mesh_plink.c revision e87278e730b11e9852fe0fe967908ef5a4e6e6a0
1/*
2 * Copyright (c) 2008, 2009 open80211s Ltd.
3 * Author:     Luis Carlos Cobo <luisca@cozybit.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9#include <linux/gfp.h>
10#include <linux/kernel.h>
11#include <linux/random.h>
12#include "ieee80211_i.h"
13#include "rate.h"
14#include "mesh.h"
15
16#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
17#define mpl_dbg(fmt, args...)	printk(KERN_DEBUG fmt, ##args)
18#else
19#define mpl_dbg(fmt, args...)	do { (void)(0); } while (0)
20#endif
21
22#define PLINK_GET_LLID(p) (p + 2)
23#define PLINK_GET_PLID(p) (p + 4)
24
25#define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
26				jiffies + HZ * t / 1000))
27
28#define dot11MeshMaxRetries(s) (s->u.mesh.mshcfg.dot11MeshMaxRetries)
29#define dot11MeshRetryTimeout(s) (s->u.mesh.mshcfg.dot11MeshRetryTimeout)
30#define dot11MeshConfirmTimeout(s) (s->u.mesh.mshcfg.dot11MeshConfirmTimeout)
31#define dot11MeshHoldingTimeout(s) (s->u.mesh.mshcfg.dot11MeshHoldingTimeout)
32#define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
33
34/* We only need a valid sta if user configured a minimum rssi_threshold. */
35#define rssi_threshold_check(sta, sdata) \
36		(sdata->u.mesh.mshcfg.rssi_threshold == 0 ||\
37		(sta && (s8) -ewma_read(&sta->avg_signal) > \
38		sdata->u.mesh.mshcfg.rssi_threshold))
39
40enum plink_event {
41	PLINK_UNDEFINED,
42	OPN_ACPT,
43	OPN_RJCT,
44	OPN_IGNR,
45	CNF_ACPT,
46	CNF_RJCT,
47	CNF_IGNR,
48	CLS_ACPT,
49	CLS_IGNR
50};
51
52static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
53		enum ieee80211_self_protected_actioncode action,
54		u8 *da, __le16 llid, __le16 plid, __le16 reason);
55
56static inline
57void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
58{
59	atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
60	mesh_accept_plinks_update(sdata);
61}
62
63static inline
64void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
65{
66	atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
67	mesh_accept_plinks_update(sdata);
68}
69
70/**
71 * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
72 *
73 * @sta: mesh peer link to restart
74 *
75 * Locking: this function must be called holding sta->lock
76 */
77static inline void mesh_plink_fsm_restart(struct sta_info *sta)
78{
79	sta->plink_state = NL80211_PLINK_LISTEN;
80	sta->llid = sta->plid = sta->reason = 0;
81	sta->plink_retries = 0;
82}
83
84/*
85 * Allocate mesh sta entry and insert into station table
86 */
87static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
88					 u8 *hw_addr)
89{
90	struct sta_info *sta;
91
92	if (sdata->local->num_sta >= MESH_MAX_PLINKS)
93		return NULL;
94
95	sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
96	if (!sta)
97		return NULL;
98
99	sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
100	sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
101	sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
102
103	set_sta_flag(sta, WLAN_STA_WME);
104
105	return sta;
106}
107
108/**
109 * __mesh_plink_deactivate - deactivate mesh peer link
110 *
111 * @sta: mesh peer link to deactivate
112 *
113 * All mesh paths with this peer as next hop will be flushed
114 *
115 * Locking: the caller must hold sta->lock
116 */
117static bool __mesh_plink_deactivate(struct sta_info *sta)
118{
119	struct ieee80211_sub_if_data *sdata = sta->sdata;
120	bool deactivated = false;
