net/mac80211/ht.c

   1 /*
   2  * HT handling
   3  *
   4  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   5  * Copyright 2002-2005, Instant802 Networks, Inc.
   6  * Copyright 2005-2006, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9  * Copyright 2007-2008, Intel Corporation
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License version 2 as
  13  * published by the Free Software Foundation.
  14  */
  15
  16 #include <linux/ieee80211.h>
  17 #include <net/wireless.h>
  18 #include <net/mac80211.h>
  19 #include "ieee80211_i.h"
  20 #include "sta_info.h"
  21 #include "wme.h"
  22
  23 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
  24                                        struct ieee80211_ht_cap *ht_cap_ie,
  25                                        struct ieee80211_sta_ht_cap *ht_cap)
  26 {
  27         u8 ampdu_info, tx_mcs_set_cap;
  28         int i, max_tx_streams;
  29
  30         BUG_ON(!ht_cap);
  31
  32         memset(ht_cap, 0, sizeof(*ht_cap));
  33
  34         if (!ht_cap_ie)
  35                 return;
  36
  37         ht_cap->ht_supported = true;
  38
  39         ht_cap->cap = ht_cap->cap & sband->ht_cap.cap;
  40         ht_cap->cap &= ~IEEE80211_HT_CAP_SM_PS;
  41         ht_cap->cap |= sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS;
  42
  43         ampdu_info = ht_cap_ie->ampdu_params_info;
  44         ht_cap->ampdu_factor =
  45                 ampdu_info & IEEE80211_HT_AMPDU_PARM_FACTOR;
  46         ht_cap->ampdu_density =
  47                 (ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
  48
  49         /* own MCS TX capabilities */
  50         tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
  51
  52         /* can we TX with MCS rates? */
  53         if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
  54                 return;
  55
  56         /* Counting from 0, therefore +1 */
  57         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_RX_DIFF)
  58                 max_tx_streams =
  59                         ((tx_mcs_set_cap & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
  60                                 >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
  61         else
  62                 max_tx_streams = IEEE80211_HT_MCS_TX_MAX_STREAMS;
  63
  64         /*
  65          * 802.11n D5.0 20.3.5 / 20.6 says:
  66          * - indices 0 to 7 and 32 are single spatial stream
  67          * - 8 to 31 are multiple spatial streams using equal modulation
  68          *   [8..15 for two streams, 16..23 for three and 24..31 for four]
  69          * - remainder are multiple spatial streams using unequal modulation
  70          */
  71         for (i = 0; i < max_tx_streams; i++)
  72                 ht_cap->mcs.rx_mask[i] =
  73                         sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
  74
  75         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
  76                 for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
  77                      i < IEEE80211_HT_MCS_MASK_LEN; i++)
  78                         ht_cap->mcs.rx_mask[i] =
  79                                 sband->ht_cap.mcs.rx_mask[i] &
  80                                         ht_cap_ie->mcs.rx_mask[i];
  81
  82         /* handle MCS rate 32 too */
  83         if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
  84                 ht_cap->mcs.rx_mask[32/8] |= 1;
  85 }
  86
  87 /*
  88  * ieee80211_enable_ht should be called only after the operating band
  89  * has been determined as ht configuration depends on the hw's
  90  * HT abilities for a specific band.
  91  */
  92 u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
  93                         struct ieee80211_ht_info *hti,
  94                         u16 ap_ht_cap_flags)
  95 {
  96         struct ieee80211_local *local = sdata->local;
  97         struct ieee80211_supported_band *sband;
  98         struct ieee80211_bss_ht_conf ht;
  99         u32 changed = 0;
 100         bool enable_ht = true, ht_changed;
 101
 102         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 103
 104         memset(&ht, 0, sizeof(ht));
 105
 106         /* HT is not supported */
 107         if (!sband->ht_cap.ht_supported)
 108                 enable_ht = false;
 109
 110         /* check that channel matches the right operating channel */
 111         if (local->hw.conf.channel->center_freq !=
 112             ieee80211_channel_to_frequency(hti->control_chan))
 113                 enable_ht = false;
 114
 115         /*
 116          * XXX: This is totally incorrect when there are multiple virtual
 117          *      interfaces, needs to be fixed later.
