
 * mesh STA in a MBSS. Three HT protection modes are supported for now, non-HT
 * mixed mode, 20MHz-protection and no-protection mode. non-HT mixed mode is
 * selected if any non-HT peers are present in our MBSS.  20MHz-protection mode
 * is selected if all peers in our 20/40MHz MBSS support HT and atleast one
 * HT20 peer is present. Otherwise no-protection mode is selected.
117 118 119 120 121 122 123 124 125 126 127 128 129 130
 */
static u32 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct sta_info *sta;
	u32 changed = 0;
	u16 ht_opmode;
	bool non_ht_sta = false, ht20_sta = false;

	if (local->_oper_channel_type == NL80211_CHAN_NO_HT)
		return 0;

	rcu_read_lock();
	list_for_each_entry_rcu(sta, &local->sta_list, list) {
131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146
		if (sdata != sta->sdata ||
		    sta->plink_state != NL80211_PLINK_ESTAB)
			continue;

		switch (sta->ch_type) {
		case NL80211_CHAN_NO_HT:
			mpl_dbg("mesh_plink %pM: nonHT sta (%pM) is present",
				sdata->vif.addr, sta->sta.addr);
			non_ht_sta = true;
			goto out;
		case NL80211_CHAN_HT20:
			mpl_dbg("mesh_plink %pM: HT20 sta (%pM) is present",
				sdata->vif.addr, sta->sta.addr);
			ht20_sta = true;
		default:
			break;
147 148 149 150 151 152 153 154 155 156 157 158 159 160
		}
	}
out:
	rcu_read_unlock();

	if (non_ht_sta)
		ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED;
	else if (ht20_sta && local->_oper_channel_type > NL80211_CHAN_HT20)
		ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_20MHZ;
	else
		ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;

	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
161
		sdata->u.mesh.mshcfg.ht_opmode = ht_opmode;
162 163 164 165 166 167 168 169
		changed = BSS_CHANGED_HT;
		mpl_dbg("mesh_plink %pM: protection mode changed to %d",
			sdata->vif.addr, ht_opmode);
	}

	return changed;
}

170
/**
171
 * __mesh_plink_deactivate - deactivate mesh peer link
172 173 174 175 176
 *
 * @sta: mesh peer link to deactivate
 *
 * All mesh paths with this peer as next hop will be flushed
 *
177
 * Locking: the caller must hold sta->lock
178
 */
179
static bool __mesh_plink_deactivate(struct sta_info *sta)
180
{
181
	struct ieee80211_sub_if_data *sdata = sta->sdata;
182
	bool deactivated = false;
183

184
	if (sta->plink_state == NL80211_PLINK_ESTAB) {
185
		mesh_plink_dec_estab_count(sdata);
186 187
		deactivated = true;
	}
188
	sta->plink_state = NL80211_PLINK_BLOCKED;
189
	mesh_path_flush_by_nexthop(sta);
190 191

	return deactivated;
192 193
}

J
Johannes Berg 已提交
194
/**
195
 * mesh_plink_deactivate - deactivate mesh peer link
J
Johannes Berg 已提交
196 197 198 199 200 201 202
 *
 * @sta: mesh peer link to deactivate
 *
 * All mesh paths with this peer as next hop will be flushed
 */
void mesh_plink_deactivate(struct sta_info *sta)
{
203 204 205
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	bool deactivated;

206
	spin_lock_bh(&sta->lock);
207
	deactivated = __mesh_plink_deactivate(sta);
208 209 210 211
	sta->reason = cpu_to_le16(WLAN_REASON_MESH_PEER_CANCELED);
	mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
			    sta->sta.addr, sta->llid, sta->plid,
			    sta->reason);
212
	spin_unlock_bh(&sta->lock);
213 214 215

	if (deactivated)
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
J
Johannes Berg 已提交
216 217
}

218
static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
219 220
		enum ieee80211_self_protected_actioncode action,
		u8 *da, __le16 llid, __le16 plid, __le16 reason) {
221
	struct ieee80211_local *local = sdata->local;
222
	struct sk_buff *skb;
223 224
	struct ieee80211_mgmt *mgmt;
	bool include_plid = false;
225
	u16 peering_proto = 0;
226 227 228 229
	u8 *pos, ie_len = 4;
	int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
		      sizeof(mgmt->u.action.u.self_prot);

