1 files changed, 147 insertions, 106 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index eb9df22418f0..2f0ccbc5f13e 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -149,16 +149,133 @@ void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
         rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 }
 
+static inline int ieee80211_ac_from_tid(int tid)
+{
+        return ieee802_1d_to_ac[tid & 7];
+}
+
+/*
+ * When multiple aggregation sessions on multiple stations
+ * are being created/destroyed simultaneously, we need to
+ * refcount the global queue stop caused by that in order
+ * to not get into a situation where one of the aggregation
+ * setup or teardown re-enables queues before the other is
+ * ready to handle that.
+ *
+ * These two functions take care of this issue by keeping
+ * a global "agg_queue_stop" refcount.
+ */
+static void __acquires(agg_queue)
+ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
+{
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+
+        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
+                ieee80211_stop_queue_by_reason(
+                        &sdata->local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __acquire(agg_queue);
+}
+
+static void __releases(agg_queue)
+ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
+{
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+
+        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
+                ieee80211_wake_queue_by_reason(
+                        &sdata->local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __release(agg_queue);
+}
+
+/*
+ * splice packets from the STA's pending to the local pending,
+ * requires a call to ieee80211_agg_splice_finish later
+ */
+static void __acquires(agg_queue)
+ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
+                             struct tid_ampdu_tx *tid_tx, u16 tid)
+{
+        struct ieee80211_local *local = sdata->local;
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+        unsigned long flags;
+
+        ieee80211_stop_queue_agg(sdata, tid);
+
+        if (WARN(!tid_tx,
+                 "TID %d gone but expected when splicing aggregates from the pending queue\n",
+                 tid))
+                return;
+
+        if (!skb_queue_empty(&tid_tx->pending)) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                /* copy over remaining packets */
+                skb_queue_splice_tail_init(&tid_tx->pending,
+                                           &local->pending[queue]);
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        }
+}
+
+static void __releases(agg_queue)
+ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
+{
+        ieee80211_wake_queue_agg(sdata, tid);
+}
+
+static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid)
+{
+        struct tid_ampdu_tx *tid_tx;
+
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+        lockdep_assert_held(&sta->lock);
+
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+
+        /*
+         * When we get here, the TX path will not be lockless any more wrt.
+         * aggregation, since the OPERATIONAL bit has long been cleared.
+         * Thus it will block on getting the lock, if it occurs. So if we
+         * stop the queue now, we will not get any more packets, and any
+         * that might be being processed will wait for us here, thereby
+         * guaranteeing that no packets go to the tid_tx pending queue any
+         * more.
+         */
+
+        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
+
+        /* future packets must not find the tid_tx struct any more */
+        ieee80211_assign_tid_tx(sta, tid, NULL);
+
+        ieee80211_agg_splice_finish(sta->sdata, tid);
+
+        kfree_rcu(tid_tx, rcu_head);
+}
+
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                    enum ieee80211_back_parties initiator,
-                                    bool tx)
+                                    enum ieee80211_agg_stop_reason reason)
 {
         struct ieee80211_local *local = sta->local;
         struct tid_ampdu_tx *tid_tx;
+        enum ieee80211_ampdu_mlme_action action;
         int ret;
 
         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 
+        switch (reason) {
+        case AGG_STOP_DECLINED:
+        case AGG_STOP_LOCAL_REQUEST:
+        case AGG_STOP_PEER_REQUEST:
+                action = IEEE80211_AMPDU_TX_STOP_CONT;
+                break;
+        case AGG_STOP_DESTROY_STA:
+                action = IEEE80211_AMPDU_TX_STOP_FLUSH;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
+
         spin_lock_bh(&sta->lock);
 
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
@@ -167,10 +284,19 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 return -ENOENT;
         }
 
-        /* if we're already stopping ignore any new requests to stop */
+        /*
+         * if we're already stopping ignore any new requests to stop
+         * unless we're destroying it in which case notify the driver
+         */
         if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 spin_unlock_bh(&sta->lock);
-                return -EALREADY;
+                if (reason != AGG_STOP_DESTROY_STA)
+                        return -EALREADY;
+                ret = drv_ampdu_action(local, sta->sdata,
+                                       IEEE80211_AMPDU_TX_STOP_FLUSH_CONT,
+                                       &sta->sta, tid, NULL, 0);
+                WARN_ON_ONCE(ret);
+                goto remove_tid_tx;
         }
 
         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
@@ -212,11 +338,12 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
          */
         synchronize_net();
 