 118          */
 119         ht_changed = local->hw.conf.ht.enabled != enable_ht;
 120         local->hw.conf.ht.enabled = enable_ht;
 121         if (ht_changed)
 122                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_HT);
 123
 124         /* disable HT */
 125         if (!enable_ht)
 126                 return 0;
 127         ht.secondary_channel_offset =
 128                 hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
 129         ht.width_40_ok =
 130                 !(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
 131                 (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
 132                 (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY);
 133         ht.operation_mode = le16_to_cpu(hti->operation_mode);
 134
 135         /* if bss configuration changed store the new one */
 136         if (memcmp(&sdata->vif.bss_conf.ht, &ht, sizeof(ht))) {
 137                 changed |= BSS_CHANGED_HT;
 138                 sdata->vif.bss_conf.ht = ht;
 139         }
 140
 141         return changed;
 142 }
 143
 144 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
 145                                          const u8 *da, u16 tid,
 146                                          u8 dialog_token, u16 start_seq_num,
 147                                          u16 agg_size, u16 timeout)
 148 {
 149         struct ieee80211_local *local = sdata->local;
 150         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 151         struct sk_buff *skb;
 152         struct ieee80211_mgmt *mgmt;
 153         u16 capab;
 154
 155         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
 156
 157         if (!skb) {
 158                 printk(KERN_ERR "%s: failed to allocate buffer "
 159                                 "for addba request frame\n", sdata->dev->name);
 160                 return;
 161         }
 162         skb_reserve(skb, local->hw.extra_tx_headroom);
 163         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 164         memset(mgmt, 0, 24);
 165         memcpy(mgmt->da, da, ETH_ALEN);
 166         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 167         if (sdata->vif.type == NL80211_IFTYPE_AP)
 168                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
 169         else
 170                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 171
 172         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 173                                           IEEE80211_STYPE_ACTION);
 174
 175         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
 176
 177         mgmt->u.action.category = WLAN_CATEGORY_BACK;
 178         mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
 179
 180         mgmt->u.action.u.addba_req.dialog_token = dialog_token;
 181         capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
 182         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
 183         capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
 184
 185         mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
 186
 187         mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
 188         mgmt->u.action.u.addba_req.start_seq_num =
 189                                         cpu_to_le16(start_seq_num << 4);
 190
 191         ieee80211_tx_skb(sdata, skb, 0);
 192 }
 193
 194 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
 195                                       u8 dialog_token, u16 status, u16 policy,
 196                                       u16 buf_size, u16 timeout)
 197 {
 198         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 199         struct ieee80211_local *local = sdata->local;
 200         struct sk_buff *skb;
 201         struct ieee80211_mgmt *mgmt;
 202         u16 capab;
 203
 204         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
 205
 206         if (!skb) {
 207                 printk(KERN_DEBUG "%s: failed to allocate buffer "
 208                        "for addba resp frame\n", sdata->dev->name);
 209                 return;
 210         }
 211
 212         skb_reserve(skb, local->hw.extra_tx_headroom);
 213         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 214         memset(mgmt, 0, 24);
 215         memcpy(mgmt->da, da, ETH_ALEN);
 216         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 217         if (sdata->vif.type == NL80211_IFTYPE_AP)
 218                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
 219         else
 220                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 221         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 222                                           IEEE80211_STYPE_ACTION);
 223
 224         skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
 225         mgmt->u.action.category = WLAN_CATEGORY_BACK;
 226         mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
 227         mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
 228
 229         capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
 230         capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
 231         capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
 232
 233         mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
 234         mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
 235         mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
 236
 237         ieee80211_tx_skb(sdata, skb, 0);
 238 }
 239
 240 static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
 241                                  const u8 *da, u16 tid,
 242                                  u16 initiator, u16 reason_code)
 243 {
 244         struct ieee80211_local *local = sdata->local;
 245         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 246         struct sk_buff *skb;
 247         struct ieee80211_mgmt *mgmt;
 248         u16 params;
 249
 250         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
