1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * HT handling 4 * 5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 6 * Copyright 2002-2005, Instant802 Networks, Inc. 7 * Copyright 2005-2006, Devicescape Software, Inc. 8 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 10 * Copyright 2007-2010, Intel Corporation 11 * Copyright(c) 2015-2017 Intel Deutschland GmbH 12 * Copyright (C) 2018 - 2023 Intel Corporation 13 */ 14 15 #include <linux/ieee80211.h> 16 #include <linux/slab.h> 17 #include <linux/export.h> 18 #include <net/mac80211.h> 19 #include "ieee80211_i.h" 20 #include "driver-ops.h" 21 #include "wme.h" 22 23 /** 24 * DOC: TX A-MPDU aggregation 25 * 26 * Aggregation on the TX side requires setting the hardware flag 27 * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed 28 * packets with a flag indicating A-MPDU aggregation. The driver 29 * or device is responsible for actually aggregating the frames, 30 * as well as deciding how many and which to aggregate. 31 * 32 * When TX aggregation is started by some subsystem (usually the rate 33 * control algorithm would be appropriate) by calling the 34 * ieee80211_start_tx_ba_session() function, the driver will be 35 * notified via its @ampdu_action function, with the 36 * %IEEE80211_AMPDU_TX_START action. 37 * 38 * In response to that, the driver is later required to call the 39 * ieee80211_start_tx_ba_cb_irqsafe() function, which will really 40 * start the aggregation session after the peer has also responded. 41 * If the peer responds negatively, the session will be stopped 42 * again right away. Note that it is possible for the aggregation 43 * session to be stopped before the driver has indicated that it 44 * is done setting it up, in which case it must not indicate the 45 * setup completion. 46 * 47 * Also note that, since we also need to wait for a response from 48 * the peer, the driver is notified of the completion of the 49 * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the 50 * @ampdu_action callback. 51 * 52 * Similarly, when the aggregation session is stopped by the peer 53 * or something calling ieee80211_stop_tx_ba_session(), the driver's 54 * @ampdu_action function will be called with the action 55 * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail, 56 * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe(). 57 * Note that the sta can get destroyed before the BA tear down is 58 * complete. 59 */ 60 61 static void ieee80211_send_addba_request(struct sta_info *sta, u16 tid, 62 u8 dialog_token, u16 start_seq_num, 63 u16 agg_size, u16 timeout) 64 { 65 struct ieee80211_sub_if_data *sdata = sta->sdata; 66 struct ieee80211_local *local = sdata->local; 67 struct sk_buff *skb; 68 struct ieee80211_mgmt *mgmt; 69 u16 capab; 70 71 skb = dev_alloc_skb(sizeof(*mgmt) + 72 2 + sizeof(struct ieee80211_addba_ext_ie) + 73 local->hw.extra_tx_headroom); 74 if (!skb) 75 return; 76 77 skb_reserve(skb, local->hw.extra_tx_headroom); 78 mgmt = ieee80211_mgmt_ba(skb, sta->sta.addr, sdata); 79 80 skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req)); 81 82 mgmt->u.action.category = WLAN_CATEGORY_BACK; 83 mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ; 84 85 mgmt->u.action.u.addba_req.dialog_token = dialog_token; 86 capab = IEEE80211_ADDBA_PARAM_AMSDU_MASK; 87 capab |= IEEE80211_ADDBA_PARAM_POLICY_MASK; 88 capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK); 89 capab |= u16_encode_bits(agg_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK); 90 91 mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab); 92 93 mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout); 94 mgmt->u.action.u.addba_req.start_seq_num = 95 cpu_to_le16(start_seq_num << 4); 96 97 if (sta->sta.deflink.he_cap.has_he) 98 ieee80211_add_addbaext(skb, 0, agg_size); 99 100 ieee80211_tx_skb_tid(sdata, skb, tid, -1); 101 } 102 103 void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn) 104 { 105 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 106 struct ieee80211_local *local = sdata->local; 107 struct sk_buff *skb; 108 struct ieee80211_bar *bar; 109 u16 bar_control = 0; 110 111 skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom); 