package/kernel/mac80211/patches/300-pending_work.patch

   1 commit 228ee4473b89118993c17ead26381c490c44f9fb
   2 Author: Felix Fietkau <nbd@openwrt.org>
   3 Date:   Sun Nov 30 20:34:16 2014 +0100
   4
   5     ath9k: fix BE/BK queue order
   6
   7     Hardware queues are ordered by priority. Use queue index 0 for BK, which
   8     has lower priority than BE.
   9
  10     Cc: stable@vger.kernel.org
  11     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  12
  13 commit cae76a90c891c5f96895b9628060449e3deb08c6
  14 Author: Felix Fietkau <nbd@openwrt.org>
  15 Date:   Sun Nov 30 20:30:46 2014 +0100
  16
  17     ath9k_hw: fix hardware queue allocation
  18
  19     The driver passes the desired hardware queue index for a WMM data queue
  20     in qinfo->tqi_subtype. This was ignored in ath9k_hw_setuptxqueue, which
  21     instead relied on the order in which the function is called.
  22
  23     Cc: stable@vger.kernel.org
  24     Reported-by: Hubert Feurstein <h.feurstein@gmail.com>
  25     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  26
  27 commit 77980bee5f1f743b46f8749185aca28b8ec69741
  28 Author: Johannes Berg <johannes.berg@intel.com>
  29 Date:   Mon Nov 3 14:29:09 2014 +0100
  30
  31     mac80211: fix use-after-free in defragmentation
  32
  33     Upon receiving the last fragment, all but the first fragment
  34     are freed, but the multicast check for statistics at the end
  35     of the function refers to the current skb (the last fragment)
  36     causing a use-after-free bug.
  37
  38     Since multicast frames cannot be fragmented and we check for
  39     this early in the function, just modify that check to also
  40     do the accounting to fix the issue.
  41
  42     Cc: stable@vger.kernel.org
  43     Reported-by: Yosef Khyal <yosefx.khyal@intel.com>
  44     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  45
  46 commit e252be2d718dada0abd72208a44b9f1b63919883
  47 Author: Hauke Mehrtens <hauke@hauke-m.de>
  48 Date:   Wed Nov 5 23:31:07 2014 +0100
  49
  50     b43: fix NULL pointer dereference in b43_phy_copy()
  51
  52     phy_read and phy_write are not set for every phy any more sine this:
  53     commit d342b95dd735014a590f9051b1ba227eb54ca8f6
  54     Author: RafaÅ‚ MiÅ‚ecki <zajec5@gmail.com>
  55     Date:   Thu Jul 31 21:59:43 2014 +0200
  56
  57         b43: don't duplicate common PHY read/write ops
  58
  59     b43_phy_copy() accesses phy_read and phy_write directly and will fail
  60     with some phys. This patch fixes the regression by using the
  61     b43_phy_read() and b43_phy_write() functions which should be used for
  62     read and write access.
  63
  64     This should fix this bug report:
  65     https://bugzilla.kernel.org/show_bug.cgi?id=87731
  66
  67     Reported-by: Volker Kempter <v.kempter@pe.tu-clausthal.de>
  68     Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  69
  70 commit ddf93ad61cb009ed05ff2547923fb269a3604408
  71 Author: Miaoqing Pan <miaoqing@qca.qualcomm.com>
  72 Date:   Thu Nov 6 10:52:23 2014 +0530
  73
  74     ath9k: Fix RTC_DERIVED_CLK usage
  75
  76     Based on the reference clock, which could be 25MHz or 40MHz,
  77     AR_RTC_DERIVED_CLK is programmed differently for AR9340 and AR9550.
  78     But, when a chip reset is done, processing the initvals
  79     sets the register back to the default value.
  80
  81     Fix this by moving the code in ath9k_hw_init_pll() to
  82     ar9003_hw_override_ini(). Also, do this override for AR9531.
  83
  84     Cc: stable@vger.kernel.org
  85     Signed-off-by: Miaoqing Pan <miaoqing@qca.qualcomm.com>
  86     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
  87
  88 commit 536b05e91ac2715942f792184c26beb43dbaa522
  89 Author: Felix Fietkau <nbd@openwrt.org>
  90 Date:   Mon Oct 27 11:50:28 2014 +0100
  91
  92     mac80211: flush keys for AP mode on ieee80211_do_stop
  93
  94     Userspace can add keys to an AP mode interface before start_ap has been
  95     called. If there have been no calls to start_ap/stop_ap in the mean
  96     time, the keys will still be around when the interface is brought down.
  97
  98     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  99
 100 commit c35074725eb19f353beb5f71266f9e985e46f583
 101 Author: Felix Fietkau <nbd@openwrt.org>
 102 Date:   Wed Oct 22 18:16:14 2014 +0200
 103
 104     ath9k_common: always update value in ath9k_cmn_update_txpow
 105
 106     In some cases the limit may be the same as reg->power_limit, but the
 107     actual value that the hardware uses is not up to date. In that case, a
 108     wrong value for current tx power is tracked internally.
 109     Fix this by unconditionally updating it.
 110
 111     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 112
 113 commit 11f17631d9bf2a9e910dac7d09ba4581f5693831
 114 Author: Felix Fietkau <nbd@openwrt.org>
 115 Date:   Tue Sep 9 09:48:30 2014 +0200
 116
 117     ath9k_hw: fix PLL clock initialization for newer SoC
 118
 119     On AR934x and newer SoC devices, the layout of the AR_RTC_PLL_CONTROL
 120     register changed. This currently breaks at least 5/10 MHz operation.
 121     AR933x uses the old layout.
 122
 123     It might also have been causing other stability issues because of the
 124     different location of the PLL_BYPASS bit which needs to be set during
 125     PLL clock initialization.
 126
 127     This patch also removes more instances of hardcoded register values in
 128     favor of properly computed ones with the PLL_BYPASS bit added.
 129
 130     Reported-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
 131     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 132
 133 commit 0fecedddd4a0945873db1bd230ec6a168b3cc4fe
 134 Author: Felix Fietkau <nbd@openwrt.org>
 135 Date:   Mon Sep 8 18:35:08 2014 +0200
 136
 137     ath9k_hw: reduce ANI spur immunity setting on HT40 extension channel
 138
 139     The cycpwr_thr1 value needs to be lower on the extension channel than on
 140     the control channel, similar to how the register settings are programmed
 141     in the initvals.
 142
 143     Also drop the unnecessary check for HT40 - this register can always be
 144     written. This patch has been reported to improve HT40 stability and
 145     throughput in some environments.
 146
 147     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 148
 149 commit 30d7434ccb853b96de698a040888fa4dacd0cc19
 150 Author: Felix Fietkau <nbd@openwrt.org>
 151 Date:   Mon Sep 8 18:31:26 2014 +0200
 152
 153     Revert "ath9k_hw: reduce ANI firstep range for older chips"
 154
 155     This reverts commit 09efc56345be4146ab9fc87a55c837ed5d6ea1ab
 156
 157     I've received reports that this change is decreasing throughput in some
 158     rare conditions on an AR9280 based device
 159
 160     Cc: stable@vger.kernel.org
 161     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 162
 163 commit 15ed54948f508ad1baad79c30050e2d29a21696d
 164 Author: Felix Fietkau <nbd@openwrt.org>
 165 Date:   Fri Jul 25 16:18:03 2014 +0200
 166
 167     mac80211: fix smps mode check for AP_VLAN
 168
 169     In ieee80211_sta_ps_deliver_wakeup, sdata->smps_mode is checked. This is
 170     initialized only for the base AP interface, not the individual VLANs.
 171
 172     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 173
 174 commit bc74ad816bba291359ae46301173ea744bdda9d2
 175 Author: Felix Fietkau <nbd@openwrt.org>
 176 Date:   Fri Jul 25 16:15:44 2014 +0200
 177
 178     mac80211: ignore AP_VLAN in ieee80211_recalc_chanctx_chantype
 179
 180     When bringing down the AP, a WARN_ON is hit because the bss config chandef
 181     is empty here.
 182     Since AP_VLAN channel settings do not matter for anything chanctx related
 183     (always inherits the settings from the AP interface), let's just ignore
 184     it here.
 185
 186     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 187
 188 commit ff354dbdd743e5fe186df8cd17982db19f78231a
 189 Author: Felix Fietkau <nbd@openwrt.org>
 190 Date:   Wed Jul 23 15:33:26 2014 +0200
 191
 192     ath9k: fix aggregation session lockup
 193
 194     If an aggregation session fails, frames still end up in the driver queue
 195     with IEEE80211_TX_CTL_AMPDU set.
 196     This causes tx for the affected station/tid to stall, since
 197     ath_tx_get_tid_subframe returning packets to send.
 198
 199     Fix this by clearing IEEE80211_TX_CTL_AMPDU as long as no aggregation
 200     session is running.
 201
 202     Cc: stable@vger.kernel.org
 203     Reported-by: Antonio Quartulli <antonio@open-mesh.com>
 204     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 205
 206 commit 38695a6e5a940e6a524523b88a33916b016fb2a1
 207 Author: Felix Fietkau <nbd@openwrt.org>
 208 Date:   Fri Jul 11 12:06:18 2014 +0200
 209
 210     mac80211: fix crash on getting sta info with uninitialized rate control
 211
 212     If the expected throughput is queried before rate control has been
 213     initialized, the minstrel op for it will crash while trying to access
 214     the rate table.
 215     Check for WLAN_STA_RATE_CONTROL before attempting to use the rate
 216     control op.
 217
 218     Reported-by: Jean-Pierre Tosoni <jp.tosoni@acksys.fr>
 219     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 220
 221 commit c0ee7fa4c0da824ccccc172bf175fb1f86540921
 222 Author: Felix Fietkau <nbd@openwrt.org>
 223 Date:   Wed Jul 16 18:00:31 2014 +0200
 224
 225     ath9k: fix pending tx frames accounting
 226
 227     Packets originally buffered for the regular hardware tx queues can end
 228     up being transmitted through the U-APSD queue (via PS-Poll or U-APSD).
 229     When packets are dropped due to retransmit failures, the pending frames
 230     counter is not always updated properly.
 231     Fix this by keeping track of the queue that a frame was accounted for in
 232     the ath_frame_info struct, and using that on completion to decide
 233     whether the counter should be updated.
 234     This fixes some spurious transmit queue hangs.
 235
 236     Cc: stable@vger.kernel.org
 237     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 238
 239 commit edcdf0989410a05a6a4b8438df4010447eaa7d9a
 240 Author: Felix Fietkau <nbd@openwrt.org>
 241 Date:   Sun Jun 22 13:36:20 2014 +0200
 242
 243     Revert "cfg80211: Use 5MHz bandwidth by default when checking usable channels"
 244
 245     It enables channels that are not supposed to be enabled according to the
 246     regulatory rules.
 247
 248     This reverts commit 8eca1fb692cc9557f386eddce75c300a3855d11a.
 249
 250 commit 6e7341074823d2a45b81f2742cbf75f1da790031
 251 Author: Rafał Miłecki <zajec5@gmail.com>
 252 Date:   Sat May 31 19:40:45 2014 +0200
 253
 254     b43: disable 5 GHz on G-PHY
 255
 256     This fixes regression introduced by adding some G-PHY devices to the
 257     list of dual band devices. There is simply no support for 5 GHz on
 258     G-PHY devices in b43. It results in:
 259     WARNING: CPU: 0 PID: 79 at drivers/net/wireless/b43/phy_g.c:75 b43_gphy_channel_switch+0x125/0x130 [b43]()
 260     b43-phy1 ERROR: PHY init: Channel switch to default failed
 261
 262     Regression was introduced by the following commit:
 263
 264     commit 773cfc508f4d64c14547ff8751b5cbd473124364
 265     Author: Rafał Miłecki <zajec5@gmail.com>
 266     Date:   Mon May 19 23:18:55 2014 +0200
 267
 268         b43: add more devices to the bands database
 269
 270     Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 271     Signed-off-by: John W. Linville <linville@tuxdriver.com>
 272
 273 commit 1186edbef91f15722e5bdf56326ce0abc2935ce7
 274 Author: Stanislaw Gruszka <sgruszka@redhat.com>
 275 Date:   Tue Jun 10 12:51:06 2014 +0200
 276
 277     rt2x00: disable TKIP on USB
 278
 279     On USB we can not get atomically TKIP key. We have to disable support
 280     for TKIP acceleration on USB hardware to avoid bug as showed bellow.
 281
 282     [  860.827243] BUG: scheduling while atomic: hostapd/3397/0x00000002
 283     <snip>
 284     [  860.827280] Call Trace:
 285     [  860.827282]  [<ffffffff81682ea6>] dump_stack+0x4d/0x66
 286     [  860.827284]  [<ffffffff8167eb9b>] __schedule_bug+0x47/0x55
 287     [  860.827285]  [<ffffffff81685bb3>] __schedule+0x733/0x7b0
 288     [  860.827287]  [<ffffffff81685c59>] schedule+0x29/0x70
 289     [  860.827289]  [<ffffffff81684f8a>] schedule_timeout+0x15a/0x2b0
 290     [  860.827291]  [<ffffffff8105ac50>] ? ftrace_raw_event_tick_stop+0xc0/0xc0
 291     [  860.827294]  [<ffffffff810c13c2>] ? __module_text_address+0x12/0x70
 292     [  860.827296]  [<ffffffff81686823>] wait_for_completion_timeout+0xb3/0x140
 293     [  860.827298]  [<ffffffff81080fc0>] ? wake_up_state+0x20/0x20
 294     [  860.827301]  [<ffffffff814d5b3d>] usb_start_wait_urb+0x7d/0x150
 295     [  860.827303]  [<ffffffff814d5cd5>] usb_control_msg+0xc5/0x110
 296     [  860.827305]  [<ffffffffa02fb0c6>] rt2x00usb_vendor_request+0xc6/0x160  [rt2x00usb]
 297     [  860.827307]  [<ffffffffa02fb215>] rt2x00usb_vendor_req_buff_lock+0x75/0x150 [rt2x00usb]
 298     [  860.827309]  [<ffffffffa02fb393>] rt2x00usb_vendor_request_buff+0xa3/0xe0 [rt2x00usb]
 299     [  860.827311]  [<ffffffffa023d1a3>] rt2x00usb_register_multiread+0x33/0x40 [rt2800usb]
 300     [  860.827314]  [<ffffffffa05805f9>] rt2800_get_tkip_seq+0x39/0x50  [rt2800lib]
 301     [  860.827321]  [<ffffffffa0480f88>] ieee80211_get_key+0x218/0x2a0  [mac80211]
 302     [  860.827322]  [<ffffffff815cc68c>] ? __nlmsg_put+0x6c/0x80
 303     [  860.827329]  [<ffffffffa051b02e>] nl80211_get_key+0x22e/0x360 [cfg80211]
 304
 305     Cc: stable@vger.kernel.org
 306     Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
 307     Reported-and-tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
 308     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 309     Signed-off-by: John W. Linville <linville@tuxdriver.com>
 310
 311 commit 5f313a15da92dda80ac4c9a137bc42d7d0b49adf
 312 Author: Rafał Miłecki <zajec5@gmail.com>
 313 Date:   Thu Jun 12 09:28:38 2014 +0200
 314
 315     b43: fix frequency reported on G-PHY with /new/ firmware
 316
 317 commit d3a58df87a2e4c2301ac843604202d290a48440b
 318 Author: Avraham Stern <avraham.stern@intel.com>
 319 Date:   Thu May 22 12:17:47 2014 +0300
 320
 321     mac80211: set new interfaces as idle upon init
 322
 323     Mark new interfaces as idle to allow operations that require that
 324     interfaces are idle to take place. Interface types that are always
 325     not idle (like AP interfaces) will be set as not idle when they are
 326     assigned a channel context.
 327
 328     Signed-off-by: Avraham Stern <avraham.stern@intel.com>
 329     Signed-off-by: Emmanuel Grumbach<emmanuel.grumbach@intel.com>
 330     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 331
 332 commit 923eaf367206e01f22c97aee22300e332d071916
 333 Author: Arik Nemtsov <arik@wizery.com>
 334 Date:   Mon May 26 14:40:51 2014 +0300
 335
 336     mac80211: don't check netdev state for debugfs read/write
 337
 338     Doing so will lead to an oops for a p2p-dev interface, since it has
 339     no netdev.
 340
 341     Cc: stable@vger.kernel.org
 342     Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
 343     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 344     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 345
 346 commit a9fb54169b197f31aff24c8d6270dd1e56cde395
 347 Author: chaitanya.mgit@gmail.com <chaitanya.mgit@gmail.com>
 348 Date:   Mon May 26 18:01:44 2014 +0530
 349
 350     regdb: Generalize the mW to dBm power conversion
 351
 352     Generalize the power conversion from mW to dBm
 353     using log. This should fix the below compilation
 354     error for country NO which adds a new power value
 355     2000mW which is not handled earlier.
 356
 357      CC [M]  net/wireless/wext-sme.o
 358      CC [M]  net/wireless/regdb.o
 359     net/wireless/regdb.c:1130:1: error: Unknown undeclared here (not in
 360     a function)
 361     net/wireless/regdb.c:1130:9: error: expected } before power
 362     make[2]: *** [net/wireless/regdb.o] Error 1
 363     make[1]: *** [net/wireless] Error 2
 364     make: *** [net] Error 2
 365
 366     Reported-By:  John Walker <john@x109.net>
 367     Signed-off-by: Chaitanya T K <chaitanya.mgit@gmail.com>
 368     Acked-by: John W. Linville <linville@tuxdriver.com>
 369     [remove unneeded parentheses, fix rounding by using %.0f]
 370     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 371
 372 commit c7d37a66e345df2fdf1aa7b2c9a6d3d53846ca5b
 373 Author: Krzysztof Hałasa <khalasa@piap.pl>
 374 Date:   Mon May 26 14:14:46 2014 +0200
 375
 376     mac80211: fix IBSS join by initializing last_scan_completed
 377
 378     Without this fix, freshly rebooted Linux creates a new IBSS
 379     instead of joining an existing one. Only when jiffies counter
 380     overflows after 5 minutes the IBSS can be successfully joined.
 381
 382     Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
 383     [edit commit message slightly]
 384     Cc: stable@vger.kernel.org
 385     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 386
 387 commit 34171dc0d623be2c1032416bf7d3819f388ed70d
 388 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 389 Date:   Sun May 25 15:35:41 2014 +0300
 390
 391     mac80211: fix virtual monitor interface addition
 392
 393     Since the commit below, cfg80211_chandef_dfs_required()
 394     will warn if it gets a an NL80211_IFTYPE_UNSPECIFIED iftype
 395     as explicitely written in the commit log.