 251
 252         if (!skb) {
 253                 printk(KERN_ERR "%s: failed to allocate buffer "
 254                                         "for delba frame\n", sdata->dev->name);
 255                 return;
 256         }
 257
 258         skb_reserve(skb, local->hw.extra_tx_headroom);
 259         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
 260         memset(mgmt, 0, 24);
 261         memcpy(mgmt->da, da, ETH_ALEN);
 262         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 263         if (sdata->vif.type == NL80211_IFTYPE_AP)
 264                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
 265         else
 266                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 267         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 268                                           IEEE80211_STYPE_ACTION);
 269
 270         skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
 271
 272         mgmt->u.action.category = WLAN_CATEGORY_BACK;
 273         mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
 274         params = (u16)(initiator << 11);        /* bit 11 initiator */
 275         params |= (u16)(tid << 12);             /* bit 15:12 TID number */
 276
 277         mgmt->u.action.u.delba.params = cpu_to_le16(params);
 278         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
 279
 280         ieee80211_tx_skb(sdata, skb, 0);
 281 }
 282
 283 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
 284 {
 285         struct ieee80211_local *local = sdata->local;
 286         struct sk_buff *skb;
 287         struct ieee80211_bar *bar;
 288         u16 bar_control = 0;
 289
 290         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
 291         if (!skb) {
 292                 printk(KERN_ERR "%s: failed to allocate buffer for "
 293                         "bar frame\n", sdata->dev->name);
 294                 return;
 295         }
 296         skb_reserve(skb, local->hw.extra_tx_headroom);
 297         bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
 298         memset(bar, 0, sizeof(*bar));
 299         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
 300                                          IEEE80211_STYPE_BACK_REQ);
 301         memcpy(bar->ra, ra, ETH_ALEN);
 302         memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
 303         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
 304         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
 305         bar_control |= (u16)(tid << 12);
 306         bar->control = cpu_to_le16(bar_control);
 307         bar->start_seq_num = cpu_to_le16(ssn);
 308
 309         ieee80211_tx_skb(sdata, skb, 0);
 310 }
 311
 312 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
 313                                         u16 initiator, u16 reason)
 314 {
 315         struct ieee80211_local *local = sdata->local;
 316         struct ieee80211_hw *hw = &local->hw;
 317         struct sta_info *sta;
 318         int ret, i;
 319
 320         rcu_read_lock();
 321
 322         sta = sta_info_get(local, ra);
 323         if (!sta) {
 324                 rcu_read_unlock();
 325                 return;
 326         }
 327
 328         /* check if TID is in operational state */
 329         spin_lock_bh(&sta->lock);
 330         if (sta->ampdu_mlme.tid_state_rx[tid]
 331                                 != HT_AGG_STATE_OPERATIONAL) {
 332                 spin_unlock_bh(&sta->lock);
 333                 rcu_read_unlock();
 334                 return;
 335         }
 336         sta->ampdu_mlme.tid_state_rx[tid] =
 337                 HT_AGG_STATE_REQ_STOP_BA_MSK |
 338                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 339         spin_unlock_bh(&sta->lock);
 340
 341         /* stop HW Rx aggregation. ampdu_action existence
 342          * already verified in session init so we add the BUG_ON */
 343         BUG_ON(!local->ops->ampdu_action);
 344
 345 #ifdef CONFIG_MAC80211_HT_DEBUG
 346         printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
 347                ra, tid);
 348 #endif /* CONFIG_MAC80211_HT_DEBUG */
 349
 350         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
 351                                        &sta->sta, tid, NULL);
 352         if (ret)
 353                 printk(KERN_DEBUG "HW problem - can not stop rx "
 354                                 "aggregation for tid %d\n", tid);
 355
 356         /* shutdown timer has not expired */
 357         if (initiator != WLAN_BACK_TIMER)
 358                 del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
 359
 360         /* check if this is a self generated aggregation halt */
 361         if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
 362                 ieee80211_send_delba(sdata, ra, tid, 0, reason);
 363
 364         /* free the reordering buffer */
 365         for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
 366                 if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
 367                         /* release the reordered frames */
 368                         dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
 369                         sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
 370                         sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
 371                 }
 372         }
 373         /* free resources */
 374         kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
 375         kfree(sta->ampdu_mlme.tid_rx[tid]);
 376         sta->ampdu_mlme.tid_rx[tid] = NULL;
 377         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
 378
 379         rcu_read_unlock();
 380 }
 381
 382
 383 /*
 384  * After sending add Block Ack request we activated a timer until
 385  * add Block Ack response will arrive from the recipient.
 386  * If this timer expires sta_addba_resp_timer_expired will be executed.
