[linux-2.6-block.git] / net / mac80211 / agg-rx.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * HT handling
 *
 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
 * Copyright(c) 2015-2017 Intel Deutschland GmbH
 * Copyright (C) 2018        Intel Corporation
 */

/**
 * DOC: RX A-MPDU aggregation
 *
 * Aggregation on the RX side requires only implementing the
 * @ampdu_action callback that is invoked to start/stop any
 * block-ack sessions for RX aggregation.
 *
 * When RX aggregation is started by the peer, the driver is
 * notified via @ampdu_action function, with the
 * %IEEE80211_AMPDU_RX_START action, and may reject the request
 * in which case a negative response is sent to the peer, if it
 * accepts it a positive response is sent.
 *
 * While the session is active, the device/driver are required
 * to de-aggregate frames and pass them up one by one to mac80211,
 * which will handle the reorder buffer.
 *
 * When the aggregation session is stopped again by the peer or
 * ourselves, the driver's @ampdu_action function will be called
 * with the action %IEEE80211_AMPDU_RX_STOP. In this case, the
 * call must not fail.
 */

#include <linux/ieee80211.h>
#include <linux/slab.h>
#include <linux/export.h>
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "driver-ops.h"

static void ieee80211_free_tid_rx(struct rcu_head *h)
{
	struct tid_ampdu_rx *tid_rx =
		container_of(h, struct tid_ampdu_rx, rcu_head);
	int i;

	for (i = 0; i < tid_rx->buf_size; i++)
		__skb_queue_purge(&tid_rx->reorder_buf[i]);
	kfree(tid_rx->reorder_buf);
	kfree(tid_rx->reorder_time);
	kfree(tid_rx);
}

void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
				     u16 initiator, u16 reason, bool tx)
{
	struct ieee80211_local *local = sta->local;
	struct tid_ampdu_rx *tid_rx;
	struct ieee80211_ampdu_params params = {
		.sta = &sta->sta,
		.action = IEEE80211_AMPDU_RX_STOP,
		.tid = tid,
		.amsdu = false,
		.timeout = 0,
		.ssn = 0,
	};

	lockdep_assert_held(&sta->ampdu_mlme.mtx);

	tid_rx = rcu_dereference_protected(sta->ampdu_mlme.tid_rx[tid],
					lockdep_is_held(&sta->ampdu_mlme.mtx));

	if (!test_bit(tid, sta->ampdu_mlme.agg_session_valid))
		return;

	RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], NULL);
	__clear_bit(tid, sta->ampdu_mlme.agg_session_valid);

	ht_dbg(sta->sdata,
	       "Rx BA session stop requested for %pM tid %u %s reason: %d\n",
	       sta->sta.addr, tid,
	       initiator == WLAN_BACK_RECIPIENT ? "recipient" : "initiator",
	       (int)reason);

	if (drv_ampdu_action(local, sta->sdata, &params))
		sdata_info(sta->sdata,
			   "HW problem - can not stop rx aggregation for %pM tid %d\n",
			   sta->sta.addr, tid);

	/* check if this is a self generated aggregation halt */
	if (initiator == WLAN_BACK_RECIPIENT && tx)
		ieee80211_send_delba(sta->sdata, sta->sta.addr,
				     tid, WLAN_BACK_RECIPIENT, reason);

	/*
	 * return here in case tid_rx is not assigned - which will happen if
	 * IEEE80211_HW_SUPPORTS_REORDERING_BUFFER is set.
	 */
	if (!tid_rx)
		return;

	del_timer_sync(&tid_rx->session_timer);

	/* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
	spin_lock_bh(&tid_rx->reorder_lock);
	tid_rx->removed = true;
	spin_unlock_bh(&tid_rx->reorder_lock);
	del_timer_sync(&tid_rx->reorder_timer);

	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
}

void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
				    u16 initiator, u16 reason, bool tx)
{
	mutex_lock(&sta->ampdu_mlme.mtx);
	___ieee80211_stop_rx_ba_session(sta, tid, initiator, reason, tx);
	mutex_unlock(&sta->ampdu_mlme.mtx);
}

void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
				  const u8 *addr)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct sta_info *sta;
	int i;

	rcu_read_lock();
	sta = sta_info_get_bss(sdata, addr);
	if (!sta) {
		rcu_read_unlock();
		return;
	}

	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
		if (ba_rx_bitmap & BIT(i))
			set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested);

	ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
	rcu_read_unlock();
}
EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);

/*
 * After accepting the AddBA Request we activated a timer,
 * resetting it after each frame that arrives from the originator.
 */
static void sta_rx_agg_session_timer_expired(struct timer_list *t)
{
	struct tid_ampdu_rx *tid_rx = from_timer(tid_rx, t, session_timer);
	struct sta_info *sta = tid_rx->sta;
	u8 tid = tid_rx->tid;
	unsigned long timeout;

	timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
	if (time_is_after_jiffies(timeout)) {
		mod_timer(&tid_rx->session_timer, timeout);
		return;
	}

	ht_dbg(sta->sdata, "RX session timer expired on %pM tid %d\n",
	       sta->sta.addr, tid);

	set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
	ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
}

static void sta_rx_agg_reorder_timer_expired(struct timer_list *t)
{
	struct tid_ampdu_rx *tid_rx = from_timer(tid_rx, t, reorder_timer);

	rcu_read_lock();
	ieee80211_release_reorder_timeout(tid_rx->sta, tid_rx->tid);
	rcu_read_unlock();
}

