1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 /* 3 * Copyright (C) 2024-2025 Intel Corporation 4 */ 5 #include "agg.h" 6 #include "sta.h" 7 #include "hcmd.h" 8 9 static void 10 iwl_mld_reorder_release_frames(struct iwl_mld *mld, struct ieee80211_sta *sta, 11 struct napi_struct *napi, 12 struct iwl_mld_baid_data *baid_data, 13 struct iwl_mld_reorder_buffer *reorder_buf, 14 u16 nssn) 15 { 16 struct iwl_mld_reorder_buf_entry *entries = 17 &baid_data->entries[reorder_buf->queue * 18 baid_data->entries_per_queue]; 19 u16 ssn = reorder_buf->head_sn; 20 21 while (ieee80211_sn_less(ssn, nssn)) { 22 int index = ssn % baid_data->buf_size; 23 struct sk_buff_head *skb_list = &entries[index].frames; 24 struct sk_buff *skb; 25 26 ssn = ieee80211_sn_inc(ssn); 27 28 /* Empty the list. Will have more than one frame for A-MSDU. 29 * Empty list is valid as well since nssn indicates frames were 30 * received. 31 */ 32 while ((skb = __skb_dequeue(skb_list))) { 33 iwl_mld_pass_packet_to_mac80211(mld, napi, skb, 34 reorder_buf->queue, 35 sta); 36 reorder_buf->num_stored--; 37 } 38 } 39 reorder_buf->head_sn = nssn; 40 } 41 42 static void iwl_mld_release_frames_from_notif(struct iwl_mld *mld, 43 struct napi_struct *napi, 44 u8 baid, u16 nssn, int queue) 45 { 46 struct iwl_mld_reorder_buffer *reorder_buf; 47 struct iwl_mld_baid_data *ba_data; 48 struct ieee80211_link_sta *link_sta; 49 u32 sta_id; 50 51 IWL_DEBUG_HT(mld, "Frame release notification for BAID %u, NSSN %d\n", 52 baid, nssn); 53 54 if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID || 55 baid >= ARRAY_SIZE(mld->fw_id_to_ba))) 56 return; 57 58 rcu_read_lock(); 59 60 ba_data = rcu_dereference(mld->fw_id_to_ba[baid]); 61 if (!ba_data) { 62 IWL_DEBUG_HT(mld, "BAID %d not found in map\n", baid); 63 goto out_unlock; 64 } 65 66 /* pick any STA ID to find the pointer */ 67 if (WARN_ON_ONCE(!ba_data->sta_mask)) 68 goto out_unlock; 69 70 sta_id = ffs(ba_data->sta_mask) - 1; 71 link_sta = rcu_dereference(mld->fw_id_to_link_sta[sta_id]); 72 if (WARN_ON_ONCE(IS_ERR_OR_NULL(link_sta) || !link_sta->sta)) 73 goto out_unlock; 74 75 reorder_buf = &ba_data->reorder_buf[queue]; 76 77 iwl_mld_reorder_release_frames(mld, link_sta->sta, napi, ba_data, 78 reorder_buf, nssn); 79 out_unlock: 80 rcu_read_unlock(); 81 } 82 83 void iwl_mld_handle_frame_release_notif(struct iwl_mld *mld, 84 struct napi_struct *napi, 85 struct iwl_rx_packet *pkt, int queue) 86 { 87 struct iwl_frame_release *release = (void *)pkt->data; 88 u32 pkt_len = iwl_rx_packet_payload_len(pkt); 89 90 if (IWL_FW_CHECK(mld, pkt_len < sizeof(*release), 91 "Unexpected frame release notif size %u (expected %zu)\n", 92 pkt_len, sizeof(*release))) 93 return; 94 95 iwl_mld_release_frames_from_notif(mld, napi, release->baid, 96 le16_to_cpu(release->nssn), 97 queue); 98 } 99 100 void iwl_mld_handle_bar_frame_release_notif(struct iwl_mld *mld, 101 struct napi_struct *napi, 102 struct iwl_rx_packet *pkt, 103 int queue) 104 { 105 struct iwl_bar_frame_release *release = (void *)pkt->data; 106 struct iwl_mld_baid_data *baid_data; 