xref: /openbmc/linux/net/mac80211/sta_info.c (revision 9b9c2cd4)
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
4  * Copyright 2013-2014  Intel Mobile Communications GmbH
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10 
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/etherdevice.h>
14 #include <linux/netdevice.h>
15 #include <linux/types.h>
16 #include <linux/slab.h>
17 #include <linux/skbuff.h>
18 #include <linux/if_arp.h>
19 #include <linux/timer.h>
20 #include <linux/rtnetlink.h>
21 
22 #include <net/mac80211.h>
23 #include "ieee80211_i.h"
24 #include "driver-ops.h"
25 #include "rate.h"
26 #include "sta_info.h"
27 #include "debugfs_sta.h"
28 #include "mesh.h"
29 #include "wme.h"
30 
31 /**
32  * DOC: STA information lifetime rules
33  *
34  * STA info structures (&struct sta_info) are managed in a hash table
35  * for faster lookup and a list for iteration. They are managed using
36  * RCU, i.e. access to the list and hash table is protected by RCU.
37  *
38  * Upon allocating a STA info structure with sta_info_alloc(), the caller
39  * owns that structure. It must then insert it into the hash table using
40  * either sta_info_insert() or sta_info_insert_rcu(); only in the latter
41  * case (which acquires an rcu read section but must not be called from
42  * within one) will the pointer still be valid after the call. Note that
43  * the caller may not do much with the STA info before inserting it, in
44  * particular, it may not start any mesh peer link management or add
45  * encryption keys.
46  *
47  * When the insertion fails (sta_info_insert()) returns non-zero), the
48  * structure will have been freed by sta_info_insert()!
49  *
50  * Station entries are added by mac80211 when you establish a link with a
51  * peer. This means different things for the different type of interfaces
52  * we support. For a regular station this mean we add the AP sta when we
53  * receive an association response from the AP. For IBSS this occurs when
54  * get to know about a peer on the same IBSS. For WDS we add the sta for
55  * the peer immediately upon device open. When using AP mode we add stations
56  * for each respective station upon request from userspace through nl80211.
57  *
58  * In order to remove a STA info structure, various sta_info_destroy_*()
59  * calls are available.
60  *
61  * There is no concept of ownership on a STA entry, each structure is
62  * owned by the global hash table/list until it is removed. All users of
63  * the structure need to be RCU protected so that the structure won't be
64  * freed before they are done using it.
65  */
66 
67 static const struct rhashtable_params sta_rht_params = {
68 	.nelem_hint = 3, /* start small */
69 	.automatic_shrinking = true,
70 	.head_offset = offsetof(struct sta_info, hash_node),
71 	.key_offset = offsetof(struct sta_info, addr),
72 	.key_len = ETH_ALEN,
73 	.hashfn = sta_addr_hash,
74 	.max_size = CONFIG_MAC80211_STA_HASH_MAX_SIZE,
75 };
76 
77 /* Caller must hold local->sta_mtx */
78 static int sta_info_hash_del(struct ieee80211_local *local,
79 			     struct sta_info *sta)
80 {
81 	return rhashtable_remove_fast(&local->sta_hash, &sta->hash_node,
82 				      sta_rht_params);
83 }
84 
85 static void __cleanup_single_sta(struct sta_info *sta)
86 {
87 	int ac, i;
88 	struct tid_ampdu_tx *tid_tx;
89 	struct ieee80211_sub_if_data *sdata = sta->sdata;
90 	struct ieee80211_local *local = sdata->local;
91 	struct ps_data *ps;
92 
93 	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
94 	    test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
95 	    test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
96 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
97 		    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
98 			ps = &sdata->bss->ps;
99 		else if (ieee80211_vif_is_mesh(&sdata->vif))
100 			ps = &sdata->u.mesh.ps;
101 		else
102 			return;
103 
104 		clear_sta_flag(sta, WLAN_STA_PS_STA);
105 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
106 		clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
107 
108 		atomic_dec(&ps->num_sta_ps);
109 	}
110 
111 	if (sta->sta.txq[0]) {
112 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
113 			struct txq_info *txqi = to_txq_info(sta->sta.txq[i]);
114 			int n = skb_queue_len(&txqi->queue);
115 
116 			ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
117 			atomic_sub(n, &sdata->txqs_len[txqi->txq.ac]);
118 		}
119 	}
120 
121 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
122 		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
123 		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
124 		ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
125 	}
126 
127 	if (ieee80211_vif_is_mesh(&sdata->vif))
128 		mesh_sta_cleanup(sta);
129 
130 	cancel_work_sync(&sta->drv_deliver_wk);
131 
132 	/*
133 	 * Destroy aggregation state here. It would be nice to wait for the
134 	 * driver to finish aggregation stop and then clean up, but for now
135 	 * drivers have to handle aggregation stop being requested, followed
136 	 * directly by station destruction.
137 	 */
138 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
139 		kfree(sta->ampdu_mlme.tid_start_tx[i]);
140 		tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
141 		if (!tid_tx)
142 			continue;
143 		ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
144 		kfree(tid_tx);
145 	}
146 }
147 
148 static void cleanup_single_sta(struct sta_info *sta)
149 {
150 	struct ieee80211_sub_if_data *sdata = sta->sdata;
151 	struct ieee80211_local *local = sdata->local;
152 
153 	__cleanup_single_sta(sta);
154 	sta_info_free(local, sta);
155 }
156 
157 /* protected by RCU */
158 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
159 			      const u8 *addr)
160 {
161 	struct ieee80211_local *local = sdata->local;
162 	struct sta_info *sta;
163 	struct rhash_head *tmp;
164 	const struct bucket_table *tbl;
165 
166 	rcu_read_lock();
167 	tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
168 
169 	for_each_sta_info(local, tbl, addr, sta, tmp) {
170 		if (sta->sdata == sdata) {
171 			rcu_read_unlock();
172 			/* this is safe as the caller must already hold
173 			 * another rcu read section or the mutex
174 			 */
175 			return sta;
176 		}
177 	}
178 	rcu_read_unlock();
179 	return NULL;
180 }
181 
182 /*
183  * Get sta info either from the specified interface
184  * or from one of its vlans
185  */
186 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
187 				  const u8 *addr)
188 {
189 	struct ieee80211_local *local = sdata->local;
190 	struct sta_info *sta;
191 	struct rhash_head *tmp;
192 	const struct bucket_table *tbl;
193 
194 	rcu_read_lock();
195 	tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
196 
197 	for_each_sta_info(local, tbl, addr, sta, tmp) {
198 		if (sta->sdata == sdata ||
199 		    (sta->sdata->bss && sta->sdata->bss == sdata->bss)) {
200 			rcu_read_unlock();
201 			/* this is safe as the caller must already hold
202 			 * another rcu read section or the mutex
203 			 */
204 			return sta;
205 		}
206 	}
207 	rcu_read_unlock();
208 	return NULL;
209 }
210 
211 struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
212 				     int idx)
213 {
214 	struct ieee80211_local *local = sdata->local;
215 	struct sta_info *sta;
216 	int i = 0;
217 
218 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
219 		if (sdata != sta->sdata)
220 			continue;
221 		if (i < idx) {
222 			++i;
223 			continue;
224 		}
225 		return sta;
226 	}
227 
228 	return NULL;
229 }
230 
231 /**
232  * sta_info_free - free STA
233  *
234  * @local: pointer to the global information
235  * @sta: STA info to free
236  *
237  * This function must undo everything done by sta_info_alloc()
238  * that may happen before sta_info_insert(). It may only be
239  * called when sta_info_insert() has not been attempted (and
240  * if that fails, the station is freed anyway.)