-        tid_tx->stop_initiator = initiator;
-        tid_tx->tx_stop = tx;
+        tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ?
+                                        WLAN_BACK_RECIPIENT :
+                                        WLAN_BACK_INITIATOR;
+        tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST;
 
-        ret = drv_ampdu_action(local, sta->sdata,
-                               IEEE80211_AMPDU_TX_STOP,
+        ret = drv_ampdu_action(local, sta->sdata, action,
                                &sta->sta, tid, NULL, 0);
 
         /* HW shall not deny going back to legacy */
@@ -227,7 +354,14 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                  */
         }
 
-        return ret;
+        if (reason == AGG_STOP_DESTROY_STA) {
+ remove_tid_tx:
+                spin_lock_bh(&sta->lock);
+                ieee80211_remove_tid_tx(sta, tid);
+                spin_unlock_bh(&sta->lock);
+        }
+
+        return 0;
 }
 
 /*
@@ -264,80 +398,6 @@ static void sta_addba_resp_timer_expired(unsigned long data)
         rcu_read_unlock();
 }
 
-static inline int ieee80211_ac_from_tid(int tid)
-{
-        return ieee802_1d_to_ac[tid & 7];
-}
-
-/*
- * When multiple aggregation sessions on multiple stations
- * are being created/destroyed simultaneously, we need to
- * refcount the global queue stop caused by that in order
- * to not get into a situation where one of the aggregation
- * setup or teardown re-enables queues before the other is
- * ready to handle that.
- *
- * These two functions take care of this issue by keeping
- * a global "agg_queue_stop" refcount.
- */
-static void __acquires(agg_queue)
-ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
-{
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-
-        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
-                ieee80211_stop_queue_by_reason(
-                        &sdata->local->hw, queue,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        __acquire(agg_queue);
-}
-
-static void __releases(agg_queue)
-ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
-{
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-
-        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
-                ieee80211_wake_queue_by_reason(
-                        &sdata->local->hw, queue,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        __release(agg_queue);
-}
-
-/*
- * splice packets from the STA's pending to the local pending,
- * requires a call to ieee80211_agg_splice_finish later
- */
-static void __acquires(agg_queue)
-ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
-                             struct tid_ampdu_tx *tid_tx, u16 tid)
-{
-        struct ieee80211_local *local = sdata->local;
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-        unsigned long flags;
-
-        ieee80211_stop_queue_agg(sdata, tid);
-
-        if (WARN(!tid_tx,
-                 "TID %d gone but expected when splicing aggregates from the pending queue\n",
-                 tid))
-                return;
-
-        if (!skb_queue_empty(&tid_tx->pending)) {
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                /* copy over remaining packets */
-                skb_queue_splice_tail_init(&tid_tx->pending,
-                                           &local->pending[queue]);
-                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-        }
-}
-
-static void __releases(agg_queue)
-ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
-{
-        ieee80211_wake_queue_agg(sdata, tid);
-}
-
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 {
         struct tid_ampdu_tx *tid_tx;
@@ -660,14 +720,13 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                   enum ieee80211_back_parties initiator,
-                                   bool tx)
+                                   enum ieee80211_agg_stop_reason reason)
 {
         int ret;
 
         mutex_lock(&sta->ampdu_mlme.mtx);
 
-        ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator, tx);
+        ret = ___ieee80211_stop_tx_ba_session(sta, tid, reason);
 
         mutex_unlock(&sta->ampdu_mlme.mtx);
 
@@ -751,24 +810,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
                 ieee80211_send_delba(sta->sdata, ra, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
-        /*
-         * When we get here, the TX path will not be lockless any more wrt.
-         * aggregation, since the OPERATIONAL bit has long been cleared.
-         * Thus it will block on getting the lock, if it occurs. So if we
-         * stop the queue now, we will not get any more packets, and any
-         * that might be being processed will wait for us here, thereby
-         * guaranteeing that no packets go to the tid_tx pending queue any
-         * more.
-         */
-
-        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
-
-        /* future packets must not find the tid_tx struct any more */
-        ieee80211_assign_tid_tx(sta, tid, NULL);
-
-        ieee80211_agg_splice_finish(sta->sdata, tid);
-
-        kfree_rcu(tid_tx, rcu_head);
+        ieee80211_remove_tid_tx(sta, tid);
 
  unlock_sta:
         spin_unlock_bh(&sta->lock);
@@ -868,8 +910,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 }
 
         } else {
-                ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
-                                                false);
+                ___ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED);
         }
 
  out: