1/*
2 * Copyright (c) 2008, 2009 open80211s Ltd.
3 * Author:     Luis Carlos Cobo <luisca@cozybit.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9#include <linux/gfp.h>
10#include <linux/kernel.h>
11#include <linux/random.h>
12#include "ieee80211_i.h"
13#include "rate.h"
14#include "mesh.h"
15
16#define PLINK_GET_LLID(p) (p + 2)
17#define PLINK_GET_PLID(p) (p + 4)
18
19#define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
20				jiffies + msecs_to_jiffies(t)))
21
22enum plink_event {
23	PLINK_UNDEFINED,
24	OPN_ACPT,
25	OPN_RJCT,
26	OPN_IGNR,
27	CNF_ACPT,
28	CNF_RJCT,
29	CNF_IGNR,
30	CLS_ACPT,
31	CLS_IGNR
32};
33
34static const char * const mplstates[] = {
35	[NL80211_PLINK_LISTEN] = "LISTEN",
36	[NL80211_PLINK_OPN_SNT] = "OPN-SNT",
37	[NL80211_PLINK_OPN_RCVD] = "OPN-RCVD",
38	[NL80211_PLINK_CNF_RCVD] = "CNF_RCVD",
39	[NL80211_PLINK_ESTAB] = "ESTAB",
40	[NL80211_PLINK_HOLDING] = "HOLDING",
41	[NL80211_PLINK_BLOCKED] = "BLOCKED"
42};
43
44static const char * const mplevents[] = {
45	[PLINK_UNDEFINED] = "NONE",
46	[OPN_ACPT] = "OPN_ACPT",
47	[OPN_RJCT] = "OPN_RJCT",
48	[OPN_IGNR] = "OPN_IGNR",
49	[CNF_ACPT] = "CNF_ACPT",
50	[CNF_RJCT] = "CNF_RJCT",
51	[CNF_IGNR] = "CNF_IGNR",
52	[CLS_ACPT] = "CLS_ACPT",
53	[CLS_IGNR] = "CLS_IGNR"
54};
55
56static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
57			       enum ieee80211_self_protected_actioncode action,
58			       u8 *da, u16 llid, u16 plid, u16 reason);
59
60
61/* We only need a valid sta if user configured a minimum rssi_threshold. */
62static bool rssi_threshold_check(struct ieee80211_sub_if_data *sdata,
63				 struct sta_info *sta)
64{
65	s32 rssi_threshold = sdata->u.mesh.mshcfg.rssi_threshold;
66	return rssi_threshold == 0 ||
67	       (sta && (s8) -ewma_read(&sta->avg_signal) > rssi_threshold);
68}
69
70/**
71 * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
72 *
73 * @sta: mesh peer link to restart
74 *
75 * Locking: this function must be called holding sta->lock
76 */
77static inline void mesh_plink_fsm_restart(struct sta_info *sta)
78{
79	sta->plink_state = NL80211_PLINK_LISTEN;
80	sta->llid = sta->plid = sta->reason = 0;
81	sta->plink_retries = 0;
82}
83
84/*
85 * mesh_set_short_slot_time - enable / disable ERP short slot time.
86 *
87 * The standard indirectly mandates mesh STAs to turn off short slot time by
88 * disallowing advertising this (802.11-2012 8.4.1.4), but that doesn't mean we
89 * can't be sneaky about it. Enable short slot time if all mesh STAs in the
90 * MBSS support ERP rates.
91 *
92 * Returns BSS_CHANGED_ERP_SLOT or 0 for no change.
93 */
94static u32 mesh_set_short_slot_time(struct ieee80211_sub_if_data *sdata)
95{
96	struct ieee80211_local *local = sdata->local;
97	enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
98	struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
99	struct sta_info *sta;
100	u32 erp_rates = 0, changed = 0;
101	int i;
102	bool short_slot = false;
103
104	if (band == IEEE80211_BAND_5GHZ) {
105		/* (IEEE 802.11-2012 19.4.5) */
106		short_slot = true;
107		goto out;
108	} else if (band != IEEE80211_BAND_2GHZ ||
109		   (band == IEEE80211_BAND_2GHZ &&
110		    local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
111		goto out;
112
113	for (i = 0; i < sband->n_bitrates; i++)
114		if (sband->bitrates[i].flags & IEEE80211_RATE_ERP_G)
115			erp_rates |= BIT(i);
116
117	if (!erp_rates)
118		goto out;
119
120	rcu_read_lock();
121	list_for_each_entry_rcu(sta, &local->sta_list, list) {
122		if (sdata != sta->sdata ||
123		    sta->plink_state != NL80211_PLINK_ESTAB)
124			continue;
125
126		short_slot = false;
127		if (erp_rates & sta->sta.supp_rates[band])
128			short_slot = true;
129		 else
130			break;
131	}
132	rcu_read_unlock();
133
134out:
135	if (sdata->vif.bss_conf.use_short_slot != short_slot) {
136		sdata->vif.bss_conf.use_short_slot = short_slot;
137		changed = BSS_CHANGED_ERP_SLOT;
138		mpl_dbg(sdata, "mesh_plink %pM: ERP short slot time %d\n",
139			sdata->vif.addr, short_slot);
140	}
141	return changed;
142}
143
144/**
145 * mesh_set_ht_prot_mode - set correct HT protection mode
146 *
147 * Section 9.23.3.5 of IEEE 80211-2012 describes the protection rules for HT
148 * mesh STA in a MBSS. Three HT protection modes are supported for now, non-HT
149 * mixed mode, 20MHz-protection and no-protection mode. non-HT mixed mode is
150 * selected if any non-HT peers are present in our MBSS.  20MHz-protection mode
151 * is selected if all peers in our 20/40MHz MBSS support HT and atleast one
152 * HT20 peer is present. Otherwise no-protection mode is selected.
