mac80211: rewrite HT handling
[linux-2.6.git] / net / mac80211 / ht.c
1 /*
2  * HT handling
3  *
4  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
5  * Copyright 2002-2005, Instant802 Networks, Inc.
6  * Copyright 2005-2006, Devicescape Software, Inc.
7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9  * Copyright 2007-2008, Intel Corporation
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License version 2 as
13  * published by the Free Software Foundation.
14  */
15
16 #include <linux/ieee80211.h>
17 #include <net/wireless.h>
18 #include <net/mac80211.h>
19 #include "ieee80211_i.h"
20 #include "sta_info.h"
21 #include "wme.h"
22
23 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
24                                        struct ieee80211_ht_cap *ht_cap_ie,
25                                        struct ieee80211_sta_ht_cap *ht_cap)
26 {
27         u8 ampdu_info, tx_mcs_set_cap;
28         int i, max_tx_streams;
29
30         BUG_ON(!ht_cap);
31
32         memset(ht_cap, 0, sizeof(*ht_cap));
33
34         if (!ht_cap_ie)
35                 return;
36
37         ht_cap->ht_supported = true;
38
39         ht_cap->cap = ht_cap->cap & sband->ht_cap.cap;
40         ht_cap->cap &= ~IEEE80211_HT_CAP_SM_PS;
41         ht_cap->cap |= sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS;
42
43         ampdu_info = ht_cap_ie->ampdu_params_info;
44         ht_cap->ampdu_factor =
45                 ampdu_info & IEEE80211_HT_AMPDU_PARM_FACTOR;
46         ht_cap->ampdu_density =
47                 (ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
48
49         /* own MCS TX capabilities */
50         tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
51
52         /* can we TX with MCS rates? */
53         if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
54                 return;
55
56         /* Counting from 0, therefore +1 */
57         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_RX_DIFF)
58                 max_tx_streams =
59                         ((tx_mcs_set_cap & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
60                                 >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
61         else
62                 max_tx_streams = IEEE80211_HT_MCS_TX_MAX_STREAMS;
63
64         /*
65          * 802.11n D5.0 20.3.5 / 20.6 says:
66          * - indices 0 to 7 and 32 are single spatial stream
67          * - 8 to 31 are multiple spatial streams using equal modulation
68          *   [8..15 for two streams, 16..23 for three and 24..31 for four]
69          * - remainder are multiple spatial streams using unequal modulation
70          */
71         for (i = 0; i < max_tx_streams; i++)
72                 ht_cap->mcs.rx_mask[i] =
73                         sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
74
75         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
76                 for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
77                      i < IEEE80211_HT_MCS_MASK_LEN; i++)
78                         ht_cap->mcs.rx_mask[i] =
79                                 sband->ht_cap.mcs.rx_mask[i] &
80                                         ht_cap_ie->mcs.rx_mask[i];
81
82         /* handle MCS rate 32 too */
83         if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
84                 ht_cap->mcs.rx_mask[32/8] |= 1;
85 }
86
87 /*
88  * ieee80211_enable_ht should be called only after the operating band
89  * has been determined as ht configuration depends on the hw's
90  * HT abilities for a specific band.
91  */
92 u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
93                         struct ieee80211_ht_info *hti,
94                         u16 ap_ht_cap_flags)
95 {
96         struct ieee80211_local *local = sdata->local;
97         struct ieee80211_supported_band *sband;
98         struct ieee80211_bss_ht_conf ht;
99         u32 changed = 0;
100         bool enable_ht = true, ht_changed;
101
102         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
103
104         memset(&ht, 0, sizeof(ht));
105
106         /* HT is not supported */
107         if (!sband->ht_cap.ht_supported)
108                 enable_ht = false;
109
110         /* check that channel matches the right operating channel */
111         if (local->hw.conf.channel->center_freq !=
112             ieee80211_channel_to_frequency(hti->control_chan))
113                 enable_ht = false;
114
115         /*
116          * XXX: This is totally incorrect when there are multiple virtual
117          *      interfaces, needs to be fixed later.
118          */
119         ht_changed = local->hw.conf.ht.enabled != enable_ht;
120         local->hw.conf.ht.enabled = enable_ht;
121         if (ht_changed)
122                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_HT);
123
124         /* disable HT */
125         if (!enable_ht)
126                 return 0;
127         ht.secondary_channel_offset =
128                 hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
129         ht.width_40_ok =
130                 !(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
131                 (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
132                 (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY);
133         ht.operation_mode = le16_to_cpu(hti->operation_mode);
134
135         /* if bss configuration changed store the new one */
136         if (memcmp(&sdata->vif.bss_conf.ht, &ht, sizeof(ht))) {
137                 changed |= BSS_CHANGED_HT;
138                 sdata->vif.bss_conf.ht = ht;
139         }
140
141         return changed;
142 }
143
144 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
145                                          const u8 *da, u16 tid,
146                                          u8 dialog_token, u16 start_seq_num,
147                                          u16 agg_size, u16 timeout)
148 {
149         struct ieee80211_local *local = sdata->local;
150         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
151         struct sk_buff *skb;
152         struct ieee80211_mgmt *mgmt;
153         u16 capab;
154
155         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
156
157         if (!skb) {
158                 printk(KERN_ERR "%s: failed to allocate buffer "
159                                 "for addba request frame\n", sdata->dev->name);
160                 return;
161         }
162         skb_reserve(skb, local->hw.extra_tx_headroom);
163         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
164         memset(mgmt, 0, 24);
165         memcpy(mgmt->da, da, ETH_ALEN);
166         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
167         if (sdata->vif.type == NL80211_IFTYPE_AP)
168                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
169         else
170                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
171
172         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
173                                           IEEE80211_STYPE_ACTION);
174
175         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
176
177         mgmt->u.action.category = WLAN_CATEGORY_BACK;
178         mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
179
180         mgmt->u.action.u.addba_req.dialog_token = dialog_token;
181         capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
182         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
183         capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
184
185         mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
186
187         mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
188         mgmt->u.action.u.addba_req.start_seq_num =
189                                         cpu_to_le16(start_seq_num << 4);
190
191         ieee80211_tx_skb(sdata, skb, 0);
192 }
193
194 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
195                                       u8 dialog_token, u16 status, u16 policy,
196                                       u16 buf_size, u16 timeout)
197 {
198         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
199         struct ieee80211_local *local = sdata->local;
200         struct sk_buff *skb;
201         struct ieee80211_mgmt *mgmt;
202         u16 capab;
203
204         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
205
206         if (!skb) {
207                 printk(KERN_DEBUG "%s: failed to allocate buffer "
208                        "for addba resp frame\n", sdata->dev->name);
209                 return;
210         }
211
212         skb_reserve(skb, local->hw.extra_tx_headroom);
213         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
214         memset(mgmt, 0, 24);
215         memcpy(mgmt->da, da, ETH_ALEN);
216         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
217         if (sdata->vif.type == NL80211_IFTYPE_AP)
218                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
219         else
220                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
221         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
222                                           IEEE80211_STYPE_ACTION);
223
224         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
225         mgmt->u.action.category = WLAN_CATEGORY_BACK;
226         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
227         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
228
229         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
230         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
231         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
232
233         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
234         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
235         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
236
237         ieee80211_tx_skb(sdata, skb, 0);
238 }
239
240 static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
241                                  const u8 *da, u16 tid,
242                                  u16 initiator, u16 reason_code)
243 {
244         struct ieee80211_local *local = sdata->local;
245         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
246         struct sk_buff *skb;
247         struct ieee80211_mgmt *mgmt;
248         u16 params;
249
250         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