static void ieee80211_add_addbaext(struct ieee80211_sub_if_data *sdata,
				   struct sk_buff *skb,
				   const struct ieee80211_addba_ext_ie *req)
{
	struct ieee80211_supported_band *sband;
	struct ieee80211_addba_ext_ie *resp;
	const struct ieee80211_sta_he_cap *he_cap;
	u8 frag_level, cap_frag_level;
	u8 *pos;

	sband = ieee80211_get_sband(sdata);
	if (!sband)
		return;
	he_cap = ieee80211_get_he_iftype_cap(sband, sdata->vif.type);
	if (!he_cap)
		return;

	pos = skb_put_zero(skb, 2 + sizeof(struct ieee80211_addba_ext_ie));
	*pos++ = WLAN_EID_ADDBA_EXT;
	*pos++ = sizeof(struct ieee80211_addba_ext_ie);
	resp = (struct ieee80211_addba_ext_ie *)pos;
	resp->data = req->data & IEEE80211_ADDBA_EXT_NO_FRAG;

	frag_level = u32_get_bits(req->data,
				  IEEE80211_ADDBA_EXT_FRAG_LEVEL_MASK);
	cap_frag_level = u32_get_bits(he_cap->he_cap_elem.mac_cap_info[0],
				      IEEE80211_HE_MAC_CAP0_DYNAMIC_FRAG_MASK);
	if (frag_level > cap_frag_level)
		frag_level = cap_frag_level;
	resp->data |= u8_encode_bits(frag_level,
				     IEEE80211_ADDBA_EXT_FRAG_LEVEL_MASK);
}

static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
				      u8 dialog_token, u16 status, u16 policy,
				      u16 buf_size, u16 timeout,
				      const struct ieee80211_addba_ext_ie *addbaext)
{
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	bool amsdu = ieee80211_hw_check(&local->hw, SUPPORTS_AMSDU_IN_AMPDU);
	u16 capab;

	skb = dev_alloc_skb(sizeof(*mgmt) +
		    2 + sizeof(struct ieee80211_addba_ext_ie) +
		    local->hw.extra_tx_headroom);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
	mgmt = skb_put_zero(skb, 24);
	memcpy(mgmt->da, da, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	if (sdata->vif.type == NL80211_IFTYPE_AP ||
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
	    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
		memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
	else if (sdata->vif.type == NL80211_IFTYPE_STATION)
		memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
	else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
		memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);

	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);

	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
	mgmt->u.action.category = WLAN_CATEGORY_BACK;
	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;

	capab = (u16)(amsdu << 0);	/* bit 0 A-MSDU support */
	capab |= (u16)(policy << 1);	/* bit 1 aggregation policy */
	capab |= (u16)(tid << 2); 	/* bit 5:2 TID number */
	capab |= (u16)(buf_size << 6);	/* bit 15:6 max size of aggregation */

	mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
	mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
	mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);

	if (sta->sta.he_cap.has_he && addbaext)
		ieee80211_add_addbaext(sdata, skb, addbaext);

	ieee80211_tx_skb(sdata, skb);
}

void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
				      u8 dialog_token, u16 timeout,
				      u16 start_seq_num, u16 ba_policy, u16 tid,
				      u16 buf_size, bool tx, bool auto_seq,
				      const struct ieee80211_addba_ext_ie *addbaext)
{
	struct ieee80211_local *local = sta->sdata->local;
	struct tid_ampdu_rx *tid_agg_rx;
	struct ieee80211_ampdu_params params = {
		.sta = &sta->sta,
		.action = IEEE80211_AMPDU_RX_START,
		.tid = tid,
		.amsdu = false,
		.timeout = timeout,
		.ssn = start_seq_num,
	};
	int i, ret = -EOPNOTSUPP;
	u16 status = WLAN_STATUS_REQUEST_DECLINED;
	u16 max_buf_size;

	if (tid >= IEEE80211_FIRST_TSPEC_TSID) {
		ht_dbg(sta->sdata,
		       "STA %pM requests BA session on unsupported tid %d\n",
		       sta->sta.addr, tid);
		goto end;
	}

	if (!sta->sta.ht_cap.ht_supported) {
		ht_dbg(sta->sdata,
		       "STA %pM erroneously requests BA session on tid %d w/o QoS\n",
		       sta->sta.addr, tid);
		/* send a response anyway, it's an error case if we get here */
		goto end;
	}

	if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
		ht_dbg(sta->sdata,
		       "Suspend in progress - Denying ADDBA request (%pM tid %d)\n",
		       sta->sta.addr, tid);
		goto end;
	}

	if (sta->sta.he_cap.has_he)
		max_buf_size = IEEE80211_MAX_AMPDU_BUF;
	else
		max_buf_size = IEEE80211_MAX_AMPDU_BUF_HT;

	/* sanity check for incoming parameters:
	 * check if configuration can support the BA policy
	 * and if buffer size does not exceeds max value */
	/* XXX: check own ht delayed BA capability?? */
	if (((ba_policy != 1) &&
	     (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA))) ||
	    (buf_size > max_buf_size)) {
		status = WLAN_STATUS_INVALID_QOS_PARAM;
		ht_dbg_ratelimited(sta->sdata,
				   "AddBA Req with bad params from %pM on tid %u. policy %d, buffer size %d\n",
				   sta->sta.addr, tid, ba_policy, buf_size);
		goto end;
	}
	/* determine default buffer size */
	if (buf_size == 0)
		buf_size = max_buf_size;

