projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
mac80211: fix a memory leak on sta rate selection table
[deliverable/linux.git] / net / mac80211 / sta_info.c
1 /*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9
10 #include <linux/module.h>
11 #include <linux/init.h>
12 #include <linux/etherdevice.h>
13 #include <linux/netdevice.h>
14 #include <linux/types.h>
15 #include <linux/slab.h>
16 #include <linux/skbuff.h>
17 #include <linux/if_arp.h>
18 #include <linux/timer.h>
19 #include <linux/rtnetlink.h>
20
21 #include <net/mac80211.h>
22 #include "ieee80211_i.h"
23 #include "driver-ops.h"
24 #include "rate.h"
25 #include "sta_info.h"
26 #include "debugfs_sta.h"
27 #include "mesh.h"
28 #include "wme.h"
29
30 /**
31 * DOC: STA information lifetime rules
32 *
33 * STA info structures (&struct sta_info) are managed in a hash table
34 * for faster lookup and a list for iteration. They are managed using
35 * RCU, i.e. access to the list and hash table is protected by RCU.
36 *
37 * Upon allocating a STA info structure with sta_info_alloc(), the caller
38 * owns that structure. It must then insert it into the hash table using
39 * either sta_info_insert() or sta_info_insert_rcu(); only in the latter
40 * case (which acquires an rcu read section but must not be called from
41 * within one) will the pointer still be valid after the call. Note that
42 * the caller may not do much with the STA info before inserting it, in
43 * particular, it may not start any mesh peer link management or add
44 * encryption keys.
45 *
46 * When the insertion fails (sta_info_insert()) returns non-zero), the
47 * structure will have been freed by sta_info_insert()!
48 *
49 * Station entries are added by mac80211 when you establish a link with a
50 * peer. This means different things for the different type of interfaces
51 * we support. For a regular station this mean we add the AP sta when we
52 * receive an association response from the AP. For IBSS this occurs when
53 * get to know about a peer on the same IBSS. For WDS we add the sta for
54 * the peer immediately upon device open. When using AP mode we add stations
55 * for each respective station upon request from userspace through nl80211.
56 *
57 * In order to remove a STA info structure, various sta_info_destroy_*()
58 * calls are available.
59 *
60 * There is no concept of ownership on a STA entry, each structure is
61 * owned by the global hash table/list until it is removed. All users of
62 * the structure need to be RCU protected so that the structure won't be
63 * freed before they are done using it.
64 */
65
66 /* Caller must hold local->sta_mtx */
67 static int sta_info_hash_del(struct ieee80211_local *local,
68 struct sta_info *sta)
69 {
70 struct sta_info *s;
71
72 s = rcu_dereference_protected(local->sta_hash[STA_HASH(sta->sta.addr)],
73 lockdep_is_held(&local->sta_mtx));
74 if (!s)
75 return -ENOENT;
76 if (s == sta) {
77 rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
78 s->hnext);
79 return 0;
80 }
81
82 while (rcu_access_pointer(s->hnext) &&
83 rcu_access_pointer(s->hnext) != sta)
84 s = rcu_dereference_protected(s->hnext,
85 lockdep_is_held(&local->sta_mtx));
86 if (rcu_access_pointer(s->hnext)) {
87 rcu_assign_pointer(s->hnext, sta->hnext);
88 return 0;
89 }
90
91 return -ENOENT;
92 }
93
94 static void __cleanup_single_sta(struct sta_info *sta)
95 {
96 int ac, i;
97 struct tid_ampdu_tx *tid_tx;
98 struct ieee80211_sub_if_data *sdata = sta->sdata;
99 struct ieee80211_local *local = sdata->local;
100 struct ps_data *ps;
101
102 if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
103 test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
104 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
105 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
106 ps = &sdata->bss->ps;
107 else if (ieee80211_vif_is_mesh(&sdata->vif))
108 ps = &sdata->u.mesh.ps;
109 else
110 return;
111
112 clear_sta_flag(sta, WLAN_STA_PS_STA);
113 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
114
115 atomic_dec(&ps->num_sta_ps);
116 sta_info_recalc_tim(sta);
117 }
118
119 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
120 local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
121 ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
122 ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
123 }
124
125 if (ieee80211_vif_is_mesh(&sdata->vif))
126 mesh_sta_cleanup(sta);
127
128 cancel_work_sync(&sta->drv_unblock_wk);
129
130 /*
131 * Destroy aggregation state here. It would be nice to wait for the
132 * driver to finish aggregation stop and then clean up, but for now
133 * drivers have to handle aggregation stop being requested, followed
134 * directly by station destruction.
135 */
136 for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
137 kfree(sta->ampdu_mlme.tid_start_tx[i]);
138 tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
139 if (!tid_tx)
140 continue;
141 ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
142 kfree(tid_tx);
143 }
144 }
145
146 static void cleanup_single_sta(struct sta_info *sta)
147 {
148 struct ieee80211_sub_if_data *sdata = sta->sdata;
149 struct ieee80211_local *local = sdata->local;
150
151 __cleanup_single_sta(sta);
152 sta_info_free(local, sta);
153 }
154
155 /* protected by RCU */
156 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
157 const u8 *addr)
158 {
159 struct ieee80211_local *local = sdata->local;
160 struct sta_info *sta;
161
162 sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
163 lockdep_is_held(&local->sta_mtx));
164 while (sta) {
165 if (sta->sdata == sdata &&
166 ether_addr_equal(sta->sta.addr, addr))
167 break;
168 sta = rcu_dereference_check(sta->hnext,
169 lockdep_is_held(&local->sta_mtx));
170 }
171 return sta;
172 }
173
174 /*
175 * Get sta info either from the specified interface
176 * or from one of its vlans
177 */
178 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
179 const u8 *addr)
180 {
181 struct ieee80211_local *local = sdata->local;
182 struct sta_info *sta;
183
184 sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
185 lockdep_is_held(&local->sta_mtx));
186 while (sta) {
187 if ((sta->sdata == sdata ||
188 (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
189 ether_addr_equal(sta->sta.addr, addr))
190 break;
191 sta = rcu_dereference_check(sta->hnext,
192 lockdep_is_held(&local->sta_mtx));
193 }
194 return sta;
195 }
196
197 struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
198 int idx)
199 {
200 struct ieee80211_local *local = sdata->local;
201 struct sta_info *sta;
202 int i = 0;
203
204 list_for_each_entry_rcu(sta, &local->sta_list, list) {
205 if (sdata != sta->sdata)
206 continue;
207 if (i < idx) {
208 ++i;
209 continue;
210 }
211 return sta;
212 }
213
214 return NULL;
215 }
216
217 /**
218 * sta_info_free - free STA
219 *
220 * @local: pointer to the global information
221 * @sta: STA info to free
222 *
223 * This function must undo everything done by sta_info_alloc()
224 * that may happen before sta_info_insert(). It may only be
225 * called when sta_info_insert() has not been attempted (and
226 * if that fails, the station is freed anyway.)