153 */
154static u32 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata)
155{
156	struct ieee80211_local *local = sdata->local;
157	struct sta_info *sta;
158	u16 ht_opmode;
159	bool non_ht_sta = false, ht20_sta = false;
160
161	switch (sdata->vif.bss_conf.chandef.width) {
162	case NL80211_CHAN_WIDTH_20_NOHT:
163	case NL80211_CHAN_WIDTH_5:
164	case NL80211_CHAN_WIDTH_10:
165		return 0;
166	default:
167		break;
168	}
169
170	rcu_read_lock();
171	list_for_each_entry_rcu(sta, &local->sta_list, list) {
172		if (sdata != sta->sdata ||
173		    sta->plink_state != NL80211_PLINK_ESTAB)
174			continue;
175
176		if (sta->sta.bandwidth > IEEE80211_STA_RX_BW_20)
177			continue;
178
179		if (!sta->sta.ht_cap.ht_supported) {
180			mpl_dbg(sdata, "nonHT sta (%pM) is present\n",
181				       sta->sta.addr);
182			non_ht_sta = true;
183			break;
184		}
185
186		mpl_dbg(sdata, "HT20 sta (%pM) is present\n", sta->sta.addr);
187		ht20_sta = true;
188	}
189	rcu_read_unlock();
190
191	if (non_ht_sta)
192		ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED;
193	else if (ht20_sta &&
194		 sdata->vif.bss_conf.chandef.width > NL80211_CHAN_WIDTH_20)
195		ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_20MHZ;
196	else
197		ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
198
199	if (sdata->vif.bss_conf.ht_operation_mode == ht_opmode)
200		return 0;
201
202	sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
203	sdata->u.mesh.mshcfg.ht_opmode = ht_opmode;
204	mpl_dbg(sdata, "selected new HT protection mode %d\n", ht_opmode);
205	return BSS_CHANGED_HT;
206}
207
208/**
209 * __mesh_plink_deactivate - deactivate mesh peer link
210 *
211 * @sta: mesh peer link to deactivate
212 *
213 * All mesh paths with this peer as next hop will be flushed
214 * Returns beacon changed flag if the beacon content changed.
215 *
216 * Locking: the caller must hold sta->lock
217 */
218static u32 __mesh_plink_deactivate(struct sta_info *sta)
219{
220	struct ieee80211_sub_if_data *sdata = sta->sdata;
221	u32 changed = 0;
222
223	if (sta->plink_state == NL80211_PLINK_ESTAB)
224		changed = mesh_plink_dec_estab_count(sdata);
225	sta->plink_state = NL80211_PLINK_BLOCKED;
226	mesh_path_flush_by_nexthop(sta);
227
228	ieee80211_mps_sta_status_update(sta);
229	changed |= ieee80211_mps_set_sta_local_pm(sta,
230			NL80211_MESH_POWER_UNKNOWN);
231
232	return changed;
233}
234
235/**
236 * mesh_plink_deactivate - deactivate mesh peer link
237 *
238 * @sta: mesh peer link to deactivate
239 *
240 * All mesh paths with this peer as next hop will be flushed
241 */
242u32 mesh_plink_deactivate(struct sta_info *sta)
243{
244	struct ieee80211_sub_if_data *sdata = sta->sdata;
245	u32 changed;
246
247	spin_lock_bh(&sta->lock);
248	changed = __mesh_plink_deactivate(sta);
249	sta->reason = WLAN_REASON_MESH_PEER_CANCELED;
250	mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
251			    sta->sta.addr, sta->llid, sta->plid,
252			    sta->reason);
253	spin_unlock_bh(&sta->lock);
254
255	return changed;
256}
257
258static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
259			       enum ieee80211_self_protected_actioncode action,
260			       u8 *da, u16 llid, u16 plid, u16 reason)
261{
262	struct ieee80211_local *local = sdata->local;
263	struct sk_buff *skb;
264	struct ieee80211_tx_info *info;
265	struct ieee80211_mgmt *mgmt;
266	bool include_plid = false;
267	u16 peering_proto = 0;
268	u8 *pos, ie_len = 4;
269	int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
270		      sizeof(mgmt->u.action.u.self_prot);
271	int err = -ENOMEM;
272
273	skb = dev_alloc_skb(local->tx_headroom +
274			    hdr_len +
275			    2 + /* capability info */
276			    2 + /* AID */
277			    2 + 8 + /* supported rates */
278			    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
279			    2 + sdata->u.mesh.mesh_id_len +
280			    2 + sizeof(struct ieee80211_meshconf_ie) +
281			    2 + sizeof(struct ieee80211_ht_cap) +
282			    2 + sizeof(struct ieee80211_ht_operation) +
283			    2 + 8 + /* peering IE */
284			    sdata->u.mesh.ie_len);
285	if (!skb)
286		return err;
287	info = IEEE80211_SKB_CB(skb);
288	skb_reserve(skb, local->tx_headroom);
289	mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
290	memset(mgmt, 0, hdr_len);
291	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
292					  IEEE80211_STYPE_ACTION);
293	memcpy(mgmt->da, da, ETH_ALEN);
294	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
295	memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
296	mgmt->u.action.category = WLAN_CATEGORY_SELF_PROTECTED;
297	mgmt->u.action.u.self_prot.action_code = action;
298
299	if (action != WLAN_SP_MESH_PEERING_CLOSE) {
300		enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
