xref: /openbmc/linux/net/mac80211/sta_info.c (revision bd718fc11d5b184701e7fd8302033e31a3a03ba8)
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
4  * Copyright 2013-2014  Intel Mobile Communications GmbH
5  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
6  * Copyright (C) 2018-2019 Intel Corporation
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11  */
12 
13 #include <linux/module.h>
14 #include <linux/init.h>
15 #include <linux/etherdevice.h>
16 #include <linux/netdevice.h>
17 #include <linux/types.h>
18 #include <linux/slab.h>
19 #include <linux/skbuff.h>
20 #include <linux/if_arp.h>
21 #include <linux/timer.h>
22 #include <linux/rtnetlink.h>
23 
24 #include <net/codel.h>
25 #include <net/mac80211.h>
26 #include "ieee80211_i.h"
27 #include "driver-ops.h"
28 #include "rate.h"
29 #include "sta_info.h"
30 #include "debugfs_sta.h"
31 #include "mesh.h"
32 #include "wme.h"
33 
34 /**
35  * DOC: STA information lifetime rules
36  *
37  * STA info structures (&struct sta_info) are managed in a hash table
38  * for faster lookup and a list for iteration. They are managed using
39  * RCU, i.e. access to the list and hash table is protected by RCU.
40  *
41  * Upon allocating a STA info structure with sta_info_alloc(), the caller
42  * owns that structure. It must then insert it into the hash table using
43  * either sta_info_insert() or sta_info_insert_rcu(); only in the latter
44  * case (which acquires an rcu read section but must not be called from
45  * within one) will the pointer still be valid after the call. Note that
46  * the caller may not do much with the STA info before inserting it, in
47  * particular, it may not start any mesh peer link management or add
48  * encryption keys.
49  *
50  * When the insertion fails (sta_info_insert()) returns non-zero), the
51  * structure will have been freed by sta_info_insert()!
52  *
53  * Station entries are added by mac80211 when you establish a link with a
54  * peer. This means different things for the different type of interfaces
55  * we support. For a regular station this mean we add the AP sta when we
56  * receive an association response from the AP. For IBSS this occurs when
57  * get to know about a peer on the same IBSS. For WDS we add the sta for
58  * the peer immediately upon device open. When using AP mode we add stations
59  * for each respective station upon request from userspace through nl80211.
60  *
61  * In order to remove a STA info structure, various sta_info_destroy_*()
62  * calls are available.
63  *
64  * There is no concept of ownership on a STA entry, each structure is
65  * owned by the global hash table/list until it is removed. All users of
66  * the structure need to be RCU protected so that the structure won't be
67  * freed before they are done using it.
68  */
69 
70 static const struct rhashtable_params sta_rht_params = {
71 	.nelem_hint = 3, /* start small */
72 	.automatic_shrinking = true,
73 	.head_offset = offsetof(struct sta_info, hash_node),
74 	.key_offset = offsetof(struct sta_info, addr),
75 	.key_len = ETH_ALEN,
76 	.max_size = CONFIG_MAC80211_STA_HASH_MAX_SIZE,
77 };
78 
79 /* Caller must hold local->sta_mtx */
80 static int sta_info_hash_del(struct ieee80211_local *local,
81 			     struct sta_info *sta)
82 {
83 	return rhltable_remove(&local->sta_hash, &sta->hash_node,
84 			       sta_rht_params);
85 }
86 
87 static void __cleanup_single_sta(struct sta_info *sta)
88 {
89 	int ac, i;
90 	struct tid_ampdu_tx *tid_tx;
91 	struct ieee80211_sub_if_data *sdata = sta->sdata;
92 	struct ieee80211_local *local = sdata->local;
93 	struct ps_data *ps;
94 
95 	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
96 	    test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
97 	    test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
98 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
99 		    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
100 			ps = &sdata->bss->ps;
101 		else if (ieee80211_vif_is_mesh(&sdata->vif))
102 			ps = &sdata->u.mesh.ps;
103 		else
104 			return;
105 
106 		clear_sta_flag(sta, WLAN_STA_PS_STA);
107 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
108 		clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
109 
110 		atomic_dec(&ps->num_sta_ps);
111 	}
112 
113 	if (sta->sta.txq[0]) {
114 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
115 			struct txq_info *txqi;
116 
117 			if (!sta->sta.txq[i])
118 				continue;
119 
120 			txqi = to_txq_info(sta->sta.txq[i]);
121 
122 			ieee80211_txq_purge(local, txqi);
123 		}
124 	}
125 
126 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
127 		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
128 		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
129 		ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
130 	}
131 
132 	if (ieee80211_vif_is_mesh(&sdata->vif))
133 		mesh_sta_cleanup(sta);
134 
135 	cancel_work_sync(&sta->drv_deliver_wk);
136 
137 	/*
138 	 * Destroy aggregation state here. It would be nice to wait for the
139 	 * driver to finish aggregation stop and then clean up, but for now
140 	 * drivers have to handle aggregation stop being requested, followed
141 	 * directly by station destruction.
142 	 */
143 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
144 		kfree(sta->ampdu_mlme.tid_start_tx[i]);
145 		tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
146 		if (!tid_tx)
147 			continue;
148 		ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
149 		kfree(tid_tx);
150 	}
151 }
152 
153 static void cleanup_single_sta(struct sta_info *sta)
154 {
155 	struct ieee80211_sub_if_data *sdata = sta->sdata;
156 	struct ieee80211_local *local = sdata->local;
157 
158 	__cleanup_single_sta(sta);
159 	sta_info_free(local, sta);
160 }
161 
162 struct rhlist_head *sta_info_hash_lookup(struct ieee80211_local *local,
163 					 const u8 *addr)
164 {
165 	return rhltable_lookup(&local->sta_hash, addr, sta_rht_params);
166 }
167 
168 /* protected by RCU */
169 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
170 			      const u8 *addr)
171 {
172 	struct ieee80211_local *local = sdata->local;
173 	struct rhlist_head *tmp;
174 	struct sta_info *sta;
175 
176 	rcu_read_lock();
177 	for_each_sta_info(local, addr, sta, tmp) {
178 		if (sta->sdata == sdata) {
179 			rcu_read_unlock();
180 			/* this is safe as the caller must already hold
181 			 * another rcu read section or the mutex
182 			 */
183 			return sta;
184 		}
185 	}
186 	rcu_read_unlock();
187 	return NULL;
188 }
189 
190 /*
191  * Get sta info either from the specified interface
192  * or from one of its vlans
193  */
194 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
195 				  const u8 *addr)
196 {
197 	struct ieee80211_local *local = sdata->local;
198 	struct rhlist_head *tmp;
199 	struct sta_info *sta;
200 
201 	rcu_read_lock();
202 	for_each_sta_info(local, addr, sta, tmp) {
203 		if (sta->sdata == sdata ||
204 		    (sta->sdata->bss && sta->sdata->bss == sdata->bss)) {
205 			rcu_read_unlock();
206 			/* this is safe as the caller must already hold
207 			 * another rcu read section or the mutex
208 			 */
209 			return sta;
210 		}
211 	}
212 	rcu_read_unlock();
213 	return NULL;
214 }
215 
216 struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
217 				     int idx)
218 {
219 	struct ieee80211_local *local = sdata->local;
220 	struct sta_info *sta;
221 	int i = 0;
222 
223 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
224 		if (sdata != sta->sdata)
225 			continue;
226 		if (i < idx) {
227 			++i;
228 			continue;
229 		}
230 		return sta;
231 	}
232 
233 	return NULL;
234 }
235 
236 /**
237  * sta_info_free - free STA
238  *
239  * @local: pointer to the global information
240  * @sta: STA info to free
241  *
242  * This function must undo everything done by sta_info_alloc()
243  * that may happen before sta_info_insert(). It may only be
244  * called when sta_info_insert() has not been attempted (and
245  * if that fails, the station is freed anyway.)
246  */
247 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
248 {
249 	if (sta->rate_ctrl)
250 		rate_control_free_sta(sta);
251 
252 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
253 
254 	if (sta->sta.txq[0])
255 		kfree(to_txq_info(sta->sta.txq[0]));
256 	kfree(rcu_dereference_raw(sta->sta.rates));
257 #ifdef CONFIG_MAC80211_MESH
258 	kfree(sta->mesh);
259 #endif
260 	free_percpu(sta->pcpu_rx_stats);
261 	kfree(sta);
262 }
263 
264 /* Caller must hold local->sta_mtx */
265 static int sta_info_hash_add(struct ieee80211_local *local,
266 			     struct sta_info *sta)
267 {
268 	return rhltable_insert(&local->sta_hash, &sta->hash_node,
269 			       sta_rht_params);
270 }
271 
272 static void sta_deliver_ps_frames(struct work_struct *wk)
273 {
274 	struct sta_info *sta;
275 
276 	sta = container_of(wk, struct sta_info, drv_deliver_wk);
277 
278 	if (sta->dead)
279 		return;
280 
281 	local_bh_disable();
282 	if (!test_sta_flag(sta, WLAN_STA_PS_STA))
283 		ieee80211_sta_ps_deliver_wakeup(sta);
284 	else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
285 		ieee80211_sta_ps_deliver_poll_response(sta);
286 	else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
287 		ieee80211_sta_ps_deliver_uapsd(sta);
288 	local_bh_enable();
289 }
290 
291 static int sta_prepare_rate_control(struct ieee80211_local *local,
292 				    struct sta_info *sta, gfp_t gfp)
293 {
294 	if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL))
295 		return 0;
296 
297 	sta->rate_ctrl = local->rate_ctrl;
298 	sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
299 						     sta, gfp);
300 	if (!sta->rate_ctrl_priv)
301 		return -ENOMEM;
302 
303 	return 0;
304 }
305 
306 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
307 				const u8 *addr, gfp_t gfp)
308 {
309 	struct ieee80211_local *local = sdata->local;
310 	struct ieee80211_hw *hw = &local->hw;
311 	struct sta_info *sta;
312 	int i;
313 
314 	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
315 	if (!sta)
316 		return NULL;
317 
318 	if (ieee80211_hw_check(hw, USES_RSS)) {
319 		sta->pcpu_rx_stats =
320 			alloc_percpu_gfp(struct ieee80211_sta_rx_stats, gfp);
321 		if (!sta->pcpu_rx_stats)
322 			goto free;
323 	}
324 
325 	spin_lock_init(&sta->lock);
326 	spin_lock_init(&sta->ps_lock);
327 	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
328 	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
329 	mutex_init(&sta->ampdu_mlme.mtx);
330 #ifdef CONFIG_MAC80211_MESH
331 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
332 		sta->mesh = kzalloc(sizeof(*sta->mesh), gfp);
333 		if (!sta->mesh)
334 			goto free;
335 		sta->mesh->plink_sta = sta;
336 		spin_lock_init(&sta->mesh->plink_lock);
337 		if (ieee80211_vif_is_mesh(&sdata->vif) &&
338 		    !sdata->u.mesh.user_mpm)
339 			timer_setup(&sta->mesh->plink_timer, mesh_plink_timer,
340 				    0);
341 		sta->mesh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
342 	}
343 #endif
344 
345 	memcpy(sta->addr, addr, ETH_ALEN);
346 	memcpy(sta->sta.addr, addr, ETH_ALEN);
347 	sta->sta.max_rx_aggregation_subframes =
348 		local->hw.max_rx_aggregation_subframes;
349 
350 	/* Extended Key ID needs to install keys for keyid 0 and 1 Rx-only.
