agg-tx.c 22.8 KB
Newer Older
J
Johannes Berg 已提交
1 2 3 4 5 6 7 8
/*
 * HT handling
 *
 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9
 * Copyright 2007-2010, Intel Corporation
J
Johannes Berg 已提交
10 11 12 13 14 15 16
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/ieee80211.h>
17
#include <linux/slab.h>
J
Johannes Berg 已提交
18 19
#include <net/mac80211.h>
#include "ieee80211_i.h"
20
#include "driver-ops.h"
J
Johannes Berg 已提交
21 22
#include "wme.h"

23
/**
24
 * DOC: TX A-MPDU aggregation
25 26
 *
 * Aggregation on the TX side requires setting the hardware flag
27 28 29 30
 * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed
 * packets with a flag indicating A-MPDU aggregation. The driver
 * or device is responsible for actually aggregating the frames,
 * as well as deciding how many and which to aggregate.
31
 *
32 33 34 35 36
 * When TX aggregation is started by some subsystem (usually the rate
 * control algorithm would be appropriate) by calling the
 * ieee80211_start_tx_ba_session() function, the driver will be
 * notified via its @ampdu_action function, with the
 * %IEEE80211_AMPDU_TX_START action.
37 38
 *
 * In response to that, the driver is later required to call the
39 40 41 42 43 44 45
 * ieee80211_start_tx_ba_cb_irqsafe() function, which will really
 * start the aggregation session after the peer has also responded.
 * If the peer responds negatively, the session will be stopped
 * again right away. Note that it is possible for the aggregation
 * session to be stopped before the driver has indicated that it
 * is done setting it up, in which case it must not indicate the
 * setup completion.
46
 *
47 48 49 50 51 52 53 54 55 56
 * Also note that, since we also need to wait for a response from
 * the peer, the driver is notified of the completion of the
 * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the
 * @ampdu_action callback.
 *
 * Similarly, when the aggregation session is stopped by the peer
 * or something calling ieee80211_stop_tx_ba_session(), the driver's
 * @ampdu_action function will be called with the action
 * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
 * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
57 58
 */

J
Johannes Berg 已提交
59 60 61 62 63 64 65 66 67 68 69 70 71 72
static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
					 const u8 *da, u16 tid,
					 u8 dialog_token, u16 start_seq_num,
					 u16 agg_size, u16 timeout)
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u16 capab;

	skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);

	if (!skb) {
		printk(KERN_ERR "%s: failed to allocate buffer "
73
				"for addba request frame\n", sdata->name);
J
Johannes Berg 已提交
74 75 76 77 78 79
		return;
	}
	skb_reserve(skb, local->hw.extra_tx_headroom);
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, da, ETH_ALEN);
80
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
81 82
	if (sdata->vif.type == NL80211_IFTYPE_AP ||
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
83
		memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
84 85
	else if (sdata->vif.type == NL80211_IFTYPE_STATION)
		memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
J
Johannes Berg 已提交
86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105

	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);

	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));

	mgmt->u.action.category = WLAN_CATEGORY_BACK;
	mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;

	mgmt->u.action.u.addba_req.dialog_token = dialog_token;
	capab = (u16)(1 << 1);		/* bit 1 aggregation policy */
	capab |= (u16)(tid << 2); 	/* bit 5:2 TID number */
	capab |= (u16)(agg_size << 6);	/* bit 15:6 max size of aggergation */

	mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);

	mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
	mgmt->u.action.u.addba_req.start_seq_num =
					cpu_to_le16(start_seq_num << 4);