 387  */
 388 static void sta_addba_resp_timer_expired(unsigned long data)
 389 {
 390         /* not an elegant detour, but there is no choice as the timer passes
 391          * only one argument, and both sta_info and TID are needed, so init
 392          * flow in sta_info_create gives the TID as data, while the timer_to_id
 393          * array gives the sta through container_of */
 394         u16 tid = *(u8 *)data;
 395         struct sta_info *temp_sta = container_of((void *)data,
 396                 struct sta_info, timer_to_tid[tid]);
 397
 398         struct ieee80211_local *local = temp_sta->local;
 399         struct ieee80211_hw *hw = &local->hw;
 400         struct sta_info *sta;
 401         u8 *state;
 402
 403         rcu_read_lock();
 404
 405         sta = sta_info_get(local, temp_sta->sta.addr);
 406         if (!sta) {
 407                 rcu_read_unlock();
 408                 return;
 409         }
 410
 411         state = &sta->ampdu_mlme.tid_state_tx[tid];
 412         /* check if the TID waits for addBA response */
 413         spin_lock_bh(&sta->lock);
 414         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
 415                 spin_unlock_bh(&sta->lock);
 416                 *state = HT_AGG_STATE_IDLE;
 417 #ifdef CONFIG_MAC80211_HT_DEBUG
 418                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
 419                                 "expecting addBA response there", tid);
 420 #endif
 421                 goto timer_expired_exit;
 422         }
 423
 424 #ifdef CONFIG_MAC80211_HT_DEBUG
 425         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
 426 #endif
 427
 428         /* go through the state check in stop_BA_session */
 429         *state = HT_AGG_STATE_OPERATIONAL;
 430         spin_unlock_bh(&sta->lock);
 431         ieee80211_stop_tx_ba_session(hw, temp_sta->sta.addr, tid,
 432                                      WLAN_BACK_INITIATOR);
 433
 434 timer_expired_exit:
 435         rcu_read_unlock();
 436 }
 437
 438 void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr)
 439 {
 440         struct ieee80211_local *local = sdata->local;
 441         int i;
 442
 443         for (i = 0; i <  STA_TID_NUM; i++) {
 444                 ieee80211_stop_tx_ba_session(&local->hw, addr, i,
 445                                              WLAN_BACK_INITIATOR);
 446                 ieee80211_sta_stop_rx_ba_session(sdata, addr, i,
 447                                                  WLAN_BACK_RECIPIENT,
 448                                                  WLAN_REASON_QSTA_LEAVE_QBSS);
 449         }
 450 }
 451
 452 int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 453 {
 454         struct ieee80211_local *local = hw_to_local(hw);
 455         struct sta_info *sta;
 456         struct ieee80211_sub_if_data *sdata;
 457         u16 start_seq_num;
 458         u8 *state;
 459         int ret;
 460
 461         if (tid >= STA_TID_NUM)
 462                 return -EINVAL;
 463
 464 #ifdef CONFIG_MAC80211_HT_DEBUG
 465         printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
 466                ra, tid);
 467 #endif /* CONFIG_MAC80211_HT_DEBUG */
 468
 469         rcu_read_lock();
 470
 471         sta = sta_info_get(local, ra);
 472         if (!sta) {
 473 #ifdef CONFIG_MAC80211_HT_DEBUG
 474                 printk(KERN_DEBUG "Could not find the station\n");
 475 #endif
 476                 ret = -ENOENT;
 477                 goto exit;
 478         }
 479
 480         spin_lock_bh(&sta->lock);
 481
 482         /* we have tried too many times, receiver does not want A-MPDU */
 483         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
 484                 ret = -EBUSY;
 485                 goto err_unlock_sta;
 486         }
 487
 488         state = &sta->ampdu_mlme.tid_state_tx[tid];
 489         /* check if the TID is not in aggregation flow already */
 490         if (*state != HT_AGG_STATE_IDLE) {
 491 #ifdef CONFIG_MAC80211_HT_DEBUG
 492                 printk(KERN_DEBUG "BA request denied - session is not "
 493                                  "idle on tid %u\n", tid);
 494 #endif /* CONFIG_MAC80211_HT_DEBUG */
 495                 ret = -EAGAIN;
 496                 goto err_unlock_sta;
 497         }
 498
 499         /* prepare A-MPDU MLME for Tx aggregation */
 500         sta->ampdu_mlme.tid_tx[tid] =
 501                         kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
 502         if (!sta->ampdu_mlme.tid_tx[tid]) {
 503 #ifdef CONFIG_MAC80211_HT_DEBUG
 504                 if (net_ratelimit())
 505                         printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
 506                                         tid);
 507 #endif
 508                 ret = -ENOMEM;
 509                 goto err_unlock_sta;
 510         }
 511         /* Tx timer */
 512         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
 513                         sta_addba_resp_timer_expired;
 514         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
 515                         (unsigned long)&sta->timer_to_tid[tid];
 516         init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 517
 518         /* create a new queue for this aggregation */
 519         ret = ieee80211_ht_agg_queue_add(local, sta, tid);
 520
 521         /* case no queue is available to aggregation
 522          * don't switch to aggregation */
 523         if (ret) {
 524 #ifdef CONFIG_MAC80211_HT_DEBUG
 525                 printk(KERN_DEBUG "BA request denied - queue unavailable for"
 526                                         " tid %d\n", tid);
 527 #endif /* CONFIG_MAC80211_HT_DEBUG */
