xref: /openbmc/linux/net/mac80211/sta_info.c (revision d894fc60)
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
4  * Copyright 2013-2014  Intel Mobile Communications GmbH
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10 
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/etherdevice.h>
14 #include <linux/netdevice.h>
15 #include <linux/types.h>
16 #include <linux/slab.h>
17 #include <linux/skbuff.h>
18 #include <linux/if_arp.h>
19 #include <linux/timer.h>
20 #include <linux/rtnetlink.h>
21 
22 #include <net/mac80211.h>
23 #include "ieee80211_i.h"
24 #include "driver-ops.h"
25 #include "rate.h"
26 #include "sta_info.h"
27 #include "debugfs_sta.h"
28 #include "mesh.h"
29 #include "wme.h"
30 
31 /**
32  * DOC: STA information lifetime rules
33  *
34  * STA info structures (&struct sta_info) are managed in a hash table
35  * for faster lookup and a list for iteration. They are managed using
36  * RCU, i.e. access to the list and hash table is protected by RCU.
37  *
38  * Upon allocating a STA info structure with sta_info_alloc(), the caller
39  * owns that structure. It must then insert it into the hash table using
40  * either sta_info_insert() or sta_info_insert_rcu(); only in the latter
41  * case (which acquires an rcu read section but must not be called from
42  * within one) will the pointer still be valid after the call. Note that
43  * the caller may not do much with the STA info before inserting it, in
44  * particular, it may not start any mesh peer link management or add
45  * encryption keys.
46  *
47  * When the insertion fails (sta_info_insert()) returns non-zero), the
48  * structure will have been freed by sta_info_insert()!
49  *
50  * Station entries are added by mac80211 when you establish a link with a
51  * peer. This means different things for the different type of interfaces
52  * we support. For a regular station this mean we add the AP sta when we
53  * receive an association response from the AP. For IBSS this occurs when
54  * get to know about a peer on the same IBSS. For WDS we add the sta for
55  * the peer immediately upon device open. When using AP mode we add stations
56  * for each respective station upon request from userspace through nl80211.
57  *
58  * In order to remove a STA info structure, various sta_info_destroy_*()
59  * calls are available.
60  *
61  * There is no concept of ownership on a STA entry, each structure is
62  * owned by the global hash table/list until it is removed. All users of
63  * the structure need to be RCU protected so that the structure won't be
64  * freed before they are done using it.
65  */
66 
67 /* Caller must hold local->sta_mtx */
68 static int sta_info_hash_del(struct ieee80211_local *local,
69 			     struct sta_info *sta)
70 {
71 	struct sta_info *s;
72 
73 	s = rcu_dereference_protected(local->sta_hash[STA_HASH(sta->sta.addr)],
74 				      lockdep_is_held(&local->sta_mtx));
75 	if (!s)
76 		return -ENOENT;
77 	if (s == sta) {
78 		rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
79 				   s->hnext);
80 		return 0;
81 	}
82 
83 	while (rcu_access_pointer(s->hnext) &&
84 	       rcu_access_pointer(s->hnext) != sta)
85 		s = rcu_dereference_protected(s->hnext,
86 					lockdep_is_held(&local->sta_mtx));
87 	if (rcu_access_pointer(s->hnext)) {
88 		rcu_assign_pointer(s->hnext, sta->hnext);
89 		return 0;
90 	}
91 
92 	return -ENOENT;
93 }
94 
95 static void __cleanup_single_sta(struct sta_info *sta)
96 {
97 	int ac, i;
98 	struct tid_ampdu_tx *tid_tx;
99 	struct ieee80211_sub_if_data *sdata = sta->sdata;
100 	struct ieee80211_local *local = sdata->local;
101 	struct ps_data *ps;
102 
103 	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
104 	    test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
105 	    test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
106 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
107 		    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
108 			ps = &sdata->bss->ps;
109 		else if (ieee80211_vif_is_mesh(&sdata->vif))
110 			ps = &sdata->u.mesh.ps;
111 		else
112 			return;
113 
114 		clear_sta_flag(sta, WLAN_STA_PS_STA);
115 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
116 		clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
117 
118 		atomic_dec(&ps->num_sta_ps);
119 	}
120 
121 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
122 		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
123 		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
124 		ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
125 	}
126 
127 	if (ieee80211_vif_is_mesh(&sdata->vif))
128 		mesh_sta_cleanup(sta);
129 
130 	cancel_work_sync(&sta->drv_deliver_wk);
131 
132 	/*
133 	 * Destroy aggregation state here. It would be nice to wait for the
134 	 * driver to finish aggregation stop and then clean up, but for now
135 	 * drivers have to handle aggregation stop being requested, followed
136 	 * directly by station destruction.
137 	 */
138 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
139 		kfree(sta->ampdu_mlme.tid_start_tx[i]);
140 		tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
141 		if (!tid_tx)
142 			continue;
143 		ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
144 		kfree(tid_tx);
145 	}
146 }
147 
148 static void cleanup_single_sta(struct sta_info *sta)
149 {
150 	struct ieee80211_sub_if_data *sdata = sta->sdata;
151 	struct ieee80211_local *local = sdata->local;
152 
153 	__cleanup_single_sta(sta);
154 	sta_info_free(local, sta);
155 }
156 
157 /* protected by RCU */
158 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
159 			      const u8 *addr)
160 {
161 	struct ieee80211_local *local = sdata->local;
162 	struct sta_info *sta;
163 
164 	sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
165 				    lockdep_is_held(&local->sta_mtx));
166 	while (sta) {
167 		if (sta->sdata == sdata &&
168 		    ether_addr_equal(sta->sta.addr, addr))
169 			break;
170 		sta = rcu_dereference_check(sta->hnext,
171 					    lockdep_is_held(&local->sta_mtx));
172 	}
173 	return sta;
174 }
175 
176 /*
177  * Get sta info either from the specified interface
178  * or from one of its vlans
179  */
180 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
181 				  const u8 *addr)
182 {
183 	struct ieee80211_local *local = sdata->local;
184 	struct sta_info *sta;
185 
186 	sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
187 				    lockdep_is_held(&local->sta_mtx));
188 	while (sta) {
189 		if ((sta->sdata == sdata ||
190 		     (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
191 		    ether_addr_equal(sta->sta.addr, addr))
192 			break;
193 		sta = rcu_dereference_check(sta->hnext,
194 					    lockdep_is_held(&local->sta_mtx));
195 	}
196 	return sta;
197 }
198 
199 struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
200 				     int idx)
201 {
202 	struct ieee80211_local *local = sdata->local;
203 	struct sta_info *sta;
204 	int i = 0;
205 
206 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
207 		if (sdata != sta->sdata)
208 			continue;
209 		if (i < idx) {
210 			++i;
211 			continue;
212 		}
213 		return sta;
214 	}
215 
216 	return NULL;
217 }
218 
219 /**
220  * sta_info_free - free STA
221  *
222  * @local: pointer to the global information
223  * @sta: STA info to free
224  *
225  * This function must undo everything done by sta_info_alloc()
226  * that may happen before sta_info_insert(). It may only be
227  * called when sta_info_insert() has not been attempted (and
228  * if that fails, the station is freed anyway.)
