[mirror_ubuntu-artful-kernel.git] / net / mac80211 / agg-rx.c

/*
 * HT handling
 *
 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2008, Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/ieee80211.h>
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "driver-ops.h"

void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
				    u16 initiator, u16 reason)
{
	struct ieee80211_local *local = sta->local;
	int i;

	/* check if TID is in operational state */
	spin_lock_bh(&sta->lock);
	if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL) {
		spin_unlock_bh(&sta->lock);
		return;
	}

	sta->ampdu_mlme.tid_state_rx[tid] =
		HT_AGG_STATE_REQ_STOP_BA_MSK |
		(initiator << HT_AGG_STATE_INITIATOR_SHIFT);
	spin_unlock_bh(&sta->lock);

#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
	       sta->sta.addr, tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */

	if (drv_ampdu_action(local, &sta->sdata->vif,
			     IEEE80211_AMPDU_RX_STOP,
			     &sta->sta, tid, NULL))
		printk(KERN_DEBUG "HW problem - can not stop rx "
				"aggregation for tid %d\n", tid);

	/* shutdown timer has not expired */
	if (initiator != WLAN_BACK_TIMER)
		del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);

	/* check if this is a self generated aggregation halt */
	if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
		ieee80211_send_delba(sta->sdata, sta->sta.addr,
				     tid, 0, reason);

	/* free the reordering buffer */
	for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
		if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
			/* release the reordered frames */
			dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
			sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
			sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
		}
	}

	spin_lock_bh(&sta->lock);
	/* free resources */
	kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
	kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_time);

	if (!sta->ampdu_mlme.tid_rx[tid]->shutdown) {
		kfree(sta->ampdu_mlme.tid_rx[tid]);
		sta->ampdu_mlme.tid_rx[tid] = NULL;
	}

	sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
	spin_unlock_bh(&sta->lock);
}

void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
					u16 initiator, u16 reason)
{
	struct ieee80211_local *local = sdata->local;
	struct sta_info *sta;

	/* stop HW Rx aggregation. ampdu_action existence
	 * already verified in session init so we add the BUG_ON */
	BUG_ON(!local->ops->ampdu_action);

	rcu_read_lock();

	sta = sta_info_get(local, ra);
	if (!sta) {
		rcu_read_unlock();
		return;
	}

	__ieee80211_stop_rx_ba_session(sta, tid, initiator, reason);

	rcu_read_unlock();
}

/*
 * After accepting the AddBA Request we activated a timer,
 * resetting it after each frame that arrives from the originator.
 * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
 */
static void sta_rx_agg_session_timer_expired(unsigned long data)
{
	/* not an elegant detour, but there is no choice as the timer passes
	 * only one argument, and various sta_info are needed here, so init
	 * flow in sta_info_create gives the TID as data, while the timer_to_id
	 * array gives the sta through container_of */
	u8 *ptid = (u8 *)data;
	u8 *timer_to_id = ptid - *ptid;
	struct sta_info *sta = container_of(timer_to_id, struct sta_info,
					 timer_to_tid[0]);

#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
#endif
	ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
					 (u16)*ptid, WLAN_BACK_TIMER,
					 WLAN_REASON_QSTA_TIMEOUT);
}

static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
				      u8 dialog_token, u16 status, u16 policy,
				      u16 buf_size, u16 timeout)
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u16 capab;

	skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);

	if (!skb) {
		printk(KERN_DEBUG "%s: failed to allocate buffer "
		       "for addba resp frame\n", sdata->dev->name);
		return;
	}

	skb_reserve(skb, local->hw.extra_tx_headroom);
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, da, ETH_ALEN);
	memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
	if (sdata->vif.type == NL80211_IFTYPE_AP ||
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
	else if (sdata->vif.type == NL80211_IFTYPE_STATION)
		memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);

	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);

	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
	mgmt->u.action.category = WLAN_CATEGORY_BACK;
	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;

	capab = (u16)(policy << 1);	/* bit 1 aggregation policy */
	capab |= (u16)(tid << 2); 	/* bit 5:2 TID number */
	capab |= (u16)(buf_size << 6);	/* bit 15:6 max size of aggregation */

	mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
	mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
	mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);

	ieee80211_tx_skb(sdata, skb, 1);
}

void ieee80211_process_addba_request(struct ieee80211_local *local,
				     struct sta_info *sta,
				     struct ieee80211_mgmt *mgmt,
				     size_t len)
{
	struct ieee80211_hw *hw = &local->hw;
	struct ieee80211_conf *conf = &hw->conf;
	struct tid_ampdu_rx *tid_agg_rx;
	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
	u8 dialog_token;
	int ret = -EOPNOTSUPP;

