xref: /openbmc/linux/net/mac80211/agg-tx.c (revision 4da722ca)
1 /*
2  * HT handling
3  *
4  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
5  * Copyright 2002-2005, Instant802 Networks, Inc.
6  * Copyright 2005-2006, Devicescape Software, Inc.
7  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9  * Copyright 2007-2010, Intel Corporation
10  * Copyright(c) 2015-2017 Intel Deutschland GmbH
11  *
12  * This program is free software; you can redistribute it and/or modify
13  * it under the terms of the GNU General Public License version 2 as
14  * published by the Free Software Foundation.
15  */
16 
17 #include <linux/ieee80211.h>
18 #include <linux/slab.h>
19 #include <linux/export.h>
20 #include <net/mac80211.h>
21 #include "ieee80211_i.h"
22 #include "driver-ops.h"
23 #include "wme.h"
24 
25 /**
26  * DOC: TX A-MPDU aggregation
27  *
28  * Aggregation on the TX side requires setting the hardware flag
29  * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed
30  * packets with a flag indicating A-MPDU aggregation. The driver
31  * or device is responsible for actually aggregating the frames,
32  * as well as deciding how many and which to aggregate.
33  *
34  * When TX aggregation is started by some subsystem (usually the rate
35  * control algorithm would be appropriate) by calling the
36  * ieee80211_start_tx_ba_session() function, the driver will be
37  * notified via its @ampdu_action function, with the
38  * %IEEE80211_AMPDU_TX_START action.
39  *
40  * In response to that, the driver is later required to call the
41  * ieee80211_start_tx_ba_cb_irqsafe() function, which will really
42  * start the aggregation session after the peer has also responded.
43  * If the peer responds negatively, the session will be stopped
44  * again right away. Note that it is possible for the aggregation
45  * session to be stopped before the driver has indicated that it
46  * is done setting it up, in which case it must not indicate the
47  * setup completion.
48  *
49  * Also note that, since we also need to wait for a response from
50  * the peer, the driver is notified of the completion of the
51  * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the
52  * @ampdu_action callback.
53  *
54  * Similarly, when the aggregation session is stopped by the peer
55  * or something calling ieee80211_stop_tx_ba_session(), the driver's
56  * @ampdu_action function will be called with the action
57  * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
58  * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
59  * Note that the sta can get destroyed before the BA tear down is
60  * complete.
61  */
62 
63 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
64 					 const u8 *da, u16 tid,
65 					 u8 dialog_token, u16 start_seq_num,
66 					 u16 agg_size, u16 timeout)
67 {
68 	struct ieee80211_local *local = sdata->local;
69 	struct sk_buff *skb;
70 	struct ieee80211_mgmt *mgmt;
71 	u16 capab;
72 
73 	skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
74 
75 	if (!skb)
76 		return;
77 
78 	skb_reserve(skb, local->hw.extra_tx_headroom);
79 	mgmt = skb_put_zero(skb, 24);
80 	memcpy(mgmt->da, da, ETH_ALEN);
81 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
82 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
83 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
84 	    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
85 		memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
86 	else if (sdata->vif.type == NL80211_IFTYPE_STATION)
87 		memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
88 	else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
89 		memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
90 
91 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
92 					  IEEE80211_STYPE_ACTION);
93 
94 	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
95 
96 	mgmt->u.action.category = WLAN_CATEGORY_BACK;
97 	mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
98 
99 	mgmt->u.action.u.addba_req.dialog_token = dialog_token;
100 	capab = (u16)(1 << 0);		/* bit 0 A-MSDU support */
101 	capab |= (u16)(1 << 1);		/* bit 1 aggregation policy */
102 	capab |= (u16)(tid << 2); 	/* bit 5:2 TID number */
103 	capab |= (u16)(agg_size << 6);	/* bit 15:6 max size of aggergation */
104 
105 	mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
106 
107 	mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
108 	mgmt->u.action.u.addba_req.start_seq_num =
109 					cpu_to_le16(start_seq_num << 4);
110 
111 	ieee80211_tx_skb(sdata, skb);
112 }
113 
114 void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
115 {
116 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
117 	struct ieee80211_local *local = sdata->local;
118 	struct sk_buff *skb;
119 	struct ieee80211_bar *bar;
120 	u16 bar_control = 0;
121 
122 	skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
123 	if (!skb)
124 		return;
125 
