xref: /openbmc/linux/net/mac80211/agg-rx.c (revision e8d0b807)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * HT handling
4  *
5  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
6  * Copyright 2002-2005, Instant802 Networks, Inc.
7  * Copyright 2005-2006, Devicescape Software, Inc.
8  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
9  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
10  * Copyright 2007-2010, Intel Corporation
11  * Copyright(c) 2015-2017 Intel Deutschland GmbH
12  * Copyright (C) 2018-2022 Intel Corporation
13  */
14 
15 /**
16  * DOC: RX A-MPDU aggregation
17  *
18  * Aggregation on the RX side requires only implementing the
19  * @ampdu_action callback that is invoked to start/stop any
20  * block-ack sessions for RX aggregation.
21  *
22  * When RX aggregation is started by the peer, the driver is
23  * notified via @ampdu_action function, with the
24  * %IEEE80211_AMPDU_RX_START action, and may reject the request
25  * in which case a negative response is sent to the peer, if it
26  * accepts it a positive response is sent.
27  *
28  * While the session is active, the device/driver are required
29  * to de-aggregate frames and pass them up one by one to mac80211,
30  * which will handle the reorder buffer.
31  *
32  * When the aggregation session is stopped again by the peer or
33  * ourselves, the driver's @ampdu_action function will be called
34  * with the action %IEEE80211_AMPDU_RX_STOP. In this case, the
35  * call must not fail.
36  */
37 
38 #include <linux/ieee80211.h>
39 #include <linux/slab.h>
40 #include <linux/export.h>
41 #include <net/mac80211.h>
42 #include "ieee80211_i.h"
43 #include "driver-ops.h"
44 
ieee80211_free_tid_rx(struct rcu_head * h)45 static void ieee80211_free_tid_rx(struct rcu_head *h)
46 {
47 	struct tid_ampdu_rx *tid_rx =
48 		container_of(h, struct tid_ampdu_rx, rcu_head);
49 	int i;
50 
51 	for (i = 0; i < tid_rx->buf_size; i++)
52 		__skb_queue_purge(&tid_rx->reorder_buf[i]);
53 	kfree(tid_rx->reorder_buf);
54 	kfree(tid_rx->reorder_time);
55 	kfree(tid_rx);
56 }
57 
___ieee80211_stop_rx_ba_session(struct sta_info * sta,u16 tid,u16 initiator,u16 reason,bool tx)58 void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
59 				     u16 initiator, u16 reason, bool tx)
60 {
61 	struct ieee80211_local *local = sta->local;
62 	struct tid_ampdu_rx *tid_rx;
63 	struct ieee80211_ampdu_params params = {
64 		.sta = &sta->sta,
65 		.action = IEEE80211_AMPDU_RX_STOP,
66 		.tid = tid,
67 		.amsdu = false,
68 		.timeout = 0,
69 		.ssn = 0,
70 	};
71 
72 	lockdep_assert_held(&sta->ampdu_mlme.mtx);
73 
74 	tid_rx = rcu_dereference_protected(sta->ampdu_mlme.tid_rx[tid],
75 					lockdep_is_held(&sta->ampdu_mlme.mtx));
76 
77 	if (!test_bit(tid, sta->ampdu_mlme.agg_session_valid))
78 		return;
79 
80 	RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], NULL);
81 	__clear_bit(tid, sta->ampdu_mlme.agg_session_valid);
82 
83 	ht_dbg(sta->sdata,
84 	       "Rx BA session stop requested for %pM tid %u %s reason: %d\n",
85 	       sta->sta.addr, tid,
86 	       initiator == WLAN_BACK_RECIPIENT ? "recipient" : "initiator",
87 	       (int)reason);
88 
89 	if (drv_ampdu_action(local, sta->sdata, &params))
90 		sdata_info(sta->sdata,
91 			   "HW problem - can not stop rx aggregation for %pM tid %d\n",
92 			   sta->sta.addr, tid);
93 
94 	/* check if this is a self generated aggregation halt */
95 	if (initiator == WLAN_BACK_RECIPIENT && tx)
96 		ieee80211_send_delba(sta->sdata, sta->sta.addr,
97 				     tid, WLAN_BACK_RECIPIENT, reason);
98 
99 	/*
100 	 * return here in case tid_rx is not assigned - which will happen if
101 	 * IEEE80211_HW_SUPPORTS_REORDERING_BUFFER is set.
