25a34b3ebdb49a2abec164685ae81cc6a8d4acba
[openwrt.git] / package / kernel / mac80211 / patches / 300-pending_work.patch
1 commit 6e7341074823d2a45b81f2742cbf75f1da790031
2 Author: Rafał Miłecki <zajec5@gmail.com>
3 Date:   Sat May 31 19:40:45 2014 +0200
4
5     b43: disable 5 GHz on G-PHY
6     
7     This fixes regression introduced by adding some G-PHY devices to the
8     list of dual band devices. There is simply no support for 5 GHz on
9     G-PHY devices in b43. It results in:
10     WARNING: CPU: 0 PID: 79 at drivers/net/wireless/b43/phy_g.c:75 b43_gphy_channel_switch+0x125/0x130 [b43]()
11     b43-phy1 ERROR: PHY init: Channel switch to default failed
12     
13     Regression was introduced by the following commit:
14     
15     commit 773cfc508f4d64c14547ff8751b5cbd473124364
16     Author: Rafał Miłecki <zajec5@gmail.com>
17     Date:   Mon May 19 23:18:55 2014 +0200
18     
19         b43: add more devices to the bands database
20     
21     Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
22     Signed-off-by: John W. Linville <linville@tuxdriver.com>
23
24 commit 1186edbef91f15722e5bdf56326ce0abc2935ce7
25 Author: Stanislaw Gruszka <sgruszka@redhat.com>
26 Date:   Tue Jun 10 12:51:06 2014 +0200
27
28     rt2x00: disable TKIP on USB
29     
30     On USB we can not get atomically TKIP key. We have to disable support
31     for TKIP acceleration on USB hardware to avoid bug as showed bellow.
32     
33     [  860.827243] BUG: scheduling while atomic: hostapd/3397/0x00000002
34     <snip>
35     [  860.827280] Call Trace:
36     [  860.827282]  [<ffffffff81682ea6>] dump_stack+0x4d/0x66
37     [  860.827284]  [<ffffffff8167eb9b>] __schedule_bug+0x47/0x55
38     [  860.827285]  [<ffffffff81685bb3>] __schedule+0x733/0x7b0
39     [  860.827287]  [<ffffffff81685c59>] schedule+0x29/0x70
40     [  860.827289]  [<ffffffff81684f8a>] schedule_timeout+0x15a/0x2b0
41     [  860.827291]  [<ffffffff8105ac50>] ? ftrace_raw_event_tick_stop+0xc0/0xc0
42     [  860.827294]  [<ffffffff810c13c2>] ? __module_text_address+0x12/0x70
43     [  860.827296]  [<ffffffff81686823>] wait_for_completion_timeout+0xb3/0x140
44     [  860.827298]  [<ffffffff81080fc0>] ? wake_up_state+0x20/0x20
45     [  860.827301]  [<ffffffff814d5b3d>] usb_start_wait_urb+0x7d/0x150
46     [  860.827303]  [<ffffffff814d5cd5>] usb_control_msg+0xc5/0x110
47     [  860.827305]  [<ffffffffa02fb0c6>] rt2x00usb_vendor_request+0xc6/0x160  [rt2x00usb]
48     [  860.827307]  [<ffffffffa02fb215>] rt2x00usb_vendor_req_buff_lock+0x75/0x150 [rt2x00usb]
49     [  860.827309]  [<ffffffffa02fb393>] rt2x00usb_vendor_request_buff+0xa3/0xe0 [rt2x00usb]
50     [  860.827311]  [<ffffffffa023d1a3>] rt2x00usb_register_multiread+0x33/0x40 [rt2800usb]
51     [  860.827314]  [<ffffffffa05805f9>] rt2800_get_tkip_seq+0x39/0x50  [rt2800lib]
52     [  860.827321]  [<ffffffffa0480f88>] ieee80211_get_key+0x218/0x2a0  [mac80211]
53     [  860.827322]  [<ffffffff815cc68c>] ? __nlmsg_put+0x6c/0x80
54     [  860.827329]  [<ffffffffa051b02e>] nl80211_get_key+0x22e/0x360 [cfg80211]
55     
56     Cc: stable@vger.kernel.org
57     Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
58     Reported-and-tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
59     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
60     Signed-off-by: John W. Linville <linville@tuxdriver.com>
61
62 commit 5f313a15da92dda80ac4c9a137bc42d7d0b49adf
63 Author: Rafał Miłecki <zajec5@gmail.com>
64 Date:   Thu Jun 12 09:28:38 2014 +0200
65
66     b43: fix frequency reported on G-PHY with /new/ firmware
67
68 commit d3a58df87a2e4c2301ac843604202d290a48440b
69 Author: Avraham Stern <avraham.stern@intel.com>
70 Date:   Thu May 22 12:17:47 2014 +0300
71
72     mac80211: set new interfaces as idle upon init
73     
74     Mark new interfaces as idle to allow operations that require that
75     interfaces are idle to take place. Interface types that are always
76     not idle (like AP interfaces) will be set as not idle when they are
77     assigned a channel context.
78     
79     Signed-off-by: Avraham Stern <avraham.stern@intel.com>
80     Signed-off-by: Emmanuel Grumbach<emmanuel.grumbach@intel.com>
81     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
82
83 commit 923eaf367206e01f22c97aee22300e332d071916
84 Author: Arik Nemtsov <arik@wizery.com>
85 Date:   Mon May 26 14:40:51 2014 +0300
86
87     mac80211: don't check netdev state for debugfs read/write
88     
89     Doing so will lead to an oops for a p2p-dev interface, since it has
90     no netdev.
91     
92     Cc: stable@vger.kernel.org
93     Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
94     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
95     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
96
97 commit a9fb54169b197f31aff24c8d6270dd1e56cde395
98 Author: chaitanya.mgit@gmail.com <chaitanya.mgit@gmail.com>
99 Date:   Mon May 26 18:01:44 2014 +0530
100
101     regdb: Generalize the mW to dBm power conversion
102     
103     Generalize the power conversion from mW to dBm
104     using log. This should fix the below compilation
105     error for country NO which adds a new power value
106     2000mW which is not handled earlier.
107     
108      CC [M]  net/wireless/wext-sme.o
109      CC [M]  net/wireless/regdb.o
110     net/wireless/regdb.c:1130:1: error: Unknown undeclared here (not in
111     a function)
112     net/wireless/regdb.c:1130:9: error: expected } before power
113     make[2]: *** [net/wireless/regdb.o] Error 1
114     make[1]: *** [net/wireless] Error 2
115     make: *** [net] Error 2
116     
117     Reported-By:  John Walker <john@x109.net>
118     Signed-off-by: Chaitanya T K <chaitanya.mgit@gmail.com>
119     Acked-by: John W. Linville <linville@tuxdriver.com>
120     [remove unneeded parentheses, fix rounding by using %.0f]
121     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
122
123 commit c7d37a66e345df2fdf1aa7b2c9a6d3d53846ca5b
124 Author: Krzysztof Hałasa <khalasa@piap.pl>
125 Date:   Mon May 26 14:14:46 2014 +0200
126
127     mac80211: fix IBSS join by initializing last_scan_completed
128     
129     Without this fix, freshly rebooted Linux creates a new IBSS
130     instead of joining an existing one. Only when jiffies counter
131     overflows after 5 minutes the IBSS can be successfully joined.
132     
133     Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
134     [edit commit message slightly]
135     Cc: stable@vger.kernel.org
136     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
137
138 commit 34171dc0d623be2c1032416bf7d3819f388ed70d
139 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
140 Date:   Sun May 25 15:35:41 2014 +0300
141
142     mac80211: fix virtual monitor interface addition
143     
144     Since the commit below, cfg80211_chandef_dfs_required()
145     will warn if it gets a an NL80211_IFTYPE_UNSPECIFIED iftype
146     as explicitely written in the commit log.
147     When an virtual monitor interface is added, its type is set
148     in ieee80211_sub_if_data.vif.type, but not in
149     ieee80211_sub_if_data.wdev.iftype which is passed to
150     cfg80211_chandef_dfs_required() hence resulting in the
151     following warning:
152     
153     WARNING: CPU: 1 PID: 21265 at net/wireless/chan.c:376 cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]()
154     Modules linked in: [...]
155     CPU: 1 PID: 21265 Comm: ifconfig Tainted: G        W  O 3.13.11+ #12
156     Hardware name: Dell Inc. Latitude E6410/0667CC, BIOS A01 03/05/2010
157      0000000000000009 ffff88008f5fdb08 ffffffff817d4219 ffff88008f5fdb50
158      ffff88008f5fdb40 ffffffff8106f57d 0000000000000000 0000000000000000
159      ffff880081062fb8 ffff8800810604e0 0000000000000001 ffff88008f5fdba0
160     Call Trace:
161      [<ffffffff817d4219>] dump_stack+0x4d/0x66
162      [<ffffffff8106f57d>] warn_slowpath_common+0x7d/0xa0
163      [<ffffffff8106f5ec>] warn_slowpath_fmt+0x4c/0x50
164      [<ffffffffa04ea4ec>] cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]
165      [<ffffffffa06b1024>] ieee80211_vif_use_channel+0x94/0x500 [mac80211]
166      [<ffffffffa0684e6b>] ieee80211_add_virtual_monitor+0x1ab/0x5c0 [mac80211]
167      [<ffffffffa0686ae5>] ieee80211_do_open+0xe75/0x1580 [mac80211]
168      [<ffffffffa0687259>] ieee80211_open+0x69/0x70 [mac80211]
169     [snip]
170     
171     Fixes: 00ec75fc5a64 ("cfg80211: pass the actual iftype when calling cfg80211_chandef_dfs_required()")
172     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
173     Acked-by: Luciano Coelho <luciano.coelho@intel.com>
174     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
175
176 commit d93cc72b37b4e2c314e1c499e80e8801907c2fea
177 Author: Michal Kazior <michal.kazior@tieto.com>
178 Date:   Thu Jun 5 14:21:37 2014 +0200
179
180     mac80211: use csa counter offsets instead of csa_active
181     
182     vif->csa_active is protected by mutexes only. This
183     means it is unreliable to depend on it on codeflow
184     in non-sleepable beacon and CSA code. There was no
185     guarantee to have vif->csa_active update be
186     visible before beacons are updated on SMP systems.