112 if (!skb) 113 return; 114 115 skb_reserve(skb, local->hw.extra_tx_headroom); 116 bar = skb_put_zero(skb, sizeof(*bar)); 117 bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL | 118 IEEE80211_STYPE_BACK_REQ); 119 memcpy(bar->ra, ra, ETH_ALEN); 120 memcpy(bar->ta, sdata->vif.addr, ETH_ALEN); 121 bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL; 122 bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA; 123 bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT); 124 bar->control = cpu_to_le16(bar_control); 125 bar->start_seq_num = cpu_to_le16(ssn); 126 127 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT | 128 IEEE80211_TX_CTL_REQ_TX_STATUS; 129 ieee80211_tx_skb_tid(sdata, skb, tid, -1); 130 } 131 EXPORT_SYMBOL(ieee80211_send_bar); 132 133 void ieee80211_assign_tid_tx(struct sta_info *sta, int tid, 134 struct tid_ampdu_tx *tid_tx) 135 { 136 lockdep_assert_wiphy(sta->local->hw.wiphy); 137 lockdep_assert_held(&sta->lock); 138 rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx); 139 } 140 141 /* 142 * When multiple aggregation sessions on multiple stations 143 * are being created/destroyed simultaneously, we need to 144 * refcount the global queue stop caused by that in order 145 * to not get into a situation where one of the aggregation 146 * setup or teardown re-enables queues before the other is 147 * ready to handle that. 148 * 149 * These two functions take care of this issue by keeping 150 * a global "agg_queue_stop" refcount. 151 */ 152 static void __acquires(agg_queue) 153 ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid) 154 { 155 int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)]; 156 157 /* we do refcounting here, so don't use the queue reason refcounting */ 158 159 if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1) 160 ieee80211_stop_queue_by_reason( 161 &sdata->local->hw, queue, 162 IEEE80211_QUEUE_STOP_REASON_AGGREGATION, 163 false); 164 __acquire(agg_queue); 165 } 166 167 static void __releases(agg_queue) 168 ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid) 169 { 170 int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)]; 171 172 if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0) 173 ieee80211_wake_queue_by_reason( 174 &sdata->local->hw, queue, 175 IEEE80211_QUEUE_STOP_REASON_AGGREGATION, 176 false); 177 __release(agg_queue); 178 } 179 180 static void 181 ieee80211_agg_stop_txq(struct sta_info *sta, int tid) 182 { 183 struct ieee80211_txq *txq = sta->sta.txq[tid]; 184 struct ieee80211_sub_if_data *sdata; 185 struct fq *fq; 186 struct txq_info *txqi; 187 188 if (!txq) 189 return; 190 191 txqi = to_txq_info(txq); 192 sdata = vif_to_sdata(txq->vif); 193 fq = &sdata->local->fq; 194 195 /* Lock here to protect against further seqno updates on dequeue */ 196 spin_lock_bh(&fq->lock); 197 set_bit(IEEE80211_TXQ_STOP, &txqi->flags); 198 spin_unlock_bh(&fq->lock); 199 } 200 201 static void 202 ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable) 203 { 204 struct ieee80211_txq *txq = sta->sta.txq[tid]; 205 struct txq_info *txqi; 206 207 lockdep_assert_wiphy(sta->local->hw.wiphy); 208 209 if (!txq) 210 return; 211 212 txqi = to_txq_info(txq); 213 214 if (enable) 215 set_bit(IEEE80211_TXQ_AMPDU, &txqi->flags); 216 else 217 clear_bit(IEEE80211_TXQ_AMPDU, &txqi->flags); 218 219 clear_bit(IEEE80211_TXQ_STOP, &txqi->flags); 220 local_bh_disable(); 221 rcu_read_lock(); 222 schedule_and_wake_txq(sta->sdata->local, txqi); 223 rcu_read_unlock(); 224 local_bh_enable(); 225 } 226 227 /* 228 * splice packets from the STA's pending to the local pending, 229 * requires a call to ieee80211_agg_splice_finish later 230 */ 231 static void __acquires(agg_queue) 232 ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata, 233 struct tid_ampdu_tx *tid_tx, u16 tid) 234 { 235 struct ieee80211_local *local = sdata->local; 236 int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)]; 237 unsigned long flags; 238 239 ieee80211_stop_queue_agg(sdata, tid); 240 241 if (WARN(!tid_tx, 242 "TID %d gone but expected when splicing aggregates from the pending queue\n", 243 tid)) 244 return; 245 246 if (!skb_queue_empty(&tid_tx->pending)) { 247 spin_lock_irqsave(&local->queue_stop_reason_lock, flags); 248 /* copy over remaining packets */ 249 skb_queue_splice_tail_init(&tid_tx->pending, 250 &local->pending[queue]); 251 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); 252 } 253 } 254 255 static void __releases(agg_queue) 256 ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid) 257 { 258 ieee80211_wake_queue_agg(sdata, tid); 259 } 260 261 static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid) 262 { 263 struct tid_ampdu_tx *tid_tx; 264 265 lockdep_assert_wiphy(sta->local->hw.wiphy); 266 lockdep_assert_held(&sta->lock); 267 268 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 269 270 /* 271 * When we get here, the TX path will not be lockless any more wrt. 272 * aggregation, since the OPERATIONAL bit has long been cleared. 273 * Thus it will block on getting the lock, if it occurs. So if we 274 * stop the queue now, we will not get any more packets, and any 275 * that might be being processed will wait for us here, thereby 276 * guaranteeing that no packets go to the tid_tx pending queue any 277 * more. 278 */ 279 280 ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid); 281 282 /* future packets must not find the tid_tx struct any more */ 283 ieee80211_assign_tid_tx(sta, tid, NULL); 284 285 ieee80211_agg_splice_finish(sta->sdata, tid); 286 287 kfree_rcu(tid_tx, rcu_head); 288 } 289 290 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, 291 enum ieee80211_agg_stop_reason reason) 292 { 293 struct ieee80211_local *local = sta->local; 294 struct tid_ampdu_tx *tid_tx; 295 struct ieee80211_ampdu_params params = { 296 .sta = &sta->sta, 297 .tid = tid, 298 .buf_size = 0, 299 .amsdu = false, 300 .timeout = 0, 301 .ssn = 0, 302 }; 303 int ret; 304 305 lockdep_assert_wiphy(sta->local->hw.wiphy); 306 307 switch (reason) { 308 case AGG_STOP_DECLINED: 309 case AGG_STOP_LOCAL_REQUEST: 310 case AGG_STOP_PEER_REQUEST: 311 params.action = IEEE80211_AMPDU_TX_STOP_CONT; 312 break; 313 case AGG_STOP_DESTROY_STA: 314 params.action = IEEE80211_AMPDU_TX_STOP_FLUSH; 315 break; 316 default: 317 WARN_ON_ONCE(1); 318 return -EINVAL; 319 } 320 321 spin_lock_bh(&sta->lock); 322 323 /* free struct pending for start, if present */ 324 tid_tx = sta->ampdu_mlme.tid_start_tx[tid]; 325 kfree(tid_tx); 326 sta->ampdu_mlme.tid_start_tx[tid] = NULL; 327 328 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 329 if (!tid_tx) { 330 spin_unlock_bh(&sta->lock); 331 return -ENOENT; 332 } 333 334 /* 335 * if we're already stopping ignore any new requests to stop 336 * unless we're destroying it in which case notify the driver 337 */ 338 if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 339 spin_unlock_bh(&sta->lock); 340 if (reason != AGG_STOP_DESTROY_STA) 341 return -EALREADY; 342 params.action = IEEE80211_AMPDU_TX_STOP_FLUSH_CONT; 343 ret = drv_ampdu_action(local, sta->sdata, ¶ms); 344 WARN_ON_ONCE(ret); 345 return 0; 346 } 347 348 if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) { 349 /* not even started yet! */ 350 ieee80211_assign_tid_tx(sta, tid, NULL); 351 spin_unlock_bh(&sta->lock); 352 kfree_rcu(tid_tx, rcu_head); 353 return 0; 354 } 355 356 set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state); 357 358 ieee80211_agg_stop_txq(sta, tid); 359 360 spin_unlock_bh(&sta->lock); 361 362 ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n", 363 sta->sta.addr, tid); 364 365 del_timer_sync(&tid_tx->addba_resp_timer); 366 del_timer_sync(&tid_tx->session_timer); 367 368 /* 369 * After this packets are no longer handed right through 370 * to the driver but are put onto tid_tx->pending instead, 371 * with locking to ensure proper access. 372 */ 373 clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state); 374 375 /* 376 * There might be a few packets being processed right now (on 377 * another CPU) that have already gotten past the aggregation 378 * check when it was still OPERATIONAL and consequently have 379 * IEEE80211_TX_CTL_AMPDU set. In that case, this code might 380 * call into the driver at the same time or even before the 381 * TX paths calls into it, which could confuse the driver. 