351 	 * The Tx path starts to use a key as soon as the key slot ptk_idx
352 	 * references to is not NULL. To not use the initial Rx-only key
353 	 * prematurely for Tx initialize ptk_idx to an impossible PTK keyid
354 	 * which always will refer to a NULL key.
355 	 */
356 	BUILD_BUG_ON(ARRAY_SIZE(sta->ptk) <= INVALID_PTK_KEYIDX);
357 	sta->ptk_idx = INVALID_PTK_KEYIDX;
358 
359 	sta->local = local;
360 	sta->sdata = sdata;
361 	sta->rx_stats.last_rx = jiffies;
362 
363 	u64_stats_init(&sta->rx_stats.syncp);
364 
365 	sta->sta_state = IEEE80211_STA_NONE;
366 
367 	/* Mark TID as unreserved */
368 	sta->reserved_tid = IEEE80211_TID_UNRESERVED;
369 
370 	sta->last_connected = ktime_get_seconds();
371 	ewma_signal_init(&sta->rx_stats_avg.signal);
372 	ewma_avg_signal_init(&sta->status_stats.avg_ack_signal);
373 	for (i = 0; i < ARRAY_SIZE(sta->rx_stats_avg.chain_signal); i++)
374 		ewma_signal_init(&sta->rx_stats_avg.chain_signal[i]);
375 
376 	if (local->ops->wake_tx_queue) {
377 		void *txq_data;
378 		int size = sizeof(struct txq_info) +
379 			   ALIGN(hw->txq_data_size, sizeof(void *));
380 
381 		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
382 		if (!txq_data)
383 			goto free;
384 
385 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
386 			struct txq_info *txq = txq_data + i * size;
387 
388 			/* might not do anything for the bufferable MMPDU TXQ */
389 			ieee80211_txq_init(sdata, sta, txq, i);
390 		}
391 	}
392 
393 	if (sta_prepare_rate_control(local, sta, gfp))
394 		goto free_txq;
395 
396 	sta->airtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;
397 
398 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
399 		skb_queue_head_init(&sta->ps_tx_buf[i]);
400 		skb_queue_head_init(&sta->tx_filtered[i]);
401 		sta->airtime[i].deficit = sta->airtime_weight;
402 	}
403 
404 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
405 		sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
406 
407 	for (i = 0; i < NUM_NL80211_BANDS; i++) {
408 		u32 mandatory = 0;
409 		int r;
410 
411 		if (!hw->wiphy->bands[i])
412 			continue;
413 
414 		switch (i) {
415 		case NL80211_BAND_2GHZ:
416 			/*
417 			 * We use both here, even if we cannot really know for
418 			 * sure the station will support both, but the only use
419 			 * for this is when we don't know anything yet and send
420 			 * management frames, and then we'll pick the lowest
421 			 * possible rate anyway.
422 			 * If we don't include _G here, we cannot find a rate
423 			 * in P2P, and thus trigger the WARN_ONCE() in rate.c
424 			 */
425 			mandatory = IEEE80211_RATE_MANDATORY_B |
426 				    IEEE80211_RATE_MANDATORY_G;
427 			break;
428 		case NL80211_BAND_5GHZ:
429 			mandatory = IEEE80211_RATE_MANDATORY_A;
430 			break;
431 		case NL80211_BAND_60GHZ:
432 			WARN_ON(1);
433 			mandatory = 0;
434 			break;
435 		}
436 
437 		for (r = 0; r < hw->wiphy->bands[i]->n_bitrates; r++) {
438 			struct ieee80211_rate *rate;
439 
440 			rate = &hw->wiphy->bands[i]->bitrates[r];
441 
442 			if (!(rate->flags & mandatory))
443 				continue;
444 			sta->sta.supp_rates[i] |= BIT(r);
445 		}
446 	}
447 
448 	sta->sta.smps_mode = IEEE80211_SMPS_OFF;
449 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
450 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
451 		struct ieee80211_supported_band *sband;
452 		u8 smps;
453 
454 		sband = ieee80211_get_sband(sdata);
455 		if (!sband)
456 			goto free_txq;
457 
458 		smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
459 			IEEE80211_HT_CAP_SM_PS_SHIFT;
460 		/*
461 		 * Assume that hostapd advertises our caps in the beacon and
462 		 * this is the known_smps_mode for a station that just assciated
463 		 */
464 		switch (smps) {
465 		case WLAN_HT_SMPS_CONTROL_DISABLED:
466 			sta->known_smps_mode = IEEE80211_SMPS_OFF;
467 			break;
468 		case WLAN_HT_SMPS_CONTROL_STATIC:
469 			sta->known_smps_mode = IEEE80211_SMPS_STATIC;
470 			break;
471 		case WLAN_HT_SMPS_CONTROL_DYNAMIC:
472 			sta->known_smps_mode = IEEE80211_SMPS_DYNAMIC;
473 			break;
474 		default:
475 			WARN_ON(1);
476 		}
477 	}
478 
479 	sta->sta.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
480 
481 	sta->cparams.ce_threshold = CODEL_DISABLED_THRESHOLD;
482 	sta->cparams.target = MS2TIME(20);
483 	sta->cparams.interval = MS2TIME(100);
484 	sta->cparams.ecn = true;
485 
486 	sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
487 
488 	return sta;
489 
490 free_txq:
491 	if (sta->sta.txq[0])
492 		kfree(to_txq_info(sta->sta.txq[0]));
493 free:
494 	free_percpu(sta->pcpu_rx_stats);
495 #ifdef CONFIG_MAC80211_MESH
496 	kfree(sta->mesh);
497 #endif
498 	kfree(sta);
499 	return NULL;
500 }
501 
502 static int sta_info_insert_check(struct sta_info *sta)
503 {
504 	struct ieee80211_sub_if_data *sdata = sta->sdata;
505 
506 	/*
507 	 * Can't be a WARN_ON because it can be triggered through a race:
508 	 * something inserts a STA (on one CPU) without holding the RTNL
509 	 * and another CPU turns off the net device.
510 	 */
511 	if (unlikely(!ieee80211_sdata_running(sdata)))
512 		return -ENETDOWN;
513 
514 	if (WARN_ON(ether_addr_equal(sta->sta.addr, sdata->vif.addr) ||
515 		    is_multicast_ether_addr(sta->sta.addr)))
516 		return -EINVAL;
517 
518 	/* The RCU read lock is required by rhashtable due to
519 	 * asynchronous resize/rehash.  We also require the mutex
520 	 * for correctness.
521 	 */
522 	rcu_read_lock();
523 	lockdep_assert_held(&sdata->local->sta_mtx);
524 	if (ieee80211_hw_check(&sdata->local->hw, NEEDS_UNIQUE_STA_ADDR) &&
525 	    ieee80211_find_sta_by_ifaddr(&sdata->local->hw, sta->addr, NULL)) {
526 		rcu_read_unlock();
527 		return -ENOTUNIQ;
528 	}
529 	rcu_read_unlock();
530 
531 	return 0;
532 }
533 
534 static int sta_info_insert_drv_state(struct ieee80211_local *local,
535 				     struct ieee80211_sub_if_data *sdata,
536 				     struct sta_info *sta)
537 {
538 	enum ieee80211_sta_state state;
539 	int err = 0;
540 
541 	for (state = IEEE80211_STA_NOTEXIST; state < sta->sta_state; state++) {
542 		err = drv_sta_state(local, sdata, sta, state, state + 1);
543 		if (err)
544 			break;
545 	}
546 
547 	if (!err) {
548 		/*
549 		 * Drivers using legacy sta_add/sta_remove callbacks only
550 		 * get uploaded set to true after sta_add is called.
551 		 */
552 		if (!local->ops->sta_add)
553 			sta->uploaded = true;
554 		return 0;
555 	}
556 
557 	if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
558 		sdata_info(sdata,
559 			   "failed to move IBSS STA %pM to state %d (%d) - keeping it anyway\n",
560 			   sta->sta.addr, state + 1, err);
561 		err = 0;
562 	}
563 
564 	/* unwind on error */
565 	for (; state > IEEE80211_STA_NOTEXIST; state--)
566 		WARN_ON(drv_sta_state(local, sdata, sta, state, state - 1));
567 
568 	return err;
569 }
570 
571 static void
572 ieee80211_recalc_p2p_go_ps_allowed(struct ieee80211_sub_if_data *sdata)
573 {
574 	struct ieee80211_local *local = sdata->local;
575 	bool allow_p2p_go_ps = sdata->vif.p2p;
576 	struct sta_info *sta;
577 
578 	rcu_read_lock();
579 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
580 		if (sdata != sta->sdata ||
581 		    !test_sta_flag(sta, WLAN_STA_ASSOC))
582 			continue;
583 		if (!sta->sta.support_p2p_ps) {
584 			allow_p2p_go_ps = false;
585 			break;
586 		}
587 	}
588 	rcu_read_unlock();
589 
590 	if (allow_p2p_go_ps != sdata->vif.bss_conf.allow_p2p_go_ps) {
591 		sdata->vif.bss_conf.allow_p2p_go_ps = allow_p2p_go_ps;
592 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_P2P_PS);
593 	}
594 }
595 
596 /*
597  * should be called with sta_mtx locked
598  * this function replaces the mutex lock
599  * with a RCU lock
600  */
601 static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
602 {
603 	struct ieee80211_local *local = sta->local;
604 	struct ieee80211_sub_if_data *sdata = sta->sdata;
605 	struct station_info *sinfo = NULL;
606 	int err = 0;
607 
608 	lockdep_assert_held(&local->sta_mtx);
609 
610 	/* check if STA exists already */
611 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
612 		err = -EEXIST;
613 		goto out_err;
614 	}
615 
616 	sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
617 	if (!sinfo) {
618 		err = -ENOMEM;
619 		goto out_err;
620 	}
621 
622 	local->num_sta++;
623 	local->sta_generation++;
624 	smp_mb();
625 
626 	/* simplify things and don't accept BA sessions yet */
627 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
628 
629 	/* make the station visible */
630 	err = sta_info_hash_add(local, sta);
631 	if (err)
632 		goto out_drop_sta;
633 
634 	list_add_tail_rcu(&sta->list, &local->sta_list);
635 
636 	/* notify driver */
637 	err = sta_info_insert_drv_state(local, sdata, sta);
638 	if (err)
639 		goto out_remove;
640 
641 	set_sta_flag(sta, WLAN_STA_INSERTED);
642 
643 	if (sta->sta_state >= IEEE80211_STA_ASSOC) {
644 		ieee80211_recalc_min_chandef(sta->sdata);
645 		if (!sta->sta.support_p2p_ps)
646 			ieee80211_recalc_p2p_go_ps_allowed(sta->sdata);
647 	}
648 
649 	/* accept BA sessions now */
650 	clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
651 
652 	ieee80211_sta_debugfs_add(sta);
653 	rate_control_add_sta_debugfs(sta);
654 
655 	sinfo->generation = local->sta_generation;
656 	cfg80211_new_sta(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL);
657 	kfree(sinfo);
658 
659 	sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr);
660 
661 	/* move reference to rcu-protected */
662 	rcu_read_lock();
663 	mutex_unlock(&local->sta_mtx);
664 
665 	if (ieee80211_vif_is_mesh(&sdata->vif))
666 		mesh_accept_plinks_update(sdata);
667 
668 	return 0;
669  out_remove:
670 	sta_info_hash_del(local, sta);
671 	list_del_rcu(&sta->list);
672  out_drop_sta:
673 	local->num_sta--;
674 	synchronize_net();
675 	__cleanup_single_sta(sta);
676  out_err:
677 	mutex_unlock(&local->sta_mtx);
678 	kfree(sinfo);
679 	rcu_read_lock();
680 	return err;
681 }
682 
683 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
684 {
685 	struct ieee80211_local *local = sta->local;
686 	int err;
687 
688 	might_sleep();
689 
690 	mutex_lock(&local->sta_mtx);
691 
692 	err = sta_info_insert_check(sta);
693 	if (err) {
694 		mutex_unlock(&local->sta_mtx);
695 		rcu_read_lock();
696 		goto out_free;
697 	}
698 
699 	err = sta_info_insert_finish(sta);
700 	if (err)
701 		goto out_free;
702 
703 	return 0;
704  out_free:
705 	sta_info_free(local, sta);
706 	return err;
707 }
708 
709 int sta_info_insert(struct sta_info *sta)
710 {
711 	int err = sta_info_insert_rcu(sta);
712 
713 	rcu_read_unlock();
714 
715 	return err;
716 }
717 
718 static inline void __bss_tim_set(u8 *tim, u16 id)
719 {
720 	/*
721 	 * This format has been mandated by the IEEE specifications,
722 	 * so this line may not be changed to use the __set_bit() format.
