4 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
5 * Copyright 2002-2005, Instant802 Networks, Inc.
6 * Copyright 2005-2006, Devicescape Software, Inc.
7 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9 * Copyright 2007-2010, Intel Corporation
10 * Copyright(c) 2015-2017 Intel Deutschland GmbH
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License version 2 as
14 * published by the Free Software Foundation.
18 * DOC: RX A-MPDU aggregation
20 * Aggregation on the RX side requires only implementing the
21 * @ampdu_action callback that is invoked to start/stop any
22 * block-ack sessions for RX aggregation.
24 * When RX aggregation is started by the peer, the driver is
25 * notified via @ampdu_action function, with the
26 * %IEEE80211_AMPDU_RX_START action, and may reject the request
27 * in which case a negative response is sent to the peer, if it
28 * accepts it a positive response is sent.
30 * While the session is active, the device/driver are required
31 * to de-aggregate frames and pass them up one by one to mac80211,
32 * which will handle the reorder buffer.
34 * When the aggregation session is stopped again by the peer or
35 * ourselves, the driver's @ampdu_action function will be called
36 * with the action %IEEE80211_AMPDU_RX_STOP. In this case, the
40 #include <linux/ieee80211.h>
41 #include <linux/slab.h>
42 #include <linux/export.h>
43 #include <net/mac80211.h>
44 #include "ieee80211_i.h"
45 #include "driver-ops.h"
47 static void ieee80211_free_tid_rx(struct rcu_head
*h
)
49 struct tid_ampdu_rx
*tid_rx
=
50 container_of(h
, struct tid_ampdu_rx
, rcu_head
);
53 for (i
= 0; i
< tid_rx
->buf_size
; i
++)
54 __skb_queue_purge(&tid_rx
->reorder_buf
[i
]);
55 kfree(tid_rx
->reorder_buf
);
56 kfree(tid_rx
->reorder_time
);
60 void ___ieee80211_stop_rx_ba_session(struct sta_info
*sta
, u16 tid
,
61 u16 initiator
, u16 reason
, bool tx
)
63 struct ieee80211_local
*local
= sta
->local
;
64 struct tid_ampdu_rx
*tid_rx
;
65 struct ieee80211_ampdu_params params
= {
67 .action
= IEEE80211_AMPDU_RX_STOP
,
74 lockdep_assert_held(&sta
->ampdu_mlme
.mtx
);
76 tid_rx
= rcu_dereference_protected(sta
->ampdu_mlme
.tid_rx
[tid
],
77 lockdep_is_held(&sta
->ampdu_mlme
.mtx
));
79 if (!test_bit(tid
, sta
->ampdu_mlme
.agg_session_valid
))
82 RCU_INIT_POINTER(sta
->ampdu_mlme
.tid_rx
[tid
], NULL
);
83 __clear_bit(tid
, sta
->ampdu_mlme
.agg_session_valid
);
86 "Rx BA session stop requested for %pM tid %u %s reason: %d\n",
88 initiator
== WLAN_BACK_RECIPIENT
? "recipient" : "initiator",
91 if (drv_ampdu_action(local
, sta
->sdata
, ¶ms
))
92 sdata_info(sta
->sdata
,
93 "HW problem - can not stop rx aggregation for %pM tid %d\n",
96 /* check if this is a self generated aggregation halt */
97 if (initiator
== WLAN_BACK_RECIPIENT
&& tx
)
98 ieee80211_send_delba(sta
->sdata
, sta
->sta
.addr
,
99 tid
, WLAN_BACK_RECIPIENT
, reason
);
102 * return here in case tid_rx is not assigned - which will happen if
103 * IEEE80211_HW_SUPPORTS_REORDERING_BUFFER is set.
108 del_timer_sync(&tid_rx
->session_timer
);
110 /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
111 spin_lock_bh(&tid_rx
->reorder_lock
);
112 tid_rx
->removed
= true;
113 spin_unlock_bh(&tid_rx
->reorder_lock
);
114 del_timer_sync(&tid_rx
->reorder_timer
);
116 call_rcu(&tid_rx
->rcu_head
, ieee80211_free_tid_rx
);
119 void __ieee80211_stop_rx_ba_session(struct sta_info
*sta
, u16 tid
,
120 u16 initiator
, u16 reason
, bool tx
)
122 mutex_lock(&sta
->ampdu_mlme
.mtx
);
123 ___ieee80211_stop_rx_ba_session(sta
, tid
, initiator
, reason
, tx
);
124 mutex_unlock(&sta
->ampdu_mlme
.mtx
);
127 void ieee80211_stop_rx_ba_session(struct ieee80211_vif
*vif
, u16 ba_rx_bitmap
,
130 struct ieee80211_sub_if_data
*sdata
= vif_to_sdata(vif
);
131 struct sta_info
*sta
;
135 sta
= sta_info_get_bss(sdata
, addr
);
141 for (i
= 0; i
< IEEE80211_NUM_TIDS
; i
++)
142 if (ba_rx_bitmap
& BIT(i
))
143 set_bit(i
, sta
->ampdu_mlme
.tid_rx_stop_requested
);
145 ieee80211_queue_work(&sta
->local
->hw
, &sta
->ampdu_mlme
.work
);
148 EXPORT_SYMBOL(ieee80211_stop_rx_ba_session
);
151 * After accepting the AddBA Request we activated a timer,
152 * resetting it after each frame that arrives from the originator.
154 static void sta_rx_agg_session_timer_expired(struct timer_list
*t
)
156 struct tid_ampdu_rx
*tid_rx_timer
=
157 from_timer(tid_rx_timer
, t
, session_timer
);
158 struct sta_info
*sta
= tid_rx_timer
->sta
;
159 u8 tid
= tid_rx_timer
->tid
;
160 struct tid_ampdu_rx
*tid_rx
;
161 unsigned long timeout
;
164 tid_rx
= rcu_dereference(sta
->ampdu_mlme
.tid_rx
[tid
]);
170 timeout
= tid_rx
->last_rx
+ TU_TO_JIFFIES(tid_rx
->timeout
);
171 if (time_is_after_jiffies(timeout
)) {
172 mod_timer(&tid_rx
->session_timer
, timeout
);
178 ht_dbg(sta
->sdata
, "RX session timer expired on %pM tid %d\n",
181 set_bit(tid
, sta
->ampdu_mlme
.tid_rx_timer_expired
);
182 ieee80211_queue_work(&sta
->local
->hw
, &sta
->ampdu_mlme
.work
);
185 static void sta_rx_agg_reorder_timer_expired(struct timer_list
*t
)
187 struct tid_ampdu_rx
*tid_rx
= from_timer(tid_rx
, t
, reorder_timer
);
190 ieee80211_release_reorder_timeout(tid_rx
->sta
, tid_rx
->tid
);
194 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data
*sdata
, u8
*da
, u16 tid
,
195 u8 dialog_token
, u16 status
, u16 policy
,
196 u16 buf_size
, u16 timeout
)
198 struct ieee80211_local
*local
= sdata
->local
;
200 struct ieee80211_mgmt
*mgmt
;
201 bool amsdu
= ieee80211_hw_check(&local
->hw
, SUPPORTS_AMSDU_IN_AMPDU
);
204 skb
= dev_alloc_skb(sizeof(*mgmt
) + local
->hw
.extra_tx_headroom
);
208 skb_reserve(skb
, local
->hw
.extra_tx_headroom
);
209 mgmt
= skb_put_zero(skb
, 24);
210 memcpy(mgmt
->da
, da
, ETH_ALEN
);
211 memcpy(mgmt
->sa
, sdata
->vif
.addr
, ETH_ALEN
);
212 if (sdata
->vif
.type
== NL80211_IFTYPE_AP
||
213 sdata
->vif
.type
== NL80211_IFTYPE_AP_VLAN
||
214 sdata
->vif
.type
== NL80211_IFTYPE_MESH_POINT
)
215 memcpy(mgmt
->bssid
, sdata
->vif
.addr
, ETH_ALEN
);
216 else if (sdata
->vif
.type
== NL80211_IFTYPE_STATION
)
217 memcpy(mgmt
->bssid
, sdata
->u
.mgd
.bssid
, ETH_ALEN
);
218 else if (sdata
->vif
.type
== NL80211_IFTYPE_ADHOC
)