106
	ieee80211_tx_skb(sdata, skb);
J
Johannes Berg 已提交
107 108 109 110 111 112 113 114 115 116 117 118
}

void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_bar *bar;
	u16 bar_control = 0;

	skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
	if (!skb) {
		printk(KERN_ERR "%s: failed to allocate buffer for "
119
			"bar frame\n", sdata->name);
J
Johannes Berg 已提交
120 121 122 123 124 125 126 127
		return;
	}
	skb_reserve(skb, local->hw.extra_tx_headroom);
	bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
	memset(bar, 0, sizeof(*bar));
	bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
					 IEEE80211_STYPE_BACK_REQ);
	memcpy(bar->ra, ra, ETH_ALEN);
128
	memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
J
Johannes Berg 已提交
129 130 131 132 133 134
	bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
	bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
	bar_control |= (u16)(tid << 12);
	bar->control = cpu_to_le16(bar_control);
	bar->start_seq_num = cpu_to_le16(ssn);

135 136
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
J
Johannes Berg 已提交
137 138
}

J
Johannes Berg 已提交
139 140 141 142 143 144 145 146
void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
			     struct tid_ampdu_tx *tid_tx)
{
	lockdep_assert_held(&sta->ampdu_mlme.mtx);
	lockdep_assert_held(&sta->lock);
	rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
}

J
Johannes Berg 已提交
147
int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
148 149
				    enum ieee80211_back_parties initiator,
				    bool tx)
150
{
151
	struct ieee80211_local *local = sta->local;
J
Johannes Berg 已提交
152
	struct tid_ampdu_tx *tid_tx;
153
	int ret;
154

155
	lockdep_assert_held(&sta->ampdu_mlme.mtx);
156

157 158
	spin_lock_bh(&sta->lock);

J
Johannes Berg 已提交
159 160 161 162 163 164
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
	if (!tid_tx) {
		spin_unlock_bh(&sta->lock);
		return -ENOENT;
	}

165 166
	if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
		/* not even started yet! */
J
Johannes Berg 已提交
167
		ieee80211_assign_tid_tx(sta, tid, NULL);
168
		spin_unlock_bh(&sta->lock);
169
		kfree_rcu(tid_tx, rcu_head);
170 171 172
		return 0;
	}

173 174
	spin_unlock_bh(&sta->lock);

175 176 177 178 179
#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
	       sta->sta.addr, tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */

180
	set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
181

182 183
	del_timer_sync(&tid_tx->addba_resp_timer);

184 185 186 187 188 189
	/*
	 * After this packets are no longer handed right through
	 * to the driver but are put onto tid_tx->pending instead,
	 * with locking to ensure proper access.
	 */
	clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
190

191
	tid_tx->stop_initiator = initiator;
192
	tid_tx->tx_stop = tx;
193

J
Johannes Berg 已提交
194
	ret = drv_ampdu_action(local, sta->sdata,
195
			       IEEE80211_AMPDU_TX_STOP,
196
			       &sta->sta, tid, NULL, 0);
197 198 199

	/* HW shall not deny going back to legacy */
	if (WARN_ON(ret)) {
200 201 202 203
		/*
		 * We may have pending packets get stuck in this case...
		 * Not bothering with a workaround for now.
		 */
204 205 206 207 208
	}

	return ret;
}

J
Johannes Berg 已提交
209 210 211 212 213 214 215 216 217 218 219 220
/*
 * After sending add Block Ack request we activated a timer until
 * add Block Ack response will arrive from the recipient.
 * If this timer expires sta_addba_resp_timer_expired will be executed.
 */
static void sta_addba_resp_timer_expired(unsigned long data)
{
	/* not an elegant detour, but there is no choice as the timer passes
	 * only one argument, and both sta_info and TID are needed, so init
	 * flow in sta_info_create gives the TID as data, while the timer_to_id
	 * array gives the sta through container_of */
	u16 tid = *(u8 *)data;
221
	struct sta_info *sta = container_of((void *)data,
J
Johannes Berg 已提交
222
		struct sta_info, timer_to_tid[tid]);
223
	struct tid_ampdu_tx *tid_tx;
224

