package/mac80211/patches/300-pending_work.patch

   1 --- a/drivers/net/wireless/ath/ath5k/base.c
   2 +++ b/drivers/net/wireless/ath/ath5k/base.c
   3 @@ -325,6 +325,8 @@ ath5k_setup_channels(struct ath5k_hw *ah
   4                 if (!ath5k_is_standard_channel(ch, band))
   5                         continue;
   6
   7 +               channels[count].max_power = AR5K_TUNE_MAX_TXPOWER/2;
   8 +
   9                 count++;
  10         }
  11
  12 @@ -850,7 +852,7 @@ ath5k_txbuf_free_skb(struct ath5k_hw *ah
  13                 return;
  14         dma_unmap_single(ah->dev, bf->skbaddr, bf->skb->len,
  15                         DMA_TO_DEVICE);
  16 -       dev_kfree_skb_any(bf->skb);
  17 +       ieee80211_free_txskb(ah->hw, bf->skb);
  18         bf->skb = NULL;
  19         bf->skbaddr = 0;
  20         bf->desc->ds_data = 0;
  21 @@ -1577,7 +1579,7 @@ ath5k_tx_queue(struct ieee80211_hw *hw,
  22         return;
  23
  24  drop_packet:
  25 -       dev_kfree_skb_any(skb);
  26 +       ieee80211_free_txskb(hw, skb);
  27  }
  28
  29  static void
  30 --- a/net/mac80211/agg-rx.c
  31 +++ b/net/mac80211/agg-rx.c
  32 @@ -203,6 +203,8 @@ static void ieee80211_send_addba_resp(st
  33                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  34         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
  35                 memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
  36 +       else if (sdata->vif.type == NL80211_IFTYPE_WDS)
  37 +               memcpy(mgmt->bssid, da, ETH_ALEN);
  38
  39         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  40                                           IEEE80211_STYPE_ACTION);
  41 --- a/net/mac80211/agg-tx.c
  42 +++ b/net/mac80211/agg-tx.c
  43 @@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
  44         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  45         if (sdata->vif.type == NL80211_IFTYPE_AP ||
  46             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  47 -           sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  48 +           sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
  49 +           sdata->vif.type == NL80211_IFTYPE_WDS)
  50                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  51         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  52                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  53 @@ -460,6 +461,7 @@ int ieee80211_start_tx_ba_session(struct
  54             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  55             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  56             sdata->vif.type != NL80211_IFTYPE_AP &&
  57 +           sdata->vif.type != NL80211_IFTYPE_WDS &&
  58             sdata->vif.type != NL80211_IFTYPE_ADHOC)
  59                 return -EINVAL;
  60
  61 @@ -869,7 +871,7 @@ void ieee80211_process_addba_resp(struct
  62
  63         } else {
  64                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
  65 -                                               true);
  66 +                                               false);
  67         }
  68
  69   out:
  70 --- a/net/mac80211/debugfs_sta.c
  71 +++ b/net/mac80211/debugfs_sta.c
  72 @@ -63,11 +63,11 @@ static ssize_t sta_flags_read(struct fil
  73         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  74
  75         int res = scnprintf(buf, sizeof(buf),
  76 -                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  77 +                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  78                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
  79                             TEST(PS_DRIVER), TEST(AUTHORIZED),
  80                             TEST(SHORT_PREAMBLE),
  81 -                           TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
  82 +                           TEST(WME), TEST(CLEAR_PS_FILT),
  83                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  84                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  85                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
  86 --- a/net/mac80211/iface.c
  87 +++ b/net/mac80211/iface.c
  88 @@ -420,7 +420,6 @@ int ieee80211_do_open(struct wireless_de
  89         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  90         struct net_device *dev = wdev->netdev;
  91         struct ieee80211_local *local = sdata->local;
  92 -       struct sta_info *sta;
  93         u32 changed = 0;
  94         int res;
  95         u32 hw_reconf_flags = 0;
  96 @@ -575,30 +574,8 @@ int ieee80211_do_open(struct wireless_de
  97
  98         set_bit(SDATA_STATE_RUNNING, &sdata->state);
  99
 100 -       if (sdata->vif.type == NL80211_IFTYPE_WDS) {
 101 -               /* Create STA entry for the WDS peer */
 102 -               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 103 -                                    GFP_KERNEL);
 104 -               if (!sta) {
 105 -                       res = -ENOMEM;
 106 -                       goto err_del_interface;
 107 -               }
 108 -
 109 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 110 -               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 111 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 112 -
 113 -               res = sta_info_insert(sta);
 114 -               if (res) {
 115 -                       /* STA has been freed */
 116 -                       goto err_del_interface;
 117 -               }
 118 -
 119 -               rate_control_rate_init(sta);
 120 -               netif_carrier_on(dev);
 121 -       } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
 122 +       if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 123                 rcu_assign_pointer(local->p2p_sdata, sdata);
 124 -       }
 125
 126         /*
 127          * set_multicast_list will be invoked by the networking core
 128 @@ -849,7 +826,7 @@ static void ieee80211_do_stop(struct iee
 129                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 130                         if (info->control.vif == &sdata->vif) {
 131                                 __skb_unlink(skb, &local->pending[i]);
 132 -                               dev_kfree_skb_irq(skb);
 133 +                               ieee80211_free_txskb(&local->hw, skb);
 134                         }
 135                 }
 136         }
 137 @@ -997,6 +974,72 @@ static void ieee80211_if_setup(struct ne
 138         dev->destructor = free_netdev;
 139  }
 140
 141 +static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 142 +                                        struct sk_buff *skb)
 143 +{
 144 +       struct ieee80211_local *local = sdata->local;
 145 +       struct ieee80211_rx_status *rx_status;
 146 +       struct ieee802_11_elems elems;
 147 +       struct ieee80211_mgmt *mgmt;
 148 +       struct sta_info *sta;
 149 +       size_t baselen;
 150 +       u32 rates = 0;
 151 +       u16 stype;
 152 +       bool new = false;
 153 +       enum ieee80211_band band = local->hw.conf.channel->band;
 154 +       struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
 155 +
 156 +       rx_status = IEEE80211_SKB_RXCB(skb);
 157 +       mgmt = (struct ieee80211_mgmt *) skb->data;
 158 +       stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 159 +
 160 +       if (stype != IEEE80211_STYPE_BEACON)
 161 +               return;
 162 +
 163 +       baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
 164 +       if (baselen > skb->len)
 165 +               return;
 166 +
 167 +       ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
 168 +                              skb->len - baselen, &elems);
 169 +
 170 +       rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 171 +
 172 +       rcu_read_lock();
 173 +
 174 +       sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
 175 +
 176 +       if (!sta) {
 177 +               rcu_read_unlock();
 178 +               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 179 +                                    GFP_KERNEL);
 180 +               if (!sta)
 181 +                       return;
 182 +
 183 +               new = true;
 184 +       }
 185 +
 186 +       sta->last_rx = jiffies;
 187 +       sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
 188 +
 189 +       if (elems.ht_cap_elem)
 190 +               ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
 191 +                               elems.ht_cap_elem, &sta->sta.ht_cap);
 192 +