219 memcpy(mgmt
->bssid
, sdata
->u
.ibss
.bssid
, ETH_ALEN
);
221 mgmt
->frame_control
= cpu_to_le16(IEEE80211_FTYPE_MGMT
|
222 IEEE80211_STYPE_ACTION
);
224 skb_put(skb
, 1 + sizeof(mgmt
->u
.action
.u
.addba_resp
));
225 mgmt
->u
.action
.category
= WLAN_CATEGORY_BACK
;
226 mgmt
->u
.action
.u
.addba_resp
.action_code
= WLAN_ACTION_ADDBA_RESP
;
227 mgmt
->u
.action
.u
.addba_resp
.dialog_token
= dialog_token
;
229 capab
= (u16
)(amsdu
<< 0); /* bit 0 A-MSDU support */
230 capab
|= (u16
)(policy
<< 1); /* bit 1 aggregation policy */
231 capab
|= (u16
)(tid
<< 2); /* bit 5:2 TID number */
232 capab
|= (u16
)(buf_size
<< 6); /* bit 15:6 max size of aggregation */
234 mgmt
->u
.action
.u
.addba_resp
.capab
= cpu_to_le16(capab
);
235 mgmt
->u
.action
.u
.addba_resp
.timeout
= cpu_to_le16(timeout
);
236 mgmt
->u
.action
.u
.addba_resp
.status
= cpu_to_le16(status
);
238 ieee80211_tx_skb(sdata
, skb
);
241 void ___ieee80211_start_rx_ba_session(struct sta_info
*sta
,
242 u8 dialog_token
, u16 timeout
,
243 u16 start_seq_num
, u16 ba_policy
, u16 tid
,
244 u16 buf_size
, bool tx
, bool auto_seq
)
246 struct ieee80211_local
*local
= sta
->sdata
->local
;
247 struct tid_ampdu_rx
*tid_agg_rx
;
248 struct ieee80211_ampdu_params params
= {
250 .action
= IEEE80211_AMPDU_RX_START
,
254 .ssn
= start_seq_num
,
256 int i
, ret
= -EOPNOTSUPP
;
257 u16 status
= WLAN_STATUS_REQUEST_DECLINED
;
259 if (tid
>= IEEE80211_FIRST_TSPEC_TSID
) {
261 "STA %pM requests BA session on unsupported tid %d\n",
266 if (!sta
->sta
.ht_cap
.ht_supported
) {
268 "STA %pM erroneously requests BA session on tid %d w/o QoS\n",
270 /* send a response anyway, it's an error case if we get here */
274 if (test_sta_flag(sta
, WLAN_STA_BLOCK_BA
)) {
276 "Suspend in progress - Denying ADDBA request (%pM tid %d)\n",
281 /* sanity check for incoming parameters:
282 * check if configuration can support the BA policy
283 * and if buffer size does not exceeds max value */
284 /* XXX: check own ht delayed BA capability?? */
285 if (((ba_policy
!= 1) &&
286 (!(sta
->sta
.ht_cap
.cap
& IEEE80211_HT_CAP_DELAY_BA
))) ||
287 (buf_size
> IEEE80211_MAX_AMPDU_BUF
)) {
288 status
= WLAN_STATUS_INVALID_QOS_PARAM
;
289 ht_dbg_ratelimited(sta
->sdata
,
290 "AddBA Req with bad params from %pM on tid %u. policy %d, buffer size %d\n",
291 sta
->sta
.addr
, tid
, ba_policy
, buf_size
);
294 /* determine default buffer size */
296 buf_size
= IEEE80211_MAX_AMPDU_BUF
;
298 /* make sure the size doesn't exceed the maximum supported by the hw */
299 if (buf_size
> sta
->sta
.max_rx_aggregation_subframes
)
300 buf_size
= sta
->sta
.max_rx_aggregation_subframes
;
301 params
.buf_size
= buf_size
;
303 ht_dbg(sta
->sdata
, "AddBA Req buf_size=%d for %pM\n",
304 buf_size
, sta
->sta
.addr
);
306 /* examine state machine */
307 lockdep_assert_held(&sta
->ampdu_mlme
.mtx
);
309 if (test_bit(tid
, sta
->ampdu_mlme
.agg_session_valid
)) {
310 if (sta
->ampdu_mlme
.tid_rx_token
[tid
] == dialog_token
) {
311 ht_dbg_ratelimited(sta
->sdata
,
312 "updated AddBA Req from %pM on tid %u\n",
314 /* We have no API to update the timeout value in the
315 * driver so reject the timeout update.