J
Johannes Berg 已提交
225
	/* check if the TID waits for addBA response */
226 227
	rcu_read_lock();
	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
228 229
	if (!tid_tx ||
	    test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
230
		rcu_read_unlock();
J
Johannes Berg 已提交
231 232
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "timer expired on tid %d but we are not "
J
Johannes Berg 已提交
233
				"(or no longer) expecting addBA response there\n",
234
			tid);
J
Johannes Berg 已提交
235
#endif
236
		return;
J
Johannes Berg 已提交
237 238 239 240 241 242
	}

#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
#endif

243 244
	ieee80211_stop_tx_ba_session(&sta->sta, tid);
	rcu_read_unlock();
J
Johannes Berg 已提交
245 246
}

247 248 249 250 251
static inline int ieee80211_ac_from_tid(int tid)
{
	return ieee802_1d_to_ac[tid & 7];
}

252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286
/*
 * When multiple aggregation sessions on multiple stations
 * are being created/destroyed simultaneously, we need to
 * refcount the global queue stop caused by that in order
 * to not get into a situation where one of the aggregation
 * setup or teardown re-enables queues before the other is
 * ready to handle that.
 *
 * These two functions take care of this issue by keeping
 * a global "agg_queue_stop" refcount.
 */
static void __acquires(agg_queue)
ieee80211_stop_queue_agg(struct ieee80211_local *local, int tid)
{
	int queue = ieee80211_ac_from_tid(tid);

	if (atomic_inc_return(&local->agg_queue_stop[queue]) == 1)
		ieee80211_stop_queue_by_reason(
			&local->hw, queue,
			IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
	__acquire(agg_queue);
}

static void __releases(agg_queue)
ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
{
	int queue = ieee80211_ac_from_tid(tid);

	if (atomic_dec_return(&local->agg_queue_stop[queue]) == 0)
		ieee80211_wake_queue_by_reason(
			&local->hw, queue,
			IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
	__release(agg_queue);
}

J
Johannes Berg 已提交
287
void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
288
{
J
Johannes Berg 已提交
289
	struct tid_ampdu_tx *tid_tx;
290 291 292 293 294
	struct ieee80211_local *local = sta->local;
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	u16 start_seq_num;
	int ret;

J
Johannes Berg 已提交
295
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
296

297 298 299 300 301 302 303 304 305 306 307 308
	/*
	 * While we're asking the driver about the aggregation,
	 * stop the AC queue so that we don't have to worry
	 * about frames that came in while we were doing that,
	 * which would require us to put them to the AC pending
	 * afterwards which just makes the code more complex.
	 */
	ieee80211_stop_queue_agg(local, tid);

	clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);

	/*
309 310
	 * make sure no packets are being processed to get
	 * valid starting sequence number
311
	 */
312 313
	synchronize_net();

314 315 316
	start_seq_num = sta->tid_seq[tid] >> 4;

	ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
317
			       &sta->sta, tid, &start_seq_num, 0);
318 319 320 321 322
	if (ret) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "BA request denied - HW unavailable for"
					" tid %d\n", tid);
#endif
323
		spin_lock_bh(&sta->lock);
J
Johannes Berg 已提交
324
		ieee80211_assign_tid_tx(sta, tid, NULL);
325 326
		spin_unlock_bh(&sta->lock);

327
		ieee80211_wake_queue_agg(local, tid);
328
		kfree_rcu(tid_tx, rcu_head);
329 330 331 332 333 334 335 336 337 338 339 340
		return;
	}

	/* we can take packets again now */
	ieee80211_wake_queue_agg(local, tid);

	/* activate the timer for the recipient's addBA response */
	mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
#endif

341
	spin_lock_bh(&sta->lock);
342
	sta->ampdu_mlme.addba_req_num[tid]++;
343
	spin_unlock_bh(&sta->lock);
344 345 346 347

	/* send AddBA request */
	ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
				     tid_tx->dialog_token, start_seq_num,
348 349
				     local->hw.max_tx_aggregation_subframes,
				     tid_tx->timeout);
350 351
}

352 353
int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
				  u16 timeout)
J
Johannes Berg 已提交
354
{
355 356 357
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	struct ieee80211_local *local = sdata->local;
358
	struct tid_ampdu_tx *tid_tx;
359
	int ret = 0;
J
Johannes Berg 已提交
360

J
Johannes Berg 已提交
361 362
	trace_api_start_tx_ba_session(pubsta, tid);

363 364 365
	if (WARN_ON(!local->ops->ampdu_action))
		return -EINVAL;

366 367
	if ((tid >= STA_TID_NUM) ||
	    !(local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION))
J
Johannes Berg 已提交
368 369 370 371
		return -EINVAL;

#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
372
	       pubsta->addr, tid);
J
Johannes Berg 已提交
373 374
#endif /* CONFIG_MAC80211_HT_DEBUG */

375 376 377 378 379 380
	/*
	 * The aggregation code is not prepared to handle
	 * anything but STA/AP due to the BSSID handling.
	 * IBSS could work in the code but isn't supported
	 * by drivers or the standard.
	 */
381 382 383 384
	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
	    sdata->vif.type != NL80211_IFTYPE_AP)
		return -EINVAL;
385

386
	if (test_sta_flags(sta, WLAN_STA_BLOCK_BA)) {
387
#ifdef CONFIG_MAC80211_HT_DEBUG
388
		printk(KERN_DEBUG "BA sessions blocked. "
389 390
		       "Denying BA session request\n");
#endif
391
		return -EINVAL;
392 393
	}

J
Johannes Berg 已提交
394 395 396 397 398 399 400 401
	spin_lock_bh(&sta->lock);

	/* we have tried too many times, receiver does not want A-MPDU */
	if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
		ret = -EBUSY;
		goto err_unlock_sta;
	}

J
Johannes Berg 已提交
402
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
J
Johannes Berg 已提交
403
	/* check if the TID is not in aggregation flow already */
J
Johannes Berg 已提交
404
	if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
J
Johannes Berg 已提交
405 406 407 408 409 410 411 412 413
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "BA request denied - session is not "
				 "idle on tid %u\n", tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */
		ret = -EAGAIN;
		goto err_unlock_sta;
	}

	/* prepare A-MPDU MLME for Tx aggregation */
414 415
	tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
	if (!tid_tx) {
J
Johannes Berg 已提交
416 417 418 419 420 421
#ifdef CONFIG_MAC80211_HT_DEBUG
		if (net_ratelimit())
			printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
					tid);
#endif
		ret = -ENOMEM;
422
		goto err_unlock_sta;
J
Johannes Berg 已提交
423
	}
424

425
	skb_queue_head_init(&tid_tx->pending);
426
	__set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
427

428 429
	tid_tx->timeout = timeout;

J
Johannes Berg 已提交
430
	/* Tx timer */
431 432 433
	tid_tx->addba_resp_timer.function = sta_addba_resp_timer_expired;
	tid_tx->addba_resp_timer.data = (unsigned long)&sta->timer_to_tid[tid];
	init_timer(&tid_tx->addba_resp_timer);
J
Johannes Berg 已提交
434

435
	/* assign a dialog token */
J
Johannes Berg 已提交
436
	sta->ampdu_mlme.dialog_token_allocator++;
437
	tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
J
Johannes Berg 已提交
438

J
Johannes Berg 已提交
439 440 441 442 443
	/*
	 * Finally, assign it to the start array; the work item will
	 * collect it and move it to the normal array.
	 */
	sta->ampdu_mlme.tid_start_tx[tid] = tid_tx;
444

445
	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
J
Johannes Berg 已提交
446

447
	/* this flow continues off the work */
448
 err_unlock_sta:
J
Johannes Berg 已提交
449 450 451 452 453
	spin_unlock_bh(&sta->lock);
	return ret;
}
EXPORT_SYMBOL(ieee80211_start_tx_ba_session);

454 455
/*
 * splice packets from the STA's pending to the local pending,
456
 * requires a call to ieee80211_agg_splice_finish later
457
 */
458 459 460
static void __acquires(agg_queue)
ieee80211_agg_splice_packets(struct ieee80211_local *local,
			     struct tid_ampdu_tx *tid_tx, u16 tid)
461
{
462
	int queue = ieee80211_ac_from_tid(tid);
463 464
	unsigned long flags;

465
	ieee80211_stop_queue_agg(local, tid);
466

467 468
	if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
			  " from the pending queue\n", tid))
469 470
		return;

471
	if (!skb_queue_empty(&tid_tx->pending)) {
472 473
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		/* copy over remaining packets */
474 475
		skb_queue_splice_tail_init(&tid_tx->pending,
					   &local->pending[queue]);
476 477 478 479
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
	}
}

480 481
static void __releases(agg_queue)
ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
482
{
483
	ieee80211_wake_queue_agg(local, tid);
484 485
}

486 487 488
static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
					 struct sta_info *sta, u16 tid)
{
J
Johannes Berg 已提交
489 490
	struct tid_ampdu_tx *tid_tx;

491
	lockdep_assert_held(&sta->ampdu_mlme.mtx);
492

J
Johannes Berg 已提交
493 494
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);

495
#ifdef CONFIG_MAC80211_HT_DEBUG
496
	printk(KERN_DEBUG "Aggregation is on for tid %d\n", tid);
497 498
#endif

499 500
	drv_ampdu_action(local, sta->sdata,
			 IEEE80211_AMPDU_TX_OPERATIONAL,
J
Johannes Berg 已提交
501
			 &sta->sta, tid, NULL, tid_tx->buf_size);
502 503 504 505 506 507 508

	/*
	 * synchronize with TX path, while splicing the TX path
	 * should block so it won't put more packets onto pending.
	 */
	spin_lock_bh(&sta->lock);

J
Johannes Berg 已提交
509
	ieee80211_agg_splice_packets(local, tid_tx, tid);
510
	/*
511 512 513
	 * Now mark as operational. This will be visible
	 * in the TX path, and lets it go lock-free in
	 * the common case.
514
	 */
J
Johannes Berg 已提交
515
	set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
516
	ieee80211_agg_splice_finish(local, tid);
517

518
	spin_unlock_bh(&sta->lock);
519 520
}

521
void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
J
Johannes Berg 已提交
522
{
523 524
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
525
	struct sta_info *sta;
526
	struct tid_ampdu_tx *tid_tx;
J
Johannes Berg 已提交
527

J
Johannes Berg 已提交
528 529
	trace_api_start_tx_ba_cb(sdata, ra, tid);

J
Johannes Berg 已提交
530 531 532 533 534 535 536 537
	if (tid >= STA_TID_NUM) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
				tid, STA_TID_NUM);
#endif
		return;
	}

538
	mutex_lock(&local->sta_mtx);
539
	sta = sta_info_get(sdata, ra);
J
Johannes Berg 已提交
540
	if (!sta) {
541
		mutex_unlock(&local->sta_mtx);
J
Johannes Berg 已提交
542 543 544 545 546 547
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "Could not find station: %pM\n", ra);
#endif
		return;
	}

548
	mutex_lock(&sta->ampdu_mlme.mtx);
J
Johannes Berg 已提交
549
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
J
Johannes Berg 已提交
550

551
	if (WARN_ON(!tid_tx)) {
J
Johannes Berg 已提交
552
#ifdef CONFIG_MAC80211_HT_DEBUG
553
		printk(KERN_DEBUG "addBA was not requested!\n");
J
Johannes Berg 已提交
554
#endif
555
		goto unlock;
J
Johannes Berg 已提交
556 557
	}

558
	if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
559
		goto unlock;
J
Johannes Berg 已提交
560

561
	if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
562
		ieee80211_agg_tx_operational(local, sta, tid);
563

564 565 566
 unlock:
	mutex_unlock(&sta->ampdu_mlme.mtx);
	mutex_unlock(&local->sta_mtx);
J
Johannes Berg 已提交
567 568
}

569
void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
570 571
				      const u8 *ra, u16 tid)
{
572 573
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_local *local = sdata->local;
574 575 576 577 578 579 580
	struct ieee80211_ra_tid *ra_tid;
	struct sk_buff *skb = dev_alloc_skb(0);

	if (unlikely(!skb)) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		if (net_ratelimit())
			printk(KERN_WARNING "%s: Not enough memory, "
581
			       "dropping start BA session", sdata->name);
582 583 584 585 586 587 588
#endif
		return;
	}
	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
	memcpy(&ra_tid->ra, ra, ETH_ALEN);
	ra_tid->tid = tid;

589 590 591
	skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
	skb_queue_tail(&sdata->skb_queue, skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
592 593 594
}
EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);

595
int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
596 597
				   enum ieee80211_back_parties initiator,
				   bool tx)
598 599 600
{
	int ret;

601
	mutex_lock(&sta->ampdu_mlme.mtx);
602

603
	ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator, tx);
604

605 606
	mutex_unlock(&sta->ampdu_mlme.mtx);

607 608
	return ret;
}
J
Johannes Berg 已提交
609

610
int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
J
Johannes Berg 已提交
611
{
612 613 614
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	struct ieee80211_local *local = sdata->local;
615 616
	struct tid_ampdu_tx *tid_tx;
	int ret = 0;
J
Johannes Berg 已提交
617

618
	trace_api_stop_tx_ba_session(pubsta, tid);
J
Johannes Berg 已提交
619

J
Johannes Berg 已提交
620
	if (!local->ops->ampdu_action)
621 622
		return -EINVAL;

J
Johannes Berg 已提交
623 624 625
	if (tid >= STA_TID_NUM)
		return -EINVAL;

626
	spin_lock_bh(&sta->lock);
J
Johannes Berg 已提交
627
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645

	if (!tid_tx) {
		ret = -ENOENT;
		goto unlock;
	}

	if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
		/* already in progress stopping it */
		ret = 0;
		goto unlock;
	}

	set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state);
	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);

 unlock:
	spin_unlock_bh(&sta->lock);
	return ret;
J
Johannes Berg 已提交
646 647 648
}
EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);

649
void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
J
Johannes Berg 已提交
650
{
651 652
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
653
	struct sta_info *sta;
654
	struct tid_ampdu_tx *tid_tx;
J
Johannes Berg 已提交
655

J
Johannes Berg 已提交
656 657
	trace_api_stop_tx_ba_cb(sdata, ra, tid);

J
Johannes Berg 已提交
658 659 660 661 662 663 664 665 666 667 668 669 670
	if (tid >= STA_TID_NUM) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
				tid, STA_TID_NUM);
#endif
		return;
	}

#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
	       ra, tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */

671 672
	mutex_lock(&local->sta_mtx);

673
	sta = sta_info_get(sdata, ra);
J
Johannes Berg 已提交
674 675 676 677
	if (!sta) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "Could not find station: %pM\n", ra);
#endif
678
		goto unlock;
J
Johannes Berg 已提交
679 680
	}

681
	mutex_lock(&sta->ampdu_mlme.mtx);
682
	spin_lock_bh(&sta->lock);
J
Johannes Berg 已提交
683
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
684 685

	if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
J
Johannes Berg 已提交
686 687 688
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
#endif
689
		goto unlock_sta;
J
Johannes Berg 已提交
690 691
	}

692
	if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR && tid_tx->tx_stop)
J
Johannes Berg 已提交
693 694 695
		ieee80211_send_delba(sta->sdata, ra, tid,
			WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);

696 697 698 699 700 701 702 703 704
	/*
	 * When we get here, the TX path will not be lockless any more wrt.
	 * aggregation, since the OPERATIONAL bit has long been cleared.
	 * Thus it will block on getting the lock, if it occurs. So if we
	 * stop the queue now, we will not get any more packets, and any
	 * that might be being processed will wait for us here, thereby
	 * guaranteeing that no packets go to the tid_tx pending queue any
	 * more.
	 */
J
Johannes Berg 已提交
705