187     
188     Using csa counter offsets which are embedded in
189     beacon struct (and thus are protected with single
190     RCU assignment) is much safer.
191     
192     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
193     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
194
195 commit d2746694fcdef24e0a7a1947d8c70082cde81a26
196 Author: Michal Kazior <michal.kazior@tieto.com>
197 Date:   Thu Jun 5 14:21:36 2014 +0200
198
199     mac80211: move csa counters from sdata to beacon/presp
200     
201     Having csa counters part of beacon and probe_resp
202     structures makes it easier to get rid of possible
203     races between setting a beacon and updating
204     counters on SMP systems by guaranteeing counters
205     are always consistent against given beacon struct.
206     
207     While at it relax WARN_ON into WARN_ON_ONCE to
208     prevent spamming logs and racing.
209     
210     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
211     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
212
213 commit 5dcb54f3a1a8cd7e0331e773487574f9743615db
214 Author: Janusz Dziedzic <janusz.dziedzic@tieto.com>
215 Date:   Thu Jun 5 08:12:57 2014 +0200
216
217     mac80211: allow tx via monitor iface when DFS
218     
219     Allow send frames using monitor interface
220     when DFS chandef and we pass CAC (beaconing
221     allowed).
222     
223     This fix problem when old kernel and new backports used,
224     in such case hostapd create/use also monitor interface.
225     Before this patch all frames hostapd send using monitor
226     iface were dropped when AP was configured on DFS channel.
227     
228     Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
229     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
230
231 commit 6f09a1beb0d2007572248c986780562219bd206f
232 Author: Johannes Berg <johannes.berg@intel.com>
233 Date:   Wed Jun 4 17:31:56 2014 +0200
234
235     cfg80211: make ethtool the driver's responsibility
236     
237     Currently, cfg80211 tries to implement ethtool, but that doesn't
238     really scale well, with all the different operations. Make the
239     lower-level driver responsible for it, which currently only has
240     an effect on mac80211. It will similarly not scale well at that
241     level though, since mac80211 also has many drivers.
242     
243     To cleanly implement this in mac80211, introduce a new file and
244     move some code to appropriate places.
245     
246     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
247
248 commit 6b0c6f133de8f90caeb1c4a902e6140567c5bf96
249 Author: Johannes Berg <johannes.berg@intel.com>
250 Date:   Wed Jun 4 17:06:23 2014 +0200
251
252     mac80211: remove weak WEP IV accounting
253     
254     Since WEP is practically dead, there seems very little
255     point in keeping WEP weak IV accounting.
256     
257     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
258
259 commit aecdc89fb4664c76baa4bbd46008f220532309ff
260 Author: Luciano Coelho <luciano.coelho@intel.com>
261 Date:   Fri May 23 11:04:50 2014 +0300
262
263     ath9k/ath10k: remove unnecessary channel_switch_beacon callbacks
264     
265     The channel_switch_beacon callback is optional, so it doesn't have to
266     be defined if it's not going to do anything useful with it.  Both
267     ath9k and ath10k define the callback and just returns.  This commit
268     removes them.
269     
270     Cc: Michal Kazior <michal.kazior@tieto.com>
271     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
272     Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
273
274 commit 60ccc107c9b9fb732fdee1f76bb2dad44f0e1798
275 Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
276 Date:   Tue May 27 16:58:02 2014 +0530
277
278     ath9k: Fix deadlock while updating p2p beacon timer
279     
280     pm_lock is taken twice while syncing HW TSF of p2p vif.
281     Fix this by taking the lock at caller side.
282     
283     Cc: Felix Fietkau <nbd@openwrt.org>
284     Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
285     Signed-off-by: John W. Linville <linville@tuxdriver.com>
286
287 commit f3831a4e3903dbc1a57d5df56deb6a143fd001bc
288 Author: Stanislaw Gruszka <sgruszka@redhat.com>
289 Date:   Thu Jun 5 13:52:27 2014 +0200
290
291     rt2x00: do not initialize BCN_OFFSET registers
292     
293     We setup BCN_OFFSET{0,1} registers dynamically, don't have to
294     initialize them.
295     
296     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
297
298 commit e5c58ca7a48d4c82f282749a978052c47fd95998
299 Author: Stanislaw Gruszka <sgruszka@redhat.com>
300 Date:   Thu Jun 5 13:52:26 2014 +0200
301
302     rt2x00: change order when stop beaconing
303     
304     When no beaconing is needed, first stop beacon queue (disable beaconing
305     globally) to avoid possible sending of not prepared beacon on short
306     period after clearing beacon and before stop of BCN queue.
307     
308     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
309
310 commit 382c1b9e03f52d0cd741ef1d942cad0f649f0744
311 Author: Stanislaw Gruszka <sgruszka@redhat.com>
312 Date:   Thu Jun 5 13:52:25 2014 +0200
313
314     rt2x00: change default MAC_BSSID_DW1_BSS_BCN_NUM
315     
316     We setup MAC_BSSID_DW1_BSS_BCN_NUM dynamically when numbers of active
317     beacons increase. Change default to 0 to tell hardware that we want to
318     send only one beacon as default.
319     
320     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
321
322 commit 3b400571dd033e46fa7e76c5bb92a3ce8198afa9
323 Author: Stanislaw Gruszka <sgruszka@redhat.com>
324 Date:   Thu Jun 5 13:52:24 2014 +0200
325
326     rt2x00: change beaconing setup on RT2800
327     
328     As reported by Matthias, on 5572 chip, even if we clear up TXWI
329     of corresponding beacon, hardware still try to send it or do other
330     action that increase power consumption peak up to 1A.
331     
332     To avoid the issue, setup beaconing dynamically by configuring offsets
333     of currently active beacons and MAC_BSSID_DW1_BSS_BCN_NUM variable,
334     which limit number of beacons that hardware will try to send.
335     
336     Reported-by: Matthias Fend <Matthias.Fend@wolfvision.net>
337     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
338
339 commit 916e591b2cc41f7e572992175ca56d866d7bc958
340 Author: Stanislaw Gruszka <sgruszka@redhat.com>
341 Date:   Thu Jun 5 13:52:23 2014 +0200
342
343     rt2x00: change beaconing locking
344     
345     This patch is needed for further changes to keep global variables
346     consistent when changing beaconing on diffrent vif's.
347     
348     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
349
350 commit 930b0dffd1731f3f418f9132faea720a23b7af61
351 Author: Johannes Berg <johannes.berg@intel.com>
352 Date:   Tue Jun 3 11:18:47 2014 +0200
353
354     mac80211: fix station/driver powersave race
355     
356     It is currently possible to have a race due to the station PS
357     unblock work like this:
358      * station goes to sleep with frames buffered in the driver
359      * driver blocks wakeup
360      * station wakes up again
361      * driver flushes/returns frames, and unblocks, which schedules
362        the unblock work
363      * unblock work starts to run, and checks that the station is
364        awake (i.e. that the WLAN_STA_PS_STA flag isn't set)
365      * we process a received frame with PM=1, setting the flag again
366      * ieee80211_sta_ps_deliver_wakeup() runs, delivering all frames
367        to the driver, and then clearing the WLAN_STA_PS_DRIVER and
368        WLAN_STA_PS_STA flags
369     
370     In this scenario, mac80211 will think that the station is awake,
371     while it really is asleep, and any TX'ed frames should be filtered
372     by the device (it will know that the station is sleeping) but then
373     passed to mac80211 again, which will not buffer it either as it
374     thinks the station is awake, and eventually the packets will be
375     dropped.
376     
377     Fix this by moving the clearing of the flags to exactly where we
378     learn about the situation. This creates a problem of reordering,
379     so introduce another flag indicating that delivery is being done,
380     this new flag also queues frames and is cleared only while the
381     spinlock is held (which the queuing code also holds) so that any
382     concurrent delivery/TX is handled correctly.
383     
384     Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
385     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
386
387 commit 6df35206bc6c1c6aad1d8077df5786b4a7f77873
388 Author: Felix Fietkau <nbd@openwrt.org>
389 Date:   Fri May 23 19:58:14 2014 +0200
390
391     mac80211: reduce packet loss notifications under load
392     
393     During strong signal fluctuations under high throughput, few consecutive
394     failed A-MPDU transmissions can easily trigger packet loss notification,
395     and thus (in AP mode) client disconnection.