229  */
230 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
231 {
232 	int i;
233 
234 	if (sta->rate_ctrl)
235 		rate_control_free_sta(sta);
236 
237 	if (sta->tx_lat) {
238 		for (i = 0; i < IEEE80211_NUM_TIDS; i++)
239 			kfree(sta->tx_lat[i].bins);
240 		kfree(sta->tx_lat);
241 	}
242 
243 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
244 
245 	kfree(rcu_dereference_raw(sta->sta.rates));
246 	kfree(sta);
247 }
248 
249 /* Caller must hold local->sta_mtx */
250 static void sta_info_hash_add(struct ieee80211_local *local,
251 			      struct sta_info *sta)
252 {
253 	lockdep_assert_held(&local->sta_mtx);
254 	sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
255 	rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
256 }
257 
258 static void sta_deliver_ps_frames(struct work_struct *wk)
259 {
260 	struct sta_info *sta;
261 
262 	sta = container_of(wk, struct sta_info, drv_deliver_wk);
263 
264 	if (sta->dead)
265 		return;
266 
267 	local_bh_disable();
268 	if (!test_sta_flag(sta, WLAN_STA_PS_STA))
269 		ieee80211_sta_ps_deliver_wakeup(sta);
270 	else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
271 		ieee80211_sta_ps_deliver_poll_response(sta);
272 	else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
273 		ieee80211_sta_ps_deliver_uapsd(sta);
274 	local_bh_enable();
275 }
276 
277 static int sta_prepare_rate_control(struct ieee80211_local *local,
278 				    struct sta_info *sta, gfp_t gfp)
279 {
280 	if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
281 		return 0;
282 
283 	sta->rate_ctrl = local->rate_ctrl;
284 	sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
285 						     &sta->sta, gfp);
286 	if (!sta->rate_ctrl_priv)
287 		return -ENOMEM;
288 
289 	return 0;
290 }
291 
292 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
293 				const u8 *addr, gfp_t gfp)
294 {
295 	struct ieee80211_local *local = sdata->local;
296 	struct sta_info *sta;
297 	struct timespec uptime;
298 	struct ieee80211_tx_latency_bin_ranges *tx_latency;
299 	int i;
300 
301 	sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
302 	if (!sta)
303 		return NULL;
304 
305 	rcu_read_lock();
306 	tx_latency = rcu_dereference(local->tx_latency);
307 	/* init stations Tx latency statistics && TID bins */
308 	if (tx_latency) {
309 		sta->tx_lat = kzalloc(IEEE80211_NUM_TIDS *
310 				      sizeof(struct ieee80211_tx_latency_stat),
311 				      GFP_ATOMIC);
312 		if (!sta->tx_lat) {
313 			rcu_read_unlock();
314 			goto free;
315 		}
316 
317 		if (tx_latency->n_ranges) {
318 			for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
319 				/* size of bins is size of the ranges +1 */
320 				sta->tx_lat[i].bin_count =
321 					tx_latency->n_ranges + 1;
322 				sta->tx_lat[i].bins =
323 					kcalloc(sta->tx_lat[i].bin_count,
324 						sizeof(u32), GFP_ATOMIC);
325 				if (!sta->tx_lat[i].bins) {
326 					rcu_read_unlock();
327 					goto free;
328 				}
329 			}
330 		}
331 	}
332 	rcu_read_unlock();
333 
334 	spin_lock_init(&sta->lock);
335 	spin_lock_init(&sta->ps_lock);
336 	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
337 	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
338 	mutex_init(&sta->ampdu_mlme.mtx);
339 #ifdef CONFIG_MAC80211_MESH
340 	if (ieee80211_vif_is_mesh(&sdata->vif) &&
341 	    !sdata->u.mesh.user_mpm)
342 		init_timer(&sta->plink_timer);
343 	sta->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
344 #endif
345 
346 	memcpy(sta->sta.addr, addr, ETH_ALEN);
347 	sta->local = local;
348 	sta->sdata = sdata;
349 	sta->last_rx = jiffies;
350 
351 	sta->sta_state = IEEE80211_STA_NONE;
352 
353 	/* Mark TID as unreserved */
354 	sta->reserved_tid = IEEE80211_TID_UNRESERVED;
355 
356 	ktime_get_ts(&uptime);
357 	sta->last_connected = uptime.tv_sec;
358 	ewma_init(&sta->avg_signal, 1024, 8);
359 	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
360 		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
361 
362 	if (sta_prepare_rate_control(local, sta, gfp))
363 		goto free;
364 
365 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
366 		/*
367 		 * timer_to_tid must be initialized with identity mapping
368 		 * to enable session_timer's data differentiation. See
369 		 * sta_rx_agg_session_timer_expired for usage.
370 		 */
371 		sta->timer_to_tid[i] = i;
372 	}
373 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
374 		skb_queue_head_init(&sta->ps_tx_buf[i]);
375 		skb_queue_head_init(&sta->tx_filtered[i]);
376 	}
377 
378 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
379 		sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
380 
381 	sta->sta.smps_mode = IEEE80211_SMPS_OFF;
382 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
383 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
384 		struct ieee80211_supported_band *sband =
385 			local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
386 		u8 smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
387 				IEEE80211_HT_CAP_SM_PS_SHIFT;
388 		/*
389 		 * Assume that hostapd advertises our caps in the beacon and
390 		 * this is the known_smps_mode for a station that just assciated
391 		 */
392 		switch (smps) {
393 		case WLAN_HT_SMPS_CONTROL_DISABLED:
394 			sta->known_smps_mode = IEEE80211_SMPS_OFF;
395 			break;
396 		case WLAN_HT_SMPS_CONTROL_STATIC:
397 			sta->known_smps_mode = IEEE80211_SMPS_STATIC;
398 			break;
399 		case WLAN_HT_SMPS_CONTROL_DYNAMIC:
400 			sta->known_smps_mode = IEEE80211_SMPS_DYNAMIC;
401 			break;
402 		default:
403 			WARN_ON(1);
404 		}
405 	}
406 
407 	sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
408 	return sta;
409 
410 free:
411 	if (sta->tx_lat) {
412 		for (i = 0; i < IEEE80211_NUM_TIDS; i++)
413 			kfree(sta->tx_lat[i].bins);
414 		kfree(sta->tx_lat);
415 	}
416 	kfree(sta);
417 	return NULL;
418 }
419 
420 static int sta_info_insert_check(struct sta_info *sta)
421 {
422 	struct ieee80211_sub_if_data *sdata = sta->sdata;
423 
424 	/*
425 	 * Can't be a WARN_ON because it can be triggered through a race:
426 	 * something inserts a STA (on one CPU) without holding the RTNL
427 	 * and another CPU turns off the net device.
428 	 */
429 	if (unlikely(!ieee80211_sdata_running(sdata)))
430 		return -ENETDOWN;
431 
432 	if (WARN_ON(ether_addr_equal(sta->sta.addr, sdata->vif.addr) ||
433 		    is_multicast_ether_addr(sta->sta.addr)))
434 		return -EINVAL;
435 
436 	return 0;
437 }
438 
439 static int sta_info_insert_drv_state(struct ieee80211_local *local,
440 				     struct ieee80211_sub_if_data *sdata,
441 				     struct sta_info *sta)
442 {
443 	enum ieee80211_sta_state state;
444 	int err = 0;
445 
446 	for (state = IEEE80211_STA_NOTEXIST; state < sta->sta_state; state++) {
447 		err = drv_sta_state(local, sdata, sta, state, state + 1);
448 		if (err)
449 			break;
450 	}
451 
452 	if (!err) {
453 		/*
454 		 * Drivers using legacy sta_add/sta_remove callbacks only
455 		 * get uploaded set to true after sta_add is called.
456 		 */
457 		if (!local->ops->sta_add)
458 			sta->uploaded = true;
459 		return 0;
460 	}
461 
462 	if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
463 		sdata_info(sdata,
464 			   "failed to move IBSS STA %pM to state %d (%d) - keeping it anyway\n",
465 			   sta->sta.addr, state + 1, err);
466 		err = 0;
467 	}
468 
469 	/* unwind on error */
470 	for (; state > IEEE80211_STA_NOTEXIST; state--)
471 		WARN_ON(drv_sta_state(local, sdata, sta, state, state - 1));
472 
473 	return err;
474 }
475 
476 /*
477  * should be called with sta_mtx locked
478  * this function replaces the mutex lock
479  * with a RCU lock
480  */
481 static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
482 {
483 	struct ieee80211_local *local = sta->local;
484 	struct ieee80211_sub_if_data *sdata = sta->sdata;
485 	struct station_info sinfo;
486 	int err = 0;
487 
488 	lockdep_assert_held(&local->sta_mtx);
489 
490 	/* check if STA exists already */
491 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
492 		err = -EEXIST;
493 		goto out_err;
494 	}
495 
496 	local->num_sta++;
497 	local->sta_generation++;
498 	smp_mb();
499 
500 	/* simplify things and don't accept BA sessions yet */
501 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
502 
503 	/* make the station visible */
504 	sta_info_hash_add(local, sta);
505 
506 	list_add_tail_rcu(&sta->list, &local->sta_list);
507 
508 	/* notify driver */
509 	err = sta_info_insert_drv_state(local, sdata, sta);
510 	if (err)
511 		goto out_remove;
512 
513 	set_sta_flag(sta, WLAN_STA_INSERTED);
514 	/* accept BA sessions now */
515 	clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
516 
517 	ieee80211_recalc_min_chandef(sdata);
518 	ieee80211_sta_debugfs_add(sta);
519 	rate_control_add_sta_debugfs(sta);
520 
521 	memset(&sinfo, 0, sizeof(sinfo));
522 	sinfo.filled = 0;
523 	sinfo.generation = local->sta_generation;
524 	cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
525 
526 	sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr);
527 
528 	/* move reference to rcu-protected */
529 	rcu_read_lock();
530 	mutex_unlock(&local->sta_mtx);
531 
532 	if (ieee80211_vif_is_mesh(&sdata->vif))
533 		mesh_accept_plinks_update(sdata);
534 
535 	return 0;
536  out_remove:
537 	sta_info_hash_del(local, sta);
538 	list_del_rcu(&sta->list);
539 	local->num_sta--;
540 	synchronize_net();
541 	__cleanup_single_sta(sta);
542  out_err:
543 	mutex_unlock(&local->sta_mtx);
544 	rcu_read_lock();
545 	return err;
546 }
547 
548 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
549 {
550 	struct ieee80211_local *local = sta->local;
551 	int err;
552 
553 	might_sleep();
554 
555 	err = sta_info_insert_check(sta);
556 	if (err) {
557 		rcu_read_lock();
558 		goto out_free;
559 	}
560 
561 	mutex_lock(&local->sta_mtx);
562 
563 	err = sta_info_insert_finish(sta);
564 	if (err)
565 		goto out_free;
566 
567 	return 0;
568  out_free:
569 	sta_info_free(local, sta);
570 	return err;
571 }
572 
573 int sta_info_insert(struct sta_info *sta)
574 {
575 	int err = sta_info_insert_rcu(sta);
576 
577 	rcu_read_unlock();
578 
579 	return err;
580 }
581 
582 static inline void __bss_tim_set(u8 *tim, u16 id)
583 {
584 	/*
585 	 * This format has been mandated by the IEEE specifications,
586 	 * so this line may not be changed to use the __set_bit() format.
