/net/mac80211/agg-tx.c

http://github.com/mirrors/linux · C · 1006 lines · 630 code · 177 blank · 199 comment · 90 complexity · 31f2c59a8cff6902df7616e2650d1db8 MD5 · raw file

  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * HT handling
  4. *
  5. * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
  6. * Copyright 2002-2005, Instant802 Networks, Inc.
  7. * Copyright 2005-2006, Devicescape Software, Inc.
  8. * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
  9. * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  10. * Copyright 2007-2010, Intel Corporation
  11. * Copyright(c) 2015-2017 Intel Deutschland GmbH
  12. * Copyright (C) 2018 - 2019 Intel Corporation
  13. */
  14. #include <linux/ieee80211.h>
  15. #include <linux/slab.h>
  16. #include <linux/export.h>
  17. #include <net/mac80211.h>
  18. #include "ieee80211_i.h"
  19. #include "driver-ops.h"
  20. #include "wme.h"
  21. /**
  22. * DOC: TX A-MPDU aggregation
  23. *
  24. * Aggregation on the TX side requires setting the hardware flag
  25. * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed
  26. * packets with a flag indicating A-MPDU aggregation. The driver
  27. * or device is responsible for actually aggregating the frames,
  28. * as well as deciding how many and which to aggregate.
  29. *
  30. * When TX aggregation is started by some subsystem (usually the rate
  31. * control algorithm would be appropriate) by calling the
  32. * ieee80211_start_tx_ba_session() function, the driver will be
  33. * notified via its @ampdu_action function, with the
  34. * %IEEE80211_AMPDU_TX_START action.
  35. *
  36. * In response to that, the driver is later required to call the
  37. * ieee80211_start_tx_ba_cb_irqsafe() function, which will really
  38. * start the aggregation session after the peer has also responded.
  39. * If the peer responds negatively, the session will be stopped
  40. * again right away. Note that it is possible for the aggregation
  41. * session to be stopped before the driver has indicated that it
  42. * is done setting it up, in which case it must not indicate the
  43. * setup completion.
  44. *
  45. * Also note that, since we also need to wait for a response from
  46. * the peer, the driver is notified of the completion of the
  47. * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the
  48. * @ampdu_action callback.
  49. *
  50. * Similarly, when the aggregation session is stopped by the peer
  51. * or something calling ieee80211_stop_tx_ba_session(), the driver's
  52. * @ampdu_action function will be called with the action
  53. * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
  54. * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
  55. * Note that the sta can get destroyed before the BA tear down is
  56. * complete.
  57. */
  58. static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
  59. const u8 *da, u16 tid,
  60. u8 dialog_token, u16 start_seq_num,
  61. u16 agg_size, u16 timeout)
  62. {
  63. struct ieee80211_local *local = sdata->local;
  64. struct sk_buff *skb;
  65. struct ieee80211_mgmt *mgmt;
  66. u16 capab;
  67. skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
  68. if (!skb)
  69. return;
  70. skb_reserve(skb, local->hw.extra_tx_headroom);
  71. mgmt = skb_put_zero(skb, 24);
  72. memcpy(mgmt->da, da, ETH_ALEN);
  73. memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  74. if (sdata->vif.type == NL80211_IFTYPE_AP ||
  75. sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  76. sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  77. memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  78. else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  79. memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  80. else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
  81. memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
  82. mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  83. IEEE80211_STYPE_ACTION);
  84. skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
  85. mgmt->u.action.category = WLAN_CATEGORY_BACK;
  86. mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
  87. mgmt->u.action.u.addba_req.dialog_token = dialog_token;
  88. capab = (u16)(1 << 0); /* bit 0 A-MSDU support */
  89. capab |= (u16)(1 << 1); /* bit 1 aggregation policy */
  90. capab |= (u16)(tid << 2); /* bit 5:2 TID number */
  91. capab |= (u16)(agg_size << 6); /* bit 15:6 max size of aggergation */
  92. mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
  93. mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
  94. mgmt->u.action.u.addba_req.start_seq_num =
  95. cpu_to_le16(start_seq_num << 4);
  96. ieee80211_tx_skb(sdata, skb);
  97. }
  98. void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
  99. {
  100. struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  101. struct ieee80211_local *local = sdata->local;
  102. struct sk_buff *skb;
  103. struct ieee80211_bar *bar;
  104. u16 bar_control = 0;
  105. skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
  106. if (!skb)
  107. return;