	/* make sure the size doesn't exceed the maximum supported by the hw */
	if (buf_size > sta->sta.max_rx_aggregation_subframes)
		buf_size = sta->sta.max_rx_aggregation_subframes;
	params.buf_size = buf_size;

	ht_dbg(sta->sdata, "AddBA Req buf_size=%d for %pM\n",
	       buf_size, sta->sta.addr);

	/* examine state machine */
	lockdep_assert_held(&sta->ampdu_mlme.mtx);

	if (test_bit(tid, sta->ampdu_mlme.agg_session_valid)) {
		if (sta->ampdu_mlme.tid_rx_token[tid] == dialog_token) {
			struct tid_ampdu_rx *tid_rx;

			ht_dbg_ratelimited(sta->sdata,
					   "updated AddBA Req from %pM on tid %u\n",
					   sta->sta.addr, tid);
			/* We have no API to update the timeout value in the
			 * driver so reject the timeout update if the timeout
			 * changed. If if did not change, i.e., no real update,
			 * just reply with success.
			 */
			rcu_read_lock();
			tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
			if (tid_rx && tid_rx->timeout == timeout)
				status = WLAN_STATUS_SUCCESS;
			else
				status = WLAN_STATUS_REQUEST_DECLINED;
			rcu_read_unlock();
			goto end;
		}

		ht_dbg_ratelimited(sta->sdata,
				   "unexpected AddBA Req from %pM on tid %u\n",
				   sta->sta.addr, tid);

		/* delete existing Rx BA session on the same tid */
		___ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
						WLAN_STATUS_UNSPECIFIED_QOS,
						false);
	}

	if (ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) {
		ret = drv_ampdu_action(local, sta->sdata, &params);
		ht_dbg(sta->sdata,
		       "Rx A-MPDU request on %pM tid %d result %d\n",
		       sta->sta.addr, tid, ret);
		if (!ret)
			status = WLAN_STATUS_SUCCESS;
		goto end;
	}

	/* prepare A-MPDU MLME for Rx aggregation */
	tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL);
	if (!tid_agg_rx)
		goto end;

	spin_lock_init(&tid_agg_rx->reorder_lock);

	/* rx timer */
	timer_setup(&tid_agg_rx->session_timer,
		    sta_rx_agg_session_timer_expired, TIMER_DEFERRABLE);

	/* rx reorder timer */
	timer_setup(&tid_agg_rx->reorder_timer,
		    sta_rx_agg_reorder_timer_expired, 0);

	/* prepare reordering buffer */
	tid_agg_rx->reorder_buf =
		kcalloc(buf_size, sizeof(struct sk_buff_head), GFP_KERNEL);
	tid_agg_rx->reorder_time =
		kcalloc(buf_size, sizeof(unsigned long), GFP_KERNEL);
	if (!tid_agg_rx->reorder_buf || !tid_agg_rx->reorder_time) {
		kfree(tid_agg_rx->reorder_buf);
		kfree(tid_agg_rx->reorder_time);
		kfree(tid_agg_rx);
		goto end;
	}

	for (i = 0; i < buf_size; i++)
		__skb_queue_head_init(&tid_agg_rx->reorder_buf[i]);

	ret = drv_ampdu_action(local, sta->sdata, &params);
	ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n",
	       sta->sta.addr, tid, ret);
	if (ret) {
		kfree(tid_agg_rx->reorder_buf);
		kfree(tid_agg_rx->reorder_time);
		kfree(tid_agg_rx);
		goto end;
	}

	/* update data */
	tid_agg_rx->ssn = start_seq_num;
	tid_agg_rx->head_seq_num = start_seq_num;
	tid_agg_rx->buf_size = buf_size;
	tid_agg_rx->timeout = timeout;
	tid_agg_rx->stored_mpdu_num = 0;
	tid_agg_rx->auto_seq = auto_seq;
	tid_agg_rx->started = false;
	tid_agg_rx->reorder_buf_filtered = 0;
	tid_agg_rx->tid = tid;
	tid_agg_rx->sta = sta;
	status = WLAN_STATUS_SUCCESS;

	/* activate it for RX */
	rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);

	if (timeout) {
		mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
		tid_agg_rx->last_rx = jiffies;
	}

end:
	if (status == WLAN_STATUS_SUCCESS) {
		__set_bit(tid, sta->ampdu_mlme.agg_session_valid);
		__clear_bit(tid, sta->ampdu_mlme.unexpected_agg);
		sta->ampdu_mlme.tid_rx_token[tid] = dialog_token;
	}

	if (tx)
		ieee80211_send_addba_resp(sta, sta->sta.addr, tid,
					  dialog_token, status, 1, buf_size,
					  timeout, addbaext);
}

static void __ieee80211_start_rx_ba_session(struct sta_info *sta,
					    u8 dialog_token, u16 timeout,
					    u16 start_seq_num, u16 ba_policy,
					    u16 tid, u16 buf_size, bool tx,
					    bool auto_seq,
					    const struct ieee80211_addba_ext_ie *addbaext)
{
	mutex_lock(&sta->ampdu_mlme.mtx);
	___ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
					 start_seq_num, ba_policy, tid,
					 buf_size, tx, auto_seq, addbaext);
	mutex_unlock(&sta->ampdu_mlme.mtx);
}

void ieee80211_process_addba_request(struct ieee80211_local *local,
				     struct sta_info *sta,
				     struct ieee80211_mgmt *mgmt,
				     size_t len)
{
	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num;
	struct ieee802_11_elems elems = { 0 };
	u8 dialog_token;
	int ies_len;