126 	skb_reserve(skb, local->hw.extra_tx_headroom);
127 	bar = skb_put_zero(skb, sizeof(*bar));
128 	bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
129 					 IEEE80211_STYPE_BACK_REQ);
130 	memcpy(bar->ra, ra, ETH_ALEN);
131 	memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
132 	bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
133 	bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
134 	bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT);
135 	bar->control = cpu_to_le16(bar_control);
136 	bar->start_seq_num = cpu_to_le16(ssn);
137 
138 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
139 					IEEE80211_TX_CTL_REQ_TX_STATUS;
140 	ieee80211_tx_skb_tid(sdata, skb, tid);
141 }
142 EXPORT_SYMBOL(ieee80211_send_bar);
143 
144 void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
145 			     struct tid_ampdu_tx *tid_tx)
146 {
147 	lockdep_assert_held(&sta->ampdu_mlme.mtx);
148 	lockdep_assert_held(&sta->lock);
149 	rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
150 }
151 
152 /*
153  * When multiple aggregation sessions on multiple stations
154  * are being created/destroyed simultaneously, we need to
155  * refcount the global queue stop caused by that in order
156  * to not get into a situation where one of the aggregation
157  * setup or teardown re-enables queues before the other is
158  * ready to handle that.
159  *
160  * These two functions take care of this issue by keeping
161  * a global "agg_queue_stop" refcount.
162  */
163 static void __acquires(agg_queue)
164 ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
165 {
166 	int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
167 
168 	/* we do refcounting here, so don't use the queue reason refcounting */
169 
170 	if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
171 		ieee80211_stop_queue_by_reason(
172 			&sdata->local->hw, queue,
173 			IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
174 			false);
175 	__acquire(agg_queue);
176 }
177 
178 static void __releases(agg_queue)
179 ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
180 {
181 	int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
182 
183 	if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
184 		ieee80211_wake_queue_by_reason(
185 			&sdata->local->hw, queue,
186 			IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
187 			false);
188 	__release(agg_queue);
189 }
190 
191 static void
192 ieee80211_agg_stop_txq(struct sta_info *sta, int tid)
193 {
194 	struct ieee80211_txq *txq = sta->sta.txq[tid];
195 	struct ieee80211_sub_if_data *sdata;
196 	struct fq *fq;
197 	struct txq_info *txqi;
198 
199 	if (!txq)
200 		return;
201 
202 	txqi = to_txq_info(txq);
203 	sdata = vif_to_sdata(txq->vif);
204 	fq = &sdata->local->fq;
205 
206 	/* Lock here to protect against further seqno updates on dequeue */
207 	spin_lock_bh(&fq->lock);
208 	set_bit(IEEE80211_TXQ_STOP, &txqi->flags);
209 	spin_unlock_bh(&fq->lock);
210 }
211 
212 static void
213 ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable)
214 {
215 	struct ieee80211_txq *txq = sta->sta.txq[tid];
216 	struct txq_info *txqi;
217 
218 	if (!txq)
219 		return;
220 
221 	txqi = to_txq_info(txq);
222 
223 	if (enable)
224 		set_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
225 	else
226 		clear_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
227 
228 	clear_bit(IEEE80211_TXQ_STOP, &txqi->flags);
229 	drv_wake_tx_queue(sta->sdata->local, txqi);
230 }
231 
232 /*
233  * splice packets from the STA's pending to the local pending,
234  * requires a call to ieee80211_agg_splice_finish later
235  */
236 static void __acquires(agg_queue)
237 ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
238 			     struct tid_ampdu_tx *tid_tx, u16 tid)
239 {
240 	struct ieee80211_local *local = sdata->local;
241 	int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
242 	unsigned long flags;
243 
244 	ieee80211_stop_queue_agg(sdata, tid);
245 
246 	if (WARN(!tid_tx,
247 		 "TID %d gone but expected when splicing aggregates from the pending queue\n",
248 		 tid))
249 		return;
250 
251 	if (!skb_queue_empty(&tid_tx->pending)) {
252 		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
253 		/* copy over remaining packets */
254 		skb_queue_splice_tail_init(&tid_tx->pending,
255 					   &local->pending[queue]);
256 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
257 	}
258 }
259 
260 static void __releases(agg_queue)
261 ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
262 {
263 	ieee80211_wake_queue_agg(sdata, tid);
264 }
265 
266 static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid)
267 {
268 	struct tid_ampdu_tx *tid_tx;
269 
270 	lockdep_assert_held(&sta->ampdu_mlme.mtx);
271 	lockdep_assert_held(&sta->lock);
272 
273 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
274 
275 	/*
276 	 * When we get here, the TX path will not be lockless any more wrt.
