mesh_plink.c revision b973c31a925c6753d84a100673f6b25546ec8b34
1/*
2 * Copyright (c) 2008 open80211s Ltd.
3 * Author:     Luis Carlos Cobo <luisca@cozybit.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9#include <linux/kernel.h>
10#include <linux/random.h>
11#include "ieee80211_i.h"
12#include "rate.h"
13#include "mesh.h"
14
15#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
16#define mpl_dbg(fmt, args...)	printk(KERN_DEBUG fmt, ##args)
17#else
18#define mpl_dbg(fmt, args...)	do { (void)(0); } while (0)
19#endif
20
21#define PLINK_GET_FRAME_SUBTYPE(p) (p)
22#define PLINK_GET_LLID(p) (p + 1)
23#define PLINK_GET_PLID(p) (p + 3)
24
25#define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
26				jiffies + HZ * t / 1000))
27
28/* Peer link cancel reasons, all subject to ANA approval */
29#define MESH_LINK_CANCELLED			2
30#define MESH_MAX_NEIGHBORS			3
31#define MESH_CAPABILITY_POLICY_VIOLATION	4
32#define MESH_CLOSE_RCVD				5
33#define MESH_MAX_RETRIES			6
34#define MESH_CONFIRM_TIMEOUT			7
35#define MESH_SECURITY_ROLE_NEGOTIATION_DIFFERS	8
36#define MESH_SECURITY_AUTHENTICATION_IMPOSSIBLE	9
37#define MESH_SECURITY_FAILED_VERIFICATION	10
38
39#define dot11MeshMaxRetries(s) (s->u.mesh.mshcfg.dot11MeshMaxRetries)
40#define dot11MeshRetryTimeout(s) (s->u.mesh.mshcfg.dot11MeshRetryTimeout)
41#define dot11MeshConfirmTimeout(s) (s->u.mesh.mshcfg.dot11MeshConfirmTimeout)
42#define dot11MeshHoldingTimeout(s) (s->u.mesh.mshcfg.dot11MeshHoldingTimeout)
43#define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
44
45enum plink_frame_type {
46	PLINK_OPEN = 0,
47	PLINK_CONFIRM,
48	PLINK_CLOSE
49};
50
51enum plink_event {
52	PLINK_UNDEFINED,
53	OPN_ACPT,
54	OPN_RJCT,
55	OPN_IGNR,
56	CNF_ACPT,
57	CNF_RJCT,
58	CNF_IGNR,
59	CLS_ACPT,
60	CLS_IGNR
61};
62
63static inline
64void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
65{
66	atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
67	mesh_accept_plinks_update(sdata);
68}
69
70static inline
71void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
72{
73	atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
74	mesh_accept_plinks_update(sdata);
75}
76
77/**
78 * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
79 *
80 * @sta: mes peer link to restart
81 *
82 * Locking: this function must be called holding sta->lock
83 */
84static inline void mesh_plink_fsm_restart(struct sta_info *sta)
85{
86	sta->plink_state = PLINK_LISTEN;
87	sta->llid = sta->plid = sta->reason = 0;
88	sta->plink_retries = 0;
89}
90
91/*
92 * NOTE: This is just an alias for sta_info_alloc(), see notes
93 *       on it in the lifecycle management section!