227 */
228 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
229 {
230 int i;
231
232 if (sta->rate_ctrl)
233 rate_control_free_sta(sta);
234
235 if (sta->tx_lat) {
236 for (i = 0; i < IEEE80211_NUM_TIDS; i++)
237 kfree(sta->tx_lat[i].bins);
238 kfree(sta->tx_lat);
239 }
240
241 sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
242
243 kfree(rcu_dereference_raw(sta->sta.rates));
244 kfree(sta);
245 }
246
247 /* Caller must hold local->sta_mtx */
248 static void sta_info_hash_add(struct ieee80211_local *local,
249 struct sta_info *sta)
250 {
251 lockdep_assert_held(&local->sta_mtx);
252 sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
253 rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
254 }
255
256 static void sta_unblock(struct work_struct *wk)
257 {
258 struct sta_info *sta;
259
260 sta = container_of(wk, struct sta_info, drv_unblock_wk);
261
262 if (sta->dead)
263 return;
264
265 if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
266 local_bh_disable();
267 ieee80211_sta_ps_deliver_wakeup(sta);
268 local_bh_enable();
269 } else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
270 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
271
272 local_bh_disable();
273 ieee80211_sta_ps_deliver_poll_response(sta);
274 local_bh_enable();
275 } else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD)) {
276 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
277
278 local_bh_disable();
279 ieee80211_sta_ps_deliver_uapsd(sta);
280 local_bh_enable();
281 } else
282 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
283 }
284
285 static int sta_prepare_rate_control(struct ieee80211_local *local,
286 struct sta_info *sta, gfp_t gfp)
287 {
288 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
289 return 0;
290
291 sta->rate_ctrl = local->rate_ctrl;
292 sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
293 &sta->sta, gfp);
294 if (!sta->rate_ctrl_priv)
295 return -ENOMEM;
296
297 return 0;
298 }
299
300 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
301 const u8 *addr, gfp_t gfp)
302 {
303 struct ieee80211_local *local = sdata->local;
304 struct sta_info *sta;
305 struct timespec uptime;
306 struct ieee80211_tx_latency_bin_ranges *tx_latency;
307 int i;
308
309 sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
310 if (!sta)
311 return NULL;
312
313 rcu_read_lock();
314 tx_latency = rcu_dereference(local->tx_latency);
315 /* init stations Tx latency statistics && TID bins */
316 if (tx_latency) {
317 sta->tx_lat = kzalloc(IEEE80211_NUM_TIDS *
318 sizeof(struct ieee80211_tx_latency_stat),
319 GFP_ATOMIC);
320 if (!sta->tx_lat) {
321 rcu_read_unlock();
322 goto free;
323 }
324
325 if (tx_latency->n_ranges) {
326 for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
327 /* size of bins is size of the ranges +1 */
328 sta->tx_lat[i].bin_count =
329 tx_latency->n_ranges + 1;
330 sta->tx_lat[i].bins =
331 kcalloc(sta->tx_lat[i].bin_count,
332 sizeof(u32), GFP_ATOMIC);
333 if (!sta->tx_lat[i].bins) {
334 rcu_read_unlock();
335 goto free;
336 }
337 }
338 }
339 }
340 rcu_read_unlock();
341
342 spin_lock_init(&sta->lock);
343 spin_lock_init(&sta->ps_lock);
344 INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
345 INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
346 mutex_init(&sta->ampdu_mlme.mtx);
347 #ifdef CONFIG_MAC80211_MESH
348 if (ieee80211_vif_is_mesh(&sdata->vif) &&
349 !sdata->u.mesh.user_mpm)
350 init_timer(&sta->plink_timer);
351 sta->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
352 #endif
353
354 memcpy(sta->sta.addr, addr, ETH_ALEN);
355 sta->local = local;
356 sta->sdata = sdata;
357 sta->last_rx = jiffies;
358
359 sta->sta_state = IEEE80211_STA_NONE;
360
361 do_posix_clock_monotonic_gettime(&uptime);
362 sta->last_connected = uptime.tv_sec;
363 ewma_init(&sta->avg_signal, 1024, 8);
364 for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
365 ewma_init(&sta->chain_signal_avg[i], 1024, 8);
366
367 if (sta_prepare_rate_control(local, sta, gfp))
368 goto free;
369
370 for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
371 /*
372 * timer_to_tid must be initialized with identity mapping
373 * to enable session_timer's data differentiation. See
374 * sta_rx_agg_session_timer_expired for usage.
375 */
376 sta->timer_to_tid[i] = i;
377 }
378 for (i = 0; i < IEEE80211_NUM_ACS; i++) {
379 skb_queue_head_init(&sta->ps_tx_buf[i]);
380 skb_queue_head_init(&sta->tx_filtered[i]);
381 }
382
383 for (i = 0; i < IEEE80211_NUM_TIDS; i++)
384 sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
385
386 sta->sta.smps_mode = IEEE80211_SMPS_OFF;
387 if (sdata->vif.type == NL80211_IFTYPE_AP ||
388 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
389 struct ieee80211_supported_band *sband =
390 local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
391 u8 smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
392 IEEE80211_HT_CAP_SM_PS_SHIFT;
393 /*
394 * Assume that hostapd advertises our caps in the beacon and
395 * this is the known_smps_mode for a station that just assciated
396 */
397 switch (smps) {
398 case WLAN_HT_SMPS_CONTROL_DISABLED:
399 sta->known_smps_mode = IEEE80211_SMPS_OFF;
400 break;
401 case WLAN_HT_SMPS_CONTROL_STATIC:
402 sta->known_smps_mode = IEEE80211_SMPS_STATIC;
403 break;
404 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
405 sta->known_smps_mode = IEEE80211_SMPS_DYNAMIC;
406 break;
407 default:
408 WARN_ON(1);
409 }
410 }
411
412 sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
413 return sta;
414
415 free:
416 if (sta->tx_lat) {
417 for (i = 0; i < IEEE80211_NUM_TIDS; i++)
418 kfree(sta->tx_lat[i].bins);
419 kfree(sta->tx_lat);
420 }
421 kfree(sta);
422 return NULL;
423 }
424
425 static int sta_info_insert_check(struct sta_info *sta)
426 {
427 struct ieee80211_sub_if_data *sdata = sta->sdata;
428
429 /*
430 * Can't be a WARN_ON because it can be triggered through a race:
431 * something inserts a STA (on one CPU) without holding the RTNL
432 * and another CPU turns off the net device.
433 */
434 if (unlikely(!ieee80211_sdata_running(sdata)))
435 return -ENETDOWN;
436
437 if (WARN_ON(ether_addr_equal(sta->sta.addr, sdata->vif.addr) ||
438 is_multicast_ether_addr(sta->sta.addr)))
439 return -EINVAL;
440
441 return 0;
442 }
443
444 static int sta_info_insert_drv_state(struct ieee80211_local *local,
445 struct ieee80211_sub_if_data *sdata,
446 struct sta_info *sta)
447 {
448 enum ieee80211_sta_state state;
449 int err = 0;
450
451 for (state = IEEE80211_STA_NOTEXIST; state < sta->sta_state; state++) {
452 err = drv_sta_state(local, sdata, sta, state, state + 1);
453 if (err)
454 break;
455 }
456
457 if (!err) {
458 /*
459 * Drivers using legacy sta_add/sta_remove callbacks only
460 * get uploaded set to true after sta_add is called.
461 */
462 if (!local->ops->sta_add)
463 sta->uploaded = true;
464 return 0;
465 }
466
467 if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
468 sdata_info(sdata,
469 "failed to move IBSS STA %pM to state %d (%d) - keeping it anyway\n",
470 sta->sta.addr, state + 1, err);
471 err = 0;
472 }
473
474 /* unwind on error */
475 for (; state > IEEE80211_STA_NOTEXIST; state--)
476 WARN_ON(drv_sta_state(local, sdata, sta, state, state - 1));
477
478 return err;
479 }
480
481 /*
482 * should be called with sta_mtx locked
483 * this function replaces the mutex lock
484 * with a RCU lock
485 */
486 static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
487 {
488 struct ieee80211_local *local = sta->local;
489 struct ieee80211_sub_if_data *sdata = sta->sdata;
490 struct station_info sinfo;
491 int err = 0;
492
493 lockdep_assert_held(&local->sta_mtx);
494
495 /* check if STA exists already */
496 if (sta_info_get_bss(sdata, sta->sta.addr)) {
497 err = -EEXIST;
498 goto out_err;
499 }
500
501 local->num_sta++;
502 local->sta_generation++;
503 smp_mb();
504
505 /* simplify things and don't accept BA sessions yet */
506 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
507
508 /* make the station visible */
509 sta_info_hash_add(local, sta);
510
511 list_add_rcu(&sta->list, &local->sta_list);
512
513 /* notify driver */
514 err = sta_info_insert_drv_state(local, sdata, sta);
515 if (err)
516 goto out_remove;
517
518 set_sta_flag(sta, WLAN_STA_INSERTED);
519 /* accept BA sessions now */
520 clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
521
522 ieee80211_recalc_min_chandef(sdata);
523 ieee80211_sta_debugfs_add(sta);
524 rate_control_add_sta_debugfs(sta);
525
526 memset(&sinfo, 0, sizeof(sinfo));
527 sinfo.filled = 0;
528 sinfo.generation = local->sta_generation;
529 cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
530
531 sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr);
532
533 /* move reference to rcu-protected */
534 rcu_read_lock();
535 mutex_unlock(&local->sta_mtx);
536
537 if (ieee80211_vif_is_mesh(&sdata->vif))
538 mesh_accept_plinks_update(sdata);
539
540 return 0;
541 out_remove:
542 sta_info_hash_del(local, sta);
543 list_del_rcu(&sta->list);
544 local->num_sta--;
545 synchronize_net();
546 __cleanup_single_sta(sta);
547 out_err:
548 mutex_unlock(&local->sta_mtx);
549 rcu_read_lock();
550 return err;
551 }
552
553 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
554 {
555 struct ieee80211_local *local = sta->local;
556 int err;
557
558 might_sleep();
559
560 err = sta_info_insert_check(sta);
561 if (err) {
562 rcu_read_lock();
563 goto out_free;
564 }
565
566 mutex_lock(&local->sta_mtx);
567
568 err = sta_info_insert_finish(sta);
569 if (err)
570 goto out_free;
571
572 return 0;
573 out_free:
574 sta_info_free(local, sta);
575 return err;
576 }
577
578 int sta_info_insert(struct sta_info *sta)
579 {
580 int err = sta_info_insert_rcu(sta);
581
582 rcu_read_unlock();
583
584 return err;
585 }
586
587 static inline void __bss_tim_set(u8 *tim, u16 id)
588 {
589 /*
590 * This format has been mandated by the IEEE specifications,
591 * so this line may not be changed to use the __set_bit() format.
592 */
593 tim[id / 8] |= (1 << (id % 8));
594 }
595
596 static inline void __bss_tim_clear(u8 *tim, u16 id)
597 {
598 /*
599 * This format has been mandated by the IEEE specifications,
600 * so this line may not be changed to use the __clear_bit() format.
601 */
602 tim[id / 8] &= ~(1 << (id % 8));
603 }
604
605 static inline bool __bss_tim_get(u8 *tim, u16 id)
606 {
607 /*
608 * This format has been mandated by the IEEE specifications,
609 * so this line may not be changed to use the test_bit() format.
610 */
611 return tim[id / 8] & (1 << (id % 8));
612 }
613
614 static unsigned long ieee80211_tids_for_ac(int ac)
615 {
616 /* If we ever support TIDs > 7, this obviously needs to be adjusted */
617 switch (ac) {
618 case IEEE80211_AC_VO:
619 return BIT(6) | BIT(7);
620 case IEEE80211_AC_VI:
621 return BIT(4) | BIT(5);
622 case IEEE80211_AC_BE:
623 return BIT(0) | BIT(3);
624 case IEEE80211_AC_BK:
625 return BIT(1) | BIT(2);
626 default:
627 WARN_ON(1);
628 return 0;
629 }
630 }
631
632 void sta_info_recalc_tim(struct sta_info *sta)
633 {
634 struct ieee80211_local *local = sta->local;
635 struct ps_data *ps;
636 bool indicate_tim = false;
637 u8 ignore_for_tim = sta->sta.uapsd_queues;
638 int ac;
639 u16 id;
640
641 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
642 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
643 if (WARN_ON_ONCE(!sta->sdata->bss))
644 return;
645
646 ps = &sta->sdata->bss->ps;
647 id = sta->sta.aid;
648 #ifdef CONFIG_MAC80211_MESH
649 } else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
650 ps = &sta->sdata->u.mesh.ps;
651 /* TIM map only for 1 <= PLID <= IEEE80211_MAX_AID */
652 id = sta->plid % (IEEE80211_MAX_AID + 1);
653 #endif
654 } else {
655 return;
656 }
657
658 /* No need to do anything if the driver does all */
659 if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
660 return;
661
662 if (sta->dead)
663 goto done;
664
665 /*
666 * If all ACs are delivery-enabled then we should build
667 * the TIM bit for all ACs anyway; if only some are then
668 * we ignore those and build the TIM bit using only the
669 * non-enabled ones.
670 */
671 if (ignore_for_tim == BIT(IEEE80211_NUM_ACS) - 1)
672 ignore_for_tim = 0;
673
674 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
675 unsigned long tids;
676
677 if (ignore_for_tim & BIT(ac))
678 continue;
679
680 indicate_tim |= !skb_queue_empty(&sta->tx_filtered[ac]) ||
681 !skb_queue_empty(&sta->ps_tx_buf[ac]);
682 if (indicate_tim)
683 break;
684
685 tids = ieee80211_tids_for_ac(ac);
686
687 indicate_tim |=
688 sta->driver_buffered_tids & tids;
689 }
690
691 done:
692 spin_lock_bh(&local->tim_lock);
693
694 if (indicate_tim == __bss_tim_get(ps->tim, id))
695 goto out_unlock;
696
697 if (indicate_tim)
698 __bss_tim_set(ps->tim, id);
699 else
700 __bss_tim_clear(ps->tim, id);
701
702 if (local->ops->set_tim) {
703 local->tim_in_locked_section = true;
704 drv_set_tim(local, &sta->sta, indicate_tim);
705 local->tim_in_locked_section = false;
706 }
707
708 out_unlock:
709 spin_unlock_bh(&local->tim_lock);
710 }
711
712 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
713 {
714 struct ieee80211_tx_info *info;
715 int timeout;
716
717 if (!skb)
718 return false;
719
720 info = IEEE80211_SKB_CB(skb);
721
722 /* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
723 timeout = (sta->listen_interval *
724 sta->sdata->vif.bss_conf.beacon_int *
725 32 / 15625) * HZ;
726 if (timeout < STA_TX_BUFFER_EXPIRE)
727 timeout = STA_TX_BUFFER_EXPIRE;
728 return time_after(jiffies, info->control.jiffies + timeout);
729 }
730
731
732 static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
733 struct sta_info *sta, int ac)
734 {
735 unsigned long flags;
736 struct sk_buff *skb;
737
738 /*
739 * First check for frames that should expire on the filtered
740 * queue. Frames here were rejected by the driver and are on
741 * a separate queue to avoid reordering with normal PS-buffered
742 * frames. They also aren't accounted for right now in the
743 * total_ps_buffered counter.
744 */
745 for (;;) {
746 spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
747 skb = skb_peek(&sta->tx_filtered[ac]);
748 if (sta_info_buffer_expired(sta, skb))
749 skb = __skb_dequeue(&sta->tx_filtered[ac]);
750 else
751 skb = NULL;
752 spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
753
754 /*
755 * Frames are queued in order, so if this one
756 * hasn't expired yet we can stop testing. If
757 * we actually reached the end of the queue we
758 * also need to stop, of course.
759 */
760 if (!skb)
761 break;
762 ieee80211_free_txskb(&local->hw, skb);
763 }
764
765 /*
766 * Now also check the normal PS-buffered queue, this will
767 * only find something if the filtered queue was emptied
768 * since the filtered frames are all before the normal PS
769 * buffered frames.
770 */
771 for (;;) {
772 spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
773 skb = skb_peek(&sta->ps_tx_buf[ac]);
774 if (sta_info_buffer_expired(sta, skb))
775 skb = __skb_dequeue(&sta->ps_tx_buf[ac]);
776 else
777 skb = NULL;
778 spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
779
780 /*
781 * frames are queued in order, so if this one
782 * hasn't expired yet (or we reached the end of
783 * the queue) we can stop testing
784 */
785 if (!skb)
786 break;
787
788 local->total_ps_buffered--;
789 ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
790 sta->sta.addr);
791 ieee80211_free_txskb(&local->hw, skb);
792 }
793
794 /*
795 * Finally, recalculate the TIM bit for this station -- it might
796 * now be clear because the station was too slow to retrieve its
797 * frames.
798 */
799 sta_info_recalc_tim(sta);
800
801 /*
802 * Return whether there are any frames still buffered, this is
803 * used to check whether the cleanup timer still needs to run,
804 * if there are no frames we don't need to rearm the timer.
805 */
806 return !(skb_queue_empty(&sta->ps_tx_buf[ac]) &&
807 skb_queue_empty(&sta->tx_filtered[ac]));
808 }
809
810 static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
811 struct sta_info *sta)
812 {
813 bool have_buffered = false;
814 int ac;
815
816 /* This is only necessary for stations on BSS/MBSS interfaces */
817 if (!sta->sdata->bss &&
818 !ieee80211_vif_is_mesh(&sta->sdata->vif))
819 return false;
820
821 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
822 have_buffered |=
823 sta_info_cleanup_expire_buffered_ac(local, sta, ac);
824
825 return have_buffered;
826 }
827
828 static int __must_check __sta_info_destroy_part1(struct sta_info *sta)
829 {
830 struct ieee80211_local *local;
831 struct ieee80211_sub_if_data *sdata;
832 int ret;
833
834 might_sleep();
835
836 if (!sta)
837 return -ENOENT;
838
839 local = sta->local;
840 sdata = sta->sdata;
841
842 lockdep_assert_held(&local->sta_mtx);
843
844 /*
845 * Before removing the station from the driver and
846 * rate control, it might still start new aggregation
847 * sessions -- block that to make sure the tear-down
848 * will be sufficient.
849 */
850 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
851 ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
852
853 ret = sta_info_hash_del(local, sta);
854 if (WARN_ON(ret))
855 return ret;
856
857 list_del_rcu(&sta->list);
858
859 drv_sta_pre_rcu_remove(local, sta->sdata, sta);
860
861 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
862 rcu_access_pointer(sdata->u.vlan.sta) == sta)
863 RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
864
865 return 0;
866 }
867
868 static void __sta_info_destroy_part2(struct sta_info *sta)
869 {
870 struct ieee80211_local *local = sta->local;
871 struct ieee80211_sub_if_data *sdata = sta->sdata;
872 int ret;
873
874 /*
875 * NOTE: This assumes at least synchronize_net() was done
876 * after _part1 and before _part2!
877 */
878
879 might_sleep();
880 lockdep_assert_held(&local->sta_mtx);
881
882 /* now keys can no longer be reached */
883 ieee80211_free_sta_keys(local, sta);
884
885 sta->dead = true;
886
887 local->num_sta--;
888 local->sta_generation++;
889
890 while (sta->sta_state > IEEE80211_STA_NONE) {
891 ret = sta_info_move_state(sta, sta->sta_state - 1);
892 if (ret) {
893 WARN_ON_ONCE(1);
894 break;
895 }
896 }
897
898 if (sta->uploaded) {
899 ret = drv_sta_state(local, sdata, sta, IEEE80211_STA_NONE,
900 IEEE80211_STA_NOTEXIST);
901 WARN_ON_ONCE(ret != 0);
902 }
903
904 sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
905
906 cfg80211_del_sta(sdata->dev, sta->sta.addr, GFP_KERNEL);
907
908 rate_control_remove_sta_debugfs(sta);
909 ieee80211_sta_debugfs_remove(sta);
910 ieee80211_recalc_min_chandef(sdata);
911
912 cleanup_single_sta(sta);
913 }
914
915 int __must_check __sta_info_destroy(struct sta_info *sta)
916 {
917 int err = __sta_info_destroy_part1(sta);
918
919 if (err)
920 return err;
921
922 synchronize_net();
923
924 __sta_info_destroy_part2(sta);
925
926 return 0;
927 }
928
929 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
930 {
931 struct sta_info *sta;
932 int ret;
933
934 mutex_lock(&sdata->local->sta_mtx);
935 sta = sta_info_get(sdata, addr);
936 ret = __sta_info_destroy(sta);
937 mutex_unlock(&sdata->local->sta_mtx);
938
939 return ret;
940 }
941
942 int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
943 const u8 *addr)
944 {
945 struct sta_info *sta;
946 int ret;
947
948 mutex_lock(&sdata->local->sta_mtx);
949 sta = sta_info_get_bss(sdata, addr);
950 ret = __sta_info_destroy(sta);
951 mutex_unlock(&sdata->local->sta_mtx);
952
953 return ret;
954 }
955
956 static void sta_info_cleanup(unsigned long data)
957 {
958 struct ieee80211_local *local = (struct ieee80211_local *) data;
959 struct sta_info *sta;
960 bool timer_needed = false;
961
962 rcu_read_lock();
963 list_for_each_entry_rcu(sta, &local->sta_list, list)
964 if (sta_info_cleanup_expire_buffered(local, sta))
965 timer_needed = true;
966 rcu_read_unlock();
967
968 if (local->quiescing)
969 return;
970
971 if (!timer_needed)
972 return;
973
974 mod_timer(&local->sta_cleanup,
975 round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL));
976 }
977
978 void sta_info_init(struct ieee80211_local *local)
979 {
980 spin_lock_init(&local->tim_lock);
981 mutex_init(&local->sta_mtx);
982 INIT_LIST_HEAD(&local->sta_list);
983
984 setup_timer(&local->sta_cleanup, sta_info_cleanup,
985 (unsigned long)local);
986 }
987
988 void sta_info_stop(struct ieee80211_local *local)
989 {
990 del_timer_sync(&local->sta_cleanup);
991 }
992
993
994 int __sta_info_flush(struct ieee80211_sub_if_data *sdata, bool vlans)
995 {
996 struct ieee80211_local *local = sdata->local;
997 struct sta_info *sta, *tmp;
998 LIST_HEAD(free_list);
999 int ret = 0;
1000
1001 might_sleep();
1002
1003 WARN_ON(vlans && sdata->vif.type != NL80211_IFTYPE_AP);
1004 WARN_ON(vlans && !sdata->bss);
1005
1006 mutex_lock(&local->sta_mtx);
1007 list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1008 if (sdata == sta->sdata ||
1009 (vlans && sdata->bss == sta->sdata->bss)) {
1010 if (!WARN_ON(__sta_info_destroy_part1(sta)))
1011 list_add(&sta->free_list, &free_list);
1012 ret++;
1013 }
1014 }
1015
1016 if (!list_empty(&free_list)) {
1017 synchronize_net();
1018 list_for_each_entry_safe(sta, tmp, &free_list, free_list)
1019 __sta_info_destroy_part2(sta);
1020 }
1021 mutex_unlock(&local->sta_mtx);
1022
1023 return ret;
1024 }
1025
1026 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
1027 unsigned long exp_time)
1028 {
1029 struct ieee80211_local *local = sdata->local;
1030 struct sta_info *sta, *tmp;
1031
1032 mutex_lock(&local->sta_mtx);
1033
1034 list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
1035 if (sdata != sta->sdata)
1036 continue;
1037
1038 if (time_after(jiffies, sta->last_rx + exp_time)) {
1039 sta_dbg(sta->sdata, "expiring inactive STA %pM\n",
1040 sta->sta.addr);
1041
1042 if (ieee80211_vif_is_mesh(&sdata->vif) &&
1043 test_sta_flag(sta, WLAN_STA_PS_STA))
1044 atomic_dec(&sdata->u.mesh.ps.num_sta_ps);
1045
1046 WARN_ON(__sta_info_destroy(sta));
1047 }
1048 }
1049
1050 mutex_unlock(&local->sta_mtx);
1051 }
1052
1053 struct ieee80211_sta *ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
1054 const u8 *addr,
1055 const u8 *localaddr)
1056 {
1057 struct sta_info *sta, *nxt;
1058
1059 /*
1060 * Just return a random station if localaddr is NULL
1061 * ... first in list.
1062 */
1063 for_each_sta_info(hw_to_local(hw), addr, sta, nxt) {
1064 if (localaddr &&
1065 !ether_addr_equal(sta->sdata->vif.addr, localaddr))
1066 continue;
1067 if (!sta->uploaded)
1068 return NULL;
1069 return &sta->sta;
1070 }
1071
1072 return NULL;
1073 }
1074 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_ifaddr);
1075
1076 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
1077 const u8 *addr)
1078 {
1079 struct sta_info *sta;
1080
1081 if (!vif)
1082 return NULL;
1083
1084 sta = sta_info_get_bss(vif_to_sdata(vif), addr);
1085 if (!sta)
1086 return NULL;
1087
1088 if (!sta->uploaded)
1089 return NULL;
1090
1091 return &sta->sta;
1092 }
1093 EXPORT_SYMBOL(ieee80211_find_sta);
1094
1095 /* powersave support code */
1096 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
1097 {
1098 struct ieee80211_sub_if_data *sdata = sta->sdata;
1099 struct ieee80211_local *local = sdata->local;
1100 struct sk_buff_head pending;
1101 int filtered = 0, buffered = 0, ac;
1102 unsigned long flags;
1103 struct ps_data *ps;
1104
1105 if (sdata->vif.type == NL80211_IFTYPE_AP ||
1106 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1107 ps = &sdata->bss->ps;
1108 else if (ieee80211_vif_is_mesh(&sdata->vif))
1109 ps = &sdata->u.mesh.ps;
1110 else
1111 return;
1112
1113 clear_sta_flag(sta, WLAN_STA_SP);
1114
1115 BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
1116 sta->driver_buffered_tids = 0;
1117
1118 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1119 drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
1120
1121 skb_queue_head_init(&pending);
1122
1123 /* sync with ieee80211_tx_h_unicast_ps_buf */
1124 spin_lock(&sta->ps_lock);
1125 /* Send all buffered frames to the station */