241  */
242 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
243 {
244 	if (sta->rate_ctrl)
245 		rate_control_free_sta(sta);
246 
247 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
248 
249 	if (sta->sta.txq[0])
250 		kfree(to_txq_info(sta->sta.txq[0]));
251 	kfree(rcu_dereference_raw(sta->sta.rates));
252 #ifdef CONFIG_MAC80211_MESH
253 	kfree(sta->mesh);
254 #endif
255 	kfree(sta);
256 }
257 
258 /* Caller must hold local->sta_mtx */
259 static void sta_info_hash_add(struct ieee80211_local *local,
260 			      struct sta_info *sta)
261 {
262 	rhashtable_insert_fast(&local->sta_hash, &sta->hash_node,
263 			       sta_rht_params);
264 }
265 
266 static void sta_deliver_ps_frames(struct work_struct *wk)
267 {
268 	struct sta_info *sta;
269 
270 	sta = container_of(wk, struct sta_info, drv_deliver_wk);
271 
272 	if (sta->dead)
273 		return;
274 
275 	local_bh_disable();
276 	if (!test_sta_flag(sta, WLAN_STA_PS_STA))
277 		ieee80211_sta_ps_deliver_wakeup(sta);
278 	else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
279 		ieee80211_sta_ps_deliver_poll_response(sta);
280 	else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
281 		ieee80211_sta_ps_deliver_uapsd(sta);
282 	local_bh_enable();
283 }
284 
285 static int sta_prepare_rate_control(struct ieee80211_local *local,
286 				    struct sta_info *sta, gfp_t gfp)
287 {
288 	if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL))
289 		return 0;
290 
291 	sta->rate_ctrl = local->rate_ctrl;
292 	sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
293 						     sta, gfp);
294 	if (!sta->rate_ctrl_priv)
295 		return -ENOMEM;
296 
297 	return 0;
298 }
299 
300 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
301 				const u8 *addr, gfp_t gfp)
302 {
303 	struct ieee80211_local *local = sdata->local;
304 	struct ieee80211_hw *hw = &local->hw;
305 	struct sta_info *sta;
306 	int i;
307 
308 	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
309 	if (!sta)
310 		return NULL;
311 
312 	spin_lock_init(&sta->lock);
313 	spin_lock_init(&sta->ps_lock);
314 	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
315 	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
316 	mutex_init(&sta->ampdu_mlme.mtx);
317 #ifdef CONFIG_MAC80211_MESH
318 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
319 		sta->mesh = kzalloc(sizeof(*sta->mesh), gfp);
320 		if (!sta->mesh)
321 			goto free;
322 		spin_lock_init(&sta->mesh->plink_lock);
323 		if (ieee80211_vif_is_mesh(&sdata->vif) &&
324 		    !sdata->u.mesh.user_mpm)
325 			init_timer(&sta->mesh->plink_timer);
326 		sta->mesh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
327 	}
328 #endif
329 
330 	memcpy(sta->addr, addr, ETH_ALEN);
331 	memcpy(sta->sta.addr, addr, ETH_ALEN);
332 	sta->local = local;
333 	sta->sdata = sdata;
334 	sta->rx_stats.last_rx = jiffies;
335 
336 	sta->sta_state = IEEE80211_STA_NONE;
337 
338 	/* Mark TID as unreserved */
339 	sta->reserved_tid = IEEE80211_TID_UNRESERVED;
340 
341 	sta->last_connected = ktime_get_seconds();
342 	ewma_signal_init(&sta->rx_stats.avg_signal);
343 	for (i = 0; i < ARRAY_SIZE(sta->rx_stats.chain_signal_avg); i++)
344 		ewma_signal_init(&sta->rx_stats.chain_signal_avg[i]);
345 
346 	if (local->ops->wake_tx_queue) {
347 		void *txq_data;
348 		int size = sizeof(struct txq_info) +
349 			   ALIGN(hw->txq_data_size, sizeof(void *));
350 
351 		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
352 		if (!txq_data)
353 			goto free;
354 
355 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
356 			struct txq_info *txq = txq_data + i * size;
357 
358 			ieee80211_init_tx_queue(sdata, sta, txq, i);
359 		}
360 	}
361 
362 	if (sta_prepare_rate_control(local, sta, gfp))
363 		goto free_txq;
364 
365 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
366 		/*
367 		 * timer_to_tid must be initialized with identity mapping
368 		 * to enable session_timer's data differentiation. See
369 		 * sta_rx_agg_session_timer_expired for usage.
370 		 */
371 		sta->timer_to_tid[i] = i;
372 	}
373 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
374 		skb_queue_head_init(&sta->ps_tx_buf[i]);
375 		skb_queue_head_init(&sta->tx_filtered[i]);
376 	}
377 
378 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
379 		sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
380 
381 	sta->sta.smps_mode = IEEE80211_SMPS_OFF;
382 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
383 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
384 		struct ieee80211_supported_band *sband =
385 			hw->wiphy->bands[ieee80211_get_sdata_band(sdata)];
386 		u8 smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
387 				IEEE80211_HT_CAP_SM_PS_SHIFT;
388 		/*
389 		 * Assume that hostapd advertises our caps in the beacon and
390 		 * this is the known_smps_mode for a station that just assciated
391 		 */
392 		switch (smps) {
393 		case WLAN_HT_SMPS_CONTROL_DISABLED:
394 			sta->known_smps_mode = IEEE80211_SMPS_OFF;
395 			break;
396 		case WLAN_HT_SMPS_CONTROL_STATIC:
397 			sta->known_smps_mode = IEEE80211_SMPS_STATIC;
398 			break;
399 		case WLAN_HT_SMPS_CONTROL_DYNAMIC:
400 			sta->known_smps_mode = IEEE80211_SMPS_DYNAMIC;
401 			break;
402 		default:
403 			WARN_ON(1);
404 		}
405 	}
406 
407 	sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
408 
409 	return sta;
410 
411 free_txq:
412 	if (sta->sta.txq[0])
413 		kfree(to_txq_info(sta->sta.txq[0]));
414 free:
415 #ifdef CONFIG_MAC80211_MESH
416 	kfree(sta->mesh);
417 #endif
418 	kfree(sta);
419 	return NULL;
420 }
421 
422 static int sta_info_insert_check(struct sta_info *sta)
423 {
424 	struct ieee80211_sub_if_data *sdata = sta->sdata;
425 
426 	/*
427 	 * Can't be a WARN_ON because it can be triggered through a race:
428 	 * something inserts a STA (on one CPU) without holding the RTNL
429 	 * and another CPU turns off the net device.
430 	 */
431 	if (unlikely(!ieee80211_sdata_running(sdata)))
432 		return -ENETDOWN;
433 
434 	if (WARN_ON(ether_addr_equal(sta->sta.addr, sdata->vif.addr) ||
435 		    is_multicast_ether_addr(sta->sta.addr)))
436 		return -EINVAL;
437 
438 	return 0;
439 }
440 
441 static int sta_info_insert_drv_state(struct ieee80211_local *local,
442 				     struct ieee80211_sub_if_data *sdata,
443 				     struct sta_info *sta)
444 {
445 	enum ieee80211_sta_state state;
446 	int err = 0;
447 
448 	for (state = IEEE80211_STA_NOTEXIST; state < sta->sta_state; state++) {
449 		err = drv_sta_state(local, sdata, sta, state, state + 1);
450 		if (err)
451 			break;
452 	}
453 
454 	if (!err) {
455 		/*
456 		 * Drivers using legacy sta_add/sta_remove callbacks only
457 		 * get uploaded set to true after sta_add is called.
458 		 */
459 		if (!local->ops->sta_add)
460 			sta->uploaded = true;
461 		return 0;
462 	}
463 
464 	if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
465 		sdata_info(sdata,
466 			   "failed to move IBSS STA %pM to state %d (%d) - keeping it anyway\n",
467 			   sta->sta.addr, state + 1, err);
468 		err = 0;
469 	}
470 
471 	/* unwind on error */
472 	for (; state > IEEE80211_STA_NOTEXIST; state--)
473 		WARN_ON(drv_sta_state(local, sdata, sta, state, state - 1));
474 
475 	return err;
476 }
477 
478 /*
479  * should be called with sta_mtx locked
480  * this function replaces the mutex lock
481  * with a RCU lock
482  */
483 static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
484 {
485 	struct ieee80211_local *local = sta->local;
486 	struct ieee80211_sub_if_data *sdata = sta->sdata;
487 	struct station_info sinfo;
488 	int err = 0;
489 
490 	lockdep_assert_held(&local->sta_mtx);
491 
492 	/* check if STA exists already */
493 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
494 		err = -EEXIST;
495 		goto out_err;
496 	}
497 
498 	local->num_sta++;
499 	local->sta_generation++;
500 	smp_mb();
501 
502 	/* simplify things and don't accept BA sessions yet */
503 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
504 
505 	/* make the station visible */
506 	sta_info_hash_add(local, sta);
507 
508 	list_add_tail_rcu(&sta->list, &local->sta_list);
509 
510 	/* notify driver */
511 	err = sta_info_insert_drv_state(local, sdata, sta);
512 	if (err)
513 		goto out_remove;
514 
515 	set_sta_flag(sta, WLAN_STA_INSERTED);
516 	/* accept BA sessions now */
517 	clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
518 
519 	ieee80211_recalc_min_chandef(sdata);
520 	ieee80211_sta_debugfs_add(sta);
521 	rate_control_add_sta_debugfs(sta);
522 
523 	memset(&sinfo, 0, sizeof(sinfo));
524 	sinfo.filled = 0;
525 	sinfo.generation = local->sta_generation;
526 	cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
527 
528 	sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr);
529 
530 	/* move reference to rcu-protected */
531 	rcu_read_lock();
532 	mutex_unlock(&local->sta_mtx);
533 
534 	if (ieee80211_vif_is_mesh(&sdata->vif))
535 		mesh_accept_plinks_update(sdata);
536 
537 	return 0;
538  out_remove:
539 	sta_info_hash_del(local, sta);
540 	list_del_rcu(&sta->list);
541 	local->num_sta--;
542 	synchronize_net();
543 	__cleanup_single_sta(sta);
544  out_err:
545 	mutex_unlock(&local->sta_mtx);
546 	rcu_read_lock();
547 	return err;
548 }
549 
550 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
551 {
552 	struct ieee80211_local *local = sta->local;
553 	int err;
554 
555 	might_sleep();
556 
557 	err = sta_info_insert_check(sta);
558 	if (err) {
559 		rcu_read_lock();
560 		goto out_free;
561 	}
562 
563 	mutex_lock(&local->sta_mtx);
564 
565 	err = sta_info_insert_finish(sta);
566 	if (err)
567 		goto out_free;
568 
569 	return 0;
570  out_free:
571 	sta_info_free(local, sta);
572 	return err;
573 }
574 
575 int sta_info_insert(struct sta_info *sta)
576 {
577 	int err = sta_info_insert_rcu(sta);
578 
579 	rcu_read_unlock();
580 
581 	return err;
582 }
583 
584 static inline void __bss_tim_set(u8 *tim, u16 id)
585 {
586 	/*
587 	 * This format has been mandated by the IEEE specifications,
588 	 * so this line may not be changed to use the __set_bit() format.