382 * 383 * Wait for all currently running TX paths to finish before 384 * telling the driver. New packets will not go through since 385 * the aggregation session is no longer OPERATIONAL. 386 */ 387 if (!local->in_reconfig) 388 synchronize_net(); 389 390 tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ? 391 WLAN_BACK_RECIPIENT : 392 WLAN_BACK_INITIATOR; 393 tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST; 394 395 ret = drv_ampdu_action(local, sta->sdata, ¶ms); 396 397 /* HW shall not deny going back to legacy */ 398 if (WARN_ON(ret)) { 399 /* 400 * We may have pending packets get stuck in this case... 401 * Not bothering with a workaround for now. 402 */ 403 } 404 405 /* 406 * In the case of AGG_STOP_DESTROY_STA, the driver won't 407 * necessarily call ieee80211_stop_tx_ba_cb(), so this may 408 * seem like we can leave the tid_tx data pending forever. 409 * This is true, in a way, but "forever" is only until the 410 * station struct is actually destroyed. In the meantime, 411 * leaving it around ensures that we don't transmit packets 412 * to the driver on this TID which might confuse it. 413 */ 414 415 return 0; 416 } 417 418 /* 419 * After sending add Block Ack request we activated a timer until 420 * add Block Ack response will arrive from the recipient. 421 * If this timer expires sta_addba_resp_timer_expired will be executed. 422 */ 423 static void sta_addba_resp_timer_expired(struct timer_list *t) 424 { 425 struct tid_ampdu_tx *tid_tx = from_timer(tid_tx, t, addba_resp_timer); 426 struct sta_info *sta = tid_tx->sta; 427 u8 tid = tid_tx->tid; 428 429 /* check if the TID waits for addBA response */ 430 if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) { 431 ht_dbg(sta->sdata, 432 "timer expired on %pM tid %d not expecting addBA response\n", 433 sta->sta.addr, tid); 434 return; 435 } 436 437 ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n", 438 sta->sta.addr, tid); 439 440 ieee80211_stop_tx_ba_session(&sta->sta, tid); 441 } 442 443 static void ieee80211_send_addba_with_timeout(struct sta_info *sta, 444 struct tid_ampdu_tx *tid_tx) 445 { 446 struct ieee80211_sub_if_data *sdata = sta->sdata; 447 struct ieee80211_local *local = sta->local; 448 u8 tid = tid_tx->tid; 449 u16 buf_size; 450 451 if (WARN_ON_ONCE(test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state) || 452 test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state))) 453 return; 454 455 lockdep_assert_wiphy(sta->local->hw.wiphy); 456 457 /* activate the timer for the recipient's addBA response */ 458 mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL); 459 ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n", 460 sta->sta.addr, tid); 461 462 spin_lock_bh(&sta->lock); 463 sta->ampdu_mlme.last_addba_req_time[tid] = jiffies; 464 sta->ampdu_mlme.addba_req_num[tid]++; 465 spin_unlock_bh(&sta->lock); 466 467 if (sta->sta.deflink.eht_cap.has_eht) { 468 buf_size = local->hw.max_tx_aggregation_subframes; 469 } else if (sta->sta.deflink.he_cap.has_he) { 470 buf_size = min_t(u16, local->hw.max_tx_aggregation_subframes, 471 IEEE80211_MAX_AMPDU_BUF_HE); 472 } else { 473 /* 474 * We really should use what the driver told us it will 475 * transmit as the maximum, but certain APs (e.g. the 476 * LinkSys WRT120N with FW v1.0.07 build 002 Jun 18 2012) 477 * will crash when we use a lower number. 478 */ 479 buf_size = IEEE80211_MAX_AMPDU_BUF_HT; 480 } 481 482 /* send AddBA request */ 483 ieee80211_send_addba_request(sta, tid, tid_tx->dialog_token, 484 tid_tx->ssn, buf_size, tid_tx->timeout); 485 486 WARN_ON(test_and_set_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state)); 487 } 488 489 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) 490 { 491 struct tid_ampdu_tx *tid_tx; 492 struct ieee80211_local *local = sta->local; 493 struct ieee80211_sub_if_data *sdata = sta->sdata; 494 struct ieee80211_ampdu_params params = { 495 .sta = &sta->sta, 496 .action = IEEE80211_AMPDU_TX_START, 497 .tid = tid, 498 .buf_size = 0, 499 .amsdu = false, 500 .timeout = 0, 501 }; 502 int ret; 503 504 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 505 506 /* 507 * Start queuing up packets for this aggregation session. 