1126 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1127 int count = skb_queue_len(&pending), tmp;
1128
1129 spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
1130 skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
1131 spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
1132 tmp = skb_queue_len(&pending);
1133 filtered += tmp - count;
1134 count = tmp;
1135
1136 spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
1137 skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
1138 spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
1139 tmp = skb_queue_len(&pending);
1140 buffered += tmp - count;
1141 }
1142
1143 ieee80211_add_pending_skbs(local, &pending);
1144 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
1145 clear_sta_flag(sta, WLAN_STA_PS_STA);
1146 spin_unlock(&sta->ps_lock);
1147
1148 atomic_dec(&ps->num_sta_ps);
1149
1150 /* This station just woke up and isn't aware of our SMPS state */
1151 if (!ieee80211_smps_is_restrictive(sta->known_smps_mode,
1152 sdata->smps_mode) &&
1153 sta->known_smps_mode != sdata->bss->req_smps &&
1154 sta_info_tx_streams(sta) != 1) {
1155 ht_dbg(sdata,
1156 "%pM just woke up and MIMO capable - update SMPS\n",
1157 sta->sta.addr);
1158 ieee80211_send_smps_action(sdata, sdata->bss->req_smps,
1159 sta->sta.addr,
1160 sdata->vif.bss_conf.bssid);
1161 }
1162
1163 local->total_ps_buffered -= buffered;
1164
1165 sta_info_recalc_tim(sta);
1166
1167 ps_dbg(sdata,
1168 "STA %pM aid %d sending %d filtered/%d PS frames since STA not sleeping anymore\n",
1169 sta->sta.addr, sta->sta.aid, filtered, buffered);
1170 }
1171
1172 static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
1173 struct sta_info *sta, int tid,
1174 enum ieee80211_frame_release_type reason,
1175 bool call_driver)
1176 {
1177 struct ieee80211_local *local = sdata->local;
1178 struct ieee80211_qos_hdr *nullfunc;
1179 struct sk_buff *skb;
1180 int size = sizeof(*nullfunc);
1181 __le16 fc;
1182 bool qos = test_sta_flag(sta, WLAN_STA_WME);
1183 struct ieee80211_tx_info *info;
1184 struct ieee80211_chanctx_conf *chanctx_conf;
1185
1186 if (qos) {
1187 fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1188 IEEE80211_STYPE_QOS_NULLFUNC |
1189 IEEE80211_FCTL_FROMDS);
1190 } else {
1191 size -= 2;
1192 fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
1193 IEEE80211_STYPE_NULLFUNC |
1194 IEEE80211_FCTL_FROMDS);
1195 }
1196
1197 skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
1198 if (!skb)
1199 return;
1200
1201 skb_reserve(skb, local->hw.extra_tx_headroom);
1202
1203 nullfunc = (void *) skb_put(skb, size);
1204 nullfunc->frame_control = fc;
1205 nullfunc->duration_id = 0;
1206 memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
1207 memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1208 memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
1209 nullfunc->seq_ctrl = 0;
1210
1211 skb->priority = tid;
1212 skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
1213 if (qos) {
1214 nullfunc->qos_ctrl = cpu_to_le16(tid);
1215
1216 if (reason == IEEE80211_FRAME_RELEASE_UAPSD)
1217 nullfunc->qos_ctrl |=
1218 cpu_to_le16(IEEE80211_QOS_CTL_EOSP);
1219 }
1220
1221 info = IEEE80211_SKB_CB(skb);
1222
1223 /*
1224 * Tell TX path to send this frame even though the
1225 * STA may still remain is PS mode after this frame
1226 * exchange. Also set EOSP to indicate this packet
1227 * ends the poll/service period.
1228 */
1229 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
1230 IEEE80211_TX_CTL_PS_RESPONSE |
1231 IEEE80211_TX_STATUS_EOSP |
1232 IEEE80211_TX_CTL_REQ_TX_STATUS;
1233
1234 if (call_driver)
1235 drv_allow_buffered_frames(local, sta, BIT(tid), 1,
1236 reason, false);
1237
1238 skb->dev = sdata->dev;
1239
1240 rcu_read_lock();
1241 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1242 if (WARN_ON(!chanctx_conf)) {
1243 rcu_read_unlock();
1244 kfree_skb(skb);
1245 return;
1246 }
1247
1248 ieee80211_xmit(sdata, skb, chanctx_conf->def.chan->band);
1249 rcu_read_unlock();
1250 }
1251
1252 static int find_highest_prio_tid(unsigned long tids)
1253 {
1254 /* lower 3 TIDs aren't ordered perfectly */
1255 if (tids & 0xF8)
1256 return fls(tids) - 1;
1257 /* TID 0 is BE just like TID 3 */
1258 if (tids & BIT(0))
1259 return 0;
1260 return fls(tids) - 1;
1261 }
1262
1263 static void
1264 ieee80211_sta_ps_deliver_response(struct sta_info *sta,
1265 int n_frames, u8 ignored_acs,
1266 enum ieee80211_frame_release_type reason)
1267 {
1268 struct ieee80211_sub_if_data *sdata = sta->sdata;
1269 struct ieee80211_local *local = sdata->local;
1270 bool more_data = false;
1271 int ac;
1272 unsigned long driver_release_tids = 0;
1273 struct sk_buff_head frames;
1274
1275 /* Service or PS-Poll period starts */
1276 set_sta_flag(sta, WLAN_STA_SP);
1277
1278 __skb_queue_head_init(&frames);
1279
1280 /* Get response frame(s) and more data bit for the last one. */
1281 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1282 unsigned long tids;
1283
1284 if (ignored_acs & BIT(ac))
1285 continue;
1286
1287 tids = ieee80211_tids_for_ac(ac);
1288
1289 /* if we already have frames from software, then we can't also
1290 * release from hardware queues
1291 */
1292 if (skb_queue_empty(&frames))
1293 driver_release_tids |= sta->driver_buffered_tids & tids;
1294
1295 if (driver_release_tids) {
1296 /* If the driver has data on more than one TID then
1297 * certainly there's more data if we release just a
1298 * single frame now (from a single TID). This will
1299 * only happen for PS-Poll.
1300 */
1301 if (reason == IEEE80211_FRAME_RELEASE_PSPOLL &&
1302 hweight16(driver_release_tids) > 1) {
1303 more_data = true;
1304 driver_release_tids =
1305 BIT(find_highest_prio_tid(
1306 driver_release_tids));
1307 break;
1308 }
1309 } else {
1310 struct sk_buff *skb;
1311
1312 while (n_frames > 0) {
1313 skb = skb_dequeue(&sta->tx_filtered[ac]);
1314 if (!skb) {
1315 skb = skb_dequeue(
1316 &sta->ps_tx_buf[ac]);
1317 if (skb)
1318 local->total_ps_buffered--;
1319 }
1320 if (!skb)
1321 break;
1322 n_frames--;
1323 __skb_queue_tail(&frames, skb);
1324 }
1325 }
1326
1327 /* If we have more frames buffered on this AC, then set the
1328 * more-data bit and abort the loop since we can't send more
1329 * data from other ACs before the buffered frames from this.