	/* extract session parameters from addba request frame */
	dialog_token = mgmt->u.action.u.addba_req.dialog_token;
	timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
	start_seq_num =
		le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;

	capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
	ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;

	ies_len = len - offsetof(struct ieee80211_mgmt,
				 u.action.u.addba_req.variable);
	if (ies_len) {
		ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
                                ies_len, true, &elems, mgmt->bssid, NULL);
		if (elems.parse_error)
			return;
	}

	__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
					start_seq_num, ba_policy, tid,
					buf_size, true, false,
					elems.addba_ext_ie);
}

void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
				 const u8 *addr, unsigned int tid)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_local *local = sdata->local;
	struct sta_info *sta;

	rcu_read_lock();
	sta = sta_info_get_bss(sdata, addr);
	if (!sta)
		goto unlock;

	set_bit(tid, sta->ampdu_mlme.tid_rx_manage_offl);
	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
 unlock:
	rcu_read_unlock();
}
EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);

void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
				   const u8 *addr, unsigned int tid)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_local *local = sdata->local;
	struct sta_info *sta;

	rcu_read_lock();
	sta = sta_info_get_bss(sdata, addr);
	if (!sta)
		goto unlock;

	set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);

 unlock:
	rcu_read_unlock();
}
EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
b8695a8f JB	2	/*
	3	* HT handling
	4	*
	5	* Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
	6	* Copyright 2002-2005, Instant802 Networks, Inc.
	7	* Copyright 2005-2006, Devicescape Software, Inc.
	8	* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
	9	* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
a93e3644	10	* Copyright 2007-2010, Intel Corporation
04c2cf34	11	* Copyright(c) 2015-2017 Intel Deutschland GmbH
3b070297	12	* Copyright (C) 2018 Intel Corporation
b8695a8f JB	13	*/
b8695a8f JB	14
73a72a81 JB	15	/**
	16	* DOC: RX A-MPDU aggregation
	17	*
	18	* Aggregation on the RX side requires only implementing the
	19	* @ampdu_action callback that is invoked to start/stop any
	20	* block-ack sessions for RX aggregation.
	21	*
	22	* When RX aggregation is started by the peer, the driver is
	23	* notified via @ampdu_action function, with the
	24	* %IEEE80211_AMPDU_RX_START action, and may reject the request
	25	* in which case a negative response is sent to the peer, if it
	26	* accepts it a positive response is sent.
	27	*
	28	* While the session is active, the device/driver are required
	29	* to de-aggregate frames and pass them up one by one to mac80211,
	30	* which will handle the reorder buffer.
	31	*
	32	* When the aggregation session is stopped again by the peer or
	33	* ourselves, the driver's @ampdu_action function will be called
	34	* with the action %IEEE80211_AMPDU_RX_STOP. In this case, the
	35	* call must not fail.
	36	*/
	37
b8695a8f	38	#include <linux/ieee80211.h>
5a0e3ad6	39	#include <linux/slab.h>
bc3b2d7f	40	#include <linux/export.h>
b8695a8f JB	41	#include <net/mac80211.h>
b8695a8f JB	42	#include "ieee80211_i.h"
24487981	43	#include "driver-ops.h"
b8695a8f	44
a87f736d JB	45	static void ieee80211_free_tid_rx(struct rcu_head *h)
	46	{
	47	struct tid_ampdu_rx *tid_rx =
	48	container_of(h, struct tid_ampdu_rx, rcu_head);
	49	int i;
	50
	51	for (i = 0; i < tid_rx->buf_size; i++)
83eb935e	52	__skb_queue_purge(&tid_rx->reorder_buf[i]);
a87f736d JB	53	kfree(tid_rx->reorder_buf);
	54	kfree(tid_rx->reorder_time);
	55	kfree(tid_rx);
	56	}
	57
7c3b1dd8	58	void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
53f73c09	59	u16 initiator, u16 reason, bool tx)
b8695a8f	60	{
d75636ef	61	struct ieee80211_local *local = sta->local;
098a6070	62	struct tid_ampdu_rx *tid_rx;
50ea05ef SS	63	struct ieee80211_ampdu_params params = {
	64	.sta = &sta->sta,
	65	.action = IEEE80211_AMPDU_RX_STOP,
	66	.tid = tid,
	67	.amsdu = false,
	68	.timeout = 0,
	69	.ssn = 0,
	70	};
b8695a8f	71
a93e3644	72	lockdep_assert_held(&sta->ampdu_mlme.mtx);
098a6070	73
40b275b6 JB	74	tid_rx = rcu_dereference_protected(sta->ampdu_mlme.tid_rx[tid],
40b275b6 JB	75	lockdep_is_held(&sta->ampdu_mlme.mtx));
a87f736d	76
412a6d80	77	if (!test_bit(tid, sta->ampdu_mlme.agg_session_valid))
b8695a8f	78	return;
d75636ef	79