251
252         if (!skb) {
253                 printk(KERN_ERR "%s: failed to allocate buffer "
254                                         "for delba frame\n", sdata->dev->name);
255                 return;
256         }
257
258         skb_reserve(skb, local->hw.extra_tx_headroom);
259         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
260         memset(mgmt, 0, 24);
261         memcpy(mgmt->da, da, ETH_ALEN);
262         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
263         if (sdata->vif.type == NL80211_IFTYPE_AP)
264                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
265         else
266                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
267         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
268                                           IEEE80211_STYPE_ACTION);
269
270         skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
271
272         mgmt->u.action.category = WLAN_CATEGORY_BACK;
273         mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
274         params = (u16)(initiator << 11);        /* bit 11 initiator */
275         params |= (u16)(tid << 12);             /* bit 15:12 TID number */
276
277         mgmt->u.action.u.delba.params = cpu_to_le16(params);
278         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
279
280         ieee80211_tx_skb(sdata, skb, 0);
281 }
282
283 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
284 {
285         struct ieee80211_local *local = sdata->local;
286         struct sk_buff *skb;
287         struct ieee80211_bar *bar;
288         u16 bar_control = 0;
289
290         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
291         if (!skb) {
292                 printk(KERN_ERR "%s: failed to allocate buffer for "
293                         "bar frame\n", sdata->dev->name);
294                 return;
295         }
296         skb_reserve(skb, local->hw.extra_tx_headroom);
297         bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
298         memset(bar, 0, sizeof(*bar));
299         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
300                                          IEEE80211_STYPE_BACK_REQ);
301         memcpy(bar->ra, ra, ETH_ALEN);
302         memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
303         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
304         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
305         bar_control |= (u16)(tid << 12);
306         bar->control = cpu_to_le16(bar_control);
307         bar->start_seq_num = cpu_to_le16(ssn);
308
309         ieee80211_tx_skb(sdata, skb, 0);
310 }
311
312 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
313                                         u16 initiator, u16 reason)
314 {
315         struct ieee80211_local *local = sdata->local;
316         struct ieee80211_hw *hw = &local->hw;
317         struct sta_info *sta;
318         int ret, i;
319
320         rcu_read_lock();
321
322         sta = sta_info_get(local, ra);
323         if (!sta) {
324                 rcu_read_unlock();
325                 return;
326         }
327
328         /* check if TID is in operational state */
329         spin_lock_bh(&sta->lock);
330         if (sta->ampdu_mlme.tid_state_rx[tid]
331                                 != HT_AGG_STATE_OPERATIONAL) {
332                 spin_unlock_bh(&sta->lock);
333                 rcu_read_unlock();
334                 return;
335         }
336         sta->ampdu_mlme.tid_state_rx[tid] =
337                 HT_AGG_STATE_REQ_STOP_BA_MSK |
338                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
339         spin_unlock_bh(&sta->lock);
340
341         /* stop HW Rx aggregation. ampdu_action existence
342          * already verified in session init so we add the BUG_ON */
343         BUG_ON(!local->ops->ampdu_action);
344
345 #ifdef CONFIG_MAC80211_HT_DEBUG
346         printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
347                ra, tid);
348 #endif /* CONFIG_MAC80211_HT_DEBUG */
349
350         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
351                                        &sta->sta, tid, NULL);
352         if (ret)
353                 printk(KERN_DEBUG "HW problem - can not stop rx "
354                                 "aggregation for tid %d\n", tid);
355
356         /* shutdown timer has not expired */
357         if (initiator != WLAN_BACK_TIMER)
358                 del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
359
360         /* check if this is a self generated aggregation halt */
361         if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
362                 ieee80211_send_delba(sdata, ra, tid, 0, reason);
363
364         /* free the reordering buffer */
365         for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
366                 if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
367                         /* release the reordered frames */
368                         dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
369                         sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
370                         sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
371                 }
372         }
373         /* free resources */
374         kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
375         kfree(sta->ampdu_mlme.tid_rx[tid]);
376         sta->ampdu_mlme.tid_rx[tid] = NULL;
377         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
378
379         rcu_read_unlock();
380 }
381
382
383 /*
384  * After sending add Block Ack request we activated a timer until
385  * add Block Ack response will arrive from the recipient.
386  * If this timer expires sta_addba_resp_timer_expired will be executed.