587 	 */
588 	tim[id / 8] |= (1 << (id % 8));
589 }
590 
591 static inline void __bss_tim_clear(u8 *tim, u16 id)
592 {
593 	/*
594 	 * This format has been mandated by the IEEE specifications,
595 	 * so this line may not be changed to use the __clear_bit() format.
596 	 */
597 	tim[id / 8] &= ~(1 << (id % 8));
598 }
599 
600 static inline bool __bss_tim_get(u8 *tim, u16 id)
601 {
602 	/*
603 	 * This format has been mandated by the IEEE specifications,
604 	 * so this line may not be changed to use the test_bit() format.
605 	 */
606 	return tim[id / 8] & (1 << (id % 8));
607 }
608 
609 static unsigned long ieee80211_tids_for_ac(int ac)
610 {
611 	/* If we ever support TIDs > 7, this obviously needs to be adjusted */
612 	switch (ac) {
613 	case IEEE80211_AC_VO:
614 		return BIT(6) | BIT(7);
615 	case IEEE80211_AC_VI:
616 		return BIT(4) | BIT(5);
617 	case IEEE80211_AC_BE:
618 		return BIT(0) | BIT(3);
619 	case IEEE80211_AC_BK:
620 		return BIT(1) | BIT(2);
621 	default:
622 		WARN_ON(1);
623 		return 0;
624 	}
625 }
626 
627 static void __sta_info_recalc_tim(struct sta_info *sta, bool ignore_pending)
628 {
629 	struct ieee80211_local *local = sta->local;
630 	struct ps_data *ps;
631 	bool indicate_tim = false;
632 	u8 ignore_for_tim = sta->sta.uapsd_queues;
633 	int ac;
634 	u16 id;
635 
636 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
637 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
638 		if (WARN_ON_ONCE(!sta->sdata->bss))
639 			return;
640 
641 		ps = &sta->sdata->bss->ps;
642 		id = sta->sta.aid;
643 #ifdef CONFIG_MAC80211_MESH
644 	} else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
645 		ps = &sta->sdata->u.mesh.ps;
646 		/* TIM map only for 1 <= PLID <= IEEE80211_MAX_AID */
647 		id = sta->plid % (IEEE80211_MAX_AID + 1);
648 #endif
649 	} else {
650 		return;
651 	}
652 
653 	/* No need to do anything if the driver does all */
654 	if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
655 		return;
656 
657 	if (sta->dead)
658 		goto done;
659 
660 	/*
661 	 * If all ACs are delivery-enabled then we should build
662 	 * the TIM bit for all ACs anyway; if only some are then
663 	 * we ignore those and build the TIM bit using only the
664 	 * non-enabled ones.
665 	 */
666 	if (ignore_for_tim == BIT(IEEE80211_NUM_ACS) - 1)
667 		ignore_for_tim = 0;
668 
669 	if (ignore_pending)
670 		ignore_for_tim = BIT(IEEE80211_NUM_ACS) - 1;
671 
672 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
673 		unsigned long tids;
674 
675 		if (ignore_for_tim & BIT(ac))
676 			continue;
677 
678 		indicate_tim |= !skb_queue_empty(&sta->tx_filtered[ac]) ||
679 				!skb_queue_empty(&sta->ps_tx_buf[ac]);
680 		if (indicate_tim)
681 			break;
682 
683 		tids = ieee80211_tids_for_ac(ac);
684 
685 		indicate_tim |=
686 			sta->driver_buffered_tids & tids;
687 	}
688 
689  done:
690 	spin_lock_bh(&local->tim_lock);
691 
692 	if (indicate_tim == __bss_tim_get(ps->tim, id))
693 		goto out_unlock;
694 
695 	if (indicate_tim)
696 		__bss_tim_set(ps->tim, id);
697 	else
698 		__bss_tim_clear(ps->tim, id);
699 
700 	if (local->ops->set_tim && !WARN_ON(sta->dead)) {
701 		local->tim_in_locked_section = true;
702 		drv_set_tim(local, &sta->sta, indicate_tim);
703 		local->tim_in_locked_section = false;
704 	}
705 
706 out_unlock:
707 	spin_unlock_bh(&local->tim_lock);
708 }
709 
710 void sta_info_recalc_tim(struct sta_info *sta)
711 {
712 	__sta_info_recalc_tim(sta, false);
713 }
714 
715 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
716 {
717 	struct ieee80211_tx_info *info;
718 	int timeout;
719 
720 	if (!skb)
721 		return false;
722 
723 	info = IEEE80211_SKB_CB(skb);
724 
725 	/* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
726 	timeout = (sta->listen_interval *
727 		   sta->sdata->vif.bss_conf.beacon_int *
728 		   32 / 15625) * HZ;
729 	if (timeout < STA_TX_BUFFER_EXPIRE)
730 		timeout = STA_TX_BUFFER_EXPIRE;
731 	return time_after(jiffies, info->control.jiffies + timeout);
732 }
733 
734 
735 static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
736 						struct sta_info *sta, int ac)
737 {
738 	unsigned long flags;
739 	struct sk_buff *skb;
740 
741 	/*
742 	 * First check for frames that should expire on the filtered
743 	 * queue. Frames here were rejected by the driver and are on
744 	 * a separate queue to avoid reordering with normal PS-buffered
745 	 * frames. They also aren't accounted for right now in the
746 	 * total_ps_buffered counter.
747 	 */
748 	for (;;) {
749 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
750 		skb = skb_peek(&sta->tx_filtered[ac]);
751 		if (sta_info_buffer_expired(sta, skb))
752 			skb = __skb_dequeue(&sta->tx_filtered[ac]);
753 		else
754 			skb = NULL;
755 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
756 
757 		/*
758 		 * Frames are queued in order, so if this one
759 		 * hasn't expired yet we can stop testing. If
760 		 * we actually reached the end of the queue we
761 		 * also need to stop, of course.
762 		 */
763 		if (!skb)
764 			break;
765 		ieee80211_free_txskb(&local->hw, skb);
766 	}
767 
768 	/*
769 	 * Now also check the normal PS-buffered queue, this will
770 	 * only find something if the filtered queue was emptied
771 	 * since the filtered frames are all before the normal PS
772 	 * buffered frames.
773 	 */
774 	for (;;) {
775 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
776 		skb = skb_peek(&sta->ps_tx_buf[ac]);
777 		if (sta_info_buffer_expired(sta, skb))
778 			skb = __skb_dequeue(&sta->ps_tx_buf[ac]);
779 		else
780 			skb = NULL;
781 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
782 
783 		/*
784 		 * frames are queued in order, so if this one
785 		 * hasn't expired yet (or we reached the end of
786 		 * the queue) we can stop testing
787 		 */
788 		if (!skb)
789 			break;
790 
791 		local->total_ps_buffered--;
792 		ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
793 		       sta->sta.addr);
794 		ieee80211_free_txskb(&local->hw, skb);
795 	}
796 
797 	/*
798 	 * Finally, recalculate the TIM bit for this station -- it might
799 	 * now be clear because the station was too slow to retrieve its
800 	 * frames.