277 	 * aggregation, since the OPERATIONAL bit has long been cleared.
278 	 * Thus it will block on getting the lock, if it occurs. So if we
279 	 * stop the queue now, we will not get any more packets, and any
280 	 * that might be being processed will wait for us here, thereby
281 	 * guaranteeing that no packets go to the tid_tx pending queue any
282 	 * more.
283 	 */
284 
285 	ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
286 
287 	/* future packets must not find the tid_tx struct any more */
288 	ieee80211_assign_tid_tx(sta, tid, NULL);
289 
290 	ieee80211_agg_splice_finish(sta->sdata, tid);
291 	ieee80211_agg_start_txq(sta, tid, false);
292 
293 	kfree_rcu(tid_tx, rcu_head);
294 }
295 
296 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
297 				    enum ieee80211_agg_stop_reason reason)
298 {
299 	struct ieee80211_local *local = sta->local;
300 	struct tid_ampdu_tx *tid_tx;
301 	struct ieee80211_ampdu_params params = {
302 		.sta = &sta->sta,
303 		.tid = tid,
304 		.buf_size = 0,
305 		.amsdu = false,
306 		.timeout = 0,
307 		.ssn = 0,
308 	};
309 	int ret;
310 
311 	lockdep_assert_held(&sta->ampdu_mlme.mtx);
312 
313 	switch (reason) {
314 	case AGG_STOP_DECLINED:
315 	case AGG_STOP_LOCAL_REQUEST:
316 	case AGG_STOP_PEER_REQUEST:
317 		params.action = IEEE80211_AMPDU_TX_STOP_CONT;
318 		break;
319 	case AGG_STOP_DESTROY_STA:
320 		params.action = IEEE80211_AMPDU_TX_STOP_FLUSH;
321 		break;
322 	default:
323 		WARN_ON_ONCE(1);
324 		return -EINVAL;
325 	}
326 
327 	spin_lock_bh(&sta->lock);
328 
329 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
330 	if (!tid_tx) {
331 		spin_unlock_bh(&sta->lock);
332 		return -ENOENT;
333 	}
334 
335 	/*
336 	 * if we're already stopping ignore any new requests to stop
337 	 * unless we're destroying it in which case notify the driver
338 	 */
339 	if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
340 		spin_unlock_bh(&sta->lock);
341 		if (reason != AGG_STOP_DESTROY_STA)
342 			return -EALREADY;
343 		params.action = IEEE80211_AMPDU_TX_STOP_FLUSH_CONT;
344 		ret = drv_ampdu_action(local, sta->sdata, &params);
345 		WARN_ON_ONCE(ret);
346 		return 0;
347 	}
348 
349 	if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
350 		/* not even started yet! */
351 		ieee80211_assign_tid_tx(sta, tid, NULL);
352 		spin_unlock_bh(&sta->lock);
353 		kfree_rcu(tid_tx, rcu_head);
354 		return 0;
355 	}
356 
357 	set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
358 
359 	spin_unlock_bh(&sta->lock);
360 
361 	ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
362 	       sta->sta.addr, tid);
363 
364 	del_timer_sync(&tid_tx->addba_resp_timer);
365 	del_timer_sync(&tid_tx->session_timer);
366 
367 	/*
368 	 * After this packets are no longer handed right through
369 	 * to the driver but are put onto tid_tx->pending instead,
370 	 * with locking to ensure proper access.
