net/mac80211/agg-tx.c

   1 /*
   2  * HT handling
   3  *
   4  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   5  * Copyright 2002-2005, Instant802 Networks, Inc.
   6  * Copyright 2005-2006, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9  * Copyright 2007-2010, Intel Corporation
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License version 2 as
  13  * published by the Free Software Foundation.
  14  */
  15
  16 #include <linux/ieee80211.h>
  17 #include <linux/slab.h>
  18 #include <linux/export.h>
  19 #include <net/mac80211.h>
  20 #include "ieee80211_i.h"
  21 #include "driver-ops.h"
  22 #include "wme.h"
  23
  24 /**
  25  * DOC: TX A-MPDU aggregation
  26  *
  27  * Aggregation on the TX side requires setting the hardware flag
  28  * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed
  29  * packets with a flag indicating A-MPDU aggregation. The driver
  30  * or device is responsible for actually aggregating the frames,
  31  * as well as deciding how many and which to aggregate.
  32  *
  33  * When TX aggregation is started by some subsystem (usually the rate
  34  * control algorithm would be appropriate) by calling the
  35  * ieee80211_start_tx_ba_session() function, the driver will be
  36  * notified via its @ampdu_action function, with the
  37  * %IEEE80211_AMPDU_TX_START action.
  38  *
  39  * In response to that, the driver is later required to call the
  40  * ieee80211_start_tx_ba_cb_irqsafe() function, which will really
  41  * start the aggregation session after the peer has also responded.
  42  * If the peer responds negatively, the session will be stopped
  43  * again right away. Note that it is possible for the aggregation
  44  * session to be stopped before the driver has indicated that it
  45  * is done setting it up, in which case it must not indicate the
  46  * setup completion.
  47  *
  48  * Also note that, since we also need to wait for a response from
  49  * the peer, the driver is notified of the completion of the
  50  * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the
  51  * @ampdu_action callback.
  52  *
  53  * Similarly, when the aggregation session is stopped by the peer
  54  * or something calling ieee80211_stop_tx_ba_session(), the driver's
  55  * @ampdu_action function will be called with the action
  56  * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
  57  * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
  58  */
  59
  60 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
  61                                          const u8 *da, u16 tid,
  62                                          u8 dialog_token, u16 start_seq_num,
  63                                          u16 agg_size, u16 timeout)
  64 {
  65         struct ieee80211_local *local = sdata->local;
  66         struct sk_buff *skb;
  67         struct ieee80211_mgmt *mgmt;
  68         u16 capab;
  69
  70         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
  71
  72         if (!skb)
  73                 return;
  74
  75         skb_reserve(skb, local->hw.extra_tx_headroom);
  76         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
  77         memset(mgmt, 0, 24);
  78         memcpy(mgmt->da, da, ETH_ALEN);
  79         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  80         if (sdata->vif.type == NL80211_IFTYPE_AP ||
  81             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  82             sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  83                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  84         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  85                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  86
  87         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  88                                           IEEE80211_STYPE_ACTION);
  89
  90         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
  91
  92         mgmt->u.action.category = WLAN_CATEGORY_BACK;
  93         mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
  94
  95         mgmt->u.action.u.addba_req.dialog_token = dialog_token;
  96         capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
  97         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
  98         capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
  99
 100         mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
 101
 102         mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
 103         mgmt->u.action.u.addba_req.start_seq_num =
 104                                         cpu_to_le16(start_seq_num << 4);
 105
 106         ieee80211_tx_skb(sdata, skb);
 107 }
 108
 109 void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
 110 {
 111         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 112         struct ieee80211_local *local = sdata->local;
 113         struct sk_buff *skb;
 114         struct ieee80211_bar *bar;
 115         u16 bar_control = 0;
 116
 117         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
 118         if (!skb)
 119                 return;
 120
 121         skb_reserve(skb, local->hw.extra_tx_headroom);
 122         bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
 123         memset(bar, 0, sizeof(*bar));
 124         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
 125                                          IEEE80211_STYPE_BACK_REQ);
 126         memcpy(bar->ra, ra, ETH_ALEN);
 127         memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
 128         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
 129         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
 130         bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT);
 131         bar->control = cpu_to_le16(bar_control);
 132         bar->start_seq_num = cpu_to_le16(ssn);
 133
 134         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 135         ieee80211_tx_skb(sdata, skb);
 136 }
 137 EXPORT_SYMBOL(ieee80211_send_bar);
 138
 139 void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
 140                              struct tid_ampdu_tx *tid_tx)
 141 {
 142         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 143         lockdep_assert_held(&sta->lock);
 144         rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 145 }
 146
 147 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 148                                     enum ieee80211_back_parties initiator,
 149                                     bool tx)
 150 {
 151         struct ieee80211_local *local = sta->local;
 152         struct tid_ampdu_tx *tid_tx;
 153         int ret;
 154
 155         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 156
 157         spin_lock_bh(&sta->lock);
 158
 159         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 160         if (!tid_tx) {
 161                 spin_unlock_bh(&sta->lock);
 162                 return -ENOENT;
 163         }
 164
 165         /* if we're already stopping ignore any new requests to stop */
 166         if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
 167                 spin_unlock_bh(&sta->lock);
 168                 return -EALREADY;
 169         }
 170
 171         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
 172                 /* not even started yet! */
 173                 ieee80211_assign_tid_tx(sta, tid, NULL);
 174                 spin_unlock_bh(&sta->lock);
 175                 kfree_rcu(tid_tx, rcu_head);
 176                 return 0;
 177         }
 178
 179         set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
 180
 181         spin_unlock_bh(&sta->lock);
 182
 183 #ifdef CONFIG_MAC80211_HT_DEBUG
 184         printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
 185                sta->sta.addr, tid);
 186 #endif /* CONFIG_MAC80211_HT_DEBUG */
 187
 188         del_timer_sync(&tid_tx->addba_resp_timer);
 189         del_timer_sync(&tid_tx->session_timer);
 190
 191         /*
 192          * After this packets are no longer handed right through
 193          * to the driver but are put onto tid_tx->pending instead,
 194          * with locking to ensure proper access.
 195          */
 196         clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
 197
 198         /*
 199          * There might be a few packets being processed right now (on
 200          * another CPU) that have already gotten past the aggregation
 201          * check when it was still OPERATIONAL and consequently have
 202          * IEEE80211_TX_CTL_AMPDU set. In that case, this code might
 203          * call into the driver at the same time or even before the
 204          * TX paths calls into it, which could confuse the driver.
 205          *
 206          * Wait for all currently running TX paths to finish before
 207          * telling the driver. New packets will not go through since
 208          * the aggregation session is no longer OPERATIONAL.
 209          */
 210         synchronize_net();
 211
 212         tid_tx->stop_initiator = initiator;
 213         tid_tx->tx_stop = tx;
 214
 215         ret = drv_ampdu_action(local, sta->sdata,
 216                                IEEE80211_AMPDU_TX_STOP,
 217                                &sta->sta, tid, NULL, 0);
 218
 219         /* HW shall not deny going back to legacy */
 220         if (WARN_ON(ret)) {
 221                 /*
 222                  * We may have pending packets get stuck in this case...
 223                  * Not bothering with a workaround for now.
 224                  */
 225         }
 226
 227         return ret;
 228 }
 229
 230 /*
 231  * After sending add Block Ack request we activated a timer until
 232  * add Block Ack response will arrive from the recipient.
 233  * If this timer expires sta_addba_resp_timer_expired will be executed.