387  */
388 static void sta_addba_resp_timer_expired(unsigned long data)
389 {
390         /* not an elegant detour, but there is no choice as the timer passes
391          * only one argument, and both sta_info and TID are needed, so init
392          * flow in sta_info_create gives the TID as data, while the timer_to_id
393          * array gives the sta through container_of */
394         u16 tid = *(u8 *)data;
395         struct sta_info *temp_sta = container_of((void *)data,
396                 struct sta_info, timer_to_tid[tid]);
397
398         struct ieee80211_local *local = temp_sta->local;
399         struct ieee80211_hw *hw = &local->hw;
400         struct sta_info *sta;
401         u8 *state;
402
403         rcu_read_lock();
404
405         sta = sta_info_get(local, temp_sta->sta.addr);
406         if (!sta) {
407                 rcu_read_unlock();
408                 return;
409         }
410
411         state = &sta->ampdu_mlme.tid_state_tx[tid];
412         /* check if the TID waits for addBA response */
413         spin_lock_bh(&sta->lock);
414         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
415                 spin_unlock_bh(&sta->lock);
416                 *state = HT_AGG_STATE_IDLE;
417 #ifdef CONFIG_MAC80211_HT_DEBUG
418                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
419                                 "expecting addBA response there", tid);
420 #endif
421                 goto timer_expired_exit;
422         }
423
424 #ifdef CONFIG_MAC80211_HT_DEBUG
425         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
426 #endif
427
428         /* go through the state check in stop_BA_session */
429         *state = HT_AGG_STATE_OPERATIONAL;
430         spin_unlock_bh(&sta->lock);
431         ieee80211_stop_tx_ba_session(hw, temp_sta->sta.addr, tid,
432                                      WLAN_BACK_INITIATOR);
433
434 timer_expired_exit:
435         rcu_read_unlock();
436 }
437
438 void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr)
439 {
440         struct ieee80211_local *local = sdata->local;
441         int i;
442
443         for (i = 0; i <  STA_TID_NUM; i++) {
444                 ieee80211_stop_tx_ba_session(&local->hw, addr, i,
445                                              WLAN_BACK_INITIATOR);
446                 ieee80211_sta_stop_rx_ba_session(sdata, addr, i,
447                                                  WLAN_BACK_RECIPIENT,
448                                                  WLAN_REASON_QSTA_LEAVE_QBSS);
449         }
450 }
451
452 int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
453 {
454         struct ieee80211_local *local = hw_to_local(hw);
455         struct sta_info *sta;
456         struct ieee80211_sub_if_data *sdata;
457         u16 start_seq_num;
458         u8 *state;
459         int ret;
460
461         if (tid >= STA_TID_NUM)
462                 return -EINVAL;
463
464 #ifdef CONFIG_MAC80211_HT_DEBUG
465         printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
466                ra, tid);
467 #endif /* CONFIG_MAC80211_HT_DEBUG */
468
469         rcu_read_lock();
470
471         sta = sta_info_get(local, ra);
472         if (!sta) {
473 #ifdef CONFIG_MAC80211_HT_DEBUG
474                 printk(KERN_DEBUG "Could not find the station\n");
475 #endif
476                 ret = -ENOENT;
477                 goto exit;
478         }
479
480         spin_lock_bh(&sta->lock);
481
482         /* we have tried too many times, receiver does not want A-MPDU */
483         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
484                 ret = -EBUSY;
485                 goto err_unlock_sta;
486         }
487
488         state = &sta->ampdu_mlme.tid_state_tx[tid];
489         /* check if the TID is not in aggregation flow already */
490         if (*state != HT_AGG_STATE_IDLE) {
491 #ifdef CONFIG_MAC80211_HT_DEBUG
492                 printk(KERN_DEBUG "BA request denied - session is not "
493                                  "idle on tid %u\n", tid);
494 #endif /* CONFIG_MAC80211_HT_DEBUG */
495                 ret = -EAGAIN;
496                 goto err_unlock_sta;
497         }
498
499         /* prepare A-MPDU MLME for Tx aggregation */
500         sta->ampdu_mlme.tid_tx[tid] =
501                         kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
502         if (!sta->ampdu_mlme.tid_tx[tid]) {
503 #ifdef CONFIG_MAC80211_HT_DEBUG
504                 if (net_ratelimit())
505                         printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
506                                         tid);
507 #endif
508                 ret = -ENOMEM;
509                 goto err_unlock_sta;
510         }
511         /* Tx timer */
512         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
513                         sta_addba_resp_timer_expired;
514         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
515                         (unsigned long)&sta->timer_to_tid[tid];
516         init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
517
518         /* create a new queue for this aggregation */
519         ret = ieee80211_ht_agg_queue_add(local, sta, tid);
520
521         /* case no queue is available to aggregation
522          * don't switch to aggregation */
523         if (ret) {
524 #ifdef CONFIG_MAC80211_HT_DEBUG
525                 printk(KERN_DEBUG "BA request denied - queue unavailable for"
526                                         " tid %d\n", tid);
527 #endif /* CONFIG_MAC80211_HT_DEBUG */
528                 goto err_unlock_queue;
529         }
530         sdata = sta->sdata;
531
532         /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
533          * call back right away, it must see that the flow has begun */
534         *state |= HT_ADDBA_REQUESTED_MSK;
535
536         /* This is slightly racy because the queue isn't stopped */
537         start_seq_num = sta->tid_seq[tid];
538
539         if (local->ops->ampdu_action)
540                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
541                                                &sta->sta, tid, &start_seq_num);
542
543         if (ret) {
544                 /* No need to requeue the packets in the agg queue, since we
545                  * held the tx lock: no packet could be enqueued to the newly
546                  * allocated queue */
547                 ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
548 #ifdef CONFIG_MAC80211_HT_DEBUG
549                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
550                                         " tid %d\n", tid);
551 #endif /* CONFIG_MAC80211_HT_DEBUG */
552                 *state = HT_AGG_STATE_IDLE;
553                 goto err_unlock_queue;
554         }
555
556         /* Will put all the packets in the new SW queue */
557         ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
558         spin_unlock_bh(&sta->lock);
559
560         /* send an addBA request */
561         sta->ampdu_mlme.dialog_token_allocator++;
562         sta->ampdu_mlme.tid_tx[tid]->dialog_token =
563                         sta->ampdu_mlme.dialog_token_allocator;
564         sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
565
566
567         ieee80211_send_addba_request(sta->sdata, ra, tid,
568                          sta->ampdu_mlme.tid_tx[tid]->dialog_token,
569                          sta->ampdu_mlme.tid_tx[tid]->ssn,
570                          0x40, 5000);
571         /* activate the timer for the recipient's addBA response */
572         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
573                                 jiffies + ADDBA_RESP_INTERVAL;
574         add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
575 #ifdef CONFIG_MAC80211_HT_DEBUG
576         printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
577 #endif
578         goto exit;
579
580 err_unlock_queue:
581         kfree(sta->ampdu_mlme.tid_tx[tid]);
582         sta->ampdu_mlme.tid_tx[tid] = NULL;
583         ret = -EBUSY;
584 err_unlock_sta:
585         spin_unlock_bh(&sta->lock);
586 exit:
587         rcu_read_unlock();
588         return ret;
589 }
590 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
591
592 int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
593                                  u8 *ra, u16 tid,
594                                  enum ieee80211_back_parties initiator)
595 {
596         struct ieee80211_local *local = hw_to_local(hw);
597         struct sta_info *sta;
598         u8 *state;
599         int ret = 0;
600
601         if (tid >= STA_TID_NUM)
602                 return -EINVAL;
603
604         rcu_read_lock();
605         sta = sta_info_get(local, ra);
606         if (!sta) {
607                 rcu_read_unlock();
608                 return -ENOENT;
609         }
610
611         /* check if the TID is in aggregation */
612         state = &sta->ampdu_mlme.tid_state_tx[tid];
613         spin_lock_bh(&sta->lock);
614
615         if (*state != HT_AGG_STATE_OPERATIONAL) {
616                 ret = -ENOENT;
617                 goto stop_BA_exit;
618         }
619
620 #ifdef CONFIG_MAC80211_HT_DEBUG
621         printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
622                ra, tid);
623 #endif /* CONFIG_MAC80211_HT_DEBUG */
624
625         ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
626
627         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
628                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
629
630         if (local->ops->ampdu_action)
631                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
632                                                &sta->sta, tid, NULL);
633
634         /* case HW denied going back to legacy */
635         if (ret) {
636                 WARN_ON(ret != -EBUSY);
637                 *state = HT_AGG_STATE_OPERATIONAL;
638                 ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
639                 goto stop_BA_exit;
640         }
641
642 stop_BA_exit:
643         spin_unlock_bh(&sta->lock);
644         rcu_read_unlock();
645         return ret;
646 }
647 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
648
649 void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
650 {
651         struct ieee80211_local *local = hw_to_local(hw);
652         struct sta_info *sta;
653         u8 *state;
654
655         if (tid >= STA_TID_NUM) {
656 #ifdef CONFIG_MAC80211_HT_DEBUG
657                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
658                                 tid, STA_TID_NUM);
659 #endif
660                 return;
661         }
662
663         rcu_read_lock();
664         sta = sta_info_get(local, ra);
665         if (!sta) {
666                 rcu_read_unlock();
667 #ifdef CONFIG_MAC80211_HT_DEBUG
668                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
669 #endif
670                 return;
671         }
672
673         state = &sta->ampdu_mlme.tid_state_tx[tid];
674         spin_lock_bh(&sta->lock);