230
	skb = dev_alloc_skb(local->tx_headroom +
231 232 233 234 235 236 237
			    hdr_len +
			    2 + /* capability info */
			    2 + /* AID */
			    2 + 8 + /* supported rates */
			    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
			    2 + sdata->u.mesh.mesh_id_len +
			    2 + sizeof(struct ieee80211_meshconf_ie) +
238
			    2 + sizeof(struct ieee80211_ht_cap) +
239
			    2 + sizeof(struct ieee80211_ht_operation) +
240 241
			    2 + 8 + /* peering IE */
			    sdata->u.mesh.ie_len);
242 243
	if (!skb)
		return -1;
244
	skb_reserve(skb, local->tx_headroom);
245 246
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
	memset(mgmt, 0, hdr_len);
247 248
	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
249
	memcpy(mgmt->da, da, ETH_ALEN);
250
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
251
	memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
252 253
	mgmt->u.action.category = WLAN_CATEGORY_SELF_PROTECTED;
	mgmt->u.action.u.self_prot.action_code = action;
254

255 256 257 258
	if (action != WLAN_SP_MESH_PEERING_CLOSE) {
		/* capability info */
		pos = skb_put(skb, 2);
		memset(pos, 0, 2);
259
		if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
260 261
			/* AID */
			pos = skb_put(skb, 2);
262
			memcpy(pos + 2, &plid, 2);
263
		}
264 265
		if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
		    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
266 267 268 269
		    mesh_add_rsn_ie(skb, sdata) ||
		    mesh_add_meshid_ie(skb, sdata) ||
		    mesh_add_meshconf_ie(skb, sdata))
			return -1;
270 271 272
	} else {	/* WLAN_SP_MESH_PEERING_CLOSE */
		if (mesh_add_meshid_ie(skb, sdata))
			return -1;
273 274
	}

275
	/* Add Mesh Peering Management element */
276
	switch (action) {
277
	case WLAN_SP_MESH_PEERING_OPEN:
278
		break;
279
	case WLAN_SP_MESH_PEERING_CONFIRM:
280
		ie_len += 2;
281 282
		include_plid = true;
		break;
283
	case WLAN_SP_MESH_PEERING_CLOSE:
284 285
		if (plid) {
			ie_len += 2;
286 287
			include_plid = true;
		}
288
		ie_len += 2;	/* reason code */
289
		break;
290 291
	default:
		return -EINVAL;
292 293
	}

294 295 296
	if (WARN_ON(skb_tailroom(skb) < 2 + ie_len))
		return -ENOMEM;

297
	pos = skb_put(skb, 2 + ie_len);
298
	*pos++ = WLAN_EID_PEER_MGMT;
299
	*pos++ = ie_len;
300 301
	memcpy(pos, &peering_proto, 2);
	pos += 2;
302
	memcpy(pos, &llid, 2);
303
	pos += 2;
304 305
	if (include_plid) {
		memcpy(pos, &plid, 2);
306
		pos += 2;
307
	}
308
	if (action == WLAN_SP_MESH_PEERING_CLOSE) {
309
		memcpy(pos, &reason, 2);
310
		pos += 2;
311
	}
312 313 314

	if (action != WLAN_SP_MESH_PEERING_CLOSE) {
		if (mesh_add_ht_cap_ie(skb, sdata) ||
315
		    mesh_add_ht_oper_ie(skb, sdata))
316 317 318
			return -1;
	}

319 320
	if (mesh_add_vendor_ies(skb, sdata))
		return -1;
321

322
	ieee80211_tx_skb(sdata, skb);
323 324 325
	return 0;
}

326 327 328 329 330 331 332 333 334
/* mesh_peer_init - initialize new mesh peer and return resulting sta_info
 *
 * @sdata: local meshif
 * @addr: peer's address
 * @elems: IEs from beacon or mesh peering frame
 *
 * call under RCU
 */
static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
335
				       u8 *addr,
336
				       struct ieee802_11_elems *elems)
337
{
338
	struct ieee80211_local *local = sdata->local;
339
	enum ieee80211_band band = local->oper_channel->band;
340
	struct ieee80211_supported_band *sband;
341
	u32 rates, basic_rates = 0;
342
	struct sta_info *sta;
343
	bool insert = false;
344

345 346
	sband = local->hw.wiphy->bands[band];
	rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
347