94 */
95static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
96					 u8 *hw_addr, u64 rates)
97{
98	struct ieee80211_local *local = sdata->local;
99	struct sta_info *sta;
100
101	if (local->num_sta >= MESH_MAX_PLINKS)
102		return NULL;
103
104	sta = sta_info_alloc(sdata, hw_addr, GFP_ATOMIC);
105	if (!sta)
106		return NULL;
107
108	sta->flags = WLAN_STA_AUTHORIZED;
109	sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
110	rate_control_rate_init(sta);
111
112	return sta;
113}
114
115/**
116 * mesh_plink_deactivate - deactivate mesh peer link
117 *
118 * @sta: mesh peer link to deactivate
119 *
120 * All mesh paths with this peer as next hop will be flushed
121 *
122 * Locking: the caller must hold sta->lock
123 */
124static void __mesh_plink_deactivate(struct sta_info *sta)
125{
126	struct ieee80211_sub_if_data *sdata = sta->sdata;
127
128	if (sta->plink_state == PLINK_ESTAB)
129		mesh_plink_dec_estab_count(sdata);
130	sta->plink_state = PLINK_BLOCKED;
131	mesh_path_flush_by_nexthop(sta);
132}
133
134/**
135 * __mesh_plink_deactivate - deactivate mesh peer link
136 *
137 * @sta: mesh peer link to deactivate
138 *
139 * All mesh paths with this peer as next hop will be flushed
140 */
141void mesh_plink_deactivate(struct sta_info *sta)
142{
143	spin_lock_bh(&sta->lock);
144	__mesh_plink_deactivate(sta);
145	spin_unlock_bh(&sta->lock);
146}
147
148static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
149		enum plink_frame_type action, u8 *da, __le16 llid, __le16 plid,
150		__le16 reason) {
151	struct ieee80211_local *local = sdata->local;
152	struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
153	struct ieee80211_mgmt *mgmt;
154	bool include_plid = false;
155	u8 *pos;
156	int ie_len;
157
158	if (!skb)
159		return -1;
160	skb_reserve(skb, local->hw.extra_tx_headroom);
161	/* 25 is the size of the common mgmt part (24) plus the size of the
162	 * common action part (1)
163	 */
164	mgmt = (struct ieee80211_mgmt *)
165		skb_put(skb, 25 + sizeof(mgmt->u.action.u.plink_action));
166	memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.plink_action));
167	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
168					  IEEE80211_STYPE_ACTION);
169	memcpy(mgmt->da, da, ETH_ALEN);
170	memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
171	/* BSSID is left zeroed, wildcard value */
172	mgmt->u.action.category = PLINK_CATEGORY;
173	mgmt->u.action.u.plink_action.action_code = action;
174
175	if (action == PLINK_CLOSE)
176		mgmt->u.action.u.plink_action.aux = reason;
177	else {
178		mgmt->u.action.u.plink_action.aux = cpu_to_le16(0x0);
179		if (action == PLINK_CONFIRM) {
180			pos = skb_put(skb, 4);
181			/* two-byte status code followed by two-byte AID */
182			memset(pos, 0, 4);
183		}
184		mesh_mgmt_ies_add(skb, sdata);
185	}
186
187	/* Add Peer Link Management element */
188	switch (action) {
189	case PLINK_OPEN:
190		ie_len = 3;
191		break;
192	case PLINK_CONFIRM:
193		ie_len = 5;
194		include_plid = true;
195		break;
196	case PLINK_CLOSE:
197	default:
198		if (!plid)
199			ie_len = 5;
200		else {
201			ie_len = 7;
202			include_plid = true;
203		}
204		break;
205	}
206
207	pos = skb_put(skb, 2 + ie_len);
208	*pos++ = WLAN_EID_PEER_LINK;
209	*pos++ = ie_len;
210	*pos++ = action;
211	memcpy(pos, &llid, 2);
212	if (include_plid) {
213		pos += 2;
214		memcpy(pos, &plid, 2);
215	}
216	if (action == PLINK_CLOSE) {
217		pos += 2;
218		memcpy(pos, &reason, 2);
219	}
220
221	ieee80211_tx_skb(sdata, skb, 0);
222	return 0;
223}
224
225void mesh_neighbour_update(u8 *hw_addr, u64 rates, struct ieee80211_sub_if_data *sdata,
226			   bool peer_accepting_plinks)
227{
228	struct ieee80211_local *local = sdata->local;
229	struct sta_info *sta;
230
231	rcu_read_lock();
232
233	sta = sta_info_get(local, hw_addr);
234	if (!sta) {
235		sta = mesh_plink_alloc(sdata, hw_addr, rates);
236		if (!sta) {
237			rcu_read_unlock();
238			return;
239		}
240		if (sta_info_insert(sta)) {
241			rcu_read_unlock();
242			return;
243		}
244	}
245
246	sta->last_rx = jiffies;
247	sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
248	if (peer_accepting_plinks && sta->plink_state == PLINK_LISTEN &&
249			sdata->u.mesh.accepting_plinks &&
250			sdata->u.mesh.mshcfg.auto_open_plinks)
251		mesh_plink_open(sta);
252
253	rcu_read_unlock();
254}
255
256static void mesh_plink_timer(unsigned long data)
257{
258	struct sta_info *sta;
259	__le16 llid, plid, reason;
260	struct ieee80211_sub_if_data *sdata;
261
262	/*
263	 * This STA is valid because sta_info_destroy() will
264	 * del_timer_sync() this timer after having made sure
265	 * it cannot be readded (by deleting the plink.)