801 	 */
802 	sta_info_recalc_tim(sta);
803 
804 	/*
805 	 * Return whether there are any frames still buffered, this is
806 	 * used to check whether the cleanup timer still needs to run,
807 	 * if there are no frames we don't need to rearm the timer.
808 	 */
809 	return !(skb_queue_empty(&sta->ps_tx_buf[ac]) &&
810 		 skb_queue_empty(&sta->tx_filtered[ac]));
811 }
812 
813 static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
814 					     struct sta_info *sta)
815 {
816 	bool have_buffered = false;
817 	int ac;
818 
819 	/* This is only necessary for stations on BSS/MBSS interfaces */
820 	if (!sta->sdata->bss &&
821 	    !ieee80211_vif_is_mesh(&sta->sdata->vif))
822 		return false;
823 
824 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
825 		have_buffered |=
826 			sta_info_cleanup_expire_buffered_ac(local, sta, ac);
827 
828 	return have_buffered;
829 }
830 
831 static int __must_check __sta_info_destroy_part1(struct sta_info *sta)
832 {
833 	struct ieee80211_local *local;
834 	struct ieee80211_sub_if_data *sdata;
835 	int ret;
836 
837 	might_sleep();
838 
839 	if (!sta)
840 		return -ENOENT;
841 
842 	local = sta->local;
843 	sdata = sta->sdata;
844 
845 	lockdep_assert_held(&local->sta_mtx);
846 
847 	/*
848 	 * Before removing the station from the driver and
849 	 * rate control, it might still start new aggregation
850 	 * sessions -- block that to make sure the tear-down
851 	 * will be sufficient.
852 	 */
853 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
854 	ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
855 
856 	ret = sta_info_hash_del(local, sta);
857 	if (WARN_ON(ret))
858 		return ret;
859 
860 	/*
861 	 * for TDLS peers, make sure to return to the base channel before
862 	 * removal.
863 	 */
864 	if (test_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL)) {
865 		drv_tdls_cancel_channel_switch(local, sdata, &sta->sta);
866 		clear_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL);
867 	}
868 
869 	list_del_rcu(&sta->list);
870 
871 	drv_sta_pre_rcu_remove(local, sta->sdata, sta);
872 
873 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
874 	    rcu_access_pointer(sdata->u.vlan.sta) == sta)
875 		RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
876 
877 	return 0;
878 }
879 
880 static void __sta_info_destroy_part2(struct sta_info *sta)
881 {
882 	struct ieee80211_local *local = sta->local;
883 	struct ieee80211_sub_if_data *sdata = sta->sdata;
884 	struct station_info sinfo = {};
885 	int ret;
886 
887 	/*
888 	 * NOTE: This assumes at least synchronize_net() was done
889 	 *	 after _part1 and before _part2!
890 	 */
891 
892 	might_sleep();
893 	lockdep_assert_held(&local->sta_mtx);
894 
895 	/* now keys can no longer be reached */
896 	ieee80211_free_sta_keys(local, sta);
897 
898 	/* disable TIM bit - last chance to tell driver */
899 	__sta_info_recalc_tim(sta, true);
900 
901 	sta->dead = true;
902 
903 	local->num_sta--;
904 	local->sta_generation++;
905 
906 	while (sta->sta_state > IEEE80211_STA_NONE) {
907 		ret = sta_info_move_state(sta, sta->sta_state - 1);
908 		if (ret) {
909 			WARN_ON_ONCE(1);
910 			break;
911 		}
912 	}
913 
914 	if (sta->uploaded) {
915 		ret = drv_sta_state(local, sdata, sta, IEEE80211_STA_NONE,
916 				    IEEE80211_STA_NOTEXIST);
917 		WARN_ON_ONCE(ret != 0);
918 	}
919 
920 	sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
921 
922 	sta_set_sinfo(sta, &sinfo);
923 	cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
924 
925 	rate_control_remove_sta_debugfs(sta);
926 	ieee80211_sta_debugfs_remove(sta);
927 	ieee80211_recalc_min_chandef(sdata);
928 
929 	cleanup_single_sta(sta);
930 }
931 
932 int __must_check __sta_info_destroy(struct sta_info *sta)
933 {
934 	int err = __sta_info_destroy_part1(sta);
935 
936 	if (err)
937 		return err;
938 
939 	synchronize_net();
940 
941 	__sta_info_destroy_part2(sta);
942 
943 	return 0;
944 }
945 
946 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
947 {
948 	struct sta_info *sta;
949 	int ret;
950 
951 	mutex_lock(&sdata->local->sta_mtx);
952 	sta = sta_info_get(sdata, addr);
953 	ret = __sta_info_destroy(sta);
954 	mutex_unlock(&sdata->local->sta_mtx);
955 
956 	return ret;
957 }
958 
959 int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
960 			      const u8 *addr)
961 {
962 	struct sta_info *sta;
963 	int ret;
964 
965 	mutex_lock(&sdata->local->sta_mtx);
966 	sta = sta_info_get_bss(sdata, addr);
967 	ret = __sta_info_destroy(sta);
968 	mutex_unlock(&sdata->local->sta_mtx);
969 
970 	return ret;
971 }
972 
973 static void sta_info_cleanup(unsigned long data)
974 {
975 	struct ieee80211_local *local = (struct ieee80211_local *) data;
976 	struct sta_info *sta;
977 	bool timer_needed = false;
978 
979 	rcu_read_lock();
980 	list_for_each_entry_rcu(sta, &local->sta_list, list)
981 		if (sta_info_cleanup_expire_buffered(local, sta))
982 			timer_needed = true;
983 	rcu_read_unlock();
984 
985 	if (local->quiescing)
986 		return;
987 
988 	if (!timer_needed)
989 		return;
990 
991 	mod_timer(&local->sta_cleanup,
992 		  round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL));
993 }
994 
995 void sta_info_init(struct ieee80211_local *local)
996 {
997 	spin_lock_init(&local->tim_lock);
998 	mutex_init(&local->sta_mtx);
999 	INIT_LIST_HEAD(&local->sta_list);
1000 
1001 	setup_timer(&local->sta_cleanup, sta_info_cleanup,
1002 		    (unsigned long)local);
1003 }
1004 
1005 void sta_info_stop(struct ieee80211_local *local)
1006 {
1007 	del_timer_sync(&local->sta_cleanup);
1008 }
1009 
1010 
1011 int __sta_info_flush(struct ieee80211_sub_if_data *sdata, bool vlans)
1012 {
1013 	struct ieee80211_local *local = sdata->local;
1014 	struct sta_info *sta, *tmp;
1015 	LIST_HEAD(free_list);
1016 	int ret = 0;
1017 
1018 	might_sleep();
1019 
1020 	WARN_ON(vlans && sdata->vif.type != NL80211_IFTYPE_AP);
1021 	WARN_ON(vlans && !sdata->bss);
1022 
1023 	mutex_lock(&local->sta_mtx);
1024 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1025 		if (sdata == sta->sdata ||
1026 		    (vlans && sdata->bss == sta->sdata->bss)) {
1027 			if (!WARN_ON(__sta_info_destroy_part1(sta)))
1028 				list_add(&sta->free_list, &free_list);
1029 			ret++;
1030 		}
1031 	}
1032 
1033 	if (!list_empty(&free_list)) {
1034 		synchronize_net();
1035 		list_for_each_entry_safe(sta, tmp, &free_list, free_list)
1036 			__sta_info_destroy_part2(sta);
1037 	}
1038 	mutex_unlock(&local->sta_mtx);
1039 
1040 	return ret;
1041 }
1042 
1043 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
1044 			  unsigned long exp_time)
1045 {
1046 	struct ieee80211_local *local = sdata->local;
1047 	struct sta_info *sta, *tmp;
1048 
1049 	mutex_lock(&local->sta_mtx);
1050 
1051 	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1052 		if (sdata != sta->sdata)
1053 			continue;
1054 
1055 		if (time_after(jiffies, sta->last_rx + exp_time)) {
1056 			sta_dbg(sta->sdata, "expiring inactive STA %pM\n",
1057 				sta->sta.addr);
1058 
1059 			if (ieee80211_vif_is_mesh(&sdata->vif) &&
1060 			    test_sta_flag(sta, WLAN_STA_PS_STA))
1061 				atomic_dec(&sdata->u.mesh.ps.num_sta_ps);
1062 
1063 			WARN_ON(__sta_info_destroy(sta));
1064 		}
1065 	}
1066 
1067 	mutex_unlock(&local->sta_mtx);
1068 }
1069 
1070 struct ieee80211_sta *ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
1071 					       const u8 *addr,
1072 					       const u8 *localaddr)
1073 {
1074 	struct sta_info *sta, *nxt;
1075 
1076 	/*
1077 	 * Just return a random station if localaddr is NULL
1078 	 * ... first in list.