  108. skb_reserve(skb, local->hw.extra_tx_headroom);
  109. bar = skb_put_zero(skb, sizeof(*bar));
  110. bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
  111. IEEE80211_STYPE_BACK_REQ);
  112. memcpy(bar->ra, ra, ETH_ALEN);
  113. memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
  114. bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
  115. bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
  116. bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT);
  117. bar->control = cpu_to_le16(bar_control);
  118. bar->start_seq_num = cpu_to_le16(ssn);
  119. IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
  120. IEEE80211_TX_CTL_REQ_TX_STATUS;
  121. ieee80211_tx_skb_tid(sdata, skb, tid);
  122. }
  123. EXPORT_SYMBOL(ieee80211_send_bar);
  124. void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
  125. struct tid_ampdu_tx *tid_tx)
  126. {
  127. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  128. lockdep_assert_held(&sta->lock);
  129. rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
  130. }
  131. /*
  132. * When multiple aggregation sessions on multiple stations
  133. * are being created/destroyed simultaneously, we need to
  134. * refcount the global queue stop caused by that in order
  135. * to not get into a situation where one of the aggregation
  136. * setup or teardown re-enables queues before the other is
  137. * ready to handle that.
  138. *
  139. * These two functions take care of this issue by keeping
  140. * a global "agg_queue_stop" refcount.
  141. */
  142. static void __acquires(agg_queue)
  143. ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
  144. {
  145. int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
  146. /* we do refcounting here, so don't use the queue reason refcounting */
  147. if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
  148. ieee80211_stop_queue_by_reason(
  149. &sdata->local->hw, queue,
  150. IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
  151. false);
  152. __acquire(agg_queue);
  153. }
  154. static void __releases(agg_queue)
  155. ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
  156. {
  157. int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
  158. if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
  159. ieee80211_wake_queue_by_reason(
  160. &sdata->local->hw, queue,
  161. IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
  162. false);
  163. __release(agg_queue);
  164. }
  165. static void
  166. ieee80211_agg_stop_txq(struct sta_info *sta, int tid)
  167. {
  168. struct ieee80211_txq *txq = sta->sta.txq[tid];
  169. struct ieee80211_sub_if_data *sdata;
  170. struct fq *fq;
  171. struct txq_info *txqi;
  172. if (!txq)
  173. return;
  174. txqi = to_txq_info(txq);
  175. sdata = vif_to_sdata(txq->vif);
  176. fq = &sdata->local->fq;
  177. /* Lock here to protect against further seqno updates on dequeue */
  178. spin_lock_bh(&fq->lock);
  179. set_bit(IEEE80211_TXQ_STOP, &txqi->flags);
  180. spin_unlock_bh(&fq->lock);
  181. }
  182. static void
  183. ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable)
  184. {
  185. struct ieee80211_txq *txq = sta->sta.txq[tid];
  186. struct txq_info *txqi;
  187. if (!txq)
  188. return;
  189. txqi = to_txq_info(txq);
  190. if (enable)
  191. set_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
  192. else
  193. clear_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
  194. clear_bit(IEEE80211_TXQ_STOP, &txqi->flags);
  195. local_bh_disable();
  196. rcu_read_lock();
  197. schedule_and_wake_txq(sta->sdata->local, txqi);
  198. rcu_read_unlock();
  199. local_bh_enable();
  200. }
  201. /*
  202. * splice packets from the STA's pending to the local pending,
  203. * requires a call to ieee80211_agg_splice_finish later
  204. */
  205. static void __acquires(agg_queue)
  206. ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
  207. struct tid_ampdu_tx *tid_tx, u16 tid)
  208. {
  209. struct ieee80211_local *local = sdata->local;
  210. int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
  211. unsigned long flags;
  212. ieee80211_stop_queue_agg(sdata, tid);
  213. if (WARN(!tid_tx,
  214. "TID %d gone but expected when splicing aggregates from the pending queue\n",
  215. tid))
  216. return;
  217. if (!skb_queue_empty(&tid_tx->pending)) {
  218. spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
  219. /* copy over remaining packets */
  220. skb_queue_splice_tail_init(&tid_tx->pending,
  221. &local->pending[queue]);
  222. spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  223. }
  224. }
  225. static void __releases(agg_queue)
  226. ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
  227. {
  228. ieee80211_wake_queue_agg(sdata, tid);
  229. }
  230. static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid)
  231. {
  232. struct tid_ampdu_tx *tid_tx;
  233. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  234. lockdep_assert_held(&sta->lock);
  235. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  236. /*
  237. * When we get here, the TX path will not be lockless any more wrt.