348
	sta = sta_info_get(sdata, addr);
349
	if (!sta) {
350 351 352 353 354 355 356 357 358
		/* Userspace handles peer allocation when security is enabled */
		if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
			cfg80211_notify_new_peer_candidate(sdata->dev, addr,
							   elems->ie_start,
							   elems->total_len,
							   GFP_ATOMIC);
			return NULL;
		}

359
		sta = mesh_plink_alloc(sdata, addr);
360
		if (!sta)
361
			return NULL;
362
		insert = true;
363 364
	}

365
	spin_lock_bh(&sta->lock);
366
	sta->last_rx = jiffies;
367
	sta->sta.supp_rates[band] = rates;
368 369
	if (elems->ht_cap_elem &&
	    sdata->local->_oper_channel_type != NL80211_CHAN_NO_HT)
370 371 372 373 374 375
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
						  elems->ht_cap_elem,
						  &sta->sta.ht_cap);
	else
		memset(&sta->sta.ht_cap, 0, sizeof(sta->sta.ht_cap));

376
	if (elems->ht_operation) {
377 378 379 380
		if (!(elems->ht_operation->ht_param &
		      IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
			sta->sta.ht_cap.cap &=
					    ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
381 382 383
		sta->ch_type =
			ieee80211_ht_oper_to_channel_type(elems->ht_operation);
	}
384

385 386 387
	rate_control_rate_init(sta);
	spin_unlock_bh(&sta->lock);

388 389 390
	if (insert && sta_info_insert(sta))
		return NULL;

391 392 393
	return sta;
}

394 395
void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
			   u8 *hw_addr,
396 397 398 399 400
			   struct ieee802_11_elems *elems)
{
	struct sta_info *sta;

	rcu_read_lock();
401
	sta = mesh_peer_init(sdata, hw_addr, elems);
402 403 404
	if (!sta)
		goto out;

405
	if (mesh_peer_accepts_plinks(elems) &&
406 407 408 409
	    sta->plink_state == NL80211_PLINK_LISTEN &&
	    sdata->u.mesh.accepting_plinks &&
	    sdata->u.mesh.mshcfg.auto_open_plinks &&
	    rssi_threshold_check(sta, sdata))
410 411
		mesh_plink_open(sta);

412
out:
413
	rcu_read_unlock();
414 415 416 417 418 419 420 421
}

static void mesh_plink_timer(unsigned long data)
{
	struct sta_info *sta;
	__le16 llid, plid, reason;
	struct ieee80211_sub_if_data *sdata;

422 423 424 425 426
	/*
	 * This STA is valid because sta_info_destroy() will
	 * del_timer_sync() this timer after having made sure
	 * it cannot be readded (by deleting the plink.)
	 */
427 428
	sta = (struct sta_info *) data;

429 430 431 432 433
	if (sta->sdata->local->quiescing) {
		sta->plink_timer_was_running = true;
		return;
	}

434
	spin_lock_bh(&sta->lock);
435 436
	if (sta->ignore_plink_timer) {
		sta->ignore_plink_timer = false;
437
		spin_unlock_bh(&sta->lock);
438 439
		return;
	}
440 441
	mpl_dbg("Mesh plink timer for %pM fired on state %d\n",
		sta->sta.addr, sta->plink_state);
442 443 444
	reason = 0;
	llid = sta->llid;
	plid = sta->plid;
445
	sdata = sta->sdata;
446 447

	switch (sta->plink_state) {
448 449
	case NL80211_PLINK_OPN_RCVD:
	case NL80211_PLINK_OPN_SNT:
450 451 452
		/* retry timer */
		if (sta->plink_retries < dot11MeshMaxRetries(sdata)) {
			u32 rand;
453 454 455
			mpl_dbg("Mesh plink for %pM (retry, timeout): %d %d\n",
				sta->sta.addr, sta->plink_retries,
				sta->plink_timeout);
456 457 458 459
			get_random_bytes(&rand, sizeof(u32));
			sta->plink_timeout = sta->plink_timeout +
					     rand % sta->plink_timeout;
			++sta->plink_retries;
460
			mod_plink_timer(sta, sta->plink_timeout);
461
			spin_unlock_bh(&sta->lock);
462 463
			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
					    sta->sta.addr, llid, 0, 0);
464 465
			break;
		}
466
		reason = cpu_to_le16(WLAN_REASON_MESH_MAX_RETRIES);
467
		/* fall through on else */
468
	case NL80211_PLINK_CNF_RCVD:
469 470
		/* confirm timer */
		if (!reason)
471
			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIRM_TIMEOUT);
472
		sta->plink_state = NL80211_PLINK_HOLDING;
473
		mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
474
		spin_unlock_bh(&sta->lock);
475 476
		mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
				    sta->sta.addr, llid, plid, reason);
477
		break;
478
	case NL80211_PLINK_HOLDING:
479
		/* holding timer */
480
		del_timer(&sta->plink_timer);
481
		mesh_plink_fsm_restart(sta);
482
		spin_unlock_bh(&sta->lock);
483 484
		break;
	default:
485
		spin_unlock_bh(&sta->lock);
486 487 488 489
		break;
	}
}

