[rt2x00-users] [RFT] rt2x00: Tear down BA session on QoS frame failure

[Andreas Hartmann]

Helmut Schaa wrote:
[...]
> diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
> index 49a51b4..b57094a 100644
> --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
> +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
> @@ -280,7 +280,8 @@ void rt2x00lib_txdone(struct queue_entry *entry,
>  	u8 rate_idx, rate_flags, retry_rates;
>  	u8 skbdesc_flags = skbdesc->flags;
>  	bool success;
> -
> +	struct ieee80211_sta *sta;
> +       
>  	/*
>  	 * Unmap the skb.
>  	 */
> @@ -340,6 +341,8 @@ void rt2x00lib_txdone(struct queue_entry *entry,
>  	retry_rates = test_bit(TXDONE_FALLBACK, &txdesc->flags) ?
>  	    (txdesc->retry + 1) : 1;
>  
> +	sta = tx_info->control.sta;
> +
>  	/*
>  	 * Initialize TX status
>  	 */
> @@ -392,8 +395,21 @@ void rt2x00lib_txdone(struct queue_entry *entry,
>  		tx_info->status.ampdu_len = 1;
>  		tx_info->status.ampdu_ack_len = success ? 1 : 0;
>  
> -		if (!success)
> -			tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
> +		/*
> +		 * If an AMPDU failed, tear down the BA session
> +		 * instead of letting mac80211 send a BAR.
> +		 */
> +		struct ieee80211_hdr *hdr = (void *) skb->data;
> +		if (sta && !success &&
> +		    ieee80211_is_data_qos(hdr->frame_control)) {
> +			/*
> +			 * Tear down BA session 
> +			 */
> +			u8 *qc = ieee80211_get_qos_ctl(hdr);
> +			int tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
> +
> +			ieee80211_stop_tx_ba_session(sta, tid);

The call rcu_dereference_protected_tid_tx(sta, tid) in
ieee80211_stop_tx_ba_session(sta, tid) hangs up the machine for me.

A debug output before calling ieee80211_stop_tx_ba_session isn't shown
at all (if it's commented, tid is shown as 0).

I managed to ensure, that ieee80211_stop_tx_ba_session is only called
once - but this didn't help.


Hope this helps,
regards,
Andreas