1079 	 */
1080 	for_each_sta_info(hw_to_local(hw), addr, sta, nxt) {
1081 		if (localaddr &&
1082 		    !ether_addr_equal(sta->sdata->vif.addr, localaddr))
1083 			continue;
1084 		if (!sta->uploaded)
1085 			return NULL;
1086 		return &sta->sta;
1087 	}
1088 
1089 	return NULL;
1090 }
1091 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_ifaddr);
1092 
1093 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
1094 					 const u8 *addr)
1095 {
1096 	struct sta_info *sta;
1097 
1098 	if (!vif)
1099 		return NULL;
1100 
1101 	sta = sta_info_get_bss(vif_to_sdata(vif), addr);
1102 	if (!sta)
1103 		return NULL;
1104 
1105 	if (!sta->uploaded)
1106 		return NULL;
1107 
1108 	return &sta->sta;
1109 }
1110 EXPORT_SYMBOL(ieee80211_find_sta);
1111 
1112 /* powersave support code */
1113 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
1114 {
1115 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1116 	struct ieee80211_local *local = sdata->local;
1117 	struct sk_buff_head pending;
1118 	int filtered = 0, buffered = 0, ac;
1119 	unsigned long flags;
1120 	struct ps_data *ps;
1121 
1122 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1123 		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
1124 				     u.ap);
1125 
1126 	if (sdata->vif.type == NL80211_IFTYPE_AP)
1127 		ps = &sdata->bss->ps;
1128 	else if (ieee80211_vif_is_mesh(&sdata->vif))
1129 		ps = &sdata->u.mesh.ps;
1130 	else
1131 		return;
1132 
1133 	clear_sta_flag(sta, WLAN_STA_SP);
1134 
1135 	BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
1136 	sta->driver_buffered_tids = 0;
1137 
1138 	if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1139 		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
1140 
1141 	skb_queue_head_init(&pending);
1142 
1143 	/* sync with ieee80211_tx_h_unicast_ps_buf */
1144 	spin_lock(&sta->ps_lock);
1145 	/* Send all buffered frames to the station */
1146 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1147 		int count = skb_queue_len(&pending), tmp;
1148 
1149 		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
1150 		skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
1151 		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
1152 		tmp = skb_queue_len(&pending);
1153 		filtered += tmp - count;
1154 		count = tmp;
1155 
1156 		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
1157 		skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
1158 		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
1159 		tmp = skb_queue_len(&pending);
1160 		buffered += tmp - count;
1161 	}
1162 
1163 	ieee80211_add_pending_skbs(local, &pending);
1164 
1165 	/* now we're no longer in the deliver code */
1166 	clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
1167 
1168 	/* The station might have polled and then woken up before we responded,
1169 	 * so clear these flags now to avoid them sticking around.
1170 	 */
1171 	clear_sta_flag(sta, WLAN_STA_PSPOLL);
1172 	clear_sta_flag(sta, WLAN_STA_UAPSD);
1173 	spin_unlock(&sta->ps_lock);
1174 
1175 	atomic_dec(&ps->num_sta_ps);
1176 
1177 	/* This station just woke up and isn't aware of our SMPS state */
1178 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
1179 	    !ieee80211_smps_is_restrictive(sta->known_smps_mode,
1180 					   sdata->smps_mode) &&
1181 	    sta->known_smps_mode != sdata->bss->req_smps &&
1182 	    sta_info_tx_streams(sta) != 1) {
1183 		ht_dbg(sdata,
1184 		       "%pM just woke up and MIMO capable - update SMPS\n",
1185 		       sta->sta.addr);
1186 		ieee80211_send_smps_action(sdata, sdata->bss->req_smps,
1187 					   sta->sta.addr,
1188 					   sdata->vif.bss_conf.bssid);
1189 	}
1190 
1191 	local->total_ps_buffered -= buffered;
1192 
1193 	sta_info_recalc_tim(sta);
1194 
1195 	ps_dbg(sdata,
1196 	       "STA %pM aid %d sending %d filtered/%d PS frames since STA not sleeping anymore\n",
1197 	       sta->sta.addr, sta->sta.aid, filtered, buffered);
1198 }
1199 
1200 static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
1201 					 struct sta_info *sta, int tid,
1202 					 enum ieee80211_frame_release_type reason,
1203 					 bool call_driver)
1204 {
1205 	struct ieee80211_local *local = sdata->local;
1206 	struct ieee80211_qos_hdr *nullfunc;
1207 	struct sk_buff *skb;
1208 	int size = sizeof(*nullfunc);
1209 	__le16 fc;
1210 	bool qos = sta->sta.wme;
1211 	struct ieee80211_tx_info *info;
1212 	struct ieee80211_chanctx_conf *chanctx_conf;
1213 
1214 	if (qos) {
1215 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1216 				 IEEE80211_STYPE_QOS_NULLFUNC |
1217 				 IEEE80211_FCTL_FROMDS);
1218 	} else {
1219 		size -= 2;
1220 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1221 				 IEEE80211_STYPE_NULLFUNC |
1222 				 IEEE80211_FCTL_FROMDS);
1223 	}
1224 
1225 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
1226 	if (!skb)
1227 		return;
1228 
1229 	skb_reserve(skb, local->hw.extra_tx_headroom);
1230 
1231 	nullfunc = (void *) skb_put(skb, size);
1232 	nullfunc->frame_control = fc;
1233 	nullfunc->duration_id = 0;
1234 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
1235 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1236 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
1237 	nullfunc->seq_ctrl = 0;
1238 
1239 	skb->priority = tid;
1240 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
1241 	if (qos) {
1242 		nullfunc->qos_ctrl = cpu_to_le16(tid);
1243 
1244 		if (reason == IEEE80211_FRAME_RELEASE_UAPSD)
1245 			nullfunc->qos_ctrl |=
1246 				cpu_to_le16(IEEE80211_QOS_CTL_EOSP);
1247 	}
1248 
1249 	info = IEEE80211_SKB_CB(skb);
1250 
1251 	/*
1252 	 * Tell TX path to send this frame even though the
1253 	 * STA may still remain is PS mode after this frame
1254 	 * exchange. Also set EOSP to indicate this packet
1255 	 * ends the poll/service period.
1256 	 */
1257 	info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
1258 		       IEEE80211_TX_STATUS_EOSP |
1259 		       IEEE80211_TX_CTL_REQ_TX_STATUS;
1260 
1261 	info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
1262 
1263 	if (call_driver)
1264 		drv_allow_buffered_frames(local, sta, BIT(tid), 1,
1265 					  reason, false);
1266 
1267 	skb->dev = sdata->dev;
1268 
1269 	rcu_read_lock();
1270 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1271 	if (WARN_ON(!chanctx_conf)) {
1272 		rcu_read_unlock();
1273 		kfree_skb(skb);
1274 		return;
1275 	}
1276 
1277 	info->band = chanctx_conf->def.chan->band;
1278 	ieee80211_xmit(sdata, skb);
1279 	rcu_read_unlock();
1280 }
1281 
1282 static int find_highest_prio_tid(unsigned long tids)
1283 {
1284 	/* lower 3 TIDs aren't ordered perfectly */
1285 	if (tids & 0xF8)
1286 		return fls(tids) - 1;
1287 	/* TID 0 is BE just like TID 3 */
1288 	if (tids & BIT(0))
1289 		return 0;
1290 	return fls(tids) - 1;
1291 }
1292 
1293 static void
1294 ieee80211_sta_ps_deliver_response(struct sta_info *sta,
1295 				  int n_frames, u8 ignored_acs,
1296 				  enum ieee80211_frame_release_type reason)
1297 {
1298 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1299 	struct ieee80211_local *local = sdata->local;
1300 	bool more_data = false;
1301 	int ac;
1302 	unsigned long driver_release_tids = 0;
1303 	struct sk_buff_head frames;
1304 
1305 	/* Service or PS-Poll period starts */
1306 	set_sta_flag(sta, WLAN_STA_SP);
1307 
1308 	__skb_queue_head_init(&frames);
1309 
1310 	/* Get response frame(s) and more data bit for the last one. */
1311 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1312 		unsigned long tids;
1313 
1314 		if (ignored_acs & BIT(ac))
1315 			continue;
1316 
1317 		tids = ieee80211_tids_for_ac(ac);
1318 
1319 		/* if we already have frames from software, then we can't also
1320 		 * release from hardware queues
1321 		 */
1322 		if (skb_queue_empty(&frames))
1323 			driver_release_tids |= sta->driver_buffered_tids & tids;
1324 
1325 		if (driver_release_tids) {
1326 			/* If the driver has data on more than one TID then
1327 			 * certainly there's more data if we release just a
1328 			 * single frame now (from a single TID). This will
1329 			 * only happen for PS-Poll.