 193 +       if (elems.wmm_param)
 194 +               set_sta_flag(sta, WLAN_STA_WME);
 195 +
 196 +       if (new) {
 197 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 198 +               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 199 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 200 +               rate_control_rate_init(sta);
 201 +               sta_info_insert_rcu(sta);
 202 +       }
 203 +
 204 +       rcu_read_unlock();
 205 +}
 206 +
 207  static void ieee80211_iface_work(struct work_struct *work)
 208  {
 209         struct ieee80211_sub_if_data *sdata =
 210 @@ -1101,6 +1144,9 @@ static void ieee80211_iface_work(struct
 211                                 break;
 212                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 213                         break;
 214 +               case NL80211_IFTYPE_WDS:
 215 +                       ieee80211_wds_rx_queued_mgmt(sdata, skb);
 216 +                       break;
 217                 default:
 218                         WARN(1, "frame for unexpected interface type");
 219                         break;
 220 --- a/net/mac80211/rx.c
 221 +++ b/net/mac80211/rx.c
 222 @@ -2279,6 +2279,7 @@ ieee80211_rx_h_action(struct ieee80211_r
 223                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
 224                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 225                     sdata->vif.type != NL80211_IFTYPE_AP &&
 226 +                   sdata->vif.type != NL80211_IFTYPE_WDS &&
 227                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
 228                         break;
 229
 230 @@ -2496,14 +2497,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
 231
 232         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
 233             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 234 -           sdata->vif.type != NL80211_IFTYPE_STATION)
 235 +           sdata->vif.type != NL80211_IFTYPE_STATION &&
 236 +           sdata->vif.type != NL80211_IFTYPE_WDS)
 237                 return RX_DROP_MONITOR;
 238
 239         switch (stype) {
 240         case cpu_to_le16(IEEE80211_STYPE_AUTH):
 241         case cpu_to_le16(IEEE80211_STYPE_BEACON):
 242         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 243 -               /* process for all: mesh, mlme, ibss */
 244 +               /* process for all: mesh, mlme, ibss, wds */
 245                 break;
 246         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 247         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
 248 @@ -2827,10 +2829,16 @@ static int prepare_for_handlers(struct i
 249                 }
 250                 break;
 251         case NL80211_IFTYPE_WDS:
 252 -               if (bssid || !ieee80211_is_data(hdr->frame_control))
 253 -                       return 0;
 254                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
 255                         return 0;
 256 +
 257 +               if (ieee80211_is_data(hdr->frame_control) ||
 258 +                   ieee80211_is_action(hdr->frame_control)) {
 259 +                       if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
 260 +                               return 0;
 261 +               } else if (!ieee80211_is_beacon(hdr->frame_control))
 262 +                       return 0;
 263 +
 264                 break;
 265         case NL80211_IFTYPE_P2P_DEVICE:
 266                 if (!ieee80211_is_public_action(hdr, skb->len) &&
 267 --- a/net/mac80211/sta_info.h
 268 +++ b/net/mac80211/sta_info.h
 269 @@ -32,7 +32,6 @@
 270   * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
 271   *     frames.
 272   * @WLAN_STA_WME: Station is a QoS-STA.
 273 - * @WLAN_STA_WDS: Station is one of our WDS peers.
 274   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
 275   *     IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
 276   *     frame to this station is transmitted.
 277 @@ -64,7 +63,6 @@ enum ieee80211_sta_info_flags {
 278         WLAN_STA_AUTHORIZED,
 279         WLAN_STA_SHORT_PREAMBLE,
 280         WLAN_STA_WME,
 281 -       WLAN_STA_WDS,
 282         WLAN_STA_CLEAR_PS_FILT,
 283         WLAN_STA_MFP,
 284         WLAN_STA_BLOCK_BA,
 285 --- a/net/mac80211/status.c
 286 +++ b/net/mac80211/status.c
 287 @@ -34,7 +34,7 @@ void ieee80211_tx_status_irqsafe(struct
 288                 skb_queue_len(&local->skb_queue_unreliable);
 289         while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
 290                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
 291 -               dev_kfree_skb_irq(skb);
 292 +               ieee80211_free_txskb(hw, skb);
 293                 tmp--;
 294                 I802_DEBUG_INC(local->tx_status_drop);
 295         }
 296 @@ -159,7 +159,7 @@ static void ieee80211_handle_filtered_fr
 297                            "dropped TX filtered frame, queue_len=%d PS=%d @%lu\n",
 298                            skb_queue_len(&sta->tx_filtered[ac]),
 299                            !!test_sta_flag(sta, WLAN_STA_PS_STA), jiffies);
 300 -       dev_kfree_skb(skb);
 301 +       ieee80211_free_txskb(&local->hw, skb);
 302  }
 303
 304  static void ieee80211_check_pending_bar(struct sta_info *sta, u8 *addr, u8 tid)
 305 @@ -324,6 +324,75 @@ static void ieee80211_add_tx_radiotap_he
 306
 307  }
 308
 309 +static void ieee80211_report_used_skb(struct ieee80211_local *local,
 310 +                                     struct sk_buff *skb, bool dropped)
 311 +{
 312 +       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 313 +       struct ieee80211_hdr *hdr = (void *)skb->data;
 314 +       bool acked = info->flags & IEEE80211_TX_STAT_ACK;
 315 +
 316 +       if (dropped)
 317 +               acked = false;
 318 +
 319 +       if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
 320 +               struct ieee80211_sub_if_data *sdata = NULL;
 321 +               struct ieee80211_sub_if_data *iter_sdata;
 322 +               u64 cookie = (unsigned long)skb;
 323 +
 324 +               rcu_read_lock();
 325 +
 326 +               if (skb->dev) {
 327 +                       list_for_each_entry_rcu(iter_sdata, &local->interfaces,
 328 +                                               list) {
 329 +                               if (!iter_sdata->dev)
 330 +                                       continue;
 331 +
 332 +                               if (skb->dev == iter_sdata->dev) {
 333 +                                       sdata = iter_sdata;
 334 +                                       break;
 335 +                               }
 336 +                       }
 337 +               } else {
 338 +                       sdata = rcu_dereference(local->p2p_sdata);
 339 +               }
 340 +
 341 +               if (!sdata)
 342 +                       skb->dev = NULL;
 343 +               else if (ieee80211_is_nullfunc(hdr->frame_control) ||
 344 +                        ieee80211_is_qos_nullfunc(hdr->frame_control)) {
 345 +                       cfg80211_probe_status(sdata->dev, hdr->addr1,
 346 +                                             cookie, acked, GFP_ATOMIC);
 347 +               } else {
 348 +                       cfg80211_mgmt_tx_status(&sdata->wdev, cookie, skb->data,
 349 +                                               skb->len, acked, GFP_ATOMIC);
 350 +               }
 351 +
 352 +               rcu_read_unlock();
 353 +       }
 354 +
 355 +       if (unlikely(info->ack_frame_id)) {
 356 +               struct sk_buff *ack_skb;
 357 +               unsigned long flags;
 358 +
 359 +               spin_lock_irqsave(&local->ack_status_lock, flags);
 360 +               ack_skb = idr_find(&local->ack_status_frames,
 361 +                                  info->ack_frame_id);
 362 +               if (ack_skb)
 363 +                       idr_remove(&local->ack_status_frames,
 364 +                                  info->ack_frame_id);
 365 +               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 366 +
 367 +               if (ack_skb) {
 368 +                       if (!dropped) {
 369 +                               /* consumes ack_skb */
 370 +                               skb_complete_wifi_ack(ack_skb, acked);
 371 +                       } else {
 372 +                               dev_kfree_skb_any(ack_skb);
 373 +                       }
 374 +               }
 375 +       }
 376 +}
 377 +
 378  /*
 379   * Use a static threshold for now, best value to be determined
 380   * by testing ...
