1/* 2 * HT handling 3 * 4 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 5 * Copyright 2002-2005, Instant802 Networks, Inc. 6 * Copyright 2005-2006, Devicescape Software, Inc. 7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 9 * Copyright 2007-2010, Intel Corporation 10 * 11 * This program is free software; you can redistribute it and/or modify 12 * it under the terms of the GNU General Public License version 2 as 13 * published by the Free Software Foundation. 14 */ 15 16#include <linux/ieee80211.h> 17#include <linux/slab.h> 18#include <linux/export.h> 19#include <net/mac80211.h> 20#include "ieee80211_i.h" 21#include "driver-ops.h" 22#include "wme.h" 23 24/** 25 * DOC: TX A-MPDU aggregation 26 * 27 * Aggregation on the TX side requires setting the hardware flag 28 * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed 29 * packets with a flag indicating A-MPDU aggregation. The driver 30 * or device is responsible for actually aggregating the frames, 31 * as well as deciding how many and which to aggregate. 32 * 33 * When TX aggregation is started by some subsystem (usually the rate 34 * control algorithm would be appropriate) by calling the 35 * ieee80211_start_tx_ba_session() function, the driver will be 36 * notified via its @ampdu_action function, with the 37 * %IEEE80211_AMPDU_TX_START action. 38 * 39 * In response to that, the driver is later required to call the 40 * ieee80211_start_tx_ba_cb_irqsafe() function, which will really 41 * start the aggregation session after the peer has also responded. 42 * If the peer responds negatively, the session will be stopped 43 * again right away. Note that it is possible for the aggregation 44 * session to be stopped before the driver has indicated that it 45 * is done setting it up, in which case it must not indicate the 46 * setup completion. 47 * 48 * Also note that, since we also need to wait for a response from 49 * the peer, the driver is notified of the completion of the 50 * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the 51 * @ampdu_action callback. 52 * 53 * Similarly, when the aggregation session is stopped by the peer 54 * or something calling ieee80211_stop_tx_ba_session(), the driver's 55 * @ampdu_action function will be called with the action 56 * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail, 57 * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe(). 58 * Note that the sta can get destroyed before the BA tear down is 59 * complete. 60 */ 61 62static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata, 63 const u8 *da, u16 tid, 64 u8 dialog_token, u16 start_seq_num, 65 u16 agg_size, u16 timeout) 66{ 67 struct ieee80211_local *local = sdata->local; 68 struct sk_buff *skb; 69 struct ieee80211_mgmt *mgmt; 70 u16 capab; 71 72 skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom); 73 74 if (!skb) 75 return; 76 77 skb_reserve(skb, local->hw.extra_tx_headroom); 78 mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24); 79 memset(mgmt, 0, 24); 80 memcpy(mgmt->da, da, ETH_ALEN); 81 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); 82 if (sdata->vif.type == NL80211_IFTYPE_AP || 83 sdata->vif.type == NL80211_IFTYPE_AP_VLAN || 84 sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 85 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN); 86 else if (sdata->vif.type == NL80211_IFTYPE_STATION) 87 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN); 88 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 89 memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN); 90 91 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 92 IEEE80211_STYPE_ACTION); 93 94 skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req)); 95 96 mgmt->u.action.category = WLAN_CATEGORY_BACK; 97 mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ; 98 99 mgmt->u.action.u.addba_req.dialog_token = dialog_token; 100 capab = (u16)(1 << 1); /* bit 1 aggregation policy */ 101 capab |= (u16)(tid << 2); /* bit 5:2 TID number */ 102 capab |= (u16)(agg_size << 6); /* bit 15:6 max size of aggergation */ 103 104 mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab); 105 106 mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout); 107 mgmt->u.action.u.addba_req.start_seq_num = 108 cpu_to_le16(start_seq_num << 4); 109 110 ieee80211_tx_skb(sdata, skb); 111} 112 113void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn) 114{ 115 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 116 struct ieee80211_local *local = sdata->local; 117 struct sk_buff *skb; 118 struct ieee80211_bar *bar; 119 u16 bar_control = 0; 120 121 skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom); 122 if (!skb) 123 return; 124 125 skb_reserve(skb, local->hw.extra_tx_headroom); 126 bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar)); 127 memset(bar, 0, sizeof(*bar)); 128 bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL | 129 IEEE80211_STYPE_BACK_REQ); 130 memcpy(bar->ra, ra, ETH_ALEN); 131 memcpy(bar->ta, sdata->vif.addr, ETH_ALEN); 132 bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL; 133 bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA; 134 bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT); 135 bar->control = cpu_to_le16(bar_control); 136 bar->start_seq_num = cpu_to_le16(ssn); 137 138 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT | 139 IEEE80211_TX_CTL_REQ_TX_STATUS; 140 ieee80211_tx_skb_tid(sdata, skb, tid); 141} 142EXPORT_SYMBOL(ieee80211_send_bar); 143 144void ieee80211_assign_tid_tx(struct sta_info *sta, int tid, 145 struct tid_ampdu_tx *tid_tx) 146{ 147 lockdep_assert_held(&sta->ampdu_mlme.mtx); 148 lockdep_assert_held(&sta->lock); 149 rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx); 150} 151 152/* 153 * When multiple aggregation sessions on multiple stations 154 * are being created/destroyed simultaneously, we need to 155 * refcount the global queue stop caused by that in order 156 * to not get into a situation where one of the aggregation 157 * setup or teardown re-enables queues before the other is 158 * ready to handle that. 159 * 160 * These two functions take care of this issue by keeping 161 * a global "agg_queue_stop" refcount. 162 */ 163static void __acquires(agg_queue) 164ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid) 165{ 166 int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)]; 167 168 /* we do refcounting here, so don't use the queue reason refcounting */ 169 170 if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1) 171 ieee80211_stop_queue_by_reason( 172 &sdata->local->hw, queue, 173 IEEE80211_QUEUE_STOP_REASON_AGGREGATION, 174 false); 175 __acquire(agg_queue); 176} 177 178static void __releases(agg_queue) 179ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid) 180{ 181 int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)]; 182 183 if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0) 184 ieee80211_wake_queue_by_reason( 185 &sdata->local->hw, queue, 186 IEEE80211_QUEUE_STOP_REASON_AGGREGATION, 187 false); 188 __release(agg_queue); 189} 190 191static void 192ieee80211_agg_stop_txq(struct sta_info *sta, int tid) 193{ 194 struct ieee80211_txq *txq = sta->sta.txq[tid]; 195 struct txq_info *txqi; 196 197 if (!txq) 198 return; 199 200 txqi = to_txq_info(txq); 201 202 /* Lock here to protect against further seqno updates on dequeue */ 203 spin_lock_bh(&txqi->queue.lock); 204 set_bit(IEEE80211_TXQ_STOP, &txqi->flags); 205 spin_unlock_bh(&txqi->queue.lock); 206} 207 208static void 209ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable) 210{ 211 struct ieee80211_txq *txq = sta->sta.txq[tid]; 212 struct txq_info *txqi; 213 214 if (!txq) 215 return; 216 217 txqi = to_txq_info(txq); 218 219 if (enable) 220 set_bit(IEEE80211_TXQ_AMPDU, &txqi->flags); 221 else 222 clear_bit(IEEE80211_TXQ_AMPDU, &txqi->flags); 223 224 clear_bit(IEEE80211_TXQ_STOP, &txqi->flags); 225 