723 	 */
724 	tim[id / 8] |= (1 << (id % 8));
725 }
726 
727 static inline void __bss_tim_clear(u8 *tim, u16 id)
728 {
729 	/*
730 	 * This format has been mandated by the IEEE specifications,
731 	 * so this line may not be changed to use the __clear_bit() format.
732 	 */
733 	tim[id / 8] &= ~(1 << (id % 8));
734 }
735 
736 static inline bool __bss_tim_get(u8 *tim, u16 id)
737 {
738 	/*
739 	 * This format has been mandated by the IEEE specifications,
740 	 * so this line may not be changed to use the test_bit() format.
741 	 */
742 	return tim[id / 8] & (1 << (id % 8));
743 }
744 
745 static unsigned long ieee80211_tids_for_ac(int ac)
746 {
747 	/* If we ever support TIDs > 7, this obviously needs to be adjusted */
748 	switch (ac) {
749 	case IEEE80211_AC_VO:
750 		return BIT(6) | BIT(7);
751 	case IEEE80211_AC_VI:
752 		return BIT(4) | BIT(5);
753 	case IEEE80211_AC_BE:
754 		return BIT(0) | BIT(3);
755 	case IEEE80211_AC_BK:
756 		return BIT(1) | BIT(2);
757 	default:
758 		WARN_ON(1);
759 		return 0;
760 	}
761 }
762 
763 static void __sta_info_recalc_tim(struct sta_info *sta, bool ignore_pending)
764 {
765 	struct ieee80211_local *local = sta->local;
766 	struct ps_data *ps;
767 	bool indicate_tim = false;
768 	u8 ignore_for_tim = sta->sta.uapsd_queues;
769 	int ac;
770 	u16 id = sta->sta.aid;
771 
772 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
773 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
774 		if (WARN_ON_ONCE(!sta->sdata->bss))
775 			return;
776 
777 		ps = &sta->sdata->bss->ps;
778 #ifdef CONFIG_MAC80211_MESH
779 	} else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
780 		ps = &sta->sdata->u.mesh.ps;
781 #endif
782 	} else {
783 		return;
784 	}
785 
786 	/* No need to do anything if the driver does all */
787 	if (ieee80211_hw_check(&local->hw, AP_LINK_PS) && !local->ops->set_tim)
788 		return;
789 
790 	if (sta->dead)
791 		goto done;
792 
793 	/*
794 	 * If all ACs are delivery-enabled then we should build
795 	 * the TIM bit for all ACs anyway; if only some are then
796 	 * we ignore those and build the TIM bit using only the
797 	 * non-enabled ones.
798 	 */
799 	if (ignore_for_tim == BIT(IEEE80211_NUM_ACS) - 1)
800 		ignore_for_tim = 0;
801 
802 	if (ignore_pending)
803 		ignore_for_tim = BIT(IEEE80211_NUM_ACS) - 1;
804 
805 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
806 		unsigned long tids;
807 
808 		if (ignore_for_tim & ieee80211_ac_to_qos_mask[ac])
809 			continue;
810 
811 		indicate_tim |= !skb_queue_empty(&sta->tx_filtered[ac]) ||
812 				!skb_queue_empty(&sta->ps_tx_buf[ac]);
813 		if (indicate_tim)
814 			break;
815 
816 		tids = ieee80211_tids_for_ac(ac);
817 
818 		indicate_tim |=
819 			sta->driver_buffered_tids & tids;
820 		indicate_tim |=
821 			sta->txq_buffered_tids & tids;
822 	}
823 
824  done:
825 	spin_lock_bh(&local->tim_lock);
826 
827 	if (indicate_tim == __bss_tim_get(ps->tim, id))
828 		goto out_unlock;
829 
830 	if (indicate_tim)
831 		__bss_tim_set(ps->tim, id);
832 	else
833 		__bss_tim_clear(ps->tim, id);
834 
835 	if (local->ops->set_tim && !WARN_ON(sta->dead)) {
836 		local->tim_in_locked_section = true;
837 		drv_set_tim(local, &sta->sta, indicate_tim);
838 		local->tim_in_locked_section = false;
839 	}
840 
841 out_unlock:
842 	spin_unlock_bh(&local->tim_lock);
843 }
844 
845 void sta_info_recalc_tim(struct sta_info *sta)
846 {
847 	__sta_info_recalc_tim(sta, false);
848 }
849 
850 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
851 {
852 	struct ieee80211_tx_info *info;
853 	int timeout;
854 
855 	if (!skb)
856 		return false;
857 
858 	info = IEEE80211_SKB_CB(skb);
859 
860 	/* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
861 	timeout = (sta->listen_interval *
862 		   sta->sdata->vif.bss_conf.beacon_int *
863 		   32 / 15625) * HZ;
864 	if (timeout < STA_TX_BUFFER_EXPIRE)
865 		timeout = STA_TX_BUFFER_EXPIRE;
866 	return time_after(jiffies, info->control.jiffies + timeout);
867 }
868 
869 
870 static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
871 						struct sta_info *sta, int ac)
872 {
873 	unsigned long flags;
874 	struct sk_buff *skb;
875 
876 	/*
877 	 * First check for frames that should expire on the filtered
878 	 * queue. Frames here were rejected by the driver and are on
879 	 * a separate queue to avoid reordering with normal PS-buffered
880 	 * frames. They also aren't accounted for right now in the
881 	 * total_ps_buffered counter.
882 	 */
883 	for (;;) {
884 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
885 		skb = skb_peek(&sta->tx_filtered[ac]);
886 		if (sta_info_buffer_expired(sta, skb))
887 			skb = __skb_dequeue(&sta->tx_filtered[ac]);
888 		else
889 			skb = NULL;
890 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
891 
892 		/*
893 		 * Frames are queued in order, so if this one
894 		 * hasn't expired yet we can stop testing. If
895 		 * we actually reached the end of the queue we
896 		 * also need to stop, of course.
897 		 */
898 		if (!skb)
899 			break;
900 		ieee80211_free_txskb(&local->hw, skb);
901 	}
902 
903 	/*
904 	 * Now also check the normal PS-buffered queue, this will
905 	 * only find something if the filtered queue was emptied
906 	 * since the filtered frames are all before the normal PS
907 	 * buffered frames.
908 	 */
909 	for (;;) {
910 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
911 		skb = skb_peek(&sta->ps_tx_buf[ac]);
912 		if (sta_info_buffer_expired(sta, skb))
913 			skb = __skb_dequeue(&sta->ps_tx_buf[ac]);
914 		else
915 			skb = NULL;
916 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
917 
918 		/*
919 		 * frames are queued in order, so if this one
920 		 * hasn't expired yet (or we reached the end of
921 		 * the queue) we can stop testing
922 		 */
923 		if (!skb)
924 			break;
925 
926 		local->total_ps_buffered--;
927 		ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
928 		       sta->sta.addr);
929 		ieee80211_free_txskb(&local->hw, skb);
930 	}
931 
932 	/*
933 	 * Finally, recalculate the TIM bit for this station -- it might
934 	 * now be clear because the station was too slow to retrieve its
935 	 * frames.
936 	 */
937 	sta_info_recalc_tim(sta);
938 
939 	/*
940 	 * Return whether there are any frames still buffered, this is
941 	 * used to check whether the cleanup timer still needs to run,
942 	 * if there are no frames we don't need to rearm the timer.
943 	 */
944 	return !(skb_queue_empty(&sta->ps_tx_buf[ac]) &&
945 		 skb_queue_empty(&sta->tx_filtered[ac]));
946 }
947 
948 static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
949 					     struct sta_info *sta)
950 {
951 	bool have_buffered = false;
952 	int ac;
953 
954 	/* This is only necessary for stations on BSS/MBSS interfaces */
955 	if (!sta->sdata->bss &&
956 	    !ieee80211_vif_is_mesh(&sta->sdata->vif))
957 		return false;
958 
959 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
960 		have_buffered |=
961 			sta_info_cleanup_expire_buffered_ac(local, sta, ac);
962 
963 	return have_buffered;
964 }
965 
966 static int __must_check __sta_info_destroy_part1(struct sta_info *sta)
967 {
968 	struct ieee80211_local *local;
969 	struct ieee80211_sub_if_data *sdata;
970 	int ret;
971 
972 	might_sleep();
973 
974 	if (!sta)
975 		return -ENOENT;
976 
977 	local = sta->local;
978 	sdata = sta->sdata;
979 
980 	lockdep_assert_held(&local->sta_mtx);
981 
982 	/*
983 	 * Before removing the station from the driver and
984 	 * rate control, it might still start new aggregation
985 	 * sessions -- block that to make sure the tear-down
986 	 * will be sufficient.
987 	 */
988 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
989 	ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
990 
991 	/*
992 	 * Before removing the station from the driver there might be pending
993 	 * rx frames on RSS queues sent prior to the disassociation - wait for
994 	 * all such frames to be processed.