a9b3cd7f	80	RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], NULL);
412a6d80	81	__clear_bit(tid, sta->ampdu_mlme.agg_session_valid);
b8695a8f	82
bdcbd8e0 JB	83	ht_dbg(sta->sdata,
	84	"Rx BA session stop requested for %pM tid %u %s reason: %d\n",
	85	sta->sta.addr, tid,
09e0a2fe	86	initiator == WLAN_BACK_RECIPIENT ? "recipient" : "initiator",
bdcbd8e0	87	(int)reason);
b8695a8f	88
50ea05ef	89	if (drv_ampdu_action(local, sta->sdata, &params))
bdcbd8e0	90	sdata_info(sta->sdata,
0a214d3f JB	91	"HW problem - can not stop rx aggregation for %pM tid %d\n",
0a214d3f JB	92	sta->sta.addr, tid);
b8695a8f	93
b8695a8f	94	/* check if this is a self generated aggregation halt */
53f73c09	95	if (initiator == WLAN_BACK_RECIPIENT && tx)
d75636ef	96	ieee80211_send_delba(sta->sdata, sta->sta.addr,
a7f39f60	97	tid, WLAN_BACK_RECIPIENT, reason);
b8695a8f	98
412a6d80 SS	99	/*
	100	* return here in case tid_rx is not assigned - which will happen if
	101	* IEEE80211_HW_SUPPORTS_REORDERING_BUFFER is set.
	102	*/
	103	if (!tid_rx)
	104	return;
	105
7c3b1dd8	106	del_timer_sync(&tid_rx->session_timer);
a87f736d	107
788211d8 JB	108	/* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
	109	spin_lock_bh(&tid_rx->reorder_lock);
	110	tid_rx->removed = true;
	111	spin_unlock_bh(&tid_rx->reorder_lock);
	112	del_timer_sync(&tid_rx->reorder_timer);
	113
a87f736d	114	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
b8695a8f JB	115	}
b8695a8f JB	116
2aab4c27	117	void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
53f73c09	118	u16 initiator, u16 reason, bool tx)
2aab4c27	119	{
a93e3644	120	mutex_lock(&sta->ampdu_mlme.mtx);
53f73c09	121	___ieee80211_stop_rx_ba_session(sta, tid, initiator, reason, tx);
a93e3644	122	mutex_unlock(&sta->ampdu_mlme.mtx);
2aab4c27 JB	123	}
2aab4c27 JB	124
f41ccd71 SL	125	void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
	126	const u8 *addr)
	127	{
	128	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
0a557ed3	129	struct sta_info *sta;
f41ccd71 SL	130	int i;
f41ccd71 SL	131
0a557ed3	132	rcu_read_lock();
bc192f89	133	sta = sta_info_get_bss(sdata, addr);
0a557ed3 EP	134	if (!sta) {
	135	rcu_read_unlock();
	136	return;
	137	}
	138
5a306f58	139	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
f41ccd71 SL	140	if (ba_rx_bitmap & BIT(i))
	141	set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested);
	142
	143	ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
0a557ed3	144	rcu_read_unlock();
f41ccd71 SL	145	}
	146	EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);
	147
b8695a8f JB	148	/*
	149	* After accepting the AddBA Request we activated a timer,
	150	* resetting it after each frame that arrives from the originator.
b8695a8f	151	*/
7cca2acd	152	static void sta_rx_agg_session_timer_expired(struct timer_list *t)
b8695a8f	153	{
d559e303 JB	154	struct tid_ampdu_rx *tid_rx = from_timer(tid_rx, t, session_timer);
	155	struct sta_info *sta = tid_rx->sta;
	156	u8 tid = tid_rx->tid;
12d3952f FF	157	unsigned long timeout;
12d3952f FF	158
12d3952f FF	159	timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
	160	if (time_is_after_jiffies(timeout)) {
	161	mod_timer(&tid_rx->session_timer, timeout);
	162	return;
	163	}
b8695a8f	164
0a214d3f	165	ht_dbg(sta->sdata, "RX session timer expired on %pM tid %d\n",
7cca2acd	166	sta->sta.addr, tid);
d63e9ae3	167
7cca2acd	168	set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
7c3b1dd8	169	ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
b8695a8f JB	170	}
b8695a8f JB	171
7cca2acd	172	static void sta_rx_agg_reorder_timer_expired(struct timer_list *t)
2bff8ebf	173	{
7cca2acd	174	struct tid_ampdu_rx *tid_rx = from_timer(tid_rx, t, reorder_timer);
2bff8ebf CL	175
2bff8ebf CL	176	rcu_read_lock();
7cca2acd	177	ieee80211_release_reorder_timeout(tid_rx->sta, tid_rx->tid);
2bff8ebf CL	178	rcu_read_unlock();
	179	}
	180
2ab45876 JC	181	static void ieee80211_add_addbaext(struct ieee80211_sub_if_data *sdata,
	182	struct sk_buff *skb,
	183	const struct ieee80211_addba_ext_ie *req)
	184	{
	185	struct ieee80211_supported_band *sband;
	186	struct ieee80211_addba_ext_ie *resp;
	187	const struct ieee80211_sta_he_cap *he_cap;
	188	u8 frag_level, cap_frag_level;
	189	u8 *pos;
	190
	191	sband = ieee80211_get_sband(sdata);
f12cac53 CIK	192	if (!sband)
f12cac53 CIK	193	return;
2ab45876 JC	194	he_cap = ieee80211_get_he_iftype_cap(sband, sdata->vif.type);
	195	if (!he_cap)
	196	return;
	197
	198	pos = skb_put_zero(skb, 2 + sizeof(struct ieee80211_addba_ext_ie));
	199	*pos++ = WLAN_EID_ADDBA_EXT;
	200	*pos++ = sizeof(struct ieee80211_addba_ext_ie);