 381 @@ -515,50 +584,7 @@ void ieee80211_tx_status(struct ieee8021
 382                                         msecs_to_jiffies(10));
 383         }
 384
 385 -       if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
 386 -               u64 cookie = (unsigned long)skb;
 387 -               acked = info->flags & IEEE80211_TX_STAT_ACK;
 388 -
 389 -               if (ieee80211_is_nullfunc(hdr->frame_control) ||
 390 -                   ieee80211_is_qos_nullfunc(hdr->frame_control)) {
 391 -                       cfg80211_probe_status(skb->dev, hdr->addr1,
 392 -                                             cookie, acked, GFP_ATOMIC);
 393 -               } else if (skb->dev) {
 394 -                       cfg80211_mgmt_tx_status(
 395 -                               skb->dev->ieee80211_ptr, cookie, skb->data,
 396 -                               skb->len, acked, GFP_ATOMIC);
 397 -               } else {
 398 -                       struct ieee80211_sub_if_data *p2p_sdata;
 399 -
 400 -                       rcu_read_lock();
 401 -
 402 -                       p2p_sdata = rcu_dereference(local->p2p_sdata);
 403 -                       if (p2p_sdata) {
 404 -                               cfg80211_mgmt_tx_status(
 405 -                                       &p2p_sdata->wdev, cookie, skb->data,
 406 -                                       skb->len, acked, GFP_ATOMIC);
 407 -                       }
 408 -                       rcu_read_unlock();
 409 -               }
 410 -       }
 411 -
 412 -       if (unlikely(info->ack_frame_id)) {
 413 -               struct sk_buff *ack_skb;
 414 -               unsigned long flags;
 415 -
 416 -               spin_lock_irqsave(&local->ack_status_lock, flags);
 417 -               ack_skb = idr_find(&local->ack_status_frames,
 418 -                                  info->ack_frame_id);
 419 -               if (ack_skb)
 420 -                       idr_remove(&local->ack_status_frames,
 421 -                                  info->ack_frame_id);
 422 -               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 423 -
 424 -               /* consumes ack_skb */
 425 -               if (ack_skb)
 426 -                       skb_complete_wifi_ack(ack_skb,
 427 -                               info->flags & IEEE80211_TX_STAT_ACK);
 428 -       }
 429 +       ieee80211_report_used_skb(local, skb, false);
 430
 431         /* this was a transmitted frame, but now we want to reuse it */
 432         skb_orphan(skb);
 433 @@ -634,25 +660,17 @@ EXPORT_SYMBOL(ieee80211_report_low_ack);
 434  void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
 435  {
 436         struct ieee80211_local *local = hw_to_local(hw);
 437 -       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 438 -
 439 -       if (unlikely(info->ack_frame_id)) {
 440 -               struct sk_buff *ack_skb;
 441 -               unsigned long flags;
 442 -
 443 -               spin_lock_irqsave(&local->ack_status_lock, flags);
 444 -               ack_skb = idr_find(&local->ack_status_frames,
 445 -                                  info->ack_frame_id);
 446 -               if (ack_skb)
 447 -                       idr_remove(&local->ack_status_frames,
 448 -                                  info->ack_frame_id);
 449 -               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 450 -
 451 -               /* consumes ack_skb */
 452 -               if (ack_skb)
 453 -                       dev_kfree_skb_any(ack_skb);
 454 -       }
 455
 456 +       ieee80211_report_used_skb(local, skb, true);
 457         dev_kfree_skb_any(skb);
 458  }
 459  EXPORT_SYMBOL(ieee80211_free_txskb);
 460 +
 461 +void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 462 +                             struct sk_buff_head *skbs)
 463 +{
 464 +       struct sk_buff *skb;
 465 +
 466 +       while ((skb = __skb_dequeue(skbs)))
 467 +               ieee80211_free_txskb(hw, skb);
 468 +}
 469 --- a/drivers/net/wireless/p54/main.c
 470 +++ b/drivers/net/wireless/p54/main.c
 471 @@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(stru
 472  static int p54_beacon_update(struct p54_common *priv,
 473                         struct ieee80211_vif *vif)
 474  {
 475 +       struct ieee80211_tx_control control = { };
 476         struct sk_buff *beacon;
 477         int ret;
 478
 479 @@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_
 480          * to cancel the old beacon template by hand, instead the firmware
 481          * will release the previous one through the feedback mechanism.