121
122	if (sta->plink_state == NL80211_PLINK_ESTAB) {
123		mesh_plink_dec_estab_count(sdata);
124		deactivated = true;
125	}
126	sta->plink_state = NL80211_PLINK_BLOCKED;
127	mesh_path_flush_by_nexthop(sta);
128
129	return deactivated;
130}
131
132/**
133 * mesh_plink_deactivate - deactivate mesh peer link
134 *
135 * @sta: mesh peer link to deactivate
136 *
137 * All mesh paths with this peer as next hop will be flushed
138 */
139void mesh_plink_deactivate(struct sta_info *sta)
140{
141	struct ieee80211_sub_if_data *sdata = sta->sdata;
142	bool deactivated;
143
144	spin_lock_bh(&sta->lock);
145	deactivated = __mesh_plink_deactivate(sta);
146	sta->reason = cpu_to_le16(WLAN_REASON_MESH_PEER_CANCELED);
147	mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
148			    sta->sta.addr, sta->llid, sta->plid,
149			    sta->reason);
150	spin_unlock_bh(&sta->lock);
151
152	if (deactivated)
153		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
154}
155
156static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
157		enum ieee80211_self_protected_actioncode action,
158		u8 *da, __le16 llid, __le16 plid, __le16 reason) {
159	struct ieee80211_local *local = sdata->local;
160	struct sk_buff *skb;
161	struct ieee80211_mgmt *mgmt;
162	bool include_plid = false;
163	u16 peering_proto = 0;
164	u8 *pos, ie_len = 4;
165	int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
166		      sizeof(mgmt->u.action.u.self_prot);
167
168	skb = dev_alloc_skb(local->tx_headroom +
169			    hdr_len +
170			    2 + /* capability info */
171			    2 + /* AID */
172			    2 + 8 + /* supported rates */
173			    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
174			    2 + sdata->u.mesh.mesh_id_len +
175			    2 + sizeof(struct ieee80211_meshconf_ie) +
176			    2 + sizeof(struct ieee80211_ht_cap) +
177			    2 + sizeof(struct ieee80211_ht_operation) +
178			    2 + 8 + /* peering IE */
179			    sdata->u.mesh.ie_len);
180	if (!skb)
181		return -1;
182	skb_reserve(skb, local->tx_headroom);
183	mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
184	memset(mgmt, 0, hdr_len);
185	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
186					  IEEE80211_STYPE_ACTION);
187	memcpy(mgmt->da, da, ETH_ALEN);
188	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
189	memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
190	mgmt->u.action.category = WLAN_CATEGORY_SELF_PROTECTED;
191	mgmt->u.action.u.self_prot.action_code = action;
192
193	if (action != WLAN_SP_MESH_PEERING_CLOSE) {
194		/* capability info */
195		pos = skb_put(skb, 2);
196		memset(pos, 0, 2);
197		if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
198			/* AID */
199			pos = skb_put(skb, 2);
200			memcpy(pos + 2, &plid, 2);
201		}
202		if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
203		    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
204		    mesh_add_rsn_ie(skb, sdata) ||
205		    mesh_add_meshid_ie(skb, sdata) ||
206		    mesh_add_meshconf_ie(skb, sdata))
207			return -1;
208	} else {	/* WLAN_SP_MESH_PEERING_CLOSE */
209		if (mesh_add_meshid_ie(skb, sdata))
210			return -1;
211	}
212
213	/* Add Mesh Peering Management element */
214	switch (action) {
215	case WLAN_SP_MESH_PEERING_OPEN:
216		break;
217	case WLAN_SP_MESH_PEERING_CONFIRM:
218		ie_len += 2;
219		include_plid = true;
220		break;
221	case WLAN_SP_MESH_PEERING_CLOSE:
222		if (plid) {
223			ie_len += 2;
224			include_plid = true;