995 	 */
996 	drv_sync_rx_queues(local, sta);
997 
998 	ret = sta_info_hash_del(local, sta);
999 	if (WARN_ON(ret))
1000 		return ret;
1001 
1002 	/*
1003 	 * for TDLS peers, make sure to return to the base channel before
1004 	 * removal.
1005 	 */
1006 	if (test_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL)) {
1007 		drv_tdls_cancel_channel_switch(local, sdata, &sta->sta);
1008 		clear_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL);
1009 	}
1010 
1011 	list_del_rcu(&sta->list);
1012 	sta->removed = true;
1013 
1014 	drv_sta_pre_rcu_remove(local, sta->sdata, sta);
1015 
1016 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1017 	    rcu_access_pointer(sdata->u.vlan.sta) == sta)
1018 		RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
1019 
1020 	return 0;
1021 }
1022 
1023 static void __sta_info_destroy_part2(struct sta_info *sta)
1024 {
1025 	struct ieee80211_local *local = sta->local;
1026 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1027 	struct station_info *sinfo;
1028 	int ret;
1029 
1030 	/*
1031 	 * NOTE: This assumes at least synchronize_net() was done
1032 	 *	 after _part1 and before _part2!
1033 	 */
1034 
1035 	might_sleep();
1036 	lockdep_assert_held(&local->sta_mtx);
1037 
1038 	/* now keys can no longer be reached */
1039 	ieee80211_free_sta_keys(local, sta);
1040 
1041 	/* disable TIM bit - last chance to tell driver */
1042 	__sta_info_recalc_tim(sta, true);
1043 
1044 	sta->dead = true;
1045 
1046 	local->num_sta--;
1047 	local->sta_generation++;
1048 
1049 	while (sta->sta_state > IEEE80211_STA_NONE) {
1050 		ret = sta_info_move_state(sta, sta->sta_state - 1);
1051 		if (ret) {
1052 			WARN_ON_ONCE(1);
1053 			break;
1054 		}
1055 	}
1056 
1057 	if (sta->uploaded) {
1058 		ret = drv_sta_state(local, sdata, sta, IEEE80211_STA_NONE,
1059 				    IEEE80211_STA_NOTEXIST);
1060 		WARN_ON_ONCE(ret != 0);
1061 	}
1062 
1063 	sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
1064 
1065 	sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
1066 	if (sinfo)
1067 		sta_set_sinfo(sta, sinfo, true);
1068 	cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL);
1069 	kfree(sinfo);
1070 
1071 	rate_control_remove_sta_debugfs(sta);
1072 	ieee80211_sta_debugfs_remove(sta);
1073 
1074 	cleanup_single_sta(sta);
1075 }
1076 
1077 int __must_check __sta_info_destroy(struct sta_info *sta)
1078 {
1079 	int err = __sta_info_destroy_part1(sta);
1080 
1081 	if (err)
1082 		return err;
1083 
1084 	synchronize_net();
1085 
1086 	__sta_info_destroy_part2(sta);
1087 
1088 	return 0;
1089 }
1090 
1091 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
1092 {
1093 	struct sta_info *sta;
1094 	int ret;
1095 
1096 	mutex_lock(&sdata->local->sta_mtx);
1097 	sta = sta_info_get(sdata, addr);
1098 	ret = __sta_info_destroy(sta);
1099 	mutex_unlock(&sdata->local->sta_mtx);
1100 
1101 	return ret;
1102 }
1103 
1104 int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
1105 			      const u8 *addr)
1106 {
1107 	struct sta_info *sta;
1108 	int ret;
1109 
1110 	mutex_lock(&sdata->local->sta_mtx);
1111 	sta = sta_info_get_bss(sdata, addr);
1112 	ret = __sta_info_destroy(sta);
1113 	mutex_unlock(&sdata->local->sta_mtx);
1114 
1115 	return ret;
1116 }
1117 
1118 static void sta_info_cleanup(struct timer_list *t)
1119 {
1120 	struct ieee80211_local *local = from_timer(local, t, sta_cleanup);
1121 	struct sta_info *sta;
1122 	bool timer_needed = false;
1123 
1124 	rcu_read_lock();
1125 	list_for_each_entry_rcu(sta, &local->sta_list, list)
1126 		if (sta_info_cleanup_expire_buffered(local, sta))
1127 			timer_needed = true;
1128 	rcu_read_unlock();
1129 
1130 	if (local->quiescing)
1131 		return;
1132 
1133 	if (!timer_needed)
1134 		return;
1135 
1136 	mod_timer(&local->sta_cleanup,
1137 		  round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL));
1138 }
1139 
1140 int sta_info_init(struct ieee80211_local *local)
1141 {
1142 	int err;
1143 
1144 	err = rhltable_init(&local->sta_hash, &sta_rht_params);
1145 	if (err)
1146 		return err;
1147 
1148 	spin_lock_init(&local->tim_lock);
1149 	mutex_init(&local->sta_mtx);
1150 	INIT_LIST_HEAD(&local->sta_list);
1151 
1152 	timer_setup(&local->sta_cleanup, sta_info_cleanup, 0);
1153 	return 0;
1154 }
1155 
1156 void sta_info_stop(struct ieee80211_local *local)
1157 {
1158 	del_timer_sync(&local->sta_cleanup);
1159 	rhltable_destroy(&local->sta_hash);
1160 }
1161 
1162 
1163 int __sta_info_flush(struct ieee80211_sub_if_data *sdata, bool vlans)
1164 {
1165 	struct ieee80211_local *local = sdata->local;
1166 	struct sta_info *sta, *tmp;
1167 	LIST_HEAD(free_list);
1168 	int ret = 0;
1169 
1170 	might_sleep();
1171 
1172 	WARN_ON(vlans && sdata->vif.type != NL80211_IFTYPE_AP);
1173 	WARN_ON(vlans && !sdata->bss);
1174 
1175 	mutex_lock(&local->sta_mtx);
1176 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1177 		if (sdata == sta->sdata ||
1178 		    (vlans && sdata->bss == sta->sdata->bss)) {
1179 			if (!WARN_ON(__sta_info_destroy_part1(sta)))
1180 				list_add(&sta->free_list, &free_list);
1181 			ret++;
1182 		}
1183 	}
1184 
1185 	if (!list_empty(&free_list)) {
1186 		synchronize_net();
1187 		list_for_each_entry_safe(sta, tmp, &free_list, free_list)
1188 			__sta_info_destroy_part2(sta);
1189 	}
1190 	mutex_unlock(&local->sta_mtx);
1191 
1192 	return ret;
1193 }
1194 
1195 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
1196 			  unsigned long exp_time)
1197 {
1198 	struct ieee80211_local *local = sdata->local;
1199 	struct sta_info *sta, *tmp;
1200 
1201 	mutex_lock(&local->sta_mtx);
1202 
1203 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1204 		unsigned long last_active = ieee80211_sta_last_active(sta);
1205 
1206 		if (sdata != sta->sdata)
1207 			continue;
1208 
1209 		if (time_is_before_jiffies(last_active + exp_time)) {
1210 			sta_dbg(sta->sdata, "expiring inactive STA %pM\n",
1211 				sta->sta.addr);
1212 
1213 			if (ieee80211_vif_is_mesh(&sdata->vif) &&
1214 			    test_sta_flag(sta, WLAN_STA_PS_STA))
1215 				atomic_dec(&sdata->u.mesh.ps.num_sta_ps);
1216 
1217 			WARN_ON(__sta_info_destroy(sta));
1218 		}
1219 	}
1220 
1221 	mutex_unlock(&local->sta_mtx);
1222 }
1223 
1224 struct ieee80211_sta *ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
1225 						   const u8 *addr,
1226 						   const u8 *localaddr)
1227 {
1228 	struct ieee80211_local *local = hw_to_local(hw);
1229 	struct rhlist_head *tmp;
1230 	struct sta_info *sta;
1231 
1232 	/*
1233 	 * Just return a random station if localaddr is NULL
1234 	 * ... first in list.
1235 	 */
1236 	for_each_sta_info(local, addr, sta, tmp) {
1237 		if (localaddr &&
1238 		    !ether_addr_equal(sta->sdata->vif.addr, localaddr))
1239 			continue;
1240 		if (!sta->uploaded)
1241 			return NULL;
1242 		return &sta->sta;
1243 	}
1244 
1245 	return NULL;
1246 }
1247 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_ifaddr);
1248 
1249 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
1250 					 const u8 *addr)
1251 {
1252 	struct sta_info *sta;
1253 
1254 	if (!vif)
1255 		return NULL;
1256 
1257 	sta = sta_info_get_bss(vif_to_sdata(vif), addr);
1258 	if (!sta)
1259 		return NULL;
1260 
1261 	if (!sta->uploaded)
1262 		return NULL;
1263 
1264 	return &sta->sta;
1265 }
1266 EXPORT_SYMBOL(ieee80211_find_sta);
1267 
1268 /* powersave support code */
1269 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
1270 {
1271 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1272 	struct ieee80211_local *local = sdata->local;
1273 	struct sk_buff_head pending;
1274 	int filtered = 0, buffered = 0, ac, i;
1275 	unsigned long flags;
1276 	struct ps_data *ps;
1277 
1278 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1279 		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
1280 				     u.ap);
1281 
1282 	if (sdata->vif.type == NL80211_IFTYPE_AP)
1283 		ps = &sdata->bss->ps;
1284 	else if (ieee80211_vif_is_mesh(&sdata->vif))
1285 		ps = &sdata->u.mesh.ps;
1286 	else
1287 		return;
1288 
1289 	clear_sta_flag(sta, WLAN_STA_SP);
1290 
1291 	BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
1292 	sta->driver_buffered_tids = 0;
1293 	sta->txq_buffered_tids = 0;
1294 
1295 	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1296 		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
1297 
1298 	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
1299 		if (!sta->sta.txq[i] || !txq_has_queue(sta->sta.txq[i]))
1300 			continue;
1301 
1302 		schedule_and_wake_txq(local, to_txq_info(sta->sta.txq[i]));
1303 	}
1304 
1305 	skb_queue_head_init(&pending);
1306 
1307 	/* sync with ieee80211_tx_h_unicast_ps_buf */
1308 	spin_lock(&sta->ps_lock);
1309 	/* Send all buffered frames to the station */
1310 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1311 		int count = skb_queue_len(&pending), tmp;
1312 
1313 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
1314 		skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
1315 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
1316 		tmp = skb_queue_len(&pending);
1317 		filtered += tmp - count;
1318 		count = tmp;
1319 
1320 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
1321 		skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
1322 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
1323 		tmp = skb_queue_len(&pending);
1324 		buffered += tmp - count;
1325 	}
1326 
1327 	ieee80211_add_pending_skbs(local, &pending);
1328 
1329 	/* now we're no longer in the deliver code */
1330 	clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
1331 
1332 	/* The station might have polled and then woken up before we responded,
1333 	 * so clear these flags now to avoid them sticking around.