301
302		/* capability info */
303		pos = skb_put(skb, 2);
304		memset(pos, 0, 2);
305		if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
306			/* AID */
307			pos = skb_put(skb, 2);
308			put_unaligned_le16(plid, pos + 2);
309		}
310		if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
311		    ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
312		    mesh_add_rsn_ie(sdata, skb) ||
313		    mesh_add_meshid_ie(sdata, skb) ||
314		    mesh_add_meshconf_ie(sdata, skb))
315			goto free;
316	} else {	/* WLAN_SP_MESH_PEERING_CLOSE */
317		info->flags |= IEEE80211_TX_CTL_NO_ACK;
318		if (mesh_add_meshid_ie(sdata, skb))
319			goto free;
320	}
321
322	/* Add Mesh Peering Management element */
323	switch (action) {
324	case WLAN_SP_MESH_PEERING_OPEN:
325		break;
326	case WLAN_SP_MESH_PEERING_CONFIRM:
327		ie_len += 2;
328		include_plid = true;
329		break;
330	case WLAN_SP_MESH_PEERING_CLOSE:
331		if (plid) {
332			ie_len += 2;
333			include_plid = true;
334		}
335		ie_len += 2;	/* reason code */
336		break;
337	default:
338		err = -EINVAL;
339		goto free;
340	}
341
342	if (WARN_ON(skb_tailroom(skb) < 2 + ie_len))
343		goto free;
344
345	pos = skb_put(skb, 2 + ie_len);
346	*pos++ = WLAN_EID_PEER_MGMT;
347	*pos++ = ie_len;
348	memcpy(pos, &peering_proto, 2);
349	pos += 2;
350	put_unaligned_le16(llid, pos);
351	pos += 2;
352	if (include_plid) {
353		put_unaligned_le16(plid, pos);
354		pos += 2;
355	}
356	if (action == WLAN_SP_MESH_PEERING_CLOSE) {
357		put_unaligned_le16(reason, pos);
358		pos += 2;
359	}
360
361	if (action != WLAN_SP_MESH_PEERING_CLOSE) {
362		if (mesh_add_ht_cap_ie(sdata, skb) ||
363		    mesh_add_ht_oper_ie(sdata, skb))
364			goto free;
365	}
366
367	if (mesh_add_vendor_ies(sdata, skb))
368		goto free;
369
370	ieee80211_tx_skb(sdata, skb);
371	return 0;
372free:
373	kfree_skb(skb);
374	return err;
375}
376
377static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
378			       struct sta_info *sta,
379			       struct ieee802_11_elems *elems, bool insert)
380{
381	struct ieee80211_local *local = sdata->local;
382	enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
383	struct ieee80211_supported_band *sband;
384	u32 rates, basic_rates = 0, changed = 0;
385	enum ieee80211_sta_rx_bandwidth bw = sta->sta.bandwidth;
386
387	sband = local->hw.wiphy->bands[band];
388	rates = ieee80211_sta_get_rates(sdata, elems, band, &basic_rates);
389
390	spin_lock_bh(&sta->lock);
391	sta->last_rx = jiffies;
392
393	/* rates and capabilities don't change during peering */
394	if (sta->plink_state == NL80211_PLINK_ESTAB)
395		goto out;
396
397	if (sta->sta.supp_rates[band] != rates)
398		changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
399	sta->sta.supp_rates[band] = rates;
400
401	if (ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
402					      elems->ht_cap_elem, sta))
403		changed |= IEEE80211_RC_BW_CHANGED;
404
405	if (bw != sta->sta.bandwidth)
406		changed |= IEEE80211_RC_BW_CHANGED;
407
408	/* HT peer is operating 20MHz-only */
409	if (elems->ht_operation &&
410	    !(elems->ht_operation->ht_param &
411	      IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
412		if (sta->sta.bandwidth != IEEE80211_STA_RX_BW_20)
413			changed |= IEEE80211_RC_BW_CHANGED;
414		sta->sta.bandwidth = IEEE80211_STA_RX_BW_20;
415	}
416
417	if (insert)
418		rate_control_rate_init(sta);
419	else
420		rate_control_rate_update(local, sband, sta, changed);
421out:
422	spin_unlock_bh(&sta->lock);
423}
424
425static struct sta_info *
426__mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *hw_addr)
427{
428	struct sta_info *sta;
429
430	if (sdata->local->num_sta >= MESH_MAX_PLINKS)
431		return NULL;
432
433	sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
434	if (!sta)
435		return NULL;
436
437	sta->plink_state = NL80211_PLINK_LISTEN;
438	sta->sta.wme = true;
439
440	sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
441	sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
442	sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
443
444	return sta;
445}
446
447static struct sta_info *
448mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *addr,
449		    struct ieee802_11_elems *elems)
450{
451	struct sta_info *sta = NULL;
452
453	/* Userspace handles station allocation */
454	if (sdata->u.mesh.user_mpm ||
455	    sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
456		cfg80211_notify_new_peer_candidate(sdata->dev, addr,
457						   elems->ie_start,
458						   elems->total_len,
459						   GFP_KERNEL);
460	else
461		sta = __mesh_sta_info_alloc(sdata, addr);
462
463	return sta;
464}
465
466/*
467 * mesh_sta_info_get - return mesh sta info entry for @addr.