490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505
#ifdef CONFIG_PM
void mesh_plink_quiesce(struct sta_info *sta)
{
	if (del_timer_sync(&sta->plink_timer))
		sta->plink_timer_was_running = true;
}

void mesh_plink_restart(struct sta_info *sta)
{
	if (sta->plink_timer_was_running) {
		add_timer(&sta->plink_timer);
		sta->plink_timer_was_running = false;
	}
}
#endif

506 507 508 509 510 511 512 513 514 515 516 517
static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
{
	sta->plink_timer.expires = jiffies + (HZ * timeout / 1000);
	sta->plink_timer.data = (unsigned long) sta;
	sta->plink_timer.function = mesh_plink_timer;
	sta->plink_timeout = timeout;
	add_timer(&sta->plink_timer);
}

int mesh_plink_open(struct sta_info *sta)
{
	__le16 llid;
518
	struct ieee80211_sub_if_data *sdata = sta->sdata;
519

J
Johannes Berg 已提交
520
	if (!test_sta_flag(sta, WLAN_STA_AUTH))
521 522
		return -EPERM;

523
	spin_lock_bh(&sta->lock);
524 525
	get_random_bytes(&llid, 2);
	sta->llid = llid;
526
	if (sta->plink_state != NL80211_PLINK_LISTEN) {
527
		spin_unlock_bh(&sta->lock);
528 529
		return -EBUSY;
	}
530
	sta->plink_state = NL80211_PLINK_OPN_SNT;
531
	mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
532
	spin_unlock_bh(&sta->lock);
533 534
	mpl_dbg("Mesh plink: starting establishment with %pM\n",
		sta->sta.addr);
535

536
	return mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
537
				   sta->sta.addr, llid, 0, 0);
538 539 540 541
}

void mesh_plink_block(struct sta_info *sta)
{
542 543 544
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	bool deactivated;

545
	spin_lock_bh(&sta->lock);
546
	deactivated = __mesh_plink_deactivate(sta);
547
	sta->plink_state = NL80211_PLINK_BLOCKED;
548
	spin_unlock_bh(&sta->lock);
549 550 551

	if (deactivated)
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
552 553 554
}


555
void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
556 557 558 559 560
			 size_t len, struct ieee80211_rx_status *rx_status)
{
	struct ieee802_11_elems elems;
	struct sta_info *sta;
	enum plink_event event;
561
	enum ieee80211_self_protected_actioncode ftype;
562
	size_t baselen;
563
	bool matches_local = true;
564 565
	u8 ie_len;
	u8 *baseaddr;
566
	u32 changed = 0;
567
	__le16 plid, llid, reason;
568 569
#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
	static const char *mplstates[] = {
570 571 572 573 574 575 576
		[NL80211_PLINK_LISTEN] = "LISTEN",
		[NL80211_PLINK_OPN_SNT] = "OPN-SNT",
		[NL80211_PLINK_OPN_RCVD] = "OPN-RCVD",
		[NL80211_PLINK_CNF_RCVD] = "CNF_RCVD",
		[NL80211_PLINK_ESTAB] = "ESTAB",
		[NL80211_PLINK_HOLDING] = "HOLDING",
		[NL80211_PLINK_BLOCKED] = "BLOCKED"
577 578
	};
#endif
579

580 581 582 583
	/* need action_code, aux */
	if (len < IEEE80211_MIN_ACTION_SIZE + 3)
		return;

584 585 586 587 588
	if (is_multicast_ether_addr(mgmt->da)) {
		mpl_dbg("Mesh plink: ignore frame from multicast address");
		return;
	}

589 590 591
	baseaddr = mgmt->u.action.u.self_prot.variable;
	baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
	if (mgmt->u.action.u.self_prot.action_code ==
592
						WLAN_SP_MESH_PEERING_CONFIRM) {
593
		baseaddr += 4;
594
		baselen += 4;
595 596
	}
	ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
597
	if (!elems.peering) {
598 599 600
		mpl_dbg("Mesh plink: missing necessary peer link ie\n");
		return;
	}
601 602
	if (elems.rsn_len &&
			sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
603 604 605
		mpl_dbg("Mesh plink: can't establish link with secure peer\n");
		return;
	}
606

607 608 609 610 611 612
	ftype = mgmt->u.action.u.self_prot.action_code;
	ie_len = elems.peering_len;
	if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
	    (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
	    (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
							&& ie_len != 8)) {
613 614
		mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
		    ftype, ie_len);
615 616 617
		return;
	}

618 619
	if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
				(!elems.mesh_id || !elems.mesh_config)) {
620 621 622 623 624 625
		mpl_dbg("Mesh plink: missing necessary ie\n");
		return;
	}
	/* Note the lines below are correct, the llid in the frame is the plid
	 * from the point of view of this host.
	 */
626
	memcpy(&plid, PLINK_GET_LLID(elems.peering), 2);
627
	if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
628 629
	    (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
		memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
630

631 632
	rcu_read_lock();

633
	sta = sta_info_get(sdata, mgmt->sa);
634
	if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) {
635
		mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
636
		rcu_read_unlock();
637 638 639
		return;
	}

640
	if (ftype == WLAN_SP_MESH_PEERING_OPEN &&
641
	    !rssi_threshold_check(sta, sdata)) {
642
		mpl_dbg("Mesh plink: %pM does not meet rssi threshold\n",
643
			mgmt->sa);
644 645 646 647
		rcu_read_unlock();
		return;
	}

J
Johannes Berg 已提交
648
	if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) {
649 650 651 652 653
		mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
		rcu_read_unlock();
		return;
	}

654
	if (sta && sta->plink_state == NL80211_PLINK_BLOCKED) {
655
		rcu_read_unlock();
656 657 658 659 660
		return;
	}

	/* Now we will figure out the appropriate event... */
	event = PLINK_UNDEFINED;
661
	if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
662
	    !mesh_matches_local(sdata, &elems)) {
663
		matches_local = false;
664
		switch (ftype) {
665
		case WLAN_SP_MESH_PEERING_OPEN:
666 667
			event = OPN_RJCT;
			break;
668
		case WLAN_SP_MESH_PEERING_CONFIRM:
669 670
			event = CNF_RJCT;
			break;
671
		default:
672 673
			break;
		}
674 675 676 677
	}

	if (!sta && !matches_local) {
		rcu_read_unlock();
678
		reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
679
		llid = 0;
680 681
		mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
				    mgmt->sa, llid, plid, reason);
682
		return;
683
	} else if (!sta) {
684
		/* ftype == WLAN_SP_MESH_PEERING_OPEN */
685 686
		if (!mesh_plink_free_count(sdata)) {
			mpl_dbg("Mesh plink error: no more free plinks\n");
J
Johannes Berg 已提交
687 688 689
			rcu_read_unlock();
			return;
		}
690
		event = OPN_ACPT;
691
	} else if (matches_local) {
692
		switch (ftype) {
693
		case WLAN_SP_MESH_PEERING_OPEN:
694
			if (!mesh_plink_free_count(sdata) ||
695
			    (sta->plid && sta->plid != plid))
696 697 698 699
				event = OPN_IGNR;
			else
				event = OPN_ACPT;
			break;
700
		case WLAN_SP_MESH_PEERING_CONFIRM:
701
			if (!mesh_plink_free_count(sdata) ||
702
			    (sta->llid != llid || sta->plid != plid))
703 704 705 706
				event = CNF_IGNR;
			else
				event = CNF_ACPT;
			break;
707
		case WLAN_SP_MESH_PEERING_CLOSE:
708
			if (sta->plink_state == NL80211_PLINK_ESTAB)
709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727
				/* Do not check for llid or plid. This does not
				 * follow the standard but since multiple plinks
				 * per sta are not supported, it is necessary in
				 * order to avoid a livelock when MP A sees an
				 * establish peer link to MP B but MP B does not
				 * see it. This can be caused by a timeout in
				 * B's peer link establishment or B beign
				 * restarted.
				 */
				event = CLS_ACPT;
			else if (sta->plid != plid)
				event = CLS_IGNR;
			else if (ie_len == 7 && sta->llid != llid)
				event = CLS_IGNR;
			else
				event = CLS_ACPT;
			break;
		default:
			mpl_dbg("Mesh plink: unknown frame subtype\n");
728
			rcu_read_unlock();
729 730
			return;
		}
731 732 733 734
	}