 528                 goto err_unlock_queue;
 529         }
 530         sdata = sta->sdata;
 531
 532         /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
 533          * call back right away, it must see that the flow has begun */
 534         *state |= HT_ADDBA_REQUESTED_MSK;
 535
 536         /* This is slightly racy because the queue isn't stopped */
 537         start_seq_num = sta->tid_seq[tid];
 538
 539         if (local->ops->ampdu_action)
 540                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
 541                                                &sta->sta, tid, &start_seq_num);
 542
 543         if (ret) {
 544                 /* No need to requeue the packets in the agg queue, since we
 545                  * held the tx lock: no packet could be enqueued to the newly
 546                  * allocated queue */
 547                 ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
 548 #ifdef CONFIG_MAC80211_HT_DEBUG
 549                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
 550                                         " tid %d\n", tid);
 551 #endif /* CONFIG_MAC80211_HT_DEBUG */
 552                 *state = HT_AGG_STATE_IDLE;
 553                 goto err_unlock_queue;
 554         }
 555
 556         /* Will put all the packets in the new SW queue */
 557         ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
 558         spin_unlock_bh(&sta->lock);
 559
 560         /* send an addBA request */
 561         sta->ampdu_mlme.dialog_token_allocator++;
 562         sta->ampdu_mlme.tid_tx[tid]->dialog_token =
 563                         sta->ampdu_mlme.dialog_token_allocator;
 564         sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
 565
 566
 567         ieee80211_send_addba_request(sta->sdata, ra, tid,
 568                          sta->ampdu_mlme.tid_tx[tid]->dialog_token,
 569                          sta->ampdu_mlme.tid_tx[tid]->ssn,
 570                          0x40, 5000);
 571         /* activate the timer for the recipient's addBA response */
 572         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
 573                                 jiffies + ADDBA_RESP_INTERVAL;
 574         add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 575 #ifdef CONFIG_MAC80211_HT_DEBUG
 576         printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
 577 #endif
 578         goto exit;
 579
 580 err_unlock_queue:
 581         kfree(sta->ampdu_mlme.tid_tx[tid]);
 582         sta->ampdu_mlme.tid_tx[tid] = NULL;
 583         ret = -EBUSY;
 584 err_unlock_sta:
 585         spin_unlock_bh(&sta->lock);
 586 exit:
 587         rcu_read_unlock();
 588         return ret;
 589 }
 590 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
 591
 592 int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
 593                                  u8 *ra, u16 tid,
 594                                  enum ieee80211_back_parties initiator)
 595 {
 596         struct ieee80211_local *local = hw_to_local(hw);
 597         struct sta_info *sta;
 598         u8 *state;
 599         int ret = 0;
 600
 601         if (tid >= STA_TID_NUM)
 602                 return -EINVAL;
 603
 604         rcu_read_lock();
 605         sta = sta_info_get(local, ra);
 606         if (!sta) {
 607                 rcu_read_unlock();
 608                 return -ENOENT;
 609         }
 610
 611         /* check if the TID is in aggregation */
 612         state = &sta->ampdu_mlme.tid_state_tx[tid];
 613         spin_lock_bh(&sta->lock);
 614
 615         if (*state != HT_AGG_STATE_OPERATIONAL) {
 616                 ret = -ENOENT;
 617                 goto stop_BA_exit;
 618         }
 619
 620 #ifdef CONFIG_MAC80211_HT_DEBUG
 621         printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
 622                ra, tid);
 623 #endif /* CONFIG_MAC80211_HT_DEBUG */
 624
 625         ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
 626
 627         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
 628                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 629
 630         if (local->ops->ampdu_action)
 631                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
 632                                                &sta->sta, tid, NULL);
 633
 634         /* case HW denied going back to legacy */
 635         if (ret) {
 636                 WARN_ON(ret != -EBUSY);
 637                 *state = HT_AGG_STATE_OPERATIONAL;
 638                 ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
 639                 goto stop_BA_exit;
 640         }
 641
 642 stop_BA_exit:
 643         spin_unlock_bh(&sta->lock);
 644         rcu_read_unlock();
 645         return ret;
 646 }
 647 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 648
 649 void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 650 {
 651         struct ieee80211_local *local = hw_to_local(hw);
 652         struct sta_info *sta;
 653         u8 *state;
 654
 655         if (tid >= STA_TID_NUM) {
 656 #ifdef CONFIG_MAC80211_HT_DEBUG
 657                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
 658                                 tid, STA_TID_NUM);
 659 #endif
 660                 return;
 661         }
 662
 663         rcu_read_lock();
 664         sta = sta_info_get(local, ra);
 665         if (!sta) {
 666                 rcu_read_unlock();
 667 #ifdef CONFIG_MAC80211_HT_DEBUG
 668                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 669 #endif
 670                 return;
 671         }
 672
 673         state = &sta->ampdu_mlme.tid_state_tx[tid];
 674         spin_lock_bh(&sta->lock);
