[PATCH wireless-next 08/18] wifi: mac80211: Add driver_op for SMD substate changes
From: Pooventhiran G
Date: Mon Sep 07 2026 - 16:40:54 EST
During SMD BSS Transition, a non-AP MLD cycles through sub-states 4a,
4b, and 4c that impose different frame-filtering rules on the AP MLD.
mac80211 tracks these sub-states in STA flags but has no mechanism to
propagate the transitions to the driver, so hardware-level queue
gating and frame-filtering cannot follow the SMD state machine.
Add a new driver op that mac80211 calls on each sub-state transition.
This lets drivers perform the necessary hardware queue and filtering
adjustments at each phase of the SMD BSS Transition.
Valid transition order:
NONE -> PREP (ST preparation completed at the target AP MLD)
NONE -> EXEC (ST execution in progress at the current AP MLD)
EXEC -> DRAIN (DL drain period started at the current AP MLD)
Suggested-by: Rohan Dutta <drohan@xxxxxxxxxxxxxxxx>
Signed-off-by: Pooventhiran G <pooventhiran.g@xxxxxxxxxxxxxxxx>
---
include/net/mac80211.h | 26 +++++++++
net/mac80211/cfg.c | 59 ++++++++++++++-----
net/mac80211/driver-ops.c | 24 ++++++++
net/mac80211/driver-ops.h | 6 ++
net/mac80211/sta_info.c | 140 ++++++++++++++++++++++++++++++++++++++++++++++
net/mac80211/sta_info.h | 9 +++
net/mac80211/trace.h | 33 +++++++++++
7 files changed, 284 insertions(+), 13 deletions(-)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index d8f5e5d8a021..9b5fa6d6281b 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -4077,6 +4077,24 @@ struct ieee80211_prep_tx_info {
int link_id;
};
+/**
+ * enum ieee80211_sta_smd_state - SMD BSS Transition sub-state
+ *
+ * Tracks the 802.11bn SMD BSS Transition sub-state (IEEE P802.11bn/D2.0,
+ * Aug 2026, subclause 11.3.1) for a specific (non-AP MLD, AP MLD) association.
+ *
+ * @IEEE80211_STA_SMD_NONE: Plain State 4. No sub-state active.
+ * @IEEE80211_STA_SMD_PREP: State 4a. STA prepared at the target AP MLD
+ * @IEEE80211_STA_SMD_EXEC: State 4b. ST execution active at the current AP MLD
+ * @IEEE80211_STA_SMD_DRAIN: State 4c. DL draining period at the current AP MLD
+ */
+enum ieee80211_sta_smd_state {
+ IEEE80211_STA_SMD_NONE,
+ IEEE80211_STA_SMD_PREP,
+ IEEE80211_STA_SMD_EXEC,
+ IEEE80211_STA_SMD_DRAIN,
+};
+
/**
* struct ieee80211_ops - callbacks from mac80211 to the driver
*
@@ -4743,6 +4761,9 @@ struct ieee80211_prep_tx_info {
* @set_eml_op_mode: Configure eMLSR/eMLMR operation mode in the underlay
* driver according to the parameter received in the EML Operating mode
* notification frame.
+ * @sta_smd_state: Notifies low level driver about IEEE 802.11bn SMD substate
+ * transition of a station. It must not fail while transitioning down.
+ * The callback can sleep.
