package/mac80211/patches/300-pending_work.patch

   1 --- a/drivers/net/wireless/ath/ath5k/base.c
   2 +++ b/drivers/net/wireless/ath/ath5k/base.c
   3 @@ -325,6 +325,8 @@ ath5k_setup_channels(struct ath5k_hw *ah
   4                 if (!ath5k_is_standard_channel(ch, band))
   5                         continue;
   6
   7 +               channels[count].max_power = AR5K_TUNE_MAX_TXPOWER/2;
   8 +
   9                 count++;
  10         }
  11
  12 @@ -850,7 +852,7 @@ ath5k_txbuf_free_skb(struct ath5k_hw *ah
  13                 return;
  14         dma_unmap_single(ah->dev, bf->skbaddr, bf->skb->len,
  15                         DMA_TO_DEVICE);
  16 -       dev_kfree_skb_any(bf->skb);
  17 +       ieee80211_free_txskb(ah->hw, bf->skb);
  18         bf->skb = NULL;
  19         bf->skbaddr = 0;
  20         bf->desc->ds_data = 0;
  21 @@ -1577,7 +1579,7 @@ ath5k_tx_queue(struct ieee80211_hw *hw,
  22         return;
  23
  24  drop_packet:
  25 -       dev_kfree_skb_any(skb);
  26 +       ieee80211_free_txskb(hw, skb);
  27  }
  28
  29  static void
  30 --- a/net/mac80211/agg-rx.c
  31 +++ b/net/mac80211/agg-rx.c
  32 @@ -203,6 +203,8 @@ static void ieee80211_send_addba_resp(st
  33                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  34         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
  35                 memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
  36 +       else if (sdata->vif.type == NL80211_IFTYPE_WDS)
  37 +               memcpy(mgmt->bssid, da, ETH_ALEN);
  38
  39         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  40                                           IEEE80211_STYPE_ACTION);
  41 --- a/net/mac80211/agg-tx.c
  42 +++ b/net/mac80211/agg-tx.c
  43 @@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
  44         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  45         if (sdata->vif.type == NL80211_IFTYPE_AP ||
  46             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  47 -           sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  48 +           sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
  49 +           sdata->vif.type == NL80211_IFTYPE_WDS)
  50                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  51         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  52                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  53 @@ -460,6 +461,7 @@ int ieee80211_start_tx_ba_session(struct
  54             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  55             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  56             sdata->vif.type != NL80211_IFTYPE_AP &&
  57 +           sdata->vif.type != NL80211_IFTYPE_WDS &&
  58             sdata->vif.type != NL80211_IFTYPE_ADHOC)
  59                 return -EINVAL;
  60
  61 @@ -869,7 +871,7 @@ void ieee80211_process_addba_resp(struct
  62
  63         } else {
  64                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
  65 -                                               true);
  66 +                                               false);
  67         }
  68
  69   out:
  70 --- a/net/mac80211/debugfs_sta.c
  71 +++ b/net/mac80211/debugfs_sta.c
  72 @@ -63,11 +63,11 @@ static ssize_t sta_flags_read(struct fil
  73         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  74
  75         int res = scnprintf(buf, sizeof(buf),
  76 -                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  77 +                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  78                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
  79                             TEST(PS_DRIVER), TEST(AUTHORIZED),
  80                             TEST(SHORT_PREAMBLE),
  81 -                           TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
  82 +                           TEST(WME), TEST(CLEAR_PS_FILT),
  83                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  84                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  85                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
  86 --- a/net/mac80211/iface.c
  87 +++ b/net/mac80211/iface.c
  88 @@ -420,7 +420,6 @@ int ieee80211_do_open(struct wireless_de
  89         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  90         struct net_device *dev = wdev->netdev;
  91         struct ieee80211_local *local = sdata->local;
  92 -       struct sta_info *sta;
  93         u32 changed = 0;
  94         int res;
  95         u32 hw_reconf_flags = 0;
  96 @@ -575,30 +574,8 @@ int ieee80211_do_open(struct wireless_de
  97
  98         set_bit(SDATA_STATE_RUNNING, &sdata->state);
  99
 100 -       if (sdata->vif.type == NL80211_IFTYPE_WDS) {
 101 -               /* Create STA entry for the WDS peer */
 102 -               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 103 -                                    GFP_KERNEL);
 104 -               if (!sta) {
 105 -                       res = -ENOMEM;
 106 -                       goto err_del_interface;
 107 -               }
 108 -
 109 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 110 -               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 111 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 112 -
 113 -               res = sta_info_insert(sta);
 114 -               if (res) {
 115 -                       /* STA has been freed */
 116 -                       goto err_del_interface;
 117 -               }
 118 -
 119 -               rate_control_rate_init(sta);
 120 -               netif_carrier_on(dev);
 121 -       } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
 122 +       if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 123                 rcu_assign_pointer(local->p2p_sdata, sdata);
 124 -       }
 125
 126         /*
 127          * set_multicast_list will be invoked by the networking core
 128 @@ -849,7 +826,7 @@ static void ieee80211_do_stop(struct iee
 129                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 130                         if (info->control.vif == &sdata->vif) {
 131                                 __skb_unlink(skb, &local->pending[i]);
 132 -                               dev_kfree_skb_irq(skb);