468 *
469 * @sdata: local meshif
470 * @addr: peer's address
471 * @elems: IEs from beacon or mesh peering frame.
472 *
473 * Return existing or newly allocated sta_info under RCU read lock.
474 * (re)initialize with given IEs.
475 */
476static struct sta_info *
477mesh_sta_info_get(struct ieee80211_sub_if_data *sdata,
478		  u8 *addr, struct ieee802_11_elems *elems) __acquires(RCU)
479{
480	struct sta_info *sta = NULL;
481
482	rcu_read_lock();
483	sta = sta_info_get(sdata, addr);
484	if (sta) {
485		mesh_sta_info_init(sdata, sta, elems, false);
486	} else {
487		rcu_read_unlock();
488		/* can't run atomic */
489		sta = mesh_sta_info_alloc(sdata, addr, elems);
490		if (!sta) {
491			rcu_read_lock();
492			return NULL;
493		}
494
495		mesh_sta_info_init(sdata, sta, elems, true);
496
497		if (sta_info_insert_rcu(sta))
498			return NULL;
499	}
500
501	return sta;
502}
503
504/*
505 * mesh_neighbour_update - update or initialize new mesh neighbor.
506 *
507 * @sdata: local meshif
508 * @addr: peer's address
509 * @elems: IEs from beacon or mesh peering frame
510 *
511 * Initiates peering if appropriate.
512 */
513void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
514			   u8 *hw_addr,
515			   struct ieee802_11_elems *elems)
516{
517	struct sta_info *sta;
518	u32 changed = 0;
519
520	sta = mesh_sta_info_get(sdata, hw_addr, elems);
521	if (!sta)
522		goto out;
523
524	if (mesh_peer_accepts_plinks(elems) &&
525	    sta->plink_state == NL80211_PLINK_LISTEN &&
526	    sdata->u.mesh.accepting_plinks &&
527	    sdata->u.mesh.mshcfg.auto_open_plinks &&
528	    rssi_threshold_check(sdata, sta))
529		changed = mesh_plink_open(sta);
530
531	ieee80211_mps_frame_release(sta, elems);
532out:
533	rcu_read_unlock();
534	ieee80211_mbss_info_change_notify(sdata, changed);
535}
536
537static void mesh_plink_timer(unsigned long data)
538{
539	struct sta_info *sta;
540	u16 reason = 0;
541	struct ieee80211_sub_if_data *sdata;
542	struct mesh_config *mshcfg;
543	enum ieee80211_self_protected_actioncode action = 0;
544
545	/*
546	 * This STA is valid because sta_info_destroy() will
547	 * del_timer_sync() this timer after having made sure
548	 * it cannot be readded (by deleting the plink.)
549	 */
550	sta = (struct sta_info *) data;
551
552	if (sta->sdata->local->quiescing)
553		return;
554
555	spin_lock_bh(&sta->lock);
556
557	/* If a timer fires just before a state transition on another CPU,
558	 * we may have already extended the timeout and changed state by the
559	 * time we've acquired the lock and arrived  here.  In that case,
560	 * skip this timer and wait for the new one.