	/* extract session parameters from addba request frame */
	dialog_token = mgmt->u.action.u.addba_req.dialog_token;
	timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
	start_seq_num =
		le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;

	capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
	ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;

	status = WLAN_STATUS_REQUEST_DECLINED;

	if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "Suspend in progress. "
		       "Denying ADDBA request\n");
#endif
		goto end_no_lock;
	}

	/* sanity check for incoming parameters:
	 * check if configuration can support the BA policy
	 * and if buffer size does not exceeds max value */
	/* XXX: check own ht delayed BA capability?? */
	if (((ba_policy != 1)
		&& (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
		|| (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
		status = WLAN_STATUS_INVALID_QOS_PARAM;
#ifdef CONFIG_MAC80211_HT_DEBUG
		if (net_ratelimit())
			printk(KERN_DEBUG "AddBA Req with bad params from "
				"%pM on tid %u. policy %d, buffer size %d\n",
				mgmt->sa, tid, ba_policy,
				buf_size);
#endif /* CONFIG_MAC80211_HT_DEBUG */
		goto end_no_lock;
	}
	/* determine default buffer size */
	if (buf_size == 0) {
		struct ieee80211_supported_band *sband;

		sband = local->hw.wiphy->bands[conf->channel->band];
		buf_size = IEEE80211_MIN_AMPDU_BUF;
		buf_size = buf_size << sband->ht_cap.ampdu_factor;
	}


	/* examine state machine */
	spin_lock_bh(&sta->lock);

	if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		if (net_ratelimit())
			printk(KERN_DEBUG "unexpected AddBA Req from "
				"%pM on tid %u\n",
				mgmt->sa, tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */
		goto end;
	}

	/* prepare A-MPDU MLME for Rx aggregation */
	sta->ampdu_mlme.tid_rx[tid] =
			kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
	if (!sta->ampdu_mlme.tid_rx[tid]) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		if (net_ratelimit())
			printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
					tid);
#endif
		goto end;
	}
	/* rx timer */
	sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
				sta_rx_agg_session_timer_expired;
	sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
				(unsigned long)&sta->timer_to_tid[tid];
	init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);

	tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];

	/* prepare reordering buffer */
	tid_agg_rx->reorder_buf =
		kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
	tid_agg_rx->reorder_time =
		kcalloc(buf_size, sizeof(unsigned long), GFP_ATOMIC);
	if (!tid_agg_rx->reorder_buf || !tid_agg_rx->reorder_time) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		if (net_ratelimit())
			printk(KERN_ERR "can not allocate reordering buffer "
			       "to tid %d\n", tid);
#endif
		kfree(tid_agg_rx->reorder_buf);
		kfree(tid_agg_rx->reorder_time);
		kfree(sta->ampdu_mlme.tid_rx[tid]);
		sta->ampdu_mlme.tid_rx[tid] = NULL;
		goto end;
	}

	ret = drv_ampdu_action(local, &sta->sdata->vif,
			       IEEE80211_AMPDU_RX_START,
			       &sta->sta, tid, &start_seq_num);
#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
#endif /* CONFIG_MAC80211_HT_DEBUG */

	if (ret) {
		kfree(tid_agg_rx->reorder_buf);
		kfree(tid_agg_rx);
		sta->ampdu_mlme.tid_rx[tid] = NULL;
		goto end;
	}