1330 */
1331 if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
1332 !skb_queue_empty(&sta->ps_tx_buf[ac])) {
1333 more_data = true;
1334 break;
1335 }
1336 }
1337
1338 if (skb_queue_empty(&frames) && !driver_release_tids) {
1339 int tid;
1340
1341 /*
1342 * For PS-Poll, this can only happen due to a race condition
1343 * when we set the TIM bit and the station notices it, but
1344 * before it can poll for the frame we expire it.
1345 *
1346 * For uAPSD, this is said in the standard (11.2.1.5 h):
1347 * At each unscheduled SP for a non-AP STA, the AP shall
1348 * attempt to transmit at least one MSDU or MMPDU, but no
1349 * more than the value specified in the Max SP Length field
1350 * in the QoS Capability element from delivery-enabled ACs,
1351 * that are destined for the non-AP STA.
1352 *
1353 * Since we have no other MSDU/MMPDU, transmit a QoS null frame.
1354 */
1355
1356 /* This will evaluate to 1, 3, 5 or 7. */
1357 tid = 7 - ((ffs(~ignored_acs) - 1) << 1);
1358
1359 ieee80211_send_null_response(sdata, sta, tid, reason, true);
1360 } else if (!driver_release_tids) {
1361 struct sk_buff_head pending;
1362 struct sk_buff *skb;
1363 int num = 0;
1364 u16 tids = 0;
1365 bool need_null = false;
1366
1367 skb_queue_head_init(&pending);
1368
1369 while ((skb = __skb_dequeue(&frames))) {
1370 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1371 struct ieee80211_hdr *hdr = (void *) skb->data;
1372 u8 *qoshdr = NULL;
1373
1374 num++;
1375
1376 /*
1377 * Tell TX path to send this frame even though the
1378 * STA may still remain is PS mode after this frame
1379 * exchange.
1380 */
1381 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
1382 IEEE80211_TX_CTL_PS_RESPONSE;
1383
1384 /*
1385 * Use MoreData flag to indicate whether there are
1386 * more buffered frames for this STA
1387 */
1388 if (more_data || !skb_queue_empty(&frames))
1389 hdr->frame_control |=
1390 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1391 else
1392 hdr->frame_control &=
1393 cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1394
1395 if (ieee80211_is_data_qos(hdr->frame_control) ||
1396 ieee80211_is_qos_nullfunc(hdr->frame_control))
1397 qoshdr = ieee80211_get_qos_ctl(hdr);
1398
1399 tids |= BIT(skb->priority);
1400
1401 __skb_queue_tail(&pending, skb);
1402
1403 /* end service period after last frame or add one */
1404 if (!skb_queue_empty(&frames))
1405 continue;
1406
1407 if (reason != IEEE80211_FRAME_RELEASE_UAPSD) {
1408 /* for PS-Poll, there's only one frame */
1409 info->flags |= IEEE80211_TX_STATUS_EOSP |
1410 IEEE80211_TX_CTL_REQ_TX_STATUS;
1411 break;
1412 }
1413
1414 /* For uAPSD, things are a bit more complicated. If the
1415 * last frame has a QoS header (i.e. is a QoS-data or
1416 * QoS-nulldata frame) then just set the EOSP bit there
1417 * and be done.
1418 * If the frame doesn't have a QoS header (which means
1419 * it should be a bufferable MMPDU) then we can't set
1420 * the EOSP bit in the QoS header; add a QoS-nulldata
1421 * frame to the list to send it after the MMPDU.
1422 *
1423 * Note that this code is only in the mac80211-release
1424 * code path, we assume that the driver will not buffer
1425 * anything but QoS-data frames, or if it does, will
1426 * create the QoS-nulldata frame by itself if needed.
1427 *
1428 * Cf. 802.11-2012 10.2.1.10 (c).
1429 */
1430 if (qoshdr) {
1431 *qoshdr |= IEEE80211_QOS_CTL_EOSP;
1432
1433 info->flags |= IEEE80211_TX_STATUS_EOSP |
1434 IEEE80211_TX_CTL_REQ_TX_STATUS;
1435 } else {
1436 /* The standard isn't completely clear on this
1437 * as it says the more-data bit should be set
1438 * if there are more BUs. The QoS-Null frame
1439 * we're about to send isn't buffered yet, we
1440 * only create it below, but let's pretend it
1441 * was buffered just in case some clients only
1442 * expect more-data=0 when eosp=1.
1443 */
1444 hdr->frame_control |=
1445 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1446 need_null = true;
1447 num++;
1448 }
1449 break;
1450 }
1451
1452 drv_allow_buffered_frames(local, sta, tids, num,
1453 reason, more_data);
1454
1455 ieee80211_add_pending_skbs(local, &pending);
1456
1457 if (need_null)
1458 ieee80211_send_null_response(
1459 sdata, sta, find_highest_prio_tid(tids),
1460 reason, false);
1461
1462 sta_info_recalc_tim(sta);
1463 } else {
1464 /*
1465 * We need to release a frame that is buffered somewhere in the
1466 * driver ... it'll have to handle that.
1467 * Note that the driver also has to check the number of frames
1468 * on the TIDs we're releasing from - if there are more than
1469 * n_frames it has to set the more-data bit (if we didn't ask
1470 * it to set it anyway due to other buffered frames); if there
1471 * are fewer than n_frames it has to make sure to adjust that
1472 * to allow the service period to end properly.
1473 */
1474 drv_release_buffered_frames(local, sta, driver_release_tids,
1475 n_frames, reason, more_data);
1476
1477 /*
1478 * Note that we don't recalculate the TIM bit here as it would
1479 * most likely have no effect at all unless the driver told us
1480 * that the TID(s) became empty before returning here from the
1481 * release function.
1482 * Either way, however, when the driver tells us that the TID(s)
1483 * became empty we'll do the TIM recalculation.
1484 */
1485 }
1486 }
1487
1488 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
1489 {
1490 u8 ignore_for_response = sta->sta.uapsd_queues;
1491
1492 /*
1493 * If all ACs are delivery-enabled then we should reply
1494 * from any of them, if only some are enabled we reply
1495 * only from the non-enabled ones.
1496 */
1497 if (ignore_for_response == BIT(IEEE80211_NUM_ACS) - 1)
1498 ignore_for_response = 0;
1499
1500 ieee80211_sta_ps_deliver_response(sta, 1, ignore_for_response,
1501 IEEE80211_FRAME_RELEASE_PSPOLL);
1502 }
1503
1504 void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
1505 {
1506 int n_frames = sta->sta.max_sp;
1507 u8 delivery_enabled = sta->sta.uapsd_queues;
1508
1509 /*
1510 * If we ever grow support for TSPEC this might happen if
1511 * the TSPEC update from hostapd comes in between a trigger
1512 * frame setting WLAN_STA_UAPSD in the RX path and this
1513 * actually getting called.