 396     When an virtual monitor interface is added, its type is set
 397     in ieee80211_sub_if_data.vif.type, but not in
 398     ieee80211_sub_if_data.wdev.iftype which is passed to
 399     cfg80211_chandef_dfs_required() hence resulting in the
 400     following warning:
 401
 402     WARNING: CPU: 1 PID: 21265 at net/wireless/chan.c:376 cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]()
 403     Modules linked in: [...]
 404     CPU: 1 PID: 21265 Comm: ifconfig Tainted: G        W  O 3.13.11+ #12
 405     Hardware name: Dell Inc. Latitude E6410/0667CC, BIOS A01 03/05/2010
 406      0000000000000009 ffff88008f5fdb08 ffffffff817d4219 ffff88008f5fdb50
 407      ffff88008f5fdb40 ffffffff8106f57d 0000000000000000 0000000000000000
 408      ffff880081062fb8 ffff8800810604e0 0000000000000001 ffff88008f5fdba0
 409     Call Trace:
 410      [<ffffffff817d4219>] dump_stack+0x4d/0x66
 411      [<ffffffff8106f57d>] warn_slowpath_common+0x7d/0xa0
 412      [<ffffffff8106f5ec>] warn_slowpath_fmt+0x4c/0x50
 413      [<ffffffffa04ea4ec>] cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]
 414      [<ffffffffa06b1024>] ieee80211_vif_use_channel+0x94/0x500 [mac80211]
 415      [<ffffffffa0684e6b>] ieee80211_add_virtual_monitor+0x1ab/0x5c0 [mac80211]
 416      [<ffffffffa0686ae5>] ieee80211_do_open+0xe75/0x1580 [mac80211]
 417      [<ffffffffa0687259>] ieee80211_open+0x69/0x70 [mac80211]
 418     [snip]
 419
 420     Fixes: 00ec75fc5a64 ("cfg80211: pass the actual iftype when calling cfg80211_chandef_dfs_required()")
 421     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 422     Acked-by: Luciano Coelho <luciano.coelho@intel.com>
 423     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 424
 425 commit d93cc72b37b4e2c314e1c499e80e8801907c2fea
 426 Author: Michal Kazior <michal.kazior@tieto.com>
 427 Date:   Thu Jun 5 14:21:37 2014 +0200
 428
 429     mac80211: use csa counter offsets instead of csa_active
 430
 431     vif->csa_active is protected by mutexes only. This
 432     means it is unreliable to depend on it on codeflow
 433     in non-sleepable beacon and CSA code. There was no
 434     guarantee to have vif->csa_active update be
 435     visible before beacons are updated on SMP systems.
 436
 437     Using csa counter offsets which are embedded in
 438     beacon struct (and thus are protected with single
 439     RCU assignment) is much safer.
 440
 441     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 442     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 443
 444 commit d2746694fcdef24e0a7a1947d8c70082cde81a26
 445 Author: Michal Kazior <michal.kazior@tieto.com>
 446 Date:   Thu Jun 5 14:21:36 2014 +0200
 447
 448     mac80211: move csa counters from sdata to beacon/presp
 449
 450     Having csa counters part of beacon and probe_resp
 451     structures makes it easier to get rid of possible
 452     races between setting a beacon and updating
 453     counters on SMP systems by guaranteeing counters
 454     are always consistent against given beacon struct.
 455
 456     While at it relax WARN_ON into WARN_ON_ONCE to
 457     prevent spamming logs and racing.
 458
 459     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 460     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 461
 462 commit 5dcb54f3a1a8cd7e0331e773487574f9743615db
 463 Author: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 464 Date:   Thu Jun 5 08:12:57 2014 +0200
 465
 466     mac80211: allow tx via monitor iface when DFS
 467
 468     Allow send frames using monitor interface
 469     when DFS chandef and we pass CAC (beaconing
 470     allowed).
 471
 472     This fix problem when old kernel and new backports used,
 473     in such case hostapd create/use also monitor interface.
 474     Before this patch all frames hostapd send using monitor
 475     iface were dropped when AP was configured on DFS channel.
 476
 477     Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 478     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 479
 480 commit 6f09a1beb0d2007572248c986780562219bd206f
 481 Author: Johannes Berg <johannes.berg@intel.com>
 482 Date:   Wed Jun 4 17:31:56 2014 +0200
 483
 484     cfg80211: make ethtool the driver's responsibility
 485
 486     Currently, cfg80211 tries to implement ethtool, but that doesn't
 487     really scale well, with all the different operations. Make the
 488     lower-level driver responsible for it, which currently only has
 489     an effect on mac80211. It will similarly not scale well at that
 490     level though, since mac80211 also has many drivers.
 491
 492     To cleanly implement this in mac80211, introduce a new file and
 493     move some code to appropriate places.
 494
 495     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 496
 497 commit 6b0c6f133de8f90caeb1c4a902e6140567c5bf96
 498 Author: Johannes Berg <johannes.berg@intel.com>
 499 Date:   Wed Jun 4 17:06:23 2014 +0200
 500
 501     mac80211: remove weak WEP IV accounting
 502
 503     Since WEP is practically dead, there seems very little
 504     point in keeping WEP weak IV accounting.
 505
 506     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 507
 508 commit aecdc89fb4664c76baa4bbd46008f220532309ff
 509 Author: Luciano Coelho <luciano.coelho@intel.com>
 510 Date:   Fri May 23 11:04:50 2014 +0300
 511
 512     ath9k/ath10k: remove unnecessary channel_switch_beacon callbacks
 513
 514     The channel_switch_beacon callback is optional, so it doesn't have to
 515     be defined if it's not going to do anything useful with it.  Both
 516     ath9k and ath10k define the callback and just returns.  This commit
 517     removes them.
 518
 519     Cc: Michal Kazior <michal.kazior@tieto.com>
 520     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 521     Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
 522
 523 commit 60ccc107c9b9fb732fdee1f76bb2dad44f0e1798
 524 Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
 525 Date:   Tue May 27 16:58:02 2014 +0530
 526
 527     ath9k: Fix deadlock while updating p2p beacon timer
 528
 529     pm_lock is taken twice while syncing HW TSF of p2p vif.
 530     Fix this by taking the lock at caller side.
 531
 532     Cc: Felix Fietkau <nbd@openwrt.org>
 533     Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
 534     Signed-off-by: John W. Linville <linville@tuxdriver.com>
 535
 536 commit f3831a4e3903dbc1a57d5df56deb6a143fd001bc
 537 Author: Stanislaw Gruszka <sgruszka@redhat.com>
 538 Date:   Thu Jun 5 13:52:27 2014 +0200
 539
 540     rt2x00: do not initialize BCN_OFFSET registers
 541
 542     We setup BCN_OFFSET{0,1} registers dynamically, don't have to
 543     initialize them.
 544
 545     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 546
 547 commit e5c58ca7a48d4c82f282749a978052c47fd95998
 548 Author: Stanislaw Gruszka <sgruszka@redhat.com>
 549 Date:   Thu Jun 5 13:52:26 2014 +0200
 550
 551     rt2x00: change order when stop beaconing
 552
 553     When no beaconing is needed, first stop beacon queue (disable beaconing
 554     globally) to avoid possible sending of not prepared beacon on short
 555     period after clearing beacon and before stop of BCN queue.
 556
 557     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 558
 559 commit 382c1b9e03f52d0cd741ef1d942cad0f649f0744
 560 Author: Stanislaw Gruszka <sgruszka@redhat.com>
 561 Date:   Thu Jun 5 13:52:25 2014 +0200
 562
 563     rt2x00: change default MAC_BSSID_DW1_BSS_BCN_NUM
 564
 565     We setup MAC_BSSID_DW1_BSS_BCN_NUM dynamically when numbers of active
 566     beacons increase. Change default to 0 to tell hardware that we want to
 567     send only one beacon as default.
 568
 569     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 570
 571 commit 3b400571dd033e46fa7e76c5bb92a3ce8198afa9
 572 Author: Stanislaw Gruszka <sgruszka@redhat.com>
 573 Date:   Thu Jun 5 13:52:24 2014 +0200
 574
 575     rt2x00: change beaconing setup on RT2800
 576
 577     As reported by Matthias, on 5572 chip, even if we clear up TXWI
 578     of corresponding beacon, hardware still try to send it or do other
 579     action that increase power consumption peak up to 1A.
 580
 581     To avoid the issue, setup beaconing dynamically by configuring offsets
 582     of currently active beacons and MAC_BSSID_DW1_BSS_BCN_NUM variable,
 583     which limit number of beacons that hardware will try to send.
 584
 585     Reported-by: Matthias Fend <Matthias.Fend@wolfvision.net>
 586     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 587
 588 commit 916e591b2cc41f7e572992175ca56d866d7bc958
 589 Author: Stanislaw Gruszka <sgruszka@redhat.com>
 590 Date:   Thu Jun 5 13:52:23 2014 +0200
 591
 592     rt2x00: change beaconing locking
 593
 594     This patch is needed for further changes to keep global variables
 595     consistent when changing beaconing on diffrent vif's.
 596
 597     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 598
 599 commit 930b0dffd1731f3f418f9132faea720a23b7af61
 600 Author: Johannes Berg <johannes.berg@intel.com>
 601 Date:   Tue Jun 3 11:18:47 2014 +0200
 602
 603     mac80211: fix station/driver powersave race
 604
 605     It is currently possible to have a race due to the station PS
 606     unblock work like this:
 607      * station goes to sleep with frames buffered in the driver
 608      * driver blocks wakeup
 609      * station wakes up again
 610      * driver flushes/returns frames, and unblocks, which schedules
 611        the unblock work
 612      * unblock work starts to run, and checks that the station is
 613        awake (i.e. that the WLAN_STA_PS_STA flag isn't set)
 614      * we process a received frame with PM=1, setting the flag again
 615      * ieee80211_sta_ps_deliver_wakeup() runs, delivering all frames
 616        to the driver, and then clearing the WLAN_STA_PS_DRIVER and
 617        WLAN_STA_PS_STA flags
 618
 619     In this scenario, mac80211 will think that the station is awake,
 620     while it really is asleep, and any TX'ed frames should be filtered
 621     by the device (it will know that the station is sleeping) but then
 622     passed to mac80211 again, which will not buffer it either as it
 623     thinks the station is awake, and eventually the packets will be
 624     dropped.
 625
 626     Fix this by moving the clearing of the flags to exactly where we
 627     learn about the situation. This creates a problem of reordering,
 628     so introduce another flag indicating that delivery is being done,
 629     this new flag also queues frames and is cleared only while the
 630     spinlock is held (which the queuing code also holds) so that any
 631     concurrent delivery/TX is handled correctly.
 632
 633     Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 634     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 635
 636 commit 6df35206bc6c1c6aad1d8077df5786b4a7f77873
 637 Author: Felix Fietkau <nbd@openwrt.org>
 638 Date:   Fri May 23 19:58:14 2014 +0200
 639
 640     mac80211: reduce packet loss notifications under load
 641
 642     During strong signal fluctuations under high throughput, few consecutive
 643     failed A-MPDU transmissions can easily trigger packet loss notification,
 644     and thus (in AP mode) client disconnection.
 645
 646     Reduce the number of false positives by checking the A-MPDU status flag
 647     and treating a failed A-MPDU as a single packet.
 648
 649     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 650
 651 commit 7b7843a36fbcc568834404c7430ff895d8502131
 652 Author: Felix Fietkau <nbd@openwrt.org>
 653 Date:   Fri May 23 19:26:32 2014 +0200
 654
 655     mac80211: fix a memory leak on sta rate selection table
 656
 657     Cc: stable@vger.kernel.org
 658     Reported-by: Christophe Prévotaux <cprevotaux@nltinc.com>
 659     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 660
 661 commit 96892d6aa0a153423070addf3070bc79578b3897
 662 Author: Felix Fietkau <nbd@openwrt.org>
 663 Date:   Mon May 19 21:20:49 2014 +0200
 664
 665     ath9k: avoid passing buffers to the hardware during flush
 666
 667     The commit "ath9k: fix possible hang on flush" changed the receive code
 668     to always link rx descriptors of processed frames, even when flushing.
 669     In some cases, this leads to flushed rx buffers being passed to the
 670     hardware while rx is already stopped.
 671
 672     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 673
 674 --- a/drivers/net/wireless/ath/ath9k/recv.c
 675 +++ b/drivers/net/wireless/ath/ath9k/recv.c
 676 @@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_slee
 677   * buffer (or rx fifo). This can incorrectly acknowledge packets
 678   * to a sender if last desc is self-linked.
 679   */
 680 -static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
 681 +static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf,
 682 +                           bool flush)
 683  {
 684         struct ath_hw *ah = sc->sc_ah;
 685         struct ath_common *common = ath9k_hw_common(ah);
 686 @@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_s
 687                              common->rx_bufsize,
 688                              0);
 689
 690 -       if (sc->rx.rxlink == NULL)
 691 -               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
 692 -       else
 693 +       if (sc->rx.rxlink)
 694                 *sc->rx.rxlink = bf->bf_daddr;
 695 +       else if (!flush)
 696 +               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
 697
 698         sc->rx.rxlink = &ds->ds_link;
 699  }
 700
 701 -static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
 702 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf,
 703 +                             bool flush)
 704  {
 705         if (sc->rx.buf_hold)
 706 -               ath_rx_buf_link(sc, sc->rx.buf_hold);
 707 +               ath_rx_buf_link(sc, sc->rx.buf_hold, flush);
 708
 709         sc->rx.buf_hold = bf;
 710  }
 711 @@ -442,7 +444,7 @@ int ath_startrecv(struct ath_softc *sc)
 712         sc->rx.buf_hold = NULL;
 713         sc->rx.rxlink = NULL;
 714         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
 715 -               ath_rx_buf_link(sc, bf);
 716 +               ath_rx_buf_link(sc, bf, false);
 717         }
 718
 719         /* We could have deleted elements so the list may be empty now */
 720 @@ -1118,12 +1120,12 @@ requeue_drop_frag:
 721  requeue:
 722                 list_add_tail(&bf->list, &sc->rx.rxbuf);
 723
 724 -               if (edma) {
 725 -                       ath_rx_edma_buf_link(sc, qtype);
 726 -               } else {
 727 -                       ath_rx_buf_relink(sc, bf);
 728 +               if (!edma) {
 729 +                       ath_rx_buf_relink(sc, bf, flush);
 730                         if (!flush)
 731                                 ath9k_hw_rxena(ah);
 732 +               } else if (!flush) {
 733 +                       ath_rx_edma_buf_link(sc, qtype);
 734                 }
 735
 736                 if (!budget--)
 737 --- a/net/mac80211/sta_info.c
 738 +++ b/net/mac80211/sta_info.c
 739 @@ -100,7 +100,8 @@ static void __cleanup_single_sta(struct
 740         struct ps_data *ps;
 741
 742         if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
 743 -           test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
 744 +           test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
 745 +           test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
 746                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
 747                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 748                         ps = &sdata->bss->ps;
 749 @@ -111,6 +112,7 @@ static void __cleanup_single_sta(struct
 750
 751                 clear_sta_flag(sta, WLAN_STA_PS_STA);
 752                 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 753 +               clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
 754
 755                 atomic_dec(&ps->num_sta_ps);
 756                 sta_info_recalc_tim(sta);
 757 @@ -125,7 +127,7 @@ static void __cleanup_single_sta(struct
 758         if (ieee80211_vif_is_mesh(&sdata->vif))
 759                 mesh_sta_cleanup(sta);
 760
 761 -       cancel_work_sync(&sta->drv_unblock_wk);
 762 +       cancel_work_sync(&sta->drv_deliver_wk);
 763
 764         /*
 765          * Destroy aggregation state here. It would be nice to wait for the
 766 @@ -227,6 +229,7 @@ struct sta_info *sta_info_get_by_idx(str
 767   */
 768  void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 769  {
 770 +       struct ieee80211_sta_rates *rates;
 771         int i;
 772
 773         if (sta->rate_ctrl)
 774 @@ -238,6 +241,10 @@ void sta_info_free(struct ieee80211_loca
 775                 kfree(sta->tx_lat);
 776         }
 777
 778 +       rates = rcu_dereference_protected(sta->sta.rates, true);
 779 +       if (rates)
 780 +               kfree(rates);
 781 +
 782         sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
 783
 784         kfree(sta);
 785 @@ -252,33 +259,23 @@ static void sta_info_hash_add(struct iee
 786         rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
 787  }
 788
 789 -static void sta_unblock(struct work_struct *wk)
 790 +static void sta_deliver_ps_frames(struct work_struct *wk)
 791  {
 792         struct sta_info *sta;
 793
 794 -       sta = container_of(wk, struct sta_info, drv_unblock_wk);
 795 +       sta = container_of(wk, struct sta_info, drv_deliver_wk);
 796
 797         if (sta->dead)
 798                 return;
 799
 800 -       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
 801 -               local_bh_disable();
 802 +       local_bh_disable();
 803 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA))
 804                 ieee80211_sta_ps_deliver_wakeup(sta);
 805 -               local_bh_enable();
 806 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
 807 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 808 -
 809 -               local_bh_disable();
 810 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
 811                 ieee80211_sta_ps_deliver_poll_response(sta);
 812 -               local_bh_enable();
 813 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD)) {
 814 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 815 -
 816 -               local_bh_disable();
 817 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
 818                 ieee80211_sta_ps_deliver_uapsd(sta);
 819 -               local_bh_enable();
 820 -       } else
 821 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 822 +       local_bh_enable();
 823  }
 824
 825  static int sta_prepare_rate_control(struct ieee80211_local *local,
 826 @@ -340,7 +337,7 @@ struct sta_info *sta_info_alloc(struct i
 827
 828         spin_lock_init(&sta->lock);
 829         spin_lock_init(&sta->ps_lock);
 830 -       INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
 831 +       INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
 832         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
 833         mutex_init(&sta->ampdu_mlme.mtx);
 834  #ifdef CPTCFG_MAC80211_MESH
 835 @@ -1101,8 +1098,11 @@ void ieee80211_sta_ps_deliver_wakeup(str
 836         unsigned long flags;
 837         struct ps_data *ps;
 838
 839 -       if (sdata->vif.type == NL80211_IFTYPE_AP ||
 840 -           sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 841 +       if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 842 +               sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
 843 +                                    u.ap);
 844 +
 845 +       if (sdata->vif.type == NL80211_IFTYPE_AP)
 846                 ps = &sdata->bss->ps;
 847         else if (ieee80211_vif_is_mesh(&sdata->vif))
 848                 ps = &sdata->u.mesh.ps;
 849 @@ -1140,8 +1140,15 @@ void ieee80211_sta_ps_deliver_wakeup(str
 850         }
 851
 852         ieee80211_add_pending_skbs(local, &pending);
 853 -       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 854 -       clear_sta_flag(sta, WLAN_STA_PS_STA);
 855 +
 856 +       /* now we're no longer in the deliver code */
 857 +       clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
 858 +
 859 +       /* The station might have polled and then woken up before we responded,
 860 +        * so clear these flags now to avoid them sticking around.