 133 +                               ieee80211_free_txskb(&local->hw, skb);
 134                         }
 135                 }
 136         }
 137 @@ -997,6 +974,72 @@ static void ieee80211_if_setup(struct ne
 138         dev->destructor = free_netdev;
 139  }
 140
 141 +static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 142 +                                        struct sk_buff *skb)
 143 +{
 144 +       struct ieee80211_local *local = sdata->local;
 145 +       struct ieee80211_rx_status *rx_status;
 146 +       struct ieee802_11_elems elems;
 147 +       struct ieee80211_mgmt *mgmt;
 148 +       struct sta_info *sta;
 149 +       size_t baselen;
 150 +       u32 rates = 0;
 151 +       u16 stype;
 152 +       bool new = false;
 153 +       enum ieee80211_band band = local->hw.conf.channel->band;
 154 +       struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
 155 +
 156 +       rx_status = IEEE80211_SKB_RXCB(skb);
 157 +       mgmt = (struct ieee80211_mgmt *) skb->data;
 158 +       stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 159 +
 160 +       if (stype != IEEE80211_STYPE_BEACON)
 161 +               return;
 162 +
 163 +       baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
 164 +       if (baselen > skb->len)
 165 +               return;
 166 +
 167 +       ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
 168 +                              skb->len - baselen, &elems);
 169 +
 170 +       rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 171 +
 172 +       rcu_read_lock();
 173 +
 174 +       sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
 175 +
 176 +       if (!sta) {
 177 +               rcu_read_unlock();
 178 +               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 179 +                                    GFP_KERNEL);
 180 +               if (!sta)
 181 +                       return;
 182 +
 183 +               new = true;
 184 +       }
 185 +
 186 +       sta->last_rx = jiffies;
 187 +       sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
 188 +
 189 +       if (elems.ht_cap_elem)
 190 +               ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
 191 +                               elems.ht_cap_elem, &sta->sta.ht_cap);
 192 +
 193 +       if (elems.wmm_param)
 194 +               set_sta_flag(sta, WLAN_STA_WME);
 195 +
 196 +       if (new) {
 197 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 198 +               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 199 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 200 +               rate_control_rate_init(sta);
 201 +               sta_info_insert_rcu(sta);
 202 +       }
 203 +
 204 +       rcu_read_unlock();
 205 +}
 206 +
 207  static void ieee80211_iface_work(struct work_struct *work)
 208  {
 209         struct ieee80211_sub_if_data *sdata =
 210 @@ -1101,6 +1144,9 @@ static void ieee80211_iface_work(struct
 211                                 break;
 212                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 213                         break;
 214 +               case NL80211_IFTYPE_WDS:
 215 +                       ieee80211_wds_rx_queued_mgmt(sdata, skb);
 216 +                       break;
 217                 default:
 218                         WARN(1, "frame for unexpected interface type");
 219                         break;
 220 --- a/net/mac80211/rx.c
 221 +++ b/net/mac80211/rx.c
 222 @@ -2279,6 +2279,7 @@ ieee80211_rx_h_action(struct ieee80211_r
 223                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
 224                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 225                     sdata->vif.type != NL80211_IFTYPE_AP &&
 226 +                   sdata->vif.type != NL80211_IFTYPE_WDS &&
 227                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
 228                         break;
 229
 230 @@ -2496,14 +2497,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
 231
 232         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
 233             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 234 -           sdata->vif.type != NL80211_IFTYPE_STATION)
 235 +           sdata->vif.type != NL80211_IFTYPE_STATION &&
 236 +           sdata->vif.type != NL80211_IFTYPE_WDS)
 237                 return RX_DROP_MONITOR;
 238
 239         switch (stype) {
 240         case cpu_to_le16(IEEE80211_STYPE_AUTH):
 241         case cpu_to_le16(IEEE80211_STYPE_BEACON):
 242         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 243 -               /* process for all: mesh, mlme, ibss */
 244 +               /* process for all: mesh, mlme, ibss, wds */
 245                 break;
 246         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 247         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
 248 @@ -2827,10 +2829,16 @@ static int prepare_for_handlers(struct i
 249                 }
 250                 break;
 251         case NL80211_IFTYPE_WDS:
 252 -               if (bssid || !ieee80211_is_data(hdr->frame_control))
 253 -                       return 0;
 254                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
 255                         return 0;
 256 +
 257 +               if (ieee80211_is_data(hdr->frame_control) ||
 258 +                   ieee80211_is_action(hdr->frame_control)) {
 259 +                       if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
 260 +                               return 0;
 261 +               } else if (!ieee80211_is_beacon(hdr->frame_control))
 262 +                       return 0;
 263 +
 264                 break;
 265         case NL80211_IFTYPE_P2P_DEVICE:
 266                 if (!ieee80211_is_public_action(hdr, skb->len) &&
 267 --- a/net/mac80211/sta_info.h
 268 +++ b/net/mac80211/sta_info.h
 269 @@ -32,7 +32,6 @@
 270   * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
 271   *     frames.
 272   * @WLAN_STA_WME: Station is a QoS-STA.
 273 - * @WLAN_STA_WDS: Station is one of our WDS peers.
 274   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
 275   *     IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
 276   *     frame to this station is transmitted.