396     
397     Reduce the number of false positives by checking the A-MPDU status flag
398     and treating a failed A-MPDU as a single packet.
399     
400     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
401
402 commit 7b7843a36fbcc568834404c7430ff895d8502131
403 Author: Felix Fietkau <nbd@openwrt.org>
404 Date:   Fri May 23 19:26:32 2014 +0200
405
406     mac80211: fix a memory leak on sta rate selection table
407     
408     Cc: stable@vger.kernel.org
409     Reported-by: Christophe Prévotaux <cprevotaux@nltinc.com>
410     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
411
412 commit 96892d6aa0a153423070addf3070bc79578b3897
413 Author: Felix Fietkau <nbd@openwrt.org>
414 Date:   Mon May 19 21:20:49 2014 +0200
415
416     ath9k: avoid passing buffers to the hardware during flush
417     
418     The commit "ath9k: fix possible hang on flush" changed the receive code
419     to always link rx descriptors of processed frames, even when flushing.
420     In some cases, this leads to flushed rx buffers being passed to the
421     hardware while rx is already stopped.
422     
423     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
424
425 --- a/drivers/net/wireless/ath/ath9k/recv.c
426 +++ b/drivers/net/wireless/ath/ath9k/recv.c
427 @@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_slee
428   * buffer (or rx fifo). This can incorrectly acknowledge packets
429   * to a sender if last desc is self-linked.
430   */
431 -static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
432 +static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf,
433 +                           bool flush)
434  {
435         struct ath_hw *ah = sc->sc_ah;
436         struct ath_common *common = ath9k_hw_common(ah);
437 @@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_s
438                              common->rx_bufsize,
439                              0);
440  
441 -       if (sc->rx.rxlink == NULL)
442 -               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
443 -       else
444 +       if (sc->rx.rxlink)
445                 *sc->rx.rxlink = bf->bf_daddr;
446 +       else if (!flush)
447 +               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
448  
449         sc->rx.rxlink = &ds->ds_link;
450  }
451  
452 -static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
453 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf,
454 +                             bool flush)
455  {
456         if (sc->rx.buf_hold)
457 -               ath_rx_buf_link(sc, sc->rx.buf_hold);
458 +               ath_rx_buf_link(sc, sc->rx.buf_hold, flush);
459  
460         sc->rx.buf_hold = bf;
461  }
462 @@ -442,7 +444,7 @@ int ath_startrecv(struct ath_softc *sc)
463         sc->rx.buf_hold = NULL;
464         sc->rx.rxlink = NULL;
465         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
466 -               ath_rx_buf_link(sc, bf);
467 +               ath_rx_buf_link(sc, bf, false);
468         }
469  
470         /* We could have deleted elements so the list may be empty now */
471 @@ -1118,12 +1120,12 @@ requeue_drop_frag:
472  requeue:
473                 list_add_tail(&bf->list, &sc->rx.rxbuf);
474  
475 -               if (edma) {
476 -                       ath_rx_edma_buf_link(sc, qtype);
477 -               } else {
478 -                       ath_rx_buf_relink(sc, bf);
479 +               if (!edma) {
480 +                       ath_rx_buf_relink(sc, bf, flush);
481                         if (!flush)
482                                 ath9k_hw_rxena(ah);
483 +               } else if (!flush) {
484 +                       ath_rx_edma_buf_link(sc, qtype);
485                 }
486  
487                 if (!budget--)
488 --- a/net/mac80211/sta_info.c
489 +++ b/net/mac80211/sta_info.c
490 @@ -100,7 +100,8 @@ static void __cleanup_single_sta(struct 
491         struct ps_data *ps;
492  
493         if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
494 -           test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
495 +           test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
496 +           test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
497                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
498                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
499                         ps = &sdata->bss->ps;
500 @@ -111,6 +112,7 @@ static void __cleanup_single_sta(struct 
501  
502                 clear_sta_flag(sta, WLAN_STA_PS_STA);
503                 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
504 +               clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
505  
506                 atomic_dec(&ps->num_sta_ps);
507                 sta_info_recalc_tim(sta);
508 @@ -125,7 +127,7 @@ static void __cleanup_single_sta(struct 
509         if (ieee80211_vif_is_mesh(&sdata->vif))
510                 mesh_sta_cleanup(sta);
511  
512 -       cancel_work_sync(&sta->drv_unblock_wk);
513 +       cancel_work_sync(&sta->drv_deliver_wk);
514  
515         /*
516          * Destroy aggregation state here. It would be nice to wait for the
517 @@ -227,6 +229,7 @@ struct sta_info *sta_info_get_by_idx(str
518   */
519  void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
520  {
521 +       struct ieee80211_sta_rates *rates;
522         int i;
523  
524         if (sta->rate_ctrl)
525 @@ -238,6 +241,10 @@ void sta_info_free(struct ieee80211_loca
526                 kfree(sta->tx_lat);
527         }
528  
529 +       rates = rcu_dereference_protected(sta->sta.rates, true);
530 +       if (rates)
531 +               kfree(rates);
532 +
533         sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
534  
535         kfree(sta);
536 @@ -252,33 +259,23 @@ static void sta_info_hash_add(struct iee
537         rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
538  }
539  
540 -static void sta_unblock(struct work_struct *wk)
541 +static void sta_deliver_ps_frames(struct work_struct *wk)
542  {
543         struct sta_info *sta;
544  
545 -       sta = container_of(wk, struct sta_info, drv_unblock_wk);
546 +       sta = container_of(wk, struct sta_info, drv_deliver_wk);
547  
548         if (sta->dead)
549                 return;
550  
551 -       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
552 -               local_bh_disable();
553 +       local_bh_disable();
554 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA))
555                 ieee80211_sta_ps_deliver_wakeup(sta);
556 -               local_bh_enable();
557 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
558 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
559 -
560 -               local_bh_disable();
561 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
562                 ieee80211_sta_ps_deliver_poll_response(sta);
563 -               local_bh_enable();
564 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD)) {
565 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
566 -
567 -               local_bh_disable();
568 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
569                 ieee80211_sta_ps_deliver_uapsd(sta);
570 -               local_bh_enable();
571 -       } else
572 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
573 +       local_bh_enable();
574  }
575  
576  static int sta_prepare_rate_control(struct ieee80211_local *local,
577 @@ -340,7 +337,7 @@ struct sta_info *sta_info_alloc(struct i
578  
579         spin_lock_init(&sta->lock);
580         spin_lock_init(&sta->ps_lock);
581 -       INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
582 +       INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
583         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
584         mutex_init(&sta->ampdu_mlme.mtx);
585  #ifdef CPTCFG_MAC80211_MESH
586 @@ -1140,8 +1137,15 @@ void ieee80211_sta_ps_deliver_wakeup(str
587         }
588  
589         ieee80211_add_pending_skbs(local, &pending);
590 -       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
591 -       clear_sta_flag(sta, WLAN_STA_PS_STA);
592 +
593 +       /* now we're no longer in the deliver code */
594 +       clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
595 +
596 +       /* The station might have polled and then woken up before we responded,
597 +        * so clear these flags now to avoid them sticking around.