 861 +        */
 862 +       clear_sta_flag(sta, WLAN_STA_PSPOLL);
 863 +       clear_sta_flag(sta, WLAN_STA_UAPSD);
 864         spin_unlock(&sta->ps_lock);
 865
 866         atomic_dec(&ps->num_sta_ps);
 867 @@ -1542,10 +1549,26 @@ void ieee80211_sta_block_awake(struct ie
 868
 869         trace_api_sta_block_awake(sta->local, pubsta, block);
 870
 871 -       if (block)
 872 +       if (block) {
 873                 set_sta_flag(sta, WLAN_STA_PS_DRIVER);
 874 -       else if (test_sta_flag(sta, WLAN_STA_PS_DRIVER))
 875 -               ieee80211_queue_work(hw, &sta->drv_unblock_wk);
 876 +               return;
 877 +       }
 878 +
 879 +       if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
 880 +               return;
 881 +
 882 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
 883 +               set_sta_flag(sta, WLAN_STA_PS_DELIVER);
 884 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 885 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
 886 +       } else if (test_sta_flag(sta, WLAN_STA_PSPOLL) ||
 887 +                  test_sta_flag(sta, WLAN_STA_UAPSD)) {
 888 +               /* must be asleep in this case */
 889 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 890 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
 891 +       } else {
 892 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 893 +       }
 894  }
 895  EXPORT_SYMBOL(ieee80211_sta_block_awake);
 896
 897 @@ -1703,3 +1726,140 @@ u8 sta_info_tx_streams(struct sta_info *
 898         return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
 899                         >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
 900  }
 901 +
 902 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 903 +{
 904 +       struct ieee80211_sub_if_data *sdata = sta->sdata;
 905 +       struct ieee80211_local *local = sdata->local;
 906 +       struct rate_control_ref *ref = NULL;
 907 +       struct timespec uptime;
 908 +       u64 packets = 0;
 909 +       u32 thr = 0;
 910 +       int i, ac;
 911 +
 912 +       if (test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
 913 +               ref = local->rate_ctrl;
 914 +
 915 +       sinfo->generation = sdata->local->sta_generation;
 916 +
 917 +       sinfo->filled = STATION_INFO_INACTIVE_TIME |
 918 +                       STATION_INFO_RX_BYTES64 |
 919 +                       STATION_INFO_TX_BYTES64 |
 920 +                       STATION_INFO_RX_PACKETS |
 921 +                       STATION_INFO_TX_PACKETS |
 922 +                       STATION_INFO_TX_RETRIES |
 923 +                       STATION_INFO_TX_FAILED |
 924 +                       STATION_INFO_TX_BITRATE |
 925 +                       STATION_INFO_RX_BITRATE |
 926 +                       STATION_INFO_RX_DROP_MISC |
 927 +                       STATION_INFO_BSS_PARAM |
 928 +                       STATION_INFO_CONNECTED_TIME |
 929 +                       STATION_INFO_STA_FLAGS |
 930 +                       STATION_INFO_BEACON_LOSS_COUNT;
 931 +
 932 +       do_posix_clock_monotonic_gettime(&uptime);
 933 +       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
 934 +
 935 +       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
 936 +       sinfo->tx_bytes = 0;
 937 +       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 938 +               sinfo->tx_bytes += sta->tx_bytes[ac];
 939 +               packets += sta->tx_packets[ac];
 940 +       }
 941 +       sinfo->tx_packets = packets;
 942 +       sinfo->rx_bytes = sta->rx_bytes;
 943 +       sinfo->rx_packets = sta->rx_packets;
 944 +       sinfo->tx_retries = sta->tx_retry_count;
 945 +       sinfo->tx_failed = sta->tx_retry_failed;
 946 +       sinfo->rx_dropped_misc = sta->rx_dropped;
 947 +       sinfo->beacon_loss_count = sta->beacon_loss_count;
 948 +
 949 +       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
 950 +           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
 951 +               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
 952 +               if (!local->ops->get_rssi ||
 953 +                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
 954 +                       sinfo->signal = (s8)sta->last_signal;
 955 +               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
 956 +       }
 957 +       if (sta->chains) {
 958 +               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
 959 +                                STATION_INFO_CHAIN_SIGNAL_AVG;
 960 +
 961 +               sinfo->chains = sta->chains;
 962 +               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
 963 +                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
 964 +                       sinfo->chain_signal_avg[i] =
 965 +                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
 966 +               }
 967 +       }
 968 +
 969 +       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
 970 +       sta_set_rate_info_rx(sta, &sinfo->rxrate);
 971 +
 972 +       if (ieee80211_vif_is_mesh(&sdata->vif)) {
 973 +#ifdef CPTCFG_MAC80211_MESH
 974 +               sinfo->filled |= STATION_INFO_LLID |
 975 +                                STATION_INFO_PLID |
 976 +                                STATION_INFO_PLINK_STATE |
 977 +                                STATION_INFO_LOCAL_PM |
 978 +                                STATION_INFO_PEER_PM |
 979 +                                STATION_INFO_NONPEER_PM;
 980 +
 981 +               sinfo->llid = sta->llid;
 982 +               sinfo->plid = sta->plid;
 983 +               sinfo->plink_state = sta->plink_state;
 984 +               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
 985 +                       sinfo->filled |= STATION_INFO_T_OFFSET;
 986 +                       sinfo->t_offset = sta->t_offset;
 987 +               }
 988 +               sinfo->local_pm = sta->local_pm;
 989 +               sinfo->peer_pm = sta->peer_pm;
 990 +               sinfo->nonpeer_pm = sta->nonpeer_pm;
 991 +#endif
 992 +       }
 993 +
 994 +       sinfo->bss_param.flags = 0;
 995 +       if (sdata->vif.bss_conf.use_cts_prot)
 996 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
 997 +       if (sdata->vif.bss_conf.use_short_preamble)
 998 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
 999 +       if (sdata->vif.bss_conf.use_short_slot)
1000 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
1001 +       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
1002 +       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
1003 +
1004 +       sinfo->sta_flags.set = 0;
1005 +       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
1006 +                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
1007 +                               BIT(NL80211_STA_FLAG_WME) |
1008 +                               BIT(NL80211_STA_FLAG_MFP) |
1009 +                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1010 +                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
1011 +                               BIT(NL80211_STA_FLAG_TDLS_PEER);
1012 +       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1013 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
1014 +       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
1015 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
1016 +       if (test_sta_flag(sta, WLAN_STA_WME))
1017 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
1018 +       if (test_sta_flag(sta, WLAN_STA_MFP))
1019 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
1020 +       if (test_sta_flag(sta, WLAN_STA_AUTH))
1021 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
1022 +       if (test_sta_flag(sta, WLAN_STA_ASSOC))
1023 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1024 +       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
1025 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
1026 +
1027 +       /* check if the driver has a SW RC implementation */
1028 +       if (ref && ref->ops->get_expected_throughput)
1029 +               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
1030 +       else
1031 +               thr = drv_get_expected_throughput(local, &sta->sta);
1032 +
1033 +       if (thr != 0) {
1034 +               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
1035 +               sinfo->expected_throughput = thr;
1036 +       }
1037 +}
1038 --- a/net/mac80211/status.c
1039 +++ b/net/mac80211/status.c
1040 @@ -541,6 +541,23 @@ static void ieee80211_tx_latency_end_msr
1041   */
1042  #define STA_LOST_PKT_THRESHOLD 50
1043
1044 +static void ieee80211_lost_packet(struct sta_info *sta, struct sk_buff *skb)
1045 +{
1046 +       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1047 +
1048 +       /* This packet was aggregated but doesn't carry status info */
1049 +       if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
1050 +           !(info->flags & IEEE80211_TX_STAT_AMPDU))
1051 +               return;
1052 +
1053 +       if (++sta->lost_packets < STA_LOST_PKT_THRESHOLD)
1054 +               return;
1055 +
1056 +       cfg80211_cqm_pktloss_notify(sta->sdata->dev, sta->sta.addr,
1057 +                                   sta->lost_packets, GFP_ATOMIC);
1058 +       sta->lost_packets = 0;
1059 +}
1060 +
1061  void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
1062  {
1063         struct sk_buff *skb2;
1064 @@ -680,12 +697,8 @@ void ieee80211_tx_status(struct ieee8021
1065                         if (info->flags & IEEE80211_TX_STAT_ACK) {
1066                                 if (sta->lost_packets)
1067                                         sta->lost_packets = 0;
1068 -                       } else if (++sta->lost_packets >= STA_LOST_PKT_THRESHOLD) {
1069 -                               cfg80211_cqm_pktloss_notify(sta->sdata->dev,
1070 -                                                           sta->sta.addr,
1071 -                                                           sta->lost_packets,
1072 -                                                           GFP_ATOMIC);
1073 -                               sta->lost_packets = 0;
1074 +                       } else {
1075 +                               ieee80211_lost_packet(sta, skb);
1076                         }
1077                 }
1078
1079 --- a/net/mac80211/rx.c
1080 +++ b/net/mac80211/rx.c
1081 @@ -1107,6 +1107,8 @@ static void sta_ps_end(struct sta_info *
1082                 return;
1083         }
1084
1085 +       set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1086 +       clear_sta_flag(sta, WLAN_STA_PS_STA);
1087         ieee80211_sta_ps_deliver_wakeup(sta);
1088  }
1089
1090 @@ -1646,11 +1648,14 @@ ieee80211_rx_h_defragment(struct ieee802
1091         sc = le16_to_cpu(hdr->seq_ctrl);
1092         frag = sc & IEEE80211_SCTL_FRAG;
1093
1094 -       if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1095 -                  is_multicast_ether_addr(hdr->addr1))) {
1096 -               /* not fragmented */
1097 +       if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1098 +               goto out;
1099 +
1100 +       if (is_multicast_ether_addr(hdr->addr1)) {
1101 +               rx->local->dot11MulticastReceivedFrameCount++;
1102                 goto out;
1103         }
1104 +
1105         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1106
1107         if (skb_linearize(rx->skb))
1108 @@ -1743,10 +1748,7 @@ ieee80211_rx_h_defragment(struct ieee802
1109   out:
1110         if (rx->sta)
1111                 rx->sta->rx_packets++;
1112 -       if (is_multicast_ether_addr(hdr->addr1))
1113 -               rx->local->dot11MulticastReceivedFrameCount++;
1114 -       else
1115 -               ieee80211_led_rx(rx->local);
1116 +       ieee80211_led_rx(rx->local);
1117         return RX_CONTINUE;
1118  }
1119
1120 --- a/net/mac80211/sta_info.h
1121 +++ b/net/mac80211/sta_info.h
1122 @@ -82,6 +82,7 @@ enum ieee80211_sta_info_flags {
1123         WLAN_STA_TOFFSET_KNOWN,
1124         WLAN_STA_MPSP_OWNER,
1125         WLAN_STA_MPSP_RECIPIENT,
1126 +       WLAN_STA_PS_DELIVER,
1127  };
1128
1129  #define ADDBA_RESP_INTERVAL HZ
1130 @@ -265,7 +266,7 @@ struct ieee80211_tx_latency_stat {
1131   * @last_rx_rate_vht_nss: rx status nss of last data packet
1132   * @lock: used for locking all fields that require locking, see comments
1133   *     in the header file.
1134 - * @drv_unblock_wk: used for driver PS unblocking
1135 + * @drv_deliver_wk: used for delivering frames after driver PS unblocking
1136   * @listen_interval: listen interval of this station, when we're acting as AP
1137   * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
1138   * @ps_lock: used for powersave (when mac80211 is the AP) related locking
1139 @@ -278,7 +279,6 @@ struct ieee80211_tx_latency_stat {
1140   * @driver_buffered_tids: bitmap of TIDs the driver has data buffered on
1141   * @rx_packets: Number of MSDUs received from this STA
1142   * @rx_bytes: Number of bytes received from this STA
1143 - * @wep_weak_iv_count: number of weak WEP IVs received from this station
1144   * @last_rx: time (in jiffies) when last frame was received from this STA
1145   * @last_connected: time (in seconds) when a station got connected
1146   * @num_duplicates: number of duplicate frames received from this STA
1147 @@ -345,7 +345,7 @@ struct sta_info {
1148         void *rate_ctrl_priv;
1149         spinlock_t lock;
1150
1151 -       struct work_struct drv_unblock_wk;
1152 +       struct work_struct drv_deliver_wk;
1153
1154         u16 listen_interval;
1155
1156 @@ -367,7 +367,6 @@ struct sta_info {
1157         /* Updated from RX path only, no locking requirements */
1158         unsigned long rx_packets;
1159         u64 rx_bytes;
1160 -       unsigned long wep_weak_iv_count;
1161         unsigned long last_rx;
1162         long last_connected;
1163         unsigned long num_duplicates;
1164 @@ -628,6 +627,8 @@ void sta_set_rate_info_tx(struct sta_inf
1165                           struct rate_info *rinfo);
1166  void sta_set_rate_info_rx(struct sta_info *sta,
1167                           struct rate_info *rinfo);
1168 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo);
1169 +
1170  void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
1171                           unsigned long exp_time);
1172  u8 sta_info_tx_streams(struct sta_info *sta);
1173 --- a/net/mac80211/tx.c
1174 +++ b/net/mac80211/tx.c
1175 @@ -469,7 +469,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
1176                 return TX_CONTINUE;
1177
1178         if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
1179 -                     test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
1180 +                     test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
1181 +                     test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
1182                      !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
1183                 int ac = skb_get_queue_mapping(tx->skb);
1184
1185 @@ -486,7 +487,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
1186                  * ahead and Tx the packet.
1187                  */
1188                 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
1189 -                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1190 +                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
1191 +                   !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
1192                         spin_unlock(&sta->ps_lock);
1193                         return TX_CONTINUE;
1194                 }
1195 @@ -1618,12 +1620,12 @@ netdev_tx_t ieee80211_monitor_start_xmit
1196  {
1197         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1198         struct ieee80211_chanctx_conf *chanctx_conf;
1199 -       struct ieee80211_channel *chan;
1200         struct ieee80211_radiotap_header *prthdr =
1201                 (struct ieee80211_radiotap_header *)skb->data;
1202         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1203         struct ieee80211_hdr *hdr;
1204         struct ieee80211_sub_if_data *tmp_sdata, *sdata;
1205 +       struct cfg80211_chan_def *chandef;
1206         u16 len_rthdr;
1207         int hdrlen;
1208
1209 @@ -1721,9 +1723,9 @@ netdev_tx_t ieee80211_monitor_start_xmit
1210         }
1211
1212         if (chanctx_conf)
1213 -               chan = chanctx_conf->def.chan;
1214 +               chandef = &chanctx_conf->def;
1215         else if (!local->use_chanctx)
1216 -               chan = local->_oper_chandef.chan;
1217 +               chandef = &local->_oper_chandef;
1218         else
1219                 goto fail_rcu;
1220
1221 @@ -1743,10 +1745,11 @@ netdev_tx_t ieee80211_monitor_start_xmit
1222          * radar detection by itself. We can do that later by adding a
1223          * monitor flag interfaces used for AP support.
1224          */
1225 -       if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)))
1226 +       if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
1227 +                                    sdata->vif.type))
1228                 goto fail_rcu;
1229
1230 -       ieee80211_xmit(sdata, skb, chan->band);
1231 +       ieee80211_xmit(sdata, skb, chandef->chan->band);
1232         rcu_read_unlock();
1233
1234         return NETDEV_TX_OK;
1235 @@ -2425,7 +2428,7 @@ static void ieee80211_set_csa(struct iee
1236         u8 *beacon_data;
1237         size_t beacon_data_len;
1238         int i;
1239 -       u8 count = sdata->csa_current_counter;
1240 +       u8 count = beacon->csa_current_counter;
1241
1242         switch (sdata->vif.type) {
1243         case NL80211_IFTYPE_AP:
1244 @@ -2444,46 +2447,54 @@ static void ieee80211_set_csa(struct iee
1245                 return;
1246         }
1247
1248 +       rcu_read_lock();
1249         for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
1250 -               u16 counter_offset_beacon =
1251 -                       sdata->csa_counter_offset_beacon[i];
1252 -               u16 counter_offset_presp = sdata->csa_counter_offset_presp[i];
1253 -
1254 -               if (counter_offset_beacon) {
1255 -                       if (WARN_ON(counter_offset_beacon >= beacon_data_len))
1256 -                               return;
1257 -
1258 -                       beacon_data[counter_offset_beacon] = count;
1259 -               }
1260 -
1261 -               if (sdata->vif.type == NL80211_IFTYPE_AP &&
1262 -                   counter_offset_presp) {
1263 -                       rcu_read_lock();
1264 -                       resp = rcu_dereference(sdata->u.ap.probe_resp);
1265 +               resp = rcu_dereference(sdata->u.ap.probe_resp);
1266
1267 -                       /* If nl80211 accepted the offset, this should
1268 -                        * not happen.
