1 /* 2 * Copyright (c) 2008, 2009 open80211s Ltd. 3 * Author: Luis Carlos Cobo <luisca@cozybit.com> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 */ 9 #include <linux/gfp.h> 10 #include <linux/kernel.h> 11 #include <linux/random.h> 12 #include "ieee80211_i.h" 13 #include "rate.h" 14 #include "mesh.h" 15 16 #define PLINK_GET_LLID(p) (p + 2) 17 #define PLINK_GET_PLID(p) (p + 4) 18 19 #define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \ 20 jiffies + HZ * t / 1000)) 21 22 /* We only need a valid sta if user configured a minimum rssi_threshold. */ 23 #define rssi_threshold_check(sta, sdata) \ 24 (sdata->u.mesh.mshcfg.rssi_threshold == 0 ||\ 25 (sta && (s8) -ewma_read(&sta->avg_signal) > \ 26 sdata->u.mesh.mshcfg.rssi_threshold)) 27 28 enum plink_event { 29 PLINK_UNDEFINED, 30 OPN_ACPT, 31 OPN_RJCT, 32 OPN_IGNR, 33 CNF_ACPT, 34 CNF_RJCT, 35 CNF_IGNR, 36 CLS_ACPT, 37 CLS_IGNR 38 }; 39 40 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata, 41 enum ieee80211_self_protected_actioncode action, 42 u8 *da, __le16 llid, __le16 plid, __le16 reason); 43 44 static inline 45 u32 mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata) 46 { 47 atomic_inc(&sdata->u.mesh.estab_plinks); 48 return mesh_accept_plinks_update(sdata); 49 } 50 51 static inline 52 u32 mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata) 53 { 54 atomic_dec(&sdata->u.mesh.estab_plinks); 55 return mesh_accept_plinks_update(sdata); 56 } 57 58 /** 59 * mesh_plink_fsm_restart - restart a mesh peer link finite state machine 60 * 61 * @sta: mesh peer link to restart 62 * 63 * Locking: this function must be called holding sta->lock 64 */ 65 static inline void mesh_plink_fsm_restart(struct sta_info *sta) 66 { 67 sta->plink_state = NL80211_PLINK_LISTEN; 68 sta->llid = sta->plid = sta->reason = 0; 69 sta->plink_retries = 0; 70 } 71 72 /* 73 * Allocate mesh sta entry and insert into station table 74 */ 75 static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata, 76 u8 *hw_addr) 77 { 78 struct sta_info *sta; 79 80 if (sdata->local->num_sta >= MESH_MAX_PLINKS) 81 return NULL; 82 83 sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL); 84 if (!sta) 85 return NULL; 86 87 sta_info_pre_move_state(sta, IEEE80211_STA_AUTH); 88 sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC); 89 sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED); 90 91 set_sta_flag(sta, WLAN_STA_WME); 92 93 return sta; 94 } 95 96 /** 97 * mesh_set_ht_prot_mode - set correct HT protection mode 98 * 99 * Section 9.23.3.5 of IEEE 80211-2012 describes the protection rules for HT 100 * mesh STA in a MBSS. Three HT protection modes are supported for now, non-HT 101 * mixed mode, 20MHz-protection and no-protection mode. non-HT mixed mode is 102 * selected if any non-HT peers are present in our MBSS. 20MHz-protection mode 103 * is selected if all peers in our 20/40MHz MBSS support HT and atleast one 104 * HT20 peer is present. Otherwise no-protection mode is selected. 105 */ 106 static u32 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata) 107 { 108 struct ieee80211_local *local = sdata->local; 109 struct sta_info *sta; 110 u32 changed = 0; 111 u16 ht_opmode; 112 bool non_ht_sta = false, ht20_sta = false; 113 114 if (sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT) 115 return 0; 116 117 rcu_read_lock(); 118 list_for_each_entry_rcu(sta, &local->sta_list, list) { 119 if (sdata != sta->sdata || 120 sta->plink_state != NL80211_PLINK_ESTAB) 121 continue; 122 123 switch (sta->ch_width) { 124 case NL80211_CHAN_WIDTH_20_NOHT: 125 mpl_dbg(sdata, 126 "mesh_plink %pM: nonHT sta (%pM) is present\n", 127 sdata->vif.addr, sta->sta.addr); 128 non_ht_sta = true; 129 goto out; 130 case NL80211_CHAN_WIDTH_20: 131 mpl_dbg(sdata, 132 "mesh_plink %pM: HT20 sta (%pM) is present\n", 133 sdata->vif.addr, sta->sta.addr); 134 ht20_sta = true; 135 default: 136 break; 137 } 138 } 139 out: 140 rcu_read_unlock(); 141 142 if (non_ht_sta) 143 ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED; 144 else if (ht20_sta && 145 sdata->vif.bss_conf.chandef.width > NL80211_CHAN_WIDTH_20) 146 ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_20MHZ; 147 else 148 ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONE; 149 150 if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) { 151 sdata->vif.bss_conf.ht_operation_mode = ht_opmode; 152 sdata->u.mesh.mshcfg.ht_opmode = ht_opmode; 153 changed = BSS_CHANGED_HT; 154 mpl_dbg(sdata, 155 "mesh_plink %pM: protection mode changed to %d\n", 156 sdata->vif.addr, ht_opmode); 157 } 158 159 return changed; 160 } 161 162 /** 163 * __mesh_plink_deactivate - deactivate mesh peer link 164 * 165 * @sta: mesh peer link to deactivate 166 * 167 * All mesh paths with this peer as next hop will be flushed 168 * Returns beacon changed flag if the beacon content changed. 169 * 170 * Locking: the caller must hold sta->lock 171 */ 172 static u32 __mesh_plink_deactivate(struct sta_info *sta) 173 { 174 struct ieee80211_sub_if_data *sdata = sta->sdata; 175 u32 changed = 0; 176 177 if (sta->plink_state == NL80211_PLINK_ESTAB) 178 changed = mesh_plink_dec_estab_count(sdata); 179 sta->plink_state = NL80211_PLINK_BLOCKED; 180 mesh_path_flush_by_nexthop(sta); 181 182 return changed; 183 } 184 185 /** 186 * mesh_plink_deactivate - deactivate mesh peer link 187 * 188 * @sta: mesh peer link to deactivate 189 * 190 * All mesh paths with this peer as next hop will be flushed 191 */ 192 void mesh_plink_deactivate(struct sta_info *sta) 193 { 194 struct ieee80211_sub_if_data *sdata = sta->sdata; 195 u32 changed; 196 197 spin_lock_bh(&sta->lock); 198 changed = __mesh_plink_deactivate(sta); 199 sta->reason = cpu_to_le16(WLAN_REASON_MESH_PEER_CANCELED); 200 mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, 201 sta->sta.addr, sta->llid, sta->plid, 202 sta->reason); 203 spin_unlock_bh(&sta->lock); 204 205 ieee80211_bss_info_change_notify(sdata, changed); 206 } 207 208 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata, 209 enum ieee80211_self_protected_actioncode action, 210 u8 *da, __le16 llid, __le16 plid, __le16 reason) { 211 struct ieee80211_local *local = sdata->local; 212 struct sk_buff *skb; 213 struct ieee80211_tx_info *info; 214 struct ieee80211_mgmt *mgmt; 215 bool include_plid = false; 216 u16 peering_proto = 0; 217 u8 *pos, ie_len = 4; 218 int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) + 219 sizeof(mgmt->u.action.u.self_prot); 220 int err = -ENOMEM; 221 222 skb = dev_alloc_skb(local->tx_headroom + 223 hdr_len + 224 2 + /* capability info */ 225 2 + /* AID */ 226 2 + 8 + /* supported rates */ 227 2 + (IEEE80211_MAX_SUPP_RATES - 8) + 228 2 + sdata->u.mesh.mesh_id_len + 229 2 + sizeof(struct ieee80211_meshconf_ie) + 230 2 + sizeof(struct ieee80211_ht_cap) + 231 2 + sizeof(struct ieee80211_ht_operation) + 232 2 + 8 + /* peering IE */ 233 sdata->u.mesh.ie_len); 234 if (!skb) 235 return -1; 236 info = IEEE80211_SKB_CB(skb); 237 skb_reserve(skb, local->tx_headroom); 238 mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len); 239 memset(mgmt, 0, hdr_len); 240 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 241 IEEE80211_STYPE_ACTION); 242 memcpy(mgmt->da, da, ETH_ALEN); 243 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); 244 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN); 245 mgmt->u.action.category = WLAN_CATEGORY_SELF_PROTECTED; 246 mgmt->u.action.u.self_prot.action_code = action; 247 248 if (action != WLAN_SP_MESH_PEERING_CLOSE) { 249 enum ieee80211_band band = ieee80211_get_sdata_band(sdata); 250 251 /* capability info */ 252 pos = skb_put(skb, 2); 253 memset(pos, 0, 2); 254 if (action == WLAN_SP_MESH_PEERING_CONFIRM) { 255 /* AID */ 256 pos = skb_put(skb, 2); 257 memcpy(pos + 2, &plid, 2); 258 } 259 if (ieee80211_add_srates_ie(sdata, skb, true, band) || 260 ieee80211_add_ext_srates_ie(sdata, skb, true, band) || 261 mesh_add_rsn_ie(skb, sdata) || 262 mesh_add_meshid_ie(skb, sdata) || 263 mesh_add_meshconf_ie(skb, sdata)) 264 goto free; 265 } else { /* WLAN_SP_MESH_PEERING_CLOSE */ 266 info->flags |= IEEE80211_TX_CTL_NO_ACK; 267 if (mesh_add_meshid_ie(skb, sdata)) 268 goto free; 269 } 270 271 /* Add Mesh Peering Management element */ 272 switch (action) { 273 case WLAN_SP_MESH_PEERING_OPEN: 274 break; 275 case WLAN_SP_MESH_PEERING_CONFIRM: 276 ie_len += 2; 277 include_plid = true; 278 break; 279 case WLAN_SP_MESH_PEERING_CLOSE: 280 if (plid) { 281 ie_len += 2; 282 include_plid = true; 283 } 284 ie_len += 2; /* reason code */ 285 break; 286 default: 287 err = -EINVAL; 288 goto free; 289 } 290 291 if (WARN_ON(skb_tailroom(skb) < 2 + ie_len)) 292 goto free; 293 294 pos = skb_put(skb, 2 + ie_len); 295 *pos++ = WLAN_EID_PEER_MGMT; 296 *pos++ = ie_len; 297 memcpy(pos, &peering_proto, 2); 298 pos += 2; 299 memcpy(pos, &llid, 2); 300 pos += 2; 301 if (include_plid) { 302 memcpy(pos, &plid, 2); 303 pos += 2; 304 } 305 if (action == WLAN_SP_MESH_PEERING_CLOSE) { 306 memcpy(pos, &reason, 2); 307 pos += 2; 308 } 309 310 if (action != WLAN_SP_MESH_PEERING_CLOSE) { 311 if (mesh_add_ht_cap_ie(skb, sdata) || 312 mesh_add_ht_oper_ie(skb, sdata)) 313 goto free; 314 } 315 316 if (mesh_add_vendor_ies(skb, sdata)) 317 goto free; 318 319 ieee80211_tx_skb(sdata, skb); 320 return 0; 321 free: 322 kfree_skb(skb); 323 return err; 324 } 325 326 /** 327 * mesh_peer_init - initialize new mesh peer and return resulting sta_info 328 * 329 * @sdata: local meshif 330 * @addr: peer's address 331 * @elems: IEs from beacon or mesh peering frame 332 * 333 * call under RCU 334 */ 335 static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata, 336 u8 *addr, 337 struct ieee802_11_elems *elems) 338 { 339 struct ieee80211_local *local = sdata->local; 340 enum ieee80211_band band = ieee80211_get_sdata_band(sdata); 341 struct ieee80211_supported_band *sband; 342 u32 rates, basic_rates = 0; 343 struct sta_info *sta; 344 bool insert = false; 345 346 sband = local->hw.wiphy->bands[band]; 347 rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates); 348 349 sta = sta_info_get(sdata, addr); 350 if (!sta) { 351 /* Userspace handles peer allocation when security is enabled */ 352 if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) { 353 cfg80211_notify_new_peer_candidate(sdata->dev, addr, 354 elems->ie_start, 355 elems->total_len, 356 GFP_ATOMIC); 357 return NULL; 358 } 359 360 sta = mesh_plink_alloc(sdata, addr); 361 if (!sta) 362 return NULL; 363 insert = true; 364 } 365 366 spin_lock_bh(&sta->lock); 367 sta->last_rx = jiffies; 368 if (sta->plink_state == NL80211_PLINK_ESTAB) { 369 spin_unlock_bh(&sta->lock); 370 return sta; 371 } 372 373 sta->sta.supp_rates[band] = rates; 374 if (elems->ht_cap_elem && 375 sdata->vif.bss_conf.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) 376 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband, 377 elems->ht_cap_elem, 378 &sta->sta.ht_cap); 379 else 380 memset(&sta->sta.ht_cap, 0, sizeof(sta->sta.ht_cap)); 381 382 if (elems->ht_operation) { 383 struct cfg80211_chan_def chandef; 384 385 if (!(elems->ht_operation->ht_param & 386 IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) 387 sta->sta.ht_cap.cap &= 388 ~IEEE80211_HT_CAP_SUP_WIDTH_20_40; 389 ieee80211_ht_oper_to_chandef(sdata->vif.bss_conf.chandef.chan, 390 elems->ht_operation, &chandef); 391 sta->ch_width = chandef.width; 392 } 393 394 if (insert) 395 rate_control_rate_init(sta); 396 spin_unlock_bh(&sta->lock); 397 398 if (insert && sta_info_insert(sta)) 399 return NULL; 400 401 return sta; 402 } 403 404 void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata, 405 u8 *hw_addr, 406 struct ieee802_11_elems *elems) 407 { 408 struct sta_info *sta; 409 410 rcu_read_lock(); 411 sta = mesh_peer_init(sdata, hw_addr, elems); 412 if (!sta) 413 goto out; 414 415 if (mesh_peer_accepts_plinks(elems) && 416 sta->plink_state == NL80211_PLINK_LISTEN && 417 sdata->u.mesh.accepting_plinks && 418 sdata->u.mesh.mshcfg.auto_open_plinks && 419 rssi_threshold_check(sta, sdata)) 420 mesh_plink_open(sta); 421 422 out: 423 rcu_read_unlock(); 424 } 425 426 static void mesh_plink_timer(unsigned long data) 427 { 428 struct sta_info *sta; 429 __le16 llid, plid, reason; 430 struct ieee80211_sub_if_data *sdata; 431 struct mesh_config *mshcfg; 432 433 /* 434 * This STA is valid because sta_info_destroy() will 435 * del_timer_sync() this timer after having made sure 436 * it cannot be readded (by deleting the plink.) 437 */ 438 sta = (struct sta_info *) data; 439 440 if (sta->sdata->local->quiescing) { 441 sta->plink_timer_was_running = true; 442 return; 443 } 444 445 spin_lock_bh(&sta->lock); 446 if (sta->ignore_plink_timer) { 447 sta->ignore_plink_timer = false; 448 spin_unlock_bh(&sta->lock); 449 return; 450 } 451 mpl_dbg(sta->sdata, 452 "Mesh plink timer for %pM fired on state %d\n", 453 sta->sta.addr, sta->plink_state); 454 reason = 0; 455 llid = sta->llid; 456 plid = sta->plid; 457 sdata = sta->sdata; 458 mshcfg = &sdata->u.mesh.mshcfg; 459 460 switch (sta->plink_state) { 461 case NL80211_PLINK_OPN_RCVD: 462 case NL80211_PLINK_OPN_SNT: 463 /* retry timer */ 464 if (sta->plink_retries < mshcfg->dot11MeshMaxRetries) { 465 u32 rand; 466 mpl_dbg(sta->sdata, 467 "Mesh plink for %pM (retry, timeout): %d %d\n", 468 sta->sta.addr, sta->plink_retries, 469 sta->plink_timeout); 470 get_random_bytes(&rand, sizeof(u32)); 471 sta->plink_timeout = sta->plink_timeout + 472 rand % sta->plink_timeout; 473 ++sta->plink_retries; 474 mod_plink_timer(sta, sta->plink_timeout); 475 spin_unlock_bh(&sta->lock); 476 mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN, 477 sta->sta.addr, llid, 0, 0); 478 break; 479 } 480 reason = cpu_to_le16(WLAN_REASON_MESH_MAX_RETRIES); 481 /* fall through on else */ 482 case NL80211_PLINK_CNF_RCVD: 483 /* confirm timer */ 484 if (!reason) 485 reason = cpu_to_le16(WLAN_REASON_MESH_CONFIRM_TIMEOUT); 486 sta->plink_state = NL80211_PLINK_HOLDING; 487 mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout); 488 spin_unlock_bh(&sta->lock); 489 mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, 490 sta->sta.addr, llid, plid, reason); 491 break; 492 case NL80211_PLINK_HOLDING: 493 /* holding timer */ 494 del_timer(&sta->plink_timer); 495 mesh_plink_fsm_restart(sta); 496 spin_unlock_bh(&sta->lock); 497 break; 498 default: 499 spin_unlock_bh(&sta->lock); 500 break; 501 } 502 } 503 504 #ifdef CONFIG_PM 505 void mesh_plink_quiesce(struct sta_info *sta) 506 { 507 if (del_timer_sync(&sta->plink_timer)) 508 sta->plink_timer_was_running = true; 509 } 510 511 void mesh_plink_restart(struct sta_info *sta) 512 { 513 if (sta->plink_timer_was_running) { 514 add_timer(&sta->plink_timer); 515 sta->plink_timer_was_running = false; 516 } 517 } 518 #endif 519 520 static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout) 521 { 522 sta->plink_timer.expires = jiffies + (HZ * timeout / 1000); 523 sta->plink_timer.data = (unsigned long) sta; 524 sta->plink_timer.function = mesh_plink_timer; 525 sta->plink_timeout = timeout; 526 add_timer(&sta->plink_timer); 527 } 528 529 int mesh_plink_open(struct sta_info *sta) 530 { 531 __le16 llid; 532 struct ieee80211_sub_if_data *sdata = sta->sdata; 533 534 if (!test_sta_flag(sta, WLAN_STA_AUTH)) 535 return -EPERM; 536 537 spin_lock_bh(&sta->lock); 538 get_random_bytes(&llid, 2); 539 sta->llid = llid; 540 if (sta->plink_state != NL80211_PLINK_LISTEN && 541 sta->plink_state != NL80211_PLINK_BLOCKED) { 542 spin_unlock_bh(&sta->lock); 543 return -EBUSY; 544 } 545 sta->plink_state = NL80211_PLINK_OPN_SNT; 546 mesh_plink_timer_set(sta, sdata->u.mesh.mshcfg.dot11MeshRetryTimeout); 547 spin_unlock_bh(&sta->lock); 548 mpl_dbg(sdata, 549 "Mesh plink: starting establishment with %pM\n", 550 sta->sta.addr); 551 552 return mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN, 553 sta->sta.addr, llid, 0, 0); 554 } 555 556 void mesh_plink_block(struct sta_info *sta) 557 { 558 struct ieee80211_sub_if_data *sdata = sta->sdata; 559 u32 changed; 560 561 spin_lock_bh(&sta->lock); 562 changed = __mesh_plink_deactivate(sta); 563 sta->plink_state = NL80211_PLINK_BLOCKED; 564 spin_unlock_bh(&sta->lock); 565 566 ieee80211_bss_info_change_notify(sdata, changed); 567 } 568 569 570 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, 571 size_t len, struct ieee80211_rx_status *rx_status) 572 { 573 struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg; 574 struct ieee802_11_elems elems; 575 struct sta_info *sta; 576 enum plink_event event; 577 enum ieee80211_self_protected_actioncode ftype; 578 size_t baselen; 579 bool matches_local = true; 580 u8 ie_len; 581 u8 *baseaddr; 582 u32 changed = 0; 583 __le16 plid, llid, reason; 584 static const char *mplstates[] = { 585 [NL80211_PLINK_LISTEN] = "LISTEN", 586 [NL80211_PLINK_OPN_SNT] = "OPN-SNT", 587 [NL80211_PLINK_OPN_RCVD] = "OPN-RCVD", 588 [NL80211_PLINK_CNF_RCVD] = "CNF_RCVD", 589 [NL80211_PLINK_ESTAB] = "ESTAB", 590 [NL80211_PLINK_HOLDING] = "HOLDING", 591 [NL80211_PLINK_BLOCKED] = "BLOCKED" 592 }; 593 594 /* need action_code, aux */ 595 if (len < IEEE80211_MIN_ACTION_SIZE + 3) 596 return; 597 598 if (is_multicast_ether_addr(mgmt->da)) { 599 mpl_dbg(sdata, 600 "Mesh plink: ignore frame from multicast address\n"); 601 return; 602 } 603 604 baseaddr = mgmt->u.action.u.self_prot.variable; 605 baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt; 606 if (mgmt->u.action.u.self_prot.action_code == 607 WLAN_SP_MESH_PEERING_CONFIRM) { 608 baseaddr += 4; 609 baselen += 4; 610 } 611 ieee802_11_parse_elems(baseaddr, len - baselen, &elems); 612 if (!elems.peering) { 613 mpl_dbg(sdata, 614 "Mesh plink: missing necessary peer link ie\n"); 615 return; 616 } 617 if (elems.rsn_len && 618 sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) { 619 mpl_dbg(sdata, 620 "Mesh plink: can't establish link with secure peer\n"); 621 return; 622 } 623 624 ftype = mgmt->u.action.u.self_prot.action_code; 625 ie_len = elems.peering_len; 626 if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) || 627 (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) || 628 (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6 629 && ie_len != 8)) { 630 mpl_dbg(sdata, 631 "Mesh plink: incorrect plink ie length %d %d\n", 632 ftype, ie_len); 633 return; 634 } 635 636 if (ftype != WLAN_SP_MESH_PEERING_CLOSE && 637 (!elems.mesh_id || !elems.mesh_config)) { 638 mpl_dbg(sdata, "Mesh plink: missing necessary ie\n"); 639 return; 640 } 641 /* Note the lines below are correct, the llid in the frame is the plid 642 * from the point of view of this host. 643 */ 644 memcpy(&plid, PLINK_GET_LLID(elems.peering), 2); 645 if (ftype == WLAN_SP_MESH_PEERING_CONFIRM || 646 (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8)) 647 memcpy(&llid, PLINK_GET_PLID(elems.peering), 2); 648 649 rcu_read_lock(); 650 651 sta = sta_info_get(sdata, mgmt->sa); 652 if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) { 653 mpl_dbg(sdata, "Mesh plink: cls or cnf from unknown peer\n"); 654 rcu_read_unlock(); 655 return; 656 } 657 658 if (ftype == WLAN_SP_MESH_PEERING_OPEN && 659 !rssi_threshold_check(sta, sdata)) { 660 mpl_dbg(sdata, "Mesh plink: %pM does not meet rssi threshold\n", 661 mgmt->sa); 662 rcu_read_unlock(); 663 return; 664 } 665 666 if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) { 667 mpl_dbg(sdata, "Mesh plink: Action frame from non-authed peer\n"); 668 rcu_read_unlock(); 669 return; 670 } 671 672 if (sta && sta->plink_state == NL80211_PLINK_BLOCKED) { 673 rcu_read_unlock(); 674 return; 675 } 676 677 /* Now we will figure out the appropriate event... */ 678 event = PLINK_UNDEFINED; 679 if (ftype != WLAN_SP_MESH_PEERING_CLOSE && 680 !mesh_matches_local(sdata, &elems)) { 681 matches_local = false; 682 switch (ftype) { 683 case WLAN_SP_MESH_PEERING_OPEN: 684 event = OPN_RJCT; 685 break; 686 case WLAN_SP_MESH_PEERING_CONFIRM: 687 event = CNF_RJCT; 688 break; 689 default: 690 break; 691 } 692 } 693 694 if (!sta && !matches_local) { 695 rcu_read_unlock(); 696 reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); 697 llid = 0; 698 mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, 699 mgmt->sa, llid, plid, reason); 700 return; 701 } else if (!sta) { 702 /* ftype == WLAN_SP_MESH_PEERING_OPEN */ 703 if (!mesh_plink_free_count(sdata)) { 704 mpl_dbg(sdata, "Mesh plink error: no more free plinks\n"); 705 rcu_read_unlock(); 706 return; 707 } 708 event = OPN_ACPT; 709 } else if (matches_local) { 710 switch (ftype) { 711 case WLAN_SP_MESH_PEERING_OPEN: 712 if (!mesh_plink_free_count(sdata) || 713 (sta->plid && sta->plid != plid)) 714 event = OPN_IGNR; 715 else 716 event = OPN_ACPT; 717 break; 718 case WLAN_SP_MESH_PEERING_CONFIRM: 719 if (!mesh_plink_free_count(sdata) || 720 (sta->llid != llid || sta->plid != plid)) 721 event = CNF_IGNR; 722 else 723 event = CNF_ACPT; 724 break; 725 case WLAN_SP_MESH_PEERING_CLOSE: 726 if (sta->plink_state == NL80211_PLINK_ESTAB) 727 /* Do not check for llid or plid. This does not 728 * follow the standard but since multiple plinks 729 * per sta are not supported, it is necessary in 730 * order to avoid a livelock when MP A sees an 731 * establish peer link to MP B but MP B does not 732 * see it. This can be caused by a timeout in 733 * B's peer link establishment or B beign 734 * restarted. 735 */ 736 event = CLS_ACPT; 737 else if (sta->plid != plid) 738 event = CLS_IGNR; 739 else if (ie_len == 7 && sta->llid != llid) 740 event = CLS_IGNR; 741 else 742 event = CLS_ACPT; 743 break; 744 default: 745 mpl_dbg(sdata, "Mesh plink: unknown frame subtype\n"); 746 rcu_read_unlock(); 747 return; 748 } 749 } 750 751 if (event == OPN_ACPT) { 752 /* allocate sta entry if necessary and update info */ 753 sta = mesh_peer_init(sdata, mgmt->sa, &elems); 754 if (!sta) { 755 mpl_dbg(sdata, "Mesh plink: failed to init peer!\n"); 756 rcu_read_unlock(); 757 return; 758 } 759 } 760 761 mpl_dbg(sdata, 762 "Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n", 763 mgmt->sa, mplstates[sta->plink_state], 764 le16_to_cpu(sta->llid), le16_to_cpu(sta->plid), 765 event); 766 reason = 0; 767 spin_lock_bh(&sta->lock); 768 switch (sta->plink_state) { 769 /* spin_unlock as soon as state is updated at each case */ 770 case NL80211_PLINK_LISTEN: 771 switch (event) { 772 case CLS_ACPT: 773 mesh_plink_fsm_restart(sta); 774 spin_unlock_bh(&sta->lock); 775 break; 776 case OPN_ACPT: 777 sta->plink_state = NL80211_PLINK_OPN_RCVD; 778 sta->plid = plid; 779 get_random_bytes(&llid, 2); 780 sta->llid = llid; 781 mesh_plink_timer_set(sta, 782 mshcfg->dot11MeshRetryTimeout); 783 spin_unlock_bh(&sta->lock); 784 mesh_plink_frame_tx(sdata, 785 WLAN_SP_MESH_PEERING_OPEN, 786 sta->sta.addr, llid, 0, 0); 787 mesh_plink_frame_tx(sdata, 788 WLAN_SP_MESH_PEERING_CONFIRM, 789 sta->sta.addr, llid, plid, 0); 790 break; 791 default: 792 spin_unlock_bh(&sta->lock); 793 break; 794 } 795 break; 796 797 case NL80211_PLINK_OPN_SNT: 798 switch (event) { 799 case OPN_RJCT: 800 case CNF_RJCT: 801 reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); 802 case CLS_ACPT: 803 if (!reason) 804 reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); 805 sta->reason = reason; 806 sta->plink_state = NL80211_PLINK_HOLDING; 807 if (!mod_plink_timer(sta, 808 mshcfg->dot11MeshHoldingTimeout)) 809 sta->ignore_plink_timer = true; 810 811 llid = sta->llid; 812 spin_unlock_bh(&sta->lock); 813 mesh_plink_frame_tx(sdata, 814 WLAN_SP_MESH_PEERING_CLOSE, 815 sta->sta.addr, llid, plid, reason); 816 break; 817 case OPN_ACPT: 818 /* retry timer is left untouched */ 819 sta->plink_state = NL80211_PLINK_OPN_RCVD; 820 sta->plid = plid; 821 llid = sta->llid; 822 spin_unlock_bh(&sta->lock); 823 mesh_plink_frame_tx(sdata, 824 WLAN_SP_MESH_PEERING_CONFIRM, 825 sta->sta.addr, llid, plid, 0); 826 break; 827 case CNF_ACPT: 828 sta->plink_state = NL80211_PLINK_CNF_RCVD; 829 if (!mod_plink_timer(sta, 830 mshcfg->dot11MeshConfirmTimeout)) 831 sta->ignore_plink_timer = true; 832 833 spin_unlock_bh(&sta->lock); 834 break; 835 default: 836 spin_unlock_bh(&sta->lock); 837 break; 838 } 839 break; 840 841 case NL80211_PLINK_OPN_RCVD: 842 switch (event) { 843 case OPN_RJCT: 844 case CNF_RJCT: 845 reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); 846 case CLS_ACPT: 847 if (!reason) 848 reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); 849 sta->reason = reason; 850 sta->plink_state = NL80211_PLINK_HOLDING; 851 if (!mod_plink_timer(sta, 852 mshcfg->dot11MeshHoldingTimeout)) 