102 	 */
103 	if (!tid_rx)
104 		return;
105 
106 	del_timer_sync(&tid_rx->session_timer);
107 
108 	/* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
109 	spin_lock_bh(&tid_rx->reorder_lock);
110 	tid_rx->removed = true;
111 	spin_unlock_bh(&tid_rx->reorder_lock);
112 	del_timer_sync(&tid_rx->reorder_timer);
113 
114 	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
115 }
116 
__ieee80211_stop_rx_ba_session(struct sta_info * sta,u16 tid,u16 initiator,u16 reason,bool tx)117 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
118 				    u16 initiator, u16 reason, bool tx)
119 {
120 	mutex_lock(&sta->ampdu_mlme.mtx);
121 	___ieee80211_stop_rx_ba_session(sta, tid, initiator, reason, tx);
122 	mutex_unlock(&sta->ampdu_mlme.mtx);
123 }
124 
ieee80211_stop_rx_ba_session(struct ieee80211_vif * vif,u16 ba_rx_bitmap,const u8 * addr)125 void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
126 				  const u8 *addr)
127 {
128 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
129 	struct sta_info *sta;
130 	int i;
131 
132 	rcu_read_lock();
133 	sta = sta_info_get_bss(sdata, addr);
134 	if (!sta) {
135 		rcu_read_unlock();
136 		return;
137 	}
138 
139 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
140 		if (ba_rx_bitmap & BIT(i))
141 			set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested);
142 
143 	ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
144 	rcu_read_unlock();
145 }
146 EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);
147 
148 /*
149  * After accepting the AddBA Request we activated a timer,
150  * resetting it after each frame that arrives from the originator.
151  */
sta_rx_agg_session_timer_expired(struct timer_list * t)152 static void sta_rx_agg_session_timer_expired(struct timer_list *t)
153 {
154 	struct tid_ampdu_rx *tid_rx = from_timer(tid_rx, t, session_timer);
155 	struct sta_info *sta = tid_rx->sta;
156 	u8 tid = tid_rx->tid;
157 	unsigned long timeout;
158 
159 	timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
160 	if (time_is_after_jiffies(timeout)) {
161 		mod_timer(&tid_rx->session_timer, timeout);
162 		return;
163 	}
164 
165 	ht_dbg(sta->sdata, "RX session timer expired on %pM tid %d\n",
166 	       sta->sta.addr, tid);
167 
168 	set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
169 	ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
170 }
171 
sta_rx_agg_reorder_timer_expired(struct timer_list * t)172 static void sta_rx_agg_reorder_timer_expired(struct timer_list *t)
173 {
174 	struct tid_ampdu_rx *tid_rx = from_timer(tid_rx, t, reorder_timer);
175 
176 	rcu_read_lock();
177 	ieee80211_release_reorder_timeout(tid_rx->sta, tid_rx->tid);
178 	rcu_read_unlock();
179 }
180 
ieee80211_add_addbaext(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,const struct ieee80211_addba_ext_ie * req,u16 buf_size)181 static void ieee80211_add_addbaext(struct ieee80211_sub_if_data *sdata,
182 				   struct sk_buff *skb,
183 				   const struct ieee80211_addba_ext_ie *req,
184 				   u16 buf_size)
185 {
186 	struct ieee80211_addba_ext_ie *resp;
187 	u8 *pos;
188 
189 	pos = skb_put_zero(skb, 2 + sizeof(struct ieee80211_addba_ext_ie));
190 	*pos++ = WLAN_EID_ADDBA_EXT;
191 	*pos++ = sizeof(struct ieee80211_addba_ext_ie);
192 	resp = (struct ieee80211_addba_ext_ie *)pos;
193 	resp->data = req->data & IEEE80211_ADDBA_EXT_NO_FRAG;
194 
195 	resp->data |= u8_encode_bits(buf_size >> IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT,
196 				     IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
197 }
198 
ieee80211_send_addba_resp(struct sta_info * sta,u8 * da,u16 tid,u8 dialog_token,u16 status,u16 policy,u16 buf_size,u16 timeout,const struct ieee80211_addba_ext_ie * addbaext)199 static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
200 				      u8 dialog_token, u16 status, u16 policy,
201 				      u16 buf_size, u16 timeout,
202 				      const struct ieee80211_addba_ext_ie *addbaext)
203 {
204 	struct ieee80211_sub_if_data *sdata = sta->sdata;
205 	struct ieee80211_local *local = sdata->local;
206 	struct sk_buff *skb;
207 	struct ieee80211_mgmt *mgmt;
208 	bool amsdu = ieee80211_hw_check(&local->hw, SUPPORTS_AMSDU_IN_AMPDU);
209 	u16 capab;
210 
211 	skb = dev_alloc_skb(sizeof(*mgmt) +
212 		    2 + sizeof(struct ieee80211_addba_ext_ie) +
213 		    local->hw.extra_tx_headroom);
214 	if (!skb)
215 		return;
216 
217 	skb_reserve(skb, local->hw.extra_tx_headroom);
218 	mgmt = skb_put_zero(skb, 24);
219 	memcpy(mgmt->da, da, ETH_ALEN);
220 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
221 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
222 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
223 	    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
224 		memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
225 	else if (sdata->vif.type == NL80211_IFTYPE_STATION)
226 		memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
227 	else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
228 		memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
229 
230 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
231 					  IEEE80211_STYPE_ACTION);
232 
233 	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
234 	mgmt->u.action.category = WLAN_CATEGORY_BACK;
235 	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
236 	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
237 
238 	capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
239 	capab |= u16_encode_bits(policy, IEEE80211_ADDBA_PARAM_POLICY_MASK);
240 	capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
241 	capab |= u16_encode_bits(buf_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
242 
243 	mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
244 	mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
245 	mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
246 
247 	if (sta->sta.deflink.he_cap.has_he && addbaext)
248 		ieee80211_add_addbaext(sdata, skb, addbaext, buf_size);
249 
250 	ieee80211_tx_skb(sdata, skb);
251 }
252 
___ieee80211_start_rx_ba_session(struct sta_info * sta,u8 dialog_token,u16 timeout,u16 start_seq_num,u16 ba_policy,u16 tid,u16 buf_size,bool tx,bool auto_seq,const struct ieee80211_addba_ext_ie * addbaext)253 void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
254 				      u8 dialog_token, u16 timeout,
255 				      u16 start_seq_num, u16 ba_policy, u16 tid,
256 				      u16 buf_size, bool tx, bool auto_seq,
257 				      const struct ieee80211_addba_ext_ie *addbaext)
258 {
259 	struct ieee80211_local *local = sta->sdata->local;
260 	struct tid_ampdu_rx *tid_agg_rx;
261 	struct ieee80211_ampdu_params params = {
262 		.sta = &sta->sta,
263 		.action = IEEE80211_AMPDU_RX_START,
264 		.tid = tid,
265 		.amsdu = false,
266 		.timeout = timeout,
267 		.ssn = start_seq_num,
268 	};
269 	int i, ret = -EOPNOTSUPP;
270 	u16 status = WLAN_STATUS_REQUEST_DECLINED;
271 	u16 max_buf_size;
272 
273 	if (tid >= IEEE80211_FIRST_TSPEC_TSID) {
274 		ht_dbg(sta->sdata,
275 		       "STA %pM requests BA session on unsupported tid %d\n",
276 		       sta->sta.addr, tid);
277 		goto end;
278 	}
279 
280 	if (!sta->sta.deflink.ht_cap.ht_supported &&
281 	    !sta->sta.deflink.he_cap.has_he) {
282 		ht_dbg(sta->sdata,
283 		       "STA %pM erroneously requests BA session on tid %d w/o HT\n",
284 		       sta->sta.addr, tid);
285 		/* send a response anyway, it's an error case if we get here */
286 		goto end;
287 	}
288 
289 	if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
290 		ht_dbg(sta->sdata,
291 		       "Suspend in progress - Denying ADDBA request (%pM tid %d)\n",
292 		       sta->sta.addr, tid);
293 		goto end;
294 	}
295 
296 	if (sta->sta.deflink.eht_cap.has_eht)
297 		max_buf_size = IEEE80211_MAX_AMPDU_BUF_EHT;
298 	else if (sta->sta.deflink.he_cap.has_he)
299 		max_buf_size = IEEE80211_MAX_AMPDU_BUF_HE;
300 	else
301 		max_buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
302 
303 	/* sanity check for incoming parameters:
304 	 * check if configuration can support the BA policy
305 	 * and if buffer size does not exceeds max value */
306 	/* XXX: check own ht delayed BA capability?? */
307 	if (((ba_policy != 1) &&
308 	     (!(sta->sta.deflink.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA))) ||
309 	    (buf_size > max_buf_size)) {
310 		status = WLAN_STATUS_INVALID_QOS_PARAM;
311 		ht_dbg_ratelimited(sta->sdata,
312 				   "AddBA Req with bad params from %pM on tid %u. policy %d, buffer size %d\n",
313 				   sta->sta.addr, tid, ba_policy, buf_size);
314 		goto end;
315 	}
316 	/* determine default buffer size */
317 	if (buf_size == 0)
318 		buf_size = max_buf_size;
319 
320 	/* make sure the size doesn't exceed the maximum supported by the hw */
321 	if (buf_size > sta->sta.max_rx_aggregation_subframes)
322 		buf_size = sta->sta.max_rx_aggregation_subframes;
323 	params.buf_size = buf_size;
324 
325 	ht_dbg(sta->sdata, "AddBA Req buf_size=%d for %pM\n",
326 	       buf_size, sta->sta.addr);
327 
328 	/* examine state machine */
329 	lockdep_assert_held(&sta->ampdu_mlme.mtx);
330 
331 	if (test_bit(tid, sta->ampdu_mlme.agg_session_valid)) {
332 		if (sta->ampdu_mlme.tid_rx_token[tid] == dialog_token) {
333 			struct tid_ampdu_rx *tid_rx;
334 
335 			ht_dbg_ratelimited(sta->sdata,
336 					   "updated AddBA Req from %pM on tid %u\n",
337 					   sta->sta.addr, tid);
338 			/* We have no API to update the timeout value in the
339 			 * driver so reject the timeout update if the timeout
340 			 * changed. If it did not change, i.e., no real update,
341 			 * just reply with success.
