agg-tx.c 30 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * HT handling
  4. *
  5. * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
  6. * Copyright 2002-2005, Instant802 Networks, Inc.
  7. * Copyright 2005-2006, Devicescape Software, Inc.
  8. * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
  9. * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  10. * Copyright 2007-2010, Intel Corporation
  11. * Copyright(c) 2015-2017 Intel Deutschland GmbH
  12. * Copyright (C) 2018 - 2022 Intel Corporation
  13. */
  14. #include <linux/ieee80211.h>
  15. #include <linux/slab.h>
  16. #include <linux/export.h>
  17. #include <net/mac80211.h>
  18. #include "ieee80211_i.h"
  19. #include "driver-ops.h"
  20. #include "wme.h"
  21. /**
  22. * DOC: TX A-MPDU aggregation
  23. *
  24. * Aggregation on the TX side requires setting the hardware flag
  25. * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed
  26. * packets with a flag indicating A-MPDU aggregation. The driver
  27. * or device is responsible for actually aggregating the frames,
  28. * as well as deciding how many and which to aggregate.
  29. *
  30. * When TX aggregation is started by some subsystem (usually the rate
  31. * control algorithm would be appropriate) by calling the
  32. * ieee80211_start_tx_ba_session() function, the driver will be
  33. * notified via its @ampdu_action function, with the
  34. * %IEEE80211_AMPDU_TX_START action.
  35. *
  36. * In response to that, the driver is later required to call the
  37. * ieee80211_start_tx_ba_cb_irqsafe() function, which will really
  38. * start the aggregation session after the peer has also responded.
  39. * If the peer responds negatively, the session will be stopped
  40. * again right away. Note that it is possible for the aggregation
  41. * session to be stopped before the driver has indicated that it
  42. * is done setting it up, in which case it must not indicate the
  43. * setup completion.
  44. *
  45. * Also note that, since we also need to wait for a response from
  46. * the peer, the driver is notified of the completion of the
  47. * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the
  48. * @ampdu_action callback.
  49. *
  50. * Similarly, when the aggregation session is stopped by the peer
  51. * or something calling ieee80211_stop_tx_ba_session(), the driver's
  52. * @ampdu_action function will be called with the action
  53. * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
  54. * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
  55. * Note that the sta can get destroyed before the BA tear down is
  56. * complete.
  57. */
  58. static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
  59. const u8 *da, u16 tid,
  60. u8 dialog_token, u16 start_seq_num,
  61. u16 agg_size, u16 timeout)
  62. {
  63. struct ieee80211_local *local = sdata->local;
  64. struct sk_buff *skb;
  65. struct ieee80211_mgmt *mgmt;
  66. u16 capab;
  67. skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
  68. if (!skb)
  69. return;
  70. skb_reserve(skb, local->hw.extra_tx_headroom);
  71. mgmt = skb_put_zero(skb, 24);
  72. memcpy(mgmt->da, da, ETH_ALEN);
  73. memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  74. if (sdata->vif.type == NL80211_IFTYPE_AP ||
  75. sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  76. sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  77. memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  78. else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  79. memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  80. else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
  81. memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
  82. mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  83. IEEE80211_STYPE_ACTION);
  84. skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
  85. mgmt->u.action.category = WLAN_CATEGORY_BACK;
  86. mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
  87. mgmt->u.action.u.addba_req.dialog_token = dialog_token;
  88. capab = (u16)(1 << 0); /* bit 0 A-MSDU support */
  89. capab |= (u16)(1 << 1); /* bit 1 aggregation policy */
  90. capab |= (u16)(tid << 2); /* bit 5:2 TID number */
  91. capab |= (u16)(agg_size << 6); /* bit 15:6 max size of aggergation */
  92. mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
  93. mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
  94. mgmt->u.action.u.addba_req.start_seq_num =
  95. cpu_to_le16(start_seq_num << 4);
  96. ieee80211_tx_skb_tid(sdata, skb, tid);
  97. }
  98. void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
  99. {
  100. struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  101. struct ieee80211_local *local = sdata->local;
  102. struct sk_buff *skb;
  103. struct ieee80211_bar *bar;
  104. u16 bar_control = 0;
  105. skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
  106. if (!skb)
  107. return;
  108. skb_reserve(skb, local->hw.extra_tx_headroom);
  109. bar = skb_put_zero(skb, sizeof(*bar));
  110. bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