	if (event == OPN_ACPT) {
		/* allocate sta entry if necessary and update info */
735
		sta = mesh_peer_init(sdata, mgmt->sa, &elems);
736 737 738 739 740
		if (!sta) {
			mpl_dbg("Mesh plink: failed to init peer!\n");
			rcu_read_unlock();
			return;
		}
741 742
	}

743 744
	mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
		mgmt->sa, mplstates[sta->plink_state],
745 746
		le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
		event);
747
	reason = 0;
748
	spin_lock_bh(&sta->lock);
749 750
	switch (sta->plink_state) {
		/* spin_unlock as soon as state is updated at each case */
751
	case NL80211_PLINK_LISTEN:
752 753 754
		switch (event) {
		case CLS_ACPT:
			mesh_plink_fsm_restart(sta);
755
			spin_unlock_bh(&sta->lock);
756 757
			break;
		case OPN_ACPT:
758
			sta->plink_state = NL80211_PLINK_OPN_RCVD;
759 760 761 762
			sta->plid = plid;
			get_random_bytes(&llid, 2);
			sta->llid = llid;
			mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
763
			spin_unlock_bh(&sta->lock);
764 765 766 767 768 769
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_OPEN,
					    sta->sta.addr, llid, 0, 0);
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_CONFIRM,
					    sta->sta.addr, llid, plid, 0);
770 771
			break;
		default:
772
			spin_unlock_bh(&sta->lock);
773 774 775 776
			break;
		}
		break;

777
	case NL80211_PLINK_OPN_SNT:
778 779 780
		switch (event) {
		case OPN_RJCT:
		case CNF_RJCT:
781
			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
782 783
		case CLS_ACPT:
			if (!reason)
784
				reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
785
			sta->reason = reason;
786
			sta->plink_state = NL80211_PLINK_HOLDING;
787 788 789 790 791
			if (!mod_plink_timer(sta,
					     dot11MeshHoldingTimeout(sdata)))
				sta->ignore_plink_timer = true;

			llid = sta->llid;
792
			spin_unlock_bh(&sta->lock);
793 794 795
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_CLOSE,
					    sta->sta.addr, llid, plid, reason);
796 797 798
			break;
		case OPN_ACPT:
			/* retry timer is left untouched */
799
			sta->plink_state = NL80211_PLINK_OPN_RCVD;
800 801
			sta->plid = plid;
			llid = sta->llid;
802
			spin_unlock_bh(&sta->lock);
803 804 805
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_CONFIRM,
					    sta->sta.addr, llid, plid, 0);
806 807
			break;
		case CNF_ACPT:
808
			sta->plink_state = NL80211_PLINK_CNF_RCVD;
809 810 811 812
			if (!mod_plink_timer(sta,
					     dot11MeshConfirmTimeout(sdata)))
				sta->ignore_plink_timer = true;

813
			spin_unlock_bh(&sta->lock);
814 815
			break;
		default:
816
			spin_unlock_bh(&sta->lock);
817 818 819 820
			break;
		}
		break;

821
	case NL80211_PLINK_OPN_RCVD:
822 823 824
		switch (event) {
		case OPN_RJCT:
		case CNF_RJCT:
825
			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
826 827
		case CLS_ACPT:
			if (!reason)
828
				reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
829
			sta->reason = reason;
830
			sta->plink_state = NL80211_PLINK_HOLDING;
831 832 833 834 835
			if (!mod_plink_timer(sta,
					     dot11MeshHoldingTimeout(sdata)))
				sta->ignore_plink_timer = true;

			llid = sta->llid;
836
			spin_unlock_bh(&sta->lock);
837 838
			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
					    sta->sta.addr, llid, plid, reason);
839 840 841
			break;
		case OPN_ACPT:
			llid = sta->llid;
842
			spin_unlock_bh(&sta->lock);
843 844 845
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_CONFIRM,
					    sta->sta.addr, llid, plid, 0);
846 847
			break;
		case CNF_ACPT:
848
			del_timer(&sta->plink_timer);
849
			sta->plink_state = NL80211_PLINK_ESTAB;
850
			spin_unlock_bh(&sta->lock);
851
			mesh_plink_inc_estab_count(sdata);
852 853
			changed |= mesh_set_ht_prot_mode(sdata);
			changed |= BSS_CHANGED_BEACON;
854 855
			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
				sta->sta.addr);
856 857
			break;
		default:
858
			spin_unlock_bh(&sta->lock);
859 860 861 862
			break;
		}
		break;

863
	case NL80211_PLINK_CNF_RCVD:
864 865 866
		switch (event) {
		case OPN_RJCT:
		case CNF_RJCT:
867
			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
868 869
		case CLS_ACPT:
			if (!reason)
870
				reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
871
			sta->reason = reason;
872
			sta->plink_state = NL80211_PLINK_HOLDING;
873 874 875 876 877
			if (!mod_plink_timer(sta,
					     dot11MeshHoldingTimeout(sdata)))
				sta->ignore_plink_timer = true;

			llid = sta->llid;
878
			spin_unlock_bh(&sta->lock);
879 880 881
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_CLOSE,
					    sta->sta.addr, llid, plid, reason);
882
			break;
883
		case OPN_ACPT:
884
			del_timer(&sta->plink_timer);
885
			sta->plink_state = NL80211_PLINK_ESTAB;
886
			spin_unlock_bh(&sta->lock);
887
			mesh_plink_inc_estab_count(sdata);
888 889
			changed |= mesh_set_ht_prot_mode(sdata);
			changed |= BSS_CHANGED_BEACON;
890 891
			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
				sta->sta.addr);
892 893 894
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_CONFIRM,
					    sta->sta.addr, llid, plid, 0);
895 896
			break;
		default:
897
			spin_unlock_bh(&sta->lock);
898 899 900 901
			break;
		}
		break;

902
	case NL80211_PLINK_ESTAB:
903 904
		switch (event) {
		case CLS_ACPT:
905
			reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
906
			sta->reason = reason;
907
			__mesh_plink_deactivate(sta);
908
			sta->plink_state = NL80211_PLINK_HOLDING;
909
			llid = sta->llid;
910
			mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
911
			spin_unlock_bh(&sta->lock);
912 913
			changed |= mesh_set_ht_prot_mode(sdata);
			changed |= BSS_CHANGED_BEACON;
914 915
			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
					    sta->sta.addr, llid, plid, reason);
916 917 918
			break;
		case OPN_ACPT:
			llid = sta->llid;
919
			spin_unlock_bh(&sta->lock);
920 921 922
			mesh_plink_frame_tx(sdata,
					    WLAN_SP_MESH_PEERING_CONFIRM,
					    sta->sta.addr, llid, plid, 0);
923 924
			break;
		default:
925
			spin_unlock_bh(&sta->lock);
926 927 928
			break;
		}
		break;
929
	case NL80211_PLINK_HOLDING:
930 931
		switch (event) {
		case CLS_ACPT:
932
			if (del_timer(&sta->plink_timer))
933 934
				sta->ignore_plink_timer = 1;
			mesh_plink_fsm_restart(sta);
935
			spin_unlock_bh(&sta->lock);
936 937 938 939 940 941 942
			break;
		case OPN_ACPT:
		case CNF_ACPT:
		case OPN_RJCT:
		case CNF_RJCT:
			llid = sta->llid;
			reason = sta->reason;
943
			spin_unlock_bh(&sta->lock);
944 945
			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
					    sta->sta.addr, llid, plid, reason);
946 947
			break;
		default:
948
			spin_unlock_bh(&sta->lock);
949 950 951
		}
		break;
	default:
952
		/* should not get here, PLINK_BLOCKED is dealt with at the
D
Daniel Mack 已提交
953
		 * beginning of the function
954
		 */
955
		spin_unlock_bh(&sta->lock);
956 957
		break;
	}
958 959

	rcu_read_unlock();
960 961 962

	if (changed)
		ieee80211_bss_info_change_notify(sdata, changed);
963
}