107 unsigned int baid, nssn, sta_id, tid; 108 u32 pkt_len = iwl_rx_packet_payload_len(pkt); 109 110 if (IWL_FW_CHECK(mld, pkt_len < sizeof(*release), 111 "Unexpected frame release notif size %u (expected %zu)\n", 112 pkt_len, sizeof(*release))) 113 return; 114 115 baid = le32_get_bits(release->ba_info, 116 IWL_BAR_FRAME_RELEASE_BAID_MASK); 117 nssn = le32_get_bits(release->ba_info, 118 IWL_BAR_FRAME_RELEASE_NSSN_MASK); 119 sta_id = le32_get_bits(release->sta_tid, 120 IWL_BAR_FRAME_RELEASE_STA_MASK); 121 tid = le32_get_bits(release->sta_tid, 122 IWL_BAR_FRAME_RELEASE_TID_MASK); 123 124 if (IWL_FW_CHECK(mld, baid >= ARRAY_SIZE(mld->fw_id_to_ba), 125 "BAR release: invalid BAID (%x)\n", baid)) 126 return; 127 128 rcu_read_lock(); 129 baid_data = rcu_dereference(mld->fw_id_to_ba[baid]); 130 if (!baid_data) { 131 IWL_DEBUG_HT(mld, 132 "Got valid BAID %d but not allocated\n", 133 baid); 134 goto out_unlock; 135 } 136 137 if (IWL_FW_CHECK(mld, tid != baid_data->tid || 138 sta_id > mld->fw->ucode_capa.num_stations || 139 !(baid_data->sta_mask & BIT(sta_id)), 140 "BAID 0x%x is mapped to sta_mask:0x%x tid:%d, but BAR release received for sta:%d tid:%d\n", 141 baid, baid_data->sta_mask, baid_data->tid, sta_id, 142 tid)) 143 goto out_unlock; 144 145 IWL_DEBUG_DROP(mld, "Received a BAR, expect packet loss: nssn %d\n", 146 nssn); 147 148 iwl_mld_release_frames_from_notif(mld, napi, baid, nssn, queue); 149 out_unlock: 150 rcu_read_unlock(); 151 } 152 153 void iwl_mld_del_ba(struct iwl_mld *mld, int queue, 154 struct iwl_mld_delba_data *data) 155 { 156 struct iwl_mld_baid_data *ba_data; 157 struct iwl_mld_reorder_buffer *reorder_buf; 158 struct ieee80211_link_sta *link_sta; 159 u8 baid = data->baid; 160 u32 sta_id; 161 162 if (WARN_ONCE(baid >= IWL_MAX_BAID, "invalid BAID: %x\n", baid)) 163 return; 164 165 rcu_read_lock(); 166 167 ba_data = rcu_dereference(mld->fw_id_to_ba[baid]); 168 if (WARN_ON_ONCE(!ba_data)) 169 goto out_unlock; 170 171 /* pick any STA ID to find the pointer */ 172 if (WARN_ON_ONCE(!ba_data->sta_mask)) 173 goto out_unlock; 174 175 sta_id = ffs(ba_data->sta_mask) - 1; 176 link_sta = rcu_dereference(mld->fw_id_to_link_sta[sta_id]); 177 if (WARN_ON_ONCE(IS_ERR_OR_NULL(link_sta) || !link_sta->sta)) 178 goto out_unlock; 179 180 reorder_buf = &ba_data->reorder_buf[queue]; 181 182 /* release all frames that are in the reorder buffer to the stack */ 183 iwl_mld_reorder_release_frames(mld, link_sta->sta, NULL, 184 ba_data, reorder_buf, 185 ieee80211_sn_add(reorder_buf->head_sn, 186 ba_data->buf_size)); 187 out_unlock: 188 rcu_read_unlock(); 189 } 190 191 /* Returns true if the MPDU was buffered\dropped, false if it should be passed 192 * to upper layer. 