  238. * aggregation, since the OPERATIONAL bit has long been cleared.
  239. * Thus it will block on getting the lock, if it occurs. So if we
  240. * stop the queue now, we will not get any more packets, and any
  241. * that might be being processed will wait for us here, thereby
  242. * guaranteeing that no packets go to the tid_tx pending queue any
  243. * more.
  244. */
  245. ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
  246. /* future packets must not find the tid_tx struct any more */
  247. ieee80211_assign_tid_tx(sta, tid, NULL);
  248. ieee80211_agg_splice_finish(sta->sdata, tid);
  249. ieee80211_agg_start_txq(sta, tid, false);
  250. kfree_rcu(tid_tx, rcu_head);
  251. }
  252. int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
  253. enum ieee80211_agg_stop_reason reason)
  254. {
  255. struct ieee80211_local *local = sta->local;
  256. struct tid_ampdu_tx *tid_tx;
  257. struct ieee80211_ampdu_params params = {
  258. .sta = &sta->sta,
  259. .tid = tid,
  260. .buf_size = 0,
  261. .amsdu = false,
  262. .timeout = 0,
  263. .ssn = 0,
  264. };
  265. int ret;
  266. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  267. switch (reason) {
  268. case AGG_STOP_DECLINED:
  269. case AGG_STOP_LOCAL_REQUEST:
  270. case AGG_STOP_PEER_REQUEST:
  271. params.action = IEEE80211_AMPDU_TX_STOP_CONT;
  272. break;
  273. case AGG_STOP_DESTROY_STA:
  274. params.action = IEEE80211_AMPDU_TX_STOP_FLUSH;
  275. break;
  276. default:
  277. WARN_ON_ONCE(1);
  278. return -EINVAL;
  279. }
  280. spin_lock_bh(&sta->lock);
  281. /* free struct pending for start, if present */
  282. tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
  283. kfree(tid_tx);
  284. sta->ampdu_mlme.tid_start_tx[tid] = NULL;
  285. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  286. if (!tid_tx) {
  287. spin_unlock_bh(&sta->lock);
  288. return -ENOENT;
  289. }
  290. /*
  291. * if we're already stopping ignore any new requests to stop
  292. * unless we're destroying it in which case notify the driver
  293. */
  294. if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  295. spin_unlock_bh(&sta->lock);
  296. if (reason != AGG_STOP_DESTROY_STA)
  297. return -EALREADY;
  298. params.action = IEEE80211_AMPDU_TX_STOP_FLUSH_CONT;
  299. ret = drv_ampdu_action(local, sta->sdata, &params);
  300. WARN_ON_ONCE(ret);
  301. return 0;
  302. }
  303. if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
  304. /* not even started yet! */
  305. ieee80211_assign_tid_tx(sta, tid, NULL);
  306. spin_unlock_bh(&sta->lock);
  307. kfree_rcu(tid_tx, rcu_head);
  308. return 0;
  309. }
  310. set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
  311. ieee80211_agg_stop_txq(sta, tid);
  312. spin_unlock_bh(&sta->lock);
  313. ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
  314. sta->sta.addr, tid);
  315. del_timer_sync(&tid_tx->addba_resp_timer);
  316. del_timer_sync(&tid_tx->session_timer);
  317. /*
  318. * After this packets are no longer handed right through
  319. * to the driver but are put onto tid_tx->pending instead,
  320. * with locking to ensure proper access.