342 			 */
343 			rcu_read_lock();
344 			tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
345 			if (tid_rx && tid_rx->timeout == timeout)
346 				status = WLAN_STATUS_SUCCESS;
347 			else
348 				status = WLAN_STATUS_REQUEST_DECLINED;
349 			rcu_read_unlock();
350 			goto end;
351 		}
352 
353 		ht_dbg_ratelimited(sta->sdata,
354 				   "unexpected AddBA Req from %pM on tid %u\n",
355 				   sta->sta.addr, tid);
356 
357 		/* delete existing Rx BA session on the same tid */
358 		___ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
359 						WLAN_STATUS_UNSPECIFIED_QOS,
360 						false);
361 	}
362 
363 	if (ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) {
364 		ret = drv_ampdu_action(local, sta->sdata, &params);
365 		ht_dbg(sta->sdata,
366 		       "Rx A-MPDU request on %pM tid %d result %d\n",
367 		       sta->sta.addr, tid, ret);
368 		if (!ret)
369 			status = WLAN_STATUS_SUCCESS;
370 		goto end;
371 	}
372 
373 	/* prepare A-MPDU MLME for Rx aggregation */
374 	tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL);
375 	if (!tid_agg_rx)
376 		goto end;
377 
378 	spin_lock_init(&tid_agg_rx->reorder_lock);
379 
380 	/* rx timer */
381 	timer_setup(&tid_agg_rx->session_timer,
382 		    sta_rx_agg_session_timer_expired, TIMER_DEFERRABLE);
383 
384 	/* rx reorder timer */
385 	timer_setup(&tid_agg_rx->reorder_timer,
386 		    sta_rx_agg_reorder_timer_expired, 0);
387 
388 	/* prepare reordering buffer */
389 	tid_agg_rx->reorder_buf =
390 		kcalloc(buf_size, sizeof(struct sk_buff_head), GFP_KERNEL);
391 	tid_agg_rx->reorder_time =
392 		kcalloc(buf_size, sizeof(unsigned long), GFP_KERNEL);
393 	if (!tid_agg_rx->reorder_buf || !tid_agg_rx->reorder_time) {
394 		kfree(tid_agg_rx->reorder_buf);
395 		kfree(tid_agg_rx->reorder_time);
396 		kfree(tid_agg_rx);
397 		goto end;
398 	}
399 
400 	for (i = 0; i < buf_size; i++)
401 		__skb_queue_head_init(&tid_agg_rx->reorder_buf[i]);
402 
403 	ret = drv_ampdu_action(local, sta->sdata, &params);
404 	ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n",
405 	       sta->sta.addr, tid, ret);
406 	if (ret) {
407 		kfree(tid_agg_rx->reorder_buf);
408 		kfree(tid_agg_rx->reorder_time);
409 		kfree(tid_agg_rx);
410 		goto end;
411 	}
412 
413 	/* update data */
414 	tid_agg_rx->ssn = start_seq_num;
415 	tid_agg_rx->head_seq_num = start_seq_num;
416 	tid_agg_rx->buf_size = buf_size;
417 	tid_agg_rx->timeout = timeout;
418 	tid_agg_rx->stored_mpdu_num = 0;
419 	tid_agg_rx->auto_seq = auto_seq;
420 	tid_agg_rx->started = false;
421 	tid_agg_rx->reorder_buf_filtered = 0;
422 	tid_agg_rx->tid = tid;
423 	tid_agg_rx->sta = sta;
424 	status = WLAN_STATUS_SUCCESS;
425 
426 	/* activate it for RX */
427 	rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
428 
429 	if (timeout) {
430 		mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
431 		tid_agg_rx->last_rx = jiffies;
432 	}
433 
434 end:
435 	if (status == WLAN_STATUS_SUCCESS) {
436 		__set_bit(tid, sta->ampdu_mlme.agg_session_valid);
437 		__clear_bit(tid, sta->ampdu_mlme.unexpected_agg);
438 		sta->ampdu_mlme.tid_rx_token[tid] = dialog_token;
439 	}
440 
441 	if (tx)
442 		ieee80211_send_addba_resp(sta, sta->sta.addr, tid,
443 					  dialog_token, status, 1, buf_size,
444 					  timeout, addbaext);
445 }
446 
__ieee80211_start_rx_ba_session(struct sta_info * sta,u8 dialog_token,u16 timeout,u16 start_seq_num,u16 ba_policy,u16 tid,u16 buf_size,bool tx,bool auto_seq,const struct ieee80211_addba_ext_ie * addbaext)447 static void __ieee80211_start_rx_ba_session(struct sta_info *sta,
448 					    u8 dialog_token, u16 timeout,