598 +        */
599 +       clear_sta_flag(sta, WLAN_STA_PSPOLL);
600 +       clear_sta_flag(sta, WLAN_STA_UAPSD);
601         spin_unlock(&sta->ps_lock);
602  
603         atomic_dec(&ps->num_sta_ps);
604 @@ -1542,10 +1546,26 @@ void ieee80211_sta_block_awake(struct ie
605  
606         trace_api_sta_block_awake(sta->local, pubsta, block);
607  
608 -       if (block)
609 +       if (block) {
610                 set_sta_flag(sta, WLAN_STA_PS_DRIVER);
611 -       else if (test_sta_flag(sta, WLAN_STA_PS_DRIVER))
612 -               ieee80211_queue_work(hw, &sta->drv_unblock_wk);
613 +               return;
614 +       }
615 +
616 +       if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
617 +               return;
618 +
619 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
620 +               set_sta_flag(sta, WLAN_STA_PS_DELIVER);
621 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
622 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
623 +       } else if (test_sta_flag(sta, WLAN_STA_PSPOLL) ||
624 +                  test_sta_flag(sta, WLAN_STA_UAPSD)) {
625 +               /* must be asleep in this case */
626 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
627 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
628 +       } else {
629 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
630 +       }
631  }
632  EXPORT_SYMBOL(ieee80211_sta_block_awake);
633  
634 @@ -1703,3 +1723,137 @@ u8 sta_info_tx_streams(struct sta_info *
635         return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
636                         >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
637  }
638 +
639 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
640 +{
641 +       struct ieee80211_sub_if_data *sdata = sta->sdata;
642 +       struct ieee80211_local *local = sdata->local;
643 +       struct rate_control_ref *ref = local->rate_ctrl;
644 +       struct timespec uptime;
645 +       u64 packets = 0;
646 +       u32 thr = 0;
647 +       int i, ac;
648 +
649 +       sinfo->generation = sdata->local->sta_generation;
650 +
651 +       sinfo->filled = STATION_INFO_INACTIVE_TIME |
652 +                       STATION_INFO_RX_BYTES64 |
653 +                       STATION_INFO_TX_BYTES64 |
654 +                       STATION_INFO_RX_PACKETS |
655 +                       STATION_INFO_TX_PACKETS |
656 +                       STATION_INFO_TX_RETRIES |
657 +                       STATION_INFO_TX_FAILED |
658 +                       STATION_INFO_TX_BITRATE |
659 +                       STATION_INFO_RX_BITRATE |
660 +                       STATION_INFO_RX_DROP_MISC |
661 +                       STATION_INFO_BSS_PARAM |
662 +                       STATION_INFO_CONNECTED_TIME |
663 +                       STATION_INFO_STA_FLAGS |
664 +                       STATION_INFO_BEACON_LOSS_COUNT;
665 +
666 +       do_posix_clock_monotonic_gettime(&uptime);
667 +       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
668 +
669 +       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
670 +       sinfo->tx_bytes = 0;
671 +       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
672 +               sinfo->tx_bytes += sta->tx_bytes[ac];
673 +               packets += sta->tx_packets[ac];
674 +       }
675 +       sinfo->tx_packets = packets;
676 +       sinfo->rx_bytes = sta->rx_bytes;
677 +       sinfo->rx_packets = sta->rx_packets;
678 +       sinfo->tx_retries = sta->tx_retry_count;
679 +       sinfo->tx_failed = sta->tx_retry_failed;
680 +       sinfo->rx_dropped_misc = sta->rx_dropped;
681 +       sinfo->beacon_loss_count = sta->beacon_loss_count;
682 +
683 +       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
684 +           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
685 +               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
686 +               if (!local->ops->get_rssi ||
687 +                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
688 +                       sinfo->signal = (s8)sta->last_signal;
689 +               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
690 +       }
691 +       if (sta->chains) {
692 +               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
693 +                                STATION_INFO_CHAIN_SIGNAL_AVG;
694 +
695 +               sinfo->chains = sta->chains;
696 +               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
697 +                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
698 +                       sinfo->chain_signal_avg[i] =
699 +                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
700 +               }
701 +       }
702 +
703 +       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
704 +       sta_set_rate_info_rx(sta, &sinfo->rxrate);
705 +
706 +       if (ieee80211_vif_is_mesh(&sdata->vif)) {
707 +#ifdef CPTCFG_MAC80211_MESH
708 +               sinfo->filled |= STATION_INFO_LLID |
709 +                                STATION_INFO_PLID |
710 +                                STATION_INFO_PLINK_STATE |
711 +                                STATION_INFO_LOCAL_PM |
712 +                                STATION_INFO_PEER_PM |
713 +                                STATION_INFO_NONPEER_PM;
714 +
715 +               sinfo->llid = sta->llid;
716 +               sinfo->plid = sta->plid;
717 +               sinfo->plink_state = sta->plink_state;
718 +               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
719 +                       sinfo->filled |= STATION_INFO_T_OFFSET;
720 +                       sinfo->t_offset = sta->t_offset;
721 +               }
722 +               sinfo->local_pm = sta->local_pm;
723 +               sinfo->peer_pm = sta->peer_pm;
724 +               sinfo->nonpeer_pm = sta->nonpeer_pm;
725 +#endif
726 +       }
727 +
728 +       sinfo->bss_param.flags = 0;
729 +       if (sdata->vif.bss_conf.use_cts_prot)
730 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
731 +       if (sdata->vif.bss_conf.use_short_preamble)
732 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
733 +       if (sdata->vif.bss_conf.use_short_slot)
734 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
735 +       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
736 +       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
737 +
738 +       sinfo->sta_flags.set = 0;
739 +       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
740 +                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
741 +                               BIT(NL80211_STA_FLAG_WME) |
742 +                               BIT(NL80211_STA_FLAG_MFP) |
743 +                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
744 +                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
745 +                               BIT(NL80211_STA_FLAG_TDLS_PEER);
746 +       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
747 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
748 +       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
749 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
750 +       if (test_sta_flag(sta, WLAN_STA_WME))
751 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
752 +       if (test_sta_flag(sta, WLAN_STA_MFP))
753 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
754 +       if (test_sta_flag(sta, WLAN_STA_AUTH))
755 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
756 +       if (test_sta_flag(sta, WLAN_STA_ASSOC))
757 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
758 +       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
759 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
760 +
761 +       /* check if the driver has a SW RC implementation */
762 +       if (ref && ref->ops->get_expected_throughput)
763 +               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
764 +       else
765 +               thr = drv_get_expected_throughput(local, &sta->sta);
766 +
767 +       if (thr != 0) {
768 +               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
769 +               sinfo->expected_throughput = thr;
770 +       }
771 +}
772 --- a/net/mac80211/status.c
773 +++ b/net/mac80211/status.c
774 @@ -541,6 +541,23 @@ static void ieee80211_tx_latency_end_msr
775   */
776  #define STA_LOST_PKT_THRESHOLD 50
777  
778 +static void ieee80211_lost_packet(struct sta_info *sta, struct sk_buff *skb)
779 +{
780 +       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
781 +
782 +       /* This packet was aggregated but doesn't carry status info */
783 +       if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
784 +           !(info->flags & IEEE80211_TX_STAT_AMPDU))
785 +               return;
786 +
787 +       if (++sta->lost_packets < STA_LOST_PKT_THRESHOLD)
788 +               return;
789 +
790 +       cfg80211_cqm_pktloss_notify(sta->sdata->dev, sta->sta.addr,
791 +                                   sta->lost_packets, GFP_ATOMIC);
792 +       sta->lost_packets = 0;
793 +}
794 +
795  void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
796  {
797         struct sk_buff *skb2;
798 @@ -680,12 +697,8 @@ void ieee80211_tx_status(struct ieee8021
799                         if (info->flags & IEEE80211_TX_STAT_ACK) {
800                                 if (sta->lost_packets)
801                                         sta->lost_packets = 0;
802 -                       } else if (++sta->lost_packets >= STA_LOST_PKT_THRESHOLD) {
803 -                               cfg80211_cqm_pktloss_notify(sta->sdata->dev,
804 -                                                           sta->sta.addr,
805 -                                                           sta->lost_packets,
806 -                                                           GFP_ATOMIC);
807 -                               sta->lost_packets = 0;
808 +                       } else {
809 +                               ieee80211_lost_packet(sta, skb);
810                         }
811                 }
812  
813 --- a/net/mac80211/rx.c
814 +++ b/net/mac80211/rx.c
815 @@ -1107,6 +1107,8 @@ static void sta_ps_end(struct sta_info *
816                 return;
817         }
818  
819 +       set_sta_flag(sta, WLAN_STA_PS_DELIVER);
820 +       clear_sta_flag(sta, WLAN_STA_PS_STA);
821         ieee80211_sta_ps_deliver_wakeup(sta);
822  }
823  
824 --- a/net/mac80211/sta_info.h
825 +++ b/net/mac80211/sta_info.h
826 @@ -82,6 +82,7 @@ enum ieee80211_sta_info_flags {
827         WLAN_STA_TOFFSET_KNOWN,
828         WLAN_STA_MPSP_OWNER,
829         WLAN_STA_MPSP_RECIPIENT,
830 +       WLAN_STA_PS_DELIVER,
831  };
832  
833  #define ADDBA_RESP_INTERVAL HZ
834 @@ -265,7 +266,7 @@ struct ieee80211_tx_latency_stat {
835   * @last_rx_rate_vht_nss: rx status nss of last data packet
836   * @lock: used for locking all fields that require locking, see comments
837   *     in the header file.
838 - * @drv_unblock_wk: used for driver PS unblocking
839 + * @drv_deliver_wk: used for delivering frames after driver PS unblocking
840   * @listen_interval: listen interval of this station, when we're acting as AP
841   * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
842   * @ps_lock: used for powersave (when mac80211 is the AP) related locking
843 @@ -278,7 +279,6 @@ struct ieee80211_tx_latency_stat {
844   * @driver_buffered_tids: bitmap of TIDs the driver has data buffered on
845   * @rx_packets: Number of MSDUs received from this STA
846   * @rx_bytes: Number of bytes received from this STA
847 - * @wep_weak_iv_count: number of weak WEP IVs received from this station
848   * @last_rx: time (in jiffies) when last frame was received from this STA
849   * @last_connected: time (in seconds) when a station got connected
850   * @num_duplicates: number of duplicate frames received from this STA
851 @@ -345,7 +345,7 @@ struct sta_info {
852         void *rate_ctrl_priv;
853         spinlock_t lock;
854  
855 -       struct work_struct drv_unblock_wk;
856 +       struct work_struct drv_deliver_wk;
857  
858         u16 listen_interval;
859  
860 @@ -367,7 +367,6 @@ struct sta_info {
861         /* Updated from RX path only, no locking requirements */
862         unsigned long rx_packets;
863         u64 rx_bytes;
864 -       unsigned long wep_weak_iv_count;
865         unsigned long last_rx;
866         long last_connected;
867         unsigned long num_duplicates;
868 @@ -628,6 +627,8 @@ void sta_set_rate_info_tx(struct sta_inf
869                           struct rate_info *rinfo);
870  void sta_set_rate_info_rx(struct sta_info *sta,
871                           struct rate_info *rinfo);
872 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo);
873 +
874  void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
875                           unsigned long exp_time);
876  u8 sta_info_tx_streams(struct sta_info *sta);
877 --- a/net/mac80211/tx.c
878 +++ b/net/mac80211/tx.c
879 @@ -469,7 +469,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
880                 return TX_CONTINUE;
881  
882         if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
883 -                     test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
884 +                     test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
885 +                     test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
886                      !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
887                 int ac = skb_get_queue_mapping(tx->skb);
888  
889 @@ -486,7 +487,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
890                  * ahead and Tx the packet.