706
	ieee80211_agg_splice_packets(local, tid_tx, tid);
707

708
	/* future packets must not find the tid_tx struct any more */
J
Johannes Berg 已提交
709
	ieee80211_assign_tid_tx(sta, tid, NULL);
710

711
	ieee80211_agg_splice_finish(local, tid);
712

713
	kfree_rcu(tid_tx, rcu_head);
J
Johannes Berg 已提交
714

715
 unlock_sta:
716
	spin_unlock_bh(&sta->lock);
717 718 719
	mutex_unlock(&sta->ampdu_mlme.mtx);
 unlock:
	mutex_unlock(&local->sta_mtx);
J
Johannes Berg 已提交
720 721
}

722
void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
J
Johannes Berg 已提交
723 724
				     const u8 *ra, u16 tid)
{
725 726
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
727 728 729 730 731 732 733
	struct ieee80211_ra_tid *ra_tid;
	struct sk_buff *skb = dev_alloc_skb(0);

	if (unlikely(!skb)) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		if (net_ratelimit())
			printk(KERN_WARNING "%s: Not enough memory, "
734
			       "dropping stop BA session", sdata->name);
J
Johannes Berg 已提交
735 736 737 738 739 740 741
#endif
		return;
	}
	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
	memcpy(&ra_tid->ra, ra, ETH_ALEN);
	ra_tid->tid = tid;

742 743 744
	skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
	skb_queue_tail(&sdata->skb_queue, skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
J
Johannes Berg 已提交
745 746 747
}
EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);

748

J
Johannes Berg 已提交
749 750 751 752 753
void ieee80211_process_addba_resp(struct ieee80211_local *local,
				  struct sta_info *sta,
				  struct ieee80211_mgmt *mgmt,
				  size_t len)
{
754
	struct tid_ampdu_tx *tid_tx;
755
	u16 capab, tid;
756
	u8 buf_size;
J
Johannes Berg 已提交
757 758 759

	capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
760
	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
J
Johannes Berg 已提交
761

762
	mutex_lock(&sta->ampdu_mlme.mtx);
J
Johannes Berg 已提交
763

J
Johannes Berg 已提交
764
	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
765
	if (!tid_tx)
766
		goto out;
J
Johannes Berg 已提交
767

768
	if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
J
Johannes Berg 已提交
769 770
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
771
#endif
772
		goto out;
J
Johannes Berg 已提交
773 774
	}

775
	del_timer(&tid_tx->addba_resp_timer);
776

J
Johannes Berg 已提交
777
#ifdef CONFIG_MAC80211_HT_DEBUG
778
	printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
779
#endif
780 781 782 783 784 785
	/*
	 * IEEE 802.11-2007 7.3.1.14:
	 * In an ADDBA Response frame, when the Status Code field
	 * is set to 0, the Buffer Size subfield is set to a value
	 * of at least 1.
	 */
J
Johannes Berg 已提交
786
	if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
787
			== WLAN_STATUS_SUCCESS && buf_size) {
788 789 790 791 792
		if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
				     &tid_tx->state)) {
			/* ignore duplicate response */
			goto out;
		}
J
Johannes Berg 已提交
793

794 795
		tid_tx->buf_size = buf_size;

796
		if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
797
			ieee80211_agg_tx_operational(local, sta, tid);
J
Johannes Berg 已提交
798

799
		sta->ampdu_mlme.addba_req_num[tid] = 0;
J
Johannes Berg 已提交
800
	} else {
801 802
		___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
						true);
J
Johannes Berg 已提交
803
	}
J
Johannes Berg 已提交
804 805

 out:
806
	mutex_unlock(&sta->ampdu_mlme.mtx);
J
Johannes Berg 已提交
807
}