225		}
226		ie_len += 2;	/* reason code */
227		break;
228	default:
229		return -EINVAL;
230	}
231
232	if (WARN_ON(skb_tailroom(skb) < 2 + ie_len))
233		return -ENOMEM;
234
235	pos = skb_put(skb, 2 + ie_len);
236	*pos++ = WLAN_EID_PEER_MGMT;
237	*pos++ = ie_len;
238	memcpy(pos, &peering_proto, 2);
239	pos += 2;
240	memcpy(pos, &llid, 2);
241	pos += 2;
242	if (include_plid) {
243		memcpy(pos, &plid, 2);
244		pos += 2;
245	}
246	if (action == WLAN_SP_MESH_PEERING_CLOSE) {
247		memcpy(pos, &reason, 2);
248		pos += 2;
249	}
250
251	if (action != WLAN_SP_MESH_PEERING_CLOSE) {
252		if (mesh_add_ht_cap_ie(skb, sdata) ||
253		    mesh_add_ht_oper_ie(skb, sdata))
254			return -1;
255	}
256
257	if (mesh_add_vendor_ies(skb, sdata))
258		return -1;
259
260	ieee80211_tx_skb(sdata, skb);
261	return 0;
262}
263
264/* mesh_peer_init - initialize new mesh peer and return resulting sta_info
265 *
266 * @sdata: local meshif
267 * @addr: peer's address
268 * @elems: IEs from beacon or mesh peering frame
269 *
270 * call under RCU
271 */
272static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
273				       u8 *addr,
274				       struct ieee802_11_elems *elems)
275{
276	struct ieee80211_local *local = sdata->local;
277	enum ieee80211_band band = local->oper_channel->band;
278	struct ieee80211_supported_band *sband;
279	u32 rates, basic_rates = 0;
280	struct sta_info *sta;
281	bool insert = false;
282
283	sband = local->hw.wiphy->bands[band];
284	rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
285
286	sta = sta_info_get(sdata, addr);
287	if (!sta) {
288		sta = mesh_plink_alloc(sdata, addr);
289		if (!sta)
290			return NULL;
291		insert = true;
292	}
293
294	spin_lock_bh(&sta->lock);
295	sta->last_rx = jiffies;
296	sta->sta.supp_rates[band] = rates;
297	if (elems->ht_cap_elem &&
298	    sdata->local->_oper_channel_type != NL80211_CHAN_NO_HT)
299		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
300						  elems->ht_cap_elem,
301						  &sta->sta.ht_cap);
302	else
303		memset(&sta->sta.ht_cap, 0, sizeof(sta->sta.ht_cap));
304
305	rate_control_rate_init(sta);
306	spin_unlock_bh(&sta->lock);
307
308	if (insert && sta_info_insert(sta))
309		return NULL;
310
311	return sta;
312}
313
314void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
315			   u8 *hw_addr,
316			   struct ieee802_11_elems *elems)
317{
318	struct sta_info *sta;
319
320	/* Userspace handles peer allocation when security is enabled */
321	if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
322		cfg80211_notify_new_peer_candidate(sdata->dev, hw_addr,
323						   elems->ie_start,
324						   elems->total_len,
325						   GFP_KERNEL);
326		return;
327	}
328
329	rcu_read_lock();
330	sta = mesh_peer_init(sdata, hw_addr, elems);
331	if (!sta)
332		goto out;
333
334	if (mesh_peer_accepts_plinks(elems) &&
335	    sta->plink_state == NL80211_PLINK_LISTEN &&
336	    sdata->u.mesh.accepting_plinks &&
337	    sdata->u.mesh.mshcfg.auto_open_plinks &&
338	    rssi_threshold_check(sta, sdata))
339		mesh_plink_open(sta);
340
341out:
342	rcu_read_unlock();
343}
344
345static void mesh_plink_timer(unsigned long data)
346{
347	struct sta_info *sta;
348	__le16 llid, plid, reason;
349	struct ieee80211_sub_if_data *sdata;
350
351	/*
352	 * This STA is valid because sta_info_destroy() will
353	 * del_timer_sync() this timer after having made sure
354	 * it cannot be readded (by deleting the plink.)