589 	 */
590 	tim[id / 8] |= (1 << (id % 8));
591 }
592 
593 static inline void __bss_tim_clear(u8 *tim, u16 id)
594 {
595 	/*
596 	 * This format has been mandated by the IEEE specifications,
597 	 * so this line may not be changed to use the __clear_bit() format.
598 	 */
599 	tim[id / 8] &= ~(1 << (id % 8));
600 }
601 
602 static inline bool __bss_tim_get(u8 *tim, u16 id)
603 {
604 	/*
605 	 * This format has been mandated by the IEEE specifications,
606 	 * so this line may not be changed to use the test_bit() format.
607 	 */
608 	return tim[id / 8] & (1 << (id % 8));
609 }
610 
611 static unsigned long ieee80211_tids_for_ac(int ac)
612 {
613 	/* If we ever support TIDs > 7, this obviously needs to be adjusted */
614 	switch (ac) {
615 	case IEEE80211_AC_VO:
616 		return BIT(6) | BIT(7);
617 	case IEEE80211_AC_VI:
618 		return BIT(4) | BIT(5);
619 	case IEEE80211_AC_BE:
620 		return BIT(0) | BIT(3);
621 	case IEEE80211_AC_BK:
622 		return BIT(1) | BIT(2);
623 	default:
624 		WARN_ON(1);
625 		return 0;
626 	}
627 }
628 
629 static void __sta_info_recalc_tim(struct sta_info *sta, bool ignore_pending)
630 {
631 	struct ieee80211_local *local = sta->local;
632 	struct ps_data *ps;
633 	bool indicate_tim = false;
634 	u8 ignore_for_tim = sta->sta.uapsd_queues;
635 	int ac;
636 	u16 id = sta->sta.aid;
637 
638 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
639 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
640 		if (WARN_ON_ONCE(!sta->sdata->bss))
641 			return;
642 
643 		ps = &sta->sdata->bss->ps;
644 #ifdef CONFIG_MAC80211_MESH
645 	} else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
646 		ps = &sta->sdata->u.mesh.ps;
647 #endif
648 	} else {
649 		return;
650 	}
651 
652 	/* No need to do anything if the driver does all */
653 	if (ieee80211_hw_check(&local->hw, AP_LINK_PS))
654 		return;
655 
656 	if (sta->dead)
657 		goto done;
658 
659 	/*
660 	 * If all ACs are delivery-enabled then we should build
661 	 * the TIM bit for all ACs anyway; if only some are then
662 	 * we ignore those and build the TIM bit using only the
663 	 * non-enabled ones.
664 	 */
665 	if (ignore_for_tim == BIT(IEEE80211_NUM_ACS) - 1)
666 		ignore_for_tim = 0;
667 
668 	if (ignore_pending)
669 		ignore_for_tim = BIT(IEEE80211_NUM_ACS) - 1;
670 
671 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
672 		unsigned long tids;
673 
674 		if (ignore_for_tim & BIT(ac))
675 			continue;
676 
677 		indicate_tim |= !skb_queue_empty(&sta->tx_filtered[ac]) ||
678 				!skb_queue_empty(&sta->ps_tx_buf[ac]);
679 		if (indicate_tim)
680 			break;
681 
682 		tids = ieee80211_tids_for_ac(ac);
683 
684 		indicate_tim |=
685 			sta->driver_buffered_tids & tids;
686 		indicate_tim |=
687 			sta->txq_buffered_tids & tids;
688 	}
689 
690  done:
691 	spin_lock_bh(&local->tim_lock);
692 
693 	if (indicate_tim == __bss_tim_get(ps->tim, id))
694 		goto out_unlock;
695 
696 	if (indicate_tim)
697 		__bss_tim_set(ps->tim, id);
698 	else
699 		__bss_tim_clear(ps->tim, id);
700 
701 	if (local->ops->set_tim && !WARN_ON(sta->dead)) {
702 		local->tim_in_locked_section = true;
703 		drv_set_tim(local, &sta->sta, indicate_tim);
704 		local->tim_in_locked_section = false;
705 	}
706 
707 out_unlock:
708 	spin_unlock_bh(&local->tim_lock);
709 }
710 
711 void sta_info_recalc_tim(struct sta_info *sta)
712 {
713 	__sta_info_recalc_tim(sta, false);
714 }
715 
716 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
717 {
718 	struct ieee80211_tx_info *info;
719 	int timeout;
720 
721 	if (!skb)
722 		return false;
723 
724 	info = IEEE80211_SKB_CB(skb);
725 
726 	/* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
727 	timeout = (sta->listen_interval *
728 		   sta->sdata->vif.bss_conf.beacon_int *
729 		   32 / 15625) * HZ;
730 	if (timeout < STA_TX_BUFFER_EXPIRE)
731 		timeout = STA_TX_BUFFER_EXPIRE;
732 	return time_after(jiffies, info->control.jiffies + timeout);
733 }
734 
735 
736 static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
737 						struct sta_info *sta, int ac)
738 {
739 	unsigned long flags;
740 	struct sk_buff *skb;
741 
742 	/*
743 	 * First check for frames that should expire on the filtered
744 	 * queue. Frames here were rejected by the driver and are on
745 	 * a separate queue to avoid reordering with normal PS-buffered
746 	 * frames. They also aren't accounted for right now in the
747 	 * total_ps_buffered counter.
748 	 */
749 	for (;;) {
750 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
751 		skb = skb_peek(&sta->tx_filtered[ac]);
752 		if (sta_info_buffer_expired(sta, skb))
753 			skb = __skb_dequeue(&sta->tx_filtered[ac]);
754 		else
755 			skb = NULL;
756 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
757 
758 		/*
759 		 * Frames are queued in order, so if this one
760 		 * hasn't expired yet we can stop testing. If
761 		 * we actually reached the end of the queue we
762 		 * also need to stop, of course.
763 		 */
764 		if (!skb)
765 			break;
766 		ieee80211_free_txskb(&local->hw, skb);
767 	}
768 
769 	/*
770 	 * Now also check the normal PS-buffered queue, this will
771 	 * only find something if the filtered queue was emptied
772 	 * since the filtered frames are all before the normal PS
773 	 * buffered frames.
774 	 */
775 	for (;;) {
776 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
777 		skb = skb_peek(&sta->ps_tx_buf[ac]);
778 		if (sta_info_buffer_expired(sta, skb))
779 			skb = __skb_dequeue(&sta->ps_tx_buf[ac]);
780 		else
781 			skb = NULL;
782 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
783 
784 		/*
785 		 * frames are queued in order, so if this one
786 		 * hasn't expired yet (or we reached the end of
787 		 * the queue) we can stop testing
788 		 */
789 		if (!skb)
790 			break;
791 
792 		local->total_ps_buffered--;
793 		ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
794 		       sta->sta.addr);
795 		ieee80211_free_txskb(&local->hw, skb);
796 	}
797 
798 	/*
799 	 * Finally, recalculate the TIM bit for this station -- it might
800 	 * now be clear because the station was too slow to retrieve its
801 	 * frames.
802 	 */
803 	sta_info_recalc_tim(sta);
804 
805 	/*
806 	 * Return whether there are any frames still buffered, this is
807 	 * used to check whether the cleanup timer still needs to run,
808 	 * if there are no frames we don't need to rearm the timer.
809 	 */
810 	return !(skb_queue_empty(&sta->ps_tx_buf[ac]) &&
811 		 skb_queue_empty(&sta->tx_filtered[ac]));
812 }
813 
814 static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
815 					     struct sta_info *sta)
816 {
817 	bool have_buffered = false;
818 	int ac;
819 
820 	/* This is only necessary for stations on BSS/MBSS interfaces */
821 	if (!sta->sdata->bss &&
822 	    !ieee80211_vif_is_mesh(&sta->sdata->vif))
823 		return false;
824 
825 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
826 		have_buffered |=
827 			sta_info_cleanup_expire_buffered_ac(local, sta, ac);
828 
829 	return have_buffered;
830 }
831 
832 static int __must_check __sta_info_destroy_part1(struct sta_info *sta)
833 {
834 	struct ieee80211_local *local;
835 	struct ieee80211_sub_if_data *sdata;
836 	int ret;
837 
838 	might_sleep();
839 
840 	if (!sta)
841 		return -ENOENT;
842 
843 	local = sta->local;
844 	sdata = sta->sdata;
845 
846 	lockdep_assert_held(&local->sta_mtx);
847 
848 	/*
849 	 * Before removing the station from the driver and
850 	 * rate control, it might still start new aggregation
851 	 * sessions -- block that to make sure the tear-down
852 	 * will be sufficient.
853 	 */
854 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
855 	ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
856 
857 	ret = sta_info_hash_del(local, sta);
858 	if (WARN_ON(ret))
859 		return ret;
860 
861 	/*
862 	 * for TDLS peers, make sure to return to the base channel before
863 	 * removal.
864 	 */
865 	if (test_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL)) {
866 		drv_tdls_cancel_channel_switch(local, sdata, &sta->sta);
867 		clear_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL);
868 	}
869 
870 	list_del_rcu(&sta->list);
871 
872 	drv_sta_pre_rcu_remove(local, sta->sdata, sta);
873 
874 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
875 	    rcu_access_pointer(sdata->u.vlan.sta) == sta)
876 		RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
877 
878 	return 0;
879 }
880 
881 static void __sta_info_destroy_part2(struct sta_info *sta)
882 {
883 	struct ieee80211_local *local = sta->local;
884 	struct ieee80211_sub_if_data *sdata = sta->sdata;
885 	struct station_info sinfo = {};
886 	int ret;
887 
888 	/*
889 	 * NOTE: This assumes at least synchronize_net() was done
890 	 *	 after _part1 and before _part2!
891 	 */
892 
893 	might_sleep();
894 	lockdep_assert_held(&local->sta_mtx);
895 
896 	/* now keys can no longer be reached */
897 	ieee80211_free_sta_keys(local, sta);
898 
899 	/* disable TIM bit - last chance to tell driver */
900 	__sta_info_recalc_tim(sta, true);
901 
902 	sta->dead = true;
903 
904 	local->num_sta--;
905 	local->sta_generation++;
906 
907 	while (sta->sta_state > IEEE80211_STA_NONE) {
908 		ret = sta_info_move_state(sta, sta->sta_state - 1);
909 		if (ret) {
910 			WARN_ON_ONCE(1);
911 			break;
912 		}
913 	}
914 
915 	if (sta->uploaded) {
916 		ret = drv_sta_state(local, sdata, sta, IEEE80211_STA_NONE,
917 				    IEEE80211_STA_NOTEXIST);
918 		WARN_ON_ONCE(ret != 0);
919 	}
920 
921 	sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
922 
923 	sta_set_sinfo(sta, &sinfo);
924 	cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
925 
926 	rate_control_remove_sta_debugfs(sta);
927 	ieee80211_sta_debugfs_remove(sta);
928 	ieee80211_recalc_min_chandef(sdata);
929 
930 	cleanup_single_sta(sta);
931 }
932 
933 int __must_check __sta_info_destroy(struct sta_info *sta)
934 {
935 	int err = __sta_info_destroy_part1(sta);
936 
937 	if (err)
938 		return err;
939 
940 	synchronize_net();
941 
942 	__sta_info_destroy_part2(sta);
943 
944 	return 0;
945 }
946 
947 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
948 {
949 	struct sta_info *sta;
950 	int ret;
951 
952 	mutex_lock(&sdata->local->sta_mtx);
953 	sta = sta_info_get(sdata, addr);
954 	ret = __sta_info_destroy(sta);
955 	mutex_unlock(&sdata->local->sta_mtx);
956 
957 	return ret;
958 }
959 
960 int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
961 			      const u8 *addr)
962 {
963 	struct sta_info *sta;
964 	int ret;
965 
966 	mutex_lock(&sdata->local->sta_mtx);
967 	sta = sta_info_get_bss(sdata, addr);
968 	ret = __sta_info_destroy(sta);
969 	mutex_unlock(&sdata->local->sta_mtx);
970 
971 	return ret;
972 }
973 
974 static void sta_info_cleanup(unsigned long data)
975 {
976 	struct ieee80211_local *local = (struct ieee80211_local *) data;
977 	struct sta_info *sta;
978 	bool timer_needed = false;
979 
980 	rcu_read_lock();
981 	list_for_each_entry_rcu(sta, &local->sta_list, list)
982 		if (sta_info_cleanup_expire_buffered(local, sta))
983 			timer_needed = true;
984 	rcu_read_unlock();
985 
986 	if (local->quiescing)
987 		return;
988 
989 	if (!timer_needed)
990 		return;
991 
992 	mod_timer(&local->sta_cleanup,
993 		  round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL));
994 }
995 
996 u32 sta_addr_hash(const void *key, u32 length, u32 seed)
997 {
998 	return jhash(key, ETH_ALEN, seed);
999 }
1000 
1001 int sta_info_init(struct ieee80211_local *local)
1002 {
1003 	int err;
1004 
1005 	err = rhashtable_init(&local->sta_hash, &sta_rht_params);
1006 	if (err)
1007 		return err;
1008 
1009 	spin_lock_init(&local->tim_lock);
1010 	mutex_init(&local->sta_mtx);
1011 	INIT_LIST_HEAD(&local->sta_list);
1012 
1013 	setup_timer(&local->sta_cleanup, sta_info_cleanup,
1014 		    (unsigned long)local);
1015 	return 0;
1016 }
1017 
1018 void sta_info_stop(struct ieee80211_local *local)
1019 {
1020 	del_timer_sync(&local->sta_cleanup);
1021 	rhashtable_destroy(&local->sta_hash);
1022 }
1023 
1024 
1025 int __sta_info_flush(struct ieee80211_sub_if_data *sdata, bool vlans)
1026 {
1027 	struct ieee80211_local *local = sdata->local;
1028 	struct sta_info *sta, *tmp;
1029 	LIST_HEAD(free_list);
1030 	int ret = 0;
1031 
1032 	might_sleep();
1033 
1034 	WARN_ON(vlans && sdata->vif.type != NL80211_IFTYPE_AP);
1035 	WARN_ON(vlans && !sdata->bss);
1036 
1037 	mutex_lock(&local->sta_mtx);
1038 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1039 		if (sdata == sta->sdata ||
1040 		    (vlans && sdata->bss == sta->sdata->bss)) {
1041 			if (!WARN_ON(__sta_info_destroy_part1(sta)))
1042 				list_add(&sta->free_list, &free_list);
1043 			ret++;
1044 		}
1045 	}
1046 
1047 	if (!list_empty(&free_list)) {
1048 		synchronize_net();
1049 		list_for_each_entry_safe(sta, tmp, &free_list, free_list)
1050 			__sta_info_destroy_part2(sta);
1051 	}
1052 	mutex_unlock(&local->sta_mtx);
1053 
1054 	return ret;
1055 }
1056 
1057 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
1058 			  unsigned long exp_time)
1059 {
1060 	struct ieee80211_local *local = sdata->local;
1061 	struct sta_info *sta, *tmp;
1062 
1063 	mutex_lock(&local->sta_mtx);
1064 
1065 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1066 		if (sdata != sta->sdata)
1067 			continue;
1068 
1069 		if (time_after(jiffies, sta->rx_stats.last_rx + exp_time)) {
1070 			sta_dbg(sta->sdata, "expiring inactive STA %pM\n",
1071 				sta->sta.addr);
1072 
1073 			if (ieee80211_vif_is_mesh(&sdata->vif) &&
1074 			    test_sta_flag(sta, WLAN_STA_PS_STA))
1075 				atomic_dec(&sdata->u.mesh.ps.num_sta_ps);
1076 
1077 			WARN_ON(__sta_info_destroy(sta));
1078 		}
1079 	}
1080 
1081 	mutex_unlock(&local->sta_mtx);
1082 }
1083 
1084 struct ieee80211_sta *ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
1085 						   const u8 *addr,
1086 						   const u8 *localaddr)
1087 {
1088 	struct ieee80211_local *local = hw_to_local(hw);
1089 	struct sta_info *sta;
1090 	struct rhash_head *tmp;
1091 	const struct bucket_table *tbl;
1092 
1093 	tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
1094 
1095 	/*
1096 	 * Just return a random station if localaddr is NULL
1097 	 * ... first in list.