 277 @@ -64,7 +63,6 @@ enum ieee80211_sta_info_flags {
 278         WLAN_STA_AUTHORIZED,
 279         WLAN_STA_SHORT_PREAMBLE,
 280         WLAN_STA_WME,
 281 -       WLAN_STA_WDS,
 282         WLAN_STA_CLEAR_PS_FILT,
 283         WLAN_STA_MFP,
 284         WLAN_STA_BLOCK_BA,
 285 --- a/net/mac80211/status.c
 286 +++ b/net/mac80211/status.c
 287 @@ -34,7 +34,7 @@ void ieee80211_tx_status_irqsafe(struct
 288                 skb_queue_len(&local->skb_queue_unreliable);
 289         while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
 290                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
 291 -               dev_kfree_skb_irq(skb);
 292 +               ieee80211_free_txskb(hw, skb);
 293                 tmp--;
 294                 I802_DEBUG_INC(local->tx_status_drop);
 295         }
 296 @@ -159,7 +159,7 @@ static void ieee80211_handle_filtered_fr
 297                            "dropped TX filtered frame, queue_len=%d PS=%d @%lu\n",
 298                            skb_queue_len(&sta->tx_filtered[ac]),
 299                            !!test_sta_flag(sta, WLAN_STA_PS_STA), jiffies);
 300 -       dev_kfree_skb(skb);
 301 +       ieee80211_free_txskb(&local->hw, skb);
 302  }
 303
 304  static void ieee80211_check_pending_bar(struct sta_info *sta, u8 *addr, u8 tid)
 305 @@ -324,6 +324,75 @@ static void ieee80211_add_tx_radiotap_he
 306
 307  }
 308
 309 +static void ieee80211_report_used_skb(struct ieee80211_local *local,
 310 +                                     struct sk_buff *skb, bool dropped)
 311 +{
 312 +       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 313 +       struct ieee80211_hdr *hdr = (void *)skb->data;
 314 +       bool acked = info->flags & IEEE80211_TX_STAT_ACK;
 315 +
 316 +       if (dropped)
 317 +               acked = false;
 318 +
 319 +       if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
 320 +               struct ieee80211_sub_if_data *sdata = NULL;
 321 +               struct ieee80211_sub_if_data *iter_sdata;
 322 +               u64 cookie = (unsigned long)skb;
 323 +
 324 +               rcu_read_lock();
 325 +
 326 +               if (skb->dev) {
 327 +                       list_for_each_entry_rcu(iter_sdata, &local->interfaces,
 328 +                                               list) {
 329 +                               if (!iter_sdata->dev)
 330 +                                       continue;
 331 +
 332 +                               if (skb->dev == iter_sdata->dev) {
 333 +                                       sdata = iter_sdata;
 334 +                                       break;
 335 +                               }
 336 +                       }
 337 +               } else {
 338 +                       sdata = rcu_dereference(local->p2p_sdata);
 339 +               }
 340 +
 341 +               if (!sdata)
 342 +                       skb->dev = NULL;
 343 +               else if (ieee80211_is_nullfunc(hdr->frame_control) ||
 344 +                        ieee80211_is_qos_nullfunc(hdr->frame_control)) {
 345 +                       cfg80211_probe_status(sdata->dev, hdr->addr1,
 346 +                                             cookie, acked, GFP_ATOMIC);
 347 +               } else {
 348 +                       cfg80211_mgmt_tx_status(&sdata->wdev, cookie, skb->data,
 349 +                                               skb->len, acked, GFP_ATOMIC);
 350 +               }
 351 +
 352 +               rcu_read_unlock();
 353 +       }
 354 +
 355 +       if (unlikely(info->ack_frame_id)) {
 356 +               struct sk_buff *ack_skb;
 357 +               unsigned long flags;
 358 +
 359 +               spin_lock_irqsave(&local->ack_status_lock, flags);
 360 +               ack_skb = idr_find(&local->ack_status_frames,
 361 +                                  info->ack_frame_id);
 362 +               if (ack_skb)
 363 +                       idr_remove(&local->ack_status_frames,
 364 +                                  info->ack_frame_id);
 365 +               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 366 +
 367 +               if (ack_skb) {
 368 +                       if (!dropped) {
 369 +                               /* consumes ack_skb */
 370 +                               skb_complete_wifi_ack(ack_skb, acked);
 371 +                       } else {
 372 +                               dev_kfree_skb_any(ack_skb);
 373 +                       }
 374 +               }
 375 +       }
 376 +}
 377 +
 378  /*
 379   * Use a static threshold for now, best value to be determined
 380   * by testing ...