355	 */
356	sta = (struct sta_info *) data;
357
358	if (sta->sdata->local->quiescing) {
359		sta->plink_timer_was_running = true;
360		return;
361	}
362
363	spin_lock_bh(&sta->lock);
364	if (sta->ignore_plink_timer) {
365		sta->ignore_plink_timer = false;
366		spin_unlock_bh(&sta->lock);
367		return;
368	}
369	mpl_dbg("Mesh plink timer for %pM fired on state %d\n",
370		sta->sta.addr, sta->plink_state);
371	reason = 0;
372	llid = sta->llid;
373	plid = sta->plid;
374	sdata = sta->sdata;
375
376	switch (sta->plink_state) {
377	case NL80211_PLINK_OPN_RCVD:
378	case NL80211_PLINK_OPN_SNT:
379		/* retry timer */
380		if (sta->plink_retries < dot11MeshMaxRetries(sdata)) {
381			u32 rand;
382			mpl_dbg("Mesh plink for %pM (retry, timeout): %d %d\n",
383				sta->sta.addr, sta->plink_retries,
384				sta->plink_timeout);
385			get_random_bytes(&rand, sizeof(u32));
386			sta->plink_timeout = sta->plink_timeout +
387					     rand % sta->plink_timeout;
388			++sta->plink_retries;
389			mod_plink_timer(sta, sta->plink_timeout);
390			spin_unlock_bh(&sta->lock);
391			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
392					    sta->sta.addr, llid, 0, 0);
393			break;
394		}
395		reason = cpu_to_le16(WLAN_REASON_MESH_MAX_RETRIES);
396		/* fall through on else */
397	case NL80211_PLINK_CNF_RCVD:
398		/* confirm timer */
399		if (!reason)
400			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIRM_TIMEOUT);
401		sta->plink_state = NL80211_PLINK_HOLDING;
402		mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
403		spin_unlock_bh(&sta->lock);
404		mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
405				    sta->sta.addr, llid, plid, reason);
406		break;
407	case NL80211_PLINK_HOLDING:
408		/* holding timer */
409		del_timer(&sta->plink_timer);
410		mesh_plink_fsm_restart(sta);
411		spin_unlock_bh(&sta->lock);
412		break;
413	default:
414		spin_unlock_bh(&sta->lock);
415		break;
416	}
417}
418
419#ifdef CONFIG_PM
420void mesh_plink_quiesce(struct sta_info *sta)
421{
422	if (del_timer_sync(&sta->plink_timer))
423		sta->plink_timer_was_running = true;
424}
425
426void mesh_plink_restart(struct sta_info *sta)
427{
428	if (sta->plink_timer_was_running) {
429		add_timer(&sta->plink_timer);
430		sta->plink_timer_was_running = false;
431	}
432}
433#endif
434
435static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
436{
437	sta->plink_timer.expires = jiffies + (HZ * timeout / 1000);
438	sta->plink_timer.data = (unsigned long) sta;
439	sta->plink_timer.function = mesh_plink_timer;
440	sta->plink_timeout = timeout;
441	add_timer(&sta->plink_timer);
442}
443
444int mesh_plink_open(struct sta_info *sta)
445{
446	__le16 llid;
447	struct ieee80211_sub_if_data *sdata = sta->sdata;
448
449	if (!test_sta_flag(sta, WLAN_STA_AUTH))
450		return -EPERM;
451
452	spin_lock_bh(&sta->lock);
453	get_random_bytes(&llid, 2);
454	sta->llid = llid;
455	if (sta->plink_state != NL80211_PLINK_LISTEN) {
456		spin_unlock_bh(&sta->lock);
457		return -EBUSY;
458	}
459	sta->plink_state = NL80211_PLINK_OPN_SNT;
460	mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
461	spin_unlock_bh(&sta->lock);
462	mpl_dbg("Mesh plink: starting establishment with %pM\n",
463		sta->sta.addr);
464
465	return mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
466				   sta->sta.addr, llid, 0, 0);
467}
468
469void mesh_plink_block(struct sta_info *sta)
470{
471	struct ieee80211_sub_if_data *sdata = sta->sdata;
472	bool deactivated;
473
474	spin_lock_bh(&sta->lock);
475	deactivated = __mesh_plink_deactivate(sta);
476	sta->plink_state = NL80211_PLINK_BLOCKED;
477	spin_unlock_bh(&sta->lock);
478
479	if (deactivated)
480		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
481}
482
483
484void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
485			 size_t len, struct ieee80211_rx_status *rx_status)
486{
487	struct ieee802_11_elems elems;
488	struct sta_info *sta;
489	enum plink_event event;
490	enum ieee80211_self_protected_actioncode ftype;
491	size_t baselen;
492	bool deactivated, matches_local = true;
493	u8 ie_len;
494	u8 *baseaddr;
495	__le16 plid, llid, reason;
496#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
497	static const char *mplstates[] = {
498		[NL80211_PLINK_LISTEN] = "LISTEN",
499		[NL80211_PLINK_OPN_SNT] = "OPN-SNT",
500		[NL80211_PLINK_OPN_RCVD] = "OPN-RCVD",
501		[NL80211_PLINK_CNF_RCVD] = "CNF_RCVD",
502		[NL80211_PLINK_ESTAB] = "ESTAB",
503		[NL80211_PLINK_HOLDING] = "HOLDING",