  321. */
  322. clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
  323. /*
  324. * There might be a few packets being processed right now (on
  325. * another CPU) that have already gotten past the aggregation
  326. * check when it was still OPERATIONAL and consequently have
  327. * IEEE80211_TX_CTL_AMPDU set. In that case, this code might
  328. * call into the driver at the same time or even before the
  329. * TX paths calls into it, which could confuse the driver.
  330. *
  331. * Wait for all currently running TX paths to finish before
  332. * telling the driver. New packets will not go through since
  333. * the aggregation session is no longer OPERATIONAL.
  334. */
  335. if (!local->in_reconfig)
  336. synchronize_net();
  337. tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ?
  338. WLAN_BACK_RECIPIENT :
  339. WLAN_BACK_INITIATOR;
  340. tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST;
  341. ret = drv_ampdu_action(local, sta->sdata, &params);
  342. /* HW shall not deny going back to legacy */
  343. if (WARN_ON(ret)) {
  344. /*
  345. * We may have pending packets get stuck in this case...
  346. * Not bothering with a workaround for now.
  347. */
  348. }
  349. /*
  350. * In the case of AGG_STOP_DESTROY_STA, the driver won't
  351. * necessarily call ieee80211_stop_tx_ba_cb(), so this may
  352. * seem like we can leave the tid_tx data pending forever.
  353. * This is true, in a way, but "forever" is only until the
  354. * station struct is actually destroyed. In the meantime,
  355. * leaving it around ensures that we don't transmit packets
  356. * to the driver on this TID which might confuse it.
  357. */
  358. return 0;
  359. }
  360. /*
  361. * After sending add Block Ack request we activated a timer until
  362. * add Block Ack response will arrive from the recipient.
  363. * If this timer expires sta_addba_resp_timer_expired will be executed.
  364. */
  365. static void sta_addba_resp_timer_expired(struct timer_list *t)
  366. {
  367. struct tid_ampdu_tx *tid_tx = from_timer(tid_tx, t, addba_resp_timer);
  368. struct sta_info *sta = tid_tx->sta;
  369. u8 tid = tid_tx->tid;
  370. /* check if the TID waits for addBA response */
  371. if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
  372. ht_dbg(sta->sdata,
  373. "timer expired on %pM tid %d not expecting addBA response\n",
  374. sta->sta.addr, tid);
  375. return;
  376. }
  377. ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n",
  378. sta->sta.addr, tid);
  379. ieee80211_stop_tx_ba_session(&sta->sta, tid);
  380. }
  381. void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
  382. {
  383. struct tid_ampdu_tx *tid_tx;
  384. struct ieee80211_local *local = sta->local;
  385. struct ieee80211_sub_if_data *sdata = sta->sdata;
  386. struct ieee80211_ampdu_params params = {
  387. .sta = &sta->sta,
  388. .action = IEEE80211_AMPDU_TX_START,
  389. .tid = tid,
  390. .buf_size = 0,
  391. .amsdu = false,
  392. .timeout = 0,
  393. };
  394. int ret;
  395. u16 buf_size;
  396. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  397. /*
  398. * Start queuing up packets for this aggregation session.
  399. * We're going to release them once the driver is OK with
  400. * that.
  401. */
  402. clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
  403. ieee80211_agg_stop_txq(sta, tid);
  404. /*
  405. * Make sure no packets are being processed. This ensures that
  406. * we have a valid starting sequence number and that in-flight
  407. * packets have been flushed out and no packets for this TID
  408. * will go into the driver during the ampdu_action call.