 234  */
 235 static void sta_addba_resp_timer_expired(unsigned long data)
 236 {
 237         /* not an elegant detour, but there is no choice as the timer passes
 238          * only one argument, and both sta_info and TID are needed, so init
 239          * flow in sta_info_create gives the TID as data, while the timer_to_id
 240          * array gives the sta through container_of */
 241         u16 tid = *(u8 *)data;
 242         struct sta_info *sta = container_of((void *)data,
 243                 struct sta_info, timer_to_tid[tid]);
 244         struct tid_ampdu_tx *tid_tx;
 245
 246         /* check if the TID waits for addBA response */
 247         rcu_read_lock();
 248         tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
 249         if (!tid_tx ||
 250             test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
 251                 rcu_read_unlock();
 252 #ifdef CONFIG_MAC80211_HT_DEBUG
 253                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
 254                                 "(or no longer) expecting addBA response there\n",
 255                         tid);
 256 #endif
 257                 return;
 258         }
 259
 260 #ifdef CONFIG_MAC80211_HT_DEBUG
 261         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
 262 #endif
 263
 264         ieee80211_stop_tx_ba_session(&sta->sta, tid);
 265         rcu_read_unlock();
 266 }
 267
 268 static inline int ieee80211_ac_from_tid(int tid)
 269 {
 270         return ieee802_1d_to_ac[tid & 7];
 271 }
 272
 273 /*
 274  * When multiple aggregation sessions on multiple stations
 275  * are being created/destroyed simultaneously, we need to
 276  * refcount the global queue stop caused by that in order
 277  * to not get into a situation where one of the aggregation
 278  * setup or teardown re-enables queues before the other is
 279  * ready to handle that.
 280  *
 281  * These two functions take care of this issue by keeping
 282  * a global "agg_queue_stop" refcount.
 283  */
 284 static void __acquires(agg_queue)
 285 ieee80211_stop_queue_agg(struct ieee80211_local *local, int tid)
 286 {
 287         int queue = ieee80211_ac_from_tid(tid);
 288
 289         if (atomic_inc_return(&local->agg_queue_stop[queue]) == 1)
 290                 ieee80211_stop_queue_by_reason(
 291                         &local->hw, queue,
 292                         IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 293         __acquire(agg_queue);
 294 }
 295
 296 static void __releases(agg_queue)
 297 ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
 298 {
 299         int queue = ieee80211_ac_from_tid(tid);
 300
 301         if (atomic_dec_return(&local->agg_queue_stop[queue]) == 0)
 302                 ieee80211_wake_queue_by_reason(
 303                         &local->hw, queue,
 304                         IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 305         __release(agg_queue);
 306 }
 307
 308 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 309 {
 310         struct tid_ampdu_tx *tid_tx;
 311         struct ieee80211_local *local = sta->local;
 312         struct ieee80211_sub_if_data *sdata = sta->sdata;
 313         u16 start_seq_num;
 314         int ret;
 315
 316         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 317
 318         /*
 319          * While we're asking the driver about the aggregation,
 320          * stop the AC queue so that we don't have to worry
 321          * about frames that came in while we were doing that,
 322          * which would require us to put them to the AC pending
 323          * afterwards which just makes the code more complex.
 324          */
 325         ieee80211_stop_queue_agg(local, tid);
 326
 327         clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
 328
 329         /*
 330          * make sure no packets are being processed to get
 331          * valid starting sequence number
 332          */
 333         synchronize_net();
 334
 335         start_seq_num = sta->tid_seq[tid] >> 4;
 336
 337         ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
 338                                &sta->sta, tid, &start_seq_num, 0);
 339         if (ret) {
 340 #ifdef CONFIG_MAC80211_HT_DEBUG
 341                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
 342                                         " tid %d\n", tid);
 343 #endif
 344                 spin_lock_bh(&sta->lock);
 345                 ieee80211_assign_tid_tx(sta, tid, NULL);
 346                 spin_unlock_bh(&sta->lock);
 347
 348                 ieee80211_wake_queue_agg(local, tid);
 349                 kfree_rcu(tid_tx, rcu_head);
 350                 return;
 351         }
 352
 353         /* we can take packets again now */
 354         ieee80211_wake_queue_agg(local, tid);
 355
 356         /* activate the timer for the recipient's addBA response */
 357         mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
 358 #ifdef CONFIG_MAC80211_HT_DEBUG
 359         printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
 360 #endif
 361
 362         spin_lock_bh(&sta->lock);
 363         sta->ampdu_mlme.addba_req_num[tid]++;
 364         spin_unlock_bh(&sta->lock);
 365
 366         /* send AddBA request */
 367         ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
 368                                      tid_tx->dialog_token, start_seq_num,
 369                                      local->hw.max_tx_aggregation_subframes,
 370                                      tid_tx->timeout);
 371 }
 372
 373 /*
 374  * After accepting the AddBA Response we activated a timer,
 375  * resetting it after each frame that we send.