 482          */
 483 -       p54_tx_80211(priv->hw, NULL, beacon);
 484 +       p54_tx_80211(priv->hw, &control, beacon);
 485         priv->tsf_high32 = 0;
 486         priv->tsf_low32 = 0;
 487
 488 --- a/net/wireless/reg.c
 489 +++ b/net/wireless/reg.c
 490 @@ -352,6 +352,9 @@ static void reg_regdb_search(struct work
 491         struct reg_regdb_search_request *request;
 492         const struct ieee80211_regdomain *curdom, *regdom;
 493         int i, r;
 494 +       bool set_reg = false;
 495 +
 496 +       mutex_lock(&cfg80211_mutex);
 497
 498         mutex_lock(&reg_regdb_search_mutex);
 499         while (!list_empty(&reg_regdb_search_list)) {
 500 @@ -367,9 +370,7 @@ static void reg_regdb_search(struct work
 501                                 r = reg_copy_regd(&regdom, curdom);
 502                                 if (r)
 503                                         break;
 504 -                               mutex_lock(&cfg80211_mutex);
 505 -                               set_regdom(regdom);
 506 -                               mutex_unlock(&cfg80211_mutex);
 507 +                               set_reg = true;
 508                                 break;
 509                         }
 510                 }
 511 @@ -377,6 +378,11 @@ static void reg_regdb_search(struct work
 512                 kfree(request);
 513         }
 514         mutex_unlock(&reg_regdb_search_mutex);
 515 +
 516 +       if (set_reg)
 517 +               set_regdom(regdom);
 518 +
 519 +       mutex_unlock(&cfg80211_mutex);
 520  }
 521
 522  static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
 523 --- a/drivers/net/wireless/ath/ath9k/recv.c
 524 +++ b/drivers/net/wireless/ath/ath9k/recv.c
 525 @@ -286,7 +286,6 @@ int ath_rx_init(struct ath_softc *sc, in
 526
 527         spin_lock_init(&sc->sc_pcu_lock);
 528         spin_lock_init(&sc->rx.rxbuflock);
 529 -       clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 530
 531         common->rx_bufsize = IEEE80211_MAX_MPDU_LEN / 2 +
 532                              sc->sc_ah->caps.rx_status_len;
 533 @@ -424,8 +423,8 @@ u32 ath_calcrxfilter(struct ath_softc *s
 534                 rfilt |= ATH9K_RX_FILTER_COMP_BAR;
 535
 536         if (sc->nvifs > 1 || (sc->rx.rxfilter & FIF_OTHER_BSS)) {
 537 -               /* The following may also be needed for other older chips */
 538 -               if (sc->sc_ah->hw_version.macVersion == AR_SREV_VERSION_9160)
 539 +               /* This is needed for older chips */
 540 +               if (sc->sc_ah->hw_version.macVersion <= AR_SREV_VERSION_9160)
 541                         rfilt |= ATH9K_RX_FILTER_PROM;
 542                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
 543         }
 544 @@ -473,6 +472,13 @@ start_recv:
 545         return 0;
 546  }
 547
 548 +static void ath_flushrecv(struct ath_softc *sc)
 549 +{
 550 +       if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
 551 +               ath_rx_tasklet(sc, 1, true);
 552 +       ath_rx_tasklet(sc, 1, false);
 553 +}
 554 +
 555  bool ath_stoprecv(struct ath_softc *sc)
 556  {
 557         struct ath_hw *ah = sc->sc_ah;
 558 @@ -483,6 +489,8 @@ bool ath_stoprecv(struct ath_softc *sc)
 559         ath9k_hw_setrxfilter(ah, 0);
 560         stopped = ath9k_hw_stopdmarecv(ah, &reset);
 561
 562 +       ath_flushrecv(sc);
 563 +
 564         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
 565                 ath_edma_stop_recv(sc);
 566         else
 567 @@ -499,15 +507,6 @@ bool ath_stoprecv(struct ath_softc *sc)
 568         return stopped && !reset;
 569  }
 570
 571 -void ath_flushrecv(struct ath_softc *sc)
 572 -{
 573 -       set_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 574 -       if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
 575 -               ath_rx_tasklet(sc, 1, true);
 576 -       ath_rx_tasklet(sc, 1, false);
 577 -       clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 578 -}
 579 -
 580  static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
 581  {
 582         /* Check whether the Beacon frame has DTIM indicating buffered bc/mc */
 583 @@ -744,6 +743,7 @@ static struct ath_buf *ath_get_next_rx_b
 584                         return NULL;
 585         }
 586
 587 +       list_del(&bf->list);
 588         if (!bf->bf_mpdu)
 589                 return bf;
 590
 591 @@ -1066,9 +1066,6 @@ int ath_rx_tasklet(struct ath_softc *sc,
 592
 593         do {
 594                 bool decrypt_error = false;
 595 -               /* If handling rx interrupt and flush is in progress => exit */
 596 -               if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
 597 -                       break;
 598
 599                 memset(&rs, 0, sizeof(rs));
 600                 if (edma)
 601 @@ -1108,15 +1105,6 @@ int ath_rx_tasklet(struct ath_softc *sc,
 602                 sc->rx.num_pkts++;
 603                 ath_debug_stat_rx(sc, &rs);
 604
 605 -               /*
 606 -                * If we're asked to flush receive queue, directly
 607 -                * chain it back at the queue without processing it.
 608 -                */
 609 -               if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags)) {
 610 -                       RX_STAT_INC(rx_drop_rxflush);
 611 -                       goto requeue_drop_frag;
 612 -               }
 613 -
 614                 memset(rxs, 0, sizeof(struct ieee80211_rx_status));
 615
 616                 rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
 617 @@ -1251,14 +1239,15 @@ requeue_drop_frag:
 618                         sc->rx.frag = NULL;
 619                 }
 620  requeue:
 621 +               list_add_tail(&bf->list, &sc->rx.rxbuf);
 622 +               if (flush)
 623 +                       continue;
 624 +
 625                 if (edma) {
 626 -                       list_add_tail(&bf->list, &sc->rx.rxbuf);
 627                         ath_rx_edma_buf_link(sc, qtype);
 628                 } else {
 629 -                       list_move_tail(&bf->list, &sc->rx.rxbuf);
 630                         ath_rx_buf_link(sc, bf);
 631 -                       if (!flush)
 632 -                               ath9k_hw_rxena(ah);
 633 +                       ath9k_hw_rxena(ah);
 634                 }
 635         } while (1);
 636
 637 --- a/net/mac80211/mlme.c
 638 +++ b/net/mac80211/mlme.c
 639 @@ -818,23 +818,71 @@ void ieee80211_sta_process_chanswitch(st
 640  }
 641
 642  static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
 643 -                                       u16 capab_info, u8 *pwr_constr_elem,
 644 -                                       u8 pwr_constr_elem_len)
 645 +                                       struct ieee80211_channel *channel,
 646 +                                       const u8 *country_ie, u8 country_ie_len,
 647 +                                       const u8 *pwr_constr_elem)
 648  {
 649 -       struct ieee80211_conf *conf = &sdata->local->hw.conf;