1269 -                        */
1270 -                       if (WARN_ON(!resp)) {
1271 +               if (beacon->csa_counter_offsets[i]) {
1272 +                       if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
1273 +                                        beacon_data_len)) {
1274                                 rcu_read_unlock();
1275                                 return;
1276                         }
1277 -                       resp->data[counter_offset_presp] = count;
1278 -                       rcu_read_unlock();
1279 +
1280 +                       beacon_data[beacon->csa_counter_offsets[i]] = count;
1281                 }
1282 +
1283 +               if (sdata->vif.type == NL80211_IFTYPE_AP && resp &&
1284 +                   resp->csa_counter_offsets)
1285 +                       resp->data[resp->csa_counter_offsets[i]] = count;
1286         }
1287 +       rcu_read_unlock();
1288  }
1289
1290  u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
1291  {
1292         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1293 +       struct beacon_data *beacon = NULL;
1294 +       u8 count = 0;
1295 +
1296 +       rcu_read_lock();
1297 +
1298 +       if (sdata->vif.type == NL80211_IFTYPE_AP)
1299 +               beacon = rcu_dereference(sdata->u.ap.beacon);
1300 +       else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1301 +               beacon = rcu_dereference(sdata->u.ibss.presp);
1302 +       else if (ieee80211_vif_is_mesh(&sdata->vif))
1303 +               beacon = rcu_dereference(sdata->u.mesh.beacon);
1304 +
1305 +       if (!beacon)
1306 +               goto unlock;
1307
1308 -       sdata->csa_current_counter--;
1309 +       beacon->csa_current_counter--;
1310
1311         /* the counter should never reach 0 */
1312 -       WARN_ON(!sdata->csa_current_counter);
1313 +       WARN_ON_ONCE(!beacon->csa_current_counter);
1314 +       count = beacon->csa_current_counter;
1315
1316 -       return sdata->csa_current_counter;
1317 +unlock:
1318 +       rcu_read_unlock();
1319 +       return count;
1320  }
1321  EXPORT_SYMBOL(ieee80211_csa_update_counter);
1322
1323 @@ -2493,7 +2504,6 @@ bool ieee80211_csa_is_complete(struct ie
1324         struct beacon_data *beacon = NULL;
1325         u8 *beacon_data;
1326         size_t beacon_data_len;
1327 -       int counter_beacon = sdata->csa_counter_offset_beacon[0];
1328         int ret = false;
1329
1330         if (!ieee80211_sdata_running(sdata))
1331 @@ -2531,10 +2541,13 @@ bool ieee80211_csa_is_complete(struct ie
1332                 goto out;
1333         }
1334
1335 -       if (WARN_ON(counter_beacon > beacon_data_len))
1336 +       if (!beacon->csa_counter_offsets[0])
1337 +               goto out;
1338 +
1339 +       if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
1340                 goto out;
1341
1342 -       if (beacon_data[counter_beacon] == 1)
1343 +       if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
1344                 ret = true;
1345   out:
1346         rcu_read_unlock();
1347 @@ -2550,6 +2563,7 @@ __ieee80211_beacon_get(struct ieee80211_
1348                        bool is_template)
1349  {
1350         struct ieee80211_local *local = hw_to_local(hw);
1351 +       struct beacon_data *beacon = NULL;
1352         struct sk_buff *skb = NULL;
1353         struct ieee80211_tx_info *info;
1354         struct ieee80211_sub_if_data *sdata = NULL;
1355 @@ -2571,10 +2585,10 @@ __ieee80211_beacon_get(struct ieee80211_
1356
1357         if (sdata->vif.type == NL80211_IFTYPE_AP) {
1358                 struct ieee80211_if_ap *ap = &sdata->u.ap;
1359 -               struct beacon_data *beacon = rcu_dereference(ap->beacon);
1360
1361 +               beacon = rcu_dereference(ap->beacon);
1362                 if (beacon) {
1363 -                       if (sdata->vif.csa_active) {
1364 +                       if (beacon->csa_counter_offsets[0]) {
1365                                 if (!is_template)
1366                                         ieee80211_csa_update_counter(vif);
1367
1368 @@ -2615,37 +2629,37 @@ __ieee80211_beacon_get(struct ieee80211_
1369         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1370                 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1371                 struct ieee80211_hdr *hdr;
1372 -               struct beacon_data *presp = rcu_dereference(ifibss->presp);
1373
1374 -               if (!presp)
1375 +               beacon = rcu_dereference(ifibss->presp);
1376 +               if (!beacon)
1377                         goto out;
1378
1379 -               if (sdata->vif.csa_active) {
1380 +               if (beacon->csa_counter_offsets[0]) {
1381                         if (!is_template)
1382                                 ieee80211_csa_update_counter(vif);
1383
1384 -                       ieee80211_set_csa(sdata, presp);
1385 +                       ieee80211_set_csa(sdata, beacon);
1386                 }
1387
1388 -               skb = dev_alloc_skb(local->tx_headroom + presp->head_len +
1389 +               skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
1390                                     local->hw.extra_beacon_tailroom);
1391                 if (!skb)
1392                         goto out;
1393                 skb_reserve(skb, local->tx_headroom);
1394 -               memcpy(skb_put(skb, presp->head_len), presp->head,
1395 -                      presp->head_len);
1396 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1397 +                      beacon->head_len);
1398
1399                 hdr = (struct ieee80211_hdr *) skb->data;
1400                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1401                                                  IEEE80211_STYPE_BEACON);
1402         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
1403                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1404 -               struct beacon_data *bcn = rcu_dereference(ifmsh->beacon);
1405
1406 -               if (!bcn)
1407 +               beacon = rcu_dereference(ifmsh->beacon);
1408 +               if (!beacon)
1409                         goto out;
1410
1411 -               if (sdata->vif.csa_active) {
1412 +               if (beacon->csa_counter_offsets[0]) {
1413                         if (!is_template)
1414                                 /* TODO: For mesh csa_counter is in TU, so
1415                                  * decrementing it by one isn't correct, but
1416 @@ -2654,40 +2668,42 @@ __ieee80211_beacon_get(struct ieee80211_
1417                                  */
1418                                 ieee80211_csa_update_counter(vif);
1419
1420 -                       ieee80211_set_csa(sdata, bcn);
1421 +                       ieee80211_set_csa(sdata, beacon);
1422                 }
1423
1424                 if (ifmsh->sync_ops)
1425 -                       ifmsh->sync_ops->adjust_tbtt(sdata, bcn);
1426 +                       ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
1427
1428                 skb = dev_alloc_skb(local->tx_headroom +
1429 -                                   bcn->head_len +
1430 +                                   beacon->head_len +
1431                                     256 + /* TIM IE */
1432 -                                   bcn->tail_len +
1433 +                                   beacon->tail_len +
1434                                     local->hw.extra_beacon_tailroom);
1435                 if (!skb)
1436                         goto out;
1437                 skb_reserve(skb, local->tx_headroom);
1438 -               memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
1439 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1440 +                      beacon->head_len);
1441                 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
1442
1443                 if (offs) {
1444 -                       offs->tim_offset = bcn->head_len;
1445 -                       offs->tim_length = skb->len - bcn->head_len;
1446 +                       offs->tim_offset = beacon->head_len;
1447 +                       offs->tim_length = skb->len - beacon->head_len;
1448                 }
1449
1450 -               memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
1451 +               memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
1452 +                      beacon->tail_len);
1453         } else {
1454                 WARN_ON(1);
1455                 goto out;
1456         }
1457
1458         /* CSA offsets */
1459 -       if (offs) {
1460 +       if (offs && beacon) {
1461                 int i;
1462
1463                 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
1464 -                       u16 csa_off = sdata->csa_counter_offset_beacon[i];
1465 +                       u16 csa_off = beacon->csa_counter_offsets[i];
1466
1467                         if (!csa_off)
1468                                 continue;
1469 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
1470 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
1471 @@ -947,6 +947,40 @@ static inline u8 rt2800_get_beacon_offse
1472         return BEACON_BASE_TO_OFFSET(rt2800_hw_beacon_base(rt2x00dev, index));
1473  }
1474
1475 +static void rt2800_update_beacons_setup(struct rt2x00_dev *rt2x00dev)
1476 +{
1477 +       struct data_queue *queue = rt2x00dev->bcn;
1478 +       struct queue_entry *entry;
1479 +       int i, bcn_num = 0;
1480 +       u64 off, reg = 0;
1481 +       u32 bssid_dw1;
1482 +
1483 +       /*
1484 +        * Setup offsets of all active beacons in BCN_OFFSET{0,1} registers.
1485 +        */
1486 +       for (i = 0; i < queue->limit; i++) {
1487 +               entry = &queue->entries[i];
1488 +               if (!test_bit(ENTRY_BCN_ENABLED, &entry->flags))
1489 +                       continue;
1490 +               off = rt2800_get_beacon_offset(rt2x00dev, entry->entry_idx);
1491 +               reg |= off << (8 * bcn_num);
1492 +               bcn_num++;
1493 +       }
1494 +
1495 +       WARN_ON_ONCE(bcn_num != rt2x00dev->intf_beaconing);
1496 +
1497 +       rt2800_register_write(rt2x00dev, BCN_OFFSET0, (u32) reg);
1498 +       rt2800_register_write(rt2x00dev, BCN_OFFSET1, (u32) (reg >> 32));
1499 +
1500 +       /*
1501 +        * H/W sends up to MAC_BSSID_DW1_BSS_BCN_NUM + 1 consecutive beacons.
1502 +        */
1503 +       rt2800_register_read(rt2x00dev, MAC_BSSID_DW1, &bssid_dw1);
1504 +       rt2x00_set_field32(&bssid_dw1, MAC_BSSID_DW1_BSS_BCN_NUM,
1505 +                          bcn_num > 0 ? bcn_num - 1 : 0);
1506 +       rt2800_register_write(rt2x00dev, MAC_BSSID_DW1, bssid_dw1);
1507 +}
1508 +
1509  void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
1510  {
1511         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
1512 @@ -1003,6 +1037,12 @@ void rt2800_write_beacon(struct queue_en
1513
1514         rt2800_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
1515                                    entry->skb->len + padding_len);
1516 +       __set_bit(ENTRY_BCN_ENABLED, &entry->flags);
1517 +
1518 +       /*
1519 +        * Change global beacons settings.
1520 +        */
1521 +       rt2800_update_beacons_setup(rt2x00dev);
1522
1523         /*
1524          * Restore beaconing state.
1525 @@ -1053,8 +1093,13 @@ void rt2800_clear_beacon(struct queue_en
1526          * Clear beacon.
1527          */
1528         rt2800_clear_beacon_register(rt2x00dev, entry->entry_idx);
1529 +       __clear_bit(ENTRY_BCN_ENABLED, &entry->flags);
1530
1531         /*
1532 +        * Change global beacons settings.
1533 +        */
1534 +       rt2800_update_beacons_setup(rt2x00dev);
1535 +       /*
1536          * Restore beaconing state.
1537          */
1538         rt2800_register_write(rt2x00dev, BCN_TIME_CFG, orig_reg);
1539 @@ -1556,7 +1601,7 @@ void rt2800_config_intf(struct rt2x00_de
1540                 if (!is_zero_ether_addr((const u8 *)conf->bssid)) {
1541                         reg = le32_to_cpu(conf->bssid[1]);
1542                         rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 3);
1543 -                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 7);
1544 +                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
1545                         conf->bssid[1] = cpu_to_le32(reg);
1546                 }
1547
1548 @@ -4517,28 +4562,6 @@ static int rt2800_init_registers(struct
1549         if (ret)
1550                 return ret;
1551
1552 -       rt2800_register_read(rt2x00dev, BCN_OFFSET0, &reg);
1553 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0,
1554 -                          rt2800_get_beacon_offset(rt2x00dev, 0));
1555 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1,
1556 -                          rt2800_get_beacon_offset(rt2x00dev, 1));
1557 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2,
1558 -                          rt2800_get_beacon_offset(rt2x00dev, 2));
1559 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3,
1560 -                          rt2800_get_beacon_offset(rt2x00dev, 3));
1561 -       rt2800_register_write(rt2x00dev, BCN_OFFSET0, reg);
1562 -
1563 -       rt2800_register_read(rt2x00dev, BCN_OFFSET1, &reg);
1564 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4,
1565 -                          rt2800_get_beacon_offset(rt2x00dev, 4));
1566 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5,
1567 -                          rt2800_get_beacon_offset(rt2x00dev, 5));
1568 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6,
1569 -                          rt2800_get_beacon_offset(rt2x00dev, 6));
1570 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7,
1571 -                          rt2800_get_beacon_offset(rt2x00dev, 7));
1572 -       rt2800_register_write(rt2x00dev, BCN_OFFSET1, reg);
1573 -
1574         rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
1575         rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
1576
1577 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
1578 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
1579 @@ -141,8 +141,11 @@ static void rt2x00lib_intf_scheduled_ite
1580         if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
1581                 return;
1582
1583 -       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags))
1584 +       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags)) {
1585 +               mutex_lock(&intf->beacon_skb_mutex);
1586                 rt2x00queue_update_beacon(rt2x00dev, vif);
1587 +               mutex_unlock(&intf->beacon_skb_mutex);
1588 +       }
1589  }
1590
1591  static void rt2x00lib_intf_scheduled(struct work_struct *work)
1592 @@ -216,7 +219,7 @@ static void rt2x00lib_beaconupdate_iter(
1593          * never be called for USB devices.
1594          */
1595         WARN_ON(rt2x00_is_usb(rt2x00dev));
1596 -       rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1597 +       rt2x00queue_update_beacon(rt2x00dev, vif);
1598  }
1599
1600  void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
1601 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
1602 +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
1603 @@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_h
1604         crypto.cipher = rt2x00crypto_key_to_cipher(key);
1605         if (crypto.cipher == CIPHER_NONE)
1606                 return -EOPNOTSUPP;
1607 +       if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
1608 +               return -EOPNOTSUPP;
1609
1610         crypto.cmd = cmd;
1611
1612 @@ -624,25 +626,24 @@ void rt2x00mac_bss_info_changed(struct i
1613          * Start/stop beaconing.
1614          */
1615         if (changes & BSS_CHANGED_BEACON_ENABLED) {
1616 +               mutex_lock(&intf->beacon_skb_mutex);
1617                 if (!bss_conf->enable_beacon && intf->enable_beacon) {
1618                         rt2x00dev->intf_beaconing--;
1619                         intf->enable_beacon = false;
1620 -                       /*
1621 -                        * Clear beacon in the H/W for this vif. This is needed
1622 -                        * to disable beaconing on this particular interface
1623 -                        * and keep it running on other interfaces.
1624 -                        */
1625 -                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1626
1627                         if (rt2x00dev->intf_beaconing == 0) {
1628                                 /*
1629                                  * Last beaconing interface disabled
1630                                  * -> stop beacon queue.
1631                                  */
1632 -                               mutex_lock(&intf->beacon_skb_mutex);
1633                                 rt2x00queue_stop_queue(rt2x00dev->bcn);
1634 -                               mutex_unlock(&intf->beacon_skb_mutex);
1635                         }
1636 +                       /*
1637 +                        * Clear beacon in the H/W for this vif. This is needed
1638 +                        * to disable beaconing on this particular interface
1639 +                        * and keep it running on other interfaces.
1640 +                        */
1641 +                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1642                 } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
1643                         rt2x00dev->intf_beaconing++;
1644                         intf->enable_beacon = true;
1645 @@ -658,11 +659,10 @@ void rt2x00mac_bss_info_changed(struct i
1646                                  * First beaconing interface enabled
1647                                  * -> start beacon queue.
1648                                  */
1649 -                               mutex_lock(&intf->beacon_skb_mutex);
1650                                 rt2x00queue_start_queue(rt2x00dev->bcn);
1651 -                               mutex_unlock(&intf->beacon_skb_mutex);
1652                         }
1653                 }
1654 +               mutex_unlock(&intf->beacon_skb_mutex);
1655         }
1656
1657         /*
1658 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
1659 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
1660 @@ -754,8 +754,6 @@ int rt2x00queue_clear_beacon(struct rt2x
1661         if (unlikely(!intf->beacon))
1662                 return -ENOBUFS;
1663
1664 -       mutex_lock(&intf->beacon_skb_mutex);
1665 -
1666         /*
1667          * Clean up the beacon skb.
