5 files changed, 20 insertions, 14 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index f0e84bc48038..a48bad468880 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -227,7 +227,7 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
 void __ieee80211_start_rx_ba_session(struct sta_info *sta,
                                      u8 dialog_token, u16 timeout,
                                      u16 start_seq_num, u16 ba_policy, u16 tid,
-                                     u16 buf_size, bool tx)
+                                     u16 buf_size, bool tx, bool auto_seq)
 {
         struct ieee80211_local *local = sta->sdata->local;
         struct tid_ampdu_rx *tid_agg_rx;
@@ -326,6 +326,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
         tid_agg_rx->buf_size = buf_size;
         tid_agg_rx->timeout = timeout;
         tid_agg_rx->stored_mpdu_num = 0;
+        tid_agg_rx->auto_seq = auto_seq;
         status = WLAN_STATUS_SUCCESS;
 
         /* activate it for RX */
@@ -367,7 +368,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         __ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
                                         start_seq_num, ba_policy, tid,
-                                        buf_size, true);
+                                        buf_size, true, false);
 }
 
 void ieee80211_start_rx_ba_session_offl(struct ieee80211_vif *vif,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ffb20e5e6cf3..8fe5433f0d35 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1587,7 +1587,7 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 void __ieee80211_start_rx_ba_session(struct sta_info *sta,
                                      u8 dialog_token, u16 timeout,
                                      u16 start_seq_num, u16 ba_policy, u16 tid,
-                                     u16 buf_size, bool tx);
+                                     u16 buf_size, bool tx, bool auto_seq);
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
                                          enum ieee80211_agg_stop_reason reason);
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 01eede7406a5..bb7288e3c41c 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1172,19 +1172,11 @@ static void ieee80211_iface_work(struct work_struct *work)
                         rx_agg = (void *)&skb->cb;
                         mutex_lock(&local->sta_mtx);
                         sta = sta_info_get_bss(sdata, rx_agg->addr);
-                        if (sta) {
-                                u16 last_seq;
-
-                                last_seq = le16_to_cpu(
-                                        sta->last_seq_ctrl[rx_agg->tid]);
-
+                        if (sta)
                                 __ieee80211_start_rx_ba_session(sta,
-                                                0, 0,
-                                                ieee80211_sn_inc(last_seq),
-                                                1, rx_agg->tid,
+                                                0, 0, 0, 1, rx_agg->tid,
                                                 IEEE80211_MAX_AMPDU_BUF,
-                                                false);
-                        }
+                                                false, true);
                         mutex_unlock(&local->sta_mtx);
                 } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_STOP) {
                         rx_agg = (void *)&skb->cb;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index a8d862f9183c..41eb12c87240 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -835,6 +835,16 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
 
         spin_lock(&tid_agg_rx->reorder_lock);
 
+        /*
+         * Offloaded BA sessions have no known starting sequence number so pick
+         * one from first Rxed frame for this tid after BA was started.
+         */
+        if (unlikely(tid_agg_rx->auto_seq)) {
+                tid_agg_rx->auto_seq = false;
+                tid_agg_rx->ssn = mpdu_seq_num;
+                tid_agg_rx->head_seq_num = mpdu_seq_num;
+        }
+
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 89c40d5c0633..16dc1d414f69 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -167,6 +167,8 @@ struct tid_ampdu_tx {
  * @dialog_token: dialog token for aggregation session
  * @rcu_head: RCU head used for freeing this struct
  * @reorder_lock: serializes access to reorder buffer, see below.
+ * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
+ *      and ssn.
  *
  * This structure's lifetime is managed by RCU, assignments to
  * the array holding it must hold the aggregation mutex.
@@ -190,6 +192,7 @@ struct tid_ampdu_rx {
         u16 buf_size;
         u16 timeout;
         u8 dialog_token;
+        bool auto_seq;
 };
 
 /**