449 					    u16 start_seq_num, u16 ba_policy,
450 					    u16 tid, u16 buf_size, bool tx,
451 					    bool auto_seq,
452 					    const struct ieee80211_addba_ext_ie *addbaext)
453 {
454 	mutex_lock(&sta->ampdu_mlme.mtx);
455 	___ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
456 					 start_seq_num, ba_policy, tid,
457 					 buf_size, tx, auto_seq, addbaext);
458 	mutex_unlock(&sta->ampdu_mlme.mtx);
459 }
460 
ieee80211_process_addba_request(struct ieee80211_local * local,struct sta_info * sta,struct ieee80211_mgmt * mgmt,size_t len)461 void ieee80211_process_addba_request(struct ieee80211_local *local,
462 				     struct sta_info *sta,
463 				     struct ieee80211_mgmt *mgmt,
464 				     size_t len)
465 {
466 	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num;
467 	struct ieee802_11_elems *elems = NULL;
468 	u8 dialog_token;
469 	int ies_len;
470 
471 	/* extract session parameters from addba request frame */
472 	dialog_token = mgmt->u.action.u.addba_req.dialog_token;
473 	timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
474 	start_seq_num =
475 		le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
476 
477 	capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
478 	ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
479 	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
480 	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
481 
482 	ies_len = len - offsetof(struct ieee80211_mgmt,
483 				 u.action.u.addba_req.variable);
484 	if (ies_len) {
485 		elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
486 					       ies_len, true, NULL);
487 		if (!elems || elems->parse_error)
488 			goto free;
489 	}
490 
491 	if (sta->sta.deflink.eht_cap.has_eht && elems && elems->addba_ext_ie) {
492 		u8 buf_size_1k = u8_get_bits(elems->addba_ext_ie->data,
493 					     IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
494 
495 		buf_size |= buf_size_1k << IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT;
496 	}
497 
498 	__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
499 					start_seq_num, ba_policy, tid,
500 					buf_size, true, false,
501 					elems ? elems->addba_ext_ie : NULL);
502 free:
503 	kfree(elems);
504 }
505 
ieee80211_manage_rx_ba_offl(struct ieee80211_vif * vif,const u8 * addr,unsigned int tid)506 void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
507 				 const u8 *addr, unsigned int tid)
508 {
509 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
510 	struct ieee80211_local *local = sdata->local;
511 	struct sta_info *sta;
512 
513 	rcu_read_lock();
514 	sta = sta_info_get_bss(sdata, addr);
515 	if (!sta)
516 		goto unlock;
517 
518 	set_bit(tid, sta->ampdu_mlme.tid_rx_manage_offl);
519 	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
520  unlock:
521 	rcu_read_unlock();
522 }
523 EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);
524 
ieee80211_rx_ba_timer_expired(struct ieee80211_vif * vif,const u8 * addr,unsigned int tid)525 void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
526 				   const u8 *addr, unsigned int tid)
527 {
528 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
529 	struct ieee80211_local *local = sdata->local;
530 	struct sta_info *sta;
531 
532 	rcu_read_lock();
533 	sta = sta_info_get_bss(sdata, addr);
534 	if (!sta)
535 		goto unlock;
536 
537 	set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
538 	ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
539 
540  unlock:
541 	rcu_read_unlock();
542 }
543 EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);
544