 381 @@ -515,50 +584,7 @@ void ieee80211_tx_status(struct ieee8021
 382                                         msecs_to_jiffies(10));
 383         }
 384
 385 -       if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
 386 -               u64 cookie = (unsigned long)skb;
 387 -               acked = info->flags & IEEE80211_TX_STAT_ACK;
 388 -
 389 -               if (ieee80211_is_nullfunc(hdr->frame_control) ||
 390 -                   ieee80211_is_qos_nullfunc(hdr->frame_control)) {
 391 -                       cfg80211_probe_status(skb->dev, hdr->addr1,
 392 -                                             cookie, acked, GFP_ATOMIC);
 393 -               } else if (skb->dev) {
 394 -                       cfg80211_mgmt_tx_status(
 395 -                               skb->dev->ieee80211_ptr, cookie, skb->data,
 396 -                               skb->len, acked, GFP_ATOMIC);
 397 -               } else {
 398 -                       struct ieee80211_sub_if_data *p2p_sdata;
 399 -
 400 -                       rcu_read_lock();
 401 -
 402 -                       p2p_sdata = rcu_dereference(local->p2p_sdata);
 403 -                       if (p2p_sdata) {
 404 -                               cfg80211_mgmt_tx_status(
 405 -                                       &p2p_sdata->wdev, cookie, skb->data,
 406 -                                       skb->len, acked, GFP_ATOMIC);
 407 -                       }
 408 -                       rcu_read_unlock();
 409 -               }
 410 -       }
 411 -
 412 -       if (unlikely(info->ack_frame_id)) {
 413 -               struct sk_buff *ack_skb;
 414 -               unsigned long flags;
 415 -
 416 -               spin_lock_irqsave(&local->ack_status_lock, flags);
 417 -               ack_skb = idr_find(&local->ack_status_frames,
 418 -                                  info->ack_frame_id);
 419 -               if (ack_skb)
 420 -                       idr_remove(&local->ack_status_frames,
 421 -                                  info->ack_frame_id);
 422 -               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 423 -
 424 -               /* consumes ack_skb */
 425 -               if (ack_skb)
 426 -                       skb_complete_wifi_ack(ack_skb,
 427 -                               info->flags & IEEE80211_TX_STAT_ACK);
 428 -       }
 429 +       ieee80211_report_used_skb(local, skb, false);
 430
 431         /* this was a transmitted frame, but now we want to reuse it */
 432         skb_orphan(skb);
 433 @@ -634,25 +660,17 @@ EXPORT_SYMBOL(ieee80211_report_low_ack);
 434  void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
 435  {
 436         struct ieee80211_local *local = hw_to_local(hw);
 437 -       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 438 -
 439 -       if (unlikely(info->ack_frame_id)) {
 440 -               struct sk_buff *ack_skb;
 441 -               unsigned long flags;
 442 -
 443 -               spin_lock_irqsave(&local->ack_status_lock, flags);
 444 -               ack_skb = idr_find(&local->ack_status_frames,
 445 -                                  info->ack_frame_id);
 446 -               if (ack_skb)
 447 -                       idr_remove(&local->ack_status_frames,
 448 -                                  info->ack_frame_id);
 449 -               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 450 -
 451 -               /* consumes ack_skb */
 452 -               if (ack_skb)
 453 -                       dev_kfree_skb_any(ack_skb);
 454 -       }
 455
 456 +       ieee80211_report_used_skb(local, skb, true);
 457         dev_kfree_skb_any(skb);
 458  }
 459  EXPORT_SYMBOL(ieee80211_free_txskb);
 460 +
 461 +void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 462 +                             struct sk_buff_head *skbs)
 463 +{
 464 +       struct sk_buff *skb;
 465 +
 466 +       while ((skb = __skb_dequeue(skbs)))
 467 +               ieee80211_free_txskb(hw, skb);
 468 +}
 469 --- a/drivers/net/wireless/p54/main.c
 470 +++ b/drivers/net/wireless/p54/main.c
 471 @@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(stru
 472  static int p54_beacon_update(struct p54_common *priv,
 473                         struct ieee80211_vif *vif)
 474  {
 475 +       struct ieee80211_tx_control control = { };
 476         struct sk_buff *beacon;
 477         int ret;
 478
 479 @@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_
 480          * to cancel the old beacon template by hand, instead the firmware
 481          * will release the previous one through the feedback mechanism.
 482          */
 483 -       p54_tx_80211(priv->hw, NULL, beacon);
 484 +       p54_tx_80211(priv->hw, &control, beacon);
 485         priv->tsf_high32 = 0;
 486         priv->tsf_low32 = 0;
 487
 488 --- a/net/wireless/reg.c
 489 +++ b/net/wireless/reg.c
 490 @@ -352,6 +352,9 @@ static void reg_regdb_search(struct work
 491         struct reg_regdb_search_request *request;
 492         const struct ieee80211_regdomain *curdom, *regdom;
 493         int i, r;
 494 +       bool set_reg = false;
 495 +
 496 +       mutex_lock(&cfg80211_mutex);
 497
 498         mutex_lock(&reg_regdb_search_mutex);
 499         while (!list_empty(&reg_regdb_search_list)) {
 500 @@ -367,9 +370,7 @@ static void reg_regdb_search(struct work
 501                                 r = reg_copy_regd(&regdom, curdom);
 502                                 if (r)
 503                                         break;
 504 -                               mutex_lock(&cfg80211_mutex);
 505 -                               set_regdom(regdom);
 506 -                               mutex_unlock(&cfg80211_mutex);
