1 files changed, 113 insertions, 119 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 1df116d4d6e7..947aaaad35d2 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -131,24 +131,6 @@ static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
-        if (local->hw.ampdu_queues) {
-                if (initiator) {
-                        /*
-                         * Stop the AC queue to avoid issues where we send
-                         * unaggregated frames already before the delba.
-                         */
-                        ieee80211_stop_queue_by_reason(&local->hw,
-                                local->hw.queues + sta->tid_to_tx_q[tid],
-                                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-                }
-
-                /*
-                 * Pretend the driver woke the queue, just in case
-                 * it disabled it before the session was stopped.
-                 */
-                ieee80211_wake_queue(
-                        &local->hw, local->hw.queues + sta->tid_to_tx_q[tid]);
-        }
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 
@@ -158,6 +140,10 @@ static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         /* HW shall not deny going back to legacy */
         if (WARN_ON(ret)) {
                 *state = HT_AGG_STATE_OPERATIONAL;
+                /*
+                 * We may have pending packets get stuck in this case...
+                 * Not bothering with a workaround for now.
+                 */
         }
 
         return ret;
@@ -212,7 +198,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata;
         u8 *state;
-        int i, qn = -1, ret = 0;
+        int ret = 0;
         u16 start_seq_num;
 
         if (WARN_ON(!local->ops->ampdu_action))
@@ -226,13 +212,6 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        if (hw->ampdu_queues && ieee80211_ac_from_tid(tid) == 0) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "rejecting on voice AC\n");
-#endif
-                return -EINVAL;
-        }
-
         rcu_read_lock();
 
         sta = sta_info_get(local, ra);
@@ -257,7 +236,17 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 goto unlock;
         }
 
+        if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Suspend in progress. "
+                       "Denying BA session request\n");
+#endif
+                ret = -EINVAL;
+                goto unlock;
+        }
+
         spin_lock_bh(&sta->lock);
+        spin_lock(&local->ampdu_lock);
 
         sdata = sta->sdata;
 
@@ -278,41 +267,16 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 goto err_unlock_sta;
         }
 
-        if (hw->ampdu_queues) {
-                spin_lock(&local->queue_stop_reason_lock);
-                /* reserve a new queue for this session */
-                for (i = 0; i < local->hw.ampdu_queues; i++) {
-                        if (local->ampdu_ac_queue[i] < 0) {
-                                qn = i;
-                                local->ampdu_ac_queue[qn] =
-                                        ieee80211_ac_from_tid(tid);
-                                break;
-                        }
-                }
-                spin_unlock(&local->queue_stop_reason_lock);
-
-                if (qn < 0) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        printk(KERN_DEBUG "BA request denied - "
-                               "queue unavailable for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                        ret = -ENOSPC;
-                        goto err_unlock_sta;
-                }
-
-                /*
-                 * If we successfully allocate the session, we can't have
-                 * anything going on on the queue this TID maps into, so
-                 * stop it for now. This is a "virtual" stop using the same
-                 * mechanism that drivers will use.
-                 *
-                 * XXX: queue up frames for this session in the sta_info
-                 *      struct instead to avoid hitting all other STAs.
-                 */
-                ieee80211_stop_queue_by_reason(
-                        &local->hw, hw->queues + qn,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        }
+        /*
+         * While we're asking the driver about the aggregation,
+         * stop the AC queue so that we don't have to worry
+         * about frames that came in while we were doing that,
+         * which would require us to put them to the AC pending
+         * afterwards which just makes the code more complex.
+         */
+        ieee80211_stop_queue_by_reason(
+                &local->hw, ieee80211_ac_from_tid(tid),
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 
         /* prepare A-MPDU MLME for Tx aggregation */
         sta->ampdu_mlme.tid_tx[tid] =
@@ -324,9 +288,11 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                                         tid);
 #endif
                 ret = -ENOMEM;
-                goto err_return_queue;
+                goto err_wake_queue;
         }
 
+        skb_queue_head_init(&sta->ampdu_mlme.tid_tx[tid]->pending);
+
         /* Tx timer */
         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
                         sta_addba_resp_timer_expired;
@@ -351,8 +317,13 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 *state = HT_AGG_STATE_IDLE;
                 goto err_free;
         }
-        sta->tid_to_tx_q[tid] = qn;
 
+        /* Driver vetoed or OKed, but we can take packets again now */
+        ieee80211_wake_queue_by_reason(
+                &local->hw, ieee80211_ac_from_tid(tid),
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+
+        spin_unlock(&local->ampdu_lock);
         spin_unlock_bh(&sta->lock);
 
         /* send an addBA request */
@@ -377,17 +348,12 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
  err_free:
         kfree(sta->ampdu_mlme.tid_tx[tid]);
         sta->ampdu_mlme.tid_tx[tid] = NULL;
- err_return_queue:
-        if (qn >= 0) {
-                /* We failed, so start queue again right away. */
-                ieee80211_wake_queue_by_reason(hw, hw->queues + qn,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-                /* give queue back to pool */
-                spin_lock(&local->queue_stop_reason_lock);
-                local->ampdu_ac_queue[qn] = -1;
-                spin_unlock(&local->queue_stop_reason_lock);
-        }
+ err_wake_queue:
+        ieee80211_wake_queue_by_reason(
+                &local->hw, ieee80211_ac_from_tid(tid),
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
  err_unlock_sta:
+        spin_unlock(&local->ampdu_lock);
         spin_unlock_bh(&sta->lock);
  unlock:
         rcu_read_unlock();
@@ -395,6 +361,67 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
 