drv_wake_tx_queue(sta->sdata->local, txqi); 226} 227 228/* 229 * splice packets from the STA's pending to the local pending, 230 * requires a call to ieee80211_agg_splice_finish later 231 */ 232static void __acquires(agg_queue) 233ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata, 234 struct tid_ampdu_tx *tid_tx, u16 tid) 235{ 236 struct ieee80211_local *local = sdata->local; 237 int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)]; 238 unsigned long flags; 239 240 ieee80211_stop_queue_agg(sdata, tid); 241 242 if (WARN(!tid_tx, 243 "TID %d gone but expected when splicing aggregates from the pending queue\n", 244 tid)) 245 return; 246 247 if (!skb_queue_empty(&tid_tx->pending)) { 248 spin_lock_irqsave(&local->queue_stop_reason_lock, flags); 249 /* copy over remaining packets */ 250 skb_queue_splice_tail_init(&tid_tx->pending, 251 &local->pending[queue]); 252 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); 253 } 254} 255 256static void __releases(agg_queue) 257ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid) 258{ 259 ieee80211_wake_queue_agg(sdata, tid); 260} 261 262static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid) 263{ 264 struct tid_ampdu_tx *tid_tx; 265 266 lockdep_assert_held(&sta->ampdu_mlme.mtx); 267 lockdep_assert_held(&sta->lock); 268 269 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 270 271 /* 272 * When we get here, the TX path will not be lockless any more wrt. 273 * aggregation, since the OPERATIONAL bit has long been cleared. 274 * Thus it will block on getting the lock, if it occurs. So if we 275 * stop the queue now, we will not get any more packets, and any 276 * that might be being processed will wait for us here, thereby 277 * guaranteeing that no packets go to the tid_tx pending queue any 278 * more. 279 */ 280 281 ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid); 282 283 /* future packets must not find the tid_tx struct any more */ 284 ieee80211_assign_tid_tx(sta, tid, NULL); 285 286 ieee80211_agg_splice_finish(sta->sdata, tid); 287 ieee80211_agg_start_txq(sta, tid, false); 288 289 kfree_rcu(tid_tx, rcu_head); 290} 291 292int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, 293 enum ieee80211_agg_stop_reason reason) 294{ 295 struct ieee80211_local *local = sta->local; 296 struct tid_ampdu_tx *tid_tx; 297 enum ieee80211_ampdu_mlme_action action; 298 int ret; 299 300 lockdep_assert_held(&sta->ampdu_mlme.mtx); 301 302 switch (reason) { 303 case AGG_STOP_DECLINED: 304 case AGG_STOP_LOCAL_REQUEST: 305 case AGG_STOP_PEER_REQUEST: 306 action = IEEE80211_AMPDU_TX_STOP_CONT; 307 break; 308 case AGG_STOP_DESTROY_STA: 309 action = IEEE80211_AMPDU_TX_STOP_FLUSH; 310 break; 311 default: 312 WARN_ON_ONCE(1); 313 return -EINVAL; 314 } 315 316 spin_lock_bh(&sta->lock); 317 318 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 319 if (!tid_tx) { 320 spin_unlock_bh(&sta->lock); 321 return -ENOENT; 322 } 323 324 /* 325 * if we're already stopping ignore any new requests to stop 326 * unless we're destroying it in which case notify the driver 327 */ 328 if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 329 spin_unlock_bh(&sta->lock); 330 if (reason != AGG_STOP_DESTROY_STA) 331 return -EALREADY; 332 ret = drv_ampdu_action(local, sta->sdata, 333 IEEE80211_AMPDU_TX_STOP_FLUSH_CONT, 334 &sta->sta, tid, NULL, 0); 335 WARN_ON_ONCE(ret); 336 return 0; 337 } 338 339 if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) { 340 /* not even started yet! */ 341 ieee80211_assign_tid_tx(sta, tid, NULL); 342 spin_unlock_bh(&sta->lock); 343 kfree_rcu(tid_tx, rcu_head); 344 return 0; 345 } 346 347 set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state); 348 349 spin_unlock_bh(&sta->lock); 350 351 ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n", 352 sta->sta.addr, tid); 353 354 del_timer_sync(&tid_tx->addba_resp_timer); 355 del_timer_sync(&tid_tx->session_timer); 356 357 /* 358 * After this packets are no longer handed right through 359 * to the driver but are put onto tid_tx->pending instead, 360 * with locking to ensure proper access. 