	/* change state and send addba resp */
	sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
	tid_agg_rx->dialog_token = dialog_token;
	tid_agg_rx->ssn = start_seq_num;
	tid_agg_rx->head_seq_num = start_seq_num;
	tid_agg_rx->buf_size = buf_size;
	tid_agg_rx->timeout = timeout;
	tid_agg_rx->stored_mpdu_num = 0;
	status = WLAN_STATUS_SUCCESS;
end:
	spin_unlock_bh(&sta->lock);

end_no_lock:
	ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
				  dialog_token, status, 1, buf_size, timeout);
}
Commit	Line	Data
b8695a8f JB	1	/*
	2	* HT handling
	3	*
	4	* Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
	5	* Copyright 2002-2005, Instant802 Networks, Inc.
	6	* Copyright 2005-2006, Devicescape Software, Inc.
	7	* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
	8	* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
	9	* Copyright 2007-2008, Intel Corporation
	10	*
	11	* This program is free software; you can redistribute it and/or modify
	12	* it under the terms of the GNU General Public License version 2 as
	13	* published by the Free Software Foundation.
	14	*/
	15
	16	#include <linux/ieee80211.h>
	17	#include <net/mac80211.h>
	18	#include "ieee80211_i.h"
24487981	19	#include "driver-ops.h"
b8695a8f	20
849b7967 JB	21	void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
849b7967 JB	22	u16 initiator, u16 reason)
b8695a8f	23	{
d75636ef	24	struct ieee80211_local *local = sta->local;
d75636ef	25	int i;
b8695a8f JB	26
	27	/* check if TID is in operational state */
	28	spin_lock_bh(&sta->lock);
d75636ef	29	if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL) {
b8695a8f	30	spin_unlock_bh(&sta->lock);
b8695a8f JB	31	return;
b8695a8f JB	32	}
d75636ef	33
b8695a8f JB	34	sta->ampdu_mlme.tid_state_rx[tid] =
	35	HT_AGG_STATE_REQ_STOP_BA_MSK \|
	36	(initiator << HT_AGG_STATE_INITIATOR_SHIFT);
	37	spin_unlock_bh(&sta->lock);
	38
b8695a8f JB	39	#ifdef CONFIG_MAC80211_HT_DEBUG
b8695a8f JB	40	printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
d75636ef	41	sta->sta.addr, tid);
b8695a8f JB	42	#endif /* CONFIG_MAC80211_HT_DEBUG */
b8695a8f JB	43
c951ad35 JB	44	if (drv_ampdu_action(local, &sta->sdata->vif,
c951ad35 JB	45	IEEE80211_AMPDU_RX_STOP,
24487981	46	&sta->sta, tid, NULL))
b8695a8f JB	47	printk(KERN_DEBUG "HW problem - can not stop rx "
	48	"aggregation for tid %d\n", tid);
	49
	50	/* shutdown timer has not expired */
	51	if (initiator != WLAN_BACK_TIMER)
	52	del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
	53
	54	/* check if this is a self generated aggregation halt */
	55	if (initiator == WLAN_BACK_RECIPIENT \|\| initiator == WLAN_BACK_TIMER)
d75636ef JB	56	ieee80211_send_delba(sta->sdata, sta->sta.addr,
d75636ef JB	57	tid, 0, reason);
b8695a8f JB	58
	59	/* free the reordering buffer */
	60	for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
	61	if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
	62	/* release the reordered frames */
	63	dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
	64	sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
	65	sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
	66	}
	67	}
55687e38 JB	68
55687e38 JB	69	spin_lock_bh(&sta->lock);
b8695a8f JB	70	/* free resources */
b8695a8f JB	71	kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
4d050f1d	72	kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_time);
55687e38 JB	73
	74	if (!sta->ampdu_mlme.tid_rx[tid]->shutdown) {
	75	kfree(sta->ampdu_mlme.tid_rx[tid]);
	76	sta->ampdu_mlme.tid_rx[tid] = NULL;
	77	}
	78
b8695a8f	79	sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
55687e38	80	spin_unlock_bh(&sta->lock);
d75636ef JB	81	}
	82
	83	void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data sdata, u8 ra, u16 tid,
	84	u16 initiator, u16 reason)
	85	{
	86	struct ieee80211_local *local = sdata->local;
	87	struct sta_info *sta;
	88
	89	/* stop HW Rx aggregation. ampdu_action existence
	90	* already verified in session init so we add the BUG_ON */
	91	BUG_ON(!local->ops->ampdu_action);
	92
	93	rcu_read_lock();
	94