891                  */
892                 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
893 -                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
894 +                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
895 +                   !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
896                         spin_unlock(&sta->ps_lock);
897                         return TX_CONTINUE;
898                 }
899 @@ -1618,12 +1620,12 @@ netdev_tx_t ieee80211_monitor_start_xmit
900  {
901         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
902         struct ieee80211_chanctx_conf *chanctx_conf;
903 -       struct ieee80211_channel *chan;
904         struct ieee80211_radiotap_header *prthdr =
905                 (struct ieee80211_radiotap_header *)skb->data;
906         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
907         struct ieee80211_hdr *hdr;
908         struct ieee80211_sub_if_data *tmp_sdata, *sdata;
909 +       struct cfg80211_chan_def *chandef;
910         u16 len_rthdr;
911         int hdrlen;
912  
913 @@ -1721,9 +1723,9 @@ netdev_tx_t ieee80211_monitor_start_xmit
914         }
915  
916         if (chanctx_conf)
917 -               chan = chanctx_conf->def.chan;
918 +               chandef = &chanctx_conf->def;
919         else if (!local->use_chanctx)
920 -               chan = local->_oper_chandef.chan;
921 +               chandef = &local->_oper_chandef;
922         else
923                 goto fail_rcu;
924  
925 @@ -1743,10 +1745,11 @@ netdev_tx_t ieee80211_monitor_start_xmit
926          * radar detection by itself. We can do that later by adding a
927          * monitor flag interfaces used for AP support.
928          */
929 -       if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)))
930 +       if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
931 +                                    sdata->vif.type))
932                 goto fail_rcu;
933  
934 -       ieee80211_xmit(sdata, skb, chan->band);
935 +       ieee80211_xmit(sdata, skb, chandef->chan->band);
936         rcu_read_unlock();
937  
938         return NETDEV_TX_OK;
939 @@ -2425,7 +2428,7 @@ static void ieee80211_set_csa(struct iee
940         u8 *beacon_data;
941         size_t beacon_data_len;
942         int i;
943 -       u8 count = sdata->csa_current_counter;
944 +       u8 count = beacon->csa_current_counter;
945  
946         switch (sdata->vif.type) {
947         case NL80211_IFTYPE_AP:
948 @@ -2444,46 +2447,54 @@ static void ieee80211_set_csa(struct iee
949                 return;
950         }
951  
952 +       rcu_read_lock();
953         for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
954 -               u16 counter_offset_beacon =
955 -                       sdata->csa_counter_offset_beacon[i];
956 -               u16 counter_offset_presp = sdata->csa_counter_offset_presp[i];
957 -
958 -               if (counter_offset_beacon) {
959 -                       if (WARN_ON(counter_offset_beacon >= beacon_data_len))
960 -                               return;
961 -
962 -                       beacon_data[counter_offset_beacon] = count;
963 -               }
964 -
965 -               if (sdata->vif.type == NL80211_IFTYPE_AP &&
966 -                   counter_offset_presp) {
967 -                       rcu_read_lock();
968 -                       resp = rcu_dereference(sdata->u.ap.probe_resp);
969 +               resp = rcu_dereference(sdata->u.ap.probe_resp);
970  
971 -                       /* If nl80211 accepted the offset, this should
972 -                        * not happen.
973 -                        */
974 -                       if (WARN_ON(!resp)) {
975 +               if (beacon->csa_counter_offsets[i]) {
976 +                       if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
977 +                                        beacon_data_len)) {
978                                 rcu_read_unlock();
979                                 return;
980                         }
981 -                       resp->data[counter_offset_presp] = count;
982 -                       rcu_read_unlock();
983 +
984 +                       beacon_data[beacon->csa_counter_offsets[i]] = count;
985                 }
986 +
987 +               if (sdata->vif.type == NL80211_IFTYPE_AP && resp &&
988 +                   resp->csa_counter_offsets)
989 +                       resp->data[resp->csa_counter_offsets[i]] = count;
990         }
991 +       rcu_read_unlock();
992  }
993  
994  u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
995  {
996         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
997 +       struct beacon_data *beacon = NULL;
998 +       u8 count = 0;
999 +
1000 +       rcu_read_lock();
1001 +
1002 +       if (sdata->vif.type == NL80211_IFTYPE_AP)
1003 +               beacon = rcu_dereference(sdata->u.ap.beacon);
1004 +       else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1005 +               beacon = rcu_dereference(sdata->u.ibss.presp);
1006 +       else if (ieee80211_vif_is_mesh(&sdata->vif))
1007 +               beacon = rcu_dereference(sdata->u.mesh.beacon);
1008 +
1009 +       if (!beacon)
1010 +               goto unlock;
1011  
1012 -       sdata->csa_current_counter--;
1013 +       beacon->csa_current_counter--;
1014  
1015         /* the counter should never reach 0 */
1016 -       WARN_ON(!sdata->csa_current_counter);
1017 +       WARN_ON_ONCE(!beacon->csa_current_counter);
1018 +       count = beacon->csa_current_counter;
1019  
1020 -       return sdata->csa_current_counter;
1021 +unlock:
1022 +       rcu_read_unlock();
1023 +       return count;
1024  }
1025  EXPORT_SYMBOL(ieee80211_csa_update_counter);
1026  
1027 @@ -2493,7 +2504,6 @@ bool ieee80211_csa_is_complete(struct ie
1028         struct beacon_data *beacon = NULL;
1029         u8 *beacon_data;
1030         size_t beacon_data_len;
1031 -       int counter_beacon = sdata->csa_counter_offset_beacon[0];
1032         int ret = false;
1033  
1034         if (!ieee80211_sdata_running(sdata))
1035 @@ -2531,10 +2541,13 @@ bool ieee80211_csa_is_complete(struct ie
1036                 goto out;
1037         }
1038  
1039 -       if (WARN_ON(counter_beacon > beacon_data_len))
1040 +       if (!beacon->csa_counter_offsets[0])
1041 +               goto out;
1042 +
1043 +       if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
1044                 goto out;
1045  
1046 -       if (beacon_data[counter_beacon] == 1)
1047 +       if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
1048                 ret = true;
1049   out:
1050         rcu_read_unlock();
1051 @@ -2550,6 +2563,7 @@ __ieee80211_beacon_get(struct ieee80211_
1052                        bool is_template)
1053  {
1054         struct ieee80211_local *local = hw_to_local(hw);
1055 +       struct beacon_data *beacon = NULL;
1056         struct sk_buff *skb = NULL;
1057         struct ieee80211_tx_info *info;
1058         struct ieee80211_sub_if_data *sdata = NULL;
1059 @@ -2571,10 +2585,10 @@ __ieee80211_beacon_get(struct ieee80211_
1060  
1061         if (sdata->vif.type == NL80211_IFTYPE_AP) {
1062                 struct ieee80211_if_ap *ap = &sdata->u.ap;
1063 -               struct beacon_data *beacon = rcu_dereference(ap->beacon);
1064  
1065 +               beacon = rcu_dereference(ap->beacon);
1066                 if (beacon) {
1067 -                       if (sdata->vif.csa_active) {
1068 +                       if (beacon->csa_counter_offsets[0]) {
1069                                 if (!is_template)
1070                                         ieee80211_csa_update_counter(vif);
1071  
1072 @@ -2615,37 +2629,37 @@ __ieee80211_beacon_get(struct ieee80211_
1073         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1074                 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1075                 struct ieee80211_hdr *hdr;
1076 -               struct beacon_data *presp = rcu_dereference(ifibss->presp);
1077  
1078 -               if (!presp)
1079 +               beacon = rcu_dereference(ifibss->presp);
1080 +               if (!beacon)
1081                         goto out;
1082  
1083 -               if (sdata->vif.csa_active) {
1084 +               if (beacon->csa_counter_offsets[0]) {
1085                         if (!is_template)
1086                                 ieee80211_csa_update_counter(vif);
1087  
1088 -                       ieee80211_set_csa(sdata, presp);
1089 +                       ieee80211_set_csa(sdata, beacon);
1090                 }
1091  
1092 -               skb = dev_alloc_skb(local->tx_headroom + presp->head_len +
1093 +               skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
1094                                     local->hw.extra_beacon_tailroom);
1095                 if (!skb)
1096                         goto out;
1097                 skb_reserve(skb, local->tx_headroom);
1098 -               memcpy(skb_put(skb, presp->head_len), presp->head,
1099 -                      presp->head_len);
1100 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1101 +                      beacon->head_len);
1102  
1103                 hdr = (struct ieee80211_hdr *) skb->data;
1104                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1105                                                  IEEE80211_STYPE_BEACON);
1106         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
1107                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1108 -               struct beacon_data *bcn = rcu_dereference(ifmsh->beacon);
1109  
1110 -               if (!bcn)
1111 +               beacon = rcu_dereference(ifmsh->beacon);
1112 +               if (!beacon)
1113                         goto out;
1114  
1115 -               if (sdata->vif.csa_active) {
1116 +               if (beacon->csa_counter_offsets[0]) {
1117                         if (!is_template)
1118                                 /* TODO: For mesh csa_counter is in TU, so
1119                                  * decrementing it by one isn't correct, but