675
676         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
677 #ifdef CONFIG_MAC80211_HT_DEBUG
678                 printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
679                                 *state);
680 #endif
681                 spin_unlock_bh(&sta->lock);
682                 rcu_read_unlock();
683                 return;
684         }
685
686         WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
687
688         *state |= HT_ADDBA_DRV_READY_MSK;
689
690         if (*state == HT_AGG_STATE_OPERATIONAL) {
691 #ifdef CONFIG_MAC80211_HT_DEBUG
692                 printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
693 #endif
694                 ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
695         }
696         spin_unlock_bh(&sta->lock);
697         rcu_read_unlock();
698 }
699 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
700
701 void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
702 {
703         struct ieee80211_local *local = hw_to_local(hw);
704         struct sta_info *sta;
705         u8 *state;
706         int agg_queue;
707
708         if (tid >= STA_TID_NUM) {
709 #ifdef CONFIG_MAC80211_HT_DEBUG
710                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
711                                 tid, STA_TID_NUM);
712 #endif
713                 return;
714         }
715
716 #ifdef CONFIG_MAC80211_HT_DEBUG
717         printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
718                ra, tid);
719 #endif /* CONFIG_MAC80211_HT_DEBUG */
720
721         rcu_read_lock();
722         sta = sta_info_get(local, ra);
723         if (!sta) {
724 #ifdef CONFIG_MAC80211_HT_DEBUG
725                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
726 #endif
727                 rcu_read_unlock();
728                 return;
729         }
730         state = &sta->ampdu_mlme.tid_state_tx[tid];
731
732         /* NOTE: no need to use sta->lock in this state check, as
733          * ieee80211_stop_tx_ba_session will let only one stop call to
734          * pass through per sta/tid
735          */
736         if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
737 #ifdef CONFIG_MAC80211_HT_DEBUG
738                 printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
739 #endif
740                 rcu_read_unlock();
741                 return;
742         }
743
744         if (*state & HT_AGG_STATE_INITIATOR_MSK)
745                 ieee80211_send_delba(sta->sdata, ra, tid,
746                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
747
748         agg_queue = sta->tid_to_tx_q[tid];
749
750         ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
751
752         /* We just requeued the all the frames that were in the
753          * removed queue, and since we might miss a softirq we do
754          * netif_schedule_queue.  ieee80211_wake_queue is not used
755          * here as this queue is not necessarily stopped
756          */
757         netif_schedule_queue(netdev_get_tx_queue(local->mdev, agg_queue));
758         spin_lock_bh(&sta->lock);
759         *state = HT_AGG_STATE_IDLE;
760         sta->ampdu_mlme.addba_req_num[tid] = 0;
761         kfree(sta->ampdu_mlme.tid_tx[tid]);
762         sta->ampdu_mlme.tid_tx[tid] = NULL;
763         spin_unlock_bh(&sta->lock);
764
765         rcu_read_unlock();
766 }
767 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
768
769 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
770                                       const u8 *ra, u16 tid)
771 {
772         struct ieee80211_local *local = hw_to_local(hw);
773         struct ieee80211_ra_tid *ra_tid;
774         struct sk_buff *skb = dev_alloc_skb(0);
775
776         if (unlikely(!skb)) {
777 #ifdef CONFIG_MAC80211_HT_DEBUG
778                 if (net_ratelimit())
779                         printk(KERN_WARNING "%s: Not enough memory, "
780                                "dropping start BA session", skb->dev->name);
781 #endif
782                 return;
783         }
784         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
785         memcpy(&ra_tid->ra, ra, ETH_ALEN);
786         ra_tid->tid = tid;
787
788         skb->pkt_type = IEEE80211_ADDBA_MSG;
789         skb_queue_tail(&local->skb_queue, skb);
790         tasklet_schedule(&local->tasklet);
791 }
792 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
793
794 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
795                                      const u8 *ra, u16 tid)
796 {
797         struct ieee80211_local *local = hw_to_local(hw);
798         struct ieee80211_ra_tid *ra_tid;
799         struct sk_buff *skb = dev_alloc_skb(0);
800
801         if (unlikely(!skb)) {
802 #ifdef CONFIG_MAC80211_HT_DEBUG
803                 if (net_ratelimit())
804                         printk(KERN_WARNING "%s: Not enough memory, "
805                                "dropping stop BA session", skb->dev->name);
806 #endif
807                 return;
808         }
809         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
810         memcpy(&ra_tid->ra, ra, ETH_ALEN);
811         ra_tid->tid = tid;
812
813         skb->pkt_type = IEEE80211_DELBA_MSG;
814         skb_queue_tail(&local->skb_queue, skb);
815         tasklet_schedule(&local->tasklet);
816 }
817 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
818
819 /*
820  * After accepting the AddBA Request we activated a timer,
821  * resetting it after each frame that arrives from the originator.