317 status
= WLAN_STATUS_REQUEST_DECLINED
;
318 ieee80211_send_addba_resp(sta
->sdata
, sta
->sta
.addr
,
319 tid
, dialog_token
, status
,
320 1, buf_size
, timeout
);
324 ht_dbg_ratelimited(sta
->sdata
,
325 "unexpected AddBA Req from %pM on tid %u\n",
328 /* delete existing Rx BA session on the same tid */
329 ___ieee80211_stop_rx_ba_session(sta
, tid
, WLAN_BACK_RECIPIENT
,
330 WLAN_STATUS_UNSPECIFIED_QOS
,
334 if (ieee80211_hw_check(&local
->hw
, SUPPORTS_REORDERING_BUFFER
)) {
335 ret
= drv_ampdu_action(local
, sta
->sdata
, ¶ms
);
337 "Rx A-MPDU request on %pM tid %d result %d\n",
338 sta
->sta
.addr
, tid
, ret
);
340 status
= WLAN_STATUS_SUCCESS
;
344 /* prepare A-MPDU MLME for Rx aggregation */
345 tid_agg_rx
= kzalloc(sizeof(*tid_agg_rx
), GFP_KERNEL
);
349 spin_lock_init(&tid_agg_rx
->reorder_lock
);
352 timer_setup(&tid_agg_rx
->session_timer
,
353 sta_rx_agg_session_timer_expired
, TIMER_DEFERRABLE
);
355 /* rx reorder timer */
356 timer_setup(&tid_agg_rx
->reorder_timer
,
357 sta_rx_agg_reorder_timer_expired
, 0);
359 /* prepare reordering buffer */
360 tid_agg_rx
->reorder_buf
=
361 kcalloc(buf_size
, sizeof(struct sk_buff_head
), GFP_KERNEL
);
362 tid_agg_rx
->reorder_time
=
363 kcalloc(buf_size
, sizeof(unsigned long), GFP_KERNEL
);
364 if (!tid_agg_rx
->reorder_buf
|| !tid_agg_rx
->reorder_time
) {
365 kfree(tid_agg_rx
->reorder_buf
);
366 kfree(tid_agg_rx
->reorder_time
);
371 for (i
= 0; i
< buf_size
; i
++)
372 __skb_queue_head_init(&tid_agg_rx
->reorder_buf
[i
]);
374 ret
= drv_ampdu_action(local
, sta
->sdata
, ¶ms
);
375 ht_dbg(sta
->sdata
, "Rx A-MPDU request on %pM tid %d result %d\n",
376 sta
->sta
.addr
, tid
, ret
);
378 kfree(tid_agg_rx
->reorder_buf
);
379 kfree(tid_agg_rx
->reorder_time
);
385 tid_agg_rx
->ssn
= start_seq_num
;
386 tid_agg_rx
->head_seq_num
= start_seq_num
;
387 tid_agg_rx
->buf_size
= buf_size
;
388 tid_agg_rx
->timeout
= timeout
;
389 tid_agg_rx
->stored_mpdu_num
= 0;
390 tid_agg_rx
->auto_seq
= auto_seq
;
391 tid_agg_rx
->started
= false;
392 tid_agg_rx
->reorder_buf_filtered
= 0;
393 tid_agg_rx
->tid
= tid
;
394 tid_agg_rx
->sta
= sta
;
395 status
= WLAN_STATUS_SUCCESS
;
397 /* activate it for RX */
398 rcu_assign_pointer(sta
->ampdu_mlme
.tid_rx
[tid
], tid_agg_rx
);
401 mod_timer(&tid_agg_rx
->session_timer
, TU_TO_EXP_TIME(timeout
));
402 tid_agg_rx
->last_rx
= jiffies
;
406 if (status
== WLAN_STATUS_SUCCESS
) {
407 __set_bit(tid
, sta
->ampdu_mlme
.agg_session_valid
);