 675
 676         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
 677 #ifdef CONFIG_MAC80211_HT_DEBUG
 678                 printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
 679                                 *state);
 680 #endif
 681                 spin_unlock_bh(&sta->lock);
 682                 rcu_read_unlock();
 683                 return;
 684         }
 685
 686         WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
 687
 688         *state |= HT_ADDBA_DRV_READY_MSK;
 689
 690         if (*state == HT_AGG_STATE_OPERATIONAL) {
 691 #ifdef CONFIG_MAC80211_HT_DEBUG
 692                 printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
 693 #endif
 694                 ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
 695         }
 696         spin_unlock_bh(&sta->lock);
 697         rcu_read_unlock();
 698 }
 699 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
 700
 701 void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
 702 {
 703         struct ieee80211_local *local = hw_to_local(hw);
 704         struct sta_info *sta;
 705         u8 *state;
 706         int agg_queue;
 707
 708         if (tid >= STA_TID_NUM) {
 709 #ifdef CONFIG_MAC80211_HT_DEBUG
 710                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
 711                                 tid, STA_TID_NUM);
 712 #endif
 713                 return;
 714         }
 715
 716 #ifdef CONFIG_MAC80211_HT_DEBUG
 717         printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
 718                ra, tid);
 719 #endif /* CONFIG_MAC80211_HT_DEBUG */
 720
 721         rcu_read_lock();
 722         sta = sta_info_get(local, ra);
 723         if (!sta) {
 724 #ifdef CONFIG_MAC80211_HT_DEBUG
 725                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 726 #endif
 727                 rcu_read_unlock();
 728                 return;
 729         }
 730         state = &sta->ampdu_mlme.tid_state_tx[tid];
 731
 732         /* NOTE: no need to use sta->lock in this state check, as
 733          * ieee80211_stop_tx_ba_session will let only one stop call to
 734          * pass through per sta/tid
 735          */
 736         if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
 737 #ifdef CONFIG_MAC80211_HT_DEBUG
 738                 printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
 739 #endif
 740                 rcu_read_unlock();
 741                 return;
 742         }
 743
 744         if (*state & HT_AGG_STATE_INITIATOR_MSK)
 745                 ieee80211_send_delba(sta->sdata, ra, tid,
 746                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 747
 748         agg_queue = sta->tid_to_tx_q[tid];
 749
 750         ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
 751
 752         /* We just requeued the all the frames that were in the
 753          * removed queue, and since we might miss a softirq we do
 754          * netif_schedule_queue.  ieee80211_wake_queue is not used
 755          * here as this queue is not necessarily stopped
 756          */
 757         netif_schedule_queue(netdev_get_tx_queue(local->mdev, agg_queue));
 758         spin_lock_bh(&sta->lock);
 759         *state = HT_AGG_STATE_IDLE;
 760         sta->ampdu_mlme.addba_req_num[tid] = 0;
 761         kfree(sta->ampdu_mlme.tid_tx[tid]);
 762         sta->ampdu_mlme.tid_tx[tid] = NULL;
 763         spin_unlock_bh(&sta->lock);
 764
 765         rcu_read_unlock();
 766 }
 767 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
 768
 769 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
 770                                       const u8 *ra, u16 tid)
 771 {
 772         struct ieee80211_local *local = hw_to_local(hw);
 773         struct ieee80211_ra_tid *ra_tid;
 774         struct sk_buff *skb = dev_alloc_skb(0);
 775
 776         if (unlikely(!skb)) {
 777 #ifdef CONFIG_MAC80211_HT_DEBUG
 778                 if (net_ratelimit())
 779                         printk(KERN_WARNING "%s: Not enough memory, "
 780                                "dropping start BA session", skb->dev->name);
 781 #endif
 782                 return;
 783         }
 784         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
 785         memcpy(&ra_tid->ra, ra, ETH_ALEN);
 786         ra_tid->tid = tid;
 787
 788         skb->pkt_type = IEEE80211_ADDBA_MSG;
 789         skb_queue_tail(&local->skb_queue, skb);
 790         tasklet_schedule(&local->tasklet);
 791 }
 792 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 793
 794 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
 795                                      const u8 *ra, u16 tid)
 796 {
 797         struct ieee80211_local *local = hw_to_local(hw);
 798         struct ieee80211_ra_tid *ra_tid;
 799         struct sk_buff *skb = dev_alloc_skb(0);
 800
 801         if (unlikely(!skb)) {
 802 #ifdef CONFIG_MAC80211_HT_DEBUG
 803                 if (net_ratelimit())
 804                         printk(KERN_WARNING "%s: Not enough memory, "
 805                                "dropping stop BA session", skb->dev->name);
 806 #endif
 807                 return;
 808         }
 809         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
 810         memcpy(&ra_tid->ra, ra, ETH_ALEN);
 811         ra_tid->tid = tid;
 812
 813         skb->pkt_type = IEEE80211_DELBA_MSG;
 814         skb_queue_tail(&local->skb_queue, skb);
 815         tasklet_schedule(&local->tasklet);
 816 }
 817 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
 818
 819 /*
 820  * After accepting the AddBA Request we activated a timer,
 821  * resetting it after each frame that arrives from the originator.