1098 	 */
1099 	for_each_sta_info(local, tbl, addr, sta, tmp) {
1100 		if (localaddr &&
1101 		    !ether_addr_equal(sta->sdata->vif.addr, localaddr))
1102 			continue;
1103 		if (!sta->uploaded)
1104 			return NULL;
1105 		return &sta->sta;
1106 	}
1107 
1108 	return NULL;
1109 }
1110 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_ifaddr);
1111 
1112 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
1113 					 const u8 *addr)
1114 {
1115 	struct sta_info *sta;
1116 
1117 	if (!vif)
1118 		return NULL;
1119 
1120 	sta = sta_info_get_bss(vif_to_sdata(vif), addr);
1121 	if (!sta)
1122 		return NULL;
1123 
1124 	if (!sta->uploaded)
1125 		return NULL;
1126 
1127 	return &sta->sta;
1128 }
1129 EXPORT_SYMBOL(ieee80211_find_sta);
1130 
1131 /* powersave support code */
1132 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
1133 {
1134 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1135 	struct ieee80211_local *local = sdata->local;
1136 	struct sk_buff_head pending;
1137 	int filtered = 0, buffered = 0, ac, i;
1138 	unsigned long flags;
1139 	struct ps_data *ps;
1140 
1141 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1142 		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
1143 				     u.ap);
1144 
1145 	if (sdata->vif.type == NL80211_IFTYPE_AP)
1146 		ps = &sdata->bss->ps;
1147 	else if (ieee80211_vif_is_mesh(&sdata->vif))
1148 		ps = &sdata->u.mesh.ps;
1149 	else
1150 		return;
1151 
1152 	clear_sta_flag(sta, WLAN_STA_SP);
1153 
1154 	BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
1155 	sta->driver_buffered_tids = 0;
1156 	sta->txq_buffered_tids = 0;
1157 
1158 	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1159 		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
1160 
1161 	if (sta->sta.txq[0]) {
1162 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
1163 			struct txq_info *txqi = to_txq_info(sta->sta.txq[i]);
1164 
1165 			if (!skb_queue_len(&txqi->queue))
1166 				continue;
1167 
1168 			drv_wake_tx_queue(local, txqi);
1169 		}
1170 	}
1171 
1172 	skb_queue_head_init(&pending);
1173 
1174 	/* sync with ieee80211_tx_h_unicast_ps_buf */
1175 	spin_lock(&sta->ps_lock);
1176 	/* Send all buffered frames to the station */
1177 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1178 		int count = skb_queue_len(&pending), tmp;
1179 
1180 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
1181 		skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
1182 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
1183 		tmp = skb_queue_len(&pending);
1184 		filtered += tmp - count;
1185 		count = tmp;
1186 
1187 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
1188 		skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
1189 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
1190 		tmp = skb_queue_len(&pending);
1191 		buffered += tmp - count;
1192 	}
1193 
1194 	ieee80211_add_pending_skbs(local, &pending);
1195 
1196 	/* now we're no longer in the deliver code */
1197 	clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
1198 
1199 	/* The station might have polled and then woken up before we responded,
1200 	 * so clear these flags now to avoid them sticking around.
1201 	 */
1202 	clear_sta_flag(sta, WLAN_STA_PSPOLL);
1203 	clear_sta_flag(sta, WLAN_STA_UAPSD);
1204 	spin_unlock(&sta->ps_lock);
1205 
1206 	atomic_dec(&ps->num_sta_ps);
1207 
1208 	/* This station just woke up and isn't aware of our SMPS state */
1209 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
1210 	    !ieee80211_smps_is_restrictive(sta->known_smps_mode,
1211 					   sdata->smps_mode) &&
1212 	    sta->known_smps_mode != sdata->bss->req_smps &&
1213 	    sta_info_tx_streams(sta) != 1) {
1214 		ht_dbg(sdata,
1215 		       "%pM just woke up and MIMO capable - update SMPS\n",
1216 		       sta->sta.addr);
1217 		ieee80211_send_smps_action(sdata, sdata->bss->req_smps,
1218 					   sta->sta.addr,
1219 					   sdata->vif.bss_conf.bssid);
1220 	}
1221 
1222 	local->total_ps_buffered -= buffered;
1223 
1224 	sta_info_recalc_tim(sta);
1225 
1226 	ps_dbg(sdata,
1227 	       "STA %pM aid %d sending %d filtered/%d PS frames since STA not sleeping anymore\n",
1228 	       sta->sta.addr, sta->sta.aid, filtered, buffered);
1229 
1230 	ieee80211_check_fast_xmit(sta);
1231 }
1232 
1233 static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
1234 					 struct sta_info *sta, int tid,
1235 					 enum ieee80211_frame_release_type reason,
1236 					 bool call_driver)
1237 {
1238 	struct ieee80211_local *local = sdata->local;
1239 	struct ieee80211_qos_hdr *nullfunc;
1240 	struct sk_buff *skb;
1241 	int size = sizeof(*nullfunc);
1242 	__le16 fc;
1243 	bool qos = sta->sta.wme;
1244 	struct ieee80211_tx_info *info;
1245 	struct ieee80211_chanctx_conf *chanctx_conf;
1246 
1247 	if (qos) {
1248 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1249 				 IEEE80211_STYPE_QOS_NULLFUNC |
1250 				 IEEE80211_FCTL_FROMDS);
1251 	} else {
1252 		size -= 2;
1253 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1254 				 IEEE80211_STYPE_NULLFUNC |
1255 				 IEEE80211_FCTL_FROMDS);
1256 	}
1257 
1258 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
1259 	if (!skb)
1260 		return;
1261 
1262 	skb_reserve(skb, local->hw.extra_tx_headroom);
1263 
1264 	nullfunc = (void *) skb_put(skb, size);
1265 	nullfunc->frame_control = fc;
1266 	nullfunc->duration_id = 0;
1267 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
1268 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1269 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
1270 	nullfunc->seq_ctrl = 0;
1271 
1272 	skb->priority = tid;
1273 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
1274 	if (qos) {
1275 		nullfunc->qos_ctrl = cpu_to_le16(tid);
1276 
1277 		if (reason == IEEE80211_FRAME_RELEASE_UAPSD)
1278 			nullfunc->qos_ctrl |=
1279 				cpu_to_le16(IEEE80211_QOS_CTL_EOSP);
1280 	}
1281 
1282 	info = IEEE80211_SKB_CB(skb);
1283 
1284 	/*
1285 	 * Tell TX path to send this frame even though the
1286 	 * STA may still remain is PS mode after this frame
1287 	 * exchange. Also set EOSP to indicate this packet
1288 	 * ends the poll/service period.
1289 	 */
1290 	info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
1291 		       IEEE80211_TX_STATUS_EOSP |
1292 		       IEEE80211_TX_CTL_REQ_TX_STATUS;
1293 
1294 	info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
1295 
1296 	if (call_driver)
1297 		drv_allow_buffered_frames(local, sta, BIT(tid), 1,
1298 					  reason, false);
1299 
1300 	skb->dev = sdata->dev;
1301 
1302 	rcu_read_lock();
1303 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1304 	if (WARN_ON(!chanctx_conf)) {
1305 		rcu_read_unlock();
1306 		kfree_skb(skb);
1307 		return;
1308 	}
1309 
1310 	info->band = chanctx_conf->def.chan->band;
1311 	ieee80211_xmit(sdata, sta, skb);
1312 	rcu_read_unlock();
1313 }
1314 
1315 static int find_highest_prio_tid(unsigned long tids)
1316 {
1317 	/* lower 3 TIDs aren't ordered perfectly */
1318 	if (tids & 0xF8)
1319 		return fls(tids) - 1;
1320 	/* TID 0 is BE just like TID 3 */
1321 	if (tids & BIT(0))
1322 		return 0;
1323 	return fls(tids) - 1;
1324 }
1325 
1326 static void
1327 ieee80211_sta_ps_deliver_response(struct sta_info *sta,
1328 				  int n_frames, u8 ignored_acs,
1329 				  enum ieee80211_frame_release_type reason)
1330 {
1331 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1332 	struct ieee80211_local *local = sdata->local;
1333 	bool more_data = false;
1334 	int ac;
1335 	unsigned long driver_release_tids = 0;
1336 	struct sk_buff_head frames;
1337 
1338 	/* Service or PS-Poll period starts */
1339 	set_sta_flag(sta, WLAN_STA_SP);
1340 
1341 	__skb_queue_head_init(&frames);
1342 
1343 	/* Get response frame(s) and more data bit for the last one. */
1344 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1345 		unsigned long tids;
1346 
1347 		if (ignored_acs & BIT(ac))
1348 			continue;
1349 
1350 		tids = ieee80211_tids_for_ac(ac);
1351 
1352 		/* if we already have frames from software, then we can't also
1353 		 * release from hardware queues
1354 		 */
1355 		if (skb_queue_empty(&frames)) {
1356 			driver_release_tids |= sta->driver_buffered_tids & tids;
1357 			driver_release_tids |= sta->txq_buffered_tids & tids;
1358 		}
1359 
1360 		if (driver_release_tids) {
1361 			/* If the driver has data on more than one TID then
1362 			 * certainly there's more data if we release just a
1363 			 * single frame now (from a single TID). This will
1364 			 * only happen for PS-Poll.
1365 			 */
1366 			if (reason == IEEE80211_FRAME_RELEASE_PSPOLL &&
1367 			    hweight16(driver_release_tids) > 1) {
1368 				more_data = true;
1369 				driver_release_tids =
1370 					BIT(find_highest_prio_tid(
1371 						driver_release_tids));
1372 				break;
1373 			}
1374 		} else {
1375 			struct sk_buff *skb;
1376 
1377 			while (n_frames > 0) {
1378 				skb = skb_dequeue(&sta->tx_filtered[ac]);
1379 				if (!skb) {
1380 					skb = skb_dequeue(
1381 						&sta->ps_tx_buf[ac]);
1382 					if (skb)
1383 						local->total_ps_buffered--;
1384 				}
1385 				if (!skb)
1386 					break;
1387 				n_frames--;
1388 				__skb_queue_tail(&frames, skb);
1389 			}
1390 		}
1391 
1392 		/* If we have more frames buffered on this AC, then set the
1393 		 * more-data bit and abort the loop since we can't send more
1394 		 * data from other ACs before the buffered frames from this.