	95	sta = sta_info_get(local, ra);
	96	if (!sta) {
	97	rcu_read_unlock();
	98	return;
	99	}
	100
849b7967	101	__ieee80211_stop_rx_ba_session(sta, tid, initiator, reason);
b8695a8f JB	102
	103	rcu_read_unlock();
	104	}
	105
	106	/*
	107	* After accepting the AddBA Request we activated a timer,
	108	* resetting it after each frame that arrives from the originator.
	109	* if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
	110	*/
	111	static void sta_rx_agg_session_timer_expired(unsigned long data)
	112	{
	113	/* not an elegant detour, but there is no choice as the timer passes
	114	* only one argument, and various sta_info are needed here, so init
	115	* flow in sta_info_create gives the TID as data, while the timer_to_id
	116	* array gives the sta through container_of */
	117	u8 ptid = (u8 )data;
	118	u8 timer_to_id = ptid - ptid;
	119	struct sta_info *sta = container_of(timer_to_id, struct sta_info,
	120	timer_to_tid[0]);
	121
	122	#ifdef CONFIG_MAC80211_HT_DEBUG
	123	printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
	124	#endif
	125	ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
	126	(u16)*ptid, WLAN_BACK_TIMER,
	127	WLAN_REASON_QSTA_TIMEOUT);
	128	}
	129
	130	static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data sdata, u8 da, u16 tid,
	131	u8 dialog_token, u16 status, u16 policy,
	132	u16 buf_size, u16 timeout)
	133	{
b8695a8f JB	134	struct ieee80211_local *local = sdata->local;
	135	struct sk_buff *skb;
	136	struct ieee80211_mgmt *mgmt;
	137	u16 capab;
	138
	139	skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
	140
	141	if (!skb) {
	142	printk(KERN_DEBUG "%s: failed to allocate buffer "
	143	"for addba resp frame\n", sdata->dev->name);
	144	return;
	145	}
	146
	147	skb_reserve(skb, local->hw.extra_tx_headroom);
	148	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	149	memset(mgmt, 0, 24);
	150	memcpy(mgmt->da, da, ETH_ALEN);
	151	memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
8abd3f9b JB	152	if (sdata->vif.type == NL80211_IFTYPE_AP \|\|
8abd3f9b JB	153	sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
b8695a8f	154	memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
46900298 JB	155	else if (sdata->vif.type == NL80211_IFTYPE_STATION)
	156	memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
	157
b8695a8f JB	158	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT \|
	159	IEEE80211_STYPE_ACTION);
	160
	161	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
	162	mgmt->u.action.category = WLAN_CATEGORY_BACK;
	163	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
	164	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
	165
	166	capab = (u16)(policy << 1); /* bit 1 aggregation policy */
	167	capab \|= (u16)(tid << 2); /* bit 5:2 TID number */
	168	capab \|= (u16)(buf_size << 6); /* bit 15:6 max size of aggregation */
	169
	170	mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
	171	mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
	172	mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
	173
	174	ieee80211_tx_skb(sdata, skb, 1);
	175	}
	176
	177	void ieee80211_process_addba_request(struct ieee80211_local *local,
	178	struct sta_info *sta,
	179	struct ieee80211_mgmt *mgmt,
	180	size_t len)
	181	{
	182	struct ieee80211_hw *hw = &local->hw;
	183	struct ieee80211_conf *conf = &hw->conf;
	184	struct tid_ampdu_rx *tid_agg_rx;
	185	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
	186	u8 dialog_token;
	187	int ret = -EOPNOTSUPP;
	188
	189	/* extract session parameters from addba request frame */
	190	dialog_token = mgmt->u.action.u.addba_req.dialog_token;
	191	timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
	192	start_seq_num =
	193	le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
	194
	195	capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
	196	ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
	197	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
	198	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
	199
	200	status = WLAN_STATUS_REQUEST_DECLINED;
	201