853 sta->ignore_plink_timer = true; 854 855 llid = sta->llid; 856 spin_unlock_bh(&sta->lock); 857 mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, 858 sta->sta.addr, llid, plid, reason); 859 break; 860 case OPN_ACPT: 861 llid = sta->llid; 862 spin_unlock_bh(&sta->lock); 863 mesh_plink_frame_tx(sdata, 864 WLAN_SP_MESH_PEERING_CONFIRM, 865 sta->sta.addr, llid, plid, 0); 866 break; 867 case CNF_ACPT: 868 del_timer(&sta->plink_timer); 869 sta->plink_state = NL80211_PLINK_ESTAB; 870 spin_unlock_bh(&sta->lock); 871 changed |= mesh_plink_inc_estab_count(sdata); 872 changed |= mesh_set_ht_prot_mode(sdata); 873 mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n", 874 sta->sta.addr); 875 break; 876 default: 877 spin_unlock_bh(&sta->lock); 878 break; 879 } 880 break; 881 882 case NL80211_PLINK_CNF_RCVD: 883 switch (event) { 884 case OPN_RJCT: 885 case CNF_RJCT: 886 reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); 887 case CLS_ACPT: 888 if (!reason) 889 reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); 890 sta->reason = reason; 891 sta->plink_state = NL80211_PLINK_HOLDING; 892 if (!mod_plink_timer(sta, 893 mshcfg->dot11MeshHoldingTimeout)) 894 sta->ignore_plink_timer = true; 895 896 llid = sta->llid; 897 spin_unlock_bh(&sta->lock); 898 mesh_plink_frame_tx(sdata, 899 WLAN_SP_MESH_PEERING_CLOSE, 900 sta->sta.addr, llid, plid, reason); 901 break; 902 case OPN_ACPT: 903 del_timer(&sta->plink_timer); 904 sta->plink_state = NL80211_PLINK_ESTAB; 905 spin_unlock_bh(&sta->lock); 906 changed |= mesh_plink_inc_estab_count(sdata); 907 changed |= mesh_set_ht_prot_mode(sdata); 908 mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n", 909 sta->sta.addr); 910 mesh_plink_frame_tx(sdata, 911 WLAN_SP_MESH_PEERING_CONFIRM, 912 sta->sta.addr, llid, plid, 0); 913 break; 914 default: 915 spin_unlock_bh(&sta->lock); 916 break; 917 } 918 break; 919 920 case NL80211_PLINK_ESTAB: 921 switch (event) { 922 case CLS_ACPT: 923 reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); 924 sta->reason = reason; 925 changed |= __mesh_plink_deactivate(sta); 926 sta->plink_state = NL80211_PLINK_HOLDING; 927 llid = sta->llid; 928 mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout); 929 spin_unlock_bh(&sta->lock); 930 changed |= mesh_set_ht_prot_mode(sdata); 931 mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, 932 sta->sta.addr, llid, plid, reason); 933 break; 934 case OPN_ACPT: 935 llid = sta->llid; 936 spin_unlock_bh(&sta->lock); 937 mesh_plink_frame_tx(sdata, 938 WLAN_SP_MESH_PEERING_CONFIRM, 939 sta->sta.addr, llid, plid, 0); 940 break; 941 default: 942 spin_unlock_bh(&sta->lock); 943 break; 944 } 945 break; 946 case NL80211_PLINK_HOLDING: 947 switch (event) { 948 case CLS_ACPT: 949 if (del_timer(&sta->plink_timer)) 950 sta->ignore_plink_timer = 1; 951 mesh_plink_fsm_restart(sta); 952 spin_unlock_bh(&sta->lock); 953 break; 954 case OPN_ACPT: 955 case CNF_ACPT: 956 case OPN_RJCT: 957 case CNF_RJCT: 958 llid = sta->llid; 959 reason = sta->reason; 960 spin_unlock_bh(&sta->lock); 961 mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, 962 sta->sta.addr, llid, plid, reason); 963 break; 964 default: 965 spin_unlock_bh(&sta->lock); 966 } 967 break; 968 default: 969 /* should not get here, PLINK_BLOCKED is dealt with at the 970 * beginning of the function 971 */ 972 spin_unlock_bh(&sta->lock); 973 break; 974 } 975 976 rcu_read_unlock(); 977 978 if (changed) 979 ieee80211_bss_info_change_notify(sdata, changed); 980 } 981