*/
struct ieee80211_ops {
void (*tx)(struct ieee80211_hw *hw,
@@ -5144,6 +5165,11 @@ struct ieee80211_ops {
struct ieee80211_vif *vif,
struct ieee80211_sta *sta,
struct ieee80211_eml_params *eml_params);
+ int (*sta_smd_state)(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ enum ieee80211_sta_smd_state old_state,
+ enum ieee80211_sta_smd_state new_state);
};
/**
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 69b3ac0b48f3..0ea8b610a771 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2459,7 +2459,9 @@ static int sta_apply_smd_state_flags(struct sta_info *sta,
u32 expected_mask = BIT(NL80211_STA_FLAG_SMD_PREP_TARGET) |
BIT(NL80211_STA_FLAG_SMD_EXEC_CURRENT) |
BIT(NL80211_STA_FLAG_SMD_DL_DRAIN);
+ enum ieee80211_sta_smd_state new_ss;
u32 smd_flags;
+ int err;
if (!(mask & expected_mask))
return 0;
@@ -2479,6 +2481,22 @@ static int sta_apply_smd_state_flags(struct sta_info *sta,
(smd_exec_current || smd_dl_drain))
return -EINVAL;
+ if (smd_prep_target)
+ new_ss = IEEE80211_STA_SMD_PREP;
+ else if (smd_exec_current)
+ new_ss = IEEE80211_STA_SMD_EXEC;
+ else if (smd_dl_drain)
+ new_ss = IEEE80211_STA_SMD_DRAIN;
+ else
+ new_ss = IEEE80211_STA_SMD_NONE;
+
+ if (new_ss == sta->smd_state)
+ return 0;
+
+ err = sta_info_move_smd_state(sta, new_ss, true);
+ if (err)
+ return err;
+
if (smd_prep_target) {
clear_sta_flag(sta, WLAN_STA_SMD_EXEC_CURRENT);
clear_sta_flag(sta, WLAN_STA_SMD_DL_DRAIN);
@@ -2578,26 +2596,17 @@ static int sta_apply_parameters(struct ieee80211_local *local,
sta->sta.spp_amsdu = set & BIT(NL80211_STA_FLAG_SPP_AMSDU);
if (mask & BIT(NL80211_STA_FLAG_SMD)) {
- if (set & BIT(NL80211_STA_FLAG_SMD))
+ if (set & BIT(NL80211_STA_FLAG_SMD)) {
set_sta_flag(sta, WLAN_STA_SMD);
- else if (test_sta_flag(sta, WLAN_STA_SMD))
+ } else if (test_sta_flag(sta, WLAN_STA_SMD)) {
+ sta_info_reset_smd_state(sta, true);
clear_sta_flag(sta, WLAN_STA_SMD);
+ }
}
if (params->smd_params.smd_sta)
sta->sta.smd_params = params->smd_params;
- /*
- * SMD BSS Transition sub-states (IEEE P802.11bn/D2.0, Aug 2026,
- * subclause 11.3.1).
- * Only meaningful for SMD-capable stations (WLAN_STA_SMD set).
- */
- if (test_sta_flag(sta, WLAN_STA_SMD)) {
- ret = sta_apply_smd_state_flags(sta, mask, set);
- if (ret)
- return ret;
- }
-
/* mark TDLS channel switch support, if the AP allows it */
if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
!sdata->deflink.u.mgd.tdls_chan_switch_prohibited &&
@@ -2699,6 +2708,17 @@ static int sta_apply_parameters(struct ieee80211_local *local,
return ret;
}
+ /*
+ * SMD BSS Transition sub-states (IEEE P802.11bn/D2.0, Aug 2026,
+ * subclause 11.3.1).
+ * Only meaningful for SMD-capable stations (WLAN_STA_SMD set).
+ */
+ if (test_sta_flag(sta, WLAN_STA_SMD)) {
+ ret = sta_apply_smd_state_flags(sta, mask, set);
+ if (ret)
+ return ret;
+ }
+
/* Mark the STA as MLO if MLD MAC address is available */
if (params->link_sta_params.mld_mac)
sta->sta.mlo = true;
@@ -2783,6 +2803,19 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct wireless_dev *wdev,
*/
if (!err && sdata->vif.type == NL80211_IFTYPE_NAN_DATA)
ieee80211_nan_update_ndi_carrier(sta->sdata);
+
+ /*
+ * SMD sub-state was set in sta_apply_parameters() before the station
+ * was inserted so drv_sta_smd_state() was skipped (WLAN_STA_INSERTED
+ * was not yet set). Walk the driver step-by-step to the target state.
+ */
+ if (!err && test_sta_flag(sta, WLAN_STA_SMD) &&
+ sta->smd_state != IEEE80211_STA_SMD_NONE) {
+ err = sta_info_move_drv_smd_state(sta);
+ if (err)
+ WARN_ON(__sta_info_destroy(sta));
+ }
+
return err;
}
diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index 49753b73aba2..d77a5a80f06e 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -633,3 +633,27 @@ int drv_change_sta_links(struct ieee80211_local *local,
return 0;
}
+
+int drv_sta_smd_state(struct ieee80211_local *local,
+ struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_sta *sta,
+ enum ieee80211_sta_smd_state old_state,
+ enum ieee80211_sta_smd_state new_state)
+{
+ int ret = 0;
+
+ might_sleep();
+ lockdep_assert_wiphy(local->hw.wiphy);
+
+ sdata = get_bss_sdata(sdata);
+ if (!check_sdata_in_driver(sdata))
+ return -EIO;
+
+ trace_drv_sta_smd_state(local, sdata, sta, old_state, new_state);
+ if (local->ops->sta_smd_state)
+ ret = local->ops->sta_smd_state(&local->hw, &sdata->vif,
+ sta, old_state, new_state);
+ trace_drv_return_int(local, ret);
+
+ return ret;
+}
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index f1c0b87fddd5..ce11a723ec36 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1814,4 +1814,10 @@ drv_nan_peer_sched_changed(struct ieee80211_local *local,
return ret;
}
+int drv_sta_smd_state(struct ieee80211_local *local,
+ struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_sta *sta,
+ enum ieee80211_sta_smd_state old_state,
+ enum ieee80211_sta_smd_state new_state);
+
#endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index fdf00cbf49d8..5aa6f5b481e3 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -701,6 +701,7 @@ __sta_info_alloc(struct ieee80211_sub_if_data *sdata,
ieee80211_init_frag_cache(&sta->frags);
sta->sta_state = IEEE80211_STA_NONE;
+ sta->smd_state = IEEE80211_STA_SMD_NONE;
if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
sta->amsdu_mesh_control = -1;
@@ -1527,6 +1528,20 @@ static int _sta_info_move_state(struct sta_info *sta,
WARN_ONCE(err,
"Driver is not allowed to fail if the sta_state is transitioning down the list: %d\n",
err);
+
+ /* revert SMD states if STA has transitioned down */
+ if (new_state == IEEE80211_STA_AUTH &&
+ sta->sta_state == IEEE80211_STA_ASSOC) {
+ if (test_sta_flag(sta, WLAN_STA_SMD) &&
+ sta->smd_state == IEEE80211_STA_SMD_PREP)
+ sta_info_reset_smd_state(sta, true);
+ } else if (new_state == IEEE80211_STA_ASSOC &&
+ sta->sta_state == IEEE80211_STA_AUTHORIZED) {
+ if (test_sta_flag(sta, WLAN_STA_SMD) &&
+ sta->smd_state != IEEE80211_STA_SMD_NONE &&
+ sta->smd_state != IEEE80211_STA_SMD_PREP)
+ sta_info_reset_smd_state(sta, true);
+ }
}
sta->sta_state = new_state;
@@ -3883,3 +3898,128 @@ bool ieee80211_link_sta_update_rc_bw(struct ieee80211_link_data *link,
return true;
}
+
+int sta_info_move_smd_state(struct sta_info *sta,
+ enum ieee80211_sta_smd_state new_ss,
+ bool notify)
+{
+ enum ieee80211_sta_smd_state old_ss = sta->smd_state;
+ struct ieee80211_local *local = sta->local;
+ bool notify_driver;
+ int err;
+
+ might_sleep();
+
+ if (old_ss == new_ss)
+ return 0;
+
+ switch (new_ss) {
+ case IEEE80211_STA_SMD_NONE:
+ if (old_ss != IEEE80211_STA_SMD_PREP &&
+ old_ss != IEEE80211_STA_SMD_EXEC &&
+ old_ss != IEEE80211_STA_SMD_DRAIN)
+ return -EINVAL;
+ break;
+ case IEEE80211_STA_SMD_EXEC:
+ if (old_ss != IEEE80211_STA_SMD_NONE)
+ return -EINVAL;
+ break;
+ case IEEE80211_STA_SMD_DRAIN:
+ if (old_ss != IEEE80211_STA_SMD_EXEC)
+ return -EINVAL;
+ break;
+ case IEEE80211_STA_SMD_PREP:
+ if (old_ss != IEEE80211_STA_SMD_NONE)
+ return -EINVAL;
+ break;
+ default:
+ sdata_err(sta->sdata, "invalid smd state %d", new_ss);
+ return -EINVAL;
+ }
+
+ sta_dbg(sta->sdata, "moving STA %pM SMD state %u -> %u\n",
+ sta->sta.addr, old_ss, new_ss);
+
+ notify_driver = notify && test_sta_flag(sta, WLAN_STA_INSERTED);
+
+ if (new_ss > old_ss && notify_driver) {
+ err = drv_sta_smd_state(local, sta->sdata, &sta->sta, old_ss,
+ new_ss);
+ if (err)
+ return err;
+ }
+
+ if (new_ss < old_ss && notify_driver) {
+ err = drv_sta_smd_state(local, sta->sdata, &sta->sta, old_ss,
+ new_ss);
+ /* driver should not fail moving down SMD states */
+ WARN_ONCE(err,
+ "Driver should not fail moving down SMD states: %d\n",
+ err);
+ }
+
+ sta->smd_state = new_ss;
+
+ return 0;
+}
+
+void sta_info_reset_smd_state(struct sta_info *sta, bool notify)
+{
+ if (sta->smd_state == IEEE80211_STA_SMD_NONE)
+ return;
+
+ /* DRAIN -> NONE, EXEC -> NONE or PREP -> NONE */
+ WARN_ON_ONCE(sta_info_move_smd_state(sta, IEEE80211_STA_SMD_NONE,
+ notify));
+
+ clear_sta_flag(sta, WLAN_STA_SMD_PREP_TARGET);
+ clear_sta_flag(sta, WLAN_STA_SMD_EXEC_CURRENT);
+ clear_sta_flag(sta, WLAN_STA_SMD_DL_DRAIN);
+}
+
+int sta_info_move_drv_smd_state(struct sta_info *sta)
+{
+ enum ieee80211_sta_smd_state new_ss = sta->smd_state;
+ struct ieee80211_local *local = sta->local;
+ int err = 0;
+
+ if (!test_sta_flag(sta, WLAN_STA_INSERTED))
+ return 0;
+
+ switch (new_ss) {
+ case IEEE80211_STA_SMD_PREP:
+ err = drv_sta_smd_state(local, sta->sdata, &sta->sta,
+ IEEE80211_STA_SMD_NONE,
+ IEEE80211_STA_SMD_PREP);
+ if (err)
+ goto rollback;
+ break;
+ case IEEE80211_STA_SMD_EXEC:
+ case IEEE80211_STA_SMD_DRAIN:
+ err = drv_sta_smd_state(local, sta->sdata, &sta->sta,
+ IEEE80211_STA_SMD_NONE,
+ IEEE80211_STA_SMD_EXEC);
+ if (err)
+ goto rollback;
+
+ if (new_ss == IEEE80211_STA_SMD_DRAIN)
+ err = drv_sta_smd_state(local, sta->sdata, &sta->sta,
+ IEEE80211_STA_SMD_EXEC,
+ IEEE80211_STA_SMD_DRAIN);
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ if (!err)
+ return 0;
+
+ /* if EXEC -> DRAIN failed in the driver, notify EXEC -> NONE */
+ WARN_ON_ONCE(drv_sta_smd_state(local, sta->sdata, &sta->sta,
+ IEEE80211_STA_SMD_EXEC,
+ IEEE80211_STA_SMD_NONE));
+
+rollback:
+ sta_info_reset_smd_state(sta, false);
+ return err;
+}
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 89137b18a862..bdc021675727 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -721,6 +721,7 @@ struct ieee80211_sta_removed_link_stats {
* would be assigned to link[link_id] where link_id is the id assigned
* by the AP.
* @rem_link_stats: accumulated removed link stats
+ * @smd_state: Sub-state for STAs in SMD BSS Transition
*/
struct sta_info {
/* General information, mostly static */
@@ -797,6 +798,8 @@ struct sta_info {
struct link_sta_info __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
struct ieee80211_sta_removed_link_stats rem_link_stats;
+ enum ieee80211_sta_smd_state smd_state;
+
/* keep last! */
struct ieee80211_sta sta;
};
@@ -1169,4 +1172,10 @@ static inline u32 sta_stats_encode_rate(struct ieee80211_rx_status *s)
return r;
}
+int sta_info_move_smd_state(struct sta_info *sta,
+ enum ieee80211_sta_smd_state new_ss,
+ bool notify);
+void sta_info_reset_smd_state(struct sta_info *sta, bool notify);
+int sta_info_move_drv_smd_state(struct sta_info *sta);
+
#endif /* STA_INFO_H */
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 562a4964afa3..294a8a44a125 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -3403,6 +3403,39 @@ TRACE_EVENT(drv_nan_peer_sched_changed,
)
);
+TRACE_EVENT(drv_sta_smd_state,
+ TP_PROTO(struct ieee80211_local *local,
+ struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_sta *sta,
+ enum ieee80211_sta_smd_state old_state,
+ enum ieee80211_sta_smd_state new_state),
+
+ TP_ARGS(local, sdata, sta, old_state, new_state),
+
+ TP_STRUCT__entry(
+ LOCAL_ENTRY
+ VIF_ENTRY
+ STA_ENTRY
+ __field(u32, old_state)
+ __field(u32, new_state)
+ ),
+
+ TP_fast_assign(
+ LOCAL_ASSIGN;
+ VIF_ASSIGN;
+ STA_ASSIGN;
+ __entry->old_state = old_state;
+ __entry->new_state = new_state;
+ ),
+
+ TP_printk(
+ LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT
+ " smd_state: %d->%d",
+ LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG,
+ __entry->old_state, __entry->new_state
+ )
+);
+
#endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
#undef TRACE_INCLUDE_PATH
--
2.34.1