504		[NL80211_PLINK_BLOCKED] = "BLOCKED"
505	};
506#endif
507
508	/* need action_code, aux */
509	if (len < IEEE80211_MIN_ACTION_SIZE + 3)
510		return;
511
512	if (is_multicast_ether_addr(mgmt->da)) {
513		mpl_dbg("Mesh plink: ignore frame from multicast address");
514		return;
515	}
516
517	baseaddr = mgmt->u.action.u.self_prot.variable;
518	baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
519	if (mgmt->u.action.u.self_prot.action_code ==
520						WLAN_SP_MESH_PEERING_CONFIRM) {
521		baseaddr += 4;
522		baselen += 4;
523	}
524	ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
525	if (!elems.peering) {
526		mpl_dbg("Mesh plink: missing necessary peer link ie\n");
527		return;
528	}
529	if (elems.rsn_len &&
530			sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
531		mpl_dbg("Mesh plink: can't establish link with secure peer\n");
532		return;
533	}
534
535	ftype = mgmt->u.action.u.self_prot.action_code;
536	ie_len = elems.peering_len;
537	if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
538	    (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
539	    (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
540							&& ie_len != 8)) {
541		mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
542		    ftype, ie_len);
543		return;
544	}
545
546	if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
547				(!elems.mesh_id || !elems.mesh_config)) {
548		mpl_dbg("Mesh plink: missing necessary ie\n");
549		return;
550	}
551	/* Note the lines below are correct, the llid in the frame is the plid
552	 * from the point of view of this host.
553	 */
554	memcpy(&plid, PLINK_GET_LLID(elems.peering), 2);
555	if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
556	    (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
557		memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
558
559	rcu_read_lock();
560
561	sta = sta_info_get(sdata, mgmt->sa);
562	if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) {
563		mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
564		rcu_read_unlock();
565		return;
566	}
567
568	if (ftype == WLAN_SP_MESH_PEERING_OPEN &&
569	    !rssi_threshold_check(sta, sdata)) {
570		mpl_dbg("Mesh plink: %pM does not meet rssi threshold\n",
571			mgmt->sa);
572		rcu_read_unlock();
573		return;
574	}
575
576	if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) {
577		mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
578		rcu_read_unlock();
579		return;
580	}
581
582	if (sta && sta->plink_state == NL80211_PLINK_BLOCKED) {
583		rcu_read_unlock();
584		return;
585	}
586
587	/* Now we will figure out the appropriate event... */
588	event = PLINK_UNDEFINED;
589	if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
590	    !mesh_matches_local(sdata, &elems)) {
591		matches_local = false;
592		switch (ftype) {
593		case WLAN_SP_MESH_PEERING_OPEN:
594			event = OPN_RJCT;
595			break;
596		case WLAN_SP_MESH_PEERING_CONFIRM:
597			event = CNF_RJCT;
598			break;
599		default:
600			break;
601		}
602	}
603
604	if (!sta && !matches_local) {
605		rcu_read_unlock();
606		reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
607		llid = 0;
608		mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
609				    mgmt->sa, llid, plid, reason);
610		return;
611	} else if (!sta) {
612		/* ftype == WLAN_SP_MESH_PEERING_OPEN */
613		if (!mesh_plink_free_count(sdata)) {
614			mpl_dbg("Mesh plink error: no more free plinks\n");
615			rcu_read_unlock();
616			return;
617		}
618		event = OPN_ACPT;
619	} else if (matches_local) {
620		switch (ftype) {
621		case WLAN_SP_MESH_PEERING_OPEN:
622			if (!mesh_plink_free_count(sdata) ||
623			    (sta->plid && sta->plid != plid))
624				event = OPN_IGNR;
625			else
626				event = OPN_ACPT;
627			break;
628		case WLAN_SP_MESH_PEERING_CONFIRM:
629			if (!mesh_plink_free_count(sdata) ||
630			    (sta->llid != llid || sta->plid != plid))
631				event = CNF_IGNR;
632			else
633				event = CNF_ACPT;
634			break;
635		case WLAN_SP_MESH_PEERING_CLOSE:
636			if (sta->plink_state == NL80211_PLINK_ESTAB)
637				/* Do not check for llid or plid. This does not
638				 * follow the standard but since multiple plinks
639				 * per sta are not supported, it is necessary in
640				 * order to avoid a livelock when MP A sees an
641				 * establish peer link to MP B but MP B does not
642				 * see it. This can be caused by a timeout in
643				 * B's peer link establishment or B beign
644				 * restarted.