1668          */
1669 @@ -768,13 +766,11 @@ int rt2x00queue_clear_beacon(struct rt2x
1670         if (rt2x00dev->ops->lib->clear_beacon)
1671                 rt2x00dev->ops->lib->clear_beacon(intf->beacon);
1672
1673 -       mutex_unlock(&intf->beacon_skb_mutex);
1674 -
1675         return 0;
1676  }
1677
1678 -int rt2x00queue_update_beacon_locked(struct rt2x00_dev *rt2x00dev,
1679 -                                    struct ieee80211_vif *vif)
1680 +int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1681 +                             struct ieee80211_vif *vif)
1682  {
1683         struct rt2x00_intf *intf = vif_to_intf(vif);
1684         struct skb_frame_desc *skbdesc;
1685 @@ -815,19 +811,6 @@ int rt2x00queue_update_beacon_locked(str
1686
1687  }
1688
1689 -int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1690 -                             struct ieee80211_vif *vif)
1691 -{
1692 -       struct rt2x00_intf *intf = vif_to_intf(vif);
1693 -       int ret;
1694 -
1695 -       mutex_lock(&intf->beacon_skb_mutex);
1696 -       ret = rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1697 -       mutex_unlock(&intf->beacon_skb_mutex);
1698 -
1699 -       return ret;
1700 -}
1701 -
1702  bool rt2x00queue_for_each_entry(struct data_queue *queue,
1703                                 enum queue_index start,
1704                                 enum queue_index end,
1705 --- a/drivers/net/wireless/rt2x00/rt2x00queue.h
1706 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
1707 @@ -353,6 +353,7 @@ struct txentry_desc {
1708   */
1709  enum queue_entry_flags {
1710         ENTRY_BCN_ASSIGNED,
1711 +       ENTRY_BCN_ENABLED,
1712         ENTRY_OWNER_DEVICE_DATA,
1713         ENTRY_DATA_PENDING,
1714         ENTRY_DATA_IO_FAILED,
1715 --- a/drivers/net/wireless/ath/ath9k/main.c
1716 +++ b/drivers/net/wireless/ath/ath9k/main.c
1717 @@ -1757,7 +1757,6 @@ out:
1718  void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif)
1719  {
1720         struct ath_vif *avp = (void *)vif->drv_priv;
1721 -       unsigned long flags;
1722         u32 tsf;
1723
1724         if (!sc->p2p_ps_timer)
1725 @@ -1767,14 +1766,9 @@ void ath9k_update_p2p_ps(struct ath_soft
1726                 return;
1727
1728         sc->p2p_ps_vif = avp;
1729 -
1730 -       spin_lock_irqsave(&sc->sc_pm_lock, flags);
1731 -       if (!(sc->ps_flags & PS_BEACON_SYNC)) {
1732 -               tsf = ath9k_hw_gettsf32(sc->sc_ah);
1733 -               ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1734 -               ath9k_update_p2p_ps_timer(sc, avp);
1735 -       }
1736 -       spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1737 +       tsf = ath9k_hw_gettsf32(sc->sc_ah);
1738 +       ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1739 +       ath9k_update_p2p_ps_timer(sc, avp);
1740  }
1741
1742  static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
1743 @@ -1791,6 +1785,7 @@ static void ath9k_bss_info_changed(struc
1744         struct ath_hw *ah = sc->sc_ah;
1745         struct ath_common *common = ath9k_hw_common(ah);
1746         struct ath_vif *avp = (void *)vif->drv_priv;
1747 +       unsigned long flags;
1748         int slottime;
1749
1750         ath9k_ps_wakeup(sc);
1751 @@ -1853,7 +1848,10 @@ static void ath9k_bss_info_changed(struc
1752
1753         if (changed & BSS_CHANGED_P2P_PS) {
1754                 spin_lock_bh(&sc->sc_pcu_lock);
1755 -               ath9k_update_p2p_ps(sc, vif);
1756 +               spin_lock_irqsave(&sc->sc_pm_lock, flags);
1757 +               if (!(sc->ps_flags & PS_BEACON_SYNC))
1758 +                       ath9k_update_p2p_ps(sc, vif);
1759 +               spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1760                 spin_unlock_bh(&sc->sc_pcu_lock);
1761         }
1762
1763 @@ -2232,14 +2230,6 @@ static void ath9k_sw_scan_complete(struc
1764         clear_bit(ATH_OP_SCANNING, &common->op_flags);
1765  }
1766
1767 -static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
1768 -                                       struct ieee80211_vif *vif,
1769 -                                       struct cfg80211_chan_def *chandef)
1770 -{
1771 -       /* depend on vif->csa_active only */
1772 -       return;
1773 -}
1774 -
1775  struct ieee80211_ops ath9k_ops = {
1776         .tx                 = ath9k_tx,
1777         .start              = ath9k_start,
1778 @@ -2287,5 +2277,4 @@ struct ieee80211_ops ath9k_ops = {
1779  #endif
1780         .sw_scan_start      = ath9k_sw_scan_start,
1781         .sw_scan_complete   = ath9k_sw_scan_complete,
1782 -       .channel_switch_beacon     = ath9k_channel_switch_beacon,
1783  };
1784 --- a/drivers/net/wireless/ath/ath10k/mac.c
1785 +++ b/drivers/net/wireless/ath/ath10k/mac.c
1786 @@ -4142,14 +4142,6 @@ static int ath10k_set_bitrate_mask(struc
1787                                            fixed_nss, force_sgi);
1788  }
1789
1790 -static void ath10k_channel_switch_beacon(struct ieee80211_hw *hw,
1791 -                                        struct ieee80211_vif *vif,
1792 -                                        struct cfg80211_chan_def *chandef)
1793 -{
1794 -       /* there's no need to do anything here. vif->csa_active is enough */
1795 -       return;
1796 -}
1797 -
1798  static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
1799                                  struct ieee80211_vif *vif,
1800                                  struct ieee80211_sta *sta,
1801 @@ -4256,7 +4248,6 @@ static const struct ieee80211_ops ath10k
1802         .restart_complete               = ath10k_restart_complete,
1803         .get_survey                     = ath10k_get_survey,
1804         .set_bitrate_mask               = ath10k_set_bitrate_mask,
1805 -       .channel_switch_beacon          = ath10k_channel_switch_beacon,
1806         .sta_rc_update                  = ath10k_sta_rc_update,
1807         .get_tsf                        = ath10k_get_tsf,
1808  #ifdef CONFIG_PM
1809 --- a/net/mac80211/cfg.c
1810 +++ b/net/mac80211/cfg.c
1811 @@ -468,327 +468,6 @@ void sta_set_rate_info_rx(struct sta_inf
1812                 rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
1813  }
1814
1815 -static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
1816 -{
1817 -       struct ieee80211_sub_if_data *sdata = sta->sdata;
1818 -       struct ieee80211_local *local = sdata->local;
1819 -       struct rate_control_ref *ref = local->rate_ctrl;
1820 -       struct timespec uptime;
1821 -       u64 packets = 0;
1822 -       u32 thr = 0;
1823 -       int i, ac;
1824 -
1825 -       sinfo->generation = sdata->local->sta_generation;
1826 -
1827 -       sinfo->filled = STATION_INFO_INACTIVE_TIME |
1828 -                       STATION_INFO_RX_BYTES64 |
1829 -                       STATION_INFO_TX_BYTES64 |
1830 -                       STATION_INFO_RX_PACKETS |
1831 -                       STATION_INFO_TX_PACKETS |
1832 -                       STATION_INFO_TX_RETRIES |
1833 -                       STATION_INFO_TX_FAILED |
1834 -                       STATION_INFO_TX_BITRATE |
1835 -                       STATION_INFO_RX_BITRATE |
1836 -                       STATION_INFO_RX_DROP_MISC |
1837 -                       STATION_INFO_BSS_PARAM |
1838 -                       STATION_INFO_CONNECTED_TIME |
1839 -                       STATION_INFO_STA_FLAGS |
1840 -                       STATION_INFO_BEACON_LOSS_COUNT;
1841 -
1842 -       do_posix_clock_monotonic_gettime(&uptime);
1843 -       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
1844 -
1845 -       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
1846 -       sinfo->tx_bytes = 0;
1847 -       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1848 -               sinfo->tx_bytes += sta->tx_bytes[ac];
1849 -               packets += sta->tx_packets[ac];
1850 -       }
1851 -       sinfo->tx_packets = packets;
1852 -       sinfo->rx_bytes = sta->rx_bytes;
1853 -       sinfo->rx_packets = sta->rx_packets;
1854 -       sinfo->tx_retries = sta->tx_retry_count;
1855 -       sinfo->tx_failed = sta->tx_retry_failed;
1856 -       sinfo->rx_dropped_misc = sta->rx_dropped;
1857 -       sinfo->beacon_loss_count = sta->beacon_loss_count;
1858 -
1859 -       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
1860 -           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
1861 -               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
1862 -               if (!local->ops->get_rssi ||
1863 -                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
1864 -                       sinfo->signal = (s8)sta->last_signal;
1865 -               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
1866 -       }
1867 -       if (sta->chains) {
1868 -               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
1869 -                                STATION_INFO_CHAIN_SIGNAL_AVG;
1870 -
1871 -               sinfo->chains = sta->chains;
1872 -               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
1873 -                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
1874 -                       sinfo->chain_signal_avg[i] =
1875 -                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
1876 -               }
1877 -       }
1878 -
1879 -       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
1880 -       sta_set_rate_info_rx(sta, &sinfo->rxrate);
1881 -
1882 -       if (ieee80211_vif_is_mesh(&sdata->vif)) {
1883 -#ifdef CPTCFG_MAC80211_MESH
1884 -               sinfo->filled |= STATION_INFO_LLID |
1885 -                                STATION_INFO_PLID |
1886 -                                STATION_INFO_PLINK_STATE |
1887 -                                STATION_INFO_LOCAL_PM |
1888 -                                STATION_INFO_PEER_PM |
1889 -                                STATION_INFO_NONPEER_PM;
1890 -
1891 -               sinfo->llid = sta->llid;
1892 -               sinfo->plid = sta->plid;
1893 -               sinfo->plink_state = sta->plink_state;
1894 -               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
1895 -                       sinfo->filled |= STATION_INFO_T_OFFSET;
1896 -                       sinfo->t_offset = sta->t_offset;
1897 -               }
1898 -               sinfo->local_pm = sta->local_pm;
1899 -               sinfo->peer_pm = sta->peer_pm;
1900 -               sinfo->nonpeer_pm = sta->nonpeer_pm;
1901 -#endif
1902 -       }
1903 -
1904 -       sinfo->bss_param.flags = 0;
1905 -       if (sdata->vif.bss_conf.use_cts_prot)
1906 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
1907 -       if (sdata->vif.bss_conf.use_short_preamble)
1908 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
1909 -       if (sdata->vif.bss_conf.use_short_slot)
1910 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
1911 -       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
1912 -       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
1913 -
1914 -       sinfo->sta_flags.set = 0;
1915 -       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
1916 -                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
1917 -                               BIT(NL80211_STA_FLAG_WME) |
1918 -                               BIT(NL80211_STA_FLAG_MFP) |
1919 -                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1920 -                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
1921 -                               BIT(NL80211_STA_FLAG_TDLS_PEER);
1922 -       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1923 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
1924 -       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
1925 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
1926 -       if (test_sta_flag(sta, WLAN_STA_WME))
1927 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
1928 -       if (test_sta_flag(sta, WLAN_STA_MFP))
1929 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
1930 -       if (test_sta_flag(sta, WLAN_STA_AUTH))
1931 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
1932 -       if (test_sta_flag(sta, WLAN_STA_ASSOC))
1933 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1934 -       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
1935 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
1936 -
1937 -       /* check if the driver has a SW RC implementation */
1938 -       if (ref && ref->ops->get_expected_throughput)
1939 -               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
1940 -       else
1941 -               thr = drv_get_expected_throughput(local, &sta->sta);
1942 -
1943 -       if (thr != 0) {
1944 -               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
1945 -               sinfo->expected_throughput = thr;
1946 -       }
1947 -}
1948 -
1949 -static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
1950 -       "rx_packets", "rx_bytes", "wep_weak_iv_count",
1951 -       "rx_duplicates", "rx_fragments", "rx_dropped",
1952 -       "tx_packets", "tx_bytes", "tx_fragments",
1953 -       "tx_filtered", "tx_retry_failed", "tx_retries",
1954 -       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
1955 -       "channel", "noise", "ch_time", "ch_time_busy",
1956 -       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
1957 -};
1958 -#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
1959 -
1960 -static int ieee80211_get_et_sset_count(struct wiphy *wiphy,
1961 -                                      struct net_device *dev,
1962 -                                      int sset)
1963 -{
1964 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1965 -       int rv = 0;
1966 -
1967 -       if (sset == ETH_SS_STATS)
1968 -               rv += STA_STATS_LEN;
1969 -
1970 -       rv += drv_get_et_sset_count(sdata, sset);
1971 -
1972 -       if (rv == 0)
1973 -               return -EOPNOTSUPP;
1974 -       return rv;
1975 -}
1976 -
1977 -static void ieee80211_get_et_stats(struct wiphy *wiphy,
1978 -                                  struct net_device *dev,
1979 -                                  struct ethtool_stats *stats,
1980 -                                  u64 *data)
1981 -{
1982 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1983 -       struct ieee80211_chanctx_conf *chanctx_conf;
1984 -       struct ieee80211_channel *channel;
1985 -       struct sta_info *sta;
1986 -       struct ieee80211_local *local = sdata->local;
1987 -       struct station_info sinfo;
1988 -       struct survey_info survey;
1989 -       int i, q;
1990 -#define STA_STATS_SURVEY_LEN 7
1991 -
1992 -       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
1993 -
1994 -#define ADD_STA_STATS(sta)                             \
1995 -       do {                                            \
1996 -               data[i++] += sta->rx_packets;           \
1997 -               data[i++] += sta->rx_bytes;             \
1998 -               data[i++] += sta->wep_weak_iv_count;    \
1999 -               data[i++] += sta->num_duplicates;       \
2000 -               data[i++] += sta->rx_fragments;         \
2001 -               data[i++] += sta->rx_dropped;           \
2002 -                                                       \
2003 -               data[i++] += sinfo.tx_packets;          \
2004 -               data[i++] += sinfo.tx_bytes;            \
2005 -               data[i++] += sta->tx_fragments;         \
2006 -               data[i++] += sta->tx_filtered_count;    \
2007 -               data[i++] += sta->tx_retry_failed;      \
2008 -               data[i++] += sta->tx_retry_count;       \
2009 -               data[i++] += sta->beacon_loss_count;    \
2010 -       } while (0)
2011 -
2012 -       /* For Managed stations, find the single station based on BSSID
2013 -        * and use that.  For interface types, iterate through all available
2014 -        * stations and add stats for any station that is assigned to this
2015 -        * network device.
2016 -        */
2017 -
2018 -       mutex_lock(&local->sta_mtx);
2019 -
2020 -       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2021 -               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
2022 -
2023 -               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
2024 -                       goto do_survey;
2025 -
2026 -               sinfo.filled = 0;
2027 -               sta_set_sinfo(sta, &sinfo);
2028 -
2029 -               i = 0;
2030 -               ADD_STA_STATS(sta);
2031 -
2032 -               data[i++] = sta->sta_state;
2033 -
2034 -
2035 -               if (sinfo.filled & STATION_INFO_TX_BITRATE)
2036 -                       data[i] = 100000 *
2037 -                               cfg80211_calculate_bitrate(&sinfo.txrate);
2038 -               i++;
2039 -               if (sinfo.filled & STATION_INFO_RX_BITRATE)
2040 -                       data[i] = 100000 *
2041 -                               cfg80211_calculate_bitrate(&sinfo.rxrate);
2042 -               i++;
2043 -
2044 -               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
2045 -                       data[i] = (u8)sinfo.signal_avg;
2046 -               i++;
2047 -       } else {
2048 -               list_for_each_entry(sta, &local->sta_list, list) {
2049 -                       /* Make sure this station belongs to the proper dev */
2050 -                       if (sta->sdata->dev != dev)
2051 -                               continue;
2052 -
2053 -                       sinfo.filled = 0;
2054 -                       sta_set_sinfo(sta, &sinfo);
2055 -                       i = 0;
2056 -                       ADD_STA_STATS(sta);
2057 -               }
2058 -       }
2059 -
2060 -do_survey:
2061 -       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
2062 -       /* Get survey stats for current channel */
2063 -       survey.filled = 0;
2064 -
2065 -       rcu_read_lock();
2066 -       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2067 -       if (chanctx_conf)
2068 -               channel = chanctx_conf->def.chan;
2069 -       else
2070 -               channel = NULL;
2071 -       rcu_read_unlock();
2072 -
2073 -       if (channel) {
2074 -               q = 0;
2075 -               do {
2076 -                       survey.filled = 0;
2077 -                       if (drv_get_survey(local, q, &survey) != 0) {
2078 -                               survey.filled = 0;
2079 -                               break;
2080 -                       }
2081 -                       q++;
2082 -               } while (channel != survey.channel);
2083 -       }
2084 -
2085 -       if (survey.filled)
2086 -               data[i++] = survey.channel->center_freq;
2087 -       else
2088 -               data[i++] = 0;
2089 -       if (survey.filled & SURVEY_INFO_NOISE_DBM)
2090 -               data[i++] = (u8)survey.noise;
2091 -       else
2092 -               data[i++] = -1LL;
2093 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
2094 -               data[i++] = survey.channel_time;
2095 -       else
2096 -               data[i++] = -1LL;
2097 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
2098 -               data[i++] = survey.channel_time_busy;
2099 -       else
2100 -               data[i++] = -1LL;
2101 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
2102 -               data[i++] = survey.channel_time_ext_busy;
2103 -       else
2104 -               data[i++] = -1LL;
2105 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
2106 -               data[i++] = survey.channel_time_rx;
2107 -       else
2108 -               data[i++] = -1LL;
2109 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
2110 -               data[i++] = survey.channel_time_tx;
2111 -       else
2112 -               data[i++] = -1LL;
2113 -
2114 -       mutex_unlock(&local->sta_mtx);
2115 -
2116 -       if (WARN_ON(i != STA_STATS_LEN))
2117 -               return;
2118 -
2119 -       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
2120 -}
2121 -
2122 -static void ieee80211_get_et_strings(struct wiphy *wiphy,
2123 -                                    struct net_device *dev,
2124 -                                    u32 sset, u8 *data)
2125 -{
2126 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2127 -       int sz_sta_stats = 0;
2128 -
2129 -       if (sset == ETH_SS_STATS) {
2130 -               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
2131 -               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
2132 -       }
2133 -       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
2134 -}
2135 -
2136  static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
2137                                   int idx, u8 *mac, struct station_info *sinfo)
2138  {
2139 @@ -875,7 +554,8 @@ static int ieee80211_set_monitor_channel
2140  }
2141
2142  static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
2143 -                                   const u8 *resp, size_t resp_len)
2144 +                                   const u8 *resp, size_t resp_len,