1330 			 */
1331 			if (reason == IEEE80211_FRAME_RELEASE_PSPOLL &&
1332 			    hweight16(driver_release_tids) > 1) {
1333 				more_data = true;
1334 				driver_release_tids =
1335 					BIT(find_highest_prio_tid(
1336 						driver_release_tids));
1337 				break;
1338 			}
1339 		} else {
1340 			struct sk_buff *skb;
1341 
1342 			while (n_frames > 0) {
1343 				skb = skb_dequeue(&sta->tx_filtered[ac]);
1344 				if (!skb) {
1345 					skb = skb_dequeue(
1346 						&sta->ps_tx_buf[ac]);
1347 					if (skb)
1348 						local->total_ps_buffered--;
1349 				}
1350 				if (!skb)
1351 					break;
1352 				n_frames--;
1353 				__skb_queue_tail(&frames, skb);
1354 			}
1355 		}
1356 
1357 		/* If we have more frames buffered on this AC, then set the
1358 		 * more-data bit and abort the loop since we can't send more
1359 		 * data from other ACs before the buffered frames from this.
1360 		 */
1361 		if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
1362 		    !skb_queue_empty(&sta->ps_tx_buf[ac])) {
1363 			more_data = true;
1364 			break;
1365 		}
1366 	}
1367 
1368 	if (skb_queue_empty(&frames) && !driver_release_tids) {
1369 		int tid;
1370 
1371 		/*
1372 		 * For PS-Poll, this can only happen due to a race condition
1373 		 * when we set the TIM bit and the station notices it, but
1374 		 * before it can poll for the frame we expire it.
1375 		 *
1376 		 * For uAPSD, this is said in the standard (11.2.1.5 h):
1377 		 *	At each unscheduled SP for a non-AP STA, the AP shall
1378 		 *	attempt to transmit at least one MSDU or MMPDU, but no
1379 		 *	more than the value specified in the Max SP Length field
1380 		 *	in the QoS Capability element from delivery-enabled ACs,
1381 		 *	that are destined for the non-AP STA.
1382 		 *
1383 		 * Since we have no other MSDU/MMPDU, transmit a QoS null frame.
1384 		 */
1385 
1386 		/* This will evaluate to 1, 3, 5 or 7. */
1387 		tid = 7 - ((ffs(~ignored_acs) - 1) << 1);
1388 
1389 		ieee80211_send_null_response(sdata, sta, tid, reason, true);
1390 	} else if (!driver_release_tids) {
1391 		struct sk_buff_head pending;
1392 		struct sk_buff *skb;
1393 		int num = 0;
1394 		u16 tids = 0;
1395 		bool need_null = false;
1396 
1397 		skb_queue_head_init(&pending);
1398 
1399 		while ((skb = __skb_dequeue(&frames))) {
1400 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1401 			struct ieee80211_hdr *hdr = (void *) skb->data;
1402 			u8 *qoshdr = NULL;
1403 
1404 			num++;
1405 
1406 			/*
1407 			 * Tell TX path to send this frame even though the
1408 			 * STA may still remain is PS mode after this frame
1409 			 * exchange.
1410 			 */
1411 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
1412 			info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
1413 
1414 			/*
1415 			 * Use MoreData flag to indicate whether there are
1416 			 * more buffered frames for this STA
1417 			 */
1418 			if (more_data || !skb_queue_empty(&frames))
1419 				hdr->frame_control |=
1420 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1421 			else
1422 				hdr->frame_control &=
1423 					cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1424 
1425 			if (ieee80211_is_data_qos(hdr->frame_control) ||
1426 			    ieee80211_is_qos_nullfunc(hdr->frame_control))
1427 				qoshdr = ieee80211_get_qos_ctl(hdr);
1428 
1429 			tids |= BIT(skb->priority);
1430 
1431 			__skb_queue_tail(&pending, skb);
1432 
1433 			/* end service period after last frame or add one */
1434 			if (!skb_queue_empty(&frames))
1435 				continue;
1436 
1437 			if (reason != IEEE80211_FRAME_RELEASE_UAPSD) {
1438 				/* for PS-Poll, there's only one frame */
1439 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1440 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1441 				break;
1442 			}
1443 
1444 			/* For uAPSD, things are a bit more complicated. If the
1445 			 * last frame has a QoS header (i.e. is a QoS-data or
1446 			 * QoS-nulldata frame) then just set the EOSP bit there
1447 			 * and be done.
1448 			 * If the frame doesn't have a QoS header (which means
1449 			 * it should be a bufferable MMPDU) then we can't set
1450 			 * the EOSP bit in the QoS header; add a QoS-nulldata
1451 			 * frame to the list to send it after the MMPDU.
1452 			 *
1453 			 * Note that this code is only in the mac80211-release
1454 			 * code path, we assume that the driver will not buffer
1455 			 * anything but QoS-data frames, or if it does, will
1456 			 * create the QoS-nulldata frame by itself if needed.
1457 			 *
1458 			 * Cf. 802.11-2012 10.2.1.10 (c).
1459 			 */
1460 			if (qoshdr) {
1461 				*qoshdr |= IEEE80211_QOS_CTL_EOSP;
1462 
1463 				info->flags |= IEEE80211_TX_STATUS_EOSP |
1464 					       IEEE80211_TX_CTL_REQ_TX_STATUS;
1465 			} else {
1466 				/* The standard isn't completely clear on this
1467 				 * as it says the more-data bit should be set
1468 				 * if there are more BUs. The QoS-Null frame
1469 				 * we're about to send isn't buffered yet, we
1470 				 * only create it below, but let's pretend it
1471 				 * was buffered just in case some clients only
1472 				 * expect more-data=0 when eosp=1.
1473 				 */
1474 				hdr->frame_control |=
1475 					cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1476 				need_null = true;
1477 				num++;
1478 			}
1479 			break;
1480 		}
1481 
1482 		drv_allow_buffered_frames(local, sta, tids, num,
1483 					  reason, more_data);
1484 
1485 		ieee80211_add_pending_skbs(local, &pending);
1486 
1487 		if (need_null)
1488 			ieee80211_send_null_response(
1489 				sdata, sta, find_highest_prio_tid(tids),
1490 				reason, false);
1491 
1492 		sta_info_recalc_tim(sta);
1493 	} else {
1494 		/*
1495 		 * We need to release a frame that is buffered somewhere in the
1496 		 * driver ... it'll have to handle that.
1497 		 * Note that the driver also has to check the number of frames
1498 		 * on the TIDs we're releasing from - if there are more than
1499 		 * n_frames it has to set the more-data bit (if we didn't ask
1500 		 * it to set it anyway due to other buffered frames); if there
1501 		 * are fewer than n_frames it has to make sure to adjust that
1502 		 * to allow the service period to end properly.
1503 		 */
1504 		drv_release_buffered_frames(local, sta, driver_release_tids,
1505 					    n_frames, reason, more_data);
1506 
1507 		/*
1508 		 * Note that we don't recalculate the TIM bit here as it would
1509 		 * most likely have no effect at all unless the driver told us
1510 		 * that the TID(s) became empty before returning here from the
1511 		 * release function.
1512 		 * Either way, however, when the driver tells us that the TID(s)
1513 		 * became empty we'll do the TIM recalculation.
1514 		 */
1515 	}
1516 }
1517 
1518 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
1519 {
1520 	u8 ignore_for_response = sta->sta.uapsd_queues;
1521 
1522 	/*
1523 	 * If all ACs are delivery-enabled then we should reply
1524 	 * from any of them, if only some are enabled we reply
1525 	 * only from the non-enabled ones.