 822  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
 823  */
 824 static void sta_rx_agg_session_timer_expired(unsigned long data)
 825 {
 826         /* not an elegant detour, but there is no choice as the timer passes
 827          * only one argument, and various sta_info are needed here, so init
 828          * flow in sta_info_create gives the TID as data, while the timer_to_id
 829          * array gives the sta through container_of */
 830         u8 *ptid = (u8 *)data;
 831         u8 *timer_to_id = ptid - *ptid;
 832         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
 833                                          timer_to_tid[0]);
 834
 835 #ifdef CONFIG_MAC80211_HT_DEBUG
 836         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
 837 #endif
 838         ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
 839                                          (u16)*ptid, WLAN_BACK_TIMER,
 840                                          WLAN_REASON_QSTA_TIMEOUT);
 841 }
 842
 843 void ieee80211_process_addba_request(struct ieee80211_local *local,
 844                                      struct sta_info *sta,
 845                                      struct ieee80211_mgmt *mgmt,
 846                                      size_t len)
 847 {
 848         struct ieee80211_hw *hw = &local->hw;
 849         struct ieee80211_conf *conf = &hw->conf;
 850         struct tid_ampdu_rx *tid_agg_rx;
 851         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
 852         u8 dialog_token;
 853         int ret = -EOPNOTSUPP;
 854
 855         /* extract session parameters from addba request frame */
 856         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
 857         timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
 858         start_seq_num =
 859                 le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
 860
 861         capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
 862         ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
 863         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
 864         buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
 865
 866         status = WLAN_STATUS_REQUEST_DECLINED;
 867
 868         /* sanity check for incoming parameters:
 869          * check if configuration can support the BA policy
 870          * and if buffer size does not exceeds max value */
 871         /* XXX: check own ht delayed BA capability?? */
 872         if (((ba_policy != 1)
 873                 && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
 874                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
 875                 status = WLAN_STATUS_INVALID_QOS_PARAM;
 876 #ifdef CONFIG_MAC80211_HT_DEBUG
 877                 if (net_ratelimit())
 878                         printk(KERN_DEBUG "AddBA Req with bad params from "
 879                                 "%pM on tid %u. policy %d, buffer size %d\n",
 880                                 mgmt->sa, tid, ba_policy,
 881                                 buf_size);
 882 #endif /* CONFIG_MAC80211_HT_DEBUG */
 883                 goto end_no_lock;
 884         }
 885         /* determine default buffer size */
 886         if (buf_size == 0) {
 887                 struct ieee80211_supported_band *sband;
 888
 889                 sband = local->hw.wiphy->bands[conf->channel->band];
 890                 buf_size = IEEE80211_MIN_AMPDU_BUF;
 891                 buf_size = buf_size << sband->ht_cap.ampdu_factor;
 892         }
 893
 894
 895         /* examine state machine */
 896         spin_lock_bh(&sta->lock);
 897
 898         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
 899 #ifdef CONFIG_MAC80211_HT_DEBUG
 900                 if (net_ratelimit())
 901                         printk(KERN_DEBUG "unexpected AddBA Req from "
 902                                 "%pM on tid %u\n",
 903                                 mgmt->sa, tid);
 904 #endif /* CONFIG_MAC80211_HT_DEBUG */
 905                 goto end;
 906         }
 907
 908         /* prepare A-MPDU MLME for Rx aggregation */
 909         sta->ampdu_mlme.tid_rx[tid] =
 910                         kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
 911         if (!sta->ampdu_mlme.tid_rx[tid]) {
 912 #ifdef CONFIG_MAC80211_HT_DEBUG
 913                 if (net_ratelimit())
 914                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
 915                                         tid);
 916 #endif
 917                 goto end;
 918         }
 919         /* rx timer */
 920         sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
 921                                 sta_rx_agg_session_timer_expired;
 922         sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
 923                                 (unsigned long)&sta->timer_to_tid[tid];
 924         init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
 925
 926         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
 927
 928         /* prepare reordering buffer */
 929         tid_agg_rx->reorder_buf =
 930                 kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
 931         if (!tid_agg_rx->reorder_buf) {
 932 #ifdef CONFIG_MAC80211_HT_DEBUG
 933                 if (net_ratelimit())
 934                         printk(KERN_ERR "can not allocate reordering buffer "