  409. */
  410. synchronize_net();
  411. params.ssn = sta->tid_seq[tid] >> 4;
  412. ret = drv_ampdu_action(local, sdata, &params);
  413. if (ret == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
  414. /*
  415. * We didn't send the request yet, so don't need to check
  416. * here if we already got a response, just mark as driver
  417. * ready immediately.
  418. */
  419. set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state);
  420. } else if (ret) {
  421. ht_dbg(sdata,
  422. "BA request denied - HW unavailable for %pM tid %d\n",
  423. sta->sta.addr, tid);
  424. spin_lock_bh(&sta->lock);
  425. ieee80211_agg_splice_packets(sdata, tid_tx, tid);
  426. ieee80211_assign_tid_tx(sta, tid, NULL);
  427. ieee80211_agg_splice_finish(sdata, tid);
  428. spin_unlock_bh(&sta->lock);
  429. ieee80211_agg_start_txq(sta, tid, false);
  430. kfree_rcu(tid_tx, rcu_head);
  431. return;
  432. }
  433. /* activate the timer for the recipient's addBA response */
  434. mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
  435. ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n",
  436. sta->sta.addr, tid);
  437. spin_lock_bh(&sta->lock);
  438. sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
  439. sta->ampdu_mlme.addba_req_num[tid]++;
  440. spin_unlock_bh(&sta->lock);
  441. if (sta->sta.he_cap.has_he) {
  442. buf_size = local->hw.max_tx_aggregation_subframes;
  443. } else {
  444. /*
  445. * We really should use what the driver told us it will
  446. * transmit as the maximum, but certain APs (e.g. the
  447. * LinkSys WRT120N with FW v1.0.07 build 002 Jun 18 2012)
  448. * will crash when we use a lower number.
  449. */
  450. buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
  451. }
  452. /* send AddBA request */
  453. ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
  454. tid_tx->dialog_token, params.ssn,
  455. buf_size, tid_tx->timeout);
  456. }
  457. /*
  458. * After accepting the AddBA Response we activated a timer,
  459. * resetting it after each frame that we send.
  460. */
  461. static void sta_tx_agg_session_timer_expired(struct timer_list *t)
  462. {
  463. struct tid_ampdu_tx *tid_tx = from_timer(tid_tx, t, session_timer);
  464. struct sta_info *sta = tid_tx->sta;
  465. u8 tid = tid_tx->tid;
  466. unsigned long timeout;
  467. if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  468. return;
  469. }
  470. timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
  471. if (time_is_after_jiffies(timeout)) {
  472. mod_timer(&tid_tx->session_timer, timeout);
  473. return;
  474. }
  475. ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
  476. sta->sta.addr, tid);
  477. ieee80211_stop_tx_ba_session(&sta->sta, tid);
  478. }
  479. int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
  480. u16 timeout)
  481. {
  482. struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
  483. struct ieee80211_sub_if_data *sdata = sta->sdata;
  484. struct ieee80211_local *local = sdata->local;
  485. struct tid_ampdu_tx *tid_tx;
  486. int ret = 0;
  487. trace_api_start_tx_ba_session(pubsta, tid);
  488. if (WARN(sta->reserved_tid == tid,
  489. "Requested to start BA session on reserved tid=%d", tid))
  490. return -EINVAL;
  491. if (!pubsta->ht_cap.ht_supported)
  492. return -EINVAL;
  493. if (WARN_ON_ONCE(!local->ops->ampdu_action))
  494. return -EINVAL;
  495. if ((tid >= IEEE80211_NUM_TIDS) ||
  496. !ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) ||
  497. ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW))
  498. return -EINVAL;
  499. if (WARN_ON(tid >= IEEE80211_FIRST_TSPEC_TSID))
  500. return -EINVAL;
  501. ht_dbg(sdata, "Open BA session requested for %pM tid %u\n",
  502. pubsta->addr, tid);
  503. if (sdata->vif.type != NL80211_IFTYPE_STATION &&
  504. sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  505. sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  506. sdata->vif.type != NL80211_IFTYPE_AP &&
  507. sdata->vif.type != NL80211_IFTYPE_ADHOC)
  508. return -EINVAL;
  509. if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
  510. ht_dbg(sdata,
  511. "BA sessions blocked - Denying BA session request %pM tid %d\n",
  512. sta->sta.addr, tid);
  513. return -EINVAL;
  514. }
  515. /*
  516. * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a
  517. * member of an IBSS, and has no other existing Block Ack agreement
  518. * with the recipient STA, then the initiating STA shall transmit a
  519. * Probe Request frame to the recipient STA and shall not transmit an
  520. * ADDBA Request frame unless it receives a Probe Response frame
  521. * from the recipient within dot11ADDBAFailureTimeout.