 376  */
 377 static void sta_tx_agg_session_timer_expired(unsigned long data)
 378 {
 379         /* not an elegant detour, but there is no choice as the timer passes
 380          * only one argument, and various sta_info are needed here, so init
 381          * flow in sta_info_create gives the TID as data, while the timer_to_id
 382          * array gives the sta through container_of */
 383         u8 *ptid = (u8 *)data;
 384         u8 *timer_to_id = ptid - *ptid;
 385         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
 386                                          timer_to_tid[0]);
 387
 388 #ifdef CONFIG_MAC80211_HT_DEBUG
 389         printk(KERN_DEBUG "tx session timer expired on tid %d\n", (u16)*ptid);
 390 #endif
 391
 392         ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
 393 }
 394
 395 int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 396                                   u16 timeout)
 397 {
 398         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
 399         struct ieee80211_sub_if_data *sdata = sta->sdata;
 400         struct ieee80211_local *local = sdata->local;
 401         struct tid_ampdu_tx *tid_tx;
 402         int ret = 0;
 403
 404         trace_api_start_tx_ba_session(pubsta, tid);
 405
 406         if (WARN_ON(!local->ops->ampdu_action))
 407                 return -EINVAL;
 408
 409         if ((tid >= STA_TID_NUM) ||
 410             !(local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) ||
 411             (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW))
 412                 return -EINVAL;
 413
 414 #ifdef CONFIG_MAC80211_HT_DEBUG
 415         printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
 416                pubsta->addr, tid);
 417 #endif /* CONFIG_MAC80211_HT_DEBUG */
 418
 419         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
 420             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
 421             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 422             sdata->vif.type != NL80211_IFTYPE_AP)
 423                 return -EINVAL;
 424
 425         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
 426 #ifdef CONFIG_MAC80211_HT_DEBUG
 427                 printk(KERN_DEBUG "BA sessions blocked. "
 428                        "Denying BA session request\n");
 429 #endif
 430                 return -EINVAL;
 431         }
 432
 433         spin_lock_bh(&sta->lock);
 434
 435         /* we have tried too many times, receiver does not want A-MPDU */
 436         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
 437                 ret = -EBUSY;
 438                 goto err_unlock_sta;
 439         }
 440
 441         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 442         /* check if the TID is not in aggregation flow already */
 443         if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
 444 #ifdef CONFIG_MAC80211_HT_DEBUG
 445                 printk(KERN_DEBUG "BA request denied - session is not "
 446                                  "idle on tid %u\n", tid);
 447 #endif /* CONFIG_MAC80211_HT_DEBUG */
 448                 ret = -EAGAIN;
 449                 goto err_unlock_sta;
 450         }
 451
 452         /* prepare A-MPDU MLME for Tx aggregation */
 453         tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
 454         if (!tid_tx) {
 455                 ret = -ENOMEM;
 456                 goto err_unlock_sta;
 457         }
 458
 459         skb_queue_head_init(&tid_tx->pending);
 460         __set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
 461
 462         tid_tx->timeout = timeout;
 463
 464         /* response timer */
 465         tid_tx->addba_resp_timer.function = sta_addba_resp_timer_expired;
 466         tid_tx->addba_resp_timer.data = (unsigned long)&sta->timer_to_tid[tid];
 467         init_timer(&tid_tx->addba_resp_timer);
 468
 469         /* tx timer */
 470         tid_tx->session_timer.function = sta_tx_agg_session_timer_expired;
 471         tid_tx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
 472         init_timer(&tid_tx->session_timer);
 473
 474         /* assign a dialog token */
 475         sta->ampdu_mlme.dialog_token_allocator++;
 476         tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
 477
 478         /*
 479          * Finally, assign it to the start array; the work item will
 480          * collect it and move it to the normal array.