508 * We're going to release them once the driver is OK with 509 * that. 510 */ 511 clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state); 512 513 /* 514 * Make sure no packets are being processed. This ensures that 515 * we have a valid starting sequence number and that in-flight 516 * packets have been flushed out and no packets for this TID 517 * will go into the driver during the ampdu_action call. 518 */ 519 synchronize_net(); 520 521 params.ssn = sta->tid_seq[tid] >> 4; 522 ret = drv_ampdu_action(local, sdata, ¶ms); 523 tid_tx->ssn = params.ssn; 524 if (ret == IEEE80211_AMPDU_TX_START_DELAY_ADDBA) { 525 return; 526 } else if (ret == IEEE80211_AMPDU_TX_START_IMMEDIATE) { 527 /* 528 * We didn't send the request yet, so don't need to check 529 * here if we already got a response, just mark as driver 530 * ready immediately. 531 */ 532 set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state); 533 } else if (ret) { 534 ht_dbg(sdata, 535 "BA request denied - HW unavailable for %pM tid %d\n", 536 sta->sta.addr, tid); 537 spin_lock_bh(&sta->lock); 538 ieee80211_agg_splice_packets(sdata, tid_tx, tid); 539 ieee80211_assign_tid_tx(sta, tid, NULL); 540 ieee80211_agg_splice_finish(sdata, tid); 541 spin_unlock_bh(&sta->lock); 542 543 ieee80211_agg_start_txq(sta, tid, false); 544 545 kfree_rcu(tid_tx, rcu_head); 546 return; 547 } 548 549 ieee80211_send_addba_with_timeout(sta, tid_tx); 550 } 551 552 void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *pubsta, 553 u16 tid) 554 { 555 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 556 struct tid_ampdu_tx *tid_tx; 557 558 if (WARN_ON_ONCE(tid >= IEEE80211_NUM_TIDS)) 559 return; 560 561 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]); 562 if (!tid_tx) 563 return; 564 565 tid_tx->last_tx = jiffies; 566 } 567 EXPORT_SYMBOL(ieee80211_refresh_tx_agg_session_timer); 568 569 /* 570 * After accepting the AddBA Response we activated a timer, 571 * resetting it after each frame that we send. 572 */ 573 static void sta_tx_agg_session_timer_expired(struct timer_list *t) 574 { 575 struct tid_ampdu_tx *tid_tx = from_timer(tid_tx, t, session_timer); 576 struct sta_info *sta = tid_tx->sta; 577 u8 tid = tid_tx->tid; 578 unsigned long timeout; 579 580 if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 581 return; 582 } 583 584 timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout); 585 if (time_is_after_jiffies(timeout)) { 586 mod_timer(&tid_tx->session_timer, timeout); 587 return; 588 } 589 590 ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n", 591 sta->sta.addr, tid); 592 593 ieee80211_stop_tx_ba_session(&sta->sta, tid); 594 } 595 596 int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid, 597 u16 timeout) 598 { 599 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 600 struct ieee80211_sub_if_data *sdata = sta->sdata; 601 struct ieee80211_local *local = sdata->local; 602 struct tid_ampdu_tx *tid_tx; 603 int ret = 0; 604 605 trace_api_start_tx_ba_session(pubsta, tid); 606 607 if (WARN(sta->reserved_tid == tid, 608 "Requested to start BA session on reserved tid=%d", tid)) 609 return -EINVAL; 610 611 if (!pubsta->deflink.ht_cap.ht_supported && 612 !pubsta->deflink.vht_cap.vht_supported && 613 !pubsta->deflink.he_cap.has_he && 614 !pubsta->deflink.eht_cap.has_eht) 615 return -EINVAL; 616 617 if (WARN_ON_ONCE(!local->ops->ampdu_action)) 618 return -EINVAL; 619 620 if ((tid >= IEEE80211_NUM_TIDS) || 621 !ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) || 622 ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW)) 623 return -EINVAL; 624 625 if (WARN_ON(tid >= IEEE80211_FIRST_TSPEC_TSID)) 626 return -EINVAL; 627 628 ht_dbg(sdata, "Open BA session requested for %pM tid %u\n", 629 pubsta->addr, tid); 630 631 if (sdata->vif.type != NL80211_IFTYPE_STATION && 632 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 633 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 634 sdata->vif.type != NL80211_IFTYPE_AP && 635 sdata->vif.type != NL80211_IFTYPE_ADHOC) 636 return -EINVAL; 637 638 if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) { 639 ht_dbg(sdata, 640 "BA sessions