  522. *
  523. * The probe request mechanism for ADDBA is currently not implemented,
  524. * but we only build up Block Ack session with HT STAs. This information
  525. * is set when we receive a bss info from a probe response or a beacon.
  526. */
  527. if (sta->sdata->vif.type == NL80211_IFTYPE_ADHOC &&
  528. !sta->sta.ht_cap.ht_supported) {
  529. ht_dbg(sdata,
  530. "BA request denied - IBSS STA %pM does not advertise HT support\n",
  531. pubsta->addr);
  532. return -EINVAL;
  533. }
  534. spin_lock_bh(&sta->lock);
  535. /* we have tried too many times, receiver does not want A-MPDU */
  536. if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
  537. ret = -EBUSY;
  538. goto err_unlock_sta;
  539. }
  540. /*
  541. * if we have tried more than HT_AGG_BURST_RETRIES times we
  542. * will spread our requests in time to avoid stalling connection
  543. * for too long
  544. */
  545. if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_BURST_RETRIES &&
  546. time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
  547. HT_AGG_RETRIES_PERIOD)) {
  548. ht_dbg(sdata,
  549. "BA request denied - %d failed requests on %pM tid %u\n",
  550. sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid);
  551. ret = -EBUSY;
  552. goto err_unlock_sta;
  553. }
  554. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  555. /* check if the TID is not in aggregation flow already */
  556. if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
  557. ht_dbg(sdata,
  558. "BA request denied - session is not idle on %pM tid %u\n",
  559. sta->sta.addr, tid);
  560. ret = -EAGAIN;
  561. goto err_unlock_sta;
  562. }
  563. /* prepare A-MPDU MLME for Tx aggregation */
  564. tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
  565. if (!tid_tx) {
  566. ret = -ENOMEM;
  567. goto err_unlock_sta;
  568. }
  569. skb_queue_head_init(&tid_tx->pending);
  570. __set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
  571. tid_tx->timeout = timeout;
  572. tid_tx->sta = sta;
  573. tid_tx->tid = tid;
  574. /* response timer */
  575. timer_setup(&tid_tx->addba_resp_timer, sta_addba_resp_timer_expired, 0);
  576. /* tx timer */
  577. timer_setup(&tid_tx->session_timer,
  578. sta_tx_agg_session_timer_expired, TIMER_DEFERRABLE);
  579. /* assign a dialog token */
  580. sta->ampdu_mlme.dialog_token_allocator++;
  581. tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
  582. /*
  583. * Finally, assign it to the start array; the work item will
  584. * collect it and move it to the normal array.
  585. */
  586. sta->ampdu_mlme.tid_start_tx[tid] = tid_tx;
  587. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  588. /* this flow continues off the work */
  589. err_unlock_sta:
  590. spin_unlock_bh(&sta->lock);
  591. return ret;
  592. }
  593. EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
  594. static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
  595. struct sta_info *sta, u16 tid)
  596. {
  597. struct tid_ampdu_tx *tid_tx;
  598. struct ieee80211_ampdu_params params = {
  599. .sta = &sta->sta,
  600. .action = IEEE80211_AMPDU_TX_OPERATIONAL,
  601. .tid = tid,
  602. .timeout = 0,
  603. .ssn = 0,
  604. };
  605. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  606. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  607. params.buf_size = tid_tx->buf_size;
  608. params.amsdu = tid_tx->amsdu;
  609. ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n",
  610. sta->sta.addr, tid);
  611. drv_ampdu_action(local, sta->sdata, &params);
  612. /*
  613. * synchronize with TX path, while splicing the TX path
  614. * should block so it won't put more packets onto pending.