1395 		 */
1396 		if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
1397 		    !skb_queue_empty(&sta->ps_tx_buf[ac])) {
1398 			more_data = true;
1399 			break;
1400 		}
1401 	}
1402 
1403 	if (skb_queue_empty(&frames) && !driver_release_tids) {
1404 		int tid;
1405 
1406 		/*
1407 		 * For PS-Poll, this can only happen due to a race condition
1408 		 * when we set the TIM bit and the station notices it, but
1409 		 * before it can poll for the frame we expire it.
1410 		 *
1411 		 * For uAPSD, this is said in the standard (11.2.1.5 h):
1412 		 *	At each unscheduled SP for a non-AP STA, the AP shall
1413 		 *	attempt to transmit at least one MSDU or MMPDU, but no
1414 		 *	more than the value specified in the Max SP Length field
1415 		 *	in the QoS Capability element from delivery-enabled ACs,
1416 		 *	that are destined for the non-AP STA.
1417 		 *
1418 		 * Since we have no other MSDU/MMPDU, transmit a QoS null frame.
1419 		 */
1420 
1421 		/* This will evaluate to 1, 3, 5 or 7. */
1422 		tid = 7 - ((ffs(~ignored_acs) - 1) << 1);
1423 
1424 		ieee80211_send_null_response(sdata, sta, tid, reason, true);
1425 	} else if (!driver_release_tids) {
1426 		struct sk_buff_head pending;
1427 		struct sk_buff *skb;
1428 		int num = 0;
1429 		u16 tids = 0;
1430 		bool need_null = false;
1431 
1432 		skb_queue_head_init(&pending);
1433 
1434 		while ((skb = __skb_dequeue(&frames))) {
1435 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1436 			struct ieee80211_hdr *hdr = (void *) skb->data;
1437 			u8 *qoshdr = NULL;
1438 
1439 			num++;
1440 
1441 			/*
1442 			 * Tell TX path to send this frame even though the
1443 			 * STA may still remain is PS mode after this frame
1444 			 * exchange.
1445 			 */
1446 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
1447 			info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
1448 
1449 			/*
1450 			 * Use MoreData flag to indicate whether there are
1451 			 * more buffered frames for this STA
1452 			 */
1453 			if (more_data || !skb_queue_empty(&frames))
1454 				hdr->frame_control |=
1455 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1456 			else
1457 				hdr->frame_control &=
1458 					cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1459 
1460 			if (ieee80211_is_data_qos(hdr->frame_control) ||
1461 			    ieee80211_is_qos_nullfunc(hdr->frame_control))
1462 				qoshdr = ieee80211_get_qos_ctl(hdr);
1463 
1464 			tids |= BIT(skb->priority);
1465 
1466 			__skb_queue_tail(&pending, skb);
1467 
1468 			/* end service period after last frame or add one */
1469 			if (!skb_queue_empty(&frames))
1470 				continue;
1471 
1472 			if (reason != IEEE80211_FRAME_RELEASE_UAPSD) {
1473 				/* for PS-Poll, there's only one frame */
1474 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1475 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1476 				break;
1477 			}
1478 
1479 			/* For uAPSD, things are a bit more complicated. If the
1480 			 * last frame has a QoS header (i.e. is a QoS-data or
1481 			 * QoS-nulldata frame) then just set the EOSP bit there
1482 			 * and be done.
1483 			 * If the frame doesn't have a QoS header (which means
1484 			 * it should be a bufferable MMPDU) then we can't set
1485 			 * the EOSP bit in the QoS header; add a QoS-nulldata
1486 			 * frame to the list to send it after the MMPDU.
1487 			 *
1488 			 * Note that this code is only in the mac80211-release
1489 			 * code path, we assume that the driver will not buffer
1490 			 * anything but QoS-data frames, or if it does, will
1491 			 * create the QoS-nulldata frame by itself if needed.
1492 			 *
1493 			 * Cf. 802.11-2012 10.2.1.10 (c).
1494 			 */
1495 			if (qoshdr) {
1496 				*qoshdr |= IEEE80211_QOS_CTL_EOSP;
1497 
1498 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1499 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1500 			} else {
1501 				/* The standard isn't completely clear on this
1502 				 * as it says the more-data bit should be set
1503 				 * if there are more BUs. The QoS-Null frame
1504 				 * we're about to send isn't buffered yet, we
1505 				 * only create it below, but let's pretend it
1506 				 * was buffered just in case some clients only
1507 				 * expect more-data=0 when eosp=1.
1508 				 */
1509 				hdr->frame_control |=
1510 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1511 				need_null = true;
1512 				num++;
1513 			}
1514 			break;
1515 		}
1516 
1517 		drv_allow_buffered_frames(local, sta, tids, num,
1518 					  reason, more_data);
1519 
1520 		ieee80211_add_pending_skbs(local, &pending);
1521 
1522 		if (need_null)
1523 			ieee80211_send_null_response(
1524 				sdata, sta, find_highest_prio_tid(tids),
1525 				reason, false);
1526 
1527 		sta_info_recalc_tim(sta);
1528 	} else {
1529 		unsigned long tids = sta->txq_buffered_tids & driver_release_tids;
1530 		int tid;
1531 
1532 		/*
1533 		 * We need to release a frame that is buffered somewhere in the
1534 		 * driver ... it'll have to handle that.
1535 		 * Note that the driver also has to check the number of frames
1536 		 * on the TIDs we're releasing from - if there are more than
1537 		 * n_frames it has to set the more-data bit (if we didn't ask
1538 		 * it to set it anyway due to other buffered frames); if there
1539 		 * are fewer than n_frames it has to make sure to adjust that
1540 		 * to allow the service period to end properly.
1541 		 */
1542 		drv_release_buffered_frames(local, sta, driver_release_tids,
1543 					    n_frames, reason, more_data);
1544 
1545 		/*
1546 		 * Note that we don't recalculate the TIM bit here as it would
1547 		 * most likely have no effect at all unless the driver told us
1548 		 * that the TID(s) became empty before returning here from the
1549 		 * release function.
1550 		 * Either way, however, when the driver tells us that the TID(s)
1551 		 * became empty or we find that a txq became empty, we'll do the
1552 		 * TIM recalculation.
1553 		 */
1554 
1555 		if (!sta->sta.txq[0])
1556 			return;
1557 
1558 		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
1559 			struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
1560 
1561 			if (!(tids & BIT(tid)) || skb_queue_len(&txqi->queue))
1562 				continue;
1563 
1564 			sta_info_recalc_tim(sta);
1565 			break;
1566 		}
1567 	}
1568 }
1569 
1570 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
1571 {
1572 	u8 ignore_for_response = sta->sta.uapsd_queues;
1573 
1574 	/*
1575 	 * If all ACs are delivery-enabled then we should reply
1576 	 * from any of them, if only some are enabled we reply
1577 	 * only from the non-enabled ones.
1578 	 */
1579 	if (ignore_for_response == BIT(IEEE80211_NUM_ACS) - 1)
1580 		ignore_for_response = 0;
1581 
1582 	ieee80211_sta_ps_deliver_response(sta, 1, ignore_for_response,
1583 					  IEEE80211_FRAME_RELEASE_PSPOLL);
1584 }
1585 
1586 void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
1587 {
1588 	int n_frames = sta->sta.max_sp;
1589 	u8 delivery_enabled = sta->sta.uapsd_queues;
1590 
1591 	/*
1592 	 * If we ever grow support for TSPEC this might happen if
1593 	 * the TSPEC update from hostapd comes in between a trigger
1594 	 * frame setting WLAN_STA_UAPSD in the RX path and this
1595 	 * actually getting called.