1526 	 */
1527 	if (ignore_for_response == BIT(IEEE80211_NUM_ACS) - 1)
1528 		ignore_for_response = 0;
1529 
1530 	ieee80211_sta_ps_deliver_response(sta, 1, ignore_for_response,
1531 					  IEEE80211_FRAME_RELEASE_PSPOLL);
1532 }
1533 
1534 void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
1535 {
1536 	int n_frames = sta->sta.max_sp;
1537 	u8 delivery_enabled = sta->sta.uapsd_queues;
1538 
1539 	/*
1540 	 * If we ever grow support for TSPEC this might happen if
1541 	 * the TSPEC update from hostapd comes in between a trigger
1542 	 * frame setting WLAN_STA_UAPSD in the RX path and this
1543 	 * actually getting called.
1544 	 */
1545 	if (!delivery_enabled)
1546 		return;
1547 
1548 	switch (sta->sta.max_sp) {
1549 	case 1:
1550 		n_frames = 2;
1551 		break;
1552 	case 2:
1553 		n_frames = 4;
1554 		break;
1555 	case 3:
1556 		n_frames = 6;
1557 		break;
1558 	case 0:
1559 		/* XXX: what is a good value? */
1560 		n_frames = 128;
1561 		break;
1562 	}
1563 
1564 	ieee80211_sta_ps_deliver_response(sta, n_frames, ~delivery_enabled,
1565 					  IEEE80211_FRAME_RELEASE_UAPSD);
1566 }
1567 
1568 void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
1569 			       struct ieee80211_sta *pubsta, bool block)
1570 {
1571 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1572 
1573 	trace_api_sta_block_awake(sta->local, pubsta, block);
1574 
1575 	if (block) {
1576 		set_sta_flag(sta, WLAN_STA_PS_DRIVER);
1577 		return;
1578 	}
1579 
1580 	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1581 		return;
1582 
1583 	if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
1584 		set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1585 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1586 		ieee80211_queue_work(hw, &sta->drv_deliver_wk);
1587 	} else if (test_sta_flag(sta, WLAN_STA_PSPOLL) ||
1588 		   test_sta_flag(sta, WLAN_STA_UAPSD)) {
1589 		/* must be asleep in this case */
1590 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1591 		ieee80211_queue_work(hw, &sta->drv_deliver_wk);
1592 	} else {
1593 		clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1594 	}
1595 }
1596 EXPORT_SYMBOL(ieee80211_sta_block_awake);
1597 
1598 void ieee80211_sta_eosp(struct ieee80211_sta *pubsta)
1599 {
1600 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1601 	struct ieee80211_local *local = sta->local;
1602 
1603 	trace_api_eosp(local, pubsta);
1604 
1605 	clear_sta_flag(sta, WLAN_STA_SP);
1606 }
1607 EXPORT_SYMBOL(ieee80211_sta_eosp);
1608 
1609 void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
1610 				u8 tid, bool buffered)
1611 {
1612 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1613 
1614 	if (WARN_ON(tid >= IEEE80211_NUM_TIDS))
1615 		return;
1616 
1617 	trace_api_sta_set_buffered(sta->local, pubsta, tid, buffered);
1618 
1619 	if (buffered)
1620 		set_bit(tid, &sta->driver_buffered_tids);
1621 	else
1622 		clear_bit(tid, &sta->driver_buffered_tids);
1623 
1624 	sta_info_recalc_tim(sta);
1625 }
1626 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
1627 
1628 int sta_info_move_state(struct sta_info *sta,
1629 			enum ieee80211_sta_state new_state)
1630 {
1631 	might_sleep();
1632 
1633 	if (sta->sta_state == new_state)
1634 		return 0;
1635 
1636 	/* check allowed transitions first */
1637 
1638 	switch (new_state) {
1639 	case IEEE80211_STA_NONE:
1640 		if (sta->sta_state != IEEE80211_STA_AUTH)
1641 			return -EINVAL;
1642 		break;
1643 	case IEEE80211_STA_AUTH:
1644 		if (sta->sta_state != IEEE80211_STA_NONE &&
1645 		    sta->sta_state != IEEE80211_STA_ASSOC)
1646 			return -EINVAL;
1647 		break;
1648 	case IEEE80211_STA_ASSOC:
1649 		if (sta->sta_state != IEEE80211_STA_AUTH &&
1650 		    sta->sta_state != IEEE80211_STA_AUTHORIZED)
1651 			return -EINVAL;
1652 		break;
1653 	case IEEE80211_STA_AUTHORIZED:
1654 		if (sta->sta_state != IEEE80211_STA_ASSOC)
1655 			return -EINVAL;
1656 		break;
1657 	default:
1658 		WARN(1, "invalid state %d", new_state);
1659 		return -EINVAL;
1660 	}
1661 
1662 	sta_dbg(sta->sdata, "moving STA %pM to state %d\n",
1663 		sta->sta.addr, new_state);
1664 
1665 	/*
1666 	 * notify the driver before the actual changes so it can
1667 	 * fail the transition
1668 	 */
1669 	if (test_sta_flag(sta, WLAN_STA_INSERTED)) {
1670 		int err = drv_sta_state(sta->local, sta->sdata, sta,
1671 					sta->sta_state, new_state);
1672 		if (err)
1673 			return err;
1674 	}
1675 
1676 	/* reflect the change in all state variables */
1677 
1678 	switch (new_state) {
1679 	case IEEE80211_STA_NONE:
1680 		if (sta->sta_state == IEEE80211_STA_AUTH)
1681 			clear_bit(WLAN_STA_AUTH, &sta->_flags);
1682 		break;
1683 	case IEEE80211_STA_AUTH:
1684 		if (sta->sta_state == IEEE80211_STA_NONE)
1685 			set_bit(WLAN_STA_AUTH, &sta->_flags);
1686 		else if (sta->sta_state == IEEE80211_STA_ASSOC)
1687 			clear_bit(WLAN_STA_ASSOC, &sta->_flags);
1688 		break;
1689 	case IEEE80211_STA_ASSOC:
1690 		if (sta->sta_state == IEEE80211_STA_AUTH) {
1691 			set_bit(WLAN_STA_ASSOC, &sta->_flags);
1692 		} else if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
1693 			if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1694 			    (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1695 			     !sta->sdata->u.vlan.sta))
1696 				atomic_dec(&sta->sdata->bss->num_mcast_sta);
1697 			clear_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1698 		}
1699 		break;
1700 	case IEEE80211_STA_AUTHORIZED:
1701 		if (sta->sta_state == IEEE80211_STA_ASSOC) {
1702 			if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1703 			    (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1704 			     !sta->sdata->u.vlan.sta))
1705 				atomic_inc(&sta->sdata->bss->num_mcast_sta);
1706 			set_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1707 		}
1708 		break;
1709 	default:
1710 		break;
1711 	}
1712 
1713 	sta->sta_state = new_state;
1714 
1715 	return 0;
1716 }
1717 
1718 u8 sta_info_tx_streams(struct sta_info *sta)
1719 {
1720 	struct ieee80211_sta_ht_cap *ht_cap = &sta->sta.ht_cap;
1721 	u8 rx_streams;
1722 
1723 	if (!sta->sta.ht_cap.ht_supported)
1724 		return 1;
1725 
1726 	if (sta->sta.vht_cap.vht_supported) {
1727 		int i;
1728 		u16 tx_mcs_map =
1729 			le16_to_cpu(sta->sta.vht_cap.vht_mcs.tx_mcs_map);
1730 
1731 		for (i = 7; i >= 0; i--)
1732 			if ((tx_mcs_map & (0x3 << (i * 2))) !=
1733 			    IEEE80211_VHT_MCS_NOT_SUPPORTED)
1734 				return i + 1;
1735 	}
1736 
1737 	if (ht_cap->mcs.rx_mask[3])
1738 		rx_streams = 4;
1739 	else if (ht_cap->mcs.rx_mask[2])
1740 		rx_streams = 3;
1741 	else if (ht_cap->mcs.rx_mask[1])
1742 		rx_streams = 2;
1743 	else
1744 		rx_streams = 1;
1745 
1746 	if (!(ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_RX_DIFF))
1747 		return rx_streams;
1748 
1749 	return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
1750 			>> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
1751 }
1752 
1753 void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
1754 {
1755 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1756 	struct ieee80211_local *local = sdata->local;
1757 	struct rate_control_ref *ref = NULL;
1758 	struct timespec uptime;
1759 	u32 thr = 0;
1760 	int i, ac;
1761 
1762 	if (test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
1763 		ref = local->rate_ctrl;
1764 
1765 	sinfo->generation = sdata->local->sta_generation;
1766 
1767 	/* do before driver, so beacon filtering drivers have a
1768 	 * chance to e.g. just add the number of filtered beacons
1769 	 * (or just modify the value entirely, of course)
1770 	 */
1771 	if (sdata->vif.type == NL80211_IFTYPE_STATION)
1772 		sinfo->rx_beacon = sdata->u.mgd.count_beacon_signal;
1773 
1774 	drv_sta_statistics(local, sdata, &sta->sta, sinfo);
1775 
1776 	sinfo->filled |= BIT(NL80211_STA_INFO_INACTIVE_TIME) |
1777 			 BIT(NL80211_STA_INFO_STA_FLAGS) |
