xref: /openbmc/linux/net/mac80211/sta_info.c (revision d2999e1b)
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  */
9 
10 #include <linux/module.h>
11 #include <linux/init.h>
12 #include <linux/etherdevice.h>
13 #include <linux/netdevice.h>
14 #include <linux/types.h>
15 #include <linux/slab.h>
16 #include <linux/skbuff.h>
17 #include <linux/if_arp.h>
18 #include <linux/timer.h>
19 #include <linux/rtnetlink.h>
20 
21 #include <net/mac80211.h>
22 #include "ieee80211_i.h"
23 #include "driver-ops.h"
24 #include "rate.h"
25 #include "sta_info.h"
26 #include "debugfs_sta.h"
27 #include "mesh.h"
28 #include "wme.h"
29 
30 /**
31  * DOC: STA information lifetime rules
32  *
33  * STA info structures (&struct sta_info) are managed in a hash table
34  * for faster lookup and a list for iteration. They are managed using
35  * RCU, i.e. access to the list and hash table is protected by RCU.
36  *
37  * Upon allocating a STA info structure with sta_info_alloc(), the caller
38  * owns that structure. It must then insert it into the hash table using
39  * either sta_info_insert() or sta_info_insert_rcu(); only in the latter
40  * case (which acquires an rcu read section but must not be called from
41  * within one) will the pointer still be valid after the call. Note that
42  * the caller may not do much with the STA info before inserting it, in
43  * particular, it may not start any mesh peer link management or add
44  * encryption keys.
45  *
46  * When the insertion fails (sta_info_insert()) returns non-zero), the
47  * structure will have been freed by sta_info_insert()!
48  *
49  * Station entries are added by mac80211 when you establish a link with a
50  * peer. This means different things for the different type of interfaces
51  * we support. For a regular station this mean we add the AP sta when we
52  * receive an association response from the AP. For IBSS this occurs when
53  * get to know about a peer on the same IBSS. For WDS we add the sta for
54  * the peer immediately upon device open. When using AP mode we add stations
55  * for each respective station upon request from userspace through nl80211.
56  *
57  * In order to remove a STA info structure, various sta_info_destroy_*()
58  * calls are available.
59  *
60  * There is no concept of ownership on a STA entry, each structure is
61  * owned by the global hash table/list until it is removed. All users of
62  * the structure need to be RCU protected so that the structure won't be
63  * freed before they are done using it.
64  */
65 
66 /* Caller must hold local->sta_mtx */
67 static int sta_info_hash_del(struct ieee80211_local *local,
68 			     struct sta_info *sta)
69 {
70 	struct sta_info *s;
71 
72 	s = rcu_dereference_protected(local->sta_hash[STA_HASH(sta->sta.addr)],
73 				      lockdep_is_held(&local->sta_mtx));
74 	if (!s)
75 		return -ENOENT;
76 	if (s == sta) {
77 		rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
78 				   s->hnext);
79 		return 0;
80 	}
81 
82 	while (rcu_access_pointer(s->hnext) &&
83 	       rcu_access_pointer(s->hnext) != sta)
84 		s = rcu_dereference_protected(s->hnext,
85 					lockdep_is_held(&local->sta_mtx));
86 	if (rcu_access_pointer(s->hnext)) {
87 		rcu_assign_pointer(s->hnext, sta->hnext);
88 		return 0;
89 	}
90 
91 	return -ENOENT;
92 }
93 
94 static void __cleanup_single_sta(struct sta_info *sta)
95 {
96 	int ac, i;
97 	struct tid_ampdu_tx *tid_tx;
98 	struct ieee80211_sub_if_data *sdata = sta->sdata;
99 	struct ieee80211_local *local = sdata->local;
100 	struct ps_data *ps;
101 
102 	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
103 	    test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
104 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
105 		    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
106 			ps = &sdata->bss->ps;
107 		else if (ieee80211_vif_is_mesh(&sdata->vif))
108 			ps = &sdata->u.mesh.ps;
109 		else
110 			return;
111 
112 		clear_sta_flag(sta, WLAN_STA_PS_STA);
113 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
114 
115 		atomic_dec(&ps->num_sta_ps);
116 		sta_info_recalc_tim(sta);
117 	}
118 
119 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
120 		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
121 		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
122 		ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
123 	}
124 
125 	if (ieee80211_vif_is_mesh(&sdata->vif))
126 		mesh_sta_cleanup(sta);
127 
128 	cancel_work_sync(&sta->drv_unblock_wk);
129 
130 	/*
131 	 * Destroy aggregation state here. It would be nice to wait for the
132 	 * driver to finish aggregation stop and then clean up, but for now
133 	 * drivers have to handle aggregation stop being requested, followed
134 	 * directly by station destruction.
135 	 */
136 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
137 		kfree(sta->ampdu_mlme.tid_start_tx[i]);
138 		tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
139 		if (!tid_tx)
140 			continue;
141 		ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
142 		kfree(tid_tx);
143 	}
144 }
145 
146 static void cleanup_single_sta(struct sta_info *sta)
147 {
148 	struct ieee80211_sub_if_data *sdata = sta->sdata;
149 	struct ieee80211_local *local = sdata->local;
150 
151 	__cleanup_single_sta(sta);
152 	sta_info_free(local, sta);
153 }
154 
155 /* protected by RCU */
156 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
157 			      const u8 *addr)
158 {
159 	struct ieee80211_local *local = sdata->local;
160 	struct sta_info *sta;
161 
162 	sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
163 				    lockdep_is_held(&local->sta_mtx));
164 	while (sta) {
165 		if (sta->sdata == sdata &&
166 		    ether_addr_equal(sta->sta.addr, addr))
167 			break;
168 		sta = rcu_dereference_check(sta->hnext,
169 					    lockdep_is_held(&local->sta_mtx));
170 	}
171 	return sta;
172 }
173 
174 /*
175  * Get sta info either from the specified interface
176  * or from one of its vlans
177  */
178 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
179 				  const u8 *addr)
180 {
181 	struct ieee80211_local *local = sdata->local;
182 	struct sta_info *sta;
183 
184 	sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
185 				    lockdep_is_held(&local->sta_mtx));
186 	while (sta) {
187 		if ((sta->sdata == sdata ||
188 		     (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
189 		    ether_addr_equal(sta->sta.addr, addr))
190 			break;
191 		sta = rcu_dereference_check(sta->hnext,
192 					    lockdep_is_held(&local->sta_mtx));
193 	}
194 	return sta;
195 }
196 
197 struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
198 				     int idx)
199 {
200 	struct ieee80211_local *local = sdata->local;
201 	struct sta_info *sta;
202 	int i = 0;
203 
204 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
205 		if (sdata != sta->sdata)
206 			continue;
207 		if (i < idx) {
208 			++i;
209 			continue;
210 		}
211 		return sta;
212 	}
213 
214 	return NULL;
215 }
216 
217 /**
218  * sta_info_free - free STA
219  *
220  * @local: pointer to the global information
221  * @sta: STA info to free
222  *
223  * This function must undo everything done by sta_info_alloc()
224  * that may happen before sta_info_insert(). It may only be
225  * called when sta_info_insert() has not been attempted (and
226  * if that fails, the station is freed anyway.)