  111. IEEE80211_STYPE_BACK_REQ);
  112. memcpy(bar->ra, ra, ETH_ALEN);
  113. memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
  114. bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
  115. bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
  116. bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT);
  117. bar->control = cpu_to_le16(bar_control);
  118. bar->start_seq_num = cpu_to_le16(ssn);
  119. IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
  120. IEEE80211_TX_CTL_REQ_TX_STATUS;
  121. ieee80211_tx_skb_tid(sdata, skb, tid);
  122. }
  123. EXPORT_SYMBOL(ieee80211_send_bar);
  124. void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
  125. struct tid_ampdu_tx *tid_tx)
  126. {
  127. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  128. lockdep_assert_held(&sta->lock);
  129. rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
  130. }
  131. /*
  132. * When multiple aggregation sessions on multiple stations
  133. * are being created/destroyed simultaneously, we need to
  134. * refcount the global queue stop caused by that in order
  135. * to not get into a situation where one of the aggregation
  136. * setup or teardown re-enables queues before the other is
  137. * ready to handle that.
  138. *
  139. * These two functions take care of this issue by keeping
  140. * a global "agg_queue_stop" refcount.
  141. */
  142. static void __acquires(agg_queue)
  143. ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
  144. {
  145. int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
  146. /* we do refcounting here, so don't use the queue reason refcounting */
  147. if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
  148. ieee80211_stop_queue_by_reason(
  149. &sdata->local->hw, queue,
  150. IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
  151. false);
  152. __acquire(agg_queue);
  153. }
  154. static void __releases(agg_queue)
  155. ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
  156. {
  157. int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
  158. if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
  159. ieee80211_wake_queue_by_reason(
  160. &sdata->local->hw, queue,
  161. IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
  162. false);
  163. __release(agg_queue);
  164. }
  165. static void
  166. ieee80211_agg_stop_txq(struct sta_info *sta, int tid)
  167. {
  168. struct ieee80211_txq *txq = sta->sta.txq[tid];
  169. struct ieee80211_sub_if_data *sdata;
  170. struct fq *fq;
  171. struct txq_info *txqi;
  172. if (!txq)
  173. return;
  174. txqi = to_txq_info(txq);
  175. sdata = vif_to_sdata(txq->vif);
  176. fq = &sdata->local->fq;
  177. /* Lock here to protect against further seqno updates on dequeue */
  178. spin_lock_bh(&fq->lock);
  179. set_bit(IEEE80211_TXQ_STOP, &txqi->flags);
  180. spin_unlock_bh(&fq->lock);
  181. }
  182. static void
  183. ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable)
  184. {
  185. struct ieee80211_txq *txq = sta->sta.txq[tid];
  186. struct txq_info *txqi;
  187. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  188. if (!txq)
  189. return;
  190. txqi = to_txq_info(txq);
  191. if (enable)
  192. set_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
  193. else
  194. clear_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
  195. clear_bit(IEEE80211_TXQ_STOP, &txqi->flags);
  196. local_bh_disable();
  197. rcu_read_lock();
  198. schedule_and_wake_txq(sta->sdata->local, txqi);
  199. rcu_read_unlock();
  200. local_bh_enable();
  201. }
  202. /*
  203. * splice packets from the STA's pending to the local pending,
  204. * requires a call to ieee80211_agg_splice_finish later
  205. */
  206. static void __acquires(agg_queue)
  207. ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
  208. struct tid_ampdu_tx *tid_tx, u16 tid)
  209. {
  210. struct ieee80211_local *local = sdata->local;
  211. int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
  212. unsigned long flags;
  213. ieee80211_stop_queue_agg(sdata, tid);
  214. if (WARN(!tid_tx,
  215. "TID %d gone but expected when splicing aggregates from the pending queue\n",
  216. tid))
  217. return;
  218. if (!skb_queue_empty(&tid_tx->pending)) {
  219. spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
  220. /* copy over remaining packets */
  221. skb_queue_splice_tail_init(&tid_tx->pending,
  222. &local->pending[queue]);
  223. spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  224. }
  225. }
  226. static void __releases(agg_queue)
  227. ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
  228. {
  229. ieee80211_wake_queue_agg(sdata, tid);
  230. }
  231. static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid)
  232. {
  233. struct tid_ampdu_tx *tid_tx;
  234. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  235. lockdep_assert_held(&sta->lock);
  236. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  237. /*
  238. * When we get here, the TX path will not be lockless any more wrt.