1334 	 */
1335 	clear_sta_flag(sta, WLAN_STA_PSPOLL);
1336 	clear_sta_flag(sta, WLAN_STA_UAPSD);
1337 	spin_unlock(&sta->ps_lock);
1338 
1339 	atomic_dec(&ps->num_sta_ps);
1340 
1341 	/* This station just woke up and isn't aware of our SMPS state */
1342 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
1343 	    !ieee80211_smps_is_restrictive(sta->known_smps_mode,
1344 					   sdata->smps_mode) &&
1345 	    sta->known_smps_mode != sdata->bss->req_smps &&
1346 	    sta_info_tx_streams(sta) != 1) {
1347 		ht_dbg(sdata,
1348 		       "%pM just woke up and MIMO capable - update SMPS\n",
1349 		       sta->sta.addr);
1350 		ieee80211_send_smps_action(sdata, sdata->bss->req_smps,
1351 					   sta->sta.addr,
1352 					   sdata->vif.bss_conf.bssid);
1353 	}
1354 
1355 	local->total_ps_buffered -= buffered;
1356 
1357 	sta_info_recalc_tim(sta);
1358 
1359 	ps_dbg(sdata,
1360 	       "STA %pM aid %d sending %d filtered/%d PS frames since STA woke up\n",
1361 	       sta->sta.addr, sta->sta.aid, filtered, buffered);
1362 
1363 	ieee80211_check_fast_xmit(sta);
1364 }
1365 
1366 static void ieee80211_send_null_response(struct sta_info *sta, int tid,
1367 					 enum ieee80211_frame_release_type reason,
1368 					 bool call_driver, bool more_data)
1369 {
1370 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1371 	struct ieee80211_local *local = sdata->local;
1372 	struct ieee80211_qos_hdr *nullfunc;
1373 	struct sk_buff *skb;
1374 	int size = sizeof(*nullfunc);
1375 	__le16 fc;
1376 	bool qos = sta->sta.wme;
1377 	struct ieee80211_tx_info *info;
1378 	struct ieee80211_chanctx_conf *chanctx_conf;
1379 
1380 	/* Don't send NDPs when STA is connected HE */
1381 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1382 	    !(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
1383 		return;
1384 
1385 	if (qos) {
1386 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1387 				 IEEE80211_STYPE_QOS_NULLFUNC |
1388 				 IEEE80211_FCTL_FROMDS);
1389 	} else {
1390 		size -= 2;
1391 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1392 				 IEEE80211_STYPE_NULLFUNC |
1393 				 IEEE80211_FCTL_FROMDS);
1394 	}
1395 
1396 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
1397 	if (!skb)
1398 		return;
1399 
1400 	skb_reserve(skb, local->hw.extra_tx_headroom);
1401 
1402 	nullfunc = skb_put(skb, size);
1403 	nullfunc->frame_control = fc;
1404 	nullfunc->duration_id = 0;
1405 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
1406 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1407 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
1408 	nullfunc->seq_ctrl = 0;
1409 
1410 	skb->priority = tid;
1411 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
1412 	if (qos) {
1413 		nullfunc->qos_ctrl = cpu_to_le16(tid);
1414 
1415 		if (reason == IEEE80211_FRAME_RELEASE_UAPSD) {
1416 			nullfunc->qos_ctrl |=
1417 				cpu_to_le16(IEEE80211_QOS_CTL_EOSP);
1418 			if (more_data)
1419 				nullfunc->frame_control |=
1420 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1421 		}
1422 	}
1423 
1424 	info = IEEE80211_SKB_CB(skb);
1425 
1426 	/*
1427 	 * Tell TX path to send this frame even though the
1428 	 * STA may still remain is PS mode after this frame
1429 	 * exchange. Also set EOSP to indicate this packet
1430 	 * ends the poll/service period.
1431 	 */
1432 	info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
1433 		       IEEE80211_TX_STATUS_EOSP |
1434 		       IEEE80211_TX_CTL_REQ_TX_STATUS;
1435 
1436 	info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
1437 
1438 	if (call_driver)
1439 		drv_allow_buffered_frames(local, sta, BIT(tid), 1,
1440 					  reason, false);
1441 
1442 	skb->dev = sdata->dev;
1443 
1444 	rcu_read_lock();
1445 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1446 	if (WARN_ON(!chanctx_conf)) {
1447 		rcu_read_unlock();
1448 		kfree_skb(skb);
1449 		return;
1450 	}
1451 
1452 	info->band = chanctx_conf->def.chan->band;
1453 	ieee80211_xmit(sdata, sta, skb, 0);
1454 	rcu_read_unlock();
1455 }
1456 
1457 static int find_highest_prio_tid(unsigned long tids)
1458 {
1459 	/* lower 3 TIDs aren't ordered perfectly */
1460 	if (tids & 0xF8)
1461 		return fls(tids) - 1;
1462 	/* TID 0 is BE just like TID 3 */
1463 	if (tids & BIT(0))
1464 		return 0;
1465 	return fls(tids) - 1;
1466 }
1467 
1468 /* Indicates if the MORE_DATA bit should be set in the last
1469  * frame obtained by ieee80211_sta_ps_get_frames.
1470  * Note that driver_release_tids is relevant only if
1471  * reason = IEEE80211_FRAME_RELEASE_PSPOLL
1472  */
1473 static bool
1474 ieee80211_sta_ps_more_data(struct sta_info *sta, u8 ignored_acs,
1475 			   enum ieee80211_frame_release_type reason,
1476 			   unsigned long driver_release_tids)
1477 {
1478 	int ac;
1479 
1480 	/* If the driver has data on more than one TID then
1481 	 * certainly there's more data if we release just a
1482 	 * single frame now (from a single TID). This will
1483 	 * only happen for PS-Poll.
1484 	 */
1485 	if (reason == IEEE80211_FRAME_RELEASE_PSPOLL &&
1486 	    hweight16(driver_release_tids) > 1)
1487 		return true;
1488 
1489 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1490 		if (ignored_acs & ieee80211_ac_to_qos_mask[ac])
1491 			continue;
1492 
1493 		if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
1494 		    !skb_queue_empty(&sta->ps_tx_buf[ac]))
1495 			return true;
1496 	}
1497 
1498 	return false;
1499 }
1500 
1501 static void
1502 ieee80211_sta_ps_get_frames(struct sta_info *sta, int n_frames, u8 ignored_acs,
1503 			    enum ieee80211_frame_release_type reason,
1504 			    struct sk_buff_head *frames,
1505 			    unsigned long *driver_release_tids)
1506 {
1507 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1508 	struct ieee80211_local *local = sdata->local;
1509 	int ac;
1510 
1511 	/* Get response frame(s) and more data bit for the last one. */
1512 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1513 		unsigned long tids;
1514 
1515 		if (ignored_acs & ieee80211_ac_to_qos_mask[ac])
1516 			continue;
1517 
1518 		tids = ieee80211_tids_for_ac(ac);
1519 
1520 		/* if we already have frames from software, then we can't also
1521 		 * release from hardware queues
1522 		 */
1523 		if (skb_queue_empty(frames)) {
1524 			*driver_release_tids |=
1525 				sta->driver_buffered_tids & tids;
1526 			*driver_release_tids |= sta->txq_buffered_tids & tids;
1527 		}
1528 
1529 		if (!*driver_release_tids) {
1530 			struct sk_buff *skb;
1531 
1532 			while (n_frames > 0) {
1533 				skb = skb_dequeue(&sta->tx_filtered[ac]);
1534 				if (!skb) {
1535 					skb = skb_dequeue(
1536 						&sta->ps_tx_buf[ac]);
1537 					if (skb)
1538 						local->total_ps_buffered--;
1539 				}
1540 				if (!skb)
1541 					break;
1542 				n_frames--;
1543 				__skb_queue_tail(frames, skb);
1544 			}
1545 		}
1546 
1547 		/* If we have more frames buffered on this AC, then abort the
1548 		 * loop since we can't send more data from other ACs before
1549 		 * the buffered frames from this.
1550 		 */
1551 		if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
1552 		    !skb_queue_empty(&sta->ps_tx_buf[ac]))
1553 			break;
1554 	}
1555 }
1556 
1557 static void
1558 ieee80211_sta_ps_deliver_response(struct sta_info *sta,
1559 				  int n_frames, u8 ignored_acs,
1560 				  enum ieee80211_frame_release_type reason)
1561 {
1562 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1563 	struct ieee80211_local *local = sdata->local;
1564 	unsigned long driver_release_tids = 0;
1565 	struct sk_buff_head frames;
1566 	bool more_data;
1567 
1568 	/* Service or PS-Poll period starts */
1569 	set_sta_flag(sta, WLAN_STA_SP);
1570 
1571 	__skb_queue_head_init(&frames);
1572 
1573 	ieee80211_sta_ps_get_frames(sta, n_frames, ignored_acs, reason,
1574 				    &frames, &driver_release_tids);
1575 
1576 	more_data = ieee80211_sta_ps_more_data(sta, ignored_acs, reason, driver_release_tids);
1577 
1578 	if (driver_release_tids && reason == IEEE80211_FRAME_RELEASE_PSPOLL)
1579 		driver_release_tids =
1580 			BIT(find_highest_prio_tid(driver_release_tids));
1581 
1582 	if (skb_queue_empty(&frames) && !driver_release_tids) {
1583 		int tid, ac;
1584 
1585 		/*
1586 		 * For PS-Poll, this can only happen due to a race condition
1587 		 * when we set the TIM bit and the station notices it, but
1588 		 * before it can poll for the frame we expire it.
1589 		 *
1590 		 * For uAPSD, this is said in the standard (11.2.1.5 h):
1591 		 *	At each unscheduled SP for a non-AP STA, the AP shall
1592 		 *	attempt to transmit at least one MSDU or MMPDU, but no
1593 		 *	more than the value specified in the Max SP Length field
1594 		 *	in the QoS Capability element from delivery-enabled ACs,
1595 		 *	that are destined for the non-AP STA.
1596 		 *
1597 		 * Since we have no other MSDU/MMPDU, transmit a QoS null frame.
1598 		 */
1599 
1600 		/* This will evaluate to 1, 3, 5 or 7. */
1601 		for (ac = IEEE80211_AC_VO; ac < IEEE80211_NUM_ACS; ac++)
1602 			if (!(ignored_acs & ieee80211_ac_to_qos_mask[ac]))
1603 				break;
1604 		tid = 7 - 2 * ac;
1605 
1606 		ieee80211_send_null_response(sta, tid, reason, true, false);
1607 	} else if (!driver_release_tids) {
1608 		struct sk_buff_head pending;
1609 		struct sk_buff *skb;
1610 		int num = 0;
1611 		u16 tids = 0;
1612 		bool need_null = false;
1613 
1614 		skb_queue_head_init(&pending);
1615 
1616 		while ((skb = __skb_dequeue(&frames))) {
1617 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1618 			struct ieee80211_hdr *hdr = (void *) skb->data;
1619 			u8 *qoshdr = NULL;
1620 
1621 			num++;
1622 
1623 			/*
1624 			 * Tell TX path to send this frame even though the
1625 			 * STA may still remain is PS mode after this frame
1626 			 * exchange.