1596 	 */
1597 	if (!delivery_enabled)
1598 		return;
1599 
1600 	switch (sta->sta.max_sp) {
1601 	case 1:
1602 		n_frames = 2;
1603 		break;
1604 	case 2:
1605 		n_frames = 4;
1606 		break;
1607 	case 3:
1608 		n_frames = 6;
1609 		break;
1610 	case 0:
1611 		/* XXX: what is a good value? */
1612 		n_frames = 128;
1613 		break;
1614 	}
1615 
1616 	ieee80211_sta_ps_deliver_response(sta, n_frames, ~delivery_enabled,
1617 					  IEEE80211_FRAME_RELEASE_UAPSD);
1618 }
1619 
1620 void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
1621 			       struct ieee80211_sta *pubsta, bool block)
1622 {
1623 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1624 
1625 	trace_api_sta_block_awake(sta->local, pubsta, block);
1626 
1627 	if (block) {
1628 		set_sta_flag(sta, WLAN_STA_PS_DRIVER);
1629 		ieee80211_clear_fast_xmit(sta);
1630 		return;
1631 	}
1632 
1633 	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1634 		return;
1635 
1636 	if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
1637 		set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1638 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1639 		ieee80211_queue_work(hw, &sta->drv_deliver_wk);
1640 	} else if (test_sta_flag(sta, WLAN_STA_PSPOLL) ||
1641 		   test_sta_flag(sta, WLAN_STA_UAPSD)) {
1642 		/* must be asleep in this case */
1643 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1644 		ieee80211_queue_work(hw, &sta->drv_deliver_wk);
1645 	} else {
1646 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1647 		ieee80211_check_fast_xmit(sta);
1648 	}
1649 }
1650 EXPORT_SYMBOL(ieee80211_sta_block_awake);
1651 
1652 void ieee80211_sta_eosp(struct ieee80211_sta *pubsta)
1653 {
1654 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1655 	struct ieee80211_local *local = sta->local;
1656 
1657 	trace_api_eosp(local, pubsta);
1658 
1659 	clear_sta_flag(sta, WLAN_STA_SP);
1660 }
1661 EXPORT_SYMBOL(ieee80211_sta_eosp);
1662 
1663 void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
1664 				u8 tid, bool buffered)
1665 {
1666 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1667 
1668 	if (WARN_ON(tid >= IEEE80211_NUM_TIDS))
1669 		return;
1670 
1671 	trace_api_sta_set_buffered(sta->local, pubsta, tid, buffered);
1672 
1673 	if (buffered)
1674 		set_bit(tid, &sta->driver_buffered_tids);
1675 	else
1676 		clear_bit(tid, &sta->driver_buffered_tids);
1677 
1678 	sta_info_recalc_tim(sta);
1679 }
1680 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
1681 
1682 int sta_info_move_state(struct sta_info *sta,
1683 			enum ieee80211_sta_state new_state)
1684 {
1685 	might_sleep();
1686 
1687 	if (sta->sta_state == new_state)
1688 		return 0;
1689 
1690 	/* check allowed transitions first */
1691 
1692 	switch (new_state) {
1693 	case IEEE80211_STA_NONE:
1694 		if (sta->sta_state != IEEE80211_STA_AUTH)
1695 			return -EINVAL;
1696 		break;
1697 	case IEEE80211_STA_AUTH:
1698 		if (sta->sta_state != IEEE80211_STA_NONE &&
1699 		    sta->sta_state != IEEE80211_STA_ASSOC)
1700 			return -EINVAL;
1701 		break;
1702 	case IEEE80211_STA_ASSOC:
1703 		if (sta->sta_state != IEEE80211_STA_AUTH &&
1704 		    sta->sta_state != IEEE80211_STA_AUTHORIZED)
1705 			return -EINVAL;
1706 		break;
1707 	case IEEE80211_STA_AUTHORIZED:
1708 		if (sta->sta_state != IEEE80211_STA_ASSOC)
1709 			return -EINVAL;
1710 		break;
1711 	default:
1712 		WARN(1, "invalid state %d", new_state);
1713 		return -EINVAL;
1714 	}
1715 
1716 	sta_dbg(sta->sdata, "moving STA %pM to state %d\n",
1717 		sta->sta.addr, new_state);
1718 
1719 	/*
1720 	 * notify the driver before the actual changes so it can
1721 	 * fail the transition
1722 	 */
1723 	if (test_sta_flag(sta, WLAN_STA_INSERTED)) {
1724 		int err = drv_sta_state(sta->local, sta->sdata, sta,
1725 					sta->sta_state, new_state);
1726 		if (err)
1727 			return err;
1728 	}
1729 
1730 	/* reflect the change in all state variables */
1731 
1732 	switch (new_state) {
1733 	case IEEE80211_STA_NONE:
1734 		if (sta->sta_state == IEEE80211_STA_AUTH)
1735 			clear_bit(WLAN_STA_AUTH, &sta->_flags);
1736 		break;
1737 	case IEEE80211_STA_AUTH:
1738 		if (sta->sta_state == IEEE80211_STA_NONE)
1739 			set_bit(WLAN_STA_AUTH, &sta->_flags);
1740 		else if (sta->sta_state == IEEE80211_STA_ASSOC)
1741 			clear_bit(WLAN_STA_ASSOC, &sta->_flags);
1742 		break;
1743 	case IEEE80211_STA_ASSOC:
1744 		if (sta->sta_state == IEEE80211_STA_AUTH) {
1745 			set_bit(WLAN_STA_ASSOC, &sta->_flags);
1746 		} else if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
1747 			if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1748 			    (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1749 			     !sta->sdata->u.vlan.sta))
1750 				atomic_dec(&sta->sdata->bss->num_mcast_sta);
1751 			clear_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1752 			ieee80211_clear_fast_xmit(sta);
1753 		}
1754 		break;
1755 	case IEEE80211_STA_AUTHORIZED:
1756 		if (sta->sta_state == IEEE80211_STA_ASSOC) {
1757 			if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1758 			    (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1759 			     !sta->sdata->u.vlan.sta))
1760 				atomic_inc(&sta->sdata->bss->num_mcast_sta);
1761 			set_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1762 			ieee80211_check_fast_xmit(sta);
1763 		}
1764 		break;
1765 	default:
1766 		break;
1767 	}
1768 
1769 	sta->sta_state = new_state;
1770 
1771 	return 0;
1772 }
1773 
1774 u8 sta_info_tx_streams(struct sta_info *sta)
1775 {
1776 	struct ieee80211_sta_ht_cap *ht_cap = &sta->sta.ht_cap;
1777 	u8 rx_streams;
1778 
1779 	if (!sta->sta.ht_cap.ht_supported)
1780 		return 1;
1781 
1782 	if (sta->sta.vht_cap.vht_supported) {
1783 		int i;
1784 		u16 tx_mcs_map =
1785 			le16_to_cpu(sta->sta.vht_cap.vht_mcs.tx_mcs_map);
1786 
1787 		for (i = 7; i >= 0; i--)
1788 			if ((tx_mcs_map & (0x3 << (i * 2))) !=
1789 			    IEEE80211_VHT_MCS_NOT_SUPPORTED)
1790 				return i + 1;
1791 	}
1792 
1793 	if (ht_cap->mcs.rx_mask[3])
1794 		rx_streams = 4;
1795 	else if (ht_cap->mcs.rx_mask[2])
1796 		rx_streams = 3;
1797 	else if (ht_cap->mcs.rx_mask[1])
1798 		rx_streams = 2;
1799 	else
1800 		rx_streams = 1;
1801 
1802 	if (!(ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_RX_DIFF))
1803 		return rx_streams;
1804 
1805 	return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
1806 			>> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
1807 }
1808 
1809 static void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
1810 {
1811 	rinfo->flags = 0;
1812 
1813 	if (sta->rx_stats.last_rate_flag & RX_FLAG_HT) {
1814 		rinfo->flags |= RATE_INFO_FLAGS_MCS;
1815 		rinfo->mcs = sta->rx_stats.last_rate_idx;
1816 	} else if (sta->rx_stats.last_rate_flag & RX_FLAG_VHT) {
1817 		rinfo->flags |= RATE_INFO_FLAGS_VHT_MCS;
1818 		rinfo->nss = sta->rx_stats.last_rate_vht_nss;
1819 		rinfo->mcs = sta->rx_stats.last_rate_idx;
1820 	} else {
1821 		struct ieee80211_supported_band *sband;
1822 		int shift = ieee80211_vif_get_shift(&sta->sdata->vif);
1823 		u16 brate;
1824 
1825 		sband = sta->local->hw.wiphy->bands[
1826 				ieee80211_get_sdata_band(sta->sdata)];
1827 		brate = sband->bitrates[sta->rx_stats.last_rate_idx].bitrate;
1828 		rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
1829 	}
1830 
1831 	if (sta->rx_stats.last_rate_flag & RX_FLAG_SHORT_GI)
1832 		rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
1833 
1834 	if (sta->rx_stats.last_rate_flag & RX_FLAG_5MHZ)
1835 		rinfo->bw = RATE_INFO_BW_5;
1836 	else if (sta->rx_stats.last_rate_flag & RX_FLAG_10MHZ)
1837 		rinfo->bw = RATE_INFO_BW_10;
1838 	else if (sta->rx_stats.last_rate_flag & RX_FLAG_40MHZ)
1839 		rinfo->bw = RATE_INFO_BW_40;
1840 	else if (sta->rx_stats.last_rate_vht_flag & RX_VHT_FLAG_80MHZ)
1841 		rinfo->bw = RATE_INFO_BW_80;
1842 	else if (sta->rx_stats.last_rate_vht_flag & RX_VHT_FLAG_160MHZ)
1843 		rinfo->bw = RATE_INFO_BW_160;
1844 	else
1845 		rinfo->bw = RATE_INFO_BW_20;
1846 }
1847 
1848 void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
1849 {
1850 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1851 	struct ieee80211_local *local = sdata->local;
1852 	struct rate_control_ref *ref = NULL;
1853 	u32 thr = 0;
1854 	int i, ac;
1855 
1856 	if (test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
1857 		ref = local->rate_ctrl;
1858 
1859 	sinfo->generation = sdata->local->sta_generation;
1860 
1861 	/* do before driver, so beacon filtering drivers have a
1862 	 * chance to e.g. just add the number of filtered beacons