371 	 */
372 	clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
373 
374 	/*
375 	 * There might be a few packets being processed right now (on
376 	 * another CPU) that have already gotten past the aggregation
377 	 * check when it was still OPERATIONAL and consequently have
378 	 * IEEE80211_TX_CTL_AMPDU set. In that case, this code might
379 	 * call into the driver at the same time or even before the
380 	 * TX paths calls into it, which could confuse the driver.
381 	 *
382 	 * Wait for all currently running TX paths to finish before
383 	 * telling the driver. New packets will not go through since
384 	 * the aggregation session is no longer OPERATIONAL.
385 	 */
386 	synchronize_net();
387 
388 	tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ?
389 					WLAN_BACK_RECIPIENT :
390 					WLAN_BACK_INITIATOR;
391 	tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST;
392 
393 	ret = drv_ampdu_action(local, sta->sdata, &params);
394 
395 	/* HW shall not deny going back to legacy */
396 	if (WARN_ON(ret)) {
397 		/*
398 		 * We may have pending packets get stuck in this case...
399 		 * Not bothering with a workaround for now.
400 		 */
401 	}
402 
403 	/*
404 	 * In the case of AGG_STOP_DESTROY_STA, the driver won't
405 	 * necessarily call ieee80211_stop_tx_ba_cb(), so this may
406 	 * seem like we can leave the tid_tx data pending forever.
407 	 * This is true, in a way, but "forever" is only until the
408 	 * station struct is actually destroyed. In the meantime,
409 	 * leaving it around ensures that we don't transmit packets
410 	 * to the driver on this TID which might confuse it.
411 	 */
412 
413 	return 0;
414 }
415 
416 /*
417  * After sending add Block Ack request we activated a timer until
418  * add Block Ack response will arrive from the recipient.
419  * If this timer expires sta_addba_resp_timer_expired will be executed.
420  */
421 static void sta_addba_resp_timer_expired(unsigned long data)
422 {
423 	/* not an elegant detour, but there is no choice as the timer passes
424 	 * only one argument, and both sta_info and TID are needed, so init
425 	 * flow in sta_info_create gives the TID as data, while the timer_to_id
426 	 * array gives the sta through container_of */
427 	u16 tid = *(u8 *)data;
428 	struct sta_info *sta = container_of((void *)data,
429 		struct sta_info, timer_to_tid[tid]);
430 	struct tid_ampdu_tx *tid_tx;
431 
432 	/* check if the TID waits for addBA response */
433 	rcu_read_lock();
434 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
435 	if (!tid_tx ||
436 	    test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
437 		rcu_read_unlock();
438 		ht_dbg(sta->sdata,
439 		       "timer expired on %pM tid %d but we are not (or no longer) expecting addBA response there\n",
440 		       sta->sta.addr, tid);
441 		return;
442 	}
443 
444 	ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n",
445 	       sta->sta.addr, tid);
446 
447 	ieee80211_stop_tx_ba_session(&sta->sta, tid);
448 	rcu_read_unlock();
449 }
450 
451 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
452 {
453 	struct tid_ampdu_tx *tid_tx;
454 	struct ieee80211_local *local = sta->local;
455 	struct ieee80211_sub_if_data *sdata = sta->sdata;
456 	struct ieee80211_ampdu_params params = {
457 		.sta = &sta->sta,
458 		.action = IEEE80211_AMPDU_TX_START,
459 		.tid = tid,
460 		.buf_size = 0,
461 		.amsdu = false,
462 		.timeout = 0,
463 	};
464 	int ret;
465 
466 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
467 
468 	/*
469 	 * Start queuing up packets for this aggregation session.
470 	 * We're going to release them once the driver is OK with
471 	 * that.
472 	 */
473 	clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
474 
475 	ieee80211_agg_stop_txq(sta, tid);
476 
477 	/*
478 	 * Make sure no packets are being processed. This ensures that
479 	 * we have a valid starting sequence number and that in-flight
480 	 * packets have been flushed out and no packets for this TID
481 	 * will go into the driver during the ampdu_action call.