2145 +                                   const struct ieee80211_csa_settings *csa)
2146  {
2147         struct probe_resp *new, *old;
2148
2149 @@ -891,6 +571,11 @@ static int ieee80211_set_probe_resp(stru
2150         new->len = resp_len;
2151         memcpy(new->data, resp, resp_len);
2152
2153 +       if (csa)
2154 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_presp,
2155 +                      csa->n_counter_offsets_presp *
2156 +                      sizeof(new->csa_counter_offsets[0]));
2157 +
2158         rcu_assign_pointer(sdata->u.ap.probe_resp, new);
2159         if (old)
2160                 kfree_rcu(old, rcu_head);
2161 @@ -899,7 +584,8 @@ static int ieee80211_set_probe_resp(stru
2162  }
2163
2164  static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
2165 -                                  struct cfg80211_beacon_data *params)
2166 +                                  struct cfg80211_beacon_data *params,
2167 +                                  const struct ieee80211_csa_settings *csa)
2168  {
2169         struct beacon_data *new, *old;
2170         int new_head_len, new_tail_len;
2171 @@ -943,6 +629,13 @@ static int ieee80211_assign_beacon(struc
2172         new->head_len = new_head_len;
2173         new->tail_len = new_tail_len;
2174
2175 +       if (csa) {
2176 +               new->csa_current_counter = csa->count;
2177 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_beacon,
2178 +                      csa->n_counter_offsets_beacon *
2179 +                      sizeof(new->csa_counter_offsets[0]));
2180 +       }
2181 +
2182         /* copy in head */
2183         if (params->head)
2184                 memcpy(new->head, params->head, new_head_len);
2185 @@ -957,7 +650,7 @@ static int ieee80211_assign_beacon(struc
2186                         memcpy(new->tail, old->tail, new_tail_len);
2187
2188         err = ieee80211_set_probe_resp(sdata, params->probe_resp,
2189 -                                      params->probe_resp_len);
2190 +                                      params->probe_resp_len, csa);
2191         if (err < 0)
2192                 return err;
2193         if (err == 0)
2194 @@ -1042,7 +735,7 @@ static int ieee80211_start_ap(struct wip
2195                 sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow |=
2196                                         IEEE80211_P2P_OPPPS_ENABLE_BIT;
2197
2198 -       err = ieee80211_assign_beacon(sdata, &params->beacon);
2199 +       err = ieee80211_assign_beacon(sdata, &params->beacon, NULL);
2200         if (err < 0) {
2201                 ieee80211_vif_release_channel(sdata);
2202                 return err;
2203 @@ -1090,7 +783,7 @@ static int ieee80211_change_beacon(struc
2204         if (!old)
2205                 return -ENOENT;
2206
2207 -       err = ieee80211_assign_beacon(sdata, params);
2208 +       err = ieee80211_assign_beacon(sdata, params, NULL);
2209         if (err < 0)
2210                 return err;
2211         ieee80211_bss_info_change_notify(sdata, err);
2212 @@ -1164,7 +857,6 @@ static int ieee80211_stop_ap(struct wiph
2213         sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
2214
2215         __sta_info_flush(sdata, true);
2216 -       ieee80211_free_keys(sdata, true);
2217
2218         sdata->vif.bss_conf.enable_beacon = false;
2219         sdata->vif.bss_conf.ssid_len = 0;
2220 @@ -3073,7 +2765,8 @@ static int ieee80211_set_after_csa_beaco
2221
2222         switch (sdata->vif.type) {
2223         case NL80211_IFTYPE_AP:
2224 -               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
2225 +               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
2226 +                                             NULL);
2227                 kfree(sdata->u.ap.next_beacon);
2228                 sdata->u.ap.next_beacon = NULL;
2229
2230 @@ -3176,6 +2869,7 @@ static int ieee80211_set_csa_beacon(stru
2231                                     struct cfg80211_csa_settings *params,
2232                                     u32 *changed)
2233  {
2234 +       struct ieee80211_csa_settings csa = {};
2235         int err;
2236
2237         switch (sdata->vif.type) {
2238 @@ -3210,20 +2904,13 @@ static int ieee80211_set_csa_beacon(stru
2239                      IEEE80211_MAX_CSA_COUNTERS_NUM))
2240                         return -EINVAL;
2241
2242 -               /* make sure we don't have garbage in other counters */
2243 -               memset(sdata->csa_counter_offset_beacon, 0,
2244 -                      sizeof(sdata->csa_counter_offset_beacon));
2245 -               memset(sdata->csa_counter_offset_presp, 0,
2246 -                      sizeof(sdata->csa_counter_offset_presp));
2247 -
2248 -               memcpy(sdata->csa_counter_offset_beacon,
2249 -                      params->counter_offsets_beacon,
2250 -                      params->n_counter_offsets_beacon * sizeof(u16));
2251 -               memcpy(sdata->csa_counter_offset_presp,
2252 -                      params->counter_offsets_presp,
2253 -                      params->n_counter_offsets_presp * sizeof(u16));
2254 +               csa.counter_offsets_beacon = params->counter_offsets_beacon;
2255 +               csa.counter_offsets_presp = params->counter_offsets_presp;
2256 +               csa.n_counter_offsets_beacon = params->n_counter_offsets_beacon;
2257 +               csa.n_counter_offsets_presp = params->n_counter_offsets_presp;
2258 +               csa.count = params->count;
2259
2260 -               err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
2261 +               err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa);
2262                 if (err < 0) {
2263                         kfree(sdata->u.ap.next_beacon);
2264                         return err;
2265 @@ -3367,7 +3054,6 @@ __ieee80211_channel_switch(struct wiphy
2266         sdata->csa_radar_required = params->radar_required;
2267         sdata->csa_chandef = params->chandef;
2268         sdata->csa_block_tx = params->block_tx;
2269 -       sdata->csa_current_counter = params->count;
2270         sdata->vif.csa_active = true;
2271
2272         if (sdata->csa_block_tx)
2273 @@ -3515,10 +3201,23 @@ static int ieee80211_mgmt_tx(struct wiph
2274              sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
2275             params->n_csa_offsets) {
2276                 int i;
2277 -               u8 c = sdata->csa_current_counter;
2278 +               struct beacon_data *beacon = NULL;
2279 +
2280 +               rcu_read_lock();
2281
2282 -               for (i = 0; i < params->n_csa_offsets; i++)
2283 -                       data[params->csa_offsets[i]] = c;
2284 +               if (sdata->vif.type == NL80211_IFTYPE_AP)
2285 +                       beacon = rcu_dereference(sdata->u.ap.beacon);
2286 +               else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
2287 +                       beacon = rcu_dereference(sdata->u.ibss.presp);
2288 +               else if (ieee80211_vif_is_mesh(&sdata->vif))
2289 +                       beacon = rcu_dereference(sdata->u.mesh.beacon);
2290 +
2291 +               if (beacon)
2292 +                       for (i = 0; i < params->n_csa_offsets; i++)
2293 +                               data[params->csa_offsets[i]] =
2294 +                                       beacon->csa_current_counter;
2295 +
2296 +               rcu_read_unlock();
2297         }
2298
2299         IEEE80211_SKB_CB(skb)->flags = flags;
2300 @@ -3598,21 +3297,6 @@ static int ieee80211_get_antenna(struct
2301         return drv_get_antenna(local, tx_ant, rx_ant);
2302  }
2303
2304 -static int ieee80211_set_ringparam(struct wiphy *wiphy, u32 tx, u32 rx)
2305 -{
2306 -       struct ieee80211_local *local = wiphy_priv(wiphy);
2307 -
2308 -       return drv_set_ringparam(local, tx, rx);
2309 -}
2310 -
2311 -static void ieee80211_get_ringparam(struct wiphy *wiphy,
2312 -                                   u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max)
2313 -{
2314 -       struct ieee80211_local *local = wiphy_priv(wiphy);
2315 -
2316 -       drv_get_ringparam(local, tx, tx_max, rx, rx_max);
2317 -}
2318 -
2319  static int ieee80211_set_rekey_data(struct wiphy *wiphy,
2320                                     struct net_device *dev,
2321                                     struct cfg80211_gtk_rekey_data *data)
2322 @@ -3844,8 +3528,6 @@ const struct cfg80211_ops mac80211_confi
2323         .mgmt_frame_register = ieee80211_mgmt_frame_register,
2324         .set_antenna = ieee80211_set_antenna,
2325         .get_antenna = ieee80211_get_antenna,
2326 -       .set_ringparam = ieee80211_set_ringparam,
2327 -       .get_ringparam = ieee80211_get_ringparam,
2328         .set_rekey_data = ieee80211_set_rekey_data,
2329         .tdls_oper = ieee80211_tdls_oper,
2330         .tdls_mgmt = ieee80211_tdls_mgmt,
2331 @@ -3854,9 +3536,6 @@ const struct cfg80211_ops mac80211_confi
2332  #ifdef CONFIG_PM
2333         .set_wakeup = ieee80211_set_wakeup,
2334  #endif
2335 -       .get_et_sset_count = ieee80211_get_et_sset_count,
2336 -       .get_et_stats = ieee80211_get_et_stats,
2337 -       .get_et_strings = ieee80211_get_et_strings,
2338         .get_channel = ieee80211_cfg_get_channel,
2339         .start_radar_detection = ieee80211_start_radar_detection,
2340         .channel_switch = ieee80211_channel_switch,
2341 --- a/net/mac80211/debugfs_sta.c
2342 +++ b/net/mac80211/debugfs_sta.c
2343 @@ -587,7 +587,6 @@ void ieee80211_sta_debugfs_add(struct st
2344         DEBUGFS_ADD_COUNTER(tx_filtered, tx_filtered_count);
2345         DEBUGFS_ADD_COUNTER(tx_retry_failed, tx_retry_failed);
2346         DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
2347 -       DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
2348
2349         if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
2350                 debugfs_create_x32("driver_buffered_tids", 0400,
2351 --- a/net/mac80211/wep.c
2352 +++ b/net/mac80211/wep.c
2353 @@ -271,22 +271,6 @@ static int ieee80211_wep_decrypt(struct
2354         return ret;
2355  }
2356
2357 -
2358 -static bool ieee80211_wep_is_weak_iv(struct sk_buff *skb,
2359 -                                    struct ieee80211_key *key)
2360 -{
2361 -       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2362 -       unsigned int hdrlen;
2363 -       u8 *ivpos;
2364 -       u32 iv;
2365 -
2366 -       hdrlen = ieee80211_hdrlen(hdr->frame_control);
2367 -       ivpos = skb->data + hdrlen;
2368 -       iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
2369 -
2370 -       return ieee80211_wep_weak_iv(iv, key->conf.keylen);
2371 -}
2372 -
2373  ieee80211_rx_result
2374  ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
2375  {
2376 @@ -301,16 +285,12 @@ ieee80211_crypto_wep_decrypt(struct ieee
2377         if (!(status->flag & RX_FLAG_DECRYPTED)) {
2378                 if (skb_linearize(rx->skb))
2379                         return RX_DROP_UNUSABLE;
2380 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2381 -                       rx->sta->wep_weak_iv_count++;
2382                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
2383                         return RX_DROP_UNUSABLE;
2384         } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
2385                 if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) +
2386                                             IEEE80211_WEP_IV_LEN))
2387                         return RX_DROP_UNUSABLE;
2388 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2389 -                       rx->sta->wep_weak_iv_count++;
2390                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
2391                 /* remove ICV */
2392                 if (pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN))
2393 --- a/include/net/cfg80211.h
2394 +++ b/include/net/cfg80211.h
2395 @@ -2278,16 +2278,6 @@ struct cfg80211_qos_map {
2396   *
2397   * @set_noack_map: Set the NoAck Map for the TIDs.
2398   *
2399 - * @get_et_sset_count:  Ethtool API to get string-set count.
2400 - *     See @ethtool_ops.get_sset_count
2401 - *
2402 - * @get_et_stats:  Ethtool API to get a set of u64 stats.
2403 - *     See @ethtool_ops.get_ethtool_stats
2404 - *
2405 - * @get_et_strings:  Ethtool API to get a set of strings to describe stats
2406 - *     and perhaps other supported types of ethtool data-sets.
2407 - *     See @ethtool_ops.get_strings
2408 - *
2409   * @get_channel: Get the current operating channel for the virtual interface.
2410   *     For monitor interfaces, it should return %NULL unless there's a single
2411   *     current monitoring channel.
2412 @@ -2529,13 +2519,6 @@ struct cfg80211_ops {
2413                                   struct net_device *dev,
2414                                   u16 noack_map);
2415
2416 -       int     (*get_et_sset_count)(struct wiphy *wiphy,
2417 -                                    struct net_device *dev, int sset);
2418 -       void    (*get_et_stats)(struct wiphy *wiphy, struct net_device *dev,
2419 -                               struct ethtool_stats *stats, u64 *data);
2420 -       void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
2421 -                                 u32 sset, u8 *data);
2422 -
2423         int     (*get_channel)(struct wiphy *wiphy,
2424                                struct wireless_dev *wdev,
2425                                struct cfg80211_chan_def *chandef);
2426 @@ -4846,6 +4829,10 @@ void cfg80211_stop_iface(struct wiphy *w
2427   */
2428  void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
2429
2430 +
2431 +/* ethtool helper */
2432 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info);
2433 +
2434  /* Logging, debugging and troubleshooting/diagnostic helpers. */
2435
2436  /* wiphy_printk helpers, similar to dev_printk */
2437 --- a/net/mac80211/Makefile
2438 +++ b/net/mac80211/Makefile
2439 @@ -17,6 +17,7 @@ mac80211-y := \
2440         aes_ccm.o \
2441         aes_cmac.o \
2442         cfg.o \
2443 +       ethtool.o \
2444         rx.o \
2445         spectmgmt.o \
2446         tx.o \
2447 --- a/net/mac80211/ieee80211_i.h
2448 +++ b/net/mac80211/ieee80211_i.h
2449 @@ -229,16 +229,29 @@ struct ieee80211_rx_data {
2450         u16 tkip_iv16;
2451  };
2452
2453 +struct ieee80211_csa_settings {
2454 +       const u16 *counter_offsets_beacon;
2455 +       const u16 *counter_offsets_presp;
2456 +
2457 +       int n_counter_offsets_beacon;
2458 +       int n_counter_offsets_presp;
2459 +
2460 +       u8 count;
2461 +};
2462 +
2463  struct beacon_data {
2464         u8 *head, *tail;
2465         int head_len, tail_len;
2466         struct ieee80211_meshconf_ie *meshconf;
2467 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2468 +       u8 csa_current_counter;
2469         struct rcu_head rcu_head;
2470  };
2471
2472  struct probe_resp {
2473         struct rcu_head rcu_head;
2474         int len;
2475 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2476         u8 data[0];
2477  };
2478
2479 @@ -754,8 +767,6 @@ struct ieee80211_sub_if_data {
2480         struct mac80211_qos_map __rcu *qos_map;
2481
2482         struct work_struct csa_finalize_work;
2483 -       u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM];
2484 -       u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM];
2485         bool csa_radar_required;
2486         bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
2487         struct cfg80211_chan_def csa_chandef;
2488 @@ -767,7 +778,6 @@ struct ieee80211_sub_if_data {
2489         struct ieee80211_chanctx *reserved_chanctx;
2490         struct cfg80211_chan_def reserved_chandef;
2491         bool reserved_radar_required;
2492 -       u8 csa_current_counter;
2493
2494         /* used to reconfigure hardware SM PS */
2495         struct work_struct recalc_smps;
2496 @@ -1850,6 +1860,8 @@ int ieee80211_tdls_oper(struct wiphy *wi
2497                         const u8 *peer, enum nl80211_tdls_operation oper);
2498
2499
2500 +extern const struct ethtool_ops ieee80211_ethtool_ops;
2501 +
2502  #ifdef CPTCFG_MAC80211_NOINLINE
2503  #define debug_noinline noinline
2504  #else
2505 --- a/net/mac80211/iface.c
2506 +++ b/net/mac80211/iface.c
2507 @@ -399,6 +399,7 @@ int ieee80211_add_virtual_monitor(struct
2508         sdata->vif.type = NL80211_IFTYPE_MONITOR;
2509         snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
2510                  wiphy_name(local->hw.wiphy));
2511 +       sdata->wdev.iftype = NL80211_IFTYPE_MONITOR;
2512
2513         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2514
2515 @@ -928,9 +929,6 @@ static void ieee80211_do_stop(struct iee
2516                  * another CPU.
2517                  */
2518                 ieee80211_free_keys(sdata, true);
2519 -
2520 -               /* fall through */
2521 -       case NL80211_IFTYPE_AP:
2522                 skb_queue_purge(&sdata->skb_queue);
2523         }
2524
2525 @@ -1303,6 +1301,7 @@ static void ieee80211_setup_sdata(struct
2526         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
2527         sdata->control_port_no_encrypt = false;
2528         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2529 +       sdata->vif.bss_conf.idle = true;
2530
2531         sdata->noack_map = 0;
2532
2533 @@ -1721,6 +1720,8 @@ int ieee80211_if_add(struct ieee80211_lo
2534
2535                 ndev->features |= local->hw.netdev_features;
2536
2537 +               netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
2538 +
2539                 ret = register_netdevice(ndev);
2540                 if (ret) {
2541                         free_netdev(ndev);
2542 --- a/net/wireless/core.c
2543 +++ b/net/wireless/core.c
2544 @@ -25,7 +25,6 @@
2545  #include "sysfs.h"
2546  #include "debugfs.h"
2547  #include "wext-compat.h"
2548 -#include "ethtool.h"
2549  #include "rdev-ops.h"
2550
2551  /* name for sysfs, %d is appended */
2552 @@ -940,8 +939,6 @@ static int cfg80211_netdev_notifier_call
2553                 /* allow mac80211 to determine the timeout */
2554                 wdev->ps_timeout = -1;
2555
2556 -               netdev_set_default_ethtool_ops(dev, &cfg80211_ethtool_ops);
2557 -
2558                 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
2559                      wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
2560                      wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
2561 --- a/net/wireless/ethtool.c
2562 +++ b/net/wireless/ethtool.c
2563 @@ -1,11 +1,9 @@
2564  #include <linux/utsname.h>
2565  #include <net/cfg80211.h>
2566  #include "core.h"
2567 -#include "ethtool.h"
2568  #include "rdev-ops.h"
2569
2570 -static void cfg80211_get_drvinfo(struct net_device *dev,
2571 -                                       struct ethtool_drvinfo *info)
2572 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
2573  {
2574         struct wireless_dev *wdev = dev->ieee80211_ptr;
2575
2576 @@ -23,84 +21,4 @@ static void cfg80211_get_drvinfo(struct
2577         strlcpy(info->bus_info, dev_name(wiphy_dev(wdev->wiphy)),
2578                 sizeof(info->bus_info));
2579  }
2580 -
2581 -static int cfg80211_get_regs_len(struct net_device *dev)
2582 -{
2583 -       /* For now, return 0... */
2584 -       return 0;
2585 -}
2586 -
2587 -static void cfg80211_get_regs(struct net_device *dev, struct ethtool_regs *regs,
2588 -                       void *data)
2589 -{
2590 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2591 -
2592 -       regs->version = wdev->wiphy->hw_version;
2593 -       regs->len = 0;
2594 -}
2595 -
2596 -static void cfg80211_get_ringparam(struct net_device *dev,
2597 -                                  struct ethtool_ringparam *rp)
2598 -{
2599 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2600 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2601 -
2602 -       memset(rp, 0, sizeof(*rp));
2603 -
2604 -       if (rdev->ops->get_ringparam)
2605 -               rdev_get_ringparam(rdev, &rp->tx_pending, &rp->tx_max_pending,
2606 -                                  &rp->rx_pending, &rp->rx_max_pending);
2607 -}
2608 -
2609 -static int cfg80211_set_ringparam(struct net_device *dev,
2610 -                                 struct ethtool_ringparam *rp)
2611 -{
2612 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2613 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2614 -
2615 -       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2616 -               return -EINVAL;
2617 -
2618 -       if (rdev->ops->set_ringparam)
2619 -               return rdev_set_ringparam(rdev, rp->tx_pending, rp->rx_pending);
2620 -
2621 -       return -ENOTSUPP;
2622 -}
2623 -
2624 -static int cfg80211_get_sset_count(struct net_device *dev, int sset)
2625 -{
2626 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2627 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2628 -       if (rdev->ops->get_et_sset_count)
2629 -               return rdev_get_et_sset_count(rdev, dev, sset);
2630 -       return -EOPNOTSUPP;
2631 -}
2632 -