1120 @@ -2654,40 +2668,42 @@ __ieee80211_beacon_get(struct ieee80211_
1121                                  */
1122                                 ieee80211_csa_update_counter(vif);
1123  
1124 -                       ieee80211_set_csa(sdata, bcn);
1125 +                       ieee80211_set_csa(sdata, beacon);
1126                 }
1127  
1128                 if (ifmsh->sync_ops)
1129 -                       ifmsh->sync_ops->adjust_tbtt(sdata, bcn);
1130 +                       ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
1131  
1132                 skb = dev_alloc_skb(local->tx_headroom +
1133 -                                   bcn->head_len +
1134 +                                   beacon->head_len +
1135                                     256 + /* TIM IE */
1136 -                                   bcn->tail_len +
1137 +                                   beacon->tail_len +
1138                                     local->hw.extra_beacon_tailroom);
1139                 if (!skb)
1140                         goto out;
1141                 skb_reserve(skb, local->tx_headroom);
1142 -               memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
1143 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1144 +                      beacon->head_len);
1145                 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
1146  
1147                 if (offs) {
1148 -                       offs->tim_offset = bcn->head_len;
1149 -                       offs->tim_length = skb->len - bcn->head_len;
1150 +                       offs->tim_offset = beacon->head_len;
1151 +                       offs->tim_length = skb->len - beacon->head_len;
1152                 }
1153  
1154 -               memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
1155 +               memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
1156 +                      beacon->tail_len);
1157         } else {
1158                 WARN_ON(1);
1159                 goto out;
1160         }
1161  
1162         /* CSA offsets */
1163 -       if (offs) {
1164 +       if (offs && beacon) {
1165                 int i;
1166  
1167                 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
1168 -                       u16 csa_off = sdata->csa_counter_offset_beacon[i];
1169 +                       u16 csa_off = beacon->csa_counter_offsets[i];
1170  
1171                         if (!csa_off)
1172                                 continue;
1173 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
1174 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
1175 @@ -947,6 +947,40 @@ static inline u8 rt2800_get_beacon_offse
1176         return BEACON_BASE_TO_OFFSET(rt2800_hw_beacon_base(rt2x00dev, index));
1177  }
1178  
1179 +static void rt2800_update_beacons_setup(struct rt2x00_dev *rt2x00dev)
1180 +{
1181 +       struct data_queue *queue = rt2x00dev->bcn;
1182 +       struct queue_entry *entry;
1183 +       int i, bcn_num = 0;
1184 +       u64 off, reg = 0;
1185 +       u32 bssid_dw1;
1186 +
1187 +       /*
1188 +        * Setup offsets of all active beacons in BCN_OFFSET{0,1} registers.
1189 +        */
1190 +       for (i = 0; i < queue->limit; i++) {
1191 +               entry = &queue->entries[i];
1192 +               if (!test_bit(ENTRY_BCN_ENABLED, &entry->flags))
1193 +                       continue;
1194 +               off = rt2800_get_beacon_offset(rt2x00dev, entry->entry_idx);
1195 +               reg |= off << (8 * bcn_num);
1196 +               bcn_num++;
1197 +       }
1198 +
1199 +       WARN_ON_ONCE(bcn_num != rt2x00dev->intf_beaconing);
1200 +
1201 +       rt2800_register_write(rt2x00dev, BCN_OFFSET0, (u32) reg);
1202 +       rt2800_register_write(rt2x00dev, BCN_OFFSET1, (u32) (reg >> 32));
1203 +
1204 +       /*
1205 +        * H/W sends up to MAC_BSSID_DW1_BSS_BCN_NUM + 1 consecutive beacons.
1206 +        */
1207 +       rt2800_register_read(rt2x00dev, MAC_BSSID_DW1, &bssid_dw1);
1208 +       rt2x00_set_field32(&bssid_dw1, MAC_BSSID_DW1_BSS_BCN_NUM,
1209 +                          bcn_num > 0 ? bcn_num - 1 : 0);
1210 +       rt2800_register_write(rt2x00dev, MAC_BSSID_DW1, bssid_dw1);
1211 +}
1212 +
1213  void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
1214  {
1215         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
1216 @@ -1003,6 +1037,12 @@ void rt2800_write_beacon(struct queue_en
1217  
1218         rt2800_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
1219                                    entry->skb->len + padding_len);
1220 +       __set_bit(ENTRY_BCN_ENABLED, &entry->flags);
1221 +
1222 +       /*
1223 +        * Change global beacons settings.
1224 +        */
1225 +       rt2800_update_beacons_setup(rt2x00dev);
1226  
1227         /*
1228          * Restore beaconing state.
1229 @@ -1053,8 +1093,13 @@ void rt2800_clear_beacon(struct queue_en
1230          * Clear beacon.
1231          */
1232         rt2800_clear_beacon_register(rt2x00dev, entry->entry_idx);
1233 +       __clear_bit(ENTRY_BCN_ENABLED, &entry->flags);
1234  
1235         /*
1236 +        * Change global beacons settings.
1237 +        */
1238 +       rt2800_update_beacons_setup(rt2x00dev);
1239 +       /*
1240          * Restore beaconing state.
1241          */
1242         rt2800_register_write(rt2x00dev, BCN_TIME_CFG, orig_reg);
1243 @@ -1556,7 +1601,7 @@ void rt2800_config_intf(struct rt2x00_de
1244                 if (!is_zero_ether_addr((const u8 *)conf->bssid)) {
1245                         reg = le32_to_cpu(conf->bssid[1]);
1246                         rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 3);
1247 -                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 7);
1248 +                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
1249                         conf->bssid[1] = cpu_to_le32(reg);
1250                 }
1251  
1252 @@ -4517,28 +4562,6 @@ static int rt2800_init_registers(struct 
1253         if (ret)
1254                 return ret;
1255  
1256 -       rt2800_register_read(rt2x00dev, BCN_OFFSET0, &reg);
1257 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0,
1258 -                          rt2800_get_beacon_offset(rt2x00dev, 0));
1259 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1,
1260 -                          rt2800_get_beacon_offset(rt2x00dev, 1));
1261 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2,
1262 -                          rt2800_get_beacon_offset(rt2x00dev, 2));
1263 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3,
1264 -                          rt2800_get_beacon_offset(rt2x00dev, 3));
1265 -       rt2800_register_write(rt2x00dev, BCN_OFFSET0, reg);
1266 -
1267 -       rt2800_register_read(rt2x00dev, BCN_OFFSET1, &reg);
1268 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4,
1269 -                          rt2800_get_beacon_offset(rt2x00dev, 4));
1270 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5,
1271 -                          rt2800_get_beacon_offset(rt2x00dev, 5));
1272 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6,
1273 -                          rt2800_get_beacon_offset(rt2x00dev, 6));
1274 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7,
1275 -                          rt2800_get_beacon_offset(rt2x00dev, 7));
1276 -       rt2800_register_write(rt2x00dev, BCN_OFFSET1, reg);
1277 -
1278         rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
1279         rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
1280  
1281 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
1282 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
1283 @@ -141,8 +141,11 @@ static void rt2x00lib_intf_scheduled_ite
1284         if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
1285                 return;
1286  
1287 -       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags))
1288 +       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags)) {
1289 +               mutex_lock(&intf->beacon_skb_mutex);
1290                 rt2x00queue_update_beacon(rt2x00dev, vif);
1291 +               mutex_unlock(&intf->beacon_skb_mutex);
1292 +       }
1293  }
1294  
1295  static void rt2x00lib_intf_scheduled(struct work_struct *work)
1296 @@ -216,7 +219,7 @@ static void rt2x00lib_beaconupdate_iter(
1297          * never be called for USB devices.
1298          */
1299         WARN_ON(rt2x00_is_usb(rt2x00dev));
1300 -       rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1301 +       rt2x00queue_update_beacon(rt2x00dev, vif);
1302  }
1303  
1304  void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
1305 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
1306 +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
1307 @@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_h
1308         crypto.cipher = rt2x00crypto_key_to_cipher(key);
1309         if (crypto.cipher == CIPHER_NONE)
1310                 return -EOPNOTSUPP;
1311 +       if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
1312 +               return -EOPNOTSUPP;
1313  
1314         crypto.cmd = cmd;
1315  
1316 @@ -624,25 +626,24 @@ void rt2x00mac_bss_info_changed(struct i
1317          * Start/stop beaconing.
1318          */
1319         if (changes & BSS_CHANGED_BEACON_ENABLED) {
1320 +               mutex_lock(&intf->beacon_skb_mutex);
1321                 if (!bss_conf->enable_beacon && intf->enable_beacon) {
1322                         rt2x00dev->intf_beaconing--;
1323                         intf->enable_beacon = false;
1324 -                       /*
1325 -                        * Clear beacon in the H/W for this vif. This is needed
1326 -                        * to disable beaconing on this particular interface
1327 -                        * and keep it running on other interfaces.
1328 -                        */
1329 -                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1330  
1331                         if (rt2x00dev->intf_beaconing == 0) {
1332                                 /*
1333                                  * Last beaconing interface disabled
1334                                  * -> stop beacon queue.