	201	resp = (struct ieee80211_addba_ext_ie *)pos;
	202	resp->data = req->data & IEEE80211_ADDBA_EXT_NO_FRAG;
	203
	204	frag_level = u32_get_bits(req->data,
	205	IEEE80211_ADDBA_EXT_FRAG_LEVEL_MASK);
	206	cap_frag_level = u32_get_bits(he_cap->he_cap_elem.mac_cap_info[0],
	207	IEEE80211_HE_MAC_CAP0_DYNAMIC_FRAG_MASK);
	208	if (frag_level > cap_frag_level)
	209	frag_level = cap_frag_level;
	210	resp->data \|= u8_encode_bits(frag_level,
	211	IEEE80211_ADDBA_EXT_FRAG_LEVEL_MASK);
	212	}
	213
	214	static void ieee80211_send_addba_resp(struct sta_info sta, u8 da, u16 tid,
b8695a8f	215	u8 dialog_token, u16 status, u16 policy,
2ab45876 JC	216	u16 buf_size, u16 timeout,
2ab45876 JC	217	const struct ieee80211_addba_ext_ie *addbaext)
b8695a8f	218	{
2ab45876	219	struct ieee80211_sub_if_data *sdata = sta->sdata;
b8695a8f JB	220	struct ieee80211_local *local = sdata->local;
	221	struct sk_buff *skb;
	222	struct ieee80211_mgmt *mgmt;
99e7ca44	223	bool amsdu = ieee80211_hw_check(&local->hw, SUPPORTS_AMSDU_IN_AMPDU);
b8695a8f JB	224	u16 capab;
b8695a8f JB	225
2ab45876 JC	226	skb = dev_alloc_skb(sizeof(*mgmt) +
	227	2 + sizeof(struct ieee80211_addba_ext_ie) +
	228	local->hw.extra_tx_headroom);
d15b8459	229	if (!skb)
b8695a8f	230	return;
b8695a8f JB	231
b8695a8f JB	232	skb_reserve(skb, local->hw.extra_tx_headroom);
b080db58	233	mgmt = skb_put_zero(skb, 24);
b8695a8f	234	memcpy(mgmt->da, da, ETH_ALEN);
47846c9b	235	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
8abd3f9b	236	if (sdata->vif.type == NL80211_IFTYPE_AP \|\|
ae2772b3 TP	237	sdata->vif.type == NL80211_IFTYPE_AP_VLAN \|\|
ae2772b3 TP	238	sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
47846c9b	239	memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
46900298 JB	240	else if (sdata->vif.type == NL80211_IFTYPE_STATION)
46900298 JB	241	memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
13c40c54 AS	242	else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
13c40c54 AS	243	memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
46900298	244
b8695a8f JB	245	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT \|
	246	IEEE80211_STYPE_ACTION);
	247
	248	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
	249	mgmt->u.action.category = WLAN_CATEGORY_BACK;
	250	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
	251	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
	252
99e7ca44 EG	253	capab = (u16)(amsdu << 0); /* bit 0 A-MSDU support */
99e7ca44 EG	254	capab \|= (u16)(policy << 1); /* bit 1 aggregation policy */
b8695a8f JB	255	capab \|= (u16)(tid << 2); /* bit 5:2 TID number */
	256	capab \|= (u16)(buf_size << 6); /* bit 15:6 max size of aggregation */
	257
	258	mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
	259	mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
	260	mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
	261
2ab45876 JC	262	if (sta->sta.he_cap.has_he && addbaext)
	263	ieee80211_add_addbaext(sdata, skb, addbaext);
	264
62ae67be	265	ieee80211_tx_skb(sdata, skb);
b8695a8f JB	266	}
b8695a8f JB	267
bde59c47 JB	268	void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
	269	u8 dialog_token, u16 timeout,
	270	u16 start_seq_num, u16 ba_policy, u16 tid,
2ab45876 JC	271	u16 buf_size, bool tx, bool auto_seq,
2ab45876 JC	272	const struct ieee80211_addba_ext_ie *addbaext)
b8695a8f	273	{
08cf42e8	274	struct ieee80211_local *local = sta->sdata->local;
b8695a8f	275	struct tid_ampdu_rx *tid_agg_rx;
50ea05ef SS	276	struct ieee80211_ampdu_params params = {
	277	.sta = &sta->sta,
	278	.action = IEEE80211_AMPDU_RX_START,
	279	.tid = tid,
	280	.amsdu = false,
	281	.timeout = timeout,
	282	.ssn = start_seq_num,
	283	};
83eb935e	284	int i, ret = -EOPNOTSUPP;
08cf42e8	285	u16 status = WLAN_STATUS_REQUEST_DECLINED;
41cbb0f5	286	u16 max_buf_size;
b8695a8f	287
85d5313e JB	288	if (tid >= IEEE80211_FIRST_TSPEC_TSID) {
	289	ht_dbg(sta->sdata,
	290	"STA %pM requests BA session on unsupported tid %d\n",
	291	sta->sta.addr, tid);
bde59c47	292	goto end;
85d5313e JB	293	}
85d5313e JB	294
8f9c77fc JB	295	if (!sta->sta.ht_cap.ht_supported) {
	296	ht_dbg(sta->sdata,
	297	"STA %pM erroneously requests BA session on tid %d w/o QoS\n",
	298	sta->sta.addr, tid);
	299	/* send a response anyway, it's an error case if we get here */
bde59c47	300	goto end;
8f9c77fc JB	301	}
8f9c77fc JB	302
c2c98fde	303	if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
0a214d3f JB	304	ht_dbg(sta->sdata,
	305	"Suspend in progress - Denying ADDBA request (%pM tid %d)\n",
	306	sta->sta.addr, tid);
bde59c47	307	goto end;