227  */
228 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
229 {
230 	int i;
231 
232 	if (sta->rate_ctrl)
233 		rate_control_free_sta(sta);
234 
235 	if (sta->tx_lat) {
236 		for (i = 0; i < IEEE80211_NUM_TIDS; i++)
237 			kfree(sta->tx_lat[i].bins);
238 		kfree(sta->tx_lat);
239 	}
240 
241 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
242 
243 	kfree(rcu_dereference_raw(sta->sta.rates));
244 	kfree(sta);
245 }
246 
247 /* Caller must hold local->sta_mtx */
248 static void sta_info_hash_add(struct ieee80211_local *local,
249 			      struct sta_info *sta)
250 {
251 	lockdep_assert_held(&local->sta_mtx);
252 	sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
253 	rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
254 }
255 
256 static void sta_unblock(struct work_struct *wk)
257 {
258 	struct sta_info *sta;
259 
260 	sta = container_of(wk, struct sta_info, drv_unblock_wk);
261 
262 	if (sta->dead)
263 		return;
264 
265 	if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
266 		local_bh_disable();
267 		ieee80211_sta_ps_deliver_wakeup(sta);
268 		local_bh_enable();
269 	} else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
270 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
271 
272 		local_bh_disable();
273 		ieee80211_sta_ps_deliver_poll_response(sta);
274 		local_bh_enable();
275 	} else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD)) {
276 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
277 
278 		local_bh_disable();
279 		ieee80211_sta_ps_deliver_uapsd(sta);
280 		local_bh_enable();
281 	} else
282 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
283 }
284 
285 static int sta_prepare_rate_control(struct ieee80211_local *local,
286 				    struct sta_info *sta, gfp_t gfp)
287 {
288 	if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
289 		return 0;
290 
291 	sta->rate_ctrl = local->rate_ctrl;
292 	sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
293 						     &sta->sta, gfp);
294 	if (!sta->rate_ctrl_priv)
295 		return -ENOMEM;
296 
297 	return 0;
298 }
299 
300 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
301 				const u8 *addr, gfp_t gfp)
302 {
303 	struct ieee80211_local *local = sdata->local;
304 	struct sta_info *sta;
305 	struct timespec uptime;
306 	struct ieee80211_tx_latency_bin_ranges *tx_latency;
307 	int i;
308 
309 	sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
310 	if (!sta)
311 		return NULL;
312 
313 	rcu_read_lock();
314 	tx_latency = rcu_dereference(local->tx_latency);
315 	/* init stations Tx latency statistics && TID bins */
316 	if (tx_latency) {
317 		sta->tx_lat = kzalloc(IEEE80211_NUM_TIDS *
318 				      sizeof(struct ieee80211_tx_latency_stat),
319 				      GFP_ATOMIC);
320 		if (!sta->tx_lat) {
321 			rcu_read_unlock();
322 			goto free;
323 		}
324 
325 		if (tx_latency->n_ranges) {
326 			for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
327 				/* size of bins is size of the ranges +1 */
328 				sta->tx_lat[i].bin_count =
329 					tx_latency->n_ranges + 1;
330 				sta->tx_lat[i].bins =
331 					kcalloc(sta->tx_lat[i].bin_count,
332 						sizeof(u32), GFP_ATOMIC);
333 				if (!sta->tx_lat[i].bins) {
334 					rcu_read_unlock();
335 					goto free;
336 				}
337 			}
338 		}
339 	}
340 	rcu_read_unlock();
341 
342 	spin_lock_init(&sta->lock);
343 	spin_lock_init(&sta->ps_lock);
344 	INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
345 	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
346 	mutex_init(&sta->ampdu_mlme.mtx);
347 #ifdef CONFIG_MAC80211_MESH
348 	if (ieee80211_vif_is_mesh(&sdata->vif) &&
349 	    !sdata->u.mesh.user_mpm)
350 		init_timer(&sta->plink_timer);
351 	sta->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
352 #endif
353 
354 	memcpy(sta->sta.addr, addr, ETH_ALEN);
355 	sta->local = local;
356 	sta->sdata = sdata;
357 	sta->last_rx = jiffies;
358 
359 	sta->sta_state = IEEE80211_STA_NONE;
360 
361 	do_posix_clock_monotonic_gettime(&uptime);
362 	sta->last_connected = uptime.tv_sec;
363 	ewma_init(&sta->avg_signal, 1024, 8);
364 	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
365 		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
366 
367 	if (sta_prepare_rate_control(local, sta, gfp))
368 		goto free;
369 
370 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
371 		/*
372 		 * timer_to_tid must be initialized with identity mapping
373 		 * to enable session_timer's data differentiation. See
374 		 * sta_rx_agg_session_timer_expired for usage.
375 		 */
376 		sta->timer_to_tid[i] = i;
377 	}
378 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
379 		skb_queue_head_init(&sta->ps_tx_buf[i]);
380 		skb_queue_head_init(&sta->tx_filtered[i]);
381 	}
382 
383 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
384 		sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
385 
386 	sta->sta.smps_mode = IEEE80211_SMPS_OFF;
387 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
388 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
389 		struct ieee80211_supported_band *sband =
390 			local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
391 		u8 smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
392 				IEEE80211_HT_CAP_SM_PS_SHIFT;
393 		/*
394 		 * Assume that hostapd advertises our caps in the beacon and
395 		 * this is the known_smps_mode for a station that just assciated
396 		 */
397 		switch (smps) {
398 		case WLAN_HT_SMPS_CONTROL_DISABLED:
399 			sta->known_smps_mode = IEEE80211_SMPS_OFF;
400 			break;
401 		case WLAN_HT_SMPS_CONTROL_STATIC:
402 			sta->known_smps_mode = IEEE80211_SMPS_STATIC;
403 			break;
404 		case WLAN_HT_SMPS_CONTROL_DYNAMIC:
405 			sta->known_smps_mode = IEEE80211_SMPS_DYNAMIC;
406 			break;
407 		default:
408 			WARN_ON(1);
409 		}
410 	}
411 
412 	sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
413 	return sta;
414 
415 free:
416 	if (sta->tx_lat) {
417 		for (i = 0; i < IEEE80211_NUM_TIDS; i++)
418 			kfree(sta->tx_lat[i].bins);
419 		kfree(sta->tx_lat);
420 	}
421 	kfree(sta);
422 	return NULL;
423 }
424 
425 static int sta_info_insert_check(struct sta_info *sta)
426 {
427 	struct ieee80211_sub_if_data *sdata = sta->sdata;
428 
429 	/*
430 	 * Can't be a WARN_ON because it can be triggered through a race:
431 	 * something inserts a STA (on one CPU) without holding the RTNL
432 	 * and another CPU turns off the net device.