1627 			 */
1628 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
1629 			info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
1630 
1631 			/*
1632 			 * Use MoreData flag to indicate whether there are
1633 			 * more buffered frames for this STA
1634 			 */
1635 			if (more_data || !skb_queue_empty(&frames))
1636 				hdr->frame_control |=
1637 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1638 			else
1639 				hdr->frame_control &=
1640 					cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1641 
1642 			if (ieee80211_is_data_qos(hdr->frame_control) ||
1643 			    ieee80211_is_qos_nullfunc(hdr->frame_control))
1644 				qoshdr = ieee80211_get_qos_ctl(hdr);
1645 
1646 			tids |= BIT(skb->priority);
1647 
1648 			__skb_queue_tail(&pending, skb);
1649 
1650 			/* end service period after last frame or add one */
1651 			if (!skb_queue_empty(&frames))
1652 				continue;
1653 
1654 			if (reason != IEEE80211_FRAME_RELEASE_UAPSD) {
1655 				/* for PS-Poll, there's only one frame */
1656 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1657 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1658 				break;
1659 			}
1660 
1661 			/* For uAPSD, things are a bit more complicated. If the
1662 			 * last frame has a QoS header (i.e. is a QoS-data or
1663 			 * QoS-nulldata frame) then just set the EOSP bit there
1664 			 * and be done.
1665 			 * If the frame doesn't have a QoS header (which means
1666 			 * it should be a bufferable MMPDU) then we can't set
1667 			 * the EOSP bit in the QoS header; add a QoS-nulldata
1668 			 * frame to the list to send it after the MMPDU.
1669 			 *
1670 			 * Note that this code is only in the mac80211-release
1671 			 * code path, we assume that the driver will not buffer
1672 			 * anything but QoS-data frames, or if it does, will
1673 			 * create the QoS-nulldata frame by itself if needed.
1674 			 *
1675 			 * Cf. 802.11-2012 10.2.1.10 (c).
1676 			 */
1677 			if (qoshdr) {
1678 				*qoshdr |= IEEE80211_QOS_CTL_EOSP;
1679 
1680 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1681 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1682 			} else {
1683 				/* The standard isn't completely clear on this
1684 				 * as it says the more-data bit should be set
1685 				 * if there are more BUs. The QoS-Null frame
1686 				 * we're about to send isn't buffered yet, we
1687 				 * only create it below, but let's pretend it
1688 				 * was buffered just in case some clients only
1689 				 * expect more-data=0 when eosp=1.
1690 				 */
1691 				hdr->frame_control |=
1692 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1693 				need_null = true;
1694 				num++;
1695 			}
1696 			break;
1697 		}
1698 
1699 		drv_allow_buffered_frames(local, sta, tids, num,
1700 					  reason, more_data);
1701 
1702 		ieee80211_add_pending_skbs(local, &pending);
1703 
1704 		if (need_null)
1705 			ieee80211_send_null_response(
1706 				sta, find_highest_prio_tid(tids),
1707 				reason, false, false);
1708 
1709 		sta_info_recalc_tim(sta);
1710 	} else {
1711 		int tid;
1712 
1713 		/*
1714 		 * We need to release a frame that is buffered somewhere in the
1715 		 * driver ... it'll have to handle that.
1716 		 * Note that the driver also has to check the number of frames
1717 		 * on the TIDs we're releasing from - if there are more than
1718 		 * n_frames it has to set the more-data bit (if we didn't ask
1719 		 * it to set it anyway due to other buffered frames); if there
1720 		 * are fewer than n_frames it has to make sure to adjust that
1721 		 * to allow the service period to end properly.
1722 		 */
1723 		drv_release_buffered_frames(local, sta, driver_release_tids,
1724 					    n_frames, reason, more_data);
1725 
1726 		/*
1727 		 * Note that we don't recalculate the TIM bit here as it would
1728 		 * most likely have no effect at all unless the driver told us
1729 		 * that the TID(s) became empty before returning here from the
1730 		 * release function.
1731 		 * Either way, however, when the driver tells us that the TID(s)
1732 		 * became empty or we find that a txq became empty, we'll do the
1733 		 * TIM recalculation.
1734 		 */
1735 
1736 		if (!sta->sta.txq[0])
1737 			return;
1738 
1739 		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
1740 			if (!sta->sta.txq[tid] ||
1741 			    !(driver_release_tids & BIT(tid)) ||
1742 			    txq_has_queue(sta->sta.txq[tid]))
1743 				continue;
1744 
1745 			sta_info_recalc_tim(sta);
1746 			break;
1747 		}
1748 	}
1749 }
1750 
1751 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
1752 {
1753 	u8 ignore_for_response = sta->sta.uapsd_queues;
1754 
1755 	/*
1756 	 * If all ACs are delivery-enabled then we should reply
1757 	 * from any of them, if only some are enabled we reply
1758 	 * only from the non-enabled ones.
1759 	 */
1760 	if (ignore_for_response == BIT(IEEE80211_NUM_ACS) - 1)
1761 		ignore_for_response = 0;
1762 
1763 	ieee80211_sta_ps_deliver_response(sta, 1, ignore_for_response,
1764 					  IEEE80211_FRAME_RELEASE_PSPOLL);
1765 }
1766 
1767 void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
1768 {
1769 	int n_frames = sta->sta.max_sp;
1770 	u8 delivery_enabled = sta->sta.uapsd_queues;
1771 
1772 	/*
1773 	 * If we ever grow support for TSPEC this might happen if
1774 	 * the TSPEC update from hostapd comes in between a trigger
1775 	 * frame setting WLAN_STA_UAPSD in the RX path and this
1776 	 * actually getting called.
1777 	 */
1778 	if (!delivery_enabled)
1779 		return;
1780 
1781 	switch (sta->sta.max_sp) {
1782 	case 1:
1783 		n_frames = 2;
1784 		break;
1785 	case 2:
1786 		n_frames = 4;
1787 		break;
1788 	case 3:
1789 		n_frames = 6;
1790 		break;
1791 	case 0:
1792 		/* XXX: what is a good value? */
1793 		n_frames = 128;
1794 		break;
1795 	}
1796 
1797 	ieee80211_sta_ps_deliver_response(sta, n_frames, ~delivery_enabled,
1798 					  IEEE80211_FRAME_RELEASE_UAPSD);
1799 }
1800 
1801 void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
1802 			       struct ieee80211_sta *pubsta, bool block)
1803 {
1804 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1805 
1806 	trace_api_sta_block_awake(sta->local, pubsta, block);
1807 
1808 	if (block) {
1809 		set_sta_flag(sta, WLAN_STA_PS_DRIVER);
1810 		ieee80211_clear_fast_xmit(sta);
1811 		return;
1812 	}
1813 
1814 	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1815 		return;
1816 
1817 	if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
1818 		set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1819 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1820 		ieee80211_queue_work(hw, &sta->drv_deliver_wk);
1821 	} else if (test_sta_flag(sta, WLAN_STA_PSPOLL) ||
1822 		   test_sta_flag(sta, WLAN_STA_UAPSD)) {
1823 		/* must be asleep in this case */
1824 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1825 		ieee80211_queue_work(hw, &sta->drv_deliver_wk);
1826 	} else {
1827 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1828 		ieee80211_check_fast_xmit(sta);
1829 	}
1830 }
1831 EXPORT_SYMBOL(ieee80211_sta_block_awake);
1832 
1833 void ieee80211_sta_eosp(struct ieee80211_sta *pubsta)
1834 {
1835 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1836 	struct ieee80211_local *local = sta->local;
1837 
1838 	trace_api_eosp(local, pubsta);
1839 
1840 	clear_sta_flag(sta, WLAN_STA_SP);
1841 }
1842 EXPORT_SYMBOL(ieee80211_sta_eosp);
1843 
1844 void ieee80211_send_eosp_nullfunc(struct ieee80211_sta *pubsta, int tid)
1845 {
1846 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1847 	enum ieee80211_frame_release_type reason;
1848 	bool more_data;
1849 
1850 	trace_api_send_eosp_nullfunc(sta->local, pubsta, tid);
1851 
1852 	reason = IEEE80211_FRAME_RELEASE_UAPSD;
1853 	more_data = ieee80211_sta_ps_more_data(sta, ~sta->sta.uapsd_queues,
1854 					       reason, 0);
1855 
1856 	ieee80211_send_null_response(sta, tid, reason, false, more_data);
1857 }
1858 EXPORT_SYMBOL(ieee80211_send_eosp_nullfunc);
1859 
1860 void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
1861 				u8 tid, bool buffered)
1862 {
1863 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1864 
1865 	if (WARN_ON(tid >= IEEE80211_NUM_TIDS))
1866 		return;
1867 
1868 	trace_api_sta_set_buffered(sta->local, pubsta, tid, buffered);
1869 
1870 	if (buffered)
1871 		set_bit(tid, &sta->driver_buffered_tids);
1872 	else
1873 		clear_bit(tid, &sta->driver_buffered_tids);
1874 
1875 	sta_info_recalc_tim(sta);
1876 }
1877 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
1878 
1879 void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
1880 				    u32 tx_airtime, u32 rx_airtime)
1881 {
1882 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1883 	struct ieee80211_local *local = sta->sdata->local;
1884 	u8 ac = ieee80211_ac_from_tid(tid);
1885 	u32 airtime = 0;
1886 
1887 	if (sta->local->airtime_flags & AIRTIME_USE_TX)
1888 		airtime += tx_airtime;
1889 	if (sta->local->airtime_flags & AIRTIME_USE_RX)
1890 		airtime += rx_airtime;
1891 
1892 	spin_lock_bh(&local->active_txq_lock[ac]);
1893 	sta->airtime[ac].tx_airtime += tx_airtime;
1894 	sta->airtime[ac].rx_airtime += rx_airtime;
1895 	sta->airtime[ac].deficit -= airtime;
1896 	spin_unlock_bh(&local->active_txq_lock[ac]);
1897 }
1898 EXPORT_SYMBOL(ieee80211_sta_register_airtime);
1899 
1900 int sta_info_move_state(struct sta_info *sta,
1901 			enum ieee80211_sta_state new_state)
1902 {
1903 	might_sleep();
1904 
1905 	if (sta->sta_state == new_state)
1906 		return 0;
1907 
1908 	/* check allowed transitions first */
1909 
1910 	switch (new_state) {
1911 	case IEEE80211_STA_NONE:
1912 		if (sta->sta_state != IEEE80211_STA_AUTH)
1913 			return -EINVAL;
1914 		break;
1915 	case IEEE80211_STA_AUTH:
1916 		if (sta->sta_state != IEEE80211_STA_NONE &&
1917 		    sta->sta_state != IEEE80211_STA_ASSOC)
1918 			return -EINVAL;
1919 		break;
1920 	case IEEE80211_STA_ASSOC:
1921 		if (sta->sta_state != IEEE80211_STA_AUTH &&
1922 		    sta->sta_state != IEEE80211_STA_AUTHORIZED)
1923 			return -EINVAL;
1924 		break;
1925 	case IEEE80211_STA_AUTHORIZED:
1926 		if (sta->sta_state != IEEE80211_STA_ASSOC)
1927 			return -EINVAL;
1928 		break;
1929 	default:
1930 		WARN(1, "invalid state %d", new_state);
1931 		return -EINVAL;
1932 	}
1933 
1934 	sta_dbg(sta->sdata, "moving STA %pM to state %d\n",
1935 		sta->sta.addr, new_state);
1936 
1937 	/*
1938 	 * notify the driver before the actual changes so it can
1939 	 * fail the transition
1940 	 */
1941 	if (test_sta_flag(sta, WLAN_STA_INSERTED)) {
1942 		int err = drv_sta_state(sta->local, sta->sdata, sta,
1943 					sta->sta_state, new_state);
1944 		if (err)
1945 			return err;
1946 	}
1947 
1948 	/* reflect the change in all state variables */
1949 
1950 	switch (new_state) {
1951 	case IEEE80211_STA_NONE:
1952 		if (sta->sta_state == IEEE80211_STA_AUTH)
1953 			clear_bit(WLAN_STA_AUTH, &sta->_flags);
1954 		break;
1955 	case IEEE80211_STA_AUTH:
1956 		if (sta->sta_state == IEEE80211_STA_NONE) {
1957 			set_bit(WLAN_STA_AUTH, &sta->_flags);
1958 		} else if (sta->sta_state == IEEE80211_STA_ASSOC) {
1959 			clear_bit(WLAN_STA_ASSOC, &sta->_flags);
1960 			ieee80211_recalc_min_chandef(sta->sdata);
1961 			if (!sta->sta.support_p2p_ps)
1962 				ieee80211_recalc_p2p_go_ps_allowed(sta->sdata);
1963 		}
1964 		break;
1965 	case IEEE80211_STA_ASSOC:
1966 		if (sta->sta_state == IEEE80211_STA_AUTH) {
1967 			set_bit(WLAN_STA_ASSOC, &sta->_flags);
1968 			ieee80211_recalc_min_chandef(sta->sdata);
1969 			if (!sta->sta.support_p2p_ps)
1970 				ieee80211_recalc_p2p_go_ps_allowed(sta->sdata);
1971 		} else if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
1972 			ieee80211_vif_dec_num_mcast(sta->sdata);
1973 			clear_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1974 			ieee80211_clear_fast_xmit(sta);
1975 			ieee80211_clear_fast_rx(sta);
1976 		}
1977 		break;
1978 	case IEEE80211_STA_AUTHORIZED:
1979 		if (sta->sta_state == IEEE80211_STA_ASSOC) {
1980 			ieee80211_vif_inc_num_mcast(sta->sdata);
1981 			set_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1982 			ieee80211_check_fast_xmit(sta);
1983 			ieee80211_check_fast_rx(sta);
1984 		}
1985 		break;
1986 	default:
1987 		break;
1988 	}
1989 
1990 	sta->sta_state = new_state;
1991 
1992 	return 0;
1993 }
1994 
1995 u8 sta_info_tx_streams(struct sta_info *sta)
1996 {
1997 	struct ieee80211_sta_ht_cap *ht_cap = &sta->sta.ht_cap;
1998 	u8 rx_streams;
1999 
2000 	if (!sta->sta.ht_cap.ht_supported)
2001 		return 1;
2002 
2003 	if (sta->sta.vht_cap.vht_supported) {
2004 		int i;
2005 		u16 tx_mcs_map =
2006 			le16_to_cpu(sta->sta.vht_cap.vht_mcs.tx_mcs_map);
2007 
2008 		for (i = 7; i >= 0; i--)
2009 			if ((tx_mcs_map & (0x3 << (i * 2))) !=
2010 			    IEEE80211_VHT_MCS_NOT_SUPPORTED)
2011 				return i + 1;
2012 	}
2013 
2014 	if (ht_cap->mcs.rx_mask[3])
2015 		rx_streams = 4;
2016 	else if (ht_cap->mcs.rx_mask[2])
2017 		rx_streams = 3;
2018 	else if (ht_cap->mcs.rx_mask[1])
2019 		rx_streams = 2;
2020 	else
2021 		rx_streams = 1;
2022 
2023 	if (!(ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_RX_DIFF))
2024 		return rx_streams;
2025 
2026 	return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
2027 			>> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
2028 }
2029 
2030 static struct ieee80211_sta_rx_stats *
2031 sta_get_last_rx_stats(struct sta_info *sta)
2032 {
2033 	struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
2034 	struct ieee80211_local *local = sta->local;
2035 	int cpu;
2036 
2037 	if (!ieee80211_hw_check(&local->hw, USES_RSS))
2038 		return stats;
2039 
2040 	for_each_possible_cpu(cpu) {
2041 		struct ieee80211_sta_rx_stats *cpustats;
2042 
2043 		cpustats = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
2044 
2045 		if (time_after(cpustats->last_rx, stats->last_rx))
2046 			stats = cpustats;
2047 	}
2048 
2049 	return stats;
2050 }
2051 
2052 static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
2053 				  struct rate_info *rinfo)
2054 {
2055 	rinfo->bw = STA_STATS_GET(BW, rate);
2056 
2057 	switch (STA_STATS_GET(TYPE, rate)) {
2058 	case STA_STATS_RATE_TYPE_VHT:
2059 		rinfo->flags = RATE_INFO_FLAGS_VHT_MCS;
2060 		rinfo->mcs = STA_STATS_GET(VHT_MCS, rate);
2061 		rinfo->nss = STA_STATS_GET(VHT_NSS, rate);
2062 		if (STA_STATS_GET(SGI, rate))
2063 			rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
2064 		break;
2065 	case STA_STATS_RATE_TYPE_HT:
2066 		rinfo->flags = RATE_INFO_FLAGS_MCS;
2067 		rinfo->mcs = STA_STATS_GET(HT_MCS, rate);
2068 		if (STA_STATS_GET(SGI, rate))
2069 			rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
2070 		break;
2071 	case STA_STATS_RATE_TYPE_LEGACY: {
2072 		struct ieee80211_supported_band *sband;
2073 		u16 brate;
2074 		unsigned int shift;
2075 		int band = STA_STATS_GET(LEGACY_BAND, rate);
2076 		int rate_idx = STA_STATS_GET(LEGACY_IDX, rate);
2077 
2078 		sband = local->hw.wiphy->bands[band];
2079 		brate = sband->bitrates[rate_idx].bitrate;
2080 		if (rinfo->bw == RATE_INFO_BW_5)
2081 			shift = 2;
2082 		else if (rinfo->bw == RATE_INFO_BW_10)
2083 			shift = 1;
2084 		else
2085 			shift = 0;
2086 		rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
2087 		break;
2088 		}
2089 	case STA_STATS_RATE_TYPE_HE:
2090 		rinfo->flags = RATE_INFO_FLAGS_HE_MCS;
2091 		rinfo->mcs = STA_STATS_GET(HE_MCS, rate);
2092 		rinfo->nss = STA_STATS_GET(HE_NSS, rate);
2093 		rinfo->he_gi = STA_STATS_GET(HE_GI, rate);
2094 		rinfo->he_ru_alloc = STA_STATS_GET(HE_RU, rate);
2095 		rinfo->he_dcm = STA_STATS_GET(HE_DCM, rate);
2096 		break;
2097 	}
2098 }
2099 
2100 static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
2101 {
2102 	u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
2103 
2104 	if (rate == STA_STATS_RATE_INVALID)
2105 		return -EINVAL;
2106 
2107 	sta_stats_decode_rate(sta->local, rate, rinfo);
2108 	return 0;
2109 }
2110 
2111 static void sta_set_tidstats(struct sta_info *sta,
2112 			     struct cfg80211_tid_stats *tidstats,
2113 			     int tid)
2114 {
2115 	struct ieee80211_local *local = sta->local;
2116 
2117 	if (!(tidstats->filled & BIT(NL80211_TID_STATS_RX_MSDU))) {
2118 		unsigned int start;
2119 
2120 		do {
2121 			start = u64_stats_fetch_begin(&sta->rx_stats.syncp);
2122 			tidstats->rx_msdu = sta->rx_stats.msdu[tid];
2123 		} while (u64_stats_fetch_retry(&sta->rx_stats.syncp, start));
2124 
2125 		tidstats->filled |= BIT(NL80211_TID_STATS_RX_MSDU);
2126 	}
2127 
2128 	if (!(tidstats->filled & BIT(NL80211_TID_STATS_TX_MSDU))) {
2129 		tidstats->filled |= BIT(NL80211_TID_STATS_TX_MSDU);
2130 		tidstats->tx_msdu = sta->tx_stats.msdu[tid];
2131 	}
2132 
2133 	if (!(tidstats->filled & BIT(NL80211_TID_STATS_TX_MSDU_RETRIES)) &&
2134 	    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
2135 		tidstats->filled |= BIT(NL80211_TID_STATS_TX_MSDU_RETRIES);
2136 		tidstats->tx_msdu_retries = sta->status_stats.msdu_retries[tid];
2137 	}
2138 
2139 	if (!(tidstats->filled & BIT(NL80211_TID_STATS_TX_MSDU_FAILED)) &&
2140 	    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
2141 		tidstats->filled |= BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
2142 		tidstats->tx_msdu_failed = sta->status_stats.msdu_failed[tid];
2143 	}
2144 
2145 	if (local->ops->wake_tx_queue && tid < IEEE80211_NUM_TIDS) {
2146 		spin_lock_bh(&local->fq.lock);
2147 		rcu_read_lock();
2148 
2149 		tidstats->filled |= BIT(NL80211_TID_STATS_TXQ_STATS);
2150 		ieee80211_fill_txq_stats(&tidstats->txq_stats,
2151 					 to_txq_info(sta->sta.txq[tid]));
2152 
2153 		rcu_read_unlock();
2154 		spin_unlock_bh(&local->fq.lock);
2155 	}
2156 }
2157 
2158 static inline u64 sta_get_stats_bytes(struct ieee80211_sta_rx_stats *rxstats)
2159 {
2160 	unsigned int start;
2161 	u64 value;
2162 
2163 	do {
2164 		start = u64_stats_fetch_begin(&rxstats->syncp);
2165 		value = rxstats->bytes;
2166 	} while (u64_stats_fetch_retry(&rxstats->syncp, start));
2167 
2168 	return value;
2169 }
2170 
2171 void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
2172 		   bool tidstats)
2173 {
2174 	struct ieee80211_sub_if_data *sdata = sta->sdata;
2175 	struct ieee80211_local *local = sdata->local;
2176 	u32 thr = 0;
2177 	int i, ac, cpu;
2178 	struct ieee80211_sta_rx_stats *last_rxstats;
2179 
2180 	last_rxstats = sta_get_last_rx_stats(sta);
2181 
2182 	sinfo->generation = sdata->local->sta_generation;
2183 
2184 	/* do before driver, so beacon filtering drivers have a
2185 	 * chance to e.g. just add the number of filtered beacons
2186 	 * (or just modify the value entirely, of course)
2187 	 */
2188 	if (sdata->vif.type == NL80211_IFTYPE_STATION)
2189 		sinfo->rx_beacon = sdata->u.mgd.count_beacon_signal;
2190 
2191 	drv_sta_statistics(local, sdata, &sta->sta, sinfo);
2192 
2193 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME) |
2194 			 BIT_ULL(NL80211_STA_INFO_STA_FLAGS) |
2195 			 BIT_ULL(NL80211_STA_INFO_BSS_PARAM) |
2196 			 BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME) |
2197 			 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC);
2198 
2199 	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2200 		sinfo->beacon_loss_count = sdata->u.mgd.beacon_loss_count;
2201 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_LOSS);
2202 	}
2203 
2204 	sinfo->connected_time = ktime_get_seconds() - sta->last_connected;
2205 	sinfo->inactive_time =
2206 		jiffies_to_msecs(jiffies - ieee80211_sta_last_active(sta));
2207 
2208 	if (!(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES64) |
2209 			       BIT_ULL(NL80211_STA_INFO_TX_BYTES)))) {
2210 		sinfo->tx_bytes = 0;
2211 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2212 			sinfo->tx_bytes += sta->tx_stats.bytes[ac];
2213 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
2214 	}
2215 
2216 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_PACKETS))) {
2217 		sinfo->tx_packets = 0;
2218 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2219 			sinfo->tx_packets += sta->tx_stats.packets[ac];
2220 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
2221 	}
2222 
2223 	if (!(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES64) |