722f069a S	308	}
722f069a S	309
41cbb0f5 LC	310	if (sta->sta.he_cap.has_he)
	311	max_buf_size = IEEE80211_MAX_AMPDU_BUF;
	312	else
	313	max_buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
	314
b8695a8f JB	315	/* sanity check for incoming parameters:
	316	* check if configuration can support the BA policy
	317	* and if buffer size does not exceeds max value */
	318	/* XXX: check own ht delayed BA capability?? */
f64f9e71 JP	319	if (((ba_policy != 1) &&
f64f9e71 JP	320	(!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA))) \|\|
41cbb0f5	321	(buf_size > max_buf_size)) {
b8695a8f	322	status = WLAN_STATUS_INVALID_QOS_PARAM;
bdcbd8e0 JB	323	ht_dbg_ratelimited(sta->sdata,
bdcbd8e0 JB	324	"AddBA Req with bad params from %pM on tid %u. policy %d, buffer size %d\n",
08cf42e8	325	sta->sta.addr, tid, ba_policy, buf_size);
bde59c47	326	goto end;
b8695a8f JB	327	}
b8695a8f JB	328	/* determine default buffer size */
82694f76	329	if (buf_size == 0)
41cbb0f5	330	buf_size = max_buf_size;
b8695a8f	331
df6ba5d8	332	/* make sure the size doesn't exceed the maximum supported by the hw */
480dd46b MA	333	if (buf_size > sta->sta.max_rx_aggregation_subframes)
480dd46b MA	334	buf_size = sta->sta.max_rx_aggregation_subframes;
50ea05ef	335	params.buf_size = buf_size;
b8695a8f	336
480dd46b MA	337	ht_dbg(sta->sdata, "AddBA Req buf_size=%d for %pM\n",
	338	buf_size, sta->sta.addr);
	339
b8695a8f	340	/* examine state machine */
bde59c47	341	lockdep_assert_held(&sta->ampdu_mlme.mtx);
b8695a8f	342
412a6d80	343	if (test_bit(tid, sta->ampdu_mlme.agg_session_valid)) {
1c3d185a	344	if (sta->ampdu_mlme.tid_rx_token[tid] == dialog_token) {
21b7022f IP	345	struct tid_ampdu_rx *tid_rx;
21b7022f IP	346
f89e07d4 JB	347	ht_dbg_ratelimited(sta->sdata,
	348	"updated AddBA Req from %pM on tid %u\n",
	349	sta->sta.addr, tid);
	350	/* We have no API to update the timeout value in the
21b7022f IP	351	* driver so reject the timeout update if the timeout
	352	* changed. If if did not change, i.e., no real update,
	353	* just reply with success.
f89e07d4	354	*/
21b7022f IP	355	rcu_read_lock();
	356	tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	357	if (tid_rx && tid_rx->timeout == timeout)
	358	status = WLAN_STATUS_SUCCESS;
	359	else
	360	status = WLAN_STATUS_REQUEST_DECLINED;
	361	rcu_read_unlock();
f89e07d4 JB	362	goto end;
	363	}
	364
bdcbd8e0 JB	365	ht_dbg_ratelimited(sta->sdata,
bdcbd8e0 JB	366	"unexpected AddBA Req from %pM on tid %u\n",
08cf42e8	367	sta->sta.addr, tid);
15b4d843 AN	368
	369	/* delete existing Rx BA session on the same tid */
	370	___ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
	371	WLAN_STATUS_UNSPECIFIED_QOS,
	372	false);
b8695a8f JB	373	}
b8695a8f JB	374
412a6d80 SS	375	if (ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) {
	376	ret = drv_ampdu_action(local, sta->sdata, &params);
	377	ht_dbg(sta->sdata,
	378	"Rx A-MPDU request on %pM tid %d result %d\n",
	379	sta->sta.addr, tid, ret);
	380	if (!ret)
	381	status = WLAN_STATUS_SUCCESS;
	382	goto end;
	383	}
	384
b8695a8f	385	/* prepare A-MPDU MLME for Rx aggregation */
f39ea269	386	tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL);
d15b8459	387	if (!tid_agg_rx)
b8695a8f	388	goto end;
b8695a8f	389
2bff8ebf CL	390	spin_lock_init(&tid_agg_rx->reorder_lock);
2bff8ebf CL	391
a87f736d	392	/* rx timer */
7cca2acd KC	393	timer_setup(&tid_agg_rx->session_timer,
7cca2acd KC	394	sta_rx_agg_session_timer_expired, TIMER_DEFERRABLE);
b8695a8f	395
2bff8ebf	396	/* rx reorder timer */
7cca2acd KC	397	timer_setup(&tid_agg_rx->reorder_timer,
7cca2acd KC	398	sta_rx_agg_reorder_timer_expired, 0);
2bff8ebf	399
b8695a8f JB	400	/* prepare reordering buffer */
b8695a8f JB	401	tid_agg_rx->reorder_buf =
83eb935e	402	kcalloc(buf_size, sizeof(struct sk_buff_head), GFP_KERNEL);
4d050f1d	403	tid_agg_rx->reorder_time =
dd318575	404	kcalloc(buf_size, sizeof(unsigned long), GFP_KERNEL);
4d050f1d	405	if (!tid_agg_rx->reorder_buf \|\| !tid_agg_rx->reorder_time) {
4d050f1d JM	406	kfree(tid_agg_rx->reorder_buf);
4d050f1d JM	407	kfree(tid_agg_rx->reorder_time);
a87f736d	408	kfree(tid_agg_rx);
b8695a8f JB	409	goto end;
	410	}
	411
83eb935e MK	412	for (i = 0; i < buf_size; i++)
	413	__skb_queue_head_init(&tid_agg_rx->reorder_buf[i]);
	414
50ea05ef	415	ret = drv_ampdu_action(local, sta->sdata, &params);
0a214d3f JB	416	ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n",
0a214d3f JB	417	sta->sta.addr, tid, ret);
b8695a8f JB	418	if (ret) {
b8695a8f JB	419	kfree(tid_agg_rx->reorder_buf);
a87f736d	420	kfree(tid_agg_rx->reorder_time);