433 	 */
434 	if (unlikely(!ieee80211_sdata_running(sdata)))
435 		return -ENETDOWN;
436 
437 	if (WARN_ON(ether_addr_equal(sta->sta.addr, sdata->vif.addr) ||
438 		    is_multicast_ether_addr(sta->sta.addr)))
439 		return -EINVAL;
440 
441 	return 0;
442 }
443 
444 static int sta_info_insert_drv_state(struct ieee80211_local *local,
445 				     struct ieee80211_sub_if_data *sdata,
446 				     struct sta_info *sta)
447 {
448 	enum ieee80211_sta_state state;
449 	int err = 0;
450 
451 	for (state = IEEE80211_STA_NOTEXIST; state < sta->sta_state; state++) {
452 		err = drv_sta_state(local, sdata, sta, state, state + 1);
453 		if (err)
454 			break;
455 	}
456 
457 	if (!err) {
458 		/*
459 		 * Drivers using legacy sta_add/sta_remove callbacks only
460 		 * get uploaded set to true after sta_add is called.
461 		 */
462 		if (!local->ops->sta_add)
463 			sta->uploaded = true;
464 		return 0;
465 	}
466 
467 	if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
468 		sdata_info(sdata,
469 			   "failed to move IBSS STA %pM to state %d (%d) - keeping it anyway\n",
470 			   sta->sta.addr, state + 1, err);
471 		err = 0;
472 	}
473 
474 	/* unwind on error */
475 	for (; state > IEEE80211_STA_NOTEXIST; state--)
476 		WARN_ON(drv_sta_state(local, sdata, sta, state, state - 1));
477 
478 	return err;
479 }
480 
481 /*
482  * should be called with sta_mtx locked
483  * this function replaces the mutex lock
484  * with a RCU lock
485  */
486 static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
487 {
488 	struct ieee80211_local *local = sta->local;
489 	struct ieee80211_sub_if_data *sdata = sta->sdata;
490 	struct station_info sinfo;
491 	int err = 0;
492 
493 	lockdep_assert_held(&local->sta_mtx);
494 
495 	/* check if STA exists already */
496 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
497 		err = -EEXIST;
498 		goto out_err;
499 	}
500 
501 	local->num_sta++;
502 	local->sta_generation++;
503 	smp_mb();
504 
505 	/* simplify things and don't accept BA sessions yet */
506 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
507 
508 	/* make the station visible */
509 	sta_info_hash_add(local, sta);
510 
511 	list_add_rcu(&sta->list, &local->sta_list);
512 
513 	/* notify driver */
514 	err = sta_info_insert_drv_state(local, sdata, sta);
515 	if (err)
516 		goto out_remove;
517 
518 	set_sta_flag(sta, WLAN_STA_INSERTED);
519 	/* accept BA sessions now */
520 	clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
521 
522 	ieee80211_recalc_min_chandef(sdata);
523 	ieee80211_sta_debugfs_add(sta);
524 	rate_control_add_sta_debugfs(sta);
525 
526 	memset(&sinfo, 0, sizeof(sinfo));
527 	sinfo.filled = 0;
528 	sinfo.generation = local->sta_generation;
529 	cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
530 
531 	sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr);
532 
533 	/* move reference to rcu-protected */
534 	rcu_read_lock();
535 	mutex_unlock(&local->sta_mtx);
536 
537 	if (ieee80211_vif_is_mesh(&sdata->vif))
538 		mesh_accept_plinks_update(sdata);
539 
540 	return 0;
541  out_remove:
542 	sta_info_hash_del(local, sta);
543 	list_del_rcu(&sta->list);
544 	local->num_sta--;
545 	synchronize_net();
546 	__cleanup_single_sta(sta);
547  out_err:
548 	mutex_unlock(&local->sta_mtx);
549 	rcu_read_lock();
550 	return err;
551 }
552 
553 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
554 {
555 	struct ieee80211_local *local = sta->local;
556 	int err;
557 
558 	might_sleep();
559 
560 	err = sta_info_insert_check(sta);
561 	if (err) {
562 		rcu_read_lock();
563 		goto out_free;
564 	}
565 
566 	mutex_lock(&local->sta_mtx);
567 
568 	err = sta_info_insert_finish(sta);
569 	if (err)
570 		goto out_free;
571 
572 	return 0;
573  out_free:
574 	sta_info_free(local, sta);
575 	return err;
576 }
577 
578 int sta_info_insert(struct sta_info *sta)
579 {
580 	int err = sta_info_insert_rcu(sta);
581 
582 	rcu_read_unlock();
583 
584 	return err;
585 }
586 
587 static inline void __bss_tim_set(u8 *tim, u16 id)
588 {
589 	/*
590 	 * This format has been mandated by the IEEE specifications,
591 	 * so this line may not be changed to use the __set_bit() format.
592 	 */
593 	tim[id / 8] |= (1 << (id % 8));
594 }
595 
596 static inline void __bss_tim_clear(u8 *tim, u16 id)
597 {
598 	/*
599 	 * This format has been mandated by the IEEE specifications,
600 	 * so this line may not be changed to use the __clear_bit() format.
601 	 */
602 	tim[id / 8] &= ~(1 << (id % 8));
603 }
604 
605 static inline bool __bss_tim_get(u8 *tim, u16 id)
606 {
607 	/*
608 	 * This format has been mandated by the IEEE specifications,
609 	 * so this line may not be changed to use the test_bit() format.
610 	 */
611 	return tim[id / 8] & (1 << (id % 8));
612 }
613 
614 static unsigned long ieee80211_tids_for_ac(int ac)
615 {
616 	/* If we ever support TIDs > 7, this obviously needs to be adjusted */
617 	switch (ac) {
618 	case IEEE80211_AC_VO:
619 		return BIT(6) | BIT(7);
620 	case IEEE80211_AC_VI:
621 		return BIT(4) | BIT(5);
622 	case IEEE80211_AC_BE:
623 		return BIT(0) | BIT(3);
624 	case IEEE80211_AC_BK:
625 		return BIT(1) | BIT(2);
626 	default:
627 		WARN_ON(1);
628 		return 0;
629 	}
630 }
631 
632 void sta_info_recalc_tim(struct sta_info *sta)
633 {
634 	struct ieee80211_local *local = sta->local;
635 	struct ps_data *ps;
636 	bool indicate_tim = false;
637 	u8 ignore_for_tim = sta->sta.uapsd_queues;
638 	int ac;
639 	u16 id;
640 
641 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
642 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
643 		if (WARN_ON_ONCE(!sta->sdata->bss))
644 			return;
645 
646 		ps = &sta->sdata->bss->ps;
647 		id = sta->sta.aid;
648 #ifdef CONFIG_MAC80211_MESH
649 	} else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
650 		ps = &sta->sdata->u.mesh.ps;
651 		/* TIM map only for 1 <= PLID <= IEEE80211_MAX_AID */
652 		id = sta->plid % (IEEE80211_MAX_AID + 1);
653 #endif
654 	} else {
655 		return;
656 	}
657 
658 	/* No need to do anything if the driver does all */
659 	if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
660 		return;
661 
662 	if (sta->dead)
663 		goto done;
664 
665 	/*
666 	 * If all ACs are delivery-enabled then we should build
667 	 * the TIM bit for all ACs anyway; if only some are then
668 	 * we ignore those and build the TIM bit using only the
669 	 * non-enabled ones.