 650 +       struct ieee80211_country_ie_triplet *triplet;
 651 +       int chan = ieee80211_frequency_to_channel(channel->center_freq);
 652 +       int i, chan_pwr, chan_increment, new_ap_level;
 653 +       bool have_chan_pwr = false;
 654
 655 -       if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
 656 +       /* Invalid IE */
 657 +       if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
 658                 return;
 659
 660 -       /* Power constraint IE length should be 1 octet */
 661 -       if (pwr_constr_elem_len != 1)
 662 -               return;
 663 +       triplet = (void *)(country_ie + 3);
 664 +       country_ie_len -= 3;
 665
 666 -       if ((*pwr_constr_elem <= conf->channel->max_reg_power) &&
 667 -           (*pwr_constr_elem != sdata->local->power_constr_level)) {
 668 -               sdata->local->power_constr_level = *pwr_constr_elem;
 669 -               ieee80211_hw_config(sdata->local, 0);
 670 +       switch (channel->band) {
 671 +       default:
 672 +               WARN_ON_ONCE(1);
 673 +               /* fall through */
 674 +       case IEEE80211_BAND_2GHZ:
 675 +       case IEEE80211_BAND_60GHZ:
 676 +               chan_increment = 1;
 677 +               break;
 678 +       case IEEE80211_BAND_5GHZ:
 679 +               chan_increment = 4;
 680 +               break;
 681         }
 682 +
 683 +       /* find channel */
 684 +       while (country_ie_len >= 3) {
 685 +               u8 first_channel = triplet->chans.first_channel;
 686 +
 687 +               if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
 688 +                       goto next;
 689 +
 690 +               for (i = 0; i < triplet->chans.num_channels; i++) {
 691 +                       if (first_channel + i * chan_increment == chan) {
 692 +                               have_chan_pwr = true;
 693 +                               chan_pwr = triplet->chans.max_power;
 694 +                               break;
 695 +                       }
 696 +               }
 697 +               if (have_chan_pwr)
 698 +                       break;
 699 +
 700 + next:
 701 +               triplet++;
 702 +               country_ie_len -= 3;
 703 +       }
 704 +
 705 +       if (!have_chan_pwr)
 706 +               return;
 707 +
 708 +       new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
 709 +
 710 +       if (sdata->local->ap_power_level == new_ap_level)
 711 +               return;
 712 +
 713 +       sdata_info(sdata,
 714 +                  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
 715 +                  new_ap_level, chan_pwr, *pwr_constr_elem,
 716 +                  sdata->u.mgd.bssid);
 717 +       sdata->local->ap_power_level = new_ap_level;
 718 +       ieee80211_hw_config(sdata->local, 0);
 719  }
 720
 721  void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
 722 @@ -1390,7 +1438,7 @@ static void ieee80211_set_disassoc(struc
 723         sta = sta_info_get(sdata, ifmgd->bssid);
 724         if (sta) {
 725                 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
 726 -               ieee80211_sta_tear_down_BA_sessions(sta, tx);
 727 +               ieee80211_sta_tear_down_BA_sessions(sta, false);
 728         }
 729         mutex_unlock(&local->sta_mtx);
 730
 731 @@ -1438,7 +1486,7 @@ static void ieee80211_set_disassoc(struc
 732         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
 733         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
 734
 735 -       local->power_constr_level = 0;
 736 +       local->ap_power_level = 0;
 737
 738         del_timer_sync(&local->dynamic_ps_timer);
 739         cancel_work_sync(&local->dynamic_ps_enable_work);
 740 @@ -2530,15 +2578,13 @@ static void ieee80211_rx_mgmt_beacon(str
 741                                                   bssid, true);
 742         }
 743
 744 -       /* Note: country IE parsing is done for us by cfg80211 */
 745 -       if (elems.country_elem) {
 746 -               /* TODO: IBSS also needs this */
 747 -               if (elems.pwr_constr_elem)
 748 -                       ieee80211_handle_pwr_constr(sdata,
 749 -                               le16_to_cpu(mgmt->u.probe_resp.capab_info),
 750 -                               elems.pwr_constr_elem,
 751 -                               elems.pwr_constr_elem_len);
 752 -       }
 753 +       if (elems.country_elem && elems.pwr_constr_elem &&
 754 +           mgmt->u.probe_resp.capab_info &
 755 +                               cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
 756 +               ieee80211_handle_pwr_constr(sdata, local->oper_channel,
 757 +                                           elems.country_elem,
 758 +                                           elems.country_elem_len,
 759 +                                           elems.pwr_constr_elem);
 760
 761         ieee80211_bss_info_change_notify(sdata, changed);
 762  }
 763 @@ -3526,6 +3572,7 @@ int ieee80211_mgd_deauth(struct ieee8021
 764  {
 765         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 766         u8 frame_buf[DEAUTH_DISASSOC_LEN];
 767 +       bool tx = !req->local_state_change;
 768
 769         mutex_lock(&ifmgd->mtx);
 770
 771 @@ -3542,12 +3589,12 @@ int ieee80211_mgd_deauth(struct ieee8021
 772         if (ifmgd->associated &&
 773             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
 774                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
 775 -                                      req->reason_code, true, frame_buf);
 776 +                                      req->reason_code, tx, frame_buf);
 777         } else {
 778                 drv_mgd_prepare_tx(sdata->local, sdata);
 779                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
 780                                                IEEE80211_STYPE_DEAUTH,
 781 -                                              req->reason_code, true,
 782 +                                              req->reason_code, tx,
 783                                                frame_buf);
 784         }
 785
 786 --- a/net/mac80211/sta_info.c
 787 +++ b/net/mac80211/sta_info.c
 788 @@ -585,7 +585,7 @@ static bool sta_info_cleanup_expire_buff
 789                  */
 790                 if (!skb)
 791                         break;
 792 -               dev_kfree_skb(skb);
 793 +               ieee80211_free_txskb(&local->hw, skb);
 794         }
 795
 796         /*
 797 @@ -614,7 +614,7 @@ static bool sta_info_cleanup_expire_buff
 798                 local->total_ps_buffered--;
 799                 ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
 800                        sta->sta.addr);
 801 -               dev_kfree_skb(skb);
 802 +               ieee80211_free_txskb(&local->hw, skb);
 803         }
 804
 805         /*
 806 @@ -674,7 +674,7 @@ int __must_check __sta_info_destroy(stru
 807          * will be sufficient.