b8695a8f	421	kfree(tid_agg_rx);
b8695a8f JB	422	goto end;
	423	}
	424
a87f736d	425	/* update data */
b8695a8f JB	426	tid_agg_rx->ssn = start_seq_num;
	427	tid_agg_rx->head_seq_num = start_seq_num;
	428	tid_agg_rx->buf_size = buf_size;
	429	tid_agg_rx->timeout = timeout;
	430	tid_agg_rx->stored_mpdu_num = 0;
4549cf2b	431	tid_agg_rx->auto_seq = auto_seq;
b7540d8f	432	tid_agg_rx->started = false;
06470f74	433	tid_agg_rx->reorder_buf_filtered = 0;
7cca2acd KC	434	tid_agg_rx->tid = tid;
7cca2acd KC	435	tid_agg_rx->sta = sta;
b8695a8f	436	status = WLAN_STATUS_SUCCESS;
a87f736d JB	437
a87f736d JB	438	/* activate it for RX */
cf778b00	439	rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
f955ebb4	440
12d3952f	441	if (timeout) {
f955ebb4	442	mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
12d3952f FF	443	tid_agg_rx->last_rx = jiffies;
12d3952f FF	444	}
f955ebb4	445
b8695a8f	446	end:
bfe40fa3	447	if (status == WLAN_STATUS_SUCCESS) {
412a6d80	448	__set_bit(tid, sta->ampdu_mlme.agg_session_valid);
bfe40fa3	449	__clear_bit(tid, sta->ampdu_mlme.unexpected_agg);
1c3d185a	450	sta->ampdu_mlme.tid_rx_token[tid] = dialog_token;
bfe40fa3	451	}
b8695a8f	452
08cf42e8	453	if (tx)
2ab45876	454	ieee80211_send_addba_resp(sta, sta->sta.addr, tid,
08cf42e8	455	dialog_token, status, 1, buf_size,
2ab45876	456	timeout, addbaext);
08cf42e8 MK	457	}
08cf42e8 MK	458
a9d09bc1 JB	459	static void __ieee80211_start_rx_ba_session(struct sta_info *sta,
	460	u8 dialog_token, u16 timeout,
	461	u16 start_seq_num, u16 ba_policy,
	462	u16 tid, u16 buf_size, bool tx,
2ab45876 JC	463	bool auto_seq,
2ab45876 JC	464	const struct ieee80211_addba_ext_ie *addbaext)
bde59c47 JB	465	{
	466	mutex_lock(&sta->ampdu_mlme.mtx);
	467	___ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
	468	start_seq_num, ba_policy, tid,
2ab45876	469	buf_size, tx, auto_seq, addbaext);
bde59c47 JB	470	mutex_unlock(&sta->ampdu_mlme.mtx);
	471	}
	472
08cf42e8 MK	473	void ieee80211_process_addba_request(struct ieee80211_local *local,
	474	struct sta_info *sta,
	475	struct ieee80211_mgmt *mgmt,
	476	size_t len)
	477	{
	478	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num;
2ab45876	479	struct ieee802_11_elems elems = { 0 };
08cf42e8	480	u8 dialog_token;
2ab45876	481	int ies_len;
08cf42e8 MK	482
	483	/* extract session parameters from addba request frame */
	484	dialog_token = mgmt->u.action.u.addba_req.dialog_token;
	485	timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
	486	start_seq_num =
	487	le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
	488
	489	capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
	490	ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
	491	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
	492	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
	493
2ab45876 JC	494	ies_len = len - offsetof(struct ieee80211_mgmt,
	495	u.action.u.addba_req.variable);
	496	if (ies_len) {
	497	ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
	498	ies_len, true, &elems, mgmt->bssid, NULL);
	499	if (elems.parse_error)
	500	return;
	501	}
	502
08cf42e8 MK	503	__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
08cf42e8 MK	504	start_seq_num, ba_policy, tid,
2ab45876 JC	505	buf_size, true, false,
2ab45876 JC	506	elems.addba_ext_ie);
08cf42e8 MK	507	}
08cf42e8 MK	508
699cb58c	509	void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
1272c5d8	510	const u8 *addr, unsigned int tid)
08cf42e8 MK	511	{
	512	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	513	struct ieee80211_local *local = sdata->local;
699cb58c	514	struct sta_info *sta;
08cf42e8	515
699cb58c JB	516	rcu_read_lock();
	517	sta = sta_info_get_bss(sdata, addr);
	518	if (!sta)
	519	goto unlock;
08cf42e8	520
1272c5d8	521	set_bit(tid, sta->ampdu_mlme.tid_rx_manage_offl);
699cb58c JB	522	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
	523	unlock:
	524	rcu_read_unlock();
b8695a8f	525	}
699cb58c	526	EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);
04c2cf34 NG	527
	528	void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
	529	const u8 *addr, unsigned int tid)
	530	{
	531	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	532	struct ieee80211_local *local = sdata->local;
	533	struct sta_info *sta;
	534
	535	rcu_read_lock();
	536	sta = sta_info_get_bss(sdata, addr);
	537	if (!sta)
	538	goto unlock;
	539
	540	set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
	541	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
	542
	543	unlock:
	544	rcu_read_unlock();
	545	}
	546	EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);