561	 */
562	if (time_before(jiffies, sta->plink_timer.expires)) {
563		mpl_dbg(sta->sdata,
564			"Ignoring timer for %pM in state %s (timer adjusted)",
565			sta->sta.addr, mplstates[sta->plink_state]);
566		spin_unlock_bh(&sta->lock);
567		return;
568	}
569
570	/* del_timer() and handler may race when entering these states */
571	if (sta->plink_state == NL80211_PLINK_LISTEN ||
572	    sta->plink_state == NL80211_PLINK_ESTAB) {
573		mpl_dbg(sta->sdata,
574			"Ignoring timer for %pM in state %s (timer deleted)",
575			sta->sta.addr, mplstates[sta->plink_state]);
576		spin_unlock_bh(&sta->lock);
577		return;
578	}
579
580	mpl_dbg(sta->sdata,
581		"Mesh plink timer for %pM fired on state %s\n",
582		sta->sta.addr, mplstates[sta->plink_state]);
583	sdata = sta->sdata;
584	mshcfg = &sdata->u.mesh.mshcfg;
585
586	switch (sta->plink_state) {
587	case NL80211_PLINK_OPN_RCVD:
588	case NL80211_PLINK_OPN_SNT:
589		/* retry timer */
590		if (sta->plink_retries < mshcfg->dot11MeshMaxRetries) {
591			u32 rand;
592			mpl_dbg(sta->sdata,
593				"Mesh plink for %pM (retry, timeout): %d %d\n",
594				sta->sta.addr, sta->plink_retries,
595				sta->plink_timeout);
596			get_random_bytes(&rand, sizeof(u32));
597			sta->plink_timeout = sta->plink_timeout +
598					     rand % sta->plink_timeout;
599			++sta->plink_retries;
600			mod_plink_timer(sta, sta->plink_timeout);
601			action = WLAN_SP_MESH_PEERING_OPEN;
602			break;
603		}
604		reason = WLAN_REASON_MESH_MAX_RETRIES;
605		/* fall through on else */
606	case NL80211_PLINK_CNF_RCVD:
607		/* confirm timer */
608		if (!reason)
609			reason = WLAN_REASON_MESH_CONFIRM_TIMEOUT;
610		sta->plink_state = NL80211_PLINK_HOLDING;
611		mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout);
612		action = WLAN_SP_MESH_PEERING_CLOSE;
613		break;
614	case NL80211_PLINK_HOLDING:
615		/* holding timer */
616		del_timer(&sta->plink_timer);
617		mesh_plink_fsm_restart(sta);
618		break;
619	default:
620		break;
621	}
622	spin_unlock_bh(&sta->lock);
623	if (action)
624		mesh_plink_frame_tx(sdata, action, sta->sta.addr,
625				    sta->llid, sta->plid, reason);
626}
627
628static inline void mesh_plink_timer_set(struct sta_info *sta, u32 timeout)
629{
630	sta->plink_timer.expires = jiffies + msecs_to_jiffies(timeout);
631	sta->plink_timer.data = (unsigned long) sta;
632	sta->plink_timer.function = mesh_plink_timer;
633	sta->plink_timeout = timeout;
634	add_timer(&sta->plink_timer);
635}
636
637static bool llid_in_use(struct ieee80211_sub_if_data *sdata,
638			u16 llid)
639{
640	struct ieee80211_local *local = sdata->local;
641	bool in_use = false;
642	struct sta_info *sta;
643
644	rcu_read_lock();
645	list_for_each_entry_rcu(sta, &local->sta_list, list) {
646		if (!memcmp(&sta->llid, &llid, sizeof(llid))) {
647			in_use = true;
648			break;
649		}
650	}
651	rcu_read_unlock();
652
653	return in_use;
654}
655
656static u16 mesh_get_new_llid(struct ieee80211_sub_if_data *sdata)
657{
658	u16 llid;
659
660	do {
661		get_random_bytes(&llid, sizeof(llid));
662		/* for mesh PS we still only have the AID range for TIM bits */
663		llid = (llid % IEEE80211_MAX_AID) + 1;
664	} while (llid_in_use(sdata, llid));
665
666	return llid;
667}
668
669u32 mesh_plink_open(struct sta_info *sta)
670{
671	struct ieee80211_sub_if_data *sdata = sta->sdata;
672	u32 changed;
673
674	if (!test_sta_flag(sta, WLAN_STA_AUTH))
675		return 0;
676
677	spin_lock_bh(&sta->lock);
678	sta->llid = mesh_get_new_llid(sdata);
679	if (sta->plink_state != NL80211_PLINK_LISTEN &&
680	    sta->plink_state != NL80211_PLINK_BLOCKED) {
681		spin_unlock_bh(&sta->lock);
682		return 0;
683	}
684	sta->plink_state = NL80211_PLINK_OPN_SNT;
685	mesh_plink_timer_set(sta, sdata->u.mesh.mshcfg.dot11MeshRetryTimeout);
686	spin_unlock_bh(&sta->lock);
687	mpl_dbg(sdata,
688		"Mesh plink: starting establishment with %pM\n",
689		sta->sta.addr);
690
691	/* set the non-peer mode to active during peering */
692	changed = ieee80211_mps_local_status_update(sdata);
693
694	mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
695			    sta->sta.addr, sta->llid, 0, 0);
696	return changed;
697}
698
699u32 mesh_plink_block(struct sta_info *sta)
700{
701	u32 changed;
702
703	spin_lock_bh(&sta->lock);
704	changed = __mesh_plink_deactivate(sta);
705	sta->plink_state = NL80211_PLINK_BLOCKED;
706	spin_unlock_bh(&sta->lock);
707
708	return changed;
709}
710
711static void mesh_plink_close(struct ieee80211_sub_if_data *sdata,
712			     struct sta_info *sta,
713			     enum plink_event event)
714{
715	struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
716
717	u16 reason = (event == CLS_ACPT) ?