266	 */
267	sta = (struct sta_info *) data;
268
269	spin_lock_bh(&sta->lock);
270	if (sta->ignore_plink_timer) {
271		sta->ignore_plink_timer = false;
272		spin_unlock_bh(&sta->lock);
273		return;
274	}
275	mpl_dbg("Mesh plink timer for %pM fired on state %d\n",
276		sta->sta.addr, sta->plink_state);
277	reason = 0;
278	llid = sta->llid;
279	plid = sta->plid;
280	sdata = sta->sdata;
281
282	switch (sta->plink_state) {
283	case PLINK_OPN_RCVD:
284	case PLINK_OPN_SNT:
285		/* retry timer */
286		if (sta->plink_retries < dot11MeshMaxRetries(sdata)) {
287			u32 rand;
288			mpl_dbg("Mesh plink for %pM (retry, timeout): %d %d\n",
289				sta->sta.addr, sta->plink_retries,
290				sta->plink_timeout);
291			get_random_bytes(&rand, sizeof(u32));
292			sta->plink_timeout = sta->plink_timeout +
293					     rand % sta->plink_timeout;
294			++sta->plink_retries;
295			mod_plink_timer(sta, sta->plink_timeout);
296			spin_unlock_bh(&sta->lock);
297			mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
298					    0, 0);
299			break;
300		}
301		reason = cpu_to_le16(MESH_MAX_RETRIES);
302		/* fall through on else */
303	case PLINK_CNF_RCVD:
304		/* confirm timer */
305		if (!reason)
306			reason = cpu_to_le16(MESH_CONFIRM_TIMEOUT);
307		sta->plink_state = PLINK_HOLDING;
308		mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
309		spin_unlock_bh(&sta->lock);
310		mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid,
311				    reason);
312		break;
313	case PLINK_HOLDING:
314		/* holding timer */
315		del_timer(&sta->plink_timer);
316		mesh_plink_fsm_restart(sta);
317		spin_unlock_bh(&sta->lock);
318		break;
319	default:
320		spin_unlock_bh(&sta->lock);
321		break;
322	}
323}
324
325static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
326{
327	sta->plink_timer.expires = jiffies + (HZ * timeout / 1000);
328	sta->plink_timer.data = (unsigned long) sta;
329	sta->plink_timer.function = mesh_plink_timer;
330	sta->plink_timeout = timeout;
331	add_timer(&sta->plink_timer);
332}
333
334int mesh_plink_open(struct sta_info *sta)
335{
336	__le16 llid;
337	struct ieee80211_sub_if_data *sdata = sta->sdata;
338
339	spin_lock_bh(&sta->lock);
340	get_random_bytes(&llid, 2);
341	sta->llid = llid;
342	if (sta->plink_state != PLINK_LISTEN) {
343		spin_unlock_bh(&sta->lock);
344		return -EBUSY;
345	}
346	sta->plink_state = PLINK_OPN_SNT;
347	mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
348	spin_unlock_bh(&sta->lock);
349	mpl_dbg("Mesh plink: starting establishment with %pM\n",
350		sta->sta.addr);
351
352	return mesh_plink_frame_tx(sdata, PLINK_OPEN,
353				   sta->sta.addr, llid, 0, 0);
354}
355
356void mesh_plink_block(struct sta_info *sta)
357{
358	spin_lock_bh(&sta->lock);
359	__mesh_plink_deactivate(sta);
360	sta->plink_state = PLINK_BLOCKED;
361	spin_unlock_bh(&sta->lock);
362}
363
364int mesh_plink_close(struct sta_info *sta)
365{
366	struct ieee80211_sub_if_data *sdata = sta->sdata;
367	__le16 llid, plid, reason;
368
369	mpl_dbg("Mesh plink: closing link with %pM\n", sta->sta.addr);
370	spin_lock_bh(&sta->lock);
371	sta->reason = cpu_to_le16(MESH_LINK_CANCELLED);
372	reason = sta->reason;
373
374	if (sta->plink_state == PLINK_LISTEN ||
375	    sta->plink_state == PLINK_BLOCKED) {
376		mesh_plink_fsm_restart(sta);
377		spin_unlock_bh(&sta->lock);
378		return 0;
379	} else if (sta->plink_state == PLINK_ESTAB) {
380		__mesh_plink_deactivate(sta);
381		/* The timer should not be running */
382		mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
383	} else if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata)))
384		sta->ignore_plink_timer = true;
385
386	sta->plink_state = PLINK_HOLDING;
387	llid = sta->llid;
388	plid = sta->plid;
389	spin_unlock_bh(&sta->lock);
390	mesh_plink_frame_tx(sta->sdata, PLINK_CLOSE, sta->sta.addr, llid,
391			    plid, reason);
392	return 0;
393}
394
395void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
396			 size_t len, struct ieee80211_rx_status *rx_status)
397{
398	struct ieee80211_local *local = sdata->local;
399	struct ieee802_11_elems elems;
400	struct sta_info *sta;
401	enum plink_event event;
402	enum plink_frame_type ftype;
403	size_t baselen;
404	u8 ie_len;
405	u8 *baseaddr;
406	__le16 plid, llid, reason;
407
408	/* need action_code, aux */
409	if (len < IEEE80211_MIN_ACTION_SIZE + 3)
410		return;
411
412	if (is_multicast_ether_addr(mgmt->da)) {
413		mpl_dbg("Mesh plink: ignore frame from multicast address");
414		return;
415	}
416
417	baseaddr = mgmt->u.action.u.plink_action.variable;
418	baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
419	if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
420		baseaddr += 4;
421		baselen -= 4;
422	}
423	ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
424	if (!elems.peer_link) {
425		mpl_dbg("Mesh plink: missing necessary peer link ie\n");
426		return;
427	}
428
429	ftype = *((u8 *)PLINK_GET_FRAME_SUBTYPE(elems.peer_link));
430	ie_len = elems.peer_link_len;
431	if ((ftype == PLINK_OPEN && ie_len != 3) ||
432	    (ftype == PLINK_CONFIRM && ie_len != 5) ||
433	    (ftype == PLINK_CLOSE && ie_len != 5 && ie_len != 7)) {
434		mpl_dbg("Mesh plink: incorrect plink ie length\n");
435		return;
436	}
437
438	if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) {
439		mpl_dbg("Mesh plink: missing necessary ie\n");
440		return;
441	}
442	/* Note the lines below are correct, the llid in the frame is the plid
443	 * from the point of view of this host.