 481          */
 482         sta->ampdu_mlme.tid_start_tx[tid] = tid_tx;
 483
 484         ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
 485
 486         /* this flow continues off the work */
 487  err_unlock_sta:
 488         spin_unlock_bh(&sta->lock);
 489         return ret;
 490 }
 491 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
 492
 493 /*
 494  * splice packets from the STA's pending to the local pending,
 495  * requires a call to ieee80211_agg_splice_finish later
 496  */
 497 static void __acquires(agg_queue)
 498 ieee80211_agg_splice_packets(struct ieee80211_local *local,
 499                              struct tid_ampdu_tx *tid_tx, u16 tid)
 500 {
 501         int queue = ieee80211_ac_from_tid(tid);
 502         unsigned long flags;
 503
 504         ieee80211_stop_queue_agg(local, tid);
 505
 506         if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
 507                           " from the pending queue\n", tid))
 508                 return;
 509
 510         if (!skb_queue_empty(&tid_tx->pending)) {
 511                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 512                 /* copy over remaining packets */
 513                 skb_queue_splice_tail_init(&tid_tx->pending,
 514                                            &local->pending[queue]);
 515                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 516         }
 517 }
 518
 519 static void __releases(agg_queue)
 520 ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
 521 {
 522         ieee80211_wake_queue_agg(local, tid);
 523 }
 524
 525 static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
 526                                          struct sta_info *sta, u16 tid)
 527 {
 528         struct tid_ampdu_tx *tid_tx;
 529
 530         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 531
 532         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 533
 534 #ifdef CONFIG_MAC80211_HT_DEBUG
 535         printk(KERN_DEBUG "Aggregation is on for tid %d\n", tid);
 536 #endif
 537
 538         drv_ampdu_action(local, sta->sdata,
 539                          IEEE80211_AMPDU_TX_OPERATIONAL,
 540                          &sta->sta, tid, NULL, tid_tx->buf_size);
 541
 542         /*
 543          * synchronize with TX path, while splicing the TX path
 544          * should block so it won't put more packets onto pending.
 545          */
 546         spin_lock_bh(&sta->lock);
 547
 548         ieee80211_agg_splice_packets(local, tid_tx, tid);
 549         /*
 550          * Now mark as operational. This will be visible
 551          * in the TX path, and lets it go lock-free in
 552          * the common case.
 553          */
 554         set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
 555         ieee80211_agg_splice_finish(local, tid);
 556
 557         spin_unlock_bh(&sta->lock);
 558 }
 559
 560 void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
 561 {
 562         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 563         struct ieee80211_local *local = sdata->local;
 564         struct sta_info *sta;
 565         struct tid_ampdu_tx *tid_tx;
 566
 567         trace_api_start_tx_ba_cb(sdata, ra, tid);
 568
 569         if (tid >= STA_TID_NUM) {
 570 #ifdef CONFIG_MAC80211_HT_DEBUG
 571                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
 572                                 tid, STA_TID_NUM);
 573 #endif
 574                 return;
 575         }
 576
 577         mutex_lock(&local->sta_mtx);
 578         sta = sta_info_get_bss(sdata, ra);
 579         if (!sta) {
 580                 mutex_unlock(&local->sta_mtx);
 581 #ifdef CONFIG_MAC80211_HT_DEBUG
 582                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 583 #endif
 584                 return;
 585         }
 586
 587         mutex_lock(&sta->ampdu_mlme.mtx);
 588         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 589
 590         if (WARN_ON(!tid_tx)) {
 591 #ifdef CONFIG_MAC80211_HT_DEBUG
 592                 printk(KERN_DEBUG "addBA was not requested!\n");
 593 #endif
 594                 goto unlock;
 595         }
 596
 597         if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
 598                 goto unlock;
 599
 600         if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
 601                 ieee80211_agg_tx_operational(local, sta, tid);
 602
 603  unlock:
 604         mutex_unlock(&sta->ampdu_mlme.mtx);
 605         mutex_unlock(&local->sta_mtx);
