17 files changed, 56 insertions, 24 deletions

diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 32bf79e6a320..a9111e1161fd 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -1945,7 +1945,8 @@ static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                enum ieee80211_ampdu_mlme_action action,
-                               struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+                               struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                               u8 buf_size)
 {
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 187af5b4440d..f14f37d29f45 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1549,7 +1549,7 @@ static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif,
                                   enum ieee80211_ampdu_mlme_action action,
                                   struct ieee80211_sta *sta,
-                                  u16 tid, u16 *ssn)
+                                  u16 tid, u16 *ssn, u8 buf_size)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath9k_htc_sta *ista;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 174c016ef89d..c03184e7bffe 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2165,7 +2165,7 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif,
                               enum ieee80211_ampdu_mlme_action action,
                               struct ieee80211_sta *sta,
-                              u16 tid, u16 *ssn)
+                              u16 tid, u16 *ssn, u8 buf_size)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 870df8c42622..ecfb80b059d1 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1279,7 +1279,7 @@ static int carl9170_op_ampdu_action(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     enum ieee80211_ampdu_mlme_action action,
                                     struct ieee80211_sta *sta,
-                                    u16 tid, u16 *ssn)
+                                    u16 tid, u16 *ssn, u8 buf_size)
 {
         struct ar9170 *ar = hw->priv;
         struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 36335b1b54d4..8b045a401d62 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3393,7 +3393,8 @@ int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
                             enum ieee80211_ampdu_mlme_action action,
-                            struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                            u8 buf_size)
 {
         struct iwl_priv *priv = hw->priv;
         int ret = -EINVAL;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index da303585f801..822221a97e80 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -349,7 +349,8 @@ void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
 int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
                             enum ieee80211_ampdu_mlme_action action,
-                            struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                            u8 buf_size);
 int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 454f045ddff3..5d39b2840584 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -943,7 +943,8 @@ static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        enum ieee80211_ampdu_mlme_action action,
-                                       struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+                                       struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                                       u8 buf_size)
 {
         switch (action) {
         case IEEE80211_AMPDU_TX_START:
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 809f2bf27958..106b427d0064 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -4356,7 +4356,8 @@ static int mwl8k_get_survey(struct ieee80211_hw *hw, int idx,
 static int
 mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                    enum ieee80211_ampdu_mlme_action action,
-                   struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+                   struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                   u8 buf_size)
 {
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index a25be625ee90..f8ba01cbc6dd 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3533,7 +3533,8 @@ EXPORT_SYMBOL_GPL(rt2800_get_tsf);
 
 int rt2800_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum ieee80211_ampdu_mlme_action action,
-                        struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+                        struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                        u8 buf_size)
 {
         int ret = 0;
 
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index e3c995a9dec4..3efafb78ff77 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -198,7 +198,8 @@ int rt2800_conf_tx(struct ieee80211_hw *hw, u16 queue_idx,
 u64 rt2800_get_tsf(struct ieee80211_hw *hw);
 int rt2800_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum ieee80211_ampdu_mlme_action action,
-                        struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+                        struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                        u8 buf_size);
 int rt2800_get_survey(struct ieee80211_hw *hw, int idx,
                       struct survey_info *survey);
 
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index d6a924a05654..25d2d667ffba 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -748,7 +748,8 @@ static void rtl_op_sta_notify(struct ieee80211_hw *hw,
 static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                enum ieee80211_ampdu_mlme_action action,
-                               struct ieee80211_sta *sta, u16 tid, u16 * ssn)
+                               struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                               u8 buf_size)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index d024fc563e7b..5afe341b4010 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1731,6 +1731,10 @@ enum ieee80211_ampdu_mlme_action {
  *      ieee80211_ampdu_mlme_action. Starting sequence number (@ssn)
  *      is the first frame we expect to perform the action on. Notice
  *      that TX/RX_STOP can pass NULL for this parameter.
+ *      The @buf_size parameter is only valid when the action is set to
+ *      %IEEE80211_AMPDU_TX_OPERATIONAL and indicates the peer's reorder
+ *      buffer size (number of subframes) for this session -- aggregates
+ *      containing more subframes than this may not be transmitted to the peer.
  *      Returns a negative error code on failure.
  *      The callback can sleep.
  *
@@ -1833,7 +1837,8 @@ struct ieee80211_ops {
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
                             enum ieee80211_ampdu_mlme_action action,
-                            struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                            u8 buf_size);
         int (*get_survey)(struct ieee80211_hw *hw, int idx,
                 struct survey_info *survey);
         void (*rfkill_poll)(struct ieee80211_hw *hw);
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 002db5e86eb6..1f51f4162426 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -76,7 +76,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
-                             &sta->sta, tid, NULL))
+                             &sta->sta, tid, NULL, 0))
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggregation for tid %d\n", tid);
 