1778 			 BIT(NL80211_STA_INFO_BSS_PARAM) |
1779 			 BIT(NL80211_STA_INFO_CONNECTED_TIME) |
1780 			 BIT(NL80211_STA_INFO_RX_DROP_MISC) |
1781 			 BIT(NL80211_STA_INFO_BEACON_LOSS);
1782 
1783 	ktime_get_ts(&uptime);
1784 	sinfo->connected_time = uptime.tv_sec - sta->last_connected;
1785 	sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
1786 
1787 	if (!(sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES64) |
1788 			       BIT(NL80211_STA_INFO_TX_BYTES)))) {
1789 		sinfo->tx_bytes = 0;
1790 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
1791 			sinfo->tx_bytes += sta->tx_bytes[ac];
1792 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES64);
1793 	}
1794 
1795 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_PACKETS))) {
1796 		sinfo->tx_packets = 0;
1797 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
1798 			sinfo->tx_packets += sta->tx_packets[ac];
1799 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
1800 	}
1801 
1802 	if (!(sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES64) |
1803 			       BIT(NL80211_STA_INFO_RX_BYTES)))) {
1804 		sinfo->rx_bytes = sta->rx_bytes;
1805 		sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES64);
1806 	}
1807 
1808 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_RX_PACKETS))) {
1809 		sinfo->rx_packets = sta->rx_packets;
1810 		sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
1811 	}
1812 
1813 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_RETRIES))) {
1814 		sinfo->tx_retries = sta->tx_retry_count;
1815 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_RETRIES);
1816 	}
1817 
1818 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_FAILED))) {
1819 		sinfo->tx_failed = sta->tx_retry_failed;
1820 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
1821 	}
1822 
1823 	sinfo->rx_dropped_misc = sta->rx_dropped;
1824 	sinfo->beacon_loss_count = sta->beacon_loss_count;
1825 
1826 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1827 	    !(sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)) {
1828 		sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_RX) |
1829 				 BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
1830 		sinfo->rx_beacon_signal_avg = ieee80211_ave_rssi(&sdata->vif);
1831 	}
1832 
1833 	if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
1834 	    (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
1835 		if (!(sinfo->filled & BIT(NL80211_STA_INFO_SIGNAL))) {
1836 			sinfo->signal = (s8)sta->last_signal;
1837 			sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
1838 		}
1839 
1840 		if (!(sinfo->filled & BIT(NL80211_STA_INFO_SIGNAL_AVG))) {
1841 			sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
1842 			sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL_AVG);
1843 		}
1844 	}
1845 
1846 	if (sta->chains &&
1847 	    !(sinfo->filled & (BIT(NL80211_STA_INFO_CHAIN_SIGNAL) |
1848 			       BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)))) {
1849 		sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL) |
1850 				 BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
1851 
1852 		sinfo->chains = sta->chains;
1853 		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
1854 			sinfo->chain_signal[i] = sta->chain_signal_last[i];
1855 			sinfo->chain_signal_avg[i] =
1856 				(s8) -ewma_read(&sta->chain_signal_avg[i]);
1857 		}
1858 	}
1859 
1860 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE))) {
1861 		sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
1862 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
1863 	}
1864 
1865 	if (!(sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE))) {
1866 		sta_set_rate_info_rx(sta, &sinfo->rxrate);
1867 		sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
1868 	}
1869 
1870 	sinfo->filled |= BIT(NL80211_STA_INFO_TID_STATS);
1871 	for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++) {
1872 		struct cfg80211_tid_stats *tidstats = &sinfo->pertid[i];
1873 
1874 		if (!(tidstats->filled & BIT(NL80211_TID_STATS_RX_MSDU))) {
1875 			tidstats->filled |= BIT(NL80211_TID_STATS_RX_MSDU);
1876 			tidstats->rx_msdu = sta->rx_msdu[i];
1877 		}
1878 
1879 		if (!(tidstats->filled & BIT(NL80211_TID_STATS_TX_MSDU))) {
1880 			tidstats->filled |= BIT(NL80211_TID_STATS_TX_MSDU);
1881 			tidstats->tx_msdu = sta->tx_msdu[i];
1882 		}
1883 
1884 		if (!(tidstats->filled &
1885 				BIT(NL80211_TID_STATS_TX_MSDU_RETRIES)) &&
1886 		    local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
1887 			tidstats->filled |=
1888 				BIT(NL80211_TID_STATS_TX_MSDU_RETRIES);
1889 			tidstats->tx_msdu_retries = sta->tx_msdu_retries[i];
1890 		}
1891 
1892 		if (!(tidstats->filled &
1893 				BIT(NL80211_TID_STATS_TX_MSDU_FAILED)) &&
1894 		    local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
1895 			tidstats->filled |=
1896 				BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
1897 			tidstats->tx_msdu_failed = sta->tx_msdu_failed[i];
1898 		}
1899 	}
1900 
1901 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
1902 #ifdef CONFIG_MAC80211_MESH
1903 		sinfo->filled |= BIT(NL80211_STA_INFO_LLID) |
1904 				 BIT(NL80211_STA_INFO_PLID) |
1905 				 BIT(NL80211_STA_INFO_PLINK_STATE) |
1906 				 BIT(NL80211_STA_INFO_LOCAL_PM) |
1907 				 BIT(NL80211_STA_INFO_PEER_PM) |
1908 				 BIT(NL80211_STA_INFO_NONPEER_PM);
1909 
1910 		sinfo->llid = sta->llid;
1911 		sinfo->plid = sta->plid;
1912 		sinfo->plink_state = sta->plink_state;
1913 		if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
1914 			sinfo->filled |= BIT(NL80211_STA_INFO_T_OFFSET);
1915 			sinfo->t_offset = sta->t_offset;
1916 		}
1917 		sinfo->local_pm = sta->local_pm;
1918 		sinfo->peer_pm = sta->peer_pm;
1919 		sinfo->nonpeer_pm = sta->nonpeer_pm;
1920 #endif
1921 	}
1922 
1923 	sinfo->bss_param.flags = 0;
1924 	if (sdata->vif.bss_conf.use_cts_prot)
1925 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
1926 	if (sdata->vif.bss_conf.use_short_preamble)
1927 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
1928 	if (sdata->vif.bss_conf.use_short_slot)
1929 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
1930 	sinfo->bss_param.dtim_period = sdata->vif.bss_conf.dtim_period;
1931 	sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
1932 
1933 	sinfo->sta_flags.set = 0;
1934 	sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
1935 				BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
1936 				BIT(NL80211_STA_FLAG_WME) |
1937 				BIT(NL80211_STA_FLAG_MFP) |
1938 				BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1939 				BIT(NL80211_STA_FLAG_ASSOCIATED) |
1940 				BIT(NL80211_STA_FLAG_TDLS_PEER);
1941 	if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1942 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
1943 	if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
1944 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
1945 	if (sta->sta.wme)
1946 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
1947 	if (test_sta_flag(sta, WLAN_STA_MFP))
1948 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
1949 	if (test_sta_flag(sta, WLAN_STA_AUTH))
1950 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
1951 	if (test_sta_flag(sta, WLAN_STA_ASSOC))
1952 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1953 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
1954 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
1955 
1956 	/* check if the driver has a SW RC implementation */
1957 	if (ref && ref->ops->get_expected_throughput)
1958 		thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
1959 	else
1960 		thr = drv_get_expected_throughput(local, &sta->sta);
1961 
1962 	if (thr != 0) {
1963 		sinfo->filled |= BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
1964 		sinfo->expected_throughput = thr;
1965 	}
1966 }
1967