 606 }
 607
 608 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 609                                       const u8 *ra, u16 tid)
 610 {
 611         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 612         struct ieee80211_local *local = sdata->local;
 613         struct ieee80211_ra_tid *ra_tid;
 614         struct sk_buff *skb = dev_alloc_skb(0);
 615
 616         if (unlikely(!skb))
 617                 return;
 618
 619         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
 620         memcpy(&ra_tid->ra, ra, ETH_ALEN);
 621         ra_tid->tid = tid;
 622
 623         skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
 624         skb_queue_tail(&sdata->skb_queue, skb);
 625         ieee80211_queue_work(&local->hw, &sdata->work);
 626 }
 627 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 628
 629 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 630                                    enum ieee80211_back_parties initiator,
 631                                    bool tx)
 632 {
 633         int ret;
 634
 635         mutex_lock(&sta->ampdu_mlme.mtx);
 636
 637         ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator, tx);
 638
 639         mutex_unlock(&sta->ampdu_mlme.mtx);
 640
 641         return ret;
 642 }
 643
 644 int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 645 {
 646         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
 647         struct ieee80211_sub_if_data *sdata = sta->sdata;
 648         struct ieee80211_local *local = sdata->local;
 649         struct tid_ampdu_tx *tid_tx;
 650         int ret = 0;
 651
 652         trace_api_stop_tx_ba_session(pubsta, tid);
 653
 654         if (!local->ops->ampdu_action)
 655                 return -EINVAL;
 656
 657         if (tid >= STA_TID_NUM)
 658                 return -EINVAL;
 659
 660         spin_lock_bh(&sta->lock);
 661         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 662
 663         if (!tid_tx) {
 664                 ret = -ENOENT;
 665                 goto unlock;
 666         }
 667
 668         if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
 669                 /* already in progress stopping it */
 670                 ret = 0;
 671                 goto unlock;
 672         }
 673
 674         set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state);
 675         ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
 676
 677  unlock:
 678         spin_unlock_bh(&sta->lock);
 679         return ret;
 680 }
 681 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 682
 683 void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
 684 {
 685         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 686         struct ieee80211_local *local = sdata->local;
 687         struct sta_info *sta;
 688         struct tid_ampdu_tx *tid_tx;
 689
 690         trace_api_stop_tx_ba_cb(sdata, ra, tid);
 691
 692         if (tid >= STA_TID_NUM) {
 693 #ifdef CONFIG_MAC80211_HT_DEBUG
 694                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
 695                                 tid, STA_TID_NUM);
 696 #endif
 697                 return;
 698         }
 699
 700 #ifdef CONFIG_MAC80211_HT_DEBUG
 701         printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
 702                ra, tid);
 703 #endif /* CONFIG_MAC80211_HT_DEBUG */
 704
 705         mutex_lock(&local->sta_mtx);
 706
 707         sta = sta_info_get_bss(sdata, ra);
 708         if (!sta) {
 709 #ifdef CONFIG_MAC80211_HT_DEBUG
 710                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 711 #endif
 712                 goto unlock;
 713         }
 714
 715         mutex_lock(&sta->ampdu_mlme.mtx);
 716         spin_lock_bh(&sta->lock);
 717         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 718
 719         if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
 720 #ifdef CONFIG_MAC80211_HT_DEBUG
 721                 printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
 722 #endif
 723                 goto unlock_sta;
 724         }
 725
 726         if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR && tid_tx->tx_stop)
 727                 ieee80211_send_delba(sta->sdata, ra, tid,
 728                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 729
 730         /*
 731          * When we get here, the TX path will not be lockless any more wrt.
 732          * aggregation, since the OPERATIONAL bit has long been cleared.
 733          * Thus it will block on getting the lock, if it occurs. So if we
 734          * stop the queue now, we will not get any more packets, and any
 735          * that might be being processed will wait for us here, thereby
 736          * guaranteeing that no packets go to the tid_tx pending queue any
 737          * more.
 738          */
 739
 740         ieee80211_agg_splice_packets(local, tid_tx, tid);
 741
 742         /* future packets must not find the tid_tx struct any more */
 743         ieee80211_assign_tid_tx(sta, tid, NULL);
 744
 745         ieee80211_agg_splice_finish(local, tid);
 746
 747         kfree_rcu(tid_tx, rcu_head);
 748
 749  unlock_sta:
 750         spin_unlock_bh(&sta->lock);
 751         mutex_unlock(&sta->ampdu_mlme.mtx);
 752  unlock:
 753         mutex_unlock(&local->sta_mtx);
 754 }
 755
 756 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 757                                      const u8 *ra, u16 tid)
 758 {
 759         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 760         struct ieee80211_local *local = sdata->local;
 761         struct ieee80211_ra_tid *ra_tid;
 762         struct sk_buff *skb = dev_alloc_skb(0);
 763
 764         if (unlikely(!skb))
 765                 return;
 766
 767         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
 768         memcpy(&ra_tid->ra, ra, ETH_ALEN);
 769         ra_tid->tid = tid;
 770
 771         skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
 772         skb_queue_tail(&sdata->skb_queue, skb);
 773         ieee80211_queue_work(&local->hw, &sdata->work);
 774 }
 775 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
 776
 777
 778 void ieee80211_process_addba_resp(struct ieee80211_local *local,
 779                                   struct sta_info *sta,
 780                                   struct ieee80211_mgmt *mgmt,
 781                                   size_t len)
 782 {
 783         struct tid_ampdu_tx *tid_tx;
 784         u16 capab, tid;
 785         u8 buf_size;
 786
 787         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
 788         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
 789         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
 790
 791         mutex_lock(&sta->ampdu_mlme.mtx);
 792
 793         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 794         if (!tid_tx)
 795                 goto out;
 796
 797         if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
 798 #ifdef CONFIG_MAC80211_HT_DEBUG
 799                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
 800 #endif
 801                 goto out;
 802         }
 803
 804         del_timer_sync(&tid_tx->addba_resp_timer);
 805
 806 #ifdef CONFIG_MAC80211_HT_DEBUG
 807         printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
 808 #endif
 809
 810         /*
 811          * addba_resp_timer may have fired before we got here, and
 812          * caused WANT_STOP to be set. If the stop then was already
 813          * processed further, STOPPING might be set.
 814          */
 815         if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
 816             test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
 817 #ifdef CONFIG_MAC80211_HT_DEBUG
 818                 printk(KERN_DEBUG
 819                        "got addBA resp for tid %d but we already gave up\n",
 820                        tid);
 821 #endif
 822                 goto out;
 823         }
 824
 825         /*
 826          * IEEE 802.11-2007 7.3.1.14:
 827          * In an ADDBA Response frame, when the Status Code field
 828          * is set to 0, the Buffer Size subfield is set to a value
 829          * of at least 1.
 830          */
 831         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
 832                         == WLAN_STATUS_SUCCESS && buf_size) {
 833                 if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
 834                                      &tid_tx->state)) {
 835                         /* ignore duplicate response */
 836                         goto out;
 837                 }
 838
 839                 tid_tx->buf_size = buf_size;
 840
 841                 if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
 842                         ieee80211_agg_tx_operational(local, sta, tid);
 843
 844                 sta->ampdu_mlme.addba_req_num[tid] = 0;
 845
 846                 if (tid_tx->timeout)
 847                         mod_timer(&tid_tx->session_timer,
 848                                   TU_TO_EXP_TIME(tid_tx->timeout));
 849
 850         } else {
 851                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
 852                                                 true);
 853         }
 854
 855  out:
 856         mutex_unlock(&sta->ampdu_mlme.mtx);
 857 }