 808          */
 809         set_sta_flag(sta, WLAN_STA_BLOCK_BA);
 810 -       ieee80211_sta_tear_down_BA_sessions(sta, true);
 811 +       ieee80211_sta_tear_down_BA_sessions(sta, false);
 812
 813         ret = sta_info_hash_del(local, sta);
 814         if (ret)
 815 @@ -730,8 +730,8 @@ int __must_check __sta_info_destroy(stru
 816
 817         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 818                 local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
 819 -               __skb_queue_purge(&sta->ps_tx_buf[ac]);
 820 -               __skb_queue_purge(&sta->tx_filtered[ac]);
 821 +               ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
 822 +               ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
 823         }
 824
 825  #ifdef CONFIG_MAC80211_MESH
 826 @@ -765,7 +765,7 @@ int __must_check __sta_info_destroy(stru
 827                 tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
 828                 if (!tid_tx)
 829                         continue;
 830 -               __skb_queue_purge(&tid_tx->pending);
 831 +               ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
 832                 kfree(tid_tx);
 833         }
 834
 835 --- a/drivers/net/wireless/ath/ath5k/phy.c
 836 +++ b/drivers/net/wireless/ath/ath5k/phy.c
 837 @@ -1977,11 +1977,13 @@ ath5k_hw_set_spur_mitigation_filter(stru
 838                         spur_delta_phase = (spur_offset << 18) / 25;
 839                         spur_freq_sigma_delta = (spur_delta_phase >> 10);
 840                         symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 2;
 841 +                       break;
 842                 case AR5K_BWMODE_5MHZ:
 843                         /* Both sample_freq and chip_freq are 10MHz (?) */
 844                         spur_delta_phase = (spur_offset << 19) / 25;
 845                         spur_freq_sigma_delta = (spur_delta_phase >> 10);
 846                         symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 4;
 847 +                       break;
 848                 default:
 849                         if (channel->band == IEEE80211_BAND_5GHZ) {
 850                                 /* Both sample_freq and chip_freq are 40MHz */
 851 --- a/net/mac80211/ieee80211_i.h
 852 +++ b/net/mac80211/ieee80211_i.h
 853 @@ -1062,7 +1062,7 @@ struct ieee80211_local {
 854         bool disable_dynamic_ps;
 855
 856         int user_power_level; /* in dBm */
 857 -       int power_constr_level; /* in dBm */
 858 +       int ap_power_level; /* in dBm */
 859
 860         enum ieee80211_smps_mode smps_mode;
 861
 862 @@ -1170,7 +1170,6 @@ struct ieee802_11_elems {
 863         u8 prep_len;
 864         u8 perr_len;
 865         u8 country_elem_len;
 866 -       u8 pwr_constr_elem_len;
 867         u8 quiet_elem_len;
 868         u8 num_of_quiet_elem;   /* can be more the one */
 869         u8 timeout_int_len;
 870 @@ -1318,6 +1317,8 @@ netdev_tx_t ieee80211_monitor_start_xmit
 871                                          struct net_device *dev);
 872  netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 873                                        struct net_device *dev);
 874 +void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 875 +                             struct sk_buff_head *skbs);
 876
 877  /* HT */
 878  void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
 879 --- a/net/mac80211/util.c
 880 +++ b/net/mac80211/util.c
 881 @@ -406,7 +406,7 @@ void ieee80211_add_pending_skb(struct ie
 882         int queue = info->hw_queue;
 883
 884         if (WARN_ON(!info->control.vif)) {
 885 -               kfree_skb(skb);
 886 +               ieee80211_free_txskb(&local->hw, skb);
 887                 return;
 888         }
 889
 890 @@ -431,7 +431,7 @@ void ieee80211_add_pending_skbs_fn(struc
 891                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 892
 893                 if (WARN_ON(!info->control.vif)) {
 894 -                       kfree_skb(skb);
 895 +                       ieee80211_free_txskb(&local->hw, skb);
 896                         continue;
 897                 }
 898
 899 @@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start
 900                         elems->country_elem_len = elen;
 901                         break;
 902                 case WLAN_EID_PWR_CONSTRAINT:
 903 +                       if (elen != 1) {
 904 +                               elem_parse_failed = true;
 905 +                               break;
 906 +                       }
 907                         elems->pwr_constr_elem = pos;
 908 -                       elems->pwr_constr_elem_len = elen;
 909                         break;
 910                 case WLAN_EID_TIMEOUT_INTERVAL:
 911                         elems->timeout_int = pos;
 912 --- a/net/mac80211/main.c
 913 +++ b/net/mac80211/main.c
 914 @@ -154,13 +154,11 @@ int ieee80211_hw_config(struct ieee80211
 915
 916         if (test_bit(SCAN_SW_SCANNING, &local->scanning) ||
 917             test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
 918 -           test_bit(SCAN_HW_SCANNING, &local->scanning))
 919 +           test_bit(SCAN_HW_SCANNING, &local->scanning) ||
 920 +           !local->ap_power_level)
 921                 power = chan->max_power;
 922         else
 923 -               power = local->power_constr_level ?
 924 -                       min(chan->max_power,
 925 -                               (chan->max_reg_power  - local->power_constr_level)) :
 926 -                       chan->max_power;
 927 +               power = min(chan->max_power, local->ap_power_level);
 928
 929         if (local->user_power_level >= 0)
 930                 power = min(power, local->user_power_level);
 931 --- a/include/net/cfg80211.h
 932 +++ b/include/net/cfg80211.h
 933 @@ -1218,6 +1218,7 @@ struct cfg80211_deauth_request {
 934         const u8 *ie;
 935         size_t ie_len;
 936         u16 reason_code;
 937 +       bool local_state_change;
 938  };
 939
 940  /**
 941 --- a/net/wireless/mlme.c
 942 +++ b/net/wireless/mlme.c
 943 @@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg802
 944                 .reason_code = reason,
 945                 .ie = ie,
 946                 .ie_len = ie_len,
 947 +               .local_state_change = local_state_change,
 948         };
 949
 950         ASSERT_WDEV_LOCK(wdev);
 951
 952 -       if (local_state_change) {
 953 -               if (wdev->current_bss &&
 954 -                   ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
 955 -                       cfg80211_unhold_bss(wdev->current_bss);
 956 -                       cfg80211_put_bss(&wdev->current_bss->pub);
 957 -                       wdev->current_bss = NULL;
 958 -               }
 959 -
 960 +       if (local_state_change && (!wdev->current_bss ||
 961 +           !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 962                 return 0;
 963 -       }
 964
 965         return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 966  }
 967 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 968 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
 969 @@ -386,7 +386,7 @@ static void ath_tx_complete_aggr(struct
 970         u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0, seq_first;
 971         u32 ba[WME_BA_BMP_SIZE >> 5];
 972         int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
 973 -       bool rc_update = true;
 974 +       bool rc_update = true, isba;
 975         struct ieee80211_tx_rate rates[4];
 976         struct ath_frame_info *fi;
 977         int nframes;
 978 @@ -430,13 +430,17 @@ static void ath_tx_complete_aggr(struct
 979         tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
 980         tid = ATH_AN_2_TID(an, tidno);
 981         seq_first = tid->seq_start;
 982 +       isba = ts->ts_flags & ATH9K_TX_BA;
 983
 984         /*
 985          * The hardware occasionally sends a tx status for the wrong TID.