444	 */
445	memcpy(&plid, PLINK_GET_LLID(elems.peer_link), 2);
446	if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 7))
447		memcpy(&llid, PLINK_GET_PLID(elems.peer_link), 2);
448
449	rcu_read_lock();
450
451	sta = sta_info_get(local, mgmt->sa);
452	if (!sta && ftype != PLINK_OPEN) {
453		mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
454		rcu_read_unlock();
455		return;
456	}
457
458	if (sta && sta->plink_state == PLINK_BLOCKED) {
459		rcu_read_unlock();
460		return;
461	}
462
463	/* Now we will figure out the appropriate event... */
464	event = PLINK_UNDEFINED;
465	if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) {
466		switch (ftype) {
467		case PLINK_OPEN:
468			event = OPN_RJCT;
469			break;
470		case PLINK_CONFIRM:
471			event = CNF_RJCT;
472			break;
473		case PLINK_CLOSE:
474			/* avoid warning */
475			break;
476		}
477		spin_lock_bh(&sta->lock);
478	} else if (!sta) {
479		/* ftype == PLINK_OPEN */
480		u64 rates;
481		if (!mesh_plink_free_count(sdata)) {
482			mpl_dbg("Mesh plink error: no more free plinks\n");
483			rcu_read_unlock();
484			return;
485		}
486
487		rates = ieee80211_sta_get_rates(local, &elems, rx_status->band);
488		sta = mesh_plink_alloc(sdata, mgmt->sa, rates);
489		if (!sta) {
490			mpl_dbg("Mesh plink error: plink table full\n");
491			rcu_read_unlock();
492			return;
493		}
494		if (sta_info_insert(sta)) {
495			rcu_read_unlock();
496			return;
497		}
498		event = OPN_ACPT;
499		spin_lock_bh(&sta->lock);
500	} else {
501		spin_lock_bh(&sta->lock);
502		switch (ftype) {
503		case PLINK_OPEN:
504			if (!mesh_plink_free_count(sdata) ||
505			    (sta->plid && sta->plid != plid))
506				event = OPN_IGNR;
507			else
508				event = OPN_ACPT;
509			break;
510		case PLINK_CONFIRM:
511			if (!mesh_plink_free_count(sdata) ||
512			    (sta->llid != llid || sta->plid != plid))
513				event = CNF_IGNR;
514			else
515				event = CNF_ACPT;
516			break;
517		case PLINK_CLOSE:
518			if (sta->plink_state == PLINK_ESTAB)
519				/* Do not check for llid or plid. This does not
520				 * follow the standard but since multiple plinks
521				 * per sta are not supported, it is necessary in
522				 * order to avoid a livelock when MP A sees an
523				 * establish peer link to MP B but MP B does not
524				 * see it. This can be caused by a timeout in
525				 * B's peer link establishment or B beign
526				 * restarted.
527				 */
528				event = CLS_ACPT;
529			else if (sta->plid != plid)
530				event = CLS_IGNR;
531			else if (ie_len == 7 && sta->llid != llid)
532				event = CLS_IGNR;
533			else
534				event = CLS_ACPT;
535			break;
536		default:
537			mpl_dbg("Mesh plink: unknown frame subtype\n");
538			spin_unlock_bh(&sta->lock);
539			rcu_read_unlock();
540			return;
541		}
542	}
543
544	mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %d %d %d %d\n",
545		mgmt->sa, sta->plink_state,
546		le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
547		event);
548	reason = 0;
549	switch (sta->plink_state) {
550		/* spin_unlock as soon as state is updated at each case */
551	case PLINK_LISTEN:
552		switch (event) {
553		case CLS_ACPT:
554			mesh_plink_fsm_restart(sta);
555			spin_unlock_bh(&sta->lock);
556			break;
557		case OPN_ACPT:
558			sta->plink_state = PLINK_OPN_RCVD;
559			sta->plid = plid;
560			get_random_bytes(&llid, 2);
561			sta->llid = llid;
562			mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
563			spin_unlock_bh(&sta->lock);
564			mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
565					    0, 0);
566			mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr,
567					    llid, plid, 0);
568			break;
569		default:
570			spin_unlock_bh(&sta->lock);
571			break;
572		}
573		break;
574
575	case PLINK_OPN_SNT:
576		switch (event) {
577		case OPN_RJCT:
578		case CNF_RJCT:
579			reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
580		case CLS_ACPT:
581			if (!reason)
582				reason = cpu_to_le16(MESH_CLOSE_RCVD);
583			sta->reason = reason;
584			sta->plink_state = PLINK_HOLDING;
585			if (!mod_plink_timer(sta,
586					     dot11MeshHoldingTimeout(sdata)))
587				sta->ignore_plink_timer = true;
588
589			llid = sta->llid;
590			spin_unlock_bh(&sta->lock);
591			mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