blocked - Denying BA session request %pM tid %d\n", 641 sta->sta.addr, tid); 642 return -EINVAL; 643 } 644 645 if (test_sta_flag(sta, WLAN_STA_MFP) && 646 !test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 647 ht_dbg(sdata, 648 "MFP STA not authorized - deny BA session request %pM tid %d\n", 649 sta->sta.addr, tid); 650 return -EINVAL; 651 } 652 653 /* 654 * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a 655 * member of an IBSS, and has no other existing Block Ack agreement 656 * with the recipient STA, then the initiating STA shall transmit a 657 * Probe Request frame to the recipient STA and shall not transmit an 658 * ADDBA Request frame unless it receives a Probe Response frame 659 * from the recipient within dot11ADDBAFailureTimeout. 660 * 661 * The probe request mechanism for ADDBA is currently not implemented, 662 * but we only build up Block Ack session with HT STAs. This information 663 * is set when we receive a bss info from a probe response or a beacon. 664 */ 665 if (sta->sdata->vif.type == NL80211_IFTYPE_ADHOC && 666 !sta->sta.deflink.ht_cap.ht_supported) { 667 ht_dbg(sdata, 668 "BA request denied - IBSS STA %pM does not advertise HT support\n", 669 pubsta->addr); 670 return -EINVAL; 671 } 672 673 spin_lock_bh(&sta->lock); 674 675 /* we have tried too many times, receiver does not want A-MPDU */ 676 if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) { 677 ret = -EBUSY; 678 goto err_unlock_sta; 679 } 680 681 /* 682 * if we have tried more than HT_AGG_BURST_RETRIES times we 683 * will spread our requests in time to avoid stalling connection 684 * for too long 685 */ 686 if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_BURST_RETRIES && 687 time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] + 688 HT_AGG_RETRIES_PERIOD)) { 689 ht_dbg(sdata, 690 "BA request denied - %d failed requests on %pM tid %u\n", 691 sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid); 692 ret = -EBUSY; 693 goto err_unlock_sta; 694 } 695 696 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 697 /* check if the TID is not in aggregation flow already */ 698 if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) { 699 ht_dbg(sdata, 700 "BA request denied - session is not idle on %pM tid %u\n", 701 sta->sta.addr, tid); 702 ret = -EAGAIN; 703 goto err_unlock_sta; 704 } 705 706 /* prepare A-MPDU MLME for Tx aggregation */ 707 tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC); 708 if (!tid_tx) { 709 ret = -ENOMEM; 710 goto err_unlock_sta; 711 } 712 713 skb_queue_head_init(&tid_tx->pending); 714 __set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state); 715 716 tid_tx->timeout = timeout; 717 tid_tx->sta = sta; 718 tid_tx->tid = tid; 719 720 /* response timer */ 721 timer_setup(&tid_tx->addba_resp_timer, sta_addba_resp_timer_expired, 0); 722 723 /* tx timer */ 724 timer_setup(&tid_tx->session_timer, 725 sta_tx_agg_session_timer_expired, TIMER_DEFERRABLE); 726 727 /* assign a dialog token */ 728 sta->ampdu_mlme.dialog_token_allocator++; 729 tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator; 730 731 /* 732 * Finally, assign it to the start array; the work item will 733 * collect it and move it to the normal array. 734 */ 735 sta->ampdu_mlme.tid_start_tx[tid] = tid_tx; 736 737 wiphy_work_queue(local->hw.wiphy, &sta->ampdu_mlme.work); 738 739 /* this flow continues off the work */ 740 err_unlock_sta: 741 spin_unlock_bh(&sta->lock); 742 return ret; 743 } 744 EXPORT_SYMBOL(ieee80211_start_tx_ba_session); 745 746 static void ieee80211_agg_tx_operational(struct ieee80211_local *local, 747 struct sta_info *sta, u16 tid) 748 { 749 struct tid_ampdu_tx *tid_tx; 750 struct ieee80211_ampdu_params params = { 751 .sta = &sta->sta, 752 .action = IEEE80211_AMPDU_TX_OPERATIONAL, 753 .tid = tid, 754 .timeout = 0, 755 .ssn = 0, 756 }; 757 758 lockdep_assert_wiphy(sta->local->hw.wiphy); 759 760 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 761 params.buf_size = tid_tx->buf_size; 762 params.amsdu = tid_tx->amsdu; 763 764 ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n", 765 sta->sta.addr, tid); 766 767 drv_ampdu_action(local, sta->sdata, ¶ms); 768 769 /* 770 * synchronize with TX path, while splicing the TX path 771 * should block so it won't put more packets onto pending. 