 986          * In this case, the BA status cannot be considered valid and all
 987          * subframes need to be retransmitted
 988 +        *
 989 +        * Only BlockAcks have a TID and therefore normal Acks cannot be
 990 +        * checked
 991          */
 992 -       if (tidno != ts->tid)
 993 +       if (isba && tidno != ts->tid)
 994                 txok = false;
 995
 996         isaggr = bf_isaggr(bf);
 997 --- a/net/mac80211/cfg.c
 998 +++ b/net/mac80211/cfg.c
 999 @@ -2563,6 +2563,9 @@ static void ieee80211_mgmt_frame_registe
1000                 else
1001                         local->probe_req_reg--;
1002
1003 +               if (!local->open_count)
1004 +                       break;
1005 +
1006                 ieee80211_queue_work(&local->hw, &local->reconfig_filter);
1007                 break;
1008         default:
1009 --- a/net/mac80211/tx.c
1010 +++ b/net/mac80211/tx.c
1011 @@ -354,7 +354,7 @@ static void purge_old_ps_buffers(struct
1012                         total += skb_queue_len(&sta->ps_tx_buf[ac]);
1013                         if (skb) {
1014                                 purged++;
1015 -                               dev_kfree_skb(skb);
1016 +                               ieee80211_free_txskb(&local->hw, skb);
1017                                 break;
1018                         }
1019                 }
1020 @@ -466,7 +466,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
1021                         ps_dbg(tx->sdata,
1022                                "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
1023                                sta->sta.addr, ac);
1024 -                       dev_kfree_skb(old);
1025 +                       ieee80211_free_txskb(&local->hw, old);
1026                 } else
1027                         tx->local->total_ps_buffered++;
1028
1029 @@ -1103,7 +1103,7 @@ static bool ieee80211_tx_prep_agg(struct
1030                 spin_unlock(&tx->sta->lock);
1031
1032                 if (purge_skb)
1033 -                       dev_kfree_skb(purge_skb);
1034 +                       ieee80211_free_txskb(&tx->local->hw, purge_skb);
1035         }
1036
1037         /* reset session timer */
1038 @@ -1214,7 +1214,7 @@ static bool ieee80211_tx_frags(struct ie
1039  #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1040                 if (WARN_ON_ONCE(q >= local->hw.queues)) {
1041                         __skb_unlink(skb, skbs);
1042 -                       dev_kfree_skb(skb);
1043 +                       ieee80211_free_txskb(&local->hw, skb);
1044                         continue;
1045                 }
1046  #endif
1047 @@ -1356,9 +1356,9 @@ static int invoke_tx_handlers(struct iee
1048         if (unlikely(res == TX_DROP)) {
1049                 I802_DEBUG_INC(tx->local->tx_handlers_drop);
1050                 if (tx->skb)
1051 -                       dev_kfree_skb(tx->skb);
1052 +                       ieee80211_free_txskb(&tx->local->hw, tx->skb);
1053                 else
1054 -                       __skb_queue_purge(&tx->skbs);
1055 +                       ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1056                 return -1;
1057         } else if (unlikely(res == TX_QUEUED)) {
1058                 I802_DEBUG_INC(tx->local->tx_handlers_queued);
1059 @@ -1393,7 +1393,7 @@ static bool ieee80211_tx(struct ieee8021
1060         res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
1061
1062         if (unlikely(res_prepare == TX_DROP)) {
1063 -               dev_kfree_skb(skb);
1064 +               ieee80211_free_txskb(&local->hw, skb);
1065                 goto out;
1066         } else if (unlikely(res_prepare == TX_QUEUED)) {
1067                 goto out;
1068 @@ -1465,7 +1465,7 @@ void ieee80211_xmit(struct ieee80211_sub
1069         headroom = max_t(int, 0, headroom);
1070
1071         if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
1072 -               dev_kfree_skb(skb);
1073 +               ieee80211_free_txskb(&local->hw, skb);
1074                 rcu_read_unlock();
1075                 return;
1076         }
1077 @@ -2056,8 +2056,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
1078                 head_need += IEEE80211_ENCRYPT_HEADROOM;
1079                 head_need += local->tx_headroom;
1080                 head_need = max_t(int, 0, head_need);
1081 -               if (ieee80211_skb_resize(sdata, skb, head_need, true))
1082 -                       goto fail;
1083 +               if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
1084 +                       ieee80211_free_txskb(&local->hw, skb);
1085 +                       return NETDEV_TX_OK;
1086 +               }
1087         }
1088
1089         if (encaps_data) {
1090 @@ -2124,10 +2126,13 @@ netdev_tx_t ieee80211_subif_start_xmit(s
1091   */
1092  void ieee80211_clear_tx_pending(struct ieee80211_local *local)
1093  {
1094 +       struct sk_buff *skb;
1095         int i;
1096
1097 -       for (i = 0; i < local->hw.queues; i++)
1098 -               skb_queue_purge(&local->pending[i]);
1099 +       for (i = 0; i < local->hw.queues; i++) {
1100 +               while ((skb = skb_dequeue(&local->pending[i])) != NULL)
1101 +                       ieee80211_free_txskb(&local->hw, skb);
1102 +       }
1103  }
1104
1105  /*
1106 @@ -2190,7 +2195,7 @@ void ieee80211_tx_pending(unsigned long
1107                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1108
1109                         if (WARN_ON(!info->control.vif)) {
1110 -                               kfree_skb(skb);
1111 +                               ieee80211_free_txskb(&local->hw, skb);
1112                                 continue;
1113                         }
1114
1115 --- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
1116 +++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
1117 @@ -65,7 +65,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct
1118         u16 qnum = skb_get_queue_mapping(skb);
1119
1120         if (WARN_ON(qnum >= ah->ah_capabilities.cap_queues.q_tx_num)) {
1121 -               dev_kfree_skb_any(skb);
1122 +               ieee80211_free_txskb(hw, skb);
1123                 return;
1124         }
1125
1126 --- a/drivers/net/wireless/ath/ath9k/hw.c
1127 +++ b/drivers/net/wireless/ath/ath9k/hw.c
1128 @@ -2568,7 +2568,7 @@ int ath9k_hw_fill_cap_info(struct ath_hw
1129
1130         if (AR_SREV_9300_20_OR_LATER(ah)) {
1131                 ah->enabled_cals |= TX_IQ_CAL;
1132 -               if (AR_SREV_9485_OR_LATER(ah))
1133 +               if (AR_SREV_9485_OR_LATER(ah) && !AR_SREV_9340(ah))
1134                         ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
1135         }
1136
1137 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
1138 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
1139 @@ -324,7 +324,6 @@ struct ath_rx {
1140
1141  int ath_startrecv(struct ath_softc *sc);
1142  bool ath_stoprecv(struct ath_softc *sc);
1143 -void ath_flushrecv(struct ath_softc *sc);
1144  u32 ath_calcrxfilter(struct ath_softc *sc);
1145  int ath_rx_init(struct ath_softc *sc, int nbufs);
1146  void ath_rx_cleanup(struct ath_softc *sc);
1147 @@ -627,7 +626,6 @@ void ath_ant_comb_update(struct ath_soft
1148  enum sc_op_flags {
1149         SC_OP_INVALID,
1150         SC_OP_BEACONS,
1151 -       SC_OP_RXFLUSH,
1152         SC_OP_ANI_RUN,
1153         SC_OP_PRIM_STA_VIF,
1154         SC_OP_HW_RESET,
1155 --- a/drivers/net/wireless/ath/ath9k/beacon.c
1156 +++ b/drivers/net/wireless/ath/ath9k/beacon.c
1157 @@ -147,6 +147,7 @@ static struct ath_buf *ath9k_beacon_gene
1158                                  skb->len, DMA_TO_DEVICE);
1159                 dev_kfree_skb_any(skb);
1160                 bf->bf_buf_addr = 0;
1161 +               bf->bf_mpdu = NULL;
1162         }
1163
1164         skb = ieee80211_beacon_get(hw, vif);
1165 @@ -359,7 +360,6 @@ void ath9k_beacon_tasklet(unsigned long
1166                 return;
1167
1168         bf = ath9k_beacon_generate(sc->hw, vif);
1169 -       WARN_ON(!bf);
1170
1171         if (sc->beacon.bmisscnt != 0) {
1172                 ath_dbg(common, BSTUCK, "resume beacon xmit after %u misses\n",
1173 --- a/drivers/net/wireless/ath/ath9k/debug.c
1174 +++ b/drivers/net/wireless/ath/ath9k/debug.c
1175 @@ -919,7 +919,6 @@ static ssize_t read_file_recv(struct fil
1176         RXS_ERR("RX-LENGTH-ERR", rx_len_err);
1177         RXS_ERR("RX-OOM-ERR", rx_oom_err);
1178         RXS_ERR("RX-RATE-ERR", rx_rate_err);
1179 -       RXS_ERR("RX-DROP-RXFLUSH", rx_drop_rxflush);
1180         RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
1181
1182         PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
1183 --- a/drivers/net/wireless/ath/ath9k/debug.h
1184 +++ b/drivers/net/wireless/ath/ath9k/debug.h
1185 @@ -198,7 +198,6 @@ struct ath_tx_stats {
1186   * @rx_oom_err:  No. of frames dropped due to OOM issues.