  239. * aggregation, since the OPERATIONAL bit has long been cleared.
  240. * Thus it will block on getting the lock, if it occurs. So if we
  241. * stop the queue now, we will not get any more packets, and any
  242. * that might be being processed will wait for us here, thereby
  243. * guaranteeing that no packets go to the tid_tx pending queue any
  244. * more.
  245. */
  246. ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
  247. /* future packets must not find the tid_tx struct any more */
  248. ieee80211_assign_tid_tx(sta, tid, NULL);
  249. ieee80211_agg_splice_finish(sta->sdata, tid);
  250. kfree_rcu(tid_tx, rcu_head);
  251. }
  252. int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
  253. enum ieee80211_agg_stop_reason reason)
  254. {
  255. struct ieee80211_local *local = sta->local;
  256. struct tid_ampdu_tx *tid_tx;
  257. struct ieee80211_ampdu_params params = {
  258. .sta = &sta->sta,
  259. .tid = tid,
  260. .buf_size = 0,
  261. .amsdu = false,
  262. .timeout = 0,
  263. .ssn = 0,
  264. };
  265. int ret;
  266. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  267. switch (reason) {
  268. case AGG_STOP_DECLINED:
  269. case AGG_STOP_LOCAL_REQUEST:
  270. case AGG_STOP_PEER_REQUEST:
  271. params.action = IEEE80211_AMPDU_TX_STOP_CONT;
  272. break;
  273. case AGG_STOP_DESTROY_STA:
  274. params.action = IEEE80211_AMPDU_TX_STOP_FLUSH;
  275. break;
  276. default:
  277. WARN_ON_ONCE(1);
  278. return -EINVAL;
  279. }
  280. spin_lock_bh(&sta->lock);
  281. /* free struct pending for start, if present */
  282. tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
  283. kfree(tid_tx);
  284. sta->ampdu_mlme.tid_start_tx[tid] = NULL;
  285. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  286. if (!tid_tx) {
  287. spin_unlock_bh(&sta->lock);
  288. return -ENOENT;
  289. }
  290. /*
  291. * if we're already stopping ignore any new requests to stop
  292. * unless we're destroying it in which case notify the driver
  293. */
  294. if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  295. spin_unlock_bh(&sta->lock);
  296. if (reason != AGG_STOP_DESTROY_STA)
  297. return -EALREADY;
  298. params.action = IEEE80211_AMPDU_TX_STOP_FLUSH_CONT;
  299. ret = drv_ampdu_action(local, sta->sdata, &params);
  300. WARN_ON_ONCE(ret);
  301. return 0;
  302. }
  303. if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
  304. /* not even started yet! */
  305. ieee80211_assign_tid_tx(sta, tid, NULL);
  306. spin_unlock_bh(&sta->lock);
  307. kfree_rcu(tid_tx, rcu_head);
  308. return 0;
  309. }
  310. set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
  311. ieee80211_agg_stop_txq(sta, tid);
  312. spin_unlock_bh(&sta->lock);
  313. ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
  314. sta->sta.addr, tid);
  315. del_timer_sync(&tid_tx->addba_resp_timer);
  316. del_timer_sync(&tid_tx->session_timer);
  317. /*
  318. * After this packets are no longer handed right through
  319. * to the driver but are put onto tid_tx->pending instead,
  320. * with locking to ensure proper access.
  321. */
  322. clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
  323. /*
  324. * There might be a few packets being processed right now (on
  325. * another CPU) that have already gotten past the aggregation
  326. * check when it was still OPERATIONAL and consequently have
  327. * IEEE80211_TX_CTL_AMPDU set. In that case, this code might
  328. * call into the driver at the same time or even before the
  329. * TX paths calls into it, which could confuse the driver.
  330. *
  331. * Wait for all currently running TX paths to finish before
  332. * telling the driver. New packets will not go through since
  333. * the aggregation session is no longer OPERATIONAL.
  334. */
  335. if (!local->in_reconfig)
  336. synchronize_net();
  337. tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ?
  338. WLAN_BACK_RECIPIENT :
  339. WLAN_BACK_INITIATOR;
  340. tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST;
  341. ret = drv_ampdu_action(local, sta->sdata, &params);
  342. /* HW shall not deny going back to legacy */
  343. if (WARN_ON(ret)) {
  344. /*
  345. * We may have pending packets get stuck in this case...
  346. * Not bothering with a workaround for now.
  347. */
  348. }
  349. /*
  350. * In the case of AGG_STOP_DESTROY_STA, the driver won't
  351. * necessarily call ieee80211_stop_tx_ba_cb(), so this may
  352. * seem like we can leave the tid_tx data pending forever.
  353. * This is true, in a way, but "forever" is only until the
  354. * station struct is actually destroyed. In the meantime,
  355. * leaving it around ensures that we don't transmit packets
  356. * to the driver on this TID which might confuse it.
  357. */
  358. return 0;
  359. }
  360. /*
  361. * After sending add Block Ack request we activated a timer until
  362. * add Block Ack response will arrive from the recipient.
  363. * If this timer expires sta_addba_resp_timer_expired will be executed.
  364. */
  365. static void sta_addba_resp_timer_expired(struct timer_list *t)
  366. {
  367. struct tid_ampdu_tx *tid_tx = from_timer(tid_tx, t, addba_resp_timer);
  368. struct sta_info *sta = tid_tx->sta;
  369. u8 tid = tid_tx->tid;
  370. /* check if the TID waits for addBA response */
  371. if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
  372. ht_dbg(sta->sdata,
  373. "timer expired on %pM tid %d not expecting addBA response\n",
  374. sta->sta.addr, tid);
  375. return;
  376. }
  377. ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n",
  378. sta->sta.addr, tid);
  379. ieee80211_stop_tx_ba_session(&sta->sta, tid);
  380. }
  381. static void ieee80211_send_addba_with_timeout(struct sta_info *sta,
  382. struct tid_ampdu_tx *tid_tx)
  383. {
  384. struct ieee80211_sub_if_data *sdata = sta->sdata;
  385. struct ieee80211_local *local = sta->local;
  386. u8 tid = tid_tx->tid;
  387. u16 buf_size;
  388. /* activate the timer for the recipient's addBA response */
  389. mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
  390. ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n",
  391. sta->sta.addr, tid);
  392. spin_lock_bh(&sta->lock);
  393. sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
  394. sta->ampdu_mlme.addba_req_num[tid]++;
  395. spin_unlock_bh(&sta->lock);
  396. if (sta->sta.he_cap.has_he) {
  397. buf_size = local->hw.max_tx_aggregation_subframes;
  398. } else {
  399. /*
  400. * We really should use what the driver told us it will
  401. * transmit as the maximum, but certain APs (e.g. the
  402. * LinkSys WRT120N with FW v1.0.07 build 002 Jun 18 2012)
  403. * will crash when we use a lower number.
  404. */
  405. buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
  406. }
  407. /* send AddBA request */
  408. ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
  409. tid_tx->dialog_token, tid_tx->ssn,
  410. buf_size, tid_tx->timeout);
  411. WARN_ON(test_and_set_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state));
  412. }
  413. void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
  414. {
  415. struct tid_ampdu_tx *tid_tx;
  416. struct ieee80211_local *local = sta->local;
  417. struct ieee80211_sub_if_data *sdata = sta->sdata;
  418. struct ieee80211_ampdu_params params = {
  419. .sta = &sta->sta,
  420. .action = IEEE80211_AMPDU_TX_START,
  421. .tid = tid,
  422. .buf_size = 0,
  423. .amsdu = false,
  424. .timeout = 0,
  425. };
  426. int ret;
  427. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  428. /*
  429. * Start queuing up packets for this aggregation session.
  430. * We're going to release them once the driver is OK with
  431. * that.
  432. */
  433. clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
  434. ieee80211_agg_stop_txq(sta, tid);
  435. /*
  436. * Make sure no packets are being processed. This ensures that
  437. * we have a valid starting sequence number and that in-flight
  438. * packets have been flushed out and no packets for this TID
  439. * will go into the driver during the ampdu_action call.
  440. */
  441. synchronize_net();
  442. params.ssn = sta->tid_seq[tid] >> 4;
  443. ret = drv_ampdu_action(local, sdata, &params);
  444. tid_tx->ssn = params.ssn;
  445. if (ret == IEEE80211_AMPDU_TX_START_DELAY_ADDBA) {
  446. return;
  447. } else if (ret == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
  448. /*
  449. * We didn't send the request yet, so don't need to check
  450. * here if we already got a response, just mark as driver
  451. * ready immediately.
  452. */
  453. set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state);
  454. } else if (ret) {
  455. ht_dbg(sdata,
  456. "BA request denied - HW unavailable for %pM tid %d\n",
  457. sta->sta.addr, tid);
  458. spin_lock_bh(&sta->lock);
  459. ieee80211_agg_splice_packets(sdata, tid_tx, tid);
  460. ieee80211_assign_tid_tx(sta, tid, NULL);
  461. ieee80211_agg_splice_finish(sdata, tid);
  462. spin_unlock_bh(&sta->lock);
  463. ieee80211_agg_start_txq(sta, tid, false);
  464. kfree_rcu(tid_tx, rcu_head);
  465. return;
  466. }
  467. ieee80211_send_addba_with_timeout(sta, tid_tx);
  468. }
  469. /*
  470. * After accepting the AddBA Response we activated a timer,
  471. * resetting it after each frame that we send.
  472. */
  473. static void sta_tx_agg_session_timer_expired(struct timer_list *t)
  474. {
  475. struct tid_ampdu_tx *tid_tx = from_timer(tid_tx, t, session_timer);
  476. struct sta_info *sta = tid_tx->sta;
  477. u8 tid = tid_tx->tid;
  478. unsigned long timeout;
  479. if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  480. return;
  481. }
  482. timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
  483. if (time_is_after_jiffies(timeout)) {
  484. mod_timer(&tid_tx->session_timer, timeout);
  485. return;
  486. }
  487. ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
  488. sta->sta.addr, tid);
  489. ieee80211_stop_tx_ba_session(&sta->sta, tid);
  490. }
  491. int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
  492. u16 timeout)
  493. {
  494. struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
  495. struct ieee80211_sub_if_data *sdata = sta->sdata;
  496. struct ieee80211_local *local = sdata->local;
  497. struct tid_ampdu_tx *tid_tx;
  498. int ret = 0;
  499. trace_api_start_tx_ba_session(pubsta, tid);
  500. if (WARN(sta->reserved_tid == tid,
  501. "Requested to start BA session on reserved tid=%d", tid))
  502. return -EINVAL;
  503. if (!pubsta->ht_cap.ht_supported &&
  504. sta->sdata->vif.bss_conf.chandef.chan->band != NL80211_BAND_6GHZ)
  505. return -EINVAL;
  506. if (WARN_ON_ONCE(!local->ops->ampdu_action))
  507. return -EINVAL;
  508. if ((tid >= IEEE80211_NUM_TIDS) ||
  509. !ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) ||
  510. ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW))
  511. return -EINVAL;
  512. if (WARN_ON(tid >= IEEE80211_FIRST_TSPEC_TSID))
  513. return -EINVAL;
  514. ht_dbg(sdata, "Open BA session requested for %pM tid %u\n",
  515. pubsta->addr, tid);
  516. if (sdata->vif.type != NL80211_IFTYPE_STATION &&
  517. sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  518. sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  519. sdata->vif.type != NL80211_IFTYPE_AP &&
  520. sdata->vif.type != NL80211_IFTYPE_ADHOC)
  521. return -EINVAL;
  522. if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
  523. ht_dbg(sdata,
  524. "BA sessions blocked - Denying BA session request %pM tid %d\n",
  525. sta->sta.addr, tid);
  526. return -EINVAL;
  527. }
  528. if (test_sta_flag(sta, WLAN_STA_MFP) &&
  529. !test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
  530. ht_dbg(sdata,
  531. "MFP STA not authorized - deny BA session request %pM tid %d\n",
  532. sta->sta.addr, tid);
  533. return -EINVAL;
  534. }
  535. /*
  536. * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a
  537. * member of an IBSS, and has no other existing Block Ack agreement
  538. * with the recipient STA, then the initiating STA shall transmit a
  539. * Probe Request frame to the recipient STA and shall not transmit an
  540. * ADDBA Request frame unless it receives a Probe Response frame
  541. * from the recipient within dot11ADDBAFailureTimeout.
  542. *
  543. * The probe request mechanism for ADDBA is currently not implemented,
  544. * but we only build up Block Ack session with HT STAs. This information
  545. * is set when we receive a bss info from a probe response or a beacon.
  546. */
  547. if (sta->sdata->vif.type == NL80211_IFTYPE_ADHOC &&
  548. !sta->sta.ht_cap.ht_supported) {
  549. ht_dbg(sdata,
  550. "BA request denied - IBSS STA %pM does not advertise HT support\n",
  551. pubsta->addr);
  552. return -EINVAL;
  553. }
  554. spin_lock_bh(&sta->lock);
  555. /* we have tried too many times, receiver does not want A-MPDU */
  556. if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
  557. ret = -EBUSY;
  558. goto err_unlock_sta;
  559. }
  560. /*
  561. * if we have tried more than HT_AGG_BURST_RETRIES times we
  562. * will spread our requests in time to avoid stalling connection
  563. * for too long
  564. */
  565. if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_BURST_RETRIES &&
  566. time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
  567. HT_AGG_RETRIES_PERIOD)) {
  568. ht_dbg(sdata,
  569. "BA request denied - %d failed requests on %pM tid %u\n",
  570. sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid);
  571. ret = -EBUSY;
  572. goto err_unlock_sta;
  573. }
  574. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  575. /* check if the TID is not in aggregation flow already */
  576. if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
  577. ht_dbg(sdata,
  578. "BA request denied - session is not idle on %pM tid %u\n",
  579. sta->sta.addr, tid);
  580. ret = -EAGAIN;
  581. goto err_unlock_sta;
  582. }
  583. /* prepare A-MPDU MLME for Tx aggregation */
  584. tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
  585. if (!tid_tx) {
  586. ret = -ENOMEM;
  587. goto err_unlock_sta;
  588. }
  589. skb_queue_head_init(&tid_tx->pending);
  590. __set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
  591. tid_tx->timeout = timeout;
  592. tid_tx->sta = sta;
  593. tid_tx->tid = tid;
  594. /* response timer */
  595. timer_setup(&tid_tx->addba_resp_timer, sta_addba_resp_timer_expired, 0);
  596. /* tx timer */
  597. timer_setup(&tid_tx->session_timer,
  598. sta_tx_agg_session_timer_expired, TIMER_DEFERRABLE);
  599. /* assign a dialog token */
  600. sta->ampdu_mlme.dialog_token_allocator++;
  601. tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
  602. /*
  603. * Finally, assign it to the start array; the work item will
  604. * collect it and move it to the normal array.
  605. */
  606. sta->ampdu_mlme.tid_start_tx[tid] = tid_tx;
  607. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  608. /* this flow continues off the work */
  609. err_unlock_sta:
  610. spin_unlock_bh(&sta->lock);
  611. return ret;
  612. }
  613. EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
  614. static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
  615. struct sta_info *sta, u16 tid)
  616. {
  617. struct tid_ampdu_tx *tid_tx;
  618. struct ieee80211_ampdu_params params = {
  619. .sta = &sta->sta,
  620. .action = IEEE80211_AMPDU_TX_OPERATIONAL,
  621. .tid = tid,
  622. .timeout = 0,
  623. .ssn = 0,
  624. };
  625. lockdep_assert_held(&sta->ampdu_mlme.mtx);
  626. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  627. params.buf_size = tid_tx->buf_size;
  628. params.amsdu = tid_tx->amsdu;
  629. ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n",
  630. sta->sta.addr, tid);
  631. drv_ampdu_action(local, sta->sdata, &params);
  632. /*
  633. * synchronize with TX path, while splicing the TX path
  634. * should block so it won't put more packets onto pending.
  635. */
  636. spin_lock_bh(&sta->lock);
  637. ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
  638. /*
  639. * Now mark as operational. This will be visible
  640. * in the TX path, and lets it go lock-free in
  641. * the common case.
  642. */
  643. set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
  644. ieee80211_agg_splice_finish(sta->sdata, tid);
  645. spin_unlock_bh(&sta->lock);
  646. ieee80211_agg_start_txq(sta, tid, true);
  647. }
  648. void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
  649. struct tid_ampdu_tx *tid_tx)
  650. {
  651. struct ieee80211_sub_if_data *sdata = sta->sdata;
  652. struct ieee80211_local *local = sdata->local;
  653. if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
  654. return;
  655. if (!test_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state)) {
  656. ieee80211_send_addba_with_timeout(sta, tid_tx);
  657. /* RESPONSE_RECEIVED state whould trigger the flow again */
  658. return;
  659. }
  660. if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
  661. ieee80211_agg_tx_operational(local, sta, tid);
  662. }
  663. static struct tid_ampdu_tx *
  664. ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
  665. const u8 *ra, u16 tid, struct sta_info **sta)
  666. {
  667. struct tid_ampdu_tx *tid_tx;
  668. if (tid >= IEEE80211_NUM_TIDS) {
  669. ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
  670. tid, IEEE80211_NUM_TIDS);
  671. return NULL;
  672. }
  673. *sta = sta_info_get_bss(sdata, ra);
  674. if (!*sta) {
  675. ht_dbg(sdata, "Could not find station: %pM\n", ra);
  676. return NULL;
  677. }
  678. tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
  679. if (WARN_ON(!tid_tx))
  680. ht_dbg(sdata, "addBA was not requested!\n");
  681. return tid_tx;
  682. }
  683. void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
  684. const u8 *ra, u16 tid)
  685. {
  686. struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  687. struct ieee80211_local *local = sdata->local;
  688. struct sta_info *sta;
  689. struct tid_ampdu_tx *tid_tx;
  690. trace_api_start_tx_ba_cb(sdata, ra, tid);
  691. rcu_read_lock();
  692. tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
  693. if (!tid_tx)
  694. goto out;
  695. set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
  696. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  697. out:
  698. rcu_read_unlock();
  699. }
  700. EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
  701. int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
  702. enum ieee80211_agg_stop_reason reason)
  703. {
  704. int ret;
  705. mutex_lock(&sta->ampdu_mlme.mtx);
  706. ret = ___ieee80211_stop_tx_ba_session(sta, tid, reason);
  707. mutex_unlock(&sta->ampdu_mlme.mtx);
  708. return ret;
  709. }
  710. int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
  711. {
  712. struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
  713. struct ieee80211_sub_if_data *sdata = sta->sdata;
  714. struct ieee80211_local *local = sdata->local;
  715. struct tid_ampdu_tx *tid_tx;
  716. int ret = 0;
  717. trace_api_stop_tx_ba_session(pubsta, tid);
  718. if (!local->ops->ampdu_action)
  719. return -EINVAL;
  720. if (tid >= IEEE80211_NUM_TIDS)
  721. return -EINVAL;
  722. spin_lock_bh(&sta->lock);
  723. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  724. if (!tid_tx) {
  725. ret = -ENOENT;
  726. goto unlock;
  727. }
  728. WARN(sta->reserved_tid == tid,
  729. "Requested to stop BA session on reserved tid=%d", tid);
  730. if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  731. /* already in progress stopping it */
  732. ret = 0;
  733. goto unlock;
  734. }
  735. set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state);
  736. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  737. unlock:
  738. spin_unlock_bh(&sta->lock);
  739. return ret;
  740. }
  741. EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
  742. void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
  743. struct tid_ampdu_tx *tid_tx)
  744. {
  745. struct ieee80211_sub_if_data *sdata = sta->sdata;
  746. bool send_delba = false;
  747. bool start_txq = false;