772 */ 773 spin_lock_bh(&sta->lock); 774 775 ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid); 776 /* 777 * Now mark as operational. This will be visible 778 * in the TX path, and lets it go lock-free in 779 * the common case. 780 */ 781 set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state); 782 ieee80211_agg_splice_finish(sta->sdata, tid); 783 784 spin_unlock_bh(&sta->lock); 785 786 ieee80211_agg_start_txq(sta, tid, true); 787 } 788 789 void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid, 790 struct tid_ampdu_tx *tid_tx) 791 { 792 struct ieee80211_sub_if_data *sdata = sta->sdata; 793 struct ieee80211_local *local = sdata->local; 794 795 lockdep_assert_wiphy(sta->local->hw.wiphy); 796 797 if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))) 798 return; 799 800 if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state) || 801 test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state)) 802 return; 803 804 if (!test_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state)) { 805 ieee80211_send_addba_with_timeout(sta, tid_tx); 806 /* RESPONSE_RECEIVED state would trigger the flow again */ 807 return; 808 } 809 810 if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) 811 ieee80211_agg_tx_operational(local, sta, tid); 812 } 813 814 static struct tid_ampdu_tx * 815 ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata, 816 const u8 *ra, u16 tid, struct sta_info **sta) 817 { 818 struct tid_ampdu_tx *tid_tx; 819 820 if (tid >= IEEE80211_NUM_TIDS) { 821 ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n", 822 tid, IEEE80211_NUM_TIDS); 823 return NULL; 824 } 825 826 *sta = sta_info_get_bss(sdata, ra); 827 if (!*sta) { 828 ht_dbg(sdata, "Could not find station: %pM\n", ra); 829 return NULL; 830 } 831 832 tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]); 833 834 if (WARN_ON(!tid_tx)) 835 ht_dbg(sdata, "addBA was not requested!\n"); 836 837 return tid_tx; 838 } 839 840 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, 841 const u8 *ra, u16 tid) 842 { 843 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 844 struct ieee80211_local *local = sdata->local; 845 struct sta_info *sta; 846 struct tid_ampdu_tx *tid_tx; 847 848 trace_api_start_tx_ba_cb(sdata, ra, tid); 849 850 rcu_read_lock(); 851 tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta); 852 if (!tid_tx) 853 goto out; 854 855 set_bit(HT_AGG_STATE_START_CB, &tid_tx->state); 856 wiphy_work_queue(local->hw.wiphy, &sta->ampdu_mlme.work); 857 out: 858 rcu_read_unlock(); 859 } 860 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe); 861 862 int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid) 863 { 864 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 865 struct ieee80211_sub_if_data *sdata = sta->sdata; 866 struct ieee80211_local *local = sdata->local; 867 struct tid_ampdu_tx *tid_tx; 868 int ret = 0; 869 870 trace_api_stop_tx_ba_session(pubsta, tid); 871 872 if (!local->ops->ampdu_action) 873 return -EINVAL; 874 875 if (tid >= IEEE80211_NUM_TIDS) 876 return -EINVAL; 877 878 spin_lock_bh(&sta->lock); 879 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 880 881 if (!tid_tx) { 882 ret = -ENOENT; 883 goto unlock; 884 } 885 886 WARN(sta->reserved_tid == tid, 887 "Requested to stop BA session on reserved tid=%d", tid); 888 889 if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 890 /* already in progress stopping it */ 891 ret = 0; 892 goto unlock; 893 } 894 895 set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state); 896 wiphy_work_queue(local->hw.wiphy, &sta->ampdu_mlme.work); 897 898 unlock: 899 spin_unlock_bh(&sta->lock); 900 return ret; 901 } 902 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session); 903 904 void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid, 905 struct tid_ampdu_tx *tid_tx) 906 { 907 struct ieee80211_sub_if_data *sdata = sta->sdata; 908 bool send_delba = false; 909 bool start_txq = false; 910 911 ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", 912 sta->sta.addr, tid); 913 914 