670 	 */
671 	if (ignore_for_tim == BIT(IEEE80211_NUM_ACS) - 1)
672 		ignore_for_tim = 0;
673 
674 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
675 		unsigned long tids;
676 
677 		if (ignore_for_tim & BIT(ac))
678 			continue;
679 
680 		indicate_tim |= !skb_queue_empty(&sta->tx_filtered[ac]) ||
681 				!skb_queue_empty(&sta->ps_tx_buf[ac]);
682 		if (indicate_tim)
683 			break;
684 
685 		tids = ieee80211_tids_for_ac(ac);
686 
687 		indicate_tim |=
688 			sta->driver_buffered_tids & tids;
689 	}
690 
691  done:
692 	spin_lock_bh(&local->tim_lock);
693 
694 	if (indicate_tim == __bss_tim_get(ps->tim, id))
695 		goto out_unlock;
696 
697 	if (indicate_tim)
698 		__bss_tim_set(ps->tim, id);
699 	else
700 		__bss_tim_clear(ps->tim, id);
701 
702 	if (local->ops->set_tim) {
703 		local->tim_in_locked_section = true;
704 		drv_set_tim(local, &sta->sta, indicate_tim);
705 		local->tim_in_locked_section = false;
706 	}
707 
708 out_unlock:
709 	spin_unlock_bh(&local->tim_lock);
710 }
711 
712 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
713 {
714 	struct ieee80211_tx_info *info;
715 	int timeout;
716 
717 	if (!skb)
718 		return false;
719 
720 	info = IEEE80211_SKB_CB(skb);
721 
722 	/* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
723 	timeout = (sta->listen_interval *
724 		   sta->sdata->vif.bss_conf.beacon_int *
725 		   32 / 15625) * HZ;
726 	if (timeout < STA_TX_BUFFER_EXPIRE)
727 		timeout = STA_TX_BUFFER_EXPIRE;
728 	return time_after(jiffies, info->control.jiffies + timeout);
729 }
730 
731 
732 static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
733 						struct sta_info *sta, int ac)
734 {
735 	unsigned long flags;
736 	struct sk_buff *skb;
737 
738 	/*
739 	 * First check for frames that should expire on the filtered
740 	 * queue. Frames here were rejected by the driver and are on
741 	 * a separate queue to avoid reordering with normal PS-buffered
742 	 * frames. They also aren't accounted for right now in the
743 	 * total_ps_buffered counter.
744 	 */
745 	for (;;) {
746 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
747 		skb = skb_peek(&sta->tx_filtered[ac]);
748 		if (sta_info_buffer_expired(sta, skb))
749 			skb = __skb_dequeue(&sta->tx_filtered[ac]);
750 		else
751 			skb = NULL;
752 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
753 
754 		/*
755 		 * Frames are queued in order, so if this one
756 		 * hasn't expired yet we can stop testing. If
757 		 * we actually reached the end of the queue we
758 		 * also need to stop, of course.
759 		 */
760 		if (!skb)
761 			break;
762 		ieee80211_free_txskb(&local->hw, skb);
763 	}
764 
765 	/*
766 	 * Now also check the normal PS-buffered queue, this will
767 	 * only find something if the filtered queue was emptied
768 	 * since the filtered frames are all before the normal PS
769 	 * buffered frames.
770 	 */
771 	for (;;) {
772 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
773 		skb = skb_peek(&sta->ps_tx_buf[ac]);
774 		if (sta_info_buffer_expired(sta, skb))
775 			skb = __skb_dequeue(&sta->ps_tx_buf[ac]);
776 		else
777 			skb = NULL;
778 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
779 
780 		/*
781 		 * frames are queued in order, so if this one
782 		 * hasn't expired yet (or we reached the end of
783 		 * the queue) we can stop testing
784 		 */
785 		if (!skb)
786 			break;
787 
788 		local->total_ps_buffered--;
789 		ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
790 		       sta->sta.addr);
791 		ieee80211_free_txskb(&local->hw, skb);
792 	}
793 
794 	/*
795 	 * Finally, recalculate the TIM bit for this station -- it might
796 	 * now be clear because the station was too slow to retrieve its
797 	 * frames.
798 	 */
799 	sta_info_recalc_tim(sta);
800 
801 	/*
802 	 * Return whether there are any frames still buffered, this is
803 	 * used to check whether the cleanup timer still needs to run,
804 	 * if there are no frames we don't need to rearm the timer.
805 	 */
806 	return !(skb_queue_empty(&sta->ps_tx_buf[ac]) &&
807 		 skb_queue_empty(&sta->tx_filtered[ac]));
808 }
809 
810 static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
811 					     struct sta_info *sta)
812 {
813 	bool have_buffered = false;
814 	int ac;
815 
816 	/* This is only necessary for stations on BSS/MBSS interfaces */
817 	if (!sta->sdata->bss &&
818 	    !ieee80211_vif_is_mesh(&sta->sdata->vif))
819 		return false;
820 
821 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
822 		have_buffered |=
823 			sta_info_cleanup_expire_buffered_ac(local, sta, ac);
824 
825 	return have_buffered;
826 }
827 
828 static int __must_check __sta_info_destroy_part1(struct sta_info *sta)
829 {
830 	struct ieee80211_local *local;
831 	struct ieee80211_sub_if_data *sdata;
832 	int ret;
833 
834 	might_sleep();
835 
836 	if (!sta)
837 		return -ENOENT;
838 
839 	local = sta->local;
840 	sdata = sta->sdata;
841 
842 	lockdep_assert_held(&local->sta_mtx);
843 
844 	/*
845 	 * Before removing the station from the driver and
846 	 * rate control, it might still start new aggregation
847 	 * sessions -- block that to make sure the tear-down
848 	 * will be sufficient.
849 	 */
850 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
851 	ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
852 
853 	ret = sta_info_hash_del(local, sta);
854 	if (WARN_ON(ret))
855 		return ret;
856 
857 	list_del_rcu(&sta->list);
858 
859 	drv_sta_pre_rcu_remove(local, sta->sdata, sta);
860 
861 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
862 	    rcu_access_pointer(sdata->u.vlan.sta) == sta)
863 		RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
864 
865 	return 0;
866 }
867 
868 static void __sta_info_destroy_part2(struct sta_info *sta)
869 {
870 	struct ieee80211_local *local = sta->local;
871 	struct ieee80211_sub_if_data *sdata = sta->sdata;
872 	int ret;
873 
874 	/*
875 	 * NOTE: This assumes at least synchronize_net() was done
876 	 *	 after _part1 and before _part2!