645				 */
646				event = CLS_ACPT;
647			else if (sta->plid != plid)
648				event = CLS_IGNR;
649			else if (ie_len == 7 && sta->llid != llid)
650				event = CLS_IGNR;
651			else
652				event = CLS_ACPT;
653			break;
654		default:
655			mpl_dbg("Mesh plink: unknown frame subtype\n");
656			rcu_read_unlock();
657			return;
658		}
659	}
660
661	if (event == OPN_ACPT) {
662		/* allocate sta entry if necessary and update info */
663		sta = mesh_peer_init(sdata, mgmt->sa, &elems);
664		if (!sta) {
665			mpl_dbg("Mesh plink: failed to init peer!\n");
666			rcu_read_unlock();
667			return;
668		}
669	}
670
671	mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
672		mgmt->sa, mplstates[sta->plink_state],
673		le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
674		event);
675	reason = 0;
676	spin_lock_bh(&sta->lock);
677	switch (sta->plink_state) {
678		/* spin_unlock as soon as state is updated at each case */
679	case NL80211_PLINK_LISTEN:
680		switch (event) {
681		case CLS_ACPT:
682			mesh_plink_fsm_restart(sta);
683			spin_unlock_bh(&sta->lock);
684			break;
685		case OPN_ACPT:
686			sta->plink_state = NL80211_PLINK_OPN_RCVD;
687			sta->plid = plid;
688			get_random_bytes(&llid, 2);
689			sta->llid = llid;
690			mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
691			spin_unlock_bh(&sta->lock);
692			mesh_plink_frame_tx(sdata,
693					    WLAN_SP_MESH_PEERING_OPEN,
694					    sta->sta.addr, llid, 0, 0);
695			mesh_plink_frame_tx(sdata,
696					    WLAN_SP_MESH_PEERING_CONFIRM,
697					    sta->sta.addr, llid, plid, 0);
698			break;
699		default:
700			spin_unlock_bh(&sta->lock);
701			break;
702		}
703		break;
704
705	case NL80211_PLINK_OPN_SNT:
706		switch (event) {
707		case OPN_RJCT:
708		case CNF_RJCT:
709			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
710		case CLS_ACPT:
711			if (!reason)
712				reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
713			sta->reason = reason;
714			sta->plink_state = NL80211_PLINK_HOLDING;
715			if (!mod_plink_timer(sta,
716					     dot11MeshHoldingTimeout(sdata)))
717				sta->ignore_plink_timer = true;
718
719			llid = sta->llid;
720			spin_unlock_bh(&sta->lock);
721			mesh_plink_frame_tx(sdata,
722					    WLAN_SP_MESH_PEERING_CLOSE,
723					    sta->sta.addr, llid, plid, reason);
724			break;
725		case OPN_ACPT:
726			/* retry timer is left untouched */
727			sta->plink_state = NL80211_PLINK_OPN_RCVD;
728			sta->plid = plid;
729			llid = sta->llid;
730			spin_unlock_bh(&sta->lock);
731			mesh_plink_frame_tx(sdata,
732					    WLAN_SP_MESH_PEERING_CONFIRM,
733					    sta->sta.addr, llid, plid, 0);
734			break;
735		case CNF_ACPT:
736			sta->plink_state = NL80211_PLINK_CNF_RCVD;
737			if (!mod_plink_timer(sta,
738					     dot11MeshConfirmTimeout(sdata)))
739				sta->ignore_plink_timer = true;
740
741			spin_unlock_bh(&sta->lock);
742			break;
743		default:
744			spin_unlock_bh(&sta->lock);
745			break;
746		}
747		break;
748
749	case NL80211_PLINK_OPN_RCVD:
750		switch (event) {
751		case OPN_RJCT:
752		case CNF_RJCT:
753			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
754		case CLS_ACPT:
755			if (!reason)
756				reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
757			sta->reason = reason;
758			sta->plink_state = NL80211_PLINK_HOLDING;
759			if (!mod_plink_timer(sta,
760					     dot11MeshHoldingTimeout(sdata)))
761				sta->ignore_plink_timer = true;
762
763			llid = sta->llid;
764			spin_unlock_bh(&sta->lock);
765			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