1863 	 * (or just modify the value entirely, of course)
1864 	 */
1865 	if (sdata->vif.type == NL80211_IFTYPE_STATION)
1866 		sinfo->rx_beacon = sdata->u.mgd.count_beacon_signal;
1867 
1868 	drv_sta_statistics(local, sdata, &sta->sta, sinfo);
1869 
1870 	sinfo->filled |= BIT(NL80211_STA_INFO_INACTIVE_TIME) |
1871 			 BIT(NL80211_STA_INFO_STA_FLAGS) |
1872 			 BIT(NL80211_STA_INFO_BSS_PARAM) |
1873 			 BIT(NL80211_STA_INFO_CONNECTED_TIME) |
1874 			 BIT(NL80211_STA_INFO_RX_DROP_MISC);
1875 
1876 	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
1877 		sinfo->beacon_loss_count = sdata->u.mgd.beacon_loss_count;
1878 		sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_LOSS);
1879 	}
1880 
1881 	sinfo->connected_time = ktime_get_seconds() - sta->last_connected;
1882 	sinfo->inactive_time =
1883 		jiffies_to_msecs(jiffies - sta->rx_stats.last_rx);
1884 
1885 	if (!(sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES64) |
1886 			       BIT(NL80211_STA_INFO_TX_BYTES)))) {
1887 		sinfo->tx_bytes = 0;
1888 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
1889 			sinfo->tx_bytes += sta->tx_stats.bytes[ac];
1890 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES64);
1891 	}
1892 
1893 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_PACKETS))) {
1894 		sinfo->tx_packets = 0;
1895 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
1896 			sinfo->tx_packets += sta->tx_stats.packets[ac];
1897 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
1898 	}
1899 
1900 	if (!(sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES64) |
1901 			       BIT(NL80211_STA_INFO_RX_BYTES)))) {
1902 		sinfo->rx_bytes = sta->rx_stats.bytes;
1903 		sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES64);
1904 	}
1905 
1906 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_RX_PACKETS))) {
1907 		sinfo->rx_packets = sta->rx_stats.packets;
1908 		sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
1909 	}
1910 
1911 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_RETRIES))) {
1912 		sinfo->tx_retries = sta->status_stats.retry_count;
1913 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_RETRIES);
1914 	}
1915 
1916 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_FAILED))) {
1917 		sinfo->tx_failed = sta->status_stats.retry_failed;
1918 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
1919 	}
1920 
1921 	sinfo->rx_dropped_misc = sta->rx_stats.dropped;
1922 
1923 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1924 	    !(sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)) {
1925 		sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_RX) |
1926 				 BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
1927 		sinfo->rx_beacon_signal_avg = ieee80211_ave_rssi(&sdata->vif);
1928 	}
1929 
1930 	if (ieee80211_hw_check(&sta->local->hw, SIGNAL_DBM) ||
1931 	    ieee80211_hw_check(&sta->local->hw, SIGNAL_UNSPEC)) {
1932 		if (!(sinfo->filled & BIT(NL80211_STA_INFO_SIGNAL))) {
1933 			sinfo->signal = (s8)sta->rx_stats.last_signal;
1934 			sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
1935 		}
1936 
1937 		if (!(sinfo->filled & BIT(NL80211_STA_INFO_SIGNAL_AVG))) {
1938 			sinfo->signal_avg =
1939 				-ewma_signal_read(&sta->rx_stats.avg_signal);
1940 			sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL_AVG);
1941 		}
1942 	}
1943 
1944 	if (sta->rx_stats.chains &&
1945 	    !(sinfo->filled & (BIT(NL80211_STA_INFO_CHAIN_SIGNAL) |
1946 			       BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)))) {
1947 		sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL) |
1948 				 BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
1949 
1950 		sinfo->chains = sta->rx_stats.chains;
1951 		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
1952 			sinfo->chain_signal[i] =
1953 				sta->rx_stats.chain_signal_last[i];
1954 			sinfo->chain_signal_avg[i] =
1955 				-ewma_signal_read(&sta->rx_stats.chain_signal_avg[i]);
1956 		}
1957 	}
1958 
1959 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE))) {
1960 		sta_set_rate_info_tx(sta, &sta->tx_stats.last_rate,
1961 				     &sinfo->txrate);
1962 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
1963 	}
1964 
1965 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE))) {
1966 		sta_set_rate_info_rx(sta, &sinfo->rxrate);
1967 		sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
1968 	}
1969 
1970 	sinfo->filled |= BIT(NL80211_STA_INFO_TID_STATS);
1971 	for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++) {
1972 		struct cfg80211_tid_stats *tidstats = &sinfo->pertid[i];
1973 
1974 		if (!(tidstats->filled & BIT(NL80211_TID_STATS_RX_MSDU))) {
1975 			tidstats->filled |= BIT(NL80211_TID_STATS_RX_MSDU);
1976 			tidstats->rx_msdu = sta->rx_stats.msdu[i];
1977 		}
1978 
1979 		if (!(tidstats->filled & BIT(NL80211_TID_STATS_TX_MSDU))) {
1980 			tidstats->filled |= BIT(NL80211_TID_STATS_TX_MSDU);
1981 			tidstats->tx_msdu = sta->tx_stats.msdu[i];
1982 		}
1983 
1984 		if (!(tidstats->filled &
1985 				BIT(NL80211_TID_STATS_TX_MSDU_RETRIES)) &&
1986 		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
1987 			tidstats->filled |=
1988 				BIT(NL80211_TID_STATS_TX_MSDU_RETRIES);
1989 			tidstats->tx_msdu_retries =
1990 				sta->status_stats.msdu_retries[i];
1991 		}
1992 
1993 		if (!(tidstats->filled &
1994 				BIT(NL80211_TID_STATS_TX_MSDU_FAILED)) &&
1995 		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
1996 			tidstats->filled |=
1997 				BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
1998 			tidstats->tx_msdu_failed =
1999 				sta->status_stats.msdu_failed[i];
2000 		}
2001 	}
2002 
2003 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
2004 #ifdef CONFIG_MAC80211_MESH
2005 		sinfo->filled |= BIT(NL80211_STA_INFO_LLID) |
2006 				 BIT(NL80211_STA_INFO_PLID) |
2007 				 BIT(NL80211_STA_INFO_PLINK_STATE) |
2008 				 BIT(NL80211_STA_INFO_LOCAL_PM) |
2009 				 BIT(NL80211_STA_INFO_PEER_PM) |
2010 				 BIT(NL80211_STA_INFO_NONPEER_PM);
2011 
2012 		sinfo->llid = sta->mesh->llid;
2013 		sinfo->plid = sta->mesh->plid;
2014 		sinfo->plink_state = sta->mesh->plink_state;
2015 		if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
2016 			sinfo->filled |= BIT(NL80211_STA_INFO_T_OFFSET);
2017 			sinfo->t_offset = sta->mesh->t_offset;
2018 		}
2019 		sinfo->local_pm = sta->mesh->local_pm;
2020 		sinfo->peer_pm = sta->mesh->peer_pm;
2021 		sinfo->nonpeer_pm = sta->mesh->nonpeer_pm;
2022 #endif
2023 	}
2024 
2025 	sinfo->bss_param.flags = 0;
2026 	if (sdata->vif.bss_conf.use_cts_prot)
2027 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2028 	if (sdata->vif.bss_conf.use_short_preamble)
2029 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2030 	if (sdata->vif.bss_conf.use_short_slot)
2031 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2032 	sinfo->bss_param.dtim_period = sdata->vif.bss_conf.dtim_period;
2033 	sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
2034 
2035 	sinfo->sta_flags.set = 0;
2036 	sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2037 				BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2038 				BIT(NL80211_STA_FLAG_WME) |
2039 				BIT(NL80211_STA_FLAG_MFP) |
2040 				BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2041 				BIT(NL80211_STA_FLAG_ASSOCIATED) |
2042 				BIT(NL80211_STA_FLAG_TDLS_PEER);
2043 	if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2044 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2045 	if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
2046 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
2047 	if (sta->sta.wme)
2048 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
2049 	if (test_sta_flag(sta, WLAN_STA_MFP))
2050 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
2051 	if (test_sta_flag(sta, WLAN_STA_AUTH))
2052 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2053 	if (test_sta_flag(sta, WLAN_STA_ASSOC))
2054 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2055 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
2056 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2057 
2058 	/* check if the driver has a SW RC implementation */
2059 	if (ref && ref->ops->get_expected_throughput)
2060 		thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
2061 	else
2062 		thr = drv_get_expected_throughput(local, &sta->sta);
2063 
2064 	if (thr != 0) {
2065 		sinfo->filled |= BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
2066 		sinfo->expected_throughput = thr;
2067 	}
2068 }
2069