408 __clear_bit(tid
, sta
->ampdu_mlme
.unexpected_agg
);
409 sta
->ampdu_mlme
.tid_rx_token
[tid
] = dialog_token
;
413 ieee80211_send_addba_resp(sta
->sdata
, sta
->sta
.addr
, tid
,
414 dialog_token
, status
, 1, buf_size
,
418 void __ieee80211_start_rx_ba_session(struct sta_info
*sta
,
419 u8 dialog_token
, u16 timeout
,
420 u16 start_seq_num
, u16 ba_policy
, u16 tid
,
421 u16 buf_size
, bool tx
, bool auto_seq
)
423 mutex_lock(&sta
->ampdu_mlme
.mtx
);
424 ___ieee80211_start_rx_ba_session(sta
, dialog_token
, timeout
,
425 start_seq_num
, ba_policy
, tid
,
426 buf_size
, tx
, auto_seq
);
427 mutex_unlock(&sta
->ampdu_mlme
.mtx
);
430 void ieee80211_process_addba_request(struct ieee80211_local
*local
,
431 struct sta_info
*sta
,
432 struct ieee80211_mgmt
*mgmt
,
435 u16 capab
, tid
, timeout
, ba_policy
, buf_size
, start_seq_num
;
438 /* extract session parameters from addba request frame */
439 dialog_token
= mgmt
->u
.action
.u
.addba_req
.dialog_token
;
440 timeout
= le16_to_cpu(mgmt
->u
.action
.u
.addba_req
.timeout
);
442 le16_to_cpu(mgmt
->u
.action
.u
.addba_req
.start_seq_num
) >> 4;
444 capab
= le16_to_cpu(mgmt
->u
.action
.u
.addba_req
.capab
);
445 ba_policy
= (capab
& IEEE80211_ADDBA_PARAM_POLICY_MASK
) >> 1;
446 tid
= (capab
& IEEE80211_ADDBA_PARAM_TID_MASK
) >> 2;
447 buf_size
= (capab
& IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
) >> 6;
449 __ieee80211_start_rx_ba_session(sta
, dialog_token
, timeout
,
450 start_seq_num
, ba_policy
, tid
,
451 buf_size
, true, false);
454 void ieee80211_manage_rx_ba_offl(struct ieee80211_vif
*vif
,
455 const u8
*addr
, unsigned int tid
)
457 struct ieee80211_sub_if_data
*sdata
= vif_to_sdata(vif
);
458 struct ieee80211_local
*local
= sdata
->local
;
459 struct sta_info
*sta
;
462 sta
= sta_info_get_bss(sdata
, addr
);
466 set_bit(tid
, sta
->ampdu_mlme
.tid_rx_manage_offl
);
467 ieee80211_queue_work(&local
->hw
, &sta
->ampdu_mlme
.work
);
471 EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl
);
473 void ieee80211_rx_ba_timer_expired(struct ieee80211_vif
*vif
,
474 const u8
*addr
, unsigned int tid
)
476 struct ieee80211_sub_if_data
*sdata
= vif_to_sdata(vif
);
477 struct ieee80211_local
*local
= sdata
->local
;
478 struct sta_info
*sta
;
481 sta
= sta_info_get_bss(sdata
, addr
);
485 set_bit(tid
, sta
->ampdu_mlme
.tid_rx_timer_expired
);
486 ieee80211_queue_work(&local
->hw
, &sta
->ampdu_mlme
.work
);
491 EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired
);