482 	 */
483 	synchronize_net();
484 
485 	params.ssn = sta->tid_seq[tid] >> 4;
486 	ret = drv_ampdu_action(local, sdata, &params);
487 	if (ret) {
488 		ht_dbg(sdata,
489 		       "BA request denied - HW unavailable for %pM tid %d\n",
490 		       sta->sta.addr, tid);
491 		spin_lock_bh(&sta->lock);
492 		ieee80211_agg_splice_packets(sdata, tid_tx, tid);
493 		ieee80211_assign_tid_tx(sta, tid, NULL);
494 		ieee80211_agg_splice_finish(sdata, tid);
495 		spin_unlock_bh(&sta->lock);
496 
497 		ieee80211_agg_start_txq(sta, tid, false);
498 
499 		kfree_rcu(tid_tx, rcu_head);
500 		return;
501 	}
502 
503 	/* activate the timer for the recipient's addBA response */
504 	mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
505 	ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n",
506 	       sta->sta.addr, tid);
507 
508 	spin_lock_bh(&sta->lock);
509 	sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
510 	sta->ampdu_mlme.addba_req_num[tid]++;
511 	spin_unlock_bh(&sta->lock);
512 
513 	/* send AddBA request */
514 	ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
515 				     tid_tx->dialog_token, params.ssn,
516 				     IEEE80211_MAX_AMPDU_BUF,
517 				     tid_tx->timeout);
518 }
519 
520 /*
521  * After accepting the AddBA Response we activated a timer,
522  * resetting it after each frame that we send.
523  */
524 static void sta_tx_agg_session_timer_expired(unsigned long data)
525 {
526 	/* not an elegant detour, but there is no choice as the timer passes
527 	 * only one argument, and various sta_info are needed here, so init
528 	 * flow in sta_info_create gives the TID as data, while the timer_to_id
529 	 * array gives the sta through container_of */
530 	u8 *ptid = (u8 *)data;
531 	u8 *timer_to_id = ptid - *ptid;
532 	struct sta_info *sta = container_of(timer_to_id, struct sta_info,
533 					 timer_to_tid[0]);
534 	struct tid_ampdu_tx *tid_tx;
535 	unsigned long timeout;
536 
537 	rcu_read_lock();
538 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[*ptid]);
539 	if (!tid_tx || test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
540 		rcu_read_unlock();
541 		return;
542 	}
543 
544 	timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
545 	if (time_is_after_jiffies(timeout)) {
546 		mod_timer(&tid_tx->session_timer, timeout);
547 		rcu_read_unlock();
548 		return;
549 	}
550 
551 	rcu_read_unlock();
552 
553 	ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
554 	       sta->sta.addr, (u16)*ptid);
555 
556 	ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
557 }
558 
559 int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
560 				  u16 timeout)
561 {
562 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
563 	struct ieee80211_sub_if_data *sdata = sta->sdata;
564 	struct ieee80211_local *local = sdata->local;
565 	struct tid_ampdu_tx *tid_tx;
566 	int ret = 0;
567 
568 	trace_api_start_tx_ba_session(pubsta, tid);
569 
570 	if (WARN(sta->reserved_tid == tid,
571 		 "Requested to start BA session on reserved tid=%d", tid))
572 		return -EINVAL;
573 
574 	if (!pubsta->ht_cap.ht_supported)
575 		return -EINVAL;
576 
577 	if (WARN_ON_ONCE(!local->ops->ampdu_action))
578 		return -EINVAL;
579 
580 	if ((tid >= IEEE80211_NUM_TIDS) ||
581 	    !ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) ||
582 	    ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW))
583 		return -EINVAL;
584 
585 	if (WARN_ON(tid >= IEEE80211_FIRST_TSPEC_TSID))
586 		return -EINVAL;
587 
588 	ht_dbg(sdata, "Open BA session requested for %pM tid %u\n",
589 	       pubsta->addr, tid);
590 
591 	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
592 	    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
593 	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
594 	    sdata->vif.type != NL80211_IFTYPE_AP &&
595 	    sdata->vif.type != NL80211_IFTYPE_ADHOC)
596 		return -EINVAL;
597 
598 	if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
599 		ht_dbg(sdata,
600 		       "BA sessions blocked - Denying BA session request %pM tid %d\n",
601 		       sta->sta.addr, tid);
602 		return -EINVAL;
603 	}
604 
605 	/*
606 	 * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a
607 	 * member of an IBSS, and has no other existing Block Ack agreement
608 	 * with the recipient STA, then the initiating STA shall transmit a
609 	 * Probe Request frame to the recipient STA and shall not transmit an
610 	 * ADDBA Request frame unless it receives a Probe Response frame
611 	 * from the recipient within dot11ADDBAFailureTimeout.
612 	 *
613 	 * The probe request mechanism for ADDBA is currently not implemented,
614 	 * but we only build up Block Ack session with HT STAs. This information
615 	 * is set when we receive a bss info from a probe response or a beacon.
616 	 */
617 	if (sta->sdata->vif.type == NL80211_IFTYPE_ADHOC &&
618 	    !sta->sta.ht_cap.ht_supported) {
619 		ht_dbg(sdata,
620 		       "BA request denied - IBSS STA %pM does not advertise HT support\n",
621 		       pubsta->addr);
622 		return -EINVAL;
623 	}
624 
625 	spin_lock_bh(&sta->lock);
626 
627 	/* we have tried too many times, receiver does not want A-MPDU */
628 	if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
629 		ret = -EBUSY;
630 		goto err_unlock_sta;
631 	}
632 
633 	/*
634 	 * if we have tried more than HT_AGG_BURST_RETRIES times we
635 	 * will spread our requests in time to avoid stalling connection
636 	 * for too long
637 	 */
638 	if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_BURST_RETRIES &&
639 	    time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
640 			HT_AGG_RETRIES_PERIOD)) {
641 		ht_dbg(sdata,
642 		       "BA request denied - waiting a grace period after %d failed requests on %pM tid %u\n",
643 		       sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid);
644 		ret = -EBUSY;
645 		goto err_unlock_sta;
646 	}
647 
648 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
649 	/* check if the TID is not in aggregation flow already */
650 	if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
651 		ht_dbg(sdata,
652 		       "BA request denied - session is not idle on %pM tid %u\n",
653 		       sta->sta.addr, tid);
654 		ret = -EAGAIN;
655 		goto err_unlock_sta;
656 	}
657 
658 	/* prepare A-MPDU MLME for Tx aggregation */
659 	tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
660 	if (!tid_tx) {
661 		ret = -ENOMEM;
662 		goto err_unlock_sta;
663 	}
664 
665 	skb_queue_head_init(&tid_tx->pending);
666 	__set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
667 
668 	tid_tx->timeout = timeout;
669 
670 	/* response timer */
671 	setup_timer(&tid_tx->addba_resp_timer,
672 		    sta_addba_resp_timer_expired,
673 		    (unsigned long)&sta->timer_to_tid[tid]);
674 
675 	/* tx timer */
676 	setup_deferrable_timer(&tid_tx->session_timer,
677 			       sta_tx_agg_session_timer_expired,
678 			       (unsigned long)&sta->timer_to_tid[tid]);
679 
680 	/* assign a dialog token */
681 	sta->ampdu_mlme.dialog_token_allocator++;
682 	tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
683 
684 	/*
685 	 * Finally, assign it to the start array; the work item will
686 	 * collect it and move it to the normal array.
687 	 */
688 	sta->ampdu_mlme.tid_start_tx[tid] = tid_tx;
689 
690 	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
691 
692 	/* this flow continues off the work */
693  err_unlock_sta:
694 	spin_unlock_bh(&sta->lock);
695 	return ret;
696 }
697 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
698 
699 static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
700 					 struct sta_info *sta, u16 tid)
701 {
702 	struct tid_ampdu_tx *tid_tx;
703 	struct ieee80211_ampdu_params params = {
704 		.sta = &sta->sta,
705 		.action = IEEE80211_AMPDU_TX_OPERATIONAL,
706 		.tid = tid,
707 		.timeout = 0,
708 		.ssn = 0,
709 	};
710 
711 	lockdep_assert_held(&sta->ampdu_mlme.mtx);
712 
713 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
714 	params.buf_size = tid_tx->buf_size;
715 	params.amsdu = tid_tx->amsdu;
716 
717 	ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n",
718 	       sta->sta.addr, tid);
719 
720 	drv_ampdu_action(local, sta->sdata, &params);
721 
722 	/*
723 	 * synchronize with TX path, while splicing the TX path
724 	 * should block so it won't put more packets onto pending.