 507 +                               set_reg = true;
 508                                 break;
 509                         }
 510                 }
 511 @@ -377,6 +378,11 @@ static void reg_regdb_search(struct work
 512                 kfree(request);
 513         }
 514         mutex_unlock(&reg_regdb_search_mutex);
 515 +
 516 +       if (set_reg)
 517 +               set_regdom(regdom);
 518 +
 519 +       mutex_unlock(&cfg80211_mutex);
 520  }
 521
 522  static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
 523 --- a/drivers/net/wireless/ath/ath9k/recv.c
 524 +++ b/drivers/net/wireless/ath/ath9k/recv.c
 525 @@ -424,8 +424,8 @@ u32 ath_calcrxfilter(struct ath_softc *s
 526                 rfilt |= ATH9K_RX_FILTER_COMP_BAR;
 527
 528         if (sc->nvifs > 1 || (sc->rx.rxfilter & FIF_OTHER_BSS)) {
 529 -               /* The following may also be needed for other older chips */
 530 -               if (sc->sc_ah->hw_version.macVersion == AR_SREV_VERSION_9160)
 531 +               /* This is needed for older chips */
 532 +               if (sc->sc_ah->hw_version.macVersion <= AR_SREV_VERSION_9160)
 533                         rfilt |= ATH9K_RX_FILTER_PROM;
 534                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
 535         }
 536 --- a/net/mac80211/mlme.c
 537 +++ b/net/mac80211/mlme.c
 538 @@ -818,23 +818,71 @@ void ieee80211_sta_process_chanswitch(st
 539  }
 540
 541  static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
 542 -                                       u16 capab_info, u8 *pwr_constr_elem,
 543 -                                       u8 pwr_constr_elem_len)
 544 +                                       struct ieee80211_channel *channel,
 545 +                                       const u8 *country_ie, u8 country_ie_len,
 546 +                                       const u8 *pwr_constr_elem)
 547  {
 548 -       struct ieee80211_conf *conf = &sdata->local->hw.conf;
 549 +       struct ieee80211_country_ie_triplet *triplet;
 550 +       int chan = ieee80211_frequency_to_channel(channel->center_freq);
 551 +       int i, chan_pwr, chan_increment, new_ap_level;
 552 +       bool have_chan_pwr = false;
 553
 554 -       if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
 555 +       /* Invalid IE */
 556 +       if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
 557                 return;
 558
 559 -       /* Power constraint IE length should be 1 octet */
 560 -       if (pwr_constr_elem_len != 1)
 561 -               return;
 562 +       triplet = (void *)(country_ie + 3);
 563 +       country_ie_len -= 3;
 564
 565 -       if ((*pwr_constr_elem <= conf->channel->max_reg_power) &&
 566 -           (*pwr_constr_elem != sdata->local->power_constr_level)) {
 567 -               sdata->local->power_constr_level = *pwr_constr_elem;
 568 -               ieee80211_hw_config(sdata->local, 0);
 569 +       switch (channel->band) {
 570 +       default:
 571 +               WARN_ON_ONCE(1);
 572 +               /* fall through */
 573 +       case IEEE80211_BAND_2GHZ:
 574 +       case IEEE80211_BAND_60GHZ:
 575 +               chan_increment = 1;
 576 +               break;
 577 +       case IEEE80211_BAND_5GHZ:
 578 +               chan_increment = 4;
 579 +               break;
 580         }
 581 +
 582 +       /* find channel */
 583 +       while (country_ie_len >= 3) {
 584 +               u8 first_channel = triplet->chans.first_channel;
 585 +
 586 +               if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
 587 +                       goto next;
 588 +
 589 +               for (i = 0; i < triplet->chans.num_channels; i++) {
 590 +                       if (first_channel + i * chan_increment == chan) {
 591 +                               have_chan_pwr = true;
 592 +                               chan_pwr = triplet->chans.max_power;
 593 +                               break;
 594 +                       }
 595 +               }
 596 +               if (have_chan_pwr)
 597 +                       break;
 598 +
 599 + next:
 600 +               triplet++;
 601 +               country_ie_len -= 3;
 602 +       }
 603 +
 604 +       if (!have_chan_pwr)
 605 +               return;
 606 +
 607 +       new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
 608 +
 609 +       if (sdata->local->ap_power_level == new_ap_level)
 610 +               return;
 611 +
 612 +       sdata_info(sdata,
 613 +                  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
 614 +                  new_ap_level, chan_pwr, *pwr_constr_elem,
 615 +                  sdata->u.mgd.bssid);
 616 +       sdata->local->ap_power_level = new_ap_level;
 617 +       ieee80211_hw_config(sdata->local, 0);
 618  }
 619
 620  void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
 621 @@ -1390,7 +1438,7 @@ static void ieee80211_set_disassoc(struc
 622         sta = sta_info_get(sdata, ifmgd->bssid);
 623         if (sta) {
 624                 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
 625 -               ieee80211_sta_tear_down_BA_sessions(sta, tx);
 626 +               ieee80211_sta_tear_down_BA_sessions(sta, false);
 627         }
 628         mutex_unlock(&local->sta_mtx);
 629
 630 @@ -1438,7 +1486,7 @@ static void ieee80211_set_disassoc(struc
 631         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
 632         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
 633
 634 -       local->power_constr_level = 0;
 635 +       local->ap_power_level = 0;
 636
 637         del_timer_sync(&local->dynamic_ps_timer);