193 */ 194 enum iwl_mld_reorder_result 195 iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi, 196 int queue, struct ieee80211_sta *sta, 197 struct sk_buff *skb, struct iwl_rx_mpdu_desc *desc) 198 { 199 struct ieee80211_hdr *hdr = (void *)skb_mac_header(skb); 200 struct iwl_mld_baid_data *baid_data; 201 struct iwl_mld_reorder_buffer *buffer; 202 struct iwl_mld_reorder_buf_entry *entries; 203 struct iwl_mld_sta *mld_sta = iwl_mld_sta_from_mac80211(sta); 204 struct iwl_mld_link_sta *mld_link_sta; 205 u32 reorder = le32_to_cpu(desc->reorder_data); 206 bool amsdu, last_subframe, is_old_sn, is_dup; 207 u8 tid = ieee80211_get_tid(hdr); 208 u8 baid; 209 u16 nssn, sn; 210 u32 sta_mask = 0; 211 int index; 212 u8 link_id; 213 214 baid = u32_get_bits(reorder, IWL_RX_MPDU_REORDER_BAID_MASK); 215 216 /* This also covers the case of receiving a Block Ack Request 217 * outside a BA session; we'll pass it to mac80211 and that 218 * then sends a delBA action frame. 219 * This also covers pure monitor mode, in which case we won't 220 * have any BA sessions. 221 */ 222 if (baid == IWL_RX_REORDER_DATA_INVALID_BAID) 223 return IWL_MLD_PASS_SKB; 224 225 /* no sta yet */ 226 if (WARN_ONCE(!sta, 227 "Got valid BAID without a valid station assigned\n")) 228 return IWL_MLD_PASS_SKB; 229 230 /* not a data packet */ 231 if (!ieee80211_is_data_qos(hdr->frame_control) || 232 is_multicast_ether_addr(hdr->addr1)) 233 return IWL_MLD_PASS_SKB; 234 235 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 236 return IWL_MLD_PASS_SKB; 237 238 baid_data = rcu_dereference(mld->fw_id_to_ba[baid]); 239 if (!baid_data) { 240 IWL_DEBUG_HT(mld, 241 "Got valid BAID but no baid allocated, bypass re-ordering (BAID=%d reorder=0x%x)\n", 242 baid, reorder); 243 return IWL_MLD_PASS_SKB; 244 } 245 246 for_each_mld_link_sta(mld_sta, mld_link_sta, link_id) 247 sta_mask |= BIT(mld_link_sta->fw_id); 248 249 /* verify the BAID is correctly mapped to the sta and tid */ 250 if (IWL_FW_CHECK(mld, 251 tid != baid_data->tid || 252 !(sta_mask & baid_data->sta_mask), 253 "BAID 0x%x is mapped to sta_mask:0x%x tid:%d, but was received for sta_mask:0x%x tid:%d\n", 254 baid, baid_data->sta_mask, baid_data->tid, 255 sta_mask, tid)) 256 return IWL_MLD_PASS_SKB; 257 258 buffer = &baid_data->reorder_buf[queue]; 259 entries = &baid_data->entries[queue * baid_data->entries_per_queue]; 260 261 is_old_sn = !!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN); 262 263 if (!buffer->valid && is_old_sn) 264 return IWL_MLD_PASS_SKB; 265 266 buffer->valid = true; 267 268 is_dup = !!(desc->status & cpu_to_le32(IWL_RX_MPDU_STATUS_DUPLICATE)); 269 270 /* drop any duplicated or outdated packets */ 271 if (is_dup || is_old_sn) 272 return IWL_MLD_DROP_SKB; 273 274 sn = u32_get_bits(reorder, IWL_RX_MPDU_REORDER_SN_MASK); 275 nssn = u32_get_bits(reorder, IWL_RX_MPDU_REORDER_NSSN_MASK); 276 amsdu = desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU; 277 last_subframe = desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME; 278 279 /* release immediately if allowed by nssn and no stored frames */ 280 if (!buffer->num_stored && ieee80211_sn_less(sn, nssn)) { 281 if (!amsdu || last_subframe) 282 buffer->head_sn = nssn; 283 return IWL_MLD_PASS_SKB; 284 } 285 286 /* release immediately if there are no stored frames, and the sn is 287 * equal to the head. 288 * This can happen due to reorder timer, where NSSN is behind head_sn. 289 * When we released everything, and we got the next frame in the 290 * sequence, according to the NSSN we can't release immediately, 291 * while technically there is no hole and we can move forward. 