877 	 */
878 
879 	might_sleep();
880 	lockdep_assert_held(&local->sta_mtx);
881 
882 	/* now keys can no longer be reached */
883 	ieee80211_free_sta_keys(local, sta);
884 
885 	sta->dead = true;
886 
887 	local->num_sta--;
888 	local->sta_generation++;
889 
890 	while (sta->sta_state > IEEE80211_STA_NONE) {
891 		ret = sta_info_move_state(sta, sta->sta_state - 1);
892 		if (ret) {
893 			WARN_ON_ONCE(1);
894 			break;
895 		}
896 	}
897 
898 	if (sta->uploaded) {
899 		ret = drv_sta_state(local, sdata, sta, IEEE80211_STA_NONE,
900 				    IEEE80211_STA_NOTEXIST);
901 		WARN_ON_ONCE(ret != 0);
902 	}
903 
904 	sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
905 
906 	cfg80211_del_sta(sdata->dev, sta->sta.addr, GFP_KERNEL);
907 
908 	rate_control_remove_sta_debugfs(sta);
909 	ieee80211_sta_debugfs_remove(sta);
910 	ieee80211_recalc_min_chandef(sdata);
911 
912 	cleanup_single_sta(sta);
913 }
914 
915 int __must_check __sta_info_destroy(struct sta_info *sta)
916 {
917 	int err = __sta_info_destroy_part1(sta);
918 
919 	if (err)
920 		return err;
921 
922 	synchronize_net();
923 
924 	__sta_info_destroy_part2(sta);
925 
926 	return 0;
927 }
928 
929 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
930 {
931 	struct sta_info *sta;
932 	int ret;
933 
934 	mutex_lock(&sdata->local->sta_mtx);
935 	sta = sta_info_get(sdata, addr);
936 	ret = __sta_info_destroy(sta);
937 	mutex_unlock(&sdata->local->sta_mtx);
938 
939 	return ret;
940 }
941 
942 int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
943 			      const u8 *addr)
944 {
945 	struct sta_info *sta;
946 	int ret;
947 
948 	mutex_lock(&sdata->local->sta_mtx);
949 	sta = sta_info_get_bss(sdata, addr);
950 	ret = __sta_info_destroy(sta);
951 	mutex_unlock(&sdata->local->sta_mtx);
952 
953 	return ret;
954 }
955 
956 static void sta_info_cleanup(unsigned long data)
957 {
958 	struct ieee80211_local *local = (struct ieee80211_local *) data;
959 	struct sta_info *sta;
960 	bool timer_needed = false;
961 
962 	rcu_read_lock();
963 	list_for_each_entry_rcu(sta, &local->sta_list, list)
964 		if (sta_info_cleanup_expire_buffered(local, sta))
965 			timer_needed = true;
966 	rcu_read_unlock();
967 
968 	if (local->quiescing)
969 		return;
970 
971 	if (!timer_needed)
972 		return;
973 
974 	mod_timer(&local->sta_cleanup,
975 		  round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL));
976 }
977 
978 void sta_info_init(struct ieee80211_local *local)
979 {
980 	spin_lock_init(&local->tim_lock);
981 	mutex_init(&local->sta_mtx);
982 	INIT_LIST_HEAD(&local->sta_list);
983 
984 	setup_timer(&local->sta_cleanup, sta_info_cleanup,
985 		    (unsigned long)local);
986 }
987 
988 void sta_info_stop(struct ieee80211_local *local)
989 {
990 	del_timer_sync(&local->sta_cleanup);
991 }
992 
993 
994 int __sta_info_flush(struct ieee80211_sub_if_data *sdata, bool vlans)
995 {
996 	struct ieee80211_local *local = sdata->local;
997 	struct sta_info *sta, *tmp;
998 	LIST_HEAD(free_list);
999 	int ret = 0;
1000 
1001 	might_sleep();
1002 
1003 	WARN_ON(vlans && sdata->vif.type != NL80211_IFTYPE_AP);
1004 	WARN_ON(vlans && !sdata->bss);
1005 
1006 	mutex_lock(&local->sta_mtx);
1007 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1008 		if (sdata == sta->sdata ||
1009 		    (vlans && sdata->bss == sta->sdata->bss)) {
1010 			if (!WARN_ON(__sta_info_destroy_part1(sta)))
1011 				list_add(&sta->free_list, &free_list);
1012 			ret++;
1013 		}
1014 	}
1015 
1016 	if (!list_empty(&free_list)) {
1017 		synchronize_net();
1018 		list_for_each_entry_safe(sta, tmp, &free_list, free_list)
1019 			__sta_info_destroy_part2(sta);
1020 	}
1021 	mutex_unlock(&local->sta_mtx);
1022 
1023 	return ret;
1024 }
1025 
1026 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
1027 			  unsigned long exp_time)
1028 {
1029 	struct ieee80211_local *local = sdata->local;
1030 	struct sta_info *sta, *tmp;
1031 
1032 	mutex_lock(&local->sta_mtx);
1033 
1034 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1035 		if (sdata != sta->sdata)
1036 			continue;
1037 
1038 		if (time_after(jiffies, sta->last_rx + exp_time)) {
1039 			sta_dbg(sta->sdata, "expiring inactive STA %pM\n",
1040 				sta->sta.addr);
1041 
1042 			if (ieee80211_vif_is_mesh(&sdata->vif) &&
1043 			    test_sta_flag(sta, WLAN_STA_PS_STA))
1044 				atomic_dec(&sdata->u.mesh.ps.num_sta_ps);
1045 
1046 			WARN_ON(__sta_info_destroy(sta));
1047 		}
1048 	}
1049 
1050 	mutex_unlock(&local->sta_mtx);
1051 }
1052 
1053 struct ieee80211_sta *ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
1054 					       const u8 *addr,
1055 					       const u8 *localaddr)
1056 {
1057 	struct sta_info *sta, *nxt;
1058 
1059 	/*
1060 	 * Just return a random station if localaddr is NULL
1061 	 * ... first in list.
1062 	 */
1063 	for_each_sta_info(hw_to_local(hw), addr, sta, nxt) {
1064 		if (localaddr &&
1065 		    !ether_addr_equal(sta->sdata->vif.addr, localaddr))
1066 			continue;
1067 		if (!sta->uploaded)
1068 			return NULL;
1069 		return &sta->sta;
1070 	}
1071 
1072 	return NULL;
1073 }
1074 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_ifaddr);
1075 
1076 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
1077 					 const u8 *addr)
1078 {
1079 	struct sta_info *sta;
1080 
1081 	if (!vif)
1082 		return NULL;
1083 
1084 	sta = sta_info_get_bss(vif_to_sdata(vif), addr);
1085 	if (!sta)
1086 		return NULL;
1087 
1088 	if (!sta->uploaded)
1089 		return NULL;
1090 
1091 	return &sta->sta;
1092 }
1093 EXPORT_SYMBOL(ieee80211_find_sta);
1094 
1095 /* powersave support code */
1096 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
1097 {
1098 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1099 	struct ieee80211_local *local = sdata->local;
1100 	struct sk_buff_head pending;
1101 	int filtered = 0, buffered = 0, ac;
1102 	unsigned long flags;
1103 	struct ps_data *ps;
1104 
1105 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
1106 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1107 		ps = &sdata->bss->ps;
1108 	else if (ieee80211_vif_is_mesh(&sdata->vif))
1109 		ps = &sdata->u.mesh.ps;
1110 	else
1111 		return;
1112 
1113 	clear_sta_flag(sta, WLAN_STA_SP);
1114 
1115 	BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
1116 	sta->driver_buffered_tids = 0;
1117 
1118 	if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1119 		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
1120 
1121 	skb_queue_head_init(&pending);
1122 
1123 	/* sync with ieee80211_tx_h_unicast_ps_buf */
1124 	spin_lock(&sta->ps_lock);
1125 	/* Send all buffered frames to the station */
1126 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1127 		int count = skb_queue_len(&pending), tmp;
1128 
1129 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
1130 		skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
1131 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
1132 		tmp = skb_queue_len(&pending);
1133 		filtered += tmp - count;
1134 		count = tmp;
1135 
1136 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
1137 		skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
1138 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
1139 		tmp = skb_queue_len(&pending);
1140 		buffered += tmp - count;
1141 	}
1142 
1143 	ieee80211_add_pending_skbs(local, &pending);
1144 	clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1145 	clear_sta_flag(sta, WLAN_STA_PS_STA);
1146 	spin_unlock(&sta->ps_lock);
1147 
1148 	atomic_dec(&ps->num_sta_ps);
1149 
1150 	/* This station just woke up and isn't aware of our SMPS state */
1151 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
1152 	    !ieee80211_smps_is_restrictive(sta->known_smps_mode,
1153 					   sdata->smps_mode) &&
1154 	    sta->known_smps_mode != sdata->bss->req_smps &&
1155 	    sta_info_tx_streams(sta) != 1) {
1156 		ht_dbg(sdata,
1157 		       "%pM just woke up and MIMO capable - update SMPS\n",
1158 		       sta->sta.addr);
1159 		ieee80211_send_smps_action(sdata, sdata->bss->req_smps,
1160 					   sta->sta.addr,
1161 					   sdata->vif.bss_conf.bssid);
1162 	}
1163 
1164 	local->total_ps_buffered -= buffered;
1165 
1166 	sta_info_recalc_tim(sta);
1167 
1168 	ps_dbg(sdata,
1169 	       "STA %pM aid %d sending %d filtered/%d PS frames since STA not sleeping anymore\n",
1170 	       sta->sta.addr, sta->sta.aid, filtered, buffered);
1171 }
1172 
1173 static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
1174 					 struct sta_info *sta, int tid,
1175 					 enum ieee80211_frame_release_type reason,
1176 					 bool call_driver)
1177 {
1178 	struct ieee80211_local *local = sdata->local;
1179 	struct ieee80211_qos_hdr *nullfunc;
1180 	struct sk_buff *skb;
1181 	int size = sizeof(*nullfunc);
1182 	__le16 fc;
1183 	bool qos = test_sta_flag(sta, WLAN_STA_WME);
1184 	struct ieee80211_tx_info *info;
1185 	struct ieee80211_chanctx_conf *chanctx_conf;
1186 
1187 	if (qos) {
1188 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1189 				 IEEE80211_STYPE_QOS_NULLFUNC |
1190 				 IEEE80211_FCTL_FROMDS);
1191 	} else {
1192 		size -= 2;
1193 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1194 				 IEEE80211_STYPE_NULLFUNC |
1195 				 IEEE80211_FCTL_FROMDS);
1196 	}
1197 
1198 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
1199 	if (!skb)
1200 		return;
1201 
1202 	skb_reserve(skb, local->hw.extra_tx_headroom);
1203 
1204 	nullfunc = (void *) skb_put(skb, size);
1205 	nullfunc->frame_control = fc;
1206 	nullfunc->duration_id = 0;
1207 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
1208 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1209 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
1210 	nullfunc->seq_ctrl = 0;
1211 
1212 	skb->priority = tid;
1213 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
1214 	if (qos) {
1215 		nullfunc->qos_ctrl = cpu_to_le16(tid);
1216 
1217 		if (reason == IEEE80211_FRAME_RELEASE_UAPSD)
1218 			nullfunc->qos_ctrl |=
1219 				cpu_to_le16(IEEE80211_QOS_CTL_EOSP);
1220 	}
1221 
1222 	info = IEEE80211_SKB_CB(skb);
1223 
1224 	/*
1225 	 * Tell TX path to send this frame even though the
1226 	 * STA may still remain is PS mode after this frame
1227 	 * exchange. Also set EOSP to indicate this packet
1228 	 * ends the poll/service period.
1229 	 */
1230 	info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
1231 		       IEEE80211_TX_CTL_PS_RESPONSE |
1232 		       IEEE80211_TX_STATUS_EOSP |
1233 		       IEEE80211_TX_CTL_REQ_TX_STATUS;
1234 
1235 	if (call_driver)
1236 		drv_allow_buffered_frames(local, sta, BIT(tid), 1,
1237 					  reason, false);
1238 
1239 	skb->dev = sdata->dev;
1240 
1241 	rcu_read_lock();
1242 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1243 	if (WARN_ON(!chanctx_conf)) {
1244 		rcu_read_unlock();
1245 		kfree_skb(skb);
1246 		return;
1247 	}
1248 
1249 	ieee80211_xmit(sdata, skb, chanctx_conf->def.chan->band);
1250 	rcu_read_unlock();
1251 }
1252 
1253 static int find_highest_prio_tid(unsigned long tids)
1254 {
1255 	/* lower 3 TIDs aren't ordered perfectly */
1256 	if (tids & 0xF8)
1257 		return fls(tids) - 1;
1258 	/* TID 0 is BE just like TID 3 */
1259 	if (tids & BIT(0))
1260 		return 0;
1261 	return fls(tids) - 1;
1262 }
1263 
1264 static void
1265 ieee80211_sta_ps_deliver_response(struct sta_info *sta,
1266 				  int n_frames, u8 ignored_acs,
1267 				  enum ieee80211_frame_release_type reason)
1268 {
1269 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1270 	struct ieee80211_local *local = sdata->local;
1271 	bool more_data = false;
1272 	int ac;
1273 	unsigned long driver_release_tids = 0;
1274 	struct sk_buff_head frames;
1275 
1276 	/* Service or PS-Poll period starts */
1277 	set_sta_flag(sta, WLAN_STA_SP);
1278 
1279 	__skb_queue_head_init(&frames);
1280 
1281 	/* Get response frame(s) and more data bit for the last one. */
1282 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1283 		unsigned long tids;
1284 
1285 		if (ignored_acs & BIT(ac))
1286 			continue;
1287 
1288 		tids = ieee80211_tids_for_ac(ac);
1289 
1290 		/* if we already have frames from software, then we can't also
1291 		 * release from hardware queues
1292 		 */
1293 		if (skb_queue_empty(&frames))
1294 			driver_release_tids |= sta->driver_buffered_tids & tids;
1295 
1296 		if (driver_release_tids) {
1297 			/* If the driver has data on more than one TID then
1298 			 * certainly there's more data if we release just a
1299 			 * single frame now (from a single TID). This will
1300 			 * only happen for PS-Poll.
1301 			 */
1302 			if (reason == IEEE80211_FRAME_RELEASE_PSPOLL &&
1303 			    hweight16(driver_release_tids) > 1) {
1304 				more_data = true;
1305 				driver_release_tids =
1306 					BIT(find_highest_prio_tid(
1307 						driver_release_tids));
1308 				break;
1309 			}
1310 		} else {
1311 			struct sk_buff *skb;
1312 
1313 			while (n_frames > 0) {
1314 				skb = skb_dequeue(&sta->tx_filtered[ac]);
1315 				if (!skb) {
1316 					skb = skb_dequeue(
1317 						&sta->ps_tx_buf[ac]);
1318 					if (skb)
1319 						local->total_ps_buffered--;
1320 				}
1321 				if (!skb)
1322 					break;
1323 				n_frames--;
1324 				__skb_queue_tail(&frames, skb);
1325 			}
1326 		}
1327 
1328 		/* If we have more frames buffered on this AC, then set the
1329 		 * more-data bit and abort the loop since we can't send more
1330 		 * data from other ACs before the buffered frames from this.
1331 		 */
1332 		if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
1333 		    !skb_queue_empty(&sta->ps_tx_buf[ac])) {
1334 			more_data = true;
1335 			break;
1336 		}
1337 	}
1338 
1339 	if (skb_queue_empty(&frames) && !driver_release_tids) {
1340 		int tid;
1341 
1342 		/*
1343 		 * For PS-Poll, this can only happen due to a race condition
1344 		 * when we set the TIM bit and the station notices it, but
1345 		 * before it can poll for the frame we expire it.
1346 		 *
1347 		 * For uAPSD, this is said in the standard (11.2.1.5 h):
1348 		 *	At each unscheduled SP for a non-AP STA, the AP shall
1349 		 *	attempt to transmit at least one MSDU or MMPDU, but no
1350 		 *	more than the value specified in the Max SP Length field
1351 		 *	in the QoS Capability element from delivery-enabled ACs,
1352 		 *	that are destined for the non-AP STA.
1353 		 *
1354 		 * Since we have no other MSDU/MMPDU, transmit a QoS null frame.
1355 		 */
1356 
1357 		/* This will evaluate to 1, 3, 5 or 7. */
1358 		tid = 7 - ((ffs(~ignored_acs) - 1) << 1);
1359 
1360 		ieee80211_send_null_response(sdata, sta, tid, reason, true);
1361 	} else if (!driver_release_tids) {
1362 		struct sk_buff_head pending;
1363 		struct sk_buff *skb;
1364 		int num = 0;
1365 		u16 tids = 0;
1366 		bool need_null = false;
1367 
1368 		skb_queue_head_init(&pending);
1369 
1370 		while ((skb = __skb_dequeue(&frames))) {
1371 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1372 			struct ieee80211_hdr *hdr = (void *) skb->data;
1373 			u8 *qoshdr = NULL;
1374 
1375 			num++;
1376 
1377 			/*
1378 			 * Tell TX path to send this frame even though the
1379 			 * STA may still remain is PS mode after this frame
1380 			 * exchange.
1381 			 */
1382 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
1383 				       IEEE80211_TX_CTL_PS_RESPONSE;
1384 
1385 			/*
1386 			 * Use MoreData flag to indicate whether there are
1387 			 * more buffered frames for this STA
1388 			 */
1389 			if (more_data || !skb_queue_empty(&frames))
1390 				hdr->frame_control |=
1391 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1392 			else
1393 				hdr->frame_control &=
1394 					cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1395 
1396 			if (ieee80211_is_data_qos(hdr->frame_control) ||
1397 			    ieee80211_is_qos_nullfunc(hdr->frame_control))
1398 				qoshdr = ieee80211_get_qos_ctl(hdr);
1399 
1400 			tids |= BIT(skb->priority);
1401 
1402 			__skb_queue_tail(&pending, skb);
1403 
1404 			/* end service period after last frame or add one */
1405 			if (!skb_queue_empty(&frames))
1406 				continue;
1407 
1408 			if (reason != IEEE80211_FRAME_RELEASE_UAPSD) {
1409 				/* for PS-Poll, there's only one frame */
1410 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1411 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1412 				break;
1413 			}
1414 
1415 			/* For uAPSD, things are a bit more complicated. If the
1416 			 * last frame has a QoS header (i.e. is a QoS-data or
1417 			 * QoS-nulldata frame) then just set the EOSP bit there
1418 			 * and be done.
1419 			 * If the frame doesn't have a QoS header (which means
1420 			 * it should be a bufferable MMPDU) then we can't set
1421 			 * the EOSP bit in the QoS header; add a QoS-nulldata
1422 			 * frame to the list to send it after the MMPDU.
1423 			 *
1424 			 * Note that this code is only in the mac80211-release
1425 			 * code path, we assume that the driver will not buffer
1426 			 * anything but QoS-data frames, or if it does, will
1427 			 * create the QoS-nulldata frame by itself if needed.
1428 			 *
1429 			 * Cf. 802.11-2012 10.2.1.10 (c).
1430 			 */
1431 			if (qoshdr) {
1432 				*qoshdr |= IEEE80211_QOS_CTL_EOSP;
1433 
1434 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1435 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1436 			} else {
1437 				/* The standard isn't completely clear on this
1438 				 * as it says the more-data bit should be set
1439 				 * if there are more BUs. The QoS-Null frame
1440 				 * we're about to send isn't buffered yet, we
1441 				 * only create it below, but let's pretend it
1442 				 * was buffered just in case some clients only
1443 				 * expect more-data=0 when eosp=1.
1444 				 */
1445 				hdr->frame_control |=
1446 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1447 				need_null = true;
1448 				num++;
1449 			}
1450 			break;
1451 		}
1452 
1453 		drv_allow_buffered_frames(local, sta, tids, num,
1454 					  reason, more_data);
1455 
1456 		ieee80211_add_pending_skbs(local, &pending);
1457 
1458 		if (need_null)
1459 			ieee80211_send_null_response(
1460 				sdata, sta, find_highest_prio_tid(tids),
1461 				reason, false);
1462 
1463 		sta_info_recalc_tim(sta);
1464 	} else {
1465 		/*
1466 		 * We need to release a frame that is buffered somewhere in the
1467 		 * driver ... it'll have to handle that.
1468 		 * Note that the driver also has to check the number of frames
1469 		 * on the TIDs we're releasing from - if there are more than
1470 		 * n_frames it has to set the more-data bit (if we didn't ask
1471 		 * it to set it anyway due to other buffered frames); if there
1472 		 * are fewer than n_frames it has to make sure to adjust that
1473 		 * to allow the service period to end properly.
1474 		 */
1475 		drv_release_buffered_frames(local, sta, driver_release_tids,
1476 					    n_frames, reason, more_data);
1477 
1478 		/*
1479 		 * Note that we don't recalculate the TIM bit here as it would
1480 		 * most likely have no effect at all unless the driver told us
1481 		 * that the TID(s) became empty before returning here from the
1482 		 * release function.
1483 		 * Either way, however, when the driver tells us that the TID(s)
1484 		 * became empty we'll do the TIM recalculation.
1485 		 */
1486 	}
1487 }
1488 
1489 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
1490 {
1491 	u8 ignore_for_response = sta->sta.uapsd_queues;
1492 
1493 	/*
1494 	 * If all ACs are delivery-enabled then we should reply
1495 	 * from any of them, if only some are enabled we reply
1496 	 * only from the non-enabled ones.
1497 	 */
1498 	if (ignore_for_response == BIT(IEEE80211_NUM_ACS) - 1)
1499 		ignore_for_response = 0;
1500 
1501 	ieee80211_sta_ps_deliver_response(sta, 1, ignore_for_response,
1502 					  IEEE80211_FRAME_RELEASE_PSPOLL);
1503 }
1504 
1505 void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
1506 {
1507 	int n_frames = sta->sta.max_sp;
1508 	u8 delivery_enabled = sta->sta.uapsd_queues;
1509 
1510 	/*
1511 	 * If we ever grow support for TSPEC this might happen if
1512 	 * the TSPEC update from hostapd comes in between a trigger
1513 	 * frame setting WLAN_STA_UAPSD in the RX path and this
1514 	 * actually getting called.