592					    plid, reason);
593			break;
594		case OPN_ACPT:
595			/* retry timer is left untouched */
596			sta->plink_state = PLINK_OPN_RCVD;
597			sta->plid = plid;
598			llid = sta->llid;
599			spin_unlock_bh(&sta->lock);
600			mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
601					    plid, 0);
602			break;
603		case CNF_ACPT:
604			sta->plink_state = PLINK_CNF_RCVD;
605			if (!mod_plink_timer(sta,
606					     dot11MeshConfirmTimeout(sdata)))
607				sta->ignore_plink_timer = true;
608
609			spin_unlock_bh(&sta->lock);
610			break;
611		default:
612			spin_unlock_bh(&sta->lock);
613			break;
614		}
615		break;
616
617	case PLINK_OPN_RCVD:
618		switch (event) {
619		case OPN_RJCT:
620		case CNF_RJCT:
621			reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
622		case CLS_ACPT:
623			if (!reason)
624				reason = cpu_to_le16(MESH_CLOSE_RCVD);
625			sta->reason = reason;
626			sta->plink_state = PLINK_HOLDING;
627			if (!mod_plink_timer(sta,
628					     dot11MeshHoldingTimeout(sdata)))
629				sta->ignore_plink_timer = true;
630
631			llid = sta->llid;
632			spin_unlock_bh(&sta->lock);
633			mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
634					    plid, reason);
635			break;
636		case OPN_ACPT:
637			llid = sta->llid;
638			spin_unlock_bh(&sta->lock);
639			mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
640					    plid, 0);
641			break;
642		case CNF_ACPT:
643			del_timer(&sta->plink_timer);
644			sta->plink_state = PLINK_ESTAB;
645			mesh_plink_inc_estab_count(sdata);
646			spin_unlock_bh(&sta->lock);
647			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
648				sta->sta.addr);
649			break;
650		default:
651			spin_unlock_bh(&sta->lock);
652			break;
653		}
654		break;
655
656	case PLINK_CNF_RCVD:
657		switch (event) {
658		case OPN_RJCT:
659		case CNF_RJCT:
660			reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
661		case CLS_ACPT:
662			if (!reason)
663				reason = cpu_to_le16(MESH_CLOSE_RCVD);
664			sta->reason = reason;
665			sta->plink_state = PLINK_HOLDING;
666			if (!mod_plink_timer(sta,
667					     dot11MeshHoldingTimeout(sdata)))
668				sta->ignore_plink_timer = true;
669
670			llid = sta->llid;
671			spin_unlock_bh(&sta->lock);
672			mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
673					    plid, reason);
674			break;
675		case OPN_ACPT:
676			del_timer(&sta->plink_timer);
677			sta->plink_state = PLINK_ESTAB;
678			mesh_plink_inc_estab_count(sdata);
679			spin_unlock_bh(&sta->lock);
680			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
681				sta->sta.addr);
682			mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
683					    plid, 0);
684			break;
685		default:
686			spin_unlock_bh(&sta->lock);
687			break;
688		}
689		break;
690
691	case PLINK_ESTAB:
692		switch (event) {
693		case CLS_ACPT:
694			reason = cpu_to_le16(MESH_CLOSE_RCVD);
695			sta->reason = reason;
696			__mesh_plink_deactivate(sta);
697			sta->plink_state = PLINK_HOLDING;
698			llid = sta->llid;
699			mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
700			spin_unlock_bh(&sta->lock);
701			mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
702					    plid, reason);
703			break;
704		case OPN_ACPT:
705			llid = sta->llid;
706			spin_unlock_bh(&sta->lock);
707			mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
708					    plid, 0);
709			break;
710		default:
711			spin_unlock_bh(&sta->lock);
712			break;
713		}
714		break;
715	case PLINK_HOLDING:
716		switch (event) {
717		case CLS_ACPT:
718			if (del_timer(&sta->plink_timer))
719				sta->ignore_plink_timer = 1;
720			mesh_plink_fsm_restart(sta);
721			spin_unlock_bh(&sta->lock);
722			break;
723		case OPN_ACPT:
724		case CNF_ACPT:
725		case OPN_RJCT:
726		case CNF_RJCT:
727			llid = sta->llid;
728			reason = sta->reason;
729			spin_unlock_bh(&sta->lock);
730			mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr,
731					    llid, plid, reason);
732			break;
733		default:
734			spin_unlock_bh(&sta->lock);
735		}
736		break;
737	default:
738		/* should not get here, PLINK_BLOCKED is dealt with at the
739		 * beggining of the function
740		 */
741		spin_unlock_bh(&sta->lock);
742		break;
743	}
744
745	rcu_read_unlock();
746}
747