822  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
823  */
824 static void sta_rx_agg_session_timer_expired(unsigned long data)
825 {
826         /* not an elegant detour, but there is no choice as the timer passes
827          * only one argument, and various sta_info are needed here, so init
828          * flow in sta_info_create gives the TID as data, while the timer_to_id
829          * array gives the sta through container_of */
830         u8 *ptid = (u8 *)data;
831         u8 *timer_to_id = ptid - *ptid;
832         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
833                                          timer_to_tid[0]);
834
835 #ifdef CONFIG_MAC80211_HT_DEBUG
836         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
837 #endif
838         ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
839                                          (u16)*ptid, WLAN_BACK_TIMER,
840                                          WLAN_REASON_QSTA_TIMEOUT);
841 }
842
843 void ieee80211_process_addba_request(struct ieee80211_local *local,
844                                      struct sta_info *sta,
845                                      struct ieee80211_mgmt *mgmt,
846                                      size_t len)
847 {
848         struct ieee80211_hw *hw = &local->hw;
849         struct ieee80211_conf *conf = &hw->conf;
850         struct tid_ampdu_rx *tid_agg_rx;
851         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
852         u8 dialog_token;
853         int ret = -EOPNOTSUPP;
854
855         /* extract session parameters from addba request frame */
856         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
857         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
858         start_seq_num =
859                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
860
861         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
862         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
863         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
864         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
865
866         status = WLAN_STATUS_REQUEST_DECLINED;
867
868         /* sanity check for incoming parameters:
869          * check if configuration can support the BA policy
870          * and if buffer size does not exceeds max value */
871         /* XXX: check own ht delayed BA capability?? */
872         if (((ba_policy != 1)
873                 && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
874                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
875                 status = WLAN_STATUS_INVALID_QOS_PARAM;
876 #ifdef CONFIG_MAC80211_HT_DEBUG
877                 if (net_ratelimit())
878                         printk(KERN_DEBUG "AddBA Req with bad params from "
879                                 "%pM on tid %u. policy %d, buffer size %d\n",
880                                 mgmt->sa, tid, ba_policy,
881                                 buf_size);
882 #endif /* CONFIG_MAC80211_HT_DEBUG */
883                 goto end_no_lock;
884         }
885         /* determine default buffer size */
886         if (buf_size == 0) {
887                 struct ieee80211_supported_band *sband;
888
889                 sband = local->hw.wiphy->bands[conf->channel->band];
890                 buf_size = IEEE80211_MIN_AMPDU_BUF;
891                 buf_size = buf_size << sband->ht_cap.ampdu_factor;
892         }
893
894
895         /* examine state machine */
896         spin_lock_bh(&sta->lock);
897
898         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
899 #ifdef CONFIG_MAC80211_HT_DEBUG
900                 if (net_ratelimit())
901                         printk(KERN_DEBUG "unexpected AddBA Req from "
902                                 "%pM on tid %u\n",
903                                 mgmt->sa, tid);
904 #endif /* CONFIG_MAC80211_HT_DEBUG */
905                 goto end;
906         }
907
908         /* prepare A-MPDU MLME for Rx aggregation */
909         sta->ampdu_mlme.tid_rx[tid] =
910                         kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
911         if (!sta->ampdu_mlme.tid_rx[tid]) {
912 #ifdef CONFIG_MAC80211_HT_DEBUG
913                 if (net_ratelimit())
914                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
915                                         tid);
916 #endif
917                 goto end;
918         }
919         /* rx timer */
920         sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
921                                 sta_rx_agg_session_timer_expired;
922         sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
923                                 (unsigned long)&sta->timer_to_tid[tid];
924         init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
925
926         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
927
928         /* prepare reordering buffer */
929         tid_agg_rx->reorder_buf =
930                 kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
931         if (!tid_agg_rx->reorder_buf) {
932 #ifdef CONFIG_MAC80211_HT_DEBUG
933                 if (net_ratelimit())
934                         printk(KERN_ERR "can not allocate reordering buffer "