2633 -static void cfg80211_get_stats(struct net_device *dev,
2634 -                              struct ethtool_stats *stats, u64 *data)
2635 -{
2636 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2637 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2638 -       if (rdev->ops->get_et_stats)
2639 -               rdev_get_et_stats(rdev, dev, stats, data);
2640 -}
2641 -
2642 -static void cfg80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
2643 -{
2644 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2645 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2646 -       if (rdev->ops->get_et_strings)
2647 -               rdev_get_et_strings(rdev, dev, sset, data);
2648 -}
2649 -
2650 -const struct ethtool_ops cfg80211_ethtool_ops = {
2651 -       .get_drvinfo = cfg80211_get_drvinfo,
2652 -       .get_regs_len = cfg80211_get_regs_len,
2653 -       .get_regs = cfg80211_get_regs,
2654 -       .get_link = ethtool_op_get_link,
2655 -       .get_ringparam = cfg80211_get_ringparam,
2656 -       .set_ringparam = cfg80211_set_ringparam,
2657 -       .get_strings = cfg80211_get_strings,
2658 -       .get_ethtool_stats = cfg80211_get_stats,
2659 -       .get_sset_count = cfg80211_get_sset_count,
2660 -};
2661 +EXPORT_SYMBOL(cfg80211_get_drvinfo);
2662 --- a/net/wireless/ethtool.h
2663 +++ /dev/null
2664 @@ -1,6 +0,0 @@
2665 -#ifndef __CFG80211_ETHTOOL__
2666 -#define __CFG80211_ETHTOOL__
2667 -
2668 -extern const struct ethtool_ops cfg80211_ethtool_ops;
2669 -
2670 -#endif /* __CFG80211_ETHTOOL__ */
2671 --- a/net/wireless/rdev-ops.h
2672 +++ b/net/wireless/rdev-ops.h
2673 @@ -714,25 +714,6 @@ static inline int rdev_get_antenna(struc
2674         return ret;
2675  }
2676
2677 -static inline int rdev_set_ringparam(struct cfg80211_registered_device *rdev,
2678 -                                    u32 tx, u32 rx)
2679 -{
2680 -       int ret;
2681 -       trace_rdev_set_ringparam(&rdev->wiphy, tx, rx);
2682 -       ret = rdev->ops->set_ringparam(&rdev->wiphy, tx, rx);
2683 -       trace_rdev_return_int(&rdev->wiphy, ret);
2684 -       return ret;
2685 -}
2686 -
2687 -static inline void rdev_get_ringparam(struct cfg80211_registered_device *rdev,
2688 -                                     u32 *tx, u32 *tx_max, u32 *rx,
2689 -                                     u32 *rx_max)
2690 -{
2691 -       trace_rdev_get_ringparam(&rdev->wiphy);
2692 -       rdev->ops->get_ringparam(&rdev->wiphy, tx, tx_max, rx, rx_max);
2693 -       trace_rdev_return_void_tx_rx(&rdev->wiphy, *tx, *tx_max, *rx, *rx_max);
2694 -}
2695 -
2696  static inline int
2697  rdev_sched_scan_start(struct cfg80211_registered_device *rdev,
2698                       struct net_device *dev,
2699 @@ -816,35 +797,6 @@ static inline int rdev_set_noack_map(str
2700  }
2701
2702  static inline int
2703 -rdev_get_et_sset_count(struct cfg80211_registered_device *rdev,
2704 -                      struct net_device *dev, int sset)
2705 -{
2706 -       int ret;
2707 -       trace_rdev_get_et_sset_count(&rdev->wiphy, dev, sset);
2708 -       ret = rdev->ops->get_et_sset_count(&rdev->wiphy, dev, sset);
2709 -       trace_rdev_return_int(&rdev->wiphy, ret);
2710 -       return ret;
2711 -}
2712 -
2713 -static inline void rdev_get_et_stats(struct cfg80211_registered_device *rdev,
2714 -                                    struct net_device *dev,
2715 -                                    struct ethtool_stats *stats, u64 *data)
2716 -{
2717 -       trace_rdev_get_et_stats(&rdev->wiphy, dev);
2718 -       rdev->ops->get_et_stats(&rdev->wiphy, dev, stats, data);
2719 -       trace_rdev_return_void(&rdev->wiphy);
2720 -}
2721 -
2722 -static inline void rdev_get_et_strings(struct cfg80211_registered_device *rdev,
2723 -                                      struct net_device *dev, u32 sset,
2724 -                                      u8 *data)
2725 -{
2726 -       trace_rdev_get_et_strings(&rdev->wiphy, dev, sset);
2727 -       rdev->ops->get_et_strings(&rdev->wiphy, dev, sset, data);
2728 -       trace_rdev_return_void(&rdev->wiphy);
2729 -}
2730 -
2731 -static inline int
2732  rdev_get_channel(struct cfg80211_registered_device *rdev,
2733                  struct wireless_dev *wdev,
2734                  struct cfg80211_chan_def *chandef)
2735 --- a/net/wireless/trace.h
2736 +++ b/net/wireless/trace.h
2737 @@ -298,11 +298,6 @@ DEFINE_EVENT(wiphy_only_evt, rdev_return
2738         TP_ARGS(wiphy)
2739  );
2740
2741 -DEFINE_EVENT(wiphy_only_evt, rdev_get_ringparam,
2742 -       TP_PROTO(struct wiphy *wiphy),
2743 -       TP_ARGS(wiphy)
2744 -);
2745 -
2746  DEFINE_EVENT(wiphy_only_evt, rdev_get_antenna,
2747         TP_PROTO(struct wiphy *wiphy),
2748         TP_ARGS(wiphy)
2749 @@ -580,11 +575,6 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_stop
2750         TP_ARGS(wiphy, netdev)
2751  );
2752
2753 -DEFINE_EVENT(wiphy_netdev_evt, rdev_get_et_stats,
2754 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2755 -       TP_ARGS(wiphy, netdev)
2756 -);
2757 -
2758  DEFINE_EVENT(wiphy_netdev_evt, rdev_sched_scan_stop,
2759         TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2760         TP_ARGS(wiphy, netdev)
2761 @@ -1439,11 +1429,6 @@ DECLARE_EVENT_CLASS(tx_rx_evt,
2762                   WIPHY_PR_ARG, __entry->tx, __entry->rx)
2763  );
2764
2765 -DEFINE_EVENT(tx_rx_evt, rdev_set_ringparam,
2766 -       TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2767 -       TP_ARGS(wiphy, rx, tx)
2768 -);
2769 -
2770  DEFINE_EVENT(tx_rx_evt, rdev_set_antenna,
2771         TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2772         TP_ARGS(wiphy, rx, tx)
2773 @@ -1725,40 +1710,6 @@ TRACE_EVENT(rdev_set_noack_map,
2774                   WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->noack_map)
2775  );
2776
2777 -TRACE_EVENT(rdev_get_et_sset_count,
2778 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int sset),
2779 -       TP_ARGS(wiphy, netdev, sset),
2780 -       TP_STRUCT__entry(
2781 -               WIPHY_ENTRY
2782 -               NETDEV_ENTRY
2783 -               __field(int, sset)
2784 -       ),
2785 -       TP_fast_assign(
2786 -               WIPHY_ASSIGN;
2787 -               NETDEV_ASSIGN;
2788 -               __entry->sset = sset;
2789 -       ),
2790 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %d",
2791 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2792 -);
2793 -
2794 -TRACE_EVENT(rdev_get_et_strings,
2795 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u32 sset),
2796 -       TP_ARGS(wiphy, netdev, sset),
2797 -       TP_STRUCT__entry(
2798 -               WIPHY_ENTRY
2799 -               NETDEV_ENTRY
2800 -               __field(u32, sset)
2801 -       ),
2802 -       TP_fast_assign(
2803 -               WIPHY_ASSIGN;
2804 -               NETDEV_ASSIGN;
2805 -               __entry->sset = sset;
2806 -       ),
2807 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %u",
2808 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2809 -);
2810 -
2811  DEFINE_EVENT(wiphy_wdev_evt, rdev_get_channel,
2812         TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
2813         TP_ARGS(wiphy, wdev)
2814 --- /dev/null
2815 +++ b/net/mac80211/ethtool.c
2816 @@ -0,0 +1,244 @@
2817 +/*
2818 + * mac80211 ethtool hooks for cfg80211
2819 + *
2820 + * Copied from cfg.c - originally
2821 + * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
2822 + * Copyright 2014      Intel Corporation (Author: Johannes Berg)
2823 + *
2824 + * This file is GPLv2 as found in COPYING.
2825 + */
2826 +#include <linux/types.h>
2827 +#include <net/cfg80211.h>
2828 +#include "ieee80211_i.h"
2829 +#include "sta_info.h"
2830 +#include "driver-ops.h"
2831 +
2832 +static int ieee80211_set_ringparam(struct net_device *dev,
2833 +                                  struct ethtool_ringparam *rp)
2834 +{
2835 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2836 +
2837 +       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2838 +               return -EINVAL;
2839 +
2840 +       return drv_set_ringparam(local, rp->tx_pending, rp->rx_pending);
2841 +}
2842 +
2843 +static void ieee80211_get_ringparam(struct net_device *dev,
2844 +                                   struct ethtool_ringparam *rp)
2845 +{
2846 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2847 +
2848 +       memset(rp, 0, sizeof(*rp));
2849 +
2850 +       drv_get_ringparam(local, &rp->tx_pending, &rp->tx_max_pending,
2851 +                         &rp->rx_pending, &rp->rx_max_pending);
2852 +}
2853 +
2854 +static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
2855 +       "rx_packets", "rx_bytes",
2856 +       "rx_duplicates", "rx_fragments", "rx_dropped",
2857 +       "tx_packets", "tx_bytes", "tx_fragments",
2858 +       "tx_filtered", "tx_retry_failed", "tx_retries",
2859 +       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
2860 +       "channel", "noise", "ch_time", "ch_time_busy",
2861 +       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
2862 +};
2863 +#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
2864 +
2865 +static int ieee80211_get_sset_count(struct net_device *dev, int sset)
2866 +{
2867 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2868 +       int rv = 0;
2869 +
2870 +       if (sset == ETH_SS_STATS)
2871 +               rv += STA_STATS_LEN;
2872 +
2873 +       rv += drv_get_et_sset_count(sdata, sset);
2874 +
2875 +       if (rv == 0)
2876 +               return -EOPNOTSUPP;
2877 +       return rv;
2878 +}
2879 +
2880 +static void ieee80211_get_stats(struct net_device *dev,
2881 +                               struct ethtool_stats *stats,
2882 +                               u64 *data)
2883 +{
2884 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2885 +       struct ieee80211_chanctx_conf *chanctx_conf;
2886 +       struct ieee80211_channel *channel;
2887 +       struct sta_info *sta;
2888 +       struct ieee80211_local *local = sdata->local;
2889 +       struct station_info sinfo;
2890 +       struct survey_info survey;
2891 +       int i, q;
2892 +#define STA_STATS_SURVEY_LEN 7
2893 +
2894 +       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
2895 +
2896 +#define ADD_STA_STATS(sta)                             \
2897 +       do {                                            \
2898 +               data[i++] += sta->rx_packets;           \
2899 +               data[i++] += sta->rx_bytes;             \
2900 +               data[i++] += sta->num_duplicates;       \
2901 +               data[i++] += sta->rx_fragments;         \
2902 +               data[i++] += sta->rx_dropped;           \
2903 +                                                       \
2904 +               data[i++] += sinfo.tx_packets;          \
2905 +               data[i++] += sinfo.tx_bytes;            \
2906 +               data[i++] += sta->tx_fragments;         \
2907 +               data[i++] += sta->tx_filtered_count;    \
2908 +               data[i++] += sta->tx_retry_failed;      \
2909 +               data[i++] += sta->tx_retry_count;       \
2910 +               data[i++] += sta->beacon_loss_count;    \
2911 +       } while (0)
2912 +
2913 +       /* For Managed stations, find the single station based on BSSID
2914 +        * and use that.  For interface types, iterate through all available
2915 +        * stations and add stats for any station that is assigned to this
2916 +        * network device.
2917 +        */
2918 +
2919 +       mutex_lock(&local->sta_mtx);
2920 +
2921 +       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2922 +               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
2923 +
2924 +               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
2925 +                       goto do_survey;
2926 +
2927 +               sinfo.filled = 0;
2928 +               sta_set_sinfo(sta, &sinfo);
2929 +
2930 +               i = 0;
2931 +               ADD_STA_STATS(sta);
2932 +
2933 +               data[i++] = sta->sta_state;
2934 +
2935 +
2936 +               if (sinfo.filled & STATION_INFO_TX_BITRATE)
2937 +                       data[i] = 100000 *
2938 +                               cfg80211_calculate_bitrate(&sinfo.txrate);
2939 +               i++;
2940 +               if (sinfo.filled & STATION_INFO_RX_BITRATE)
2941 +                       data[i] = 100000 *
2942 +                               cfg80211_calculate_bitrate(&sinfo.rxrate);
2943 +               i++;
2944 +
2945 +               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
2946 +                       data[i] = (u8)sinfo.signal_avg;
2947 +               i++;
2948 +       } else {
2949 +               list_for_each_entry(sta, &local->sta_list, list) {
2950 +                       /* Make sure this station belongs to the proper dev */
2951 +                       if (sta->sdata->dev != dev)
2952 +                               continue;
2953 +
2954 +                       sinfo.filled = 0;
2955 +                       sta_set_sinfo(sta, &sinfo);
2956 +                       i = 0;
2957 +                       ADD_STA_STATS(sta);
2958 +               }
2959 +       }
2960 +
2961 +do_survey:
2962 +       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
2963 +       /* Get survey stats for current channel */
2964 +       survey.filled = 0;
2965 +
2966 +       rcu_read_lock();
2967 +       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2968 +       if (chanctx_conf)
2969 +               channel = chanctx_conf->def.chan;
2970 +       else
2971 +               channel = NULL;
2972 +       rcu_read_unlock();
2973 +
2974 +       if (channel) {
2975 +               q = 0;
2976 +               do {
2977 +                       survey.filled = 0;
2978 +                       if (drv_get_survey(local, q, &survey) != 0) {
2979 +                               survey.filled = 0;
2980 +                               break;
2981 +                       }
2982 +                       q++;
2983 +               } while (channel != survey.channel);
2984 +       }
2985 +
2986 +       if (survey.filled)
2987 +               data[i++] = survey.channel->center_freq;
2988 +       else
2989 +               data[i++] = 0;
2990 +       if (survey.filled & SURVEY_INFO_NOISE_DBM)
2991 +               data[i++] = (u8)survey.noise;
2992 +       else
2993 +               data[i++] = -1LL;
2994 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
2995 +               data[i++] = survey.channel_time;
2996 +       else
2997 +               data[i++] = -1LL;
2998 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
2999 +               data[i++] = survey.channel_time_busy;
3000 +       else
3001 +               data[i++] = -1LL;
3002 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3003 +               data[i++] = survey.channel_time_ext_busy;
3004 +       else
3005 +               data[i++] = -1LL;
3006 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
3007 +               data[i++] = survey.channel_time_rx;
3008 +       else
3009 +               data[i++] = -1LL;
3010 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
3011 +               data[i++] = survey.channel_time_tx;
3012 +       else
3013 +               data[i++] = -1LL;
3014 +
3015 +       mutex_unlock(&local->sta_mtx);
3016 +
3017 +       if (WARN_ON(i != STA_STATS_LEN))
3018 +               return;
3019 +
3020 +       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
3021 +}
3022 +
3023 +static void ieee80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
3024 +{
3025 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3026 +       int sz_sta_stats = 0;
3027 +
3028 +       if (sset == ETH_SS_STATS) {
3029 +               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
3030 +               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
3031 +       }
3032 +       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
3033 +}
3034 +
3035 +static int ieee80211_get_regs_len(struct net_device *dev)
3036 +{
3037 +       return 0;
3038 +}
3039 +
3040 +static void ieee80211_get_regs(struct net_device *dev,
3041 +                              struct ethtool_regs *regs,
3042 +                              void *data)
3043 +{
3044 +       struct wireless_dev *wdev = dev->ieee80211_ptr;
3045 +
3046 +       regs->version = wdev->wiphy->hw_version;
3047 +       regs->len = 0;
3048 +}
3049 +
3050 +const struct ethtool_ops ieee80211_ethtool_ops = {
3051 +       .get_drvinfo = cfg80211_get_drvinfo,
3052 +       .get_regs_len = ieee80211_get_regs_len,
3053 +       .get_regs = ieee80211_get_regs,
3054 +       .get_link = ethtool_op_get_link,
3055 +       .get_ringparam = ieee80211_get_ringparam,
3056 +       .set_ringparam = ieee80211_set_ringparam,
3057 +       .get_strings = ieee80211_get_strings,
3058 +       .get_ethtool_stats = ieee80211_get_stats,
3059 +       .get_sset_count = ieee80211_get_sset_count,
3060 +};
3061 --- a/net/mac80211/ibss.c
3062 +++ b/net/mac80211/ibss.c
3063 @@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80
3064                 *pos++ = csa_settings->block_tx ? 1 : 0;
3065                 *pos++ = ieee80211_frequency_to_channel(
3066                                 csa_settings->chandef.chan->center_freq);
3067 -               sdata->csa_counter_offset_beacon[0] = (pos - presp->head);
3068 +               presp->csa_counter_offsets[0] = (pos - presp->head);
3069                 *pos++ = csa_settings->count;
3070         }
3071
3072 @@ -1677,6 +1677,7 @@ int ieee80211_ibss_join(struct ieee80211
3073         sdata->u.ibss.control_port = params->control_port;
3074         sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
3075         sdata->u.ibss.basic_rates = params->basic_rates;
3076 +       sdata->u.ibss.last_scan_completed = jiffies;
3077
3078         /* fix basic_rates if channel does not support these rates */
3079         rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
3080 --- a/net/mac80211/mesh.c
3081 +++ b/net/mac80211/mesh.c
3082 @@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee8
3083                 *pos++ = 0x0;
3084                 *pos++ = ieee80211_frequency_to_channel(
3085                                 csa->settings.chandef.chan->center_freq);
3086 -               sdata->csa_counter_offset_beacon[0] = hdr_len + 6;
3087 +               bcn->csa_counter_offsets[0] = hdr_len + 6;
3088                 *pos++ = csa->settings.count;
3089                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
3090                 *pos++ = 6;
3091 --- a/net/wireless/genregdb.awk
3092 +++ b/net/wireless/genregdb.awk
3093 @@ -65,17 +65,7 @@ function parse_reg_rule()
3094         sub(/,/, "", units)
3095         dfs_cac = $9
3096         if (units == "mW") {
3097 -               if (power == 100) {
3098 -                       power = 20
3099 -               } else if (power == 200) {
3100 -                       power = 23
3101 -               } else if (power == 500) {
3102 -                       power = 27
3103 -               } else if (power == 1000) {
3104 -                       power = 30
3105 -               } else {
3106 -                       print "Unknown power value in database!"
3107 -               }
3108 +               power = 10 * log(power)/log(10)
3109         } else {
3110                 dfs_cac = $8
3111         }
3112 @@ -114,7 +104,7 @@ function parse_reg_rule()
3113
3114         }
3115         flags = flags "0"
3116 -       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
3117 +       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %.0f, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
3118         rules++
3119  }
3120
3121 --- a/net/mac80211/debugfs_netdev.c
3122 +++ b/net/mac80211/debugfs_netdev.c
3123 @@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
3124         ssize_t ret = -EINVAL;
3125
3126         read_lock(&dev_base_lock);
3127 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
3128 -               ret = (*format)(sdata, buf, sizeof(buf));
3129 +       ret = (*format)(sdata, buf, sizeof(buf));
3130         read_unlock(&dev_base_lock);
3131
3132         if (ret >= 0)
3133 @@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
3134
3135         ret = -ENODEV;
3136         rtnl_lock();
3137 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
3138 -               ret = (*write)(sdata, buf, count);
3139 +       ret = (*write)(sdata, buf, count);
3140         rtnl_unlock();
3141
3142         return ret;
3143 --- a/drivers/net/wireless/b43/xmit.c
3144 +++ b/drivers/net/wireless/b43/xmit.c
3145 @@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struc
3146                 break;
3147         case B43_PHYTYPE_G:
3148                 status.band = IEEE80211_BAND_2GHZ;
3149 -               /* chanid is the radio channel cookie value as used
3150 -                * to tune the radio. */
3151 -               status.freq = chanid + 2400;
3152 +               /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
3153 +                * has been modified to be compatible with N-PHY and others.