 935                                "to tid %d\n", tid);
 936 #endif
 937                 kfree(sta->ampdu_mlme.tid_rx[tid]);
 938                 goto end;
 939         }
 940         memset(tid_agg_rx->reorder_buf, 0,
 941                 buf_size * sizeof(struct sk_buff *));
 942
 943         if (local->ops->ampdu_action)
 944                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
 945                                                &sta->sta, tid, &start_seq_num);
 946 #ifdef CONFIG_MAC80211_HT_DEBUG
 947         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
 948 #endif /* CONFIG_MAC80211_HT_DEBUG */
 949
 950         if (ret) {
 951                 kfree(tid_agg_rx->reorder_buf);
 952                 kfree(tid_agg_rx);
 953                 sta->ampdu_mlme.tid_rx[tid] = NULL;
 954                 goto end;
 955         }
 956
 957         /* change state and send addba resp */
 958         sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
 959         tid_agg_rx->dialog_token = dialog_token;
 960         tid_agg_rx->ssn = start_seq_num;
 961         tid_agg_rx->head_seq_num = start_seq_num;
 962         tid_agg_rx->buf_size = buf_size;
 963         tid_agg_rx->timeout = timeout;
 964         tid_agg_rx->stored_mpdu_num = 0;
 965         status = WLAN_STATUS_SUCCESS;
 966 end:
 967         spin_unlock_bh(&sta->lock);
 968
 969 end_no_lock:
 970         ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
 971                                   dialog_token, status, 1, buf_size, timeout);
 972 }
 973
 974 void ieee80211_process_addba_resp(struct ieee80211_local *local,
 975                                   struct sta_info *sta,
 976                                   struct ieee80211_mgmt *mgmt,
 977                                   size_t len)
 978 {
 979         struct ieee80211_hw *hw = &local->hw;
 980         u16 capab;
 981         u16 tid;
 982         u8 *state;
 983
 984         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
 985         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
 986
 987         state = &sta->ampdu_mlme.tid_state_tx[tid];
 988
 989         spin_lock_bh(&sta->lock);
 990
 991         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
 992                 spin_unlock_bh(&sta->lock);
 993                 return;
 994         }
 995
 996         if (mgmt->u.action.u.addba_resp.dialog_token !=
 997                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
 998                 spin_unlock_bh(&sta->lock);
 999 #ifdef CONFIG_MAC80211_HT_DEBUG
1000                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
1001 #endif /* CONFIG_MAC80211_HT_DEBUG */
1002                 return;
1003         }
1004
1005         del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
1006 #ifdef CONFIG_MAC80211_HT_DEBUG
1007         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
1008 #endif /* CONFIG_MAC80211_HT_DEBUG */
1009         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
1010                         == WLAN_STATUS_SUCCESS) {
1011                 *state |= HT_ADDBA_RECEIVED_MSK;
1012                 sta->ampdu_mlme.addba_req_num[tid] = 0;
1013
1014                 if (*state == HT_AGG_STATE_OPERATIONAL)
1015                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
1016
1017                 spin_unlock_bh(&sta->lock);
1018         } else {
1019                 sta->ampdu_mlme.addba_req_num[tid]++;
1020                 /* this will allow the state check in stop_BA_session */
1021                 *state = HT_AGG_STATE_OPERATIONAL;
1022                 spin_unlock_bh(&sta->lock);
1023                 ieee80211_stop_tx_ba_session(hw, sta->sta.addr, tid,
1024                                              WLAN_BACK_INITIATOR);
1025         }
1026 }
1027
1028 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
1029                              struct sta_info *sta,
1030                              struct ieee80211_mgmt *mgmt, size_t len)
1031 {
1032         struct ieee80211_local *local = sdata->local;
1033         u16 tid, params;
1034         u16 initiator;
1035
1036         params = le16_to_cpu(mgmt->u.action.u.delba.params);
1037         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
1038         initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
1039
1040 #ifdef CONFIG_MAC80211_HT_DEBUG
1041         if (net_ratelimit())
1042                 printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
1043                         mgmt->sa, initiator ? "initiator" : "recipient", tid,
1044                         mgmt->u.action.u.delba.reason_code);
1045 #endif /* CONFIG_MAC80211_HT_DEBUG */
1046
1047         if (initiator == WLAN_BACK_INITIATOR)
1048                 ieee80211_sta_stop_rx_ba_session(sdata, sta->sta.addr, tid,
1049                                                  WLAN_BACK_INITIATOR, 0);
1050         else { /* WLAN_BACK_RECIPIENT */
1051                 spin_lock_bh(&sta->lock);
1052                 sta->ampdu_mlme.tid_state_tx[tid] =
1053                                 HT_AGG_STATE_OPERATIONAL;
1054                 spin_unlock_bh(&sta->lock);
1055                 ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid,
1056                                              WLAN_BACK_RECIPIENT);
1057         }
1058 }