  615. */
  616. spin_lock_bh(&sta->lock);
  617. ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
  618. /*
  619. * Now mark as operational. This will be visible
  620. * in the TX path, and lets it go lock-free in
  621. * the common case.
  622. */
  623. set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
  624. ieee80211_agg_splice_finish(sta->sdata, tid);
  625. spin_unlock_bh(&sta->lock);
  626. ieee80211_agg_start_txq(sta, tid, true);
  627. }
  628. void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
  629. struct tid_ampdu_tx *tid_tx)
  630. {
  631. struct ieee80211_sub_if_data *sdata = sta->sdata;
  632. struct ieee80211_local *local = sdata->local;
  633. if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
  634. return;
  635. if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
  636. ieee80211_agg_tx_operational(local, sta, tid);
  637. }
  638. static struct tid_ampdu_tx *
  639. ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
  640. const u8 *ra, u16 tid, struct sta_info **sta)
  641. {
  642. struct tid_ampdu_tx *tid_tx;
  643. if (tid >= IEEE80211_NUM_TIDS) {
  644. ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
  645. tid, IEEE80211_NUM_TIDS);
  646. return NULL;
  647. }
  648. *sta = sta_info_get_bss(sdata, ra);
  649. if (!*sta) {
  650. ht_dbg(sdata, "Could not find station: %pM\n", ra);
  651. return NULL;
  652. }
  653. tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
  654. if (WARN_ON(!tid_tx))
  655. ht_dbg(sdata, "addBA was not requested!\n");
  656. return tid_tx;
  657. }
  658. void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
  659. const u8 *ra, u16 tid)
  660. {
  661. struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  662. struct ieee80211_local *local = sdata->local;
  663. struct sta_info *sta;
  664. struct tid_ampdu_tx *tid_tx;
  665. trace_api_start_tx_ba_cb(sdata, ra, tid);
  666. rcu_read_lock();
  667. tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
  668. if (!tid_tx)
  669. goto out;
  670. set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
  671. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  672. out:
  673. rcu_read_unlock();
  674. }
  675. EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
  676. int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
  677. enum ieee80211_agg_stop_reason reason)
  678. {
  679. int ret;
  680. mutex_lock(&sta->ampdu_mlme.mtx);
  681. ret = ___ieee80211_stop_tx_ba_session(sta, tid, reason);
  682. mutex_unlock(&sta->ampdu_mlme.mtx);
  683. return ret;
  684. }
  685. int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
  686. {
  687. struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
  688. struct ieee80211_sub_if_data *sdata = sta->sdata;
  689. struct ieee80211_local *local = sdata->local;
  690. struct tid_ampdu_tx *tid_tx;
  691. int ret = 0;
  692. trace_api_stop_tx_ba_session(pubsta, tid);
  693. if (!local->ops->ampdu_action)
  694. return -EINVAL;
  695. if (tid >= IEEE80211_NUM_TIDS)
  696. return -EINVAL;
  697. spin_lock_bh(&sta->lock);
  698. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  699. if (!tid_tx) {
  700. ret = -ENOENT;
  701. goto unlock;
  702. }
  703. WARN(sta->reserved_tid == tid,
  704. "Requested to stop BA session on reserved tid=%d", tid);
  705. if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  706. /* already in progress stopping it */
  707. ret = 0;
  708. goto unlock;
  709. }
  710. set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state);
  711. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  712. unlock:
  713. spin_unlock_bh(&sta->lock);
  714. return ret;
  715. }
  716. EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
  717. void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
  718. struct tid_ampdu_tx *tid_tx)
  719. {
  720. struct ieee80211_sub_if_data *sdata = sta->sdata;
  721. bool send_delba = false;
  722. ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
  723. sta->sta.addr, tid);