1515 	 */
1516 	if (!delivery_enabled)
1517 		return;
1518 
1519 	switch (sta->sta.max_sp) {
1520 	case 1:
1521 		n_frames = 2;
1522 		break;
1523 	case 2:
1524 		n_frames = 4;
1525 		break;
1526 	case 3:
1527 		n_frames = 6;
1528 		break;
1529 	case 0:
1530 		/* XXX: what is a good value? */
1531 		n_frames = 8;
1532 		break;
1533 	}
1534 
1535 	ieee80211_sta_ps_deliver_response(sta, n_frames, ~delivery_enabled,
1536 					  IEEE80211_FRAME_RELEASE_UAPSD);
1537 }
1538 
1539 void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
1540 			       struct ieee80211_sta *pubsta, bool block)
1541 {
1542 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1543 
1544 	trace_api_sta_block_awake(sta->local, pubsta, block);
1545 
1546 	if (block)
1547 		set_sta_flag(sta, WLAN_STA_PS_DRIVER);
1548 	else if (test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1549 		ieee80211_queue_work(hw, &sta->drv_unblock_wk);
1550 }
1551 EXPORT_SYMBOL(ieee80211_sta_block_awake);
1552 
1553 void ieee80211_sta_eosp(struct ieee80211_sta *pubsta)
1554 {
1555 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1556 	struct ieee80211_local *local = sta->local;
1557 
1558 	trace_api_eosp(local, pubsta);
1559 
1560 	clear_sta_flag(sta, WLAN_STA_SP);
1561 }
1562 EXPORT_SYMBOL(ieee80211_sta_eosp);
1563 
1564 void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
1565 				u8 tid, bool buffered)
1566 {
1567 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1568 
1569 	if (WARN_ON(tid >= IEEE80211_NUM_TIDS))
1570 		return;
1571 
1572 	trace_api_sta_set_buffered(sta->local, pubsta, tid, buffered);
1573 
1574 	if (buffered)
1575 		set_bit(tid, &sta->driver_buffered_tids);
1576 	else
1577 		clear_bit(tid, &sta->driver_buffered_tids);
1578 
1579 	sta_info_recalc_tim(sta);
1580 }
1581 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
1582 
1583 int sta_info_move_state(struct sta_info *sta,
1584 			enum ieee80211_sta_state new_state)
1585 {
1586 	might_sleep();
1587 
1588 	if (sta->sta_state == new_state)
1589 		return 0;
1590 
1591 	/* check allowed transitions first */
1592 
1593 	switch (new_state) {
1594 	case IEEE80211_STA_NONE:
1595 		if (sta->sta_state != IEEE80211_STA_AUTH)
1596 			return -EINVAL;
1597 		break;
1598 	case IEEE80211_STA_AUTH:
1599 		if (sta->sta_state != IEEE80211_STA_NONE &&
1600 		    sta->sta_state != IEEE80211_STA_ASSOC)
1601 			return -EINVAL;
1602 		break;
1603 	case IEEE80211_STA_ASSOC:
1604 		if (sta->sta_state != IEEE80211_STA_AUTH &&
1605 		    sta->sta_state != IEEE80211_STA_AUTHORIZED)
1606 			return -EINVAL;
1607 		break;
1608 	case IEEE80211_STA_AUTHORIZED:
1609 		if (sta->sta_state != IEEE80211_STA_ASSOC)
1610 			return -EINVAL;
1611 		break;
1612 	default:
1613 		WARN(1, "invalid state %d", new_state);
1614 		return -EINVAL;
1615 	}
1616 
1617 	sta_dbg(sta->sdata, "moving STA %pM to state %d\n",
1618 		sta->sta.addr, new_state);
1619 
1620 	/*
1621 	 * notify the driver before the actual changes so it can
1622 	 * fail the transition
1623 	 */
1624 	if (test_sta_flag(sta, WLAN_STA_INSERTED)) {
1625 		int err = drv_sta_state(sta->local, sta->sdata, sta,
1626 					sta->sta_state, new_state);
1627 		if (err)
1628 			return err;
1629 	}
1630 
1631 	/* reflect the change in all state variables */
1632 
1633 	switch (new_state) {
1634 	case IEEE80211_STA_NONE:
1635 		if (sta->sta_state == IEEE80211_STA_AUTH)
1636 			clear_bit(WLAN_STA_AUTH, &sta->_flags);
1637 		break;
1638 	case IEEE80211_STA_AUTH:
1639 		if (sta->sta_state == IEEE80211_STA_NONE)
1640 			set_bit(WLAN_STA_AUTH, &sta->_flags);
1641 		else if (sta->sta_state == IEEE80211_STA_ASSOC)
1642 			clear_bit(WLAN_STA_ASSOC, &sta->_flags);
1643 		break;
1644 	case IEEE80211_STA_ASSOC:
1645 		if (sta->sta_state == IEEE80211_STA_AUTH) {
1646 			set_bit(WLAN_STA_ASSOC, &sta->_flags);
1647 		} else if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
1648 			if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1649 			    (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1650 			     !sta->sdata->u.vlan.sta))
1651 				atomic_dec(&sta->sdata->bss->num_mcast_sta);
1652 			clear_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1653 		}
1654 		break;
1655 	case IEEE80211_STA_AUTHORIZED:
1656 		if (sta->sta_state == IEEE80211_STA_ASSOC) {
1657 			if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1658 			    (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1659 			     !sta->sdata->u.vlan.sta))
1660 				atomic_inc(&sta->sdata->bss->num_mcast_sta);
1661 			set_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1662 		}
1663 		break;
1664 	default:
1665 		break;
1666 	}
1667 
1668 	sta->sta_state = new_state;
1669 
1670 	return 0;
1671 }
1672 
1673 u8 sta_info_tx_streams(struct sta_info *sta)
1674 {
1675 	struct ieee80211_sta_ht_cap *ht_cap = &sta->sta.ht_cap;
1676 	u8 rx_streams;
1677 
1678 	if (!sta->sta.ht_cap.ht_supported)
1679 		return 1;
1680 
1681 	if (sta->sta.vht_cap.vht_supported) {
1682 		int i;
1683 		u16 tx_mcs_map =
1684 			le16_to_cpu(sta->sta.vht_cap.vht_mcs.tx_mcs_map);
1685 
1686 		for (i = 7; i >= 0; i--)
1687 			if ((tx_mcs_map & (0x3 << (i * 2))) !=
1688 			    IEEE80211_VHT_MCS_NOT_SUPPORTED)
1689 				return i + 1;
1690 	}
1691 
1692 	if (ht_cap->mcs.rx_mask[3])
1693 		rx_streams = 4;
1694 	else if (ht_cap->mcs.rx_mask[2])
1695 		rx_streams = 3;
1696 	else if (ht_cap->mcs.rx_mask[1])
1697 		rx_streams = 2;
1698 	else
1699 		rx_streams = 1;
1700 
1701 	if (!(ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_RX_DIFF))
1702 		return rx_streams;
1703 
1704 	return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
1705 			>> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
1706 }
1707