 638         cancel_work_sync(&local->dynamic_ps_enable_work);
 639 @@ -2530,15 +2578,13 @@ static void ieee80211_rx_mgmt_beacon(str
 640                                                   bssid, true);
 641         }
 642
 643 -       /* Note: country IE parsing is done for us by cfg80211 */
 644 -       if (elems.country_elem) {
 645 -               /* TODO: IBSS also needs this */
 646 -               if (elems.pwr_constr_elem)
 647 -                       ieee80211_handle_pwr_constr(sdata,
 648 -                               le16_to_cpu(mgmt->u.probe_resp.capab_info),
 649 -                               elems.pwr_constr_elem,
 650 -                               elems.pwr_constr_elem_len);
 651 -       }
 652 +       if (elems.country_elem && elems.pwr_constr_elem &&
 653 +           mgmt->u.probe_resp.capab_info &
 654 +                               cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
 655 +               ieee80211_handle_pwr_constr(sdata, local->oper_channel,
 656 +                                           elems.country_elem,
 657 +                                           elems.country_elem_len,
 658 +                                           elems.pwr_constr_elem);
 659
 660         ieee80211_bss_info_change_notify(sdata, changed);
 661  }
 662 @@ -3526,6 +3572,7 @@ int ieee80211_mgd_deauth(struct ieee8021
 663  {
 664         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 665         u8 frame_buf[DEAUTH_DISASSOC_LEN];
 666 +       bool tx = !req->local_state_change;
 667
 668         mutex_lock(&ifmgd->mtx);
 669
 670 @@ -3542,12 +3589,12 @@ int ieee80211_mgd_deauth(struct ieee8021
 671         if (ifmgd->associated &&
 672             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
 673                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
 674 -                                      req->reason_code, true, frame_buf);
 675 +                                      req->reason_code, tx, frame_buf);
 676         } else {
 677                 drv_mgd_prepare_tx(sdata->local, sdata);
 678                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
 679                                                IEEE80211_STYPE_DEAUTH,
 680 -                                              req->reason_code, true,
 681 +                                              req->reason_code, tx,
 682                                                frame_buf);
 683         }
 684
 685 --- a/net/mac80211/sta_info.c
 686 +++ b/net/mac80211/sta_info.c
 687 @@ -585,7 +585,7 @@ static bool sta_info_cleanup_expire_buff
 688                  */
 689                 if (!skb)
 690                         break;
 691 -               dev_kfree_skb(skb);
 692 +               ieee80211_free_txskb(&local->hw, skb);
 693         }
 694
 695         /*
 696 @@ -614,7 +614,7 @@ static bool sta_info_cleanup_expire_buff
 697                 local->total_ps_buffered--;
 698                 ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
 699                        sta->sta.addr);
 700 -               dev_kfree_skb(skb);
 701 +               ieee80211_free_txskb(&local->hw, skb);
 702         }
 703
 704         /*
 705 @@ -674,7 +674,7 @@ int __must_check __sta_info_destroy(stru
 706          * will be sufficient.
 707          */
 708         set_sta_flag(sta, WLAN_STA_BLOCK_BA);
 709 -       ieee80211_sta_tear_down_BA_sessions(sta, true);
 710 +       ieee80211_sta_tear_down_BA_sessions(sta, false);
 711
 712         ret = sta_info_hash_del(local, sta);
 713         if (ret)
 714 @@ -730,8 +730,8 @@ int __must_check __sta_info_destroy(stru
 715
 716         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 717                 local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
 718 -               __skb_queue_purge(&sta->ps_tx_buf[ac]);
 719 -               __skb_queue_purge(&sta->tx_filtered[ac]);
 720 +               ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
 721 +               ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
 722         }
 723
 724  #ifdef CONFIG_MAC80211_MESH
 725 @@ -765,7 +765,7 @@ int __must_check __sta_info_destroy(stru
 726                 tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
 727                 if (!tid_tx)
 728                         continue;
 729 -               __skb_queue_purge(&tid_tx->pending);
 730 +               ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
 731                 kfree(tid_tx);
 732         }
 733
 734 --- a/drivers/net/wireless/ath/ath5k/phy.c
 735 +++ b/drivers/net/wireless/ath/ath5k/phy.c
 736 @@ -1977,11 +1977,13 @@ ath5k_hw_set_spur_mitigation_filter(stru
 737                         spur_delta_phase = (spur_offset << 18) / 25;
 738                         spur_freq_sigma_delta = (spur_delta_phase >> 10);
 739                         symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 2;
 740 +                       break;
 741                 case AR5K_BWMODE_5MHZ:
 742                         /* Both sample_freq and chip_freq are 10MHz (?) */
 743                         spur_delta_phase = (spur_offset << 19) / 25;
 744                         spur_freq_sigma_delta = (spur_delta_phase >> 10);
 745                         symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 4;
 746 +                       break;
 747                 default:
 748                         if (channel->band == IEEE80211_BAND_5GHZ) {
 749                                 /* Both sample_freq and chip_freq are 40MHz */
 750 --- a/net/mac80211/ieee80211_i.h
 751 +++ b/net/mac80211/ieee80211_i.h
 752 @@ -1062,7 +1062,7 @@ struct ieee80211_local {