292 */ 293 if (!buffer->num_stored && sn == buffer->head_sn) { 294 if (!amsdu || last_subframe) 295 buffer->head_sn = ieee80211_sn_inc(buffer->head_sn); 296 return IWL_MLD_PASS_SKB; 297 } 298 299 /* put in reorder buffer */ 300 index = sn % baid_data->buf_size; 301 __skb_queue_tail(&entries[index].frames, skb); 302 buffer->num_stored++; 303 304 /* We cannot trust NSSN for AMSDU sub-frames that are not the last. The 305 * reason is that NSSN advances on the first sub-frame, and may cause 306 * the reorder buffer to advance before all the sub-frames arrive. 307 * 308 * Example: reorder buffer contains SN 0 & 2, and we receive AMSDU with 309 * SN 1. NSSN for first sub frame will be 3 with the result of driver 310 * releasing SN 0,1, 2. When sub-frame 1 arrives - reorder buffer is 311 * already ahead and it will be dropped. 312 * If the last sub-frame is not on this queue - we will get frame 313 * release notification with up to date NSSN. 314 * If this is the first frame that is stored in the buffer, the head_sn 315 * may be outdated. Update it based on the last NSSN to make sure it 316 * will be released when the frame release notification arrives. 317 */ 318 if (!amsdu || last_subframe) 319 iwl_mld_reorder_release_frames(mld, sta, napi, baid_data, 320 buffer, nssn); 321 else if (buffer->num_stored == 1) 322 buffer->head_sn = nssn; 323 324 return IWL_MLD_BUFFERED_SKB; 325 } 326 EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mld_reorder); 327 328 static void iwl_mld_rx_agg_session_expired(struct timer_list *t) 329 { 330 struct iwl_mld_baid_data *data = 331 timer_container_of(data, t, session_timer); 332 struct iwl_mld_baid_data __rcu **rcu_ptr = data->rcu_ptr; 333 struct iwl_mld_baid_data *ba_data; 334 struct ieee80211_link_sta *link_sta; 335 struct iwl_mld_sta *mld_sta; 336 unsigned long timeout; 337 unsigned int sta_id; 338 339 rcu_read_lock(); 340 341 ba_data = rcu_dereference(*rcu_ptr); 342 if (WARN_ON(!ba_data)) 343 goto unlock; 344 345 if (WARN_ON(!ba_data->timeout)) 346 goto unlock; 347 348 timeout = ba_data->last_rx_timestamp + 349 TU_TO_JIFFIES(ba_data->timeout * 2); 350 if (time_is_after_jiffies(timeout)) { 351 mod_timer(&ba_data->session_timer, timeout); 352 goto unlock; 353 } 354 355 /* timer expired, pick any STA ID to find the pointer */ 356 if (WARN_ON_ONCE(!ba_data->sta_mask)) 357 goto unlock; 358 359 sta_id = ffs(ba_data->sta_mask) - 1; 360 link_sta = rcu_dereference(ba_data->mld->fw_id_to_link_sta[sta_id]); 361 362 /* sta should be valid unless the following happens: 363 * The firmware asserts which triggers a reconfig flow, but 364 * the reconfig fails before we set the pointer to sta into 365 * the fw_id_to_link_sta pointer table. mac80211 can't stop 366 * A-MPDU and hence the timer continues to run. Then, the 367 * timer expires and sta is NULL. 368 */ 369 if (IS_ERR_OR_NULL(link_sta) || WARN_ON(!link_sta->sta)) 370 goto unlock; 371 372 mld_sta = iwl_mld_sta_from_mac80211(link_sta->sta); 373 ieee80211_rx_ba_timer_expired(mld_sta->vif, link_sta->sta->addr, 374 ba_data->tid); 375 unlock: 376 rcu_read_unlock(); 377 } 378 379 static int 380 iwl_mld_stop_ba_in_fw(struct iwl_mld *mld, struct ieee80211_sta *sta, int tid) 381 { 382 struct iwl_rx_baid_cfg_cmd cmd = { 383 .action = cpu_to_le32(IWL_RX_BAID_ACTION_REMOVE), 384 .remove.sta_id_mask = 385 cpu_to_le32(iwl_mld_fw_sta_id_mask(mld, sta)), 386 .remove.tid = cpu_to_le32(tid), 387 388 }; 389 int ret; 390 391 ret = iwl_mld_send_cmd_pdu(mld, 392 WIDE_ID(DATA_PATH_GROUP, 393 RX_BAID_ALLOCATION_CONFIG_CMD), 394 &cmd); 395 if (ret) 396 return ret; 397 398 IWL_DEBUG_HT(mld, "RX BA Session stopped in fw\n"); 399 400 return ret; 401 } 402 403 static int 404 iwl_mld_start_ba_in_fw(struct iwl_mld *mld, struct ieee80211_sta *sta, 405 int tid, u16 ssn, u16 buf_size) 406 { 407 struct iwl_rx_baid_cfg_cmd cmd = { 408 .action = cpu_to_le32(IWL_RX_BAID_ACTION_ADD), 409 .alloc.sta_id_mask = 410 cpu_to_le32(iwl_mld_fw_sta_id_mask(mld, sta)), 411 .alloc.tid = tid, 412 .alloc.ssn = cpu_to_le16(ssn), 413 .alloc.win_size = cpu_to_le16(buf_size), 414 }; 415 struct iwl_host_cmd hcmd = { 416 .id = WIDE_ID(DATA_PATH_GROUP, RX_BAID_ALLOCATION_CONFIG_CMD), 417 .flags = CMD_WANT_SKB, 418 .len[0] = sizeof(cmd), 419 .data[0] = &cmd, 420 }; 421 struct iwl_rx_baid_cfg_resp *resp; 422 struct iwl_rx_packet *pkt; 423 u32 resp_len; 424 int ret, baid; 425 426 BUILD_BUG_ON(sizeof(*resp) != sizeof(baid)); 427 428 ret = iwl_mld_send_cmd(mld, &hcmd); 429 if (ret) 430 return ret; 431 432 pkt = hcmd.resp_pkt; 433 434 resp_len = iwl_rx_packet_payload_len(pkt); 435 if (IWL_FW_CHECK(mld, resp_len != sizeof(*resp), 436 "BAID_ALLOC_CMD: unexpected response length %d\n", 437 resp_len)) { 438 ret = -EIO; 439 goto out; 440 } 441 442 IWL_DEBUG_HT(mld, "RX BA Session started in fw\n"); 443 444 resp = (void *)pkt->data; 445 baid = le32_to_cpu(resp->baid); 446 447 if (IWL_FW_CHECK(mld, baid < 0 || baid >= ARRAY_SIZE(mld->fw_id_to_ba), 448 "BAID_ALLOC_CMD: invalid BAID response %d\n", baid)) { 449 ret = -EINVAL; 450 goto out; 451 } 452 453 ret = baid; 454 out: 455 iwl_free_resp(&hcmd); 456 return ret; 457 } 458 459 static void iwl_mld_init_reorder_buffer(struct iwl_mld *mld, 460 struct iwl_mld_baid_data *data, 461 u16 ssn) 462 { 463 for (int i = 0; i < mld->trans->info.num_rxqs; i++) { 464 struct iwl_mld_reorder_buffer *reorder_buf = 465 &data->reorder_buf[i]; 466 struct iwl_mld_reorder_buf_entry *entries = 467 &data->entries[i * data->entries_per_queue]; 468 469 reorder_buf->head_sn = ssn; 470 reorder_buf->queue = i; 471 472 for (int j = 0; j < data->buf_size; j++) 473 __skb_queue_head_init(&entries[j].frames); 474 } 475 } 476 477 static void iwl_mld_free_reorder_buffer(struct iwl_mld *mld, 478 struct iwl_mld_baid_data *data) 479 { 480 struct iwl_mld_delba_data delba_data = { 481 .baid = data->baid, 482 }; 483 484 iwl_mld_sync_rx_queues(mld, IWL_MLD_RXQ_NOTIF_DEL_BA, 485 &delba_data, sizeof(delba_data)); 486 