1514 */
1515 if (!delivery_enabled)
1516 return;
1517
1518 switch (sta->sta.max_sp) {
1519 case 1:
1520 n_frames = 2;
1521 break;
1522 case 2:
1523 n_frames = 4;
1524 break;
1525 case 3:
1526 n_frames = 6;
1527 break;
1528 case 0:
1529 /* XXX: what is a good value? */
1530 n_frames = 8;
1531 break;
1532 }
1533
1534 ieee80211_sta_ps_deliver_response(sta, n_frames, ~delivery_enabled,
1535 IEEE80211_FRAME_RELEASE_UAPSD);
1536 }
1537
1538 void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
1539 struct ieee80211_sta *pubsta, bool block)
1540 {
1541 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1542
1543 trace_api_sta_block_awake(sta->local, pubsta, block);
1544
1545 if (block)
1546 set_sta_flag(sta, WLAN_STA_PS_DRIVER);
1547 else if (test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1548 ieee80211_queue_work(hw, &sta->drv_unblock_wk);
1549 }
1550 EXPORT_SYMBOL(ieee80211_sta_block_awake);
1551
1552 void ieee80211_sta_eosp(struct ieee80211_sta *pubsta)
1553 {
1554 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1555 struct ieee80211_local *local = sta->local;
1556
1557 trace_api_eosp(local, pubsta);
1558
1559 clear_sta_flag(sta, WLAN_STA_SP);
1560 }
1561 EXPORT_SYMBOL(ieee80211_sta_eosp);
1562
1563 void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
1564 u8 tid, bool buffered)
1565 {
1566 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1567
1568 if (WARN_ON(tid >= IEEE80211_NUM_TIDS))
1569 return;
1570
1571 trace_api_sta_set_buffered(sta->local, pubsta, tid, buffered);
1572
1573 if (buffered)
1574 set_bit(tid, &sta->driver_buffered_tids);
1575 else
1576 clear_bit(tid, &sta->driver_buffered_tids);
1577
1578 sta_info_recalc_tim(sta);
1579 }
1580 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
1581
1582 int sta_info_move_state(struct sta_info *sta,
1583 enum ieee80211_sta_state new_state)
1584 {
1585 might_sleep();
1586
1587 if (sta->sta_state == new_state)
1588 return 0;
1589
1590 /* check allowed transitions first */
1591
1592 switch (new_state) {
1593 case IEEE80211_STA_NONE:
1594 if (sta->sta_state != IEEE80211_STA_AUTH)
1595 return -EINVAL;
1596 break;
1597 case IEEE80211_STA_AUTH:
1598 if (sta->sta_state != IEEE80211_STA_NONE &&
1599 sta->sta_state != IEEE80211_STA_ASSOC)
1600 return -EINVAL;
1601 break;
1602 case IEEE80211_STA_ASSOC:
1603 if (sta->sta_state != IEEE80211_STA_AUTH &&
1604 sta->sta_state != IEEE80211_STA_AUTHORIZED)
1605 return -EINVAL;
1606 break;
1607 case IEEE80211_STA_AUTHORIZED:
1608 if (sta->sta_state != IEEE80211_STA_ASSOC)
1609 return -EINVAL;
1610 break;
1611 default:
1612 WARN(1, "invalid state %d", new_state);
1613 return -EINVAL;
1614 }
1615
1616 sta_dbg(sta->sdata, "moving STA %pM to state %d\n",
1617 sta->sta.addr, new_state);
1618
1619 /*
1620 * notify the driver before the actual changes so it can
1621 * fail the transition
1622 */
1623 if (test_sta_flag(sta, WLAN_STA_INSERTED)) {
1624 int err = drv_sta_state(sta->local, sta->sdata, sta,
1625 sta->sta_state, new_state);
1626 if (err)
1627 return err;
1628 }
1629
1630 /* reflect the change in all state variables */
1631
1632 switch (new_state) {
1633 case IEEE80211_STA_NONE:
1634 if (sta->sta_state == IEEE80211_STA_AUTH)
1635 clear_bit(WLAN_STA_AUTH, &sta->_flags);
1636 break;
1637 case IEEE80211_STA_AUTH:
1638 if (sta->sta_state == IEEE80211_STA_NONE)
1639 set_bit(WLAN_STA_AUTH, &sta->_flags);
1640 else if (sta->sta_state == IEEE80211_STA_ASSOC)
1641 clear_bit(WLAN_STA_ASSOC, &sta->_flags);
1642 break;
1643 case IEEE80211_STA_ASSOC:
1644 if (sta->sta_state == IEEE80211_STA_AUTH) {
1645 set_bit(WLAN_STA_ASSOC, &sta->_flags);
1646 } else if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
1647 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1648 (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1649 !sta->sdata->u.vlan.sta))
1650 atomic_dec(&sta->sdata->bss->num_mcast_sta);
1651 clear_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1652 }
1653 break;
1654 case IEEE80211_STA_AUTHORIZED:
1655 if (sta->sta_state == IEEE80211_STA_ASSOC) {
1656 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1657 (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1658 !sta->sdata->u.vlan.sta))
1659 atomic_inc(&sta->sdata->bss->num_mcast_sta);
1660 set_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
1661 }
1662 break;
1663 default:
1664 break;
1665 }
1666
1667 sta->sta_state = new_state;
1668
1669 return 0;
1670 }
1671
1672 u8 sta_info_tx_streams(struct sta_info *sta)
1673 {
1674 struct ieee80211_sta_ht_cap *ht_cap = &sta->sta.ht_cap;
1675 u8 rx_streams;
1676
1677 if (!sta->sta.ht_cap.ht_supported)
1678 return 1;
1679
1680 if (sta->sta.vht_cap.vht_supported) {
1681 int i;
1682 u16 tx_mcs_map =
1683 le16_to_cpu(sta->sta.vht_cap.vht_mcs.tx_mcs_map);
1684
1685 for (i = 7; i >= 0; i--)
1686 if ((tx_mcs_map & (0x3 << (i * 2))) !=
1687 IEEE80211_VHT_MCS_NOT_SUPPORTED)
1688 return i + 1;
1689 }
1690
1691 if (ht_cap->mcs.rx_mask[3])
1692 rx_streams = 4;
1693 else if (ht_cap->mcs.rx_mask[2])
1694 rx_streams = 3;
1695 else if (ht_cap->mcs.rx_mask[1])
1696 rx_streams = 2;
1697 else
1698 rx_streams = 1;
1699
1700 if (!(ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_RX_DIFF))
1701 return rx_streams;
1702
1703 return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
1704 >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
1705 }
Linux kernel - Deliverables
This page took 0.080654 seconds and 5 git commands to generate.