722f069a S	202	if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
	203	#ifdef CONFIG_MAC80211_HT_DEBUG
	204	printk(KERN_DEBUG "Suspend in progress. "
	205	"Denying ADDBA request\n");
	206	#endif
	207	goto end_no_lock;
	208	}
	209
b8695a8f JB	210	/* sanity check for incoming parameters:
	211	* check if configuration can support the BA policy
	212	* and if buffer size does not exceeds max value */
	213	/* XXX: check own ht delayed BA capability?? */
	214	if (((ba_policy != 1)
	215	&& (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
	216	\|\| (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
	217	status = WLAN_STATUS_INVALID_QOS_PARAM;
	218	#ifdef CONFIG_MAC80211_HT_DEBUG
	219	if (net_ratelimit())
	220	printk(KERN_DEBUG "AddBA Req with bad params from "
	221	"%pM on tid %u. policy %d, buffer size %d\n",
	222	mgmt->sa, tid, ba_policy,
	223	buf_size);
	224	#endif /* CONFIG_MAC80211_HT_DEBUG */
	225	goto end_no_lock;
	226	}
	227	/* determine default buffer size */
	228	if (buf_size == 0) {
	229	struct ieee80211_supported_band *sband;
	230
	231	sband = local->hw.wiphy->bands[conf->channel->band];
	232	buf_size = IEEE80211_MIN_AMPDU_BUF;
	233	buf_size = buf_size << sband->ht_cap.ampdu_factor;
	234	}
	235
	236
	237	/* examine state machine */
	238	spin_lock_bh(&sta->lock);
	239
	240	if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
	241	#ifdef CONFIG_MAC80211_HT_DEBUG
	242	if (net_ratelimit())
	243	printk(KERN_DEBUG "unexpected AddBA Req from "
	244	"%pM on tid %u\n",
	245	mgmt->sa, tid);
	246	#endif /* CONFIG_MAC80211_HT_DEBUG */
	247	goto end;
	248	}
	249
	250	/* prepare A-MPDU MLME for Rx aggregation */
	251	sta->ampdu_mlme.tid_rx[tid] =
	252	kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
	253	if (!sta->ampdu_mlme.tid_rx[tid]) {
	254	#ifdef CONFIG_MAC80211_HT_DEBUG
	255	if (net_ratelimit())
	256	printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
	257	tid);
	258	#endif
	259	goto end;
	260	}
	261	/* rx timer */
	262	sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
	263	sta_rx_agg_session_timer_expired;
	264	sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
	265	(unsigned long)&sta->timer_to_tid[tid];
	266	init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
	267
	268	tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
	269
	270	/* prepare reordering buffer */
	271	tid_agg_rx->reorder_buf =
	272	kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
4d050f1d JM	273	tid_agg_rx->reorder_time =
	274	kcalloc(buf_size, sizeof(unsigned long), GFP_ATOMIC);
	275	if (!tid_agg_rx->reorder_buf \|\| !tid_agg_rx->reorder_time) {
b8695a8f JB	276	#ifdef CONFIG_MAC80211_HT_DEBUG
	277	if (net_ratelimit())
	278	printk(KERN_ERR "can not allocate reordering buffer "
	279	"to tid %d\n", tid);
	280	#endif
4d050f1d JM	281	kfree(tid_agg_rx->reorder_buf);
4d050f1d JM	282	kfree(tid_agg_rx->reorder_time);
b8695a8f	283	kfree(sta->ampdu_mlme.tid_rx[tid]);
4d050f1d	284	sta->ampdu_mlme.tid_rx[tid] = NULL;
b8695a8f JB	285	goto end;
	286	}
	287
c951ad35 JB	288	ret = drv_ampdu_action(local, &sta->sdata->vif,
c951ad35 JB	289	IEEE80211_AMPDU_RX_START,
24487981	290	&sta->sta, tid, &start_seq_num);
b8695a8f JB	291	#ifdef CONFIG_MAC80211_HT_DEBUG
	292	printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
	293	#endif /* CONFIG_MAC80211_HT_DEBUG */
	294
	295	if (ret) {
	296	kfree(tid_agg_rx->reorder_buf);
	297	kfree(tid_agg_rx);
	298	sta->ampdu_mlme.tid_rx[tid] = NULL;
	299	goto end;
	300	}
	301
	302	/* change state and send addba resp */
	303	sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
	304	tid_agg_rx->dialog_token = dialog_token;
	305	tid_agg_rx->ssn = start_seq_num;
	306	tid_agg_rx->head_seq_num = start_seq_num;
	307	tid_agg_rx->buf_size = buf_size;
	308	tid_agg_rx->timeout = timeout;
	309	tid_agg_rx->stored_mpdu_num = 0;
	310	status = WLAN_STATUS_SUCCESS;
	311	end:
	312	spin_unlock_bh(&sta->lock);
	313
	314	end_no_lock:
	315	ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
	316	dialog_token, status, 1, buf_size, timeout);
	317	}