2224 			       BIT_ULL(NL80211_STA_INFO_RX_BYTES)))) {
2225 		sinfo->rx_bytes += sta_get_stats_bytes(&sta->rx_stats);
2226 
2227 		if (sta->pcpu_rx_stats) {
2228 			for_each_possible_cpu(cpu) {
2229 				struct ieee80211_sta_rx_stats *cpurxs;
2230 
2231 				cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
2232 				sinfo->rx_bytes += sta_get_stats_bytes(cpurxs);
2233 			}
2234 		}
2235 
2236 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
2237 	}
2238 
2239 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_PACKETS))) {
2240 		sinfo->rx_packets = sta->rx_stats.packets;
2241 		if (sta->pcpu_rx_stats) {
2242 			for_each_possible_cpu(cpu) {
2243 				struct ieee80211_sta_rx_stats *cpurxs;
2244 
2245 				cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
2246 				sinfo->rx_packets += cpurxs->packets;
2247 			}
2248 		}
2249 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
2250 	}
2251 
2252 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_RETRIES))) {
2253 		sinfo->tx_retries = sta->status_stats.retry_count;
2254 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
2255 	}
2256 
2257 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED))) {
2258 		sinfo->tx_failed = sta->status_stats.retry_failed;
2259 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
2260 	}
2261 
2262 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_DURATION))) {
2263 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2264 			sinfo->rx_duration += sta->airtime[ac].rx_airtime;
2265 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_DURATION);
2266 	}
2267 
2268 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_DURATION))) {
2269 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2270 			sinfo->tx_duration += sta->airtime[ac].tx_airtime;
2271 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_DURATION);
2272 	}
2273 
2274 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
2275 		sinfo->airtime_weight = sta->airtime_weight;
2276 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);
2277 	}
2278 
2279 	sinfo->rx_dropped_misc = sta->rx_stats.dropped;
2280 	if (sta->pcpu_rx_stats) {
2281 		for_each_possible_cpu(cpu) {
2282 			struct ieee80211_sta_rx_stats *cpurxs;
2283 
2284 			cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
2285 			sinfo->rx_dropped_misc += cpurxs->dropped;
2286 		}
2287 	}
2288 
2289 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2290 	    !(sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)) {
2291 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX) |
2292 				 BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
2293 		sinfo->rx_beacon_signal_avg = ieee80211_ave_rssi(&sdata->vif);
2294 	}
2295 
2296 	if (ieee80211_hw_check(&sta->local->hw, SIGNAL_DBM) ||
2297 	    ieee80211_hw_check(&sta->local->hw, SIGNAL_UNSPEC)) {
2298 		if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_SIGNAL))) {
2299 			sinfo->signal = (s8)last_rxstats->last_signal;
2300 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2301 		}
2302 
2303 		if (!sta->pcpu_rx_stats &&
2304 		    !(sinfo->filled & BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG))) {
2305 			sinfo->signal_avg =
2306 				-ewma_signal_read(&sta->rx_stats_avg.signal);
2307 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
2308 		}
2309 	}
2310 
2311 	/* for the average - if pcpu_rx_stats isn't set - rxstats must point to
2312 	 * the sta->rx_stats struct, so the check here is fine with and without
2313 	 * pcpu statistics
2314 	 */
2315 	if (last_rxstats->chains &&
2316 	    !(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL) |
2317 			       BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)))) {
2318 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
2319 		if (!sta->pcpu_rx_stats)
2320 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
2321 
2322 		sinfo->chains = last_rxstats->chains;
2323 
2324 		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
2325 			sinfo->chain_signal[i] =
2326 				last_rxstats->chain_signal_last[i];
2327 			sinfo->chain_signal_avg[i] =
2328 				-ewma_signal_read(&sta->rx_stats_avg.chain_signal[i]);
2329 		}
2330 	}
2331 
2332 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE))) {
2333 		sta_set_rate_info_tx(sta, &sta->tx_stats.last_rate,
2334 				     &sinfo->txrate);
2335 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
2336 	}
2337 
2338 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE))) {
2339 		if (sta_set_rate_info_rx(sta, &sinfo->rxrate) == 0)
2340 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
2341 	}
2342 
2343 	if (tidstats && !cfg80211_sinfo_alloc_tid_stats(sinfo, GFP_KERNEL)) {
2344 		for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++)
2345 			sta_set_tidstats(sta, &sinfo->pertid[i], i);
2346 	}
2347 
2348 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
2349 #ifdef CONFIG_MAC80211_MESH
2350 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_LLID) |
2351 				 BIT_ULL(NL80211_STA_INFO_PLID) |
2352 				 BIT_ULL(NL80211_STA_INFO_PLINK_STATE) |
2353 				 BIT_ULL(NL80211_STA_INFO_LOCAL_PM) |
2354 				 BIT_ULL(NL80211_STA_INFO_PEER_PM) |
2355 				 BIT_ULL(NL80211_STA_INFO_NONPEER_PM) |
2356 				 BIT_ULL(NL80211_STA_INFO_CONNECTED_TO_GATE);
2357 
2358 		sinfo->llid = sta->mesh->llid;
2359 		sinfo->plid = sta->mesh->plid;
2360 		sinfo->plink_state = sta->mesh->plink_state;
2361 		if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
2362 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_T_OFFSET);
2363 			sinfo->t_offset = sta->mesh->t_offset;
2364 		}
2365 		sinfo->local_pm = sta->mesh->local_pm;
2366 		sinfo->peer_pm = sta->mesh->peer_pm;
2367 		sinfo->nonpeer_pm = sta->mesh->nonpeer_pm;
2368 		sinfo->connected_to_gate = sta->mesh->connected_to_gate;
2369 #endif
2370 	}
2371 
2372 	sinfo->bss_param.flags = 0;
2373 	if (sdata->vif.bss_conf.use_cts_prot)
2374 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2375 	if (sdata->vif.bss_conf.use_short_preamble)
2376 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2377 	if (sdata->vif.bss_conf.use_short_slot)
2378 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2379 	sinfo->bss_param.dtim_period = sdata->vif.bss_conf.dtim_period;
2380 	sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
2381 
2382 	sinfo->sta_flags.set = 0;
2383 	sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2384 				BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2385 				BIT(NL80211_STA_FLAG_WME) |
2386 				BIT(NL80211_STA_FLAG_MFP) |
2387 				BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2388 				BIT(NL80211_STA_FLAG_ASSOCIATED) |
2389 				BIT(NL80211_STA_FLAG_TDLS_PEER);
2390 	if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2391 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2392 	if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
2393 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
2394 	if (sta->sta.wme)
2395 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
2396 	if (test_sta_flag(sta, WLAN_STA_MFP))
2397 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
2398 	if (test_sta_flag(sta, WLAN_STA_AUTH))
2399 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2400 	if (test_sta_flag(sta, WLAN_STA_ASSOC))
2401 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2402 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
2403 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2404 
2405 	thr = sta_get_expected_throughput(sta);
2406 
2407 	if (thr != 0) {
2408 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
2409 		sinfo->expected_throughput = thr;
2410 	}
2411 
2412 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL)) &&
2413 	    sta->status_stats.ack_signal_filled) {
2414 		sinfo->ack_signal = sta->status_stats.last_ack_signal;
2415 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
2416 	}
2417 
2418 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG)) &&
2419 	    sta->status_stats.ack_signal_filled) {
2420 		sinfo->avg_ack_signal =
2421 			-(s8)ewma_avg_signal_read(
2422 				&sta->status_stats.avg_ack_signal);
2423 		sinfo->filled |=
2424 			BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG);
2425 	}
2426 
2427 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
2428 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_LINK_METRIC);
2429 		sinfo->airtime_link_metric =
2430 			airtime_link_metric_get(local, sta);
2431 	}
2432 }
2433 
2434 u32 sta_get_expected_throughput(struct sta_info *sta)
2435 {
2436 	struct ieee80211_sub_if_data *sdata = sta->sdata;
2437 	struct ieee80211_local *local = sdata->local;
2438 	struct rate_control_ref *ref = NULL;
2439 	u32 thr = 0;
2440 
2441 	if (test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
2442 		ref = local->rate_ctrl;
2443 
2444 	/* check if the driver has a SW RC implementation */
2445 	if (ref && ref->ops->get_expected_throughput)
2446 		thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
2447 	else
2448 		thr = drv_get_expected_throughput(local, sta);
2449 
2450 	return thr;
2451 }
2452 
2453 unsigned long ieee80211_sta_last_active(struct sta_info *sta)
2454 {
2455 	struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
2456 
2457 	if (time_after(stats->last_rx, sta->status_stats.last_ack))
2458 		return stats->last_rx;
2459 	return sta->status_stats.last_ack;
2460 }
2461 
2462 static void sta_update_codel_params(struct sta_info *sta, u32 thr)
2463 {
2464 	if (!sta->sdata->local->ops->wake_tx_queue)
2465 		return;
2466 
2467 	if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
2468 		sta->cparams.target = MS2TIME(50);
2469 		sta->cparams.interval = MS2TIME(300);
2470 		sta->cparams.ecn = false;
2471 	} else {
2472 		sta->cparams.target = MS2TIME(20);
2473 		sta->cparams.interval = MS2TIME(100);
2474 		sta->cparams.ecn = true;
2475 	}
2476 }
2477 
2478 void ieee80211_sta_set_expected_throughput(struct ieee80211_sta *pubsta,
2479 					   u32 thr)
2480 {
2481 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
2482 
2483 	sta_update_codel_params(sta, thr);
2484 }
2485