 753         bool disable_dynamic_ps;
 754
 755         int user_power_level; /* in dBm */
 756 -       int power_constr_level; /* in dBm */
 757 +       int ap_power_level; /* in dBm */
 758
 759         enum ieee80211_smps_mode smps_mode;
 760
 761 @@ -1170,7 +1170,6 @@ struct ieee802_11_elems {
 762         u8 prep_len;
 763         u8 perr_len;
 764         u8 country_elem_len;
 765 -       u8 pwr_constr_elem_len;
 766         u8 quiet_elem_len;
 767         u8 num_of_quiet_elem;   /* can be more the one */
 768         u8 timeout_int_len;
 769 @@ -1318,6 +1317,8 @@ netdev_tx_t ieee80211_monitor_start_xmit
 770                                          struct net_device *dev);
 771  netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 772                                        struct net_device *dev);
 773 +void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 774 +                             struct sk_buff_head *skbs);
 775
 776  /* HT */
 777  void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
 778 --- a/net/mac80211/util.c
 779 +++ b/net/mac80211/util.c
 780 @@ -406,7 +406,7 @@ void ieee80211_add_pending_skb(struct ie
 781         int queue = info->hw_queue;
 782
 783         if (WARN_ON(!info->control.vif)) {
 784 -               kfree_skb(skb);
 785 +               ieee80211_free_txskb(&local->hw, skb);
 786                 return;
 787         }
 788
 789 @@ -431,7 +431,7 @@ void ieee80211_add_pending_skbs_fn(struc
 790                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 791
 792                 if (WARN_ON(!info->control.vif)) {
 793 -                       kfree_skb(skb);
 794 +                       ieee80211_free_txskb(&local->hw, skb);
 795                         continue;
 796                 }
 797
 798 @@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start
 799                         elems->country_elem_len = elen;
 800                         break;
 801                 case WLAN_EID_PWR_CONSTRAINT:
 802 +                       if (elen != 1) {
 803 +                               elem_parse_failed = true;
 804 +                               break;
 805 +                       }
 806                         elems->pwr_constr_elem = pos;
 807 -                       elems->pwr_constr_elem_len = elen;
 808                         break;
 809                 case WLAN_EID_TIMEOUT_INTERVAL:
 810                         elems->timeout_int = pos;
 811 --- a/net/mac80211/main.c
 812 +++ b/net/mac80211/main.c
 813 @@ -154,13 +154,11 @@ int ieee80211_hw_config(struct ieee80211
 814
 815         if (test_bit(SCAN_SW_SCANNING, &local->scanning) ||
 816             test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
 817 -           test_bit(SCAN_HW_SCANNING, &local->scanning))
 818 +           test_bit(SCAN_HW_SCANNING, &local->scanning) ||
 819 +           !local->ap_power_level)
 820                 power = chan->max_power;
 821         else
 822 -               power = local->power_constr_level ?
 823 -                       min(chan->max_power,
 824 -                               (chan->max_reg_power  - local->power_constr_level)) :
 825 -                       chan->max_power;
 826 +               power = min(chan->max_power, local->ap_power_level);
 827
 828         if (local->user_power_level >= 0)
 829                 power = min(power, local->user_power_level);
 830 --- a/include/net/cfg80211.h
 831 +++ b/include/net/cfg80211.h
 832 @@ -1218,6 +1218,7 @@ struct cfg80211_deauth_request {
 833         const u8 *ie;
 834         size_t ie_len;
 835         u16 reason_code;
 836 +       bool local_state_change;
 837  };
 838
 839  /**
 840 --- a/net/wireless/mlme.c
 841 +++ b/net/wireless/mlme.c
 842 @@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg802
 843                 .reason_code = reason,
 844                 .ie = ie,
 845                 .ie_len = ie_len,
 846 +               .local_state_change = local_state_change,
 847         };
 848
 849         ASSERT_WDEV_LOCK(wdev);
 850
 851 -       if (local_state_change) {
 852 -               if (wdev->current_bss &&
 853 -                   ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
 854 -                       cfg80211_unhold_bss(wdev->current_bss);
 855 -                       cfg80211_put_bss(&wdev->current_bss->pub);
 856 -                       wdev->current_bss = NULL;
 857 -               }
 858 -
 859 +       if (local_state_change && (!wdev->current_bss ||
 860 +           !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 861                 return 0;
 862 -       }
 863
 864         return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 865  }
 866 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 867 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
 868 @@ -386,7 +386,7 @@ static void ath_tx_complete_aggr(struct
 869         u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0, seq_first;
 870         u32 ba[WME_BA_BMP_SIZE >> 5];
 871         int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
 872 -       bool rc_update = true;
 873 +       bool rc_update = true, isba;
 874         struct ieee80211_tx_rate rates[4];
 875         struct ath_frame_info *fi;
 876         int nframes;
 877 @@ -430,13 +430,17 @@ static void ath_tx_complete_aggr(struct
 878         tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
 879         tid = ATH_AN_2_TID(an, tidno);
 880         seq_first = tid->seq_start;
 881 +       isba = ts->ts_flags & ATH9K_TX_BA;
 882
 883         /*
 884          * The hardware occasionally sends a tx status for the wrong TID.