361 */ 362 clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state); 363 364 /* 365 * There might be a few packets being processed right now (on 366 * another CPU) that have already gotten past the aggregation 367 * check when it was still OPERATIONAL and consequently have 368 * IEEE80211_TX_CTL_AMPDU set. In that case, this code might 369 * call into the driver at the same time or even before the 370 * TX paths calls into it, which could confuse the driver. 371 * 372 * Wait for all currently running TX paths to finish before 373 * telling the driver. New packets will not go through since 374 * the aggregation session is no longer OPERATIONAL. 375 */ 376 synchronize_net(); 377 378 tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ? 379 WLAN_BACK_RECIPIENT : 380 WLAN_BACK_INITIATOR; 381 tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST; 382 383 ret = drv_ampdu_action(local, sta->sdata, action, 384 &sta->sta, tid, NULL, 0); 385 386 /* HW shall not deny going back to legacy */ 387 if (WARN_ON(ret)) { 388 /* 389 * We may have pending packets get stuck in this case... 390 * Not bothering with a workaround for now. 391 */ 392 } 393 394 /* 395 * In the case of AGG_STOP_DESTROY_STA, the driver won't 396 * necessarily call ieee80211_stop_tx_ba_cb(), so this may 397 * seem like we can leave the tid_tx data pending forever. 398 * This is true, in a way, but "forever" is only until the 399 * station struct is actually destroyed. In the meantime, 400 * leaving it around ensures that we don't transmit packets 401 * to the driver on this TID which might confuse it. 402 */ 403 404 return 0; 405} 406 407/* 408 * After sending add Block Ack request we activated a timer until 409 * add Block Ack response will arrive from the recipient. 410 * If this timer expires sta_addba_resp_timer_expired will be executed. 411 */ 412static void sta_addba_resp_timer_expired(unsigned long data) 413{ 414 /* not an elegant detour, but there is no choice as the timer passes 415 * only one argument, and both sta_info and TID are needed, so init 416 * flow in sta_info_create gives the TID as data, while the timer_to_id 417 * array gives the sta through container_of */ 418 u16 tid = *(u8 *)data; 419 struct sta_info *sta = container_of((void *)data, 420 struct sta_info, timer_to_tid[tid]); 421 struct tid_ampdu_tx *tid_tx; 422 423 /* check if the TID waits for addBA response */ 424 rcu_read_lock(); 425 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]); 426 if (!tid_tx || 427 test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) { 428 rcu_read_unlock(); 429 ht_dbg(sta->sdata, 430 "timer expired on %pM tid %d but we are not (or no longer) expecting addBA response there\n", 431 sta->sta.addr, tid); 432 return; 433 } 434 435 ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n", 436 sta->sta.addr, tid); 437 438 ieee80211_stop_tx_ba_session(&sta->sta, tid); 439 rcu_read_unlock(); 440} 441 442void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) 443{ 444 struct tid_ampdu_tx *tid_tx; 445 struct ieee80211_local *local = sta->local; 446 struct ieee80211_sub_if_data *sdata = sta->sdata; 447 u16 start_seq_num; 448 int ret; 449 450 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 451 452 /* 453 * Start queuing up packets for this aggregation session. 