@@ -297,7 +297,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         }
 
         ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
-                               &sta->sta, tid, &start_seq_num);
+                               &sta->sta, tid, &start_seq_num, 0);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9cc472c6a6a5..42f7c9007331 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -190,7 +190,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         ret = drv_ampdu_action(local, sta->sdata,
                                IEEE80211_AMPDU_TX_STOP,
-                               &sta->sta, tid, NULL);
+                               &sta->sta, tid, NULL, 0);
 
         /* HW shall not deny going back to legacy */
         if (WARN_ON(ret)) {
@@ -311,7 +311,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
         start_seq_num = sta->tid_seq[tid] >> 4;
 
         ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
-                               &sta->sta, tid, &start_seq_num);
+                               &sta->sta, tid, &start_seq_num, 0);
         if (ret) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
@@ -487,7 +487,8 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
 
         drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
-                         &sta->sta, tid, NULL);
+                         &sta->sta, tid, NULL,
+                         sta->ampdu_mlme.tid_tx[tid]->buf_size);
 
         /*
          * synchronize with TX path, while splicing the TX path
@@ -742,9 +743,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 {
         struct tid_ampdu_tx *tid_tx;
         u16 capab, tid;
+        u8 buf_size;
 
         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
 
         mutex_lock(&sta->ampdu_mlme.mtx);
 
@@ -767,12 +770,23 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
+                /*
+                 * IEEE 802.11-2007 7.3.1.14:
+                 * In an ADDBA Response frame, when the Status Code field
+                 * is set to 0, the Buffer Size subfield is set to a value
+                 * of at least 1.
+                 */
+                if (!buf_size)
+                        goto out;
+
                 if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
                                      &tid_tx->state)) {
                         /* ignore duplicate response */
                         goto out;
                 }
 
+                tid_tx->buf_size = buf_size;
+
                 if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
                         ieee80211_agg_tx_operational(local, sta, tid);
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 98d589960a49..78af32d4bc58 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -382,17 +382,17 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
                                    struct ieee80211_sub_if_data *sdata,
                                    enum ieee80211_ampdu_mlme_action action,
                                    struct ieee80211_sta *sta, u16 tid,
-                                   u16 *ssn)
+                                   u16 *ssn, u8 buf_size)
 {
         int ret = -EOPNOTSUPP;
 
         might_sleep();
 
-        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn);
+        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, buf_size);
 
         if (local->ops->ampdu_action)
                 ret = local->ops->ampdu_action(&local->hw, &sdata->vif, action,
-                                               sta, tid, ssn);
+                                               sta, tid, ssn, buf_size);
 
         trace_drv_return_int(local, ret);
 
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 49c84218b2f4..fbabbc2f181a 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -784,9 +784,9 @@ TRACE_EVENT(drv_ampdu_action,
                  struct ieee80211_sub_if_data *sdata,
                  enum ieee80211_ampdu_mlme_action action,
                  struct ieee80211_sta *sta, u16 tid,
-                 u16 *ssn),
+                 u16 *ssn, u8 buf_size),
 
-        TP_ARGS(local, sdata, action, sta, tid, ssn),
+        TP_ARGS(local, sdata, action, sta, tid, ssn, buf_size),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -794,6 +794,7 @@ TRACE_EVENT(drv_ampdu_action,
                 __field(u32, action)
                 __field(u16, tid)
                 __field(u16, ssn)
+                __field(u8, buf_size)
                 VIF_ENTRY
         ),
 
@@ -804,11 +805,13 @@ TRACE_EVENT(drv_ampdu_action,
                 __entry->action = action;
                 __entry->tid = tid;
                 __entry->ssn = ssn ? *ssn : 0;
+                __entry->buf_size = buf_size;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid
+                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d buf:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action,
+                __entry->tid, __entry->buf_size
         )
 );
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index bbdd2a86a94b..ca0b69060ef7 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -82,6 +82,7 @@ enum ieee80211_sta_info_flags {
  * @state: session state (see above)
  * @stop_initiator: initiator of a session stop
  * @tx_stop: TX DelBA frame when stopping
+ * @buf_size: reorder buffer size at receiver
  *
  * This structure's lifetime is managed by RCU, assignments to
  * the array holding it must hold the aggregation mutex.
@@ -101,6 +102,7 @@ struct tid_ampdu_tx {
         u8 dialog_token;
         u8 stop_initiator;
         bool tx_stop;
+        u8 buf_size;
 };
 
 /**