725 	 */
726 	spin_lock_bh(&sta->lock);
727 
728 	ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
729 	/*
730 	 * Now mark as operational. This will be visible
731 	 * in the TX path, and lets it go lock-free in
732 	 * the common case.
733 	 */
734 	set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
735 	ieee80211_agg_splice_finish(sta->sdata, tid);
736 
737 	spin_unlock_bh(&sta->lock);
738 
739 	ieee80211_agg_start_txq(sta, tid, true);
740 }
741 
742 void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
743 			      struct tid_ampdu_tx *tid_tx)
744 {
745 	struct ieee80211_sub_if_data *sdata = sta->sdata;
746 	struct ieee80211_local *local = sdata->local;
747 
748 	if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
749 		return;
750 
751 	if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
752 		ieee80211_agg_tx_operational(local, sta, tid);
753 }
754 
755 static struct tid_ampdu_tx *
756 ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
757 			const u8 *ra, u16 tid, struct sta_info **sta)
758 {
759 	struct tid_ampdu_tx *tid_tx;
760 
761 	if (tid >= IEEE80211_NUM_TIDS) {
762 		ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
763 		       tid, IEEE80211_NUM_TIDS);
764 		return NULL;
765 	}
766 
767 	*sta = sta_info_get_bss(sdata, ra);
768 	if (!*sta) {
769 		ht_dbg(sdata, "Could not find station: %pM\n", ra);
770 		return NULL;
771 	}
772 
773 	tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
774 
775 	if (WARN_ON(!tid_tx))
776 		ht_dbg(sdata, "addBA was not requested!\n");
777 
778 	return tid_tx;
779 }
780 
781 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
782 				      const u8 *ra, u16 tid)
783 {
784 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
785 	struct ieee80211_local *local = sdata->local;
786 	struct sta_info *sta;
787 	struct tid_ampdu_tx *tid_tx;
788 
789 	trace_api_start_tx_ba_cb(sdata, ra, tid);
790 
791 	rcu_read_lock();
792 	tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
793 	if (!tid_tx)
794 		goto out;
795 
796 	set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
797 	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
798  out:
799 	rcu_read_unlock();
800 }
801 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
802 
803 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
804 				   enum ieee80211_agg_stop_reason reason)
805 {
806 	int ret;
807 
808 	mutex_lock(&sta->ampdu_mlme.mtx);
809 
810 	ret = ___ieee80211_stop_tx_ba_session(sta, tid, reason);
811 
812 	mutex_unlock(&sta->ampdu_mlme.mtx);
813 
814 	return ret;
815 }
816 
817 int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
818 {
819 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
820 	struct ieee80211_sub_if_data *sdata = sta->sdata;
821 	struct ieee80211_local *local = sdata->local;
822 	struct tid_ampdu_tx *tid_tx;
823 	int ret = 0;
824 
825 	trace_api_stop_tx_ba_session(pubsta, tid);
826 
827 	if (!local->ops->ampdu_action)
828 		return -EINVAL;
829 
830 	if (tid >= IEEE80211_NUM_TIDS)
831 		return -EINVAL;
832 
833 	spin_lock_bh(&sta->lock);
834 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
835 
836 	if (!tid_tx) {
837 		ret = -ENOENT;
838 		goto unlock;
839 	}
840 
841 	WARN(sta->reserved_tid == tid,
842 	     "Requested to stop BA session on reserved tid=%d", tid);
843 
844 	if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
845 		/* already in progress stopping it */
846 		ret = 0;
847 		goto unlock;
848 	}
849 
850 	set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state);
851 	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
852 
853  unlock:
854 	spin_unlock_bh(&sta->lock);
855 	return ret;
856 }
857 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
858 
859 void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
860 			     struct tid_ampdu_tx *tid_tx)
861 {
862 	struct ieee80211_sub_if_data *sdata = sta->sdata;
863 	bool send_delba = false;
864 
865 	ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
866 	       sta->sta.addr, tid);