487 for (int i = 0; i < mld->trans->info.num_rxqs; i++) { 488 struct iwl_mld_reorder_buffer *reorder_buf = 489 &data->reorder_buf[i]; 490 struct iwl_mld_reorder_buf_entry *entries = 491 &data->entries[i * data->entries_per_queue]; 492 493 if (likely(!reorder_buf->num_stored)) 494 continue; 495 496 /* This shouldn't happen in regular DELBA since the RX queues 497 * sync internal DELBA notification should trigger a release 498 * of all frames in the reorder buffer. 499 */ 500 WARN_ON(1); 501 502 for (int j = 0; j < data->buf_size; j++) 503 __skb_queue_purge(&entries[j].frames); 504 } 505 } 506 507 int iwl_mld_ampdu_rx_start(struct iwl_mld *mld, struct ieee80211_sta *sta, 508 int tid, u16 ssn, u16 buf_size, u16 timeout) 509 { 510 struct iwl_mld_sta *mld_sta = iwl_mld_sta_from_mac80211(sta); 511 struct iwl_mld_baid_data *baid_data = NULL; 512 u32 reorder_buf_size = buf_size * sizeof(baid_data->entries[0]); 513 int ret, baid; 514 u32 sta_mask; 515 516 lockdep_assert_wiphy(mld->wiphy); 517 518 if (mld->num_rx_ba_sessions >= IWL_MAX_BAID) { 519 IWL_DEBUG_HT(mld, 520 "Max num of RX BA sessions reached; blocking new session\n"); 521 return -ENOSPC; 522 } 523 524 sta_mask = iwl_mld_fw_sta_id_mask(mld, sta); 525 if (WARN_ON(!sta_mask)) 526 return -EINVAL; 527 528 /* sparse doesn't like the __align() so don't check */ 529 #ifndef __CHECKER__ 530 /* The division below will be OK if either the cache line size 531 * can be divided by the entry size (ALIGN will round up) or if 532 * the entry size can be divided by the cache line size, in which 533 * case the ALIGN() will do nothing. 534 */ 535 BUILD_BUG_ON(SMP_CACHE_BYTES % sizeof(baid_data->entries[0]) && 536 sizeof(baid_data->entries[0]) % SMP_CACHE_BYTES); 537 #endif 538 539 /* Upward align the reorder buffer size to fill an entire cache 540 * line for each queue, to avoid sharing cache lines between 541 * different queues. 542 */ 543 reorder_buf_size = ALIGN(reorder_buf_size, SMP_CACHE_BYTES); 544 545 /* Allocate here so if allocation fails we can bail out early 546 * before starting the BA session in the firmware 547 */ 548 baid_data = kzalloc(sizeof(*baid_data) + 549 mld->trans->info.num_rxqs * reorder_buf_size, 550 GFP_KERNEL); 551 if (!baid_data) 552 return -ENOMEM; 553 554 /* This division is why we need the above BUILD_BUG_ON(), 555 * if that doesn't hold then this will not be right. 556 */ 557 baid_data->entries_per_queue = 558 reorder_buf_size / sizeof(baid_data->entries[0]); 559 560 baid = iwl_mld_start_ba_in_fw(mld, sta, tid, ssn, buf_size); 561 if (baid < 0) { 562 ret = baid; 563 goto out_free; 564 } 565 566 mld->num_rx_ba_sessions++; 567 mld_sta->tid_to_baid[tid] = baid; 568 569 baid_data->baid = baid; 570 baid_data->mld = mld; 571 baid_data->tid = tid; 572 baid_data->buf_size = buf_size; 573 baid_data->sta_mask = sta_mask; 574 baid_data->timeout = timeout; 575 baid_data->last_rx_timestamp = jiffies; 576 baid_data->rcu_ptr = &mld->fw_id_to_ba[baid]; 577 578 iwl_mld_init_reorder_buffer(mld, baid_data, ssn); 579 580 timer_setup(&baid_data->session_timer, iwl_mld_rx_agg_session_expired, 