718		     WLAN_REASON_MESH_CLOSE : WLAN_REASON_MESH_CONFIG;
719
720	sta->reason = reason;
721	sta->plink_state = NL80211_PLINK_HOLDING;
722	mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout);
723}
724
725static u32 mesh_plink_establish(struct ieee80211_sub_if_data *sdata,
726				struct sta_info *sta)
727{
728	struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
729	u32 changed = 0;
730
731	del_timer(&sta->plink_timer);
732	sta->plink_state = NL80211_PLINK_ESTAB;
733	changed |= mesh_plink_inc_estab_count(sdata);
734	changed |= mesh_set_ht_prot_mode(sdata);
735	changed |= mesh_set_short_slot_time(sdata);
736	mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n", sta->sta.addr);
737	ieee80211_mps_sta_status_update(sta);
738	changed |= ieee80211_mps_set_sta_local_pm(sta, mshcfg->power_mode);
739	return changed;
740}
741
742/**
743 * mesh_plink_fsm - step @sta MPM based on @event
744 *
745 * @sdata: interface
746 * @sta: mesh neighbor
747 * @event: peering event
748 *
749 * Return: changed MBSS flags
750 */
751static u32 mesh_plink_fsm(struct ieee80211_sub_if_data *sdata,
752			  struct sta_info *sta, enum plink_event event)
753{
754	struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
755	enum ieee80211_self_protected_actioncode action = 0;
756	u32 changed = 0;
757
758	mpl_dbg(sdata, "peer %pM in state %s got event %s\n", sta->sta.addr,
759		mplstates[sta->plink_state], mplevents[event]);
760
761	spin_lock_bh(&sta->lock);
762	switch (sta->plink_state) {
763	case NL80211_PLINK_LISTEN:
764		switch (event) {
765		case CLS_ACPT:
766			mesh_plink_fsm_restart(sta);
767			break;
768		case OPN_ACPT:
769			sta->plink_state = NL80211_PLINK_OPN_RCVD;
770			sta->llid = mesh_get_new_llid(sdata);
771			mesh_plink_timer_set(sta,
772					     mshcfg->dot11MeshRetryTimeout);
773
774			/* set the non-peer mode to active during peering */
775			changed |= ieee80211_mps_local_status_update(sdata);
776			action = WLAN_SP_MESH_PEERING_OPEN;
777			break;
778		default:
779			break;
780		}
781		break;
782	case NL80211_PLINK_OPN_SNT:
783		switch (event) {
784		case OPN_RJCT:
785		case CNF_RJCT:
786		case CLS_ACPT:
787			mesh_plink_close(sdata, sta, event);
788			action = WLAN_SP_MESH_PEERING_CLOSE;
789			break;
790		case OPN_ACPT:
791			/* retry timer is left untouched */
792			sta->plink_state = NL80211_PLINK_OPN_RCVD;
793			action = WLAN_SP_MESH_PEERING_CONFIRM;
794			break;
795		case CNF_ACPT:
796			sta->plink_state = NL80211_PLINK_CNF_RCVD;
797			mod_plink_timer(sta, mshcfg->dot11MeshConfirmTimeout);
798			break;
799		default:
800			break;
801		}
802		break;
803	case NL80211_PLINK_OPN_RCVD:
804		switch (event) {
805		case OPN_RJCT:
806		case CNF_RJCT:
807		case CLS_ACPT:
808			mesh_plink_close(sdata, sta, event);
809			action = WLAN_SP_MESH_PEERING_CLOSE;
810			break;
811		case OPN_ACPT:
812			action = WLAN_SP_MESH_PEERING_CONFIRM;
813			break;
814		case CNF_ACPT:
815			changed |= mesh_plink_establish(sdata, sta);
816			break;
817		default:
818			break;
819		}
820		break;
821	case NL80211_PLINK_CNF_RCVD:
822		switch (event) {
823		case OPN_RJCT:
824		case CNF_RJCT:
825		case CLS_ACPT:
826			mesh_plink_close(sdata, sta, event);
827			action = WLAN_SP_MESH_PEERING_CLOSE;
828			break;
829		case OPN_ACPT:
830			changed |= mesh_plink_establish(sdata, sta);
831			action = WLAN_SP_MESH_PEERING_CONFIRM;
832			break;
833		default:
834			break;
835		}
836		break;
837	case NL80211_PLINK_ESTAB:
838		switch (event) {
839		case CLS_ACPT:
840			changed |= __mesh_plink_deactivate(sta);
841			changed |= mesh_set_ht_prot_mode(sdata);
842			changed |= mesh_set_short_slot_time(sdata);
843			mesh_plink_close(sdata, sta, event);
844			action = WLAN_SP_MESH_PEERING_CLOSE;
845			break;
846		case OPN_ACPT:
847			action = WLAN_SP_MESH_PEERING_CONFIRM;
848			break;
849		default:
850			break;
851		}
852		break;
853	case NL80211_PLINK_HOLDING:
854		switch (event) {
855		case CLS_ACPT:
856			del_timer(&sta->plink_timer);
857			mesh_plink_fsm_restart(sta);
858			break;
859		case OPN_ACPT:
860		case CNF_ACPT:
861		case OPN_RJCT:
862		case CNF_RJCT:
863			action = WLAN_SP_MESH_PEERING_CLOSE;
864			break;
865		default:
866			break;
867		}
868		break;
869	default:
870		/* should not get here, PLINK_BLOCKED is dealt with at the
871		 * beginning of the function
872		 */
873		break;
874	}
875	spin_unlock_bh(&sta->lock);
876	if (action) {
877		mesh_plink_frame_tx(sdata, action, sta->sta.addr,
878				    sta->llid, sta->plid, sta->reason);
879
880		/* also send confirm in open case */
881		if (action == WLAN_SP_MESH_PEERING_OPEN) {
882			mesh_plink_frame_tx(sdata,
883					    WLAN_SP_MESH_PEERING_CONFIRM,
884					    sta->sta.addr, sta->llid,
885					    sta->plid, 0);
886		}
887	}
888
889	return changed;
890}
891
892/*
893 * mesh_plink_get_event - get correct MPM event
894 *
895 * @sdata: interface
896 * @sta: peer, leave NULL if processing a frame from a new suitable peer
897 * @elems: peering management IEs
898 * @ftype: frame type
899 * @llid: peer's peer link ID
900 * @plid: peer's local link ID
901 *
902 * Return: new peering event for @sta, but PLINK_UNDEFINED should be treated as
903 * an error.
904 */
905static enum plink_event
906mesh_plink_get_event(struct ieee80211_sub_if_data *sdata,
907		     struct sta_info *sta,
908		     struct ieee802_11_elems *elems,
909		     enum ieee80211_self_protected_actioncode ftype,
910		     u16 llid, u16 plid)
911{
912	enum plink_event event = PLINK_UNDEFINED;
913	u8 ie_len = elems->peering_len;
914	bool matches_local;
915
916	matches_local = (ftype == WLAN_SP_MESH_PEERING_CLOSE ||
917			 mesh_matches_local(sdata, elems));
918
919	/* deny open request from non-matching peer */
920	if (!matches_local && !sta) {
921		event = OPN_RJCT;
922		goto out;
923	}
924
925	if (!sta) {
926		if (ftype != WLAN_SP_MESH_PEERING_OPEN) {
927			mpl_dbg(sdata, "Mesh plink: cls or cnf from unknown peer\n");
928			goto out;
929		}
930		/* ftype == WLAN_SP_MESH_PEERING_OPEN */
931		if (!mesh_plink_free_count(sdata)) {
932			mpl_dbg(sdata, "Mesh plink error: no more free plinks\n");
933			goto out;
934		}
935	} else {
936		if (!test_sta_flag(sta, WLAN_STA_AUTH)) {
937			mpl_dbg(sdata, "Mesh plink: Action frame from non-authed peer\n");
938			goto out;
939		}
940		if (sta->plink_state == NL80211_PLINK_BLOCKED)
941			goto out;
942	}
943
944	/* new matching peer */
945	if (!sta) {
946		event = OPN_ACPT;
947		goto out;
948	}
949
950	switch (ftype) {
951	case WLAN_SP_MESH_PEERING_OPEN:
952		if (!matches_local)
953			event = OPN_RJCT;
954		if (!mesh_plink_free_count(sdata) ||
955		    (sta->plid && sta->plid != plid))
956			event = OPN_IGNR;
957		else
958			event = OPN_ACPT;
959		break;
960	case WLAN_SP_MESH_PEERING_CONFIRM:
961		if (!matches_local)
962			event = CNF_RJCT;
963		if (!mesh_plink_free_count(sdata) ||
964		    sta->llid != llid ||
965		    (sta->plid && sta->plid != plid))
966			event = CNF_IGNR;
967		else
968			event = CNF_ACPT;
969		break;
970	case WLAN_SP_MESH_PEERING_CLOSE:
971		if (sta->plink_state == NL80211_PLINK_ESTAB)
972			/* Do not check for llid or plid. This does not
973			 * follow the standard but since multiple plinks
974			 * per sta are not supported, it is necessary in
975			 * order to avoid a livelock when MP A sees an
976			 * establish peer link to MP B but MP B does not
977			 * see it. This can be caused by a timeout in
978			 * B's peer link establishment or B beign
979			 * restarted.
980			 */
981			event = CLS_ACPT;
982		else if (sta->plid != plid)
983			event = CLS_IGNR;
984		else if (ie_len == 8 && sta->llid != llid)
985			event = CLS_IGNR;
986		else
987			event = CLS_ACPT;
988		break;
989	default:
990		mpl_dbg(sdata, "Mesh plink: unknown frame subtype\n");
991		break;
992	}
993
994out:
995	return event;
996}
997
998static void
999mesh_process_plink_frame(struct ieee80211_sub_if_data *sdata,
1000			 struct ieee80211_mgmt *mgmt,
1001			 struct ieee802_11_elems *elems)
1002{
1003
1004	struct sta_info *sta;
1005	enum plink_event event;
1006	enum ieee80211_self_protected_actioncode ftype;
1007	u32 changed = 0;
1008	u8 ie_len = elems->peering_len;
1009	u16 plid, llid = 0;
1010
1011	if (!elems->peering) {
1012		mpl_dbg(sdata,
1013			"Mesh plink: missing necessary peer link ie\n");
1014		return;
1015	}
1016
1017	if (elems->rsn_len &&
1018	    sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
1019		mpl_dbg(sdata,
1020			"Mesh plink: can't establish link with secure peer\n");
1021		return;
1022	}
1023
1024	ftype = mgmt->u.action.u.self_prot.action_code;
1025	if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
1026	    (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
1027	    (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
1028							&& ie_len != 8)) {
1029		mpl_dbg(sdata,
1030			"Mesh plink: incorrect plink ie length %d %d\n",
1031			ftype, ie_len);
1032		return;
1033	}
1034
1035	if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
1036	    (!elems->mesh_id || !elems->mesh_config)) {
1037		mpl_dbg(sdata, "Mesh plink: missing necessary ie\n");
1038		return;
1039	}
1040	/* Note the lines below are correct, the llid in the frame is the plid
1041	 * from the point of view of this host.
1042	 */
1043	plid = get_unaligned_le16(PLINK_GET_LLID(elems->peering));
1044	if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
1045	    (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
1046		llid = get_unaligned_le16(PLINK_GET_PLID(elems->peering));
1047
1048	/* WARNING: Only for sta pointer, is dropped & re-acquired */
1049	rcu_read_lock();
1050
1051	sta = sta_info_get(sdata, mgmt->sa);
1052
1053	if (ftype == WLAN_SP_MESH_PEERING_OPEN &&
1054	    !rssi_threshold_check(sdata, sta)) {
1055		mpl_dbg(sdata, "Mesh plink: %pM does not meet rssi threshold\n",
1056			mgmt->sa);
1057		goto unlock_rcu;
1058	}
1059
1060	/* Now we will figure out the appropriate event... */
1061	event = mesh_plink_get_event(sdata, sta, elems, ftype, llid, plid);
1062
1063	if (event == OPN_ACPT) {
1064		rcu_read_unlock();
1065		/* allocate sta entry if necessary and update info */
1066		sta = mesh_sta_info_get(sdata, mgmt->sa, elems);
1067		if (!sta) {
1068			mpl_dbg(sdata, "Mesh plink: failed to init peer!\n");
1069			goto unlock_rcu;
1070		}
1071		sta->plid = plid;
1072	} else if (!sta && event == OPN_RJCT) {
1073		mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
1074				    mgmt->sa, 0, plid,
1075				    WLAN_REASON_MESH_CONFIG);
1076		goto unlock_rcu;
1077	} else if (!sta || event == PLINK_UNDEFINED) {
1078		/* something went wrong */
1079		goto unlock_rcu;
1080	}
1081
1082	/* 802.11-2012 13.3.7.2 - update plid on CNF if not set */
1083	if (!sta->plid && event == CNF_ACPT)
1084		sta->plid = plid;
1085
1086	changed |= mesh_plink_fsm(sdata, sta, event);
1087
1088unlock_rcu:
1089	rcu_read_unlock();
1090
1091	if (changed)
1092		ieee80211_mbss_info_change_notify(sdata, changed);
1093}
1094
1095void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
1096			 struct ieee80211_mgmt *mgmt, size_t len,
1097			 struct ieee80211_rx_status *rx_status)
1098{
1099	struct ieee802_11_elems elems;
1100	size_t baselen;
1101	u8 *baseaddr;
1102
1103	/* need action_code, aux */
1104	if (len < IEEE80211_MIN_ACTION_SIZE + 3)
1105		return;
1106
1107	if (sdata->u.mesh.user_mpm)
1108		/* userspace must register for these */
1109		return;
1110
1111	if (is_multicast_ether_addr(mgmt->da)) {
1112		mpl_dbg(sdata,
1113			"Mesh plink: ignore frame from multicast address\n");
1114		return;
1115	}
1116
1117	baseaddr = mgmt->u.action.u.self_prot.variable;
1118	baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
1119	if (mgmt->u.action.u.self_prot.action_code ==
1120						WLAN_SP_MESH_PEERING_CONFIRM) {
1121		baseaddr += 4;
1122		baselen += 4;
1123	}
1124	ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
1125	mesh_process_plink_frame(sdata, mgmt, &elems);
1126}
1127