867 
868 	spin_lock_bh(&sta->lock);
869 
870 	if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
871 		ht_dbg(sdata,
872 		       "unexpected callback to A-MPDU stop for %pM tid %d\n",
873 		       sta->sta.addr, tid);
874 		goto unlock_sta;
875 	}
876 
877 	if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR && tid_tx->tx_stop)
878 		send_delba = true;
879 
880 	ieee80211_remove_tid_tx(sta, tid);
881 
882  unlock_sta:
883 	spin_unlock_bh(&sta->lock);
884 
885 	if (send_delba)
886 		ieee80211_send_delba(sdata, sta->sta.addr, tid,
887 			WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
888 }
889 
890 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
891 				     const u8 *ra, u16 tid)
892 {
893 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
894 	struct ieee80211_local *local = sdata->local;
895 	struct sta_info *sta;
896 	struct tid_ampdu_tx *tid_tx;
897 
898 	trace_api_stop_tx_ba_cb(sdata, ra, tid);
899 
900 	rcu_read_lock();
901 	tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
902 	if (!tid_tx)
903 		goto out;
904 
905 	set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
906 	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
907  out:
908 	rcu_read_unlock();
909 }
910 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
911 
912 
913 void ieee80211_process_addba_resp(struct ieee80211_local *local,
914 				  struct sta_info *sta,
915 				  struct ieee80211_mgmt *mgmt,
916 				  size_t len)
917 {
918 	struct tid_ampdu_tx *tid_tx;
919 	struct ieee80211_txq *txq;
920 	u16 capab, tid;
921 	u8 buf_size;
922 	bool amsdu;
923 
924 	capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
925 	amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
926 	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
927 	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
928 	buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
929 
930 	txq = sta->sta.txq[tid];
931 	if (!amsdu && txq)
932 		set_bit(IEEE80211_TXQ_NO_AMSDU, &to_txq_info(txq)->flags);
933 
934 	mutex_lock(&sta->ampdu_mlme.mtx);
935 
936 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
937 	if (!tid_tx)
938 		goto out;
939 
940 	if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
941 		ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n",
942 		       sta->sta.addr, tid);
943 		goto out;
944 	}
945 
946 	del_timer_sync(&tid_tx->addba_resp_timer);
947 
948 	ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n",
949 	       sta->sta.addr, tid);
950 
951 	/*
952 	 * addba_resp_timer may have fired before we got here, and
953 	 * caused WANT_STOP to be set. If the stop then was already
954 	 * processed further, STOPPING might be set.
955 	 */
956 	if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
957 	    test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
958 		ht_dbg(sta->sdata,
959 		       "got addBA resp for %pM tid %d but we already gave up\n",
960 		       sta->sta.addr, tid);
961 		goto out;
962 	}
963 
964 	/*
965 	 * IEEE 802.11-2007 7.3.1.14:
966 	 * In an ADDBA Response frame, when the Status Code field
967 	 * is set to 0, the Buffer Size subfield is set to a value
968 	 * of at least 1.
969 	 */
970 	if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
971 			== WLAN_STATUS_SUCCESS && buf_size) {
972 		if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
973 				     &tid_tx->state)) {
974 			/* ignore duplicate response */
975 			goto out;
976 		}
977 
978 		tid_tx->buf_size = buf_size;
979 		tid_tx->amsdu = amsdu;
980 
981 		if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
982 			ieee80211_agg_tx_operational(local, sta, tid);
983 
984 		sta->ampdu_mlme.addba_req_num[tid] = 0;
985 
986 		if (tid_tx->timeout) {
987 			mod_timer(&tid_tx->session_timer,
988 				  TU_TO_EXP_TIME(tid_tx->timeout));
989 			tid_tx->last_tx = jiffies;
990 		}
991 
992 	} else {
993 		___ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED);
994 	}
995 
996  out:
997 	mutex_unlock(&sta->ampdu_mlme.mtx);
998 }
999