1335                                  */
1336 -                               mutex_lock(&intf->beacon_skb_mutex);
1337                                 rt2x00queue_stop_queue(rt2x00dev->bcn);
1338 -                               mutex_unlock(&intf->beacon_skb_mutex);
1339                         }
1340 +                       /*
1341 +                        * Clear beacon in the H/W for this vif. This is needed
1342 +                        * to disable beaconing on this particular interface
1343 +                        * and keep it running on other interfaces.
1344 +                        */
1345 +                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1346                 } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
1347                         rt2x00dev->intf_beaconing++;
1348                         intf->enable_beacon = true;
1349 @@ -658,11 +659,10 @@ void rt2x00mac_bss_info_changed(struct i
1350                                  * First beaconing interface enabled
1351                                  * -> start beacon queue.
1352                                  */
1353 -                               mutex_lock(&intf->beacon_skb_mutex);
1354                                 rt2x00queue_start_queue(rt2x00dev->bcn);
1355 -                               mutex_unlock(&intf->beacon_skb_mutex);
1356                         }
1357                 }
1358 +               mutex_unlock(&intf->beacon_skb_mutex);
1359         }
1360  
1361         /*
1362 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
1363 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
1364 @@ -754,8 +754,6 @@ int rt2x00queue_clear_beacon(struct rt2x
1365         if (unlikely(!intf->beacon))
1366                 return -ENOBUFS;
1367  
1368 -       mutex_lock(&intf->beacon_skb_mutex);
1369 -
1370         /*
1371          * Clean up the beacon skb.
1372          */
1373 @@ -768,13 +766,11 @@ int rt2x00queue_clear_beacon(struct rt2x
1374         if (rt2x00dev->ops->lib->clear_beacon)
1375                 rt2x00dev->ops->lib->clear_beacon(intf->beacon);
1376  
1377 -       mutex_unlock(&intf->beacon_skb_mutex);
1378 -
1379         return 0;
1380  }
1381  
1382 -int rt2x00queue_update_beacon_locked(struct rt2x00_dev *rt2x00dev,
1383 -                                    struct ieee80211_vif *vif)
1384 +int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1385 +                             struct ieee80211_vif *vif)
1386  {
1387         struct rt2x00_intf *intf = vif_to_intf(vif);
1388         struct skb_frame_desc *skbdesc;
1389 @@ -815,19 +811,6 @@ int rt2x00queue_update_beacon_locked(str
1390  
1391  }
1392  
1393 -int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1394 -                             struct ieee80211_vif *vif)
1395 -{
1396 -       struct rt2x00_intf *intf = vif_to_intf(vif);
1397 -       int ret;
1398 -
1399 -       mutex_lock(&intf->beacon_skb_mutex);
1400 -       ret = rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1401 -       mutex_unlock(&intf->beacon_skb_mutex);
1402 -
1403 -       return ret;
1404 -}
1405 -
1406  bool rt2x00queue_for_each_entry(struct data_queue *queue,
1407                                 enum queue_index start,
1408                                 enum queue_index end,
1409 --- a/drivers/net/wireless/rt2x00/rt2x00queue.h
1410 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
1411 @@ -353,6 +353,7 @@ struct txentry_desc {
1412   */
1413  enum queue_entry_flags {
1414         ENTRY_BCN_ASSIGNED,
1415 +       ENTRY_BCN_ENABLED,
1416         ENTRY_OWNER_DEVICE_DATA,
1417         ENTRY_DATA_PENDING,
1418         ENTRY_DATA_IO_FAILED,
1419 --- a/drivers/net/wireless/ath/ath9k/main.c
1420 +++ b/drivers/net/wireless/ath/ath9k/main.c
1421 @@ -1757,7 +1757,6 @@ out:
1422  void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif)
1423  {
1424         struct ath_vif *avp = (void *)vif->drv_priv;
1425 -       unsigned long flags;
1426         u32 tsf;
1427  
1428         if (!sc->p2p_ps_timer)
1429 @@ -1767,14 +1766,9 @@ void ath9k_update_p2p_ps(struct ath_soft
1430                 return;
1431  
1432         sc->p2p_ps_vif = avp;
1433 -
1434 -       spin_lock_irqsave(&sc->sc_pm_lock, flags);
1435 -       if (!(sc->ps_flags & PS_BEACON_SYNC)) {
1436 -               tsf = ath9k_hw_gettsf32(sc->sc_ah);
1437 -               ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1438 -               ath9k_update_p2p_ps_timer(sc, avp);
1439 -       }
1440 -       spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1441 +       tsf = ath9k_hw_gettsf32(sc->sc_ah);
1442 +       ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1443 +       ath9k_update_p2p_ps_timer(sc, avp);
1444  }
1445  
1446  static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
1447 @@ -1791,6 +1785,7 @@ static void ath9k_bss_info_changed(struc
1448         struct ath_hw *ah = sc->sc_ah;
1449         struct ath_common *common = ath9k_hw_common(ah);
1450         struct ath_vif *avp = (void *)vif->drv_priv;
1451 +       unsigned long flags;
1452         int slottime;
1453  
1454         ath9k_ps_wakeup(sc);
1455 @@ -1853,7 +1848,10 @@ static void ath9k_bss_info_changed(struc
1456  
1457         if (changed & BSS_CHANGED_P2P_PS) {
1458                 spin_lock_bh(&sc->sc_pcu_lock);
1459 -               ath9k_update_p2p_ps(sc, vif);
1460 +               spin_lock_irqsave(&sc->sc_pm_lock, flags);
1461 +               if (!(sc->ps_flags & PS_BEACON_SYNC))
1462 +                       ath9k_update_p2p_ps(sc, vif);
1463 +               spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1464                 spin_unlock_bh(&sc->sc_pcu_lock);
1465         }
1466  
1467 @@ -2232,14 +2230,6 @@ static void ath9k_sw_scan_complete(struc
1468         clear_bit(ATH_OP_SCANNING, &common->op_flags);
1469  }
1470  
1471 -static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
1472 -                                       struct ieee80211_vif *vif,
1473 -                                       struct cfg80211_chan_def *chandef)
1474 -{
1475 -       /* depend on vif->csa_active only */
1476 -       return;
1477 -}
1478 -
1479  struct ieee80211_ops ath9k_ops = {
1480         .tx                 = ath9k_tx,
1481         .start              = ath9k_start,
1482 @@ -2287,5 +2277,4 @@ struct ieee80211_ops ath9k_ops = {
1483  #endif
1484         .sw_scan_start      = ath9k_sw_scan_start,
1485         .sw_scan_complete   = ath9k_sw_scan_complete,
1486 -       .channel_switch_beacon     = ath9k_channel_switch_beacon,
1487  };
1488 --- a/drivers/net/wireless/ath/ath10k/mac.c
1489 +++ b/drivers/net/wireless/ath/ath10k/mac.c
1490 @@ -4142,14 +4142,6 @@ static int ath10k_set_bitrate_mask(struc
1491                                            fixed_nss, force_sgi);
1492  }
1493  
1494 -static void ath10k_channel_switch_beacon(struct ieee80211_hw *hw,
1495 -                                        struct ieee80211_vif *vif,
1496 -                                        struct cfg80211_chan_def *chandef)
1497 -{
1498 -       /* there's no need to do anything here. vif->csa_active is enough */
1499 -       return;
1500 -}
1501 -
1502  static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
1503                                  struct ieee80211_vif *vif,
1504                                  struct ieee80211_sta *sta,
1505 @@ -4256,7 +4248,6 @@ static const struct ieee80211_ops ath10k
1506         .restart_complete               = ath10k_restart_complete,
1507         .get_survey                     = ath10k_get_survey,
1508         .set_bitrate_mask               = ath10k_set_bitrate_mask,
1509 -       .channel_switch_beacon          = ath10k_channel_switch_beacon,
1510         .sta_rc_update                  = ath10k_sta_rc_update,
1511         .get_tsf                        = ath10k_get_tsf,
1512  #ifdef CONFIG_PM
1513 --- a/net/mac80211/cfg.c
1514 +++ b/net/mac80211/cfg.c
1515 @@ -468,327 +468,6 @@ void sta_set_rate_info_rx(struct sta_inf
1516                 rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
1517  }
1518  
1519 -static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
1520 -{
1521 -       struct ieee80211_sub_if_data *sdata = sta->sdata;
1522 -       struct ieee80211_local *local = sdata->local;
1523 -       struct rate_control_ref *ref = local->rate_ctrl;
1524 -       struct timespec uptime;
1525 -       u64 packets = 0;
1526 -       u32 thr = 0;
1527 -       int i, ac;
1528 -
1529 -       sinfo->generation = sdata->local->sta_generation;
1530 -
1531 -       sinfo->filled = STATION_INFO_INACTIVE_TIME |
1532 -                       STATION_INFO_RX_BYTES64 |
1533 -                       STATION_INFO_TX_BYTES64 |
1534 -                       STATION_INFO_RX_PACKETS |
1535 -                       STATION_INFO_TX_PACKETS |
1536 -                       STATION_INFO_TX_RETRIES |
1537 -                       STATION_INFO_TX_FAILED |
1538 -                       STATION_INFO_TX_BITRATE |
1539 -                       STATION_INFO_RX_BITRATE |
1540 -                       STATION_INFO_RX_DROP_MISC |
1541 -                       STATION_INFO_BSS_PARAM |
1542 -                       STATION_INFO_CONNECTED_TIME |
1543 -                       STATION_INFO_STA_FLAGS |
1544 -                       STATION_INFO_BEACON_LOSS_COUNT;
1545 -
1546 -       do_posix_clock_monotonic_gettime(&uptime);
1547 -       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
1548 -
1549 -       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
1550 -       sinfo->tx_bytes = 0;
1551 -       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1552 -               sinfo->tx_bytes += sta->tx_bytes[ac];
1553 -               packets += sta->tx_packets[ac];
1554 -       }
1555 -       sinfo->tx_packets = packets;
1556 -       sinfo->rx_bytes = sta->rx_bytes;
1557 -       sinfo->rx_packets = sta->rx_packets;
1558 -       sinfo->tx_retries = sta->tx_retry_count;
1559 -       sinfo->tx_failed = sta->tx_retry_failed;