  748. ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
  749. sta->sta.addr, tid);
  750. spin_lock_bh(&sta->lock);
  751. if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  752. ht_dbg(sdata,
  753. "unexpected callback to A-MPDU stop for %pM tid %d\n",
  754. sta->sta.addr, tid);
  755. goto unlock_sta;
  756. }
  757. if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR && tid_tx->tx_stop)
  758. send_delba = true;
  759. ieee80211_remove_tid_tx(sta, tid);
  760. start_txq = true;
  761. unlock_sta:
  762. spin_unlock_bh(&sta->lock);
  763. if (start_txq)
  764. ieee80211_agg_start_txq(sta, tid, false);
  765. if (send_delba)
  766. ieee80211_send_delba(sdata, sta->sta.addr, tid,
  767. WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
  768. }
  769. void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
  770. const u8 *ra, u16 tid)
  771. {
  772. struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  773. struct ieee80211_local *local = sdata->local;
  774. struct sta_info *sta;
  775. struct tid_ampdu_tx *tid_tx;
  776. trace_api_stop_tx_ba_cb(sdata, ra, tid);
  777. rcu_read_lock();
  778. tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
  779. if (!tid_tx)
  780. goto out;
  781. set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
  782. ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
  783. out:
  784. rcu_read_unlock();
  785. }
  786. EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
  787. void ieee80211_process_addba_resp(struct ieee80211_local *local,
  788. struct sta_info *sta,
  789. struct ieee80211_mgmt *mgmt,
  790. size_t len)
  791. {
  792. struct tid_ampdu_tx *tid_tx;
  793. struct ieee80211_txq *txq;
  794. u16 capab, tid, buf_size;
  795. bool amsdu;
  796. capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
  797. amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
  798. tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
  799. buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
  800. buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
  801. txq = sta->sta.txq[tid];
  802. if (!amsdu && txq)
  803. set_bit(IEEE80211_TXQ_NO_AMSDU, &to_txq_info(txq)->flags);
  804. mutex_lock(&sta->ampdu_mlme.mtx);
  805. tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
  806. if (!tid_tx)
  807. goto out;
  808. if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
  809. ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n",
  810. sta->sta.addr, tid);
  811. goto out;
  812. }
  813. del_timer_sync(&tid_tx->addba_resp_timer);
  814. ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n",
  815. sta->sta.addr, tid);
  816. /*
  817. * addba_resp_timer may have fired before we got here, and
  818. * caused WANT_STOP to be set. If the stop then was already
  819. * processed further, STOPPING might be set.
  820. */
  821. if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
  822. test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
  823. ht_dbg(sta->sdata,
  824. "got addBA resp for %pM tid %d but we already gave up\n",
  825. sta->sta.addr, tid);
  826. goto out;
  827. }
  828. /*
  829. * IEEE 802.11-2007 7.3.1.14:
  830. * In an ADDBA Response frame, when the Status Code field
  831. * is set to 0, the Buffer Size subfield is set to a value
  832. * of at least 1.
  833. */
  834. if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
  835. == WLAN_STATUS_SUCCESS && buf_size) {
  836. if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
  837. &tid_tx->state)) {
  838. /* ignore duplicate response */
  839. goto out;
  840. }
  841. tid_tx->buf_size = buf_size;
  842. tid_tx->amsdu = amsdu;
  843. if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
  844. ieee80211_agg_tx_operational(local, sta, tid);
  845. sta->ampdu_mlme.addba_req_num[tid] = 0;
  846. tid_tx->timeout =
  847. le16_to_cpu(mgmt->u.action.u.addba_resp.timeout);
  848. if (tid_tx->timeout) {
  849. mod_timer(&tid_tx->session_timer,
  850. TU_TO_EXP_TIME(tid_tx->timeout));
  851. tid_tx->last_tx = jiffies;
  852. }
  853. } else {
  854. ___ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED);
  855. }
  856. out:
  857. mutex_unlock(&sta->ampdu_mlme.mtx);
  858. }