766					    sta->sta.addr, llid, plid, reason);
767			break;
768		case OPN_ACPT:
769			llid = sta->llid;
770			spin_unlock_bh(&sta->lock);
771			mesh_plink_frame_tx(sdata,
772					    WLAN_SP_MESH_PEERING_CONFIRM,
773					    sta->sta.addr, llid, plid, 0);
774			break;
775		case CNF_ACPT:
776			del_timer(&sta->plink_timer);
777			sta->plink_state = NL80211_PLINK_ESTAB;
778			spin_unlock_bh(&sta->lock);
779			mesh_plink_inc_estab_count(sdata);
780			ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
781			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
782				sta->sta.addr);
783			break;
784		default:
785			spin_unlock_bh(&sta->lock);
786			break;
787		}
788		break;
789
790	case NL80211_PLINK_CNF_RCVD:
791		switch (event) {
792		case OPN_RJCT:
793		case CNF_RJCT:
794			reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
795		case CLS_ACPT:
796			if (!reason)
797				reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
798			sta->reason = reason;
799			sta->plink_state = NL80211_PLINK_HOLDING;
800			if (!mod_plink_timer(sta,
801					     dot11MeshHoldingTimeout(sdata)))
802				sta->ignore_plink_timer = true;
803
804			llid = sta->llid;
805			spin_unlock_bh(&sta->lock);
806			mesh_plink_frame_tx(sdata,
807					    WLAN_SP_MESH_PEERING_CLOSE,
808					    sta->sta.addr, llid, plid, reason);
809			break;
810		case OPN_ACPT:
811			del_timer(&sta->plink_timer);
812			sta->plink_state = NL80211_PLINK_ESTAB;
813			spin_unlock_bh(&sta->lock);
814			mesh_plink_inc_estab_count(sdata);
815			ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
816			mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
817				sta->sta.addr);
818			mesh_plink_frame_tx(sdata,
819					    WLAN_SP_MESH_PEERING_CONFIRM,
820					    sta->sta.addr, llid, plid, 0);
821			break;
822		default:
823			spin_unlock_bh(&sta->lock);
824			break;
825		}
826		break;
827
828	case NL80211_PLINK_ESTAB:
829		switch (event) {
830		case CLS_ACPT:
831			reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
832			sta->reason = reason;
833			deactivated = __mesh_plink_deactivate(sta);
834			sta->plink_state = NL80211_PLINK_HOLDING;
835			llid = sta->llid;
836			mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
837			spin_unlock_bh(&sta->lock);
838			if (deactivated)
839				ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
840			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
841					    sta->sta.addr, llid, plid, reason);
842			break;
843		case OPN_ACPT:
844			llid = sta->llid;
845			spin_unlock_bh(&sta->lock);
846			mesh_plink_frame_tx(sdata,
847					    WLAN_SP_MESH_PEERING_CONFIRM,
848					    sta->sta.addr, llid, plid, 0);
849			break;
850		default:
851			spin_unlock_bh(&sta->lock);
852			break;
853		}
854		break;
855	case NL80211_PLINK_HOLDING:
856		switch (event) {
857		case CLS_ACPT:
858			if (del_timer(&sta->plink_timer))
859				sta->ignore_plink_timer = 1;
860			mesh_plink_fsm_restart(sta);
861			spin_unlock_bh(&sta->lock);
862			break;
863		case OPN_ACPT:
864		case CNF_ACPT:
865		case OPN_RJCT:
866		case CNF_RJCT:
867			llid = sta->llid;
868			reason = sta->reason;
869			spin_unlock_bh(&sta->lock);
870			mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
871					    sta->sta.addr, llid, plid, reason);
872			break;
873		default:
874			spin_unlock_bh(&sta->lock);
875		}
876		break;
877	default:
878		/* should not get here, PLINK_BLOCKED is dealt with at the
879		 * beginning of the function
880		 */
881		spin_unlock_bh(&sta->lock);
882		break;
883	}
884
885	rcu_read_unlock();
886}
887