3154 +                */
3155 +               if (dev->fw.rev >= 508)
3156 +                       status.freq = ieee80211_channel_to_frequency(chanid, status.band);
3157 +               else
3158 +                       status.freq = chanid + 2400;
3159                 break;
3160         case B43_PHYTYPE_N:
3161         case B43_PHYTYPE_LP:
3162 --- a/drivers/net/wireless/b43/main.c
3163 +++ b/drivers/net/wireless/b43/main.c
3164 @@ -5216,6 +5216,7 @@ static int b43_wireless_core_attach(stru
3165         /* We don't support 5 GHz on some PHYs yet */
3166         switch (dev->phy.type) {
3167         case B43_PHYTYPE_A:
3168 +       case B43_PHYTYPE_G:
3169         case B43_PHYTYPE_N:
3170         case B43_PHYTYPE_LP:
3171         case B43_PHYTYPE_HT:
3172 --- a/net/wireless/reg.c
3173 +++ b/net/wireless/reg.c
3174 @@ -935,7 +935,7 @@ freq_reg_info_regd(struct wiphy *wiphy,
3175                 if (!band_rule_found)
3176                         band_rule_found = freq_in_rule_band(fr, center_freq);
3177
3178 -               bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(5));
3179 +               bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(20));
3180
3181                 if (band_rule_found && bw_fits)
3182                         return rr;
3183 @@ -1019,10 +1019,10 @@ static void chan_reg_rule_print_dbg(cons
3184  }
3185  #endif
3186
3187 -/* Find an ieee80211_reg_rule such that a 5MHz channel with frequency
3188 - * chan->center_freq fits there.
3189 - * If there is no such reg_rule, disable the channel, otherwise set the
3190 - * flags corresponding to the bandwidths allowed in the particular reg_rule
3191 +/*
3192 + * Note that right now we assume the desired channel bandwidth
3193 + * is always 20 MHz for each individual channel (HT40 uses 20 MHz
3194 + * per channel, the primary and the extension channel).
3195   */
3196  static void handle_channel(struct wiphy *wiphy,
3197                            enum nl80211_reg_initiator initiator,
3198 @@ -1083,12 +1083,8 @@ static void handle_channel(struct wiphy
3199         if (reg_rule->flags & NL80211_RRF_AUTO_BW)
3200                 max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
3201
3202 -       if (max_bandwidth_khz < MHZ_TO_KHZ(10))
3203 -               bw_flags = IEEE80211_CHAN_NO_10MHZ;
3204 -       if (max_bandwidth_khz < MHZ_TO_KHZ(20))
3205 -               bw_flags |= IEEE80211_CHAN_NO_20MHZ;
3206         if (max_bandwidth_khz < MHZ_TO_KHZ(40))
3207 -               bw_flags |= IEEE80211_CHAN_NO_HT40;
3208 +               bw_flags = IEEE80211_CHAN_NO_HT40;
3209         if (max_bandwidth_khz < MHZ_TO_KHZ(80))
3210                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
3211         if (max_bandwidth_khz < MHZ_TO_KHZ(160))
3212 @@ -1522,12 +1518,8 @@ static void handle_channel_custom(struct
3213         if (reg_rule->flags & NL80211_RRF_AUTO_BW)
3214                 max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
3215
3216 -       if (max_bandwidth_khz < MHZ_TO_KHZ(10))
3217 -               bw_flags = IEEE80211_CHAN_NO_10MHZ;
3218 -       if (max_bandwidth_khz < MHZ_TO_KHZ(20))
3219 -               bw_flags |= IEEE80211_CHAN_NO_20MHZ;
3220         if (max_bandwidth_khz < MHZ_TO_KHZ(40))
3221 -               bw_flags |= IEEE80211_CHAN_NO_HT40;
3222 +               bw_flags = IEEE80211_CHAN_NO_HT40;
3223         if (max_bandwidth_khz < MHZ_TO_KHZ(80))
3224                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
3225         if (max_bandwidth_khz < MHZ_TO_KHZ(160))
3226 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
3227 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
3228 @@ -185,7 +185,8 @@ struct ath_atx_ac {
3229
3230  struct ath_frame_info {
3231         struct ath_buf *bf;
3232 -       int framelen;
3233 +       u16 framelen;
3234 +       s8 txq;
3235         enum ath9k_key_type keytype;
3236         u8 keyix;
3237         u8 rtscts_rate;
3238 --- a/drivers/net/wireless/ath/ath9k/xmit.c
3239 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
3240 @@ -147,15 +147,13 @@ static void ath_set_rates(struct ieee802
3241  static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
3242                              struct sk_buff *skb)
3243  {
3244 -       int q;
3245 -
3246 -       q = skb_get_queue_mapping(skb);
3247 -       if (txq == sc->tx.uapsdq)
3248 -               txq = sc->tx.txq_map[q];
3249 +       struct ath_frame_info *fi = get_frame_info(skb);
3250 +       int q = fi->txq;
3251
3252 -       if (txq != sc->tx.txq_map[q])
3253 +       if (q < 0)
3254                 return;
3255
3256 +       txq = sc->tx.txq_map[q];
3257         if (WARN_ON(--txq->pending_frames < 0))
3258                 txq->pending_frames = 0;
3259
3260 @@ -887,6 +885,15 @@ ath_tx_get_tid_subframe(struct ath_softc
3261
3262                 tx_info = IEEE80211_SKB_CB(skb);
3263                 tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
3264 +
3265 +               /*
3266 +                * No aggregation session is running, but there may be frames
3267 +                * from a previous session or a failed attempt in the queue.
3268 +                * Send them out as normal data frames
3269 +                */
3270 +               if (!tid->active)
3271 +                       tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
3272 +
3273                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
3274                         bf->bf_state.bf_type = 0;
3275                         return bf;
3276 @@ -1999,6 +2006,7 @@ static void setup_frame_info(struct ieee
3277                 an = (struct ath_node *) sta->drv_priv;
3278
3279         memset(fi, 0, sizeof(*fi));
3280 +       fi->txq = -1;
3281         if (hw_key)
3282                 fi->keyix = hw_key->hw_key_idx;
3283         else if (an && ieee80211_is_data(hdr->frame_control) && an->ps_key > 0)
3284 @@ -2150,6 +2158,7 @@ int ath_tx_start(struct ieee80211_hw *hw
3285         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3286         struct ieee80211_sta *sta = txctl->sta;
3287         struct ieee80211_vif *vif = info->control.vif;
3288 +       struct ath_frame_info *fi = get_frame_info(skb);
3289         struct ath_softc *sc = hw->priv;
3290         struct ath_txq *txq = txctl->txq;
3291         struct ath_atx_tid *tid = NULL;
3292 @@ -2170,11 +2179,13 @@ int ath_tx_start(struct ieee80211_hw *hw
3293         q = skb_get_queue_mapping(skb);
3294
3295         ath_txq_lock(sc, txq);
3296 -       if (txq == sc->tx.txq_map[q] &&
3297 -           ++txq->pending_frames > sc->tx.txq_max_pending[q] &&
3298 -           !txq->stopped) {
3299 -               ieee80211_stop_queue(sc->hw, q);
3300 -               txq->stopped = true;
3301 +       if (txq == sc->tx.txq_map[q]) {
3302 +               fi->txq = q;
3303 +               if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
3304 +                   !txq->stopped) {
3305 +                       ieee80211_stop_queue(sc->hw, q);
3306 +                       txq->stopped = true;
3307 +               }
3308         }
3309
3310         if (txctl->an && ieee80211_is_data_present(hdr->frame_control))
3311 --- a/net/mac80211/chan.c
3312 +++ b/net/mac80211/chan.c
3313 @@ -521,6 +521,8 @@ static void ieee80211_recalc_chanctx_cha
3314                         continue;
3315                 if (rcu_access_pointer(sdata->vif.chanctx_conf) != conf)
3316                         continue;
3317 +               if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3318 +                       continue;
3319
3320                 if (!compat)
3321                         compat = &sdata->vif.bss_conf.chandef;
3322 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
3323 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
3324 @@ -1004,9 +1004,11 @@ static bool ar5008_hw_ani_control_new(st
3325         case ATH9K_ANI_FIRSTEP_LEVEL:{
3326                 u32 level = param;
3327
3328 -               value = level;
3329 +               value = level * 2;
3330                 REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
3331                               AR_PHY_FIND_SIG_FIRSTEP, value);
3332 +               REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW,
3333 +                             AR_PHY_FIND_SIG_FIRSTEP_LOW, value);
3334
3335                 if (level != aniState->firstepLevel) {
3336                         ath_dbg(common, ANI,
3337 @@ -1040,9 +1042,8 @@ static bool ar5008_hw_ani_control_new(st
3338                 REG_RMW_FIELD(ah, AR_PHY_TIMING5,
3339                               AR_PHY_TIMING5_CYCPWR_THR1, value);
3340
3341 -               if (IS_CHAN_HT40(ah->curchan))
3342 -                       REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
3343 -                                     AR_PHY_EXT_TIMING5_CYCPWR_THR1, value);
3344 +               REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
3345 +                                 AR_PHY_EXT_TIMING5_CYCPWR_THR1, value - 1);
3346
3347                 if (level != aniState->spurImmunityLevel) {
3348                         ath_dbg(common, ANI,
3349 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
3350 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
3351 @@ -517,6 +517,23 @@ static void ar9003_hw_spur_mitigate(stru
3352         ar9003_hw_spur_mitigate_ofdm(ah, chan);
3353  }
3354
3355 +static u32 ar9003_hw_compute_pll_control_soc(struct ath_hw *ah,
3356 +                                            struct ath9k_channel *chan)
3357 +{
3358 +       u32 pll;
3359 +
3360 +       pll = SM(0x5, AR_RTC_9300_SOC_PLL_REFDIV);
3361 +
3362 +       if (chan && IS_CHAN_HALF_RATE(chan))
3363 +               pll |= SM(0x1, AR_RTC_9300_SOC_PLL_CLKSEL);
3364 +       else if (chan && IS_CHAN_QUARTER_RATE(chan))
3365 +               pll |= SM(0x2, AR_RTC_9300_SOC_PLL_CLKSEL);
3366 +
3367 +       pll |= SM(0x2c, AR_RTC_9300_SOC_PLL_DIV_INT);
3368 +
3369 +       return pll;
3370 +}
3371 +
3372  static u32 ar9003_hw_compute_pll_control(struct ath_hw *ah,
3373                                          struct ath9k_channel *chan)
3374  {
3375 @@ -647,6 +664,19 @@ static void ar9003_hw_override_ini(struc
3376                 ah->enabled_cals |= TX_CL_CAL;
3377         else
3378                 ah->enabled_cals &= ~TX_CL_CAL;
3379 +
3380 +       if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
3381 +               if (ah->is_clk_25mhz) {
3382 +                       REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
3383 +                       REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
3384 +                       REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
3385 +               } else {
3386 +                       REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
3387 +                       REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
3388 +                       REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
3389 +               }
3390 +               udelay(100);
3391 +       }
3392  }
3393
3394  static void ar9003_hw_prog_ini(struct ath_hw *ah,
3395 @@ -1779,7 +1809,12 @@ void ar9003_hw_attach_phy_ops(struct ath
3396
3397         priv_ops->rf_set_freq = ar9003_hw_set_channel;
3398         priv_ops->spur_mitigate_freq = ar9003_hw_spur_mitigate;
3399 -       priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
3400 +
3401 +       if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
3402 +               priv_ops->compute_pll_control = ar9003_hw_compute_pll_control_soc;
3403 +       else
3404 +               priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
3405 +
3406         priv_ops->set_channel_regs = ar9003_hw_set_channel_regs;
3407         priv_ops->init_bb = ar9003_hw_init_bb;
3408         priv_ops->process_ini = ar9003_hw_process_ini;
3409 --- a/drivers/net/wireless/ath/ath9k/hw.c
3410 +++ b/drivers/net/wireless/ath/ath9k/hw.c
3411 @@ -702,6 +702,8 @@ static void ath9k_hw_init_pll(struct ath
3412  {
3413         u32 pll;
3414
3415 +       pll = ath9k_hw_compute_pll_control(ah, chan);
3416 +
3417         if (AR_SREV_9485(ah) || AR_SREV_9565(ah)) {
3418                 /* program BB PLL ki and kd value, ki=0x4, kd=0x40 */
3419                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
3420 @@ -752,7 +754,8 @@ static void ath9k_hw_init_pll(struct ath
3421                 REG_RMW_FIELD(ah, AR_CH0_DDR_DPLL3,
3422                               AR_CH0_DPLL3_PHASE_SHIFT, 0x1);
3423
3424 -               REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
3425 +               REG_WRITE(ah, AR_RTC_PLL_CONTROL,
3426 +                         pll | AR_RTC_9300_PLL_BYPASS);
3427                 udelay(1000);
3428
3429                 /* program refdiv, nint, frac to RTC register */
3430 @@ -768,7 +771,8 @@ static void ath9k_hw_init_pll(struct ath
3431         } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
3432                 u32 regval, pll2_divint, pll2_divfrac, refdiv;
3433
3434 -               REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
3435 +               REG_WRITE(ah, AR_RTC_PLL_CONTROL,
3436 +                         pll | AR_RTC_9300_SOC_PLL_BYPASS);
3437                 udelay(1000);
3438
3439                 REG_SET_BIT(ah, AR_PHY_PLL_MODE, 0x1 << 16);
3440 @@ -840,7 +844,6 @@ static void ath9k_hw_init_pll(struct ath
3441                 udelay(1000);
3442         }
3443
3444 -       pll = ath9k_hw_compute_pll_control(ah, chan);
3445         if (AR_SREV_9565(ah))
3446                 pll |= 0x40000;
3447         REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
3448 @@ -858,19 +861,6 @@ static void ath9k_hw_init_pll(struct ath
3449         udelay(RTC_PLL_SETTLE_DELAY);
3450
3451         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
3452 -
3453 -       if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
3454 -               if (ah->is_clk_25mhz) {
3455 -                       REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
3456 -                       REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
3457 -                       REG_WRITE(ah,  AR_SLP32_INC, 0x0001e7ae);
3458 -               } else {
3459 -                       REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
3460 -                       REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
3461 -                       REG_WRITE(ah,  AR_SLP32_INC, 0x0001e800);
3462 -               }
3463 -               udelay(100);
3464 -       }
3465  }
3466
3467  static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
3468 --- a/drivers/net/wireless/ath/ath9k/reg.h
3469 +++ b/drivers/net/wireless/ath/ath9k/reg.h
3470 @@ -1236,12 +1236,23 @@ enum {
3471  #define AR_CH0_DPLL3_PHASE_SHIFT_S   23
3472  #define AR_PHY_CCA_NOM_VAL_2GHZ      -118
3473
3474 +#define AR_RTC_9300_SOC_PLL_DIV_INT          0x0000003f
3475 +#define AR_RTC_9300_SOC_PLL_DIV_INT_S        0
3476 +#define AR_RTC_9300_SOC_PLL_DIV_FRAC         0x000fffc0
3477 +#define AR_RTC_9300_SOC_PLL_DIV_FRAC_S       6
3478 +#define AR_RTC_9300_SOC_PLL_REFDIV           0x01f00000
3479 +#define AR_RTC_9300_SOC_PLL_REFDIV_S         20
3480 +#define AR_RTC_9300_SOC_PLL_CLKSEL           0x06000000
3481 +#define AR_RTC_9300_SOC_PLL_CLKSEL_S         25
3482 +#define AR_RTC_9300_SOC_PLL_BYPASS           0x08000000
3483 +
3484  #define AR_RTC_9300_PLL_DIV          0x000003ff
3485  #define AR_RTC_9300_PLL_DIV_S        0
3486  #define AR_RTC_9300_PLL_REFDIV       0x00003C00
3487  #define AR_RTC_9300_PLL_REFDIV_S     10
3488  #define AR_RTC_9300_PLL_CLKSEL       0x0000C000
3489  #define AR_RTC_9300_PLL_CLKSEL_S     14
3490 +#define AR_RTC_9300_PLL_BYPASS       0x00010000
3491
3492  #define AR_RTC_9160_PLL_DIV    0x000003ff
3493  #define AR_RTC_9160_PLL_DIV_S   0
3494 --- a/drivers/net/wireless/ath/ath9k/common.c
3495 +++ b/drivers/net/wireless/ath/ath9k/common.c
3496 @@ -368,11 +368,11 @@ void ath9k_cmn_update_txpow(struct ath_h
3497  {
3498         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
3499
3500 -       if (reg->power_limit != new_txpow) {
3501 +       if (reg->power_limit != new_txpow)
3502                 ath9k_hw_set_txpowerlimit(ah, new_txpow, false);
3503 -               /* read back in case value is clamped */
3504 -               *txpower = reg->max_power_level;
3505 -       }
3506 +
3507 +       /* read back in case value is clamped */
3508 +       *txpower = reg->max_power_level;
3509  }
3510  EXPORT_SYMBOL(ath9k_cmn_update_txpow);
3511
3512 --- a/drivers/net/wireless/b43/phy_common.c
3513 +++ b/drivers/net/wireless/b43/phy_common.c
3514 @@ -276,8 +276,7 @@ void b43_phy_write(struct b43_wldev *dev
3515  void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
3516  {
3517         assert_mac_suspended(dev);
3518 -       dev->phy.ops->phy_write(dev, destreg,
3519 -               dev->phy.ops->phy_read(dev, srcreg));
3520 +       b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
3521  }
3522
3523  void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
3524 --- a/drivers/net/wireless/ath/ath9k/hw.h
3525 +++ b/drivers/net/wireless/ath/ath9k/hw.h
3526 @@ -216,8 +216,8 @@
3527  #define AH_WOW_BEACON_MISS             BIT(3)
3528
3529  enum ath_hw_txq_subtype {
3530 -       ATH_TXQ_AC_BE = 0,
3531 -       ATH_TXQ_AC_BK = 1,
3532 +       ATH_TXQ_AC_BK = 0,
3533 +       ATH_TXQ_AC_BE = 1,
3534         ATH_TXQ_AC_VI = 2,
3535         ATH_TXQ_AC_VO = 3,
3536  };
3537 --- a/drivers/net/wireless/ath/ath9k/mac.c
3538 +++ b/drivers/net/wireless/ath/ath9k/mac.c
3539 @@ -311,14 +311,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw
3540                 q = ATH9K_NUM_TX_QUEUES - 3;
3541                 break;
3542         case ATH9K_TX_QUEUE_DATA:
3543 -               for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++)
3544 -                       if (ah->txq[q].tqi_type ==
3545 -                           ATH9K_TX_QUEUE_INACTIVE)
3546 -                               break;
3547 -               if (q == ATH9K_NUM_TX_QUEUES) {
3548 -                       ath_err(common, "No available TX queue\n");
3549 -                       return -1;
3550 -               }
3551 +               q = qinfo->tqi_subtype;
3552                 break;
3553         default:
3554                 ath_err(common, "Invalid TX queue type: %u\n", type);