581 0); 582 if (timeout) 583 mod_timer(&baid_data->session_timer, 584 TU_TO_EXP_TIME(timeout * 2)); 585 586 IWL_DEBUG_HT(mld, "STA mask=0x%x (tid=%d) is assigned to BAID %d\n", 587 baid_data->sta_mask, tid, baid); 588 589 /* protect the BA data with RCU to cover a case where our 590 * internal RX sync mechanism will timeout (not that it's 591 * supposed to happen) and we will free the session data while 592 * RX is being processed in parallel 593 */ 594 WARN_ON(rcu_access_pointer(mld->fw_id_to_ba[baid])); 595 rcu_assign_pointer(mld->fw_id_to_ba[baid], baid_data); 596 597 return 0; 598 599 out_free: 600 kfree(baid_data); 601 return ret; 602 } 603 604 int iwl_mld_ampdu_rx_stop(struct iwl_mld *mld, struct ieee80211_sta *sta, 605 int tid) 606 { 607 struct iwl_mld_sta *mld_sta = iwl_mld_sta_from_mac80211(sta); 608 int baid = mld_sta->tid_to_baid[tid]; 609 struct iwl_mld_baid_data *baid_data; 610 int ret; 611 612 lockdep_assert_wiphy(mld->wiphy); 613 614 /* during firmware restart, do not send the command as the firmware no 615 * longer recognizes the session. instead, only clear the driver BA 616 * session data. 617 */ 618 if (!mld->fw_status.in_hw_restart) { 619 ret = iwl_mld_stop_ba_in_fw(mld, sta, tid); 620 if (ret) 621 return ret; 622 } 623 624 if (!WARN_ON(mld->num_rx_ba_sessions == 0)) 625 mld->num_rx_ba_sessions--; 626 627 baid_data = wiphy_dereference(mld->wiphy, mld->fw_id_to_ba[baid]); 628 if (WARN_ON(!baid_data)) 629 return -EINVAL; 630 631 if (timer_pending(&baid_data->session_timer)) 632 timer_shutdown_sync(&baid_data->session_timer); 633 634 iwl_mld_free_reorder_buffer(mld, baid_data); 635 636 RCU_INIT_POINTER(mld->fw_id_to_ba[baid], NULL); 637 kfree_rcu(baid_data, rcu_head); 638 639 IWL_DEBUG_HT(mld, "BAID %d is free\n", baid); 640 641 return 0; 642 } 643 644 int iwl_mld_update_sta_baids(struct iwl_mld *mld, 645 u32 old_sta_mask, 646 u32 new_sta_mask) 647 { 648 struct iwl_rx_baid_cfg_cmd cmd = { 649 .action = cpu_to_le32(IWL_RX_BAID_ACTION_MODIFY), 650 .modify.old_sta_id_mask = cpu_to_le32(old_sta_mask), 651 .modify.new_sta_id_mask = cpu_to_le32(new_sta_mask), 652 }; 653 u32 cmd_id = WIDE_ID(DATA_PATH_GROUP, RX_BAID_ALLOCATION_CONFIG_CMD); 654 int baid; 655 656 /* mac80211 will remove sessions later, but we ignore all that */ 657 if (mld->fw_status.in_hw_restart) 658 return 0; 659 660 BUILD_BUG_ON(sizeof(struct iwl_rx_baid_cfg_resp) != sizeof(baid)); 661 662 for (baid = 0; baid < ARRAY_SIZE(mld->fw_id_to_ba); baid++) { 663 struct iwl_mld_baid_data *data; 664 int ret; 665 666 data = wiphy_dereference(mld->wiphy, mld->fw_id_to_ba[baid]); 667 if (!data) 668 continue; 669 670 if (!(data->sta_mask & old_sta_mask)) 671 continue; 672 673 WARN_ONCE(data->sta_mask != old_sta_mask, 674 "BAID data for %d corrupted - expected 0x%x found 0x%x\n", 675 baid, old_sta_mask, data->sta_mask); 676 677 cmd.modify.tid = cpu_to_le32(data->tid); 678 679 ret = iwl_mld_send_cmd_pdu(mld, cmd_id, &cmd); 680 if (ret) 681 return ret; 682 data->sta_mask = new_sta_mask; 683 } 684 685 return 0; 686 } 687