spin_lock_bh(&sta->lock); 915 916 if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 917 ht_dbg(sdata, 918 "unexpected callback to A-MPDU stop for %pM tid %d\n", 919 sta->sta.addr, tid); 920 goto unlock_sta; 921 } 922 923 if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR && tid_tx->tx_stop) 924 send_delba = true; 925 926 ieee80211_remove_tid_tx(sta, tid); 927 start_txq = true; 928 929 unlock_sta: 930 spin_unlock_bh(&sta->lock); 931 932 if (start_txq) 933 ieee80211_agg_start_txq(sta, tid, false); 934 935 if (send_delba) 936 ieee80211_send_delba(sdata, sta->sta.addr, tid, 937 WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE); 938 } 939 940 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, 941 const u8 *ra, u16 tid) 942 { 943 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 944 struct ieee80211_local *local = sdata->local; 945 struct sta_info *sta; 946 struct tid_ampdu_tx *tid_tx; 947 948 trace_api_stop_tx_ba_cb(sdata, ra, tid); 949 950 rcu_read_lock(); 951 tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta); 952 if (!tid_tx) 953 goto out; 954 955 set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state); 956 wiphy_work_queue(local->hw.wiphy, &sta->ampdu_mlme.work); 957 out: 958 rcu_read_unlock(); 959 } 960 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe); 961 962 963 void ieee80211_process_addba_resp(struct ieee80211_local *local, 964 struct sta_info *sta, 965 struct ieee80211_mgmt *mgmt, 966 size_t len) 967 { 968 struct tid_ampdu_tx *tid_tx; 969 struct ieee80211_txq *txq; 970 u16 capab, tid, buf_size; 971 bool amsdu; 972 973 lockdep_assert_wiphy(sta->local->hw.wiphy); 974 975 capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab); 976 amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK; 977 tid = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_TID_MASK); 978 buf_size = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK); 979 980 ieee80211_retrieve_addba_ext_data(sta, 981 mgmt->u.action.u.addba_resp.variable, 982 len - offsetof(typeof(*mgmt), 983 u.action.u.addba_resp.variable), 984 &buf_size); 985 986 buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes); 987 988 txq = sta->sta.txq[tid]; 989 if (!amsdu && txq) 990 set_bit(IEEE80211_TXQ_NO_AMSDU, &to_txq_info(txq)->flags); 991 992 tid_tx = rcu_dereference_protected_tid_tx(sta, tid); 993 if (!tid_tx) 994 return; 995 996 if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) { 997 ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n", 998 sta->sta.addr, tid); 999 return; 1000 } 1001 1002 del_timer_sync(&tid_tx->addba_resp_timer); 1003 1004 ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n", 1005 sta->sta.addr, tid); 1006 1007 /* 1008 * addba_resp_timer may have fired before we got here, and 1009 * caused WANT_STOP to be set. If the stop then was already 1010 * processed further, STOPPING might be set. 1011 */ 1012 if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) || 1013 test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { 1014 ht_dbg(sta->sdata, 1015 "got addBA resp for %pM tid %d but we already gave up\n", 1016 sta->sta.addr, tid); 1017 return; 1018 } 1019 1020 /* 1021 * IEEE 802.11-2007 7.3.1.14: 1022 * In an ADDBA Response frame, when the Status Code field 1023 * is set to 0, the Buffer Size subfield is set to a value 1024 * of at least 1. 1025 */ 1026 if (le16_to_cpu(mgmt->u.action.u.addba_resp.status) 1027 == WLAN_STATUS_SUCCESS && buf_size) { 1028 if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED, 1029 &tid_tx->state)) { 1030 /* ignore duplicate response */ 1031 return; 1032 } 1033 1034 tid_tx->buf_size = buf_size; 1035 tid_tx->amsdu = amsdu; 1036 1037 if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)) 1038 ieee80211_agg_tx_operational(local, sta, tid); 1039 1040 sta->ampdu_mlme.addba_req_num[tid] = 0; 1041 1042 tid_tx->timeout = 1043 le16_to_cpu(mgmt->u.action.u.addba_resp.timeout); 1044 1045 if (tid_tx->timeout) { 1046 mod_timer(&tid_tx->session_timer, 1047 TU_TO_EXP_TIME(tid_tx->timeout)); 1048 tid_tx->last_tx = jiffies; 1049 } 1050 1051 } else { 1052 __ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED); 1053 } 1054 } 1055