 885          * In this case, the BA status cannot be considered valid and all
 886          * subframes need to be retransmitted
 887 +        *
 888 +        * Only BlockAcks have a TID and therefore normal Acks cannot be
 889 +        * checked
 890          */
 891 -       if (tidno != ts->tid)
 892 +       if (isba && tidno != ts->tid)
 893                 txok = false;
 894
 895         isaggr = bf_isaggr(bf);
 896 --- a/net/mac80211/cfg.c
 897 +++ b/net/mac80211/cfg.c
 898 @@ -2563,6 +2563,9 @@ static void ieee80211_mgmt_frame_registe
 899                 else
 900                         local->probe_req_reg--;
 901
 902 +               if (!local->open_count)
 903 +                       break;
 904 +
 905                 ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 906                 break;
 907         default:
 908 --- a/net/mac80211/tx.c
 909 +++ b/net/mac80211/tx.c
 910 @@ -354,7 +354,7 @@ static void purge_old_ps_buffers(struct
 911                         total += skb_queue_len(&sta->ps_tx_buf[ac]);
 912                         if (skb) {
 913                                 purged++;
 914 -                               dev_kfree_skb(skb);
 915 +                               ieee80211_free_txskb(&local->hw, skb);
 916                                 break;
 917                         }
 918                 }
 919 @@ -466,7 +466,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
 920                         ps_dbg(tx->sdata,
 921                                "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
 922                                sta->sta.addr, ac);
 923 -                       dev_kfree_skb(old);
 924 +                       ieee80211_free_txskb(&local->hw, old);
 925                 } else
 926                         tx->local->total_ps_buffered++;
 927
 928 @@ -1103,7 +1103,7 @@ static bool ieee80211_tx_prep_agg(struct
 929                 spin_unlock(&tx->sta->lock);
 930
 931                 if (purge_skb)
 932 -                       dev_kfree_skb(purge_skb);
 933 +                       ieee80211_free_txskb(&tx->local->hw, purge_skb);
 934         }
 935
 936         /* reset session timer */
 937 @@ -1214,7 +1214,7 @@ static bool ieee80211_tx_frags(struct ie
 938  #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 939                 if (WARN_ON_ONCE(q >= local->hw.queues)) {
 940                         __skb_unlink(skb, skbs);
 941 -                       dev_kfree_skb(skb);
 942 +                       ieee80211_free_txskb(&local->hw, skb);
 943                         continue;
 944                 }
 945  #endif
 946 @@ -1356,9 +1356,9 @@ static int invoke_tx_handlers(struct iee
 947         if (unlikely(res == TX_DROP)) {
 948                 I802_DEBUG_INC(tx->local->tx_handlers_drop);
 949                 if (tx->skb)
 950 -                       dev_kfree_skb(tx->skb);
 951 +                       ieee80211_free_txskb(&tx->local->hw, tx->skb);
 952                 else
 953 -                       __skb_queue_purge(&tx->skbs);
 954 +                       ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
 955                 return -1;
 956         } else if (unlikely(res == TX_QUEUED)) {
 957                 I802_DEBUG_INC(tx->local->tx_handlers_queued);
 958 @@ -1393,7 +1393,7 @@ static bool ieee80211_tx(struct ieee8021
 959         res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
 960
 961         if (unlikely(res_prepare == TX_DROP)) {
 962 -               dev_kfree_skb(skb);
 963 +               ieee80211_free_txskb(&local->hw, skb);
 964                 goto out;
 965         } else if (unlikely(res_prepare == TX_QUEUED)) {
 966                 goto out;
 967 @@ -1465,7 +1465,7 @@ void ieee80211_xmit(struct ieee80211_sub
 968         headroom = max_t(int, 0, headroom);
 969
 970         if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
 971 -               dev_kfree_skb(skb);
 972 +               ieee80211_free_txskb(&local->hw, skb);
 973                 rcu_read_unlock();
 974                 return;
 975         }
 976 @@ -2056,8 +2056,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
 977                 head_need += IEEE80211_ENCRYPT_HEADROOM;
 978                 head_need += local->tx_headroom;
 979                 head_need = max_t(int, 0, head_need);
 980 -               if (ieee80211_skb_resize(sdata, skb, head_need, true))
 981 -                       goto fail;
 982 +               if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
 983 +                       ieee80211_free_txskb(&local->hw, skb);
 984 +                       return NETDEV_TX_OK;
 985 +               }
 986         }
 987
 988         if (encaps_data) {
 989 @@ -2124,10 +2126,13 @@ netdev_tx_t ieee80211_subif_start_xmit(s
 990   */
 991  void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 992  {
 993 +       struct sk_buff *skb;
 994         int i;
 995
 996 -       for (i = 0; i < local->hw.queues; i++)
 997 -               skb_queue_purge(&local->pending[i]);
 998 +       for (i = 0; i < local->hw.queues; i++) {
 999 +               while ((skb = skb_dequeue(&local->pending[i])) != NULL)
1000 +                       ieee80211_free_txskb(&local->hw, skb);
1001 +       }
1002  }
1003
1004  /*
1005 @@ -2190,7 +2195,7 @@ void ieee80211_tx_pending(unsigned long
1006                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1007
1008                         if (WARN_ON(!info->control.vif)) {
1009 -                               kfree_skb(skb);
1010 +                               ieee80211_free_txskb(&local->hw, skb);
1011                                 continue;
1012                         }
1013
1014 --- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
1015 +++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
1016 @@ -65,7 +65,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct
1017         u16 qnum = skb_get_queue_mapping(skb);
1018
1019         if (WARN_ON(qnum >= ah->ah_capabilities.cap_queues.q_tx_num)) {
1020 -               dev_kfree_skb_any(skb);
1021 +               ieee80211_free_txskb(hw, skb);
1022                 return;
1023         }
1024
1025 --- a/drivers/net/wireless/ath/ath9k/hw.c
1026 +++ b/drivers/net/wireless/ath/ath9k/hw.c
1027 @@ -2568,7 +2568,7 @@ int ath9k_hw_fill_cap_info(struct ath_hw
1028
1029         if (AR_SREV_9300_20_OR_LATER(ah)) {
1030                 ah->enabled_cals |= TX_IQ_CAL;
1031 -               if (AR_SREV_9485_OR_LATER(ah))
1032 +               if (AR_SREV_9485_OR_LATER(ah) && !AR_SREV_9340(ah))
1033                         ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
1034         }
1035