  724. spin_lock_bh(&sta->lock);
  725. if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  726. ht_dbg(sdata,
  727. "unexpected callback to A-MPDU stop for %pM tid %d\n",
  728. sta->sta.addr, tid);
  729. goto unlock_sta;
  730. }
  731. if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR && tid_tx->tx_stop)
  732. send_delba = true;
  733. ieee80211_remove_tid_tx(sta, tid);
  734. unlock_sta:
  735. spin_unlock_bh(&sta->lock);
  736. if (send_delba)
  737. ieee80211_send_delba(sdata, sta->sta.addr, tid,
  738. WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
  739. }
  740. void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
  741. const u8 *ra, u16 tid)
  742. {
  743. struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  744. struct ieee80211_local *local = sdata->local;
  745. struct sta_info *sta;
  746. struct tid_ampdu_tx *tid_tx;
  747. trace_api_stop_tx_ba_cb(sdata, ra, tid);
  748. rcu_read_lock();
  749. tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
  750. if (!tid_tx)
  751. goto out;
  752. set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
  753. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  754. out:
  755. rcu_read_unlock();
  756. }
  757. EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
  758. void ieee80211_process_addba_resp(struct ieee80211_local *local,
  759. struct sta_info *sta,
  760. struct ieee80211_mgmt *mgmt,
  761. size_t len)
  762. {
  763. struct tid_ampdu_tx *tid_tx;
  764. struct ieee80211_txq *txq;
  765. u16 capab, tid, buf_size;
  766. bool amsdu;
  767. capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
  768. amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
  769. tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
  770. buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
  771. buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
  772. txq = sta->sta.txq[tid];
  773. if (!amsdu && txq)
  774. set_bit(IEEE80211_TXQ_NO_AMSDU, &to_txq_info(txq)->flags);
  775. mutex_lock(&sta->ampdu_mlme.mtx);
  776. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  777. if (!tid_tx)
  778. goto out;
  779. if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
  780. ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n",
  781. sta->sta.addr, tid);
  782. goto out;
  783. }
  784. del_timer_sync(&tid_tx->addba_resp_timer);
  785. ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n",
  786. sta->sta.addr, tid);
  787. /*
  788. * addba_resp_timer may have fired before we got here, and
  789. * caused WANT_STOP to be set. If the stop then was already
  790. * processed further, STOPPING might be set.
  791. */
  792. if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
  793. test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  794. ht_dbg(sta->sdata,
  795. "got addBA resp for %pM tid %d but we already gave up\n",
  796. sta->sta.addr, tid);
  797. goto out;
  798. }
  799. /*
  800. * IEEE 802.11-2007 7.3.1.14:
  801. * In an ADDBA Response frame, when the Status Code field
  802. * is set to 0, the Buffer Size subfield is set to a value
  803. * of at least 1.
  804. */
  805. if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
  806. == WLAN_STATUS_SUCCESS && buf_size) {
  807. if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
  808. &tid_tx->state)) {
  809. /* ignore duplicate response */
  810. goto out;
  811. }
  812. tid_tx->buf_size = buf_size;
  813. tid_tx->amsdu = amsdu;
  814. if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
  815. ieee80211_agg_tx_operational(local, sta, tid);
  816. sta->ampdu_mlme.addba_req_num[tid] = 0;
  817. tid_tx->timeout =
  818. le16_to_cpu(mgmt->u.action.u.addba_resp.timeout);
  819. if (tid_tx->timeout) {
  820. mod_timer(&tid_tx->session_timer,
  821. TU_TO_EXP_TIME(tid_tx->timeout));
  822. tid_tx->last_tx = jiffies;
  823. }
  824. } else {
  825. ___ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED);
  826. }
  827. out:
  828. mutex_unlock(&sta->ampdu_mlme.mtx);
  829. }