935                                "to tid %d\n", tid);
936 #endif
937                 kfree(sta->ampdu_mlme.tid_rx[tid]);
938                 goto end;
939         }
940         memset(tid_agg_rx->reorder_buf, 0,
941                 buf_size * sizeof(struct sk_buff *));
942
943         if (local->ops->ampdu_action)
944                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
945                                                &sta->sta, tid, &start_seq_num);
946 #ifdef CONFIG_MAC80211_HT_DEBUG
947         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
948 #endif /* CONFIG_MAC80211_HT_DEBUG */
949
950         if (ret) {
951                 kfree(tid_agg_rx->reorder_buf);
952                 kfree(tid_agg_rx);
953                 sta->ampdu_mlme.tid_rx[tid] = NULL;
954                 goto end;
955         }
956
957         /* change state and send addba resp */
958         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
959         tid_agg_rx->dialog_token = dialog_token;
960         tid_agg_rx->ssn = start_seq_num;
961         tid_agg_rx->head_seq_num = start_seq_num;
962         tid_agg_rx->buf_size = buf_size;
963         tid_agg_rx->timeout = timeout;
964         tid_agg_rx->stored_mpdu_num = 0;
965         status = WLAN_STATUS_SUCCESS;
966 end:
967         spin_unlock_bh(&sta->lock);
968
969 end_no_lock:
970         ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
971                                   dialog_token, status, 1, buf_size, timeout);
972 }
973
974 void ieee80211_process_addba_resp(struct ieee80211_local *local,
975                                   struct sta_info *sta,
976                                   struct ieee80211_mgmt *mgmt,
977                                   size_t len)
978 {
979         struct ieee80211_hw *hw = &local->hw;
980         u16 capab;
981         u16 tid;
982         u8 *state;
983
984         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
985         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
986
987         state = &sta->ampdu_mlme.tid_state_tx[tid];
988
989         spin_lock_bh(&sta->lock);
990
991         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
992                 spin_unlock_bh(&sta->lock);
993                 return;
994         }
995
996         if (mgmt->u.action.u.addba_resp.dialog_token !=
997                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
998                 spin_unlock_bh(&sta->lock);
999 #ifdef CONFIG_MAC80211_HT_DEBUG
1000                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
1001 #endif /* CONFIG_MAC80211_HT_DEBUG */
1002                 return;
1003         }
1004
1005         del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
1006 #ifdef CONFIG_MAC80211_HT_DEBUG
1007         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
1008 #endif /* CONFIG_MAC80211_HT_DEBUG */
1009         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
1010                         == WLAN_STATUS_SUCCESS) {
1011                 *state |= HT_ADDBA_RECEIVED_MSK;
1012                 sta->ampdu_mlme.addba_req_num[tid] = 0;
1013
1014                 if (*state == HT_AGG_STATE_OPERATIONAL)
1015                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
1016
1017                 spin_unlock_bh(&sta->lock);
1018         } else {
1019                 sta->ampdu_mlme.addba_req_num[tid]++;
1020                 /* this will allow the state check in stop_BA_session */
1021                 *state = HT_AGG_STATE_OPERATIONAL;
1022                 spin_unlock_bh(&sta->lock);
1023                 ieee80211_stop_tx_ba_session(hw, sta->sta.addr, tid,
1024                                              WLAN_BACK_INITIATOR);
1025         }
1026 }
1027
1028 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
1029                              struct sta_info *sta,
1030                              struct ieee80211_mgmt *mgmt, size_t len)
1031 {
1032         struct ieee80211_local *local = sdata->local;
1033         u16 tid, params;
1034         u16 initiator;
1035
1036         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1037         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1038         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1039
1040 #ifdef CONFIG_MAC80211_HT_DEBUG
1041         if (net_ratelimit())
1042                 printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
1043                         mgmt->sa, initiator ? "initiator" : "recipient", tid,
1044                         mgmt->u.action.u.delba.reason_code);
1045 #endif /* CONFIG_MAC80211_HT_DEBUG */
1046
1047         if (initiator == WLAN_BACK_INITIATOR)
1048                 ieee80211_sta_stop_rx_ba_session(sdata, sta->sta.addr, tid,
1049                                                  WLAN_BACK_INITIATOR, 0);
1050         else { /* WLAN_BACK_RECIPIENT */
1051                 spin_lock_bh(&sta->lock);
1052                 sta->ampdu_mlme.tid_state_tx[tid] =
1053                                 HT_AGG_STATE_OPERATIONAL;
1054                 spin_unlock_bh(&sta->lock);
1055                 ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid,
1056                                              WLAN_BACK_RECIPIENT);
1057         }
1058 }