+/*
+ * splice packets from the STA's pending to the local pending,
+ * requires a call to ieee80211_agg_splice_finish and holding
+ * local->ampdu_lock across both calls.
+ */
+static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
+                                         struct sta_info *sta, u16 tid)
+{
+        unsigned long flags;
+        u16 queue = ieee80211_ac_from_tid(tid);
+
+        ieee80211_stop_queue_by_reason(
+                &local->hw, queue,
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+
+        if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                /* mark queue as pending, it is stopped already */
+                __set_bit(IEEE80211_QUEUE_STOP_REASON_PENDING,
+                          &local->queue_stop_reasons[queue]);
+                /* copy over remaining packets */
+                skb_queue_splice_tail_init(
+                        &sta->ampdu_mlme.tid_tx[tid]->pending,
+                        &local->pending[queue]);
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        }
+}
+
+static void ieee80211_agg_splice_finish(struct ieee80211_local *local,
+                                        struct sta_info *sta, u16 tid)
+{
+        u16 queue = ieee80211_ac_from_tid(tid);
+
+        ieee80211_wake_queue_by_reason(
+                &local->hw, queue,
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+}
+
+/* caller must hold sta->lock */
+static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
+                                         struct sta_info *sta, u16 tid)
+{
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+#endif
+
+        spin_lock(&local->ampdu_lock);
+        ieee80211_agg_splice_packets(local, sta, tid);
+        /*
+         * NB: we rely on sta->lock being taken in the TX
+         * processing here when adding to the pending queue,
+         * otherwise we could only change the state of the
+         * session to OPERATIONAL _here_.
+         */
+        ieee80211_agg_splice_finish(local, sta, tid);
+        spin_unlock(&local->ampdu_lock);
+
+        local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_OPERATIONAL,
+                                 &sta->sta, tid, NULL);
+}
+
 void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 {
         struct ieee80211_local *local = hw_to_local(hw);
@@ -437,20 +464,8 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 
         *state |= HT_ADDBA_DRV_READY_MSK;
 
-        if (*state == HT_AGG_STATE_OPERATIONAL) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
-#endif
-                if (hw->ampdu_queues) {
-                        /*
-                         * Wake up this queue, we stopped it earlier,
-                         * this will in turn wake the entire AC.
-                         */
-                        ieee80211_wake_queue_by_reason(hw,
-                                hw->queues + sta->tid_to_tx_q[tid],
-                                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-                }
-        }
+        if (*state == HT_AGG_STATE_OPERATIONAL)
+                ieee80211_agg_tx_operational(local, sta, tid);
 
  out:
         spin_unlock_bh(&sta->lock);
@@ -584,22 +599,19 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
         spin_lock_bh(&sta->lock);
+        spin_lock(&local->ampdu_lock);
 
-        if (*state & HT_AGG_STATE_INITIATOR_MSK &&
-            hw->ampdu_queues) {
-                /*
-                 * Wake up this queue, we stopped it earlier,
-                 * this will in turn wake the entire AC.
-                 */
-                ieee80211_wake_queue_by_reason(hw,
-                        hw->queues + sta->tid_to_tx_q[tid],
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        }
+        ieee80211_agg_splice_packets(local, sta, tid);
 
         *state = HT_AGG_STATE_IDLE;
+        /* from now on packets are no longer put onto sta->pending */
         sta->ampdu_mlme.addba_req_num[tid] = 0;
         kfree(sta->ampdu_mlme.tid_tx[tid]);
         sta->ampdu_mlme.tid_tx[tid] = NULL;
+
+        ieee80211_agg_splice_finish(local, sta, tid);
+
+        spin_unlock(&local->ampdu_lock);
         spin_unlock_bh(&sta->lock);
 
         rcu_read_unlock();
@@ -637,9 +649,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len)
 {
-        struct ieee80211_hw *hw = &local->hw;
-        u16 capab;
-        u16 tid, start_seq_num;
+        u16 capab, tid;
         u8 *state;
 
         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
@@ -673,26 +683,10 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
                 *state |= HT_ADDBA_RECEIVED_MSK;
 
-                if (hw->ampdu_queues && *state != curstate &&
-                    *state == HT_AGG_STATE_OPERATIONAL) {
-                        /*
-                         * Wake up this queue, we stopped it earlier,
-                         * this will in turn wake the entire AC.
-                         */
-                        ieee80211_wake_queue_by_reason(hw,
-                                hw->queues + sta->tid_to_tx_q[tid],
-                                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-                }
-                sta->ampdu_mlme.addba_req_num[tid] = 0;
+                if (*state != curstate && *state == HT_AGG_STATE_OPERATIONAL)
+                        ieee80211_agg_tx_operational(local, sta, tid);
 
-                if (local->ops->ampdu_action) {
-                        (void)local->ops->ampdu_action(hw,
-                                               IEEE80211_AMPDU_TX_RESUME,
-                                               &sta->sta, tid, &start_seq_num);
-                }
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Resuming TX aggregation for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+                sta->ampdu_mlme.addba_req_num[tid] = 0;
         } else {
                 sta->ampdu_mlme.addba_req_num[tid]++;
                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);