454 * We're going to release them once the driver is OK with 455 * that. 456 */ 457 clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state); 458 459 ieee80211_agg_stop_txq(sta, tid); 460 461 /* 462 * Make sure no packets are being processed. This ensures that 463 * we have a valid starting sequence number and that in-flight 464 * packets have been flushed out and no packets for this TID 465 * will go into the driver during the ampdu_action call. 466 */ 467 synchronize_net(); 468 469 start_seq_num = sta->tid_seq[tid] >> 4; 470 471 ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START, 472 &sta->sta, tid, &start_seq_num, 0); 473 if (ret) { 474 ht_dbg(sdata, 475 "BA request denied - HW unavailable for %pM tid %d\n", 476 sta->sta.addr, tid); 477 spin_lock_bh(&sta->lock); 478 ieee80211_agg_splice_packets(sdata, tid_tx, tid); 479 ieee80211_assign_tid_tx(sta, tid, NULL); 480 ieee80211_agg_splice_finish(sdata, tid); 481 spin_unlock_bh(&sta->lock); 482 483 ieee80211_agg_start_txq(sta, tid, false); 484 485 kfree_rcu(tid_tx, rcu_head); 486 return; 487 } 488 489 /* activate the timer for the recipient's addBA response */ 490 mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL); 491 ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n", 492 sta->sta.addr, tid); 493 494 spin_lock_bh(&sta->lock); 495 sta->ampdu_mlme.last_addba_req_time[tid] = jiffies; 496 sta->ampdu_mlme.addba_req_num[tid]++; 497 spin_unlock_bh(&sta->lock); 498 499 /* send AddBA request */ 500 ieee80211_send_addba_request(sdata, sta->sta.addr, tid, 501 tid_tx->dialog_token, start_seq_num, 502 local->hw.max_tx_aggregation_subframes, 503 tid_tx->timeout); 504} 505 506/* 507 * After accepting the AddBA Response we activated a timer, 508 * resetting it after each frame that we send. 509 */ 510static void sta_tx_agg_session_timer_expired(unsigned long data) 511{ 512 /* not an elegant detour, but there is no choice as the timer passes 513 * only one argument, and various sta_info are needed here, so init 514 * flow in sta_info_create gives the TID as data, while the timer_to_id 515 * array gives the sta through container_of */ 516 u8 *ptid = (u8 *)data; 517 u8 *timer_to_id = ptid - *ptid; 518 struct sta_info *sta = container_of(timer_to_id, struct sta_info, 519 timer_to_tid[0]); 520 struct tid_ampdu_tx *tid_tx; 521 unsigned long timeout; 522 523 rcu_read_lock(); 524 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[*ptid]); 525 if (!tid_tx || test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 526 rcu_read_unlock(); 527 return; 528 } 529 530 timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout); 531 if (time_is_after_jiffies(timeout)) { 532 mod_timer(&tid_tx->session_timer, timeout); 533 rcu_read_unlock(); 534 return; 535 } 536 537 rcu_read_unlock(); 538 539 ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n", 540 sta->sta.addr, (u16)*ptid); 541 542 ieee80211_stop_tx_ba_session(&sta->sta, *ptid); 543} 544 545int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid, 546 u16 timeout) 547{ 548 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 549 struct ieee80211_sub_if_data *sdata = sta->sdata; 550 struct ieee80211_local *local = sdata->local; 551 struct tid_ampdu_tx *tid_tx; 552 int ret = 0; 553 554 trace_api_start_tx_ba_session(pubsta, tid); 555 556 if (WARN(sta->reserved_tid == tid, 557 "Requested to start BA session on reserved tid=%d", tid)) 558 return -EINVAL; 559 560 if (!pubsta->ht_cap.ht_supported) 561 return -EINVAL; 562 563 if (WARN_ON_ONCE(!local->ops->ampdu_action)) 564 return -EINVAL; 565 566 if ((tid >= IEEE80211_NUM_TIDS) || 567 !(local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) || 568 (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)) 569 return -EINVAL; 570 571 ht_dbg(sdata, "Open BA session requested for %pM tid %u\n", 572 pubsta->addr, tid); 573 574 if (sdata->vif.type != NL80211_IFTYPE_STATION && 575 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 576 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 577 sdata->vif.type != NL80211_IFTYPE_AP && 578 sdata->vif.type != NL80211_IFTYPE_ADHOC) 579 return -EINVAL; 580 581 if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) { 582 ht_dbg(sdata, 583 "BA sessions blocked - Denying BA session request %pM tid %d\n", 584 sta->sta.addr, tid); 585 return -EINVAL; 586 } 587 588 /* 589 * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a 590 * member of an IBSS, and has no other existing Block Ack agreement 591 * with the recipient STA, then the initiating STA shall transmit a 592 * Probe Request frame to the recipient STA and shall not transmit an 593 * ADDBA Request frame unless it receives a Probe Response frame 594 * from the recipient within dot11ADDBAFailureTimeout. 595 * 596 * The probe request mechanism for ADDBA is currently not implemented, 597 * but we only build up Block Ack session with HT STAs. This information 598 * is set when we receive a bss info from a probe response or a beacon. 599 */ 600 if (sta->sdata->vif.type == NL80211_IFTYPE_ADHOC && 601 !sta->sta.ht_cap.ht_supported) { 602 ht_dbg(sdata, 603 "BA request denied - IBSS STA %pM does not advertise HT support\n", 604 pubsta->addr); 605 return -EINVAL; 606 } 607 608 spin_lock_bh(&sta->lock); 609 610 /* we have tried too many times, receiver does not want A-MPDU */ 611 if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) { 612 ret = -EBUSY; 613 goto err_unlock_sta; 614 } 615 616 /* 617 * if we have tried more than HT_AGG_BURST_RETRIES times we 618 * will spread our requests in time to avoid stalling connection 619 * for too long 620 */ 621 if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_BURST_RETRIES && 622 time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] + 623 HT_AGG_RETRIES_PERIOD)) { 624 ht_dbg(sdata, 625 "BA request denied - waiting a grace period after %d failed requests on %pM tid %u\n", 626 sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid); 627 ret = -EBUSY; 628 goto err_unlock_sta; 629 } 630 631 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 632 /* check if the TID is not in aggregation flow already */ 633 if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) { 634 ht_dbg(sdata, 635 "BA request denied - session is not idle on %pM tid %u\n", 636 sta->sta.addr, tid); 637 ret = -EAGAIN; 638 goto err_unlock_sta; 639 } 640 641 /* prepare A-MPDU MLME for Tx aggregation */ 642 tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC); 643 if (!tid_tx) { 644 ret = -ENOMEM; 645 goto err_unlock_sta; 646 } 647 648 skb_queue_head_init(&tid_tx->pending); 649 __set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state); 650 651 tid_tx->timeout = timeout; 652 653 /* response timer */ 654 tid_tx->addba_resp_timer.function = sta_addba_resp_timer_expired; 655 tid_tx->addba_resp_timer.data = (unsigned long)&sta->timer_to_tid[tid]; 656 init_timer(&tid_tx->addba_resp_timer); 657 658 /* tx timer */ 659 tid_tx->session_timer.function = sta_tx_agg_session_timer_expired; 660 tid_tx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid]; 661 init_timer_deferrable(&tid_tx->session_timer); 662 663 /* assign a dialog token */ 664 sta->ampdu_mlme.dialog_token_allocator++; 665 tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator; 666 667 /* 668 * Finally, assign it to the start array; the work item will 669 * collect it and move it to the normal array. 670 */ 671 sta->ampdu_mlme.tid_start_tx[tid] = tid_tx; 672 673 ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work); 674 675 /* this flow continues off the work */ 676 err_unlock_sta: 677 spin_unlock_bh(&sta->lock); 678 return ret; 679} 680EXPORT_SYMBOL(ieee80211_start_tx_ba_session); 681 682static void ieee80211_agg_tx_operational(struct ieee80211_local *local, 683 struct sta_info *sta, u16 tid) 684{ 685 struct tid_ampdu_tx *tid_tx; 686 687 lockdep_assert_held(&sta->ampdu_mlme.mtx); 688 689 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 690 691 ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n", 692 sta->sta.addr, tid); 693 694 drv_ampdu_action(local, sta->sdata, 695 IEEE80211_AMPDU_TX_OPERATIONAL, 696 &sta->sta, tid, NULL, tid_tx->buf_size); 697 698 /* 699 * synchronize with TX path, while splicing the TX path 700 * should block so it won't put more packets onto pending. 701 */ 702 spin_lock_bh(&sta->lock); 703 704 ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid); 705 /* 706 * Now mark as operational. This will be visible 707 * in the TX path, and lets it go lock-free in 708 * the common case. 709 */ 710 set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state); 711 ieee80211_agg_splice_finish(sta->sdata, tid); 712 713 spin_unlock_bh(&sta->lock); 714 715 ieee80211_agg_start_txq(sta, tid, true); 716} 717 718void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid) 719{ 720 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 721 struct ieee80211_local *local = sdata->local; 722 struct sta_info *sta; 723 struct tid_ampdu_tx *tid_tx; 724 725 trace_api_start_tx_ba_cb(sdata, ra, tid); 726 727 if (tid >= IEEE80211_NUM_TIDS) { 728 ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n", 729 tid, IEEE80211_NUM_TIDS); 730 return; 731 } 732 733 mutex_lock(&local->sta_mtx); 734 sta = sta_info_get_bss(sdata, ra); 735 if (!sta) { 736 mutex_unlock(&local->sta_mtx); 737 ht_dbg(sdata, "Could not find station: %pM\n", ra); 738 return; 739 } 740 741 mutex_lock(&sta->ampdu_mlme.mtx); 742 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 743 744 if (WARN_ON(!tid_tx)) { 745 ht_dbg(sdata, "addBA was not requested!\n"); 746 goto unlock; 747 } 748 749 if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))) 750 goto unlock; 751 752 if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) 753 ieee80211_agg_tx_operational(local, sta, tid); 754 755 unlock: 756 mutex_unlock(&sta->ampdu_mlme.mtx); 757 mutex_unlock(&local->sta_mtx); 758} 759 760void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, 761 const u8 *ra, u16 tid) 762{ 763 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 764 struct ieee80211_local *local = sdata->local; 765 struct ieee80211_ra_tid *ra_tid; 766 struct sk_buff *skb = dev_alloc_skb(0); 767 768 if (unlikely(!skb)) 769 return; 770 771 ra_tid = (struct ieee80211_ra_tid *) &skb->cb; 772 memcpy(&ra_tid->ra, ra, ETH_ALEN); 773 ra_tid->tid = tid; 774 775 skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START; 776 skb_queue_tail(&sdata->skb_queue, skb); 777 ieee80211_queue_work(&local->hw, &sdata->work); 778} 779EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe); 780 781int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, 782 enum ieee80211_agg_stop_reason reason) 783{ 784 int ret; 785 786 mutex_lock(&sta->ampdu_mlme.mtx); 787 788 ret = ___ieee80211_stop_tx_ba_session(sta, tid, reason); 789 790 mutex_unlock(&sta->ampdu_mlme.mtx); 791 792 return ret; 793} 794 795int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid) 796{ 797 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 798 struct ieee80211_sub_if_data *sdata = sta->sdata; 799 struct ieee80211_local *local = sdata->local; 800 struct tid_ampdu_tx *tid_tx; 801 int ret = 0; 802 803 trace_api_stop_tx_ba_session(pubsta, tid); 804 805 if (!local->ops->ampdu_action) 806 return -EINVAL; 807 808 if (tid >= IEEE80211_NUM_TIDS) 809 return -EINVAL; 810 811 spin_lock_bh(&sta->lock); 812 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 813 814 if (!tid_tx) { 815 ret = -ENOENT; 816 goto unlock; 817 } 818 819 WARN(sta->reserved_tid == tid, 820 "Requested to stop BA session on reserved tid=%d", tid); 821 822 if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 823 /* already in progress stopping it */ 824 ret = 0; 825 goto unlock; 826 } 827 828 set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state); 829 ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work); 830 831 unlock: 832 spin_unlock_bh(&sta->lock); 833 return ret; 834} 835EXPORT_SYMBOL(ieee80211_stop_tx_ba_session); 836 837void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid) 838{ 839 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 840 struct ieee80211_local *local = sdata->local; 841 struct sta_info *sta; 842 struct tid_ampdu_tx *tid_tx; 843 bool send_delba = false; 844 845 trace_api_stop_tx_ba_cb(sdata, ra, tid); 846 847 if (tid >= IEEE80211_NUM_TIDS) { 848 ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n", 849 tid, IEEE80211_NUM_TIDS); 850 return; 851 } 852 853 ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid); 854 855 mutex_lock(&local->sta_mtx); 856 857 sta = sta_info_get_bss(sdata, ra); 858 if (!sta) { 859 ht_dbg(sdata, "Could not find station: %pM\n", ra); 860 goto unlock; 861 } 862 863 mutex_lock(&sta->ampdu_mlme.mtx); 864 spin_lock_bh(&sta->lock); 865 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 866 867 if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 868 ht_dbg(sdata, 869 "unexpected callback to A-MPDU stop for %pM tid %d\n", 870 sta->sta.addr, tid); 871 goto unlock_sta; 872 } 873 874 if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR && tid_tx->tx_stop) 875 send_delba = true; 876 877 ieee80211_remove_tid_tx(sta, tid); 878 879 unlock_sta: 880 spin_unlock_bh(&sta->lock); 881 882 if (send_delba) 883 ieee80211_send_delba(sdata, ra, tid, 884 WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE); 885 886 mutex_unlock(&sta->ampdu_mlme.mtx); 887 unlock: 888 mutex_unlock(&local->sta_mtx); 889} 890 891void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, 892 const u8 *ra, u16 tid) 893{ 894 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 895 struct ieee80211_local *local = sdata->local; 896 struct ieee80211_ra_tid *ra_tid; 897 struct sk_buff *skb = dev_alloc_skb(0); 898 899 if (unlikely(!skb)) 900 return; 901 902 ra_tid = (struct ieee80211_ra_tid *) &skb->cb; 903 memcpy(&ra_tid->ra, ra, ETH_ALEN); 904 ra_tid->tid = tid; 905 906 skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP; 907 skb_queue_tail(&sdata->skb_queue, skb); 908 ieee80211_queue_work(&local->hw, &sdata->work); 909} 910EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe); 911 912 913void ieee80211_process_addba_resp(struct ieee80211_local *local, 914 struct sta_info *sta, 915 struct ieee80211_mgmt *mgmt, 916 size_t len) 917{ 918 struct tid_ampdu_tx *tid_tx; 919 u16 capab, tid; 920 u8 buf_size; 921 922 capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab); 923 tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2; 924 buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6; 925 926 mutex_lock(&sta->ampdu_mlme.mtx); 927 928 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 929 if (!tid_tx) 930 goto out; 931 932 if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) { 933 ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n", 934 sta->sta.addr, tid); 935 goto out; 936 } 937 938 del_timer_sync(&tid_tx->addba_resp_timer); 939 940 ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n", 941 sta->sta.addr, tid); 942 943 /* 944 * addba_resp_timer may have fired before we got here, and 945 * caused WANT_STOP to be set. If the stop then was already 946 * processed further, STOPPING might be set. 947 */ 948 if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) || 949 test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 950 ht_dbg(sta->sdata, 951 "got addBA resp for %pM tid %d but we already gave up\n", 952 sta->sta.addr, tid); 953 goto out; 954 } 955 956 /* 957 * IEEE 802.11-2007 7.3.1.14: 958 * In an ADDBA Response frame, when the Status Code field 959 * is set to 0, the Buffer Size subfield is set to a value 960 * of at least 1. 961 */ 962 if (le16_to_cpu(mgmt->u.action.u.addba_resp.status) 963 == WLAN_STATUS_SUCCESS && buf_size) { 964 if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED, 965 &tid_tx->state)) { 966 /* ignore duplicate response */ 967 goto out; 968 } 969 970 tid_tx->buf_size = buf_size; 971 972 if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)) 973 ieee80211_agg_tx_operational(local, sta, tid); 974 975 sta->ampdu_mlme.addba_req_num[tid] = 0; 976 977 if (tid_tx->timeout) { 978 mod_timer(&tid_tx->session_timer, 979 TU_TO_EXP_TIME(tid_tx->timeout)); 980 tid_tx->last_tx = jiffies; 981 } 982 983 } else { 984 ___ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED); 985 } 986 987 out: 988 mutex_unlock(&sta->ampdu_mlme.mtx); 989} 990