1187   * @rx_rate_err:  No. of frames dropped due to rate errors.
1188   * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
1189 - * @rx_drop_rxflush: No. of frames dropped due to RX-FLUSH.
1190   * @rx_beacons:  No. of beacons received.
1191   * @rx_frags:  No. of rx-fragements received.
1192   */
1193 @@ -217,7 +216,6 @@ struct ath_rx_stats {
1194         u32 rx_oom_err;
1195         u32 rx_rate_err;
1196         u32 rx_too_many_frags_err;
1197 -       u32 rx_drop_rxflush;
1198         u32 rx_beacons;
1199         u32 rx_frags;
1200  };
1201 --- a/drivers/net/wireless/ath/ath9k/main.c
1202 +++ b/drivers/net/wireless/ath/ath9k/main.c
1203 @@ -181,7 +181,7 @@ static void ath_restart_work(struct ath_
1204         ath_start_ani(sc);
1205  }
1206
1207 -static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
1208 +static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx)
1209  {
1210         struct ath_hw *ah = sc->sc_ah;
1211         bool ret = true;
1212 @@ -195,19 +195,15 @@ static bool ath_prepare_reset(struct ath
1213         ath9k_debug_samp_bb_mac(sc);
1214         ath9k_hw_disable_interrupts(ah);
1215
1216 +       tasklet_disable(&sc->intr_tq);
1217 +
1218         if (!ath_stoprecv(sc))
1219                 ret = false;
1220
1221         if (!ath_drain_all_txq(sc, retry_tx))
1222                 ret = false;
1223
1224 -       if (!flush) {
1225 -               if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
1226 -                       ath_rx_tasklet(sc, 1, true);
1227 -               ath_rx_tasklet(sc, 1, false);
1228 -       } else {
1229 -               ath_flushrecv(sc);
1230 -       }
1231 +       tasklet_enable(&sc->intr_tq);
1232
1233         return ret;
1234  }
1235 @@ -261,7 +257,6 @@ static int ath_reset_internal(struct ath
1236         struct ath_common *common = ath9k_hw_common(ah);
1237         struct ath9k_hw_cal_data *caldata = NULL;
1238         bool fastcc = true;
1239 -       bool flush = false;
1240         int r;
1241
1242         __ath_cancel_work(sc);
1243 @@ -275,11 +270,10 @@ static int ath_reset_internal(struct ath
1244
1245         if (!hchan) {
1246                 fastcc = false;
1247 -               flush = true;
1248                 hchan = ah->curchan;
1249         }
1250
1251 -       if (!ath_prepare_reset(sc, retry_tx, flush))
1252 +       if (!ath_prepare_reset(sc, retry_tx))
1253                 fastcc = false;
1254
1255         ath_dbg(common, CONFIG, "Reset to %u MHz, HT40: %d fastcc: %d\n",
1256 @@ -821,7 +815,7 @@ static void ath9k_stop(struct ieee80211_
1257                 ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
1258         }
1259
1260 -       ath_prepare_reset(sc, false, true);
1261 +       ath_prepare_reset(sc, false);
1262
1263         if (sc->rx.frag) {
1264                 dev_kfree_skb_any(sc->rx.frag);
1265 --- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
1266 +++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
1267 @@ -893,7 +893,7 @@ static bool ar9003_hw_init_cal(struct at
1268         struct ath9k_hw_cal_data *caldata = ah->caldata;
1269         bool txiqcal_done = false, txclcal_done = false;
1270         bool is_reusable = true, status = true;
1271 -       bool run_rtt_cal = false, run_agc_cal;
1272 +       bool run_rtt_cal = false, run_agc_cal, sep_iq_cal = false;
1273         bool rtt = !!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT);
1274         u32 agc_ctrl = 0, agc_supp_cals = AR_PHY_AGC_CONTROL_OFFSET_CAL |
1275                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
1276 @@ -939,7 +939,8 @@ static bool ar9003_hw_init_cal(struct at
1277                 }
1278         }
1279
1280 -       if (!(ah->enabled_cals & TX_IQ_CAL))
1281 +       if ((IS_CHAN_HALF_RATE(chan) || IS_CHAN_QUARTER_RATE(chan)) ||
1282 +           !(ah->enabled_cals & TX_IQ_CAL))
1283                 goto skip_tx_iqcal;
1284
1285         /* Do Tx IQ Calibration */
1286 @@ -959,21 +960,22 @@ static bool ar9003_hw_init_cal(struct at
1287                         REG_CLR_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
1288                                     AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
1289                 txiqcal_done = run_agc_cal = true;
1290 -               goto skip_tx_iqcal;
1291 -       } else if (caldata && !caldata->done_txiqcal_once)
1292 +       } else if (caldata && !caldata->done_txiqcal_once) {
1293                 run_agc_cal = true;
1294 +               sep_iq_cal = true;
1295 +       }
1296
1297 +skip_tx_iqcal:
1298         if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
1299                 ar9003_mci_init_cal_req(ah, &is_reusable);
1300
1301 -       if (!(IS_CHAN_HALF_RATE(chan) || IS_CHAN_QUARTER_RATE(chan))) {
1302 +       if (sep_iq_cal) {
1303                 txiqcal_done = ar9003_hw_tx_iq_cal_run(ah);
1304                 REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
1305                 udelay(5);
1306                 REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
1307         }
1308
1309 -skip_tx_iqcal:
1310         if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
1311                 /* Calibrate the AGC */
1312                 REG_WRITE(ah, AR_PHY_AGC_CONTROL,