1560 -       sinfo->rx_dropped_misc = sta->rx_dropped;
1561 -       sinfo->beacon_loss_count = sta->beacon_loss_count;
1562 -
1563 -       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
1564 -           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
1565 -               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
1566 -               if (!local->ops->get_rssi ||
1567 -                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
1568 -                       sinfo->signal = (s8)sta->last_signal;
1569 -               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
1570 -       }
1571 -       if (sta->chains) {
1572 -               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
1573 -                                STATION_INFO_CHAIN_SIGNAL_AVG;
1574 -
1575 -               sinfo->chains = sta->chains;
1576 -               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
1577 -                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
1578 -                       sinfo->chain_signal_avg[i] =
1579 -                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
1580 -               }
1581 -       }
1582 -
1583 -       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
1584 -       sta_set_rate_info_rx(sta, &sinfo->rxrate);
1585 -
1586 -       if (ieee80211_vif_is_mesh(&sdata->vif)) {
1587 -#ifdef CPTCFG_MAC80211_MESH
1588 -               sinfo->filled |= STATION_INFO_LLID |
1589 -                                STATION_INFO_PLID |
1590 -                                STATION_INFO_PLINK_STATE |
1591 -                                STATION_INFO_LOCAL_PM |
1592 -                                STATION_INFO_PEER_PM |
1593 -                                STATION_INFO_NONPEER_PM;
1594 -
1595 -               sinfo->llid = sta->llid;
1596 -               sinfo->plid = sta->plid;
1597 -               sinfo->plink_state = sta->plink_state;
1598 -               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
1599 -                       sinfo->filled |= STATION_INFO_T_OFFSET;
1600 -                       sinfo->t_offset = sta->t_offset;
1601 -               }
1602 -               sinfo->local_pm = sta->local_pm;
1603 -               sinfo->peer_pm = sta->peer_pm;
1604 -               sinfo->nonpeer_pm = sta->nonpeer_pm;
1605 -#endif
1606 -       }
1607 -
1608 -       sinfo->bss_param.flags = 0;
1609 -       if (sdata->vif.bss_conf.use_cts_prot)
1610 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
1611 -       if (sdata->vif.bss_conf.use_short_preamble)
1612 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
1613 -       if (sdata->vif.bss_conf.use_short_slot)
1614 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
1615 -       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
1616 -       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
1617 -
1618 -       sinfo->sta_flags.set = 0;
1619 -       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
1620 -                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
1621 -                               BIT(NL80211_STA_FLAG_WME) |
1622 -                               BIT(NL80211_STA_FLAG_MFP) |
1623 -                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1624 -                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
1625 -                               BIT(NL80211_STA_FLAG_TDLS_PEER);
1626 -       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1627 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
1628 -       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
1629 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
1630 -       if (test_sta_flag(sta, WLAN_STA_WME))
1631 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
1632 -       if (test_sta_flag(sta, WLAN_STA_MFP))
1633 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
1634 -       if (test_sta_flag(sta, WLAN_STA_AUTH))
1635 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
1636 -       if (test_sta_flag(sta, WLAN_STA_ASSOC))
1637 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1638 -       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
1639 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
1640 -
1641 -       /* check if the driver has a SW RC implementation */
1642 -       if (ref && ref->ops->get_expected_throughput)
1643 -               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
1644 -       else
1645 -               thr = drv_get_expected_throughput(local, &sta->sta);
1646 -
1647 -       if (thr != 0) {
1648 -               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
1649 -               sinfo->expected_throughput = thr;
1650 -       }
1651 -}
1652 -
1653 -static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
1654 -       "rx_packets", "rx_bytes", "wep_weak_iv_count",
1655 -       "rx_duplicates", "rx_fragments", "rx_dropped",
1656 -       "tx_packets", "tx_bytes", "tx_fragments",
1657 -       "tx_filtered", "tx_retry_failed", "tx_retries",
1658 -       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
1659 -       "channel", "noise", "ch_time", "ch_time_busy",
1660 -       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
1661 -};
1662 -#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
1663 -
1664 -static int ieee80211_get_et_sset_count(struct wiphy *wiphy,
1665 -                                      struct net_device *dev,
1666 -                                      int sset)
1667 -{
1668 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1669 -       int rv = 0;
1670 -
1671 -       if (sset == ETH_SS_STATS)
1672 -               rv += STA_STATS_LEN;
1673 -
1674 -       rv += drv_get_et_sset_count(sdata, sset);
1675 -
1676 -       if (rv == 0)
1677 -               return -EOPNOTSUPP;
1678 -       return rv;
1679 -}
1680 -
1681 -static void ieee80211_get_et_stats(struct wiphy *wiphy,
1682 -                                  struct net_device *dev,
1683 -                                  struct ethtool_stats *stats,
1684 -                                  u64 *data)
1685 -{
1686 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1687 -       struct ieee80211_chanctx_conf *chanctx_conf;
1688 -       struct ieee80211_channel *channel;
1689 -       struct sta_info *sta;
1690 -       struct ieee80211_local *local = sdata->local;
1691 -       struct station_info sinfo;
1692 -       struct survey_info survey;
1693 -       int i, q;
1694 -#define STA_STATS_SURVEY_LEN 7
1695 -
1696 -       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
1697 -
1698 -#define ADD_STA_STATS(sta)                             \
1699 -       do {                                            \
1700 -               data[i++] += sta->rx_packets;           \
1701 -               data[i++] += sta->rx_bytes;             \
1702 -               data[i++] += sta->wep_weak_iv_count;    \
1703 -               data[i++] += sta->num_duplicates;       \
1704 -               data[i++] += sta->rx_fragments;         \
1705 -               data[i++] += sta->rx_dropped;           \
1706 -                                                       \
1707 -               data[i++] += sinfo.tx_packets;          \
1708 -               data[i++] += sinfo.tx_bytes;            \
1709 -               data[i++] += sta->tx_fragments;         \
1710 -               data[i++] += sta->tx_filtered_count;    \
1711 -               data[i++] += sta->tx_retry_failed;      \
1712 -               data[i++] += sta->tx_retry_count;       \
1713 -               data[i++] += sta->beacon_loss_count;    \
1714 -       } while (0)
1715 -
1716 -       /* For Managed stations, find the single station based on BSSID
1717 -        * and use that.  For interface types, iterate through all available
1718 -        * stations and add stats for any station that is assigned to this
1719 -        * network device.
1720 -        */
1721 -
1722 -       mutex_lock(&local->sta_mtx);
1723 -
1724 -       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
1725 -               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
1726 -
1727 -               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
1728 -                       goto do_survey;
1729 -
1730 -               sinfo.filled = 0;
1731 -               sta_set_sinfo(sta, &sinfo);
1732 -
1733 -               i = 0;
1734 -               ADD_STA_STATS(sta);
1735 -
1736 -               data[i++] = sta->sta_state;
1737 -
1738 -
1739 -               if (sinfo.filled & STATION_INFO_TX_BITRATE)
1740 -                       data[i] = 100000 *
1741 -                               cfg80211_calculate_bitrate(&sinfo.txrate);
1742 -               i++;
1743 -               if (sinfo.filled & STATION_INFO_RX_BITRATE)
1744 -                       data[i] = 100000 *
1745 -                               cfg80211_calculate_bitrate(&sinfo.rxrate);
1746 -               i++;
1747 -
1748 -               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
1749 -                       data[i] = (u8)sinfo.signal_avg;
1750 -               i++;
1751 -       } else {
1752 -               list_for_each_entry(sta, &local->sta_list, list) {
1753 -                       /* Make sure this station belongs to the proper dev */
1754 -                       if (sta->sdata->dev != dev)
1755 -                               continue;
1756 -
1757 -                       sinfo.filled = 0;
1758 -                       sta_set_sinfo(sta, &sinfo);
1759 -                       i = 0;
1760 -                       ADD_STA_STATS(sta);
1761 -               }
1762 -       }
1763 -
1764 -do_survey:
1765 -       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
1766 -       /* Get survey stats for current channel */
1767 -       survey.filled = 0;
1768 -
1769 -       rcu_read_lock();
1770 -       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1771 -       if (chanctx_conf)
1772 -               channel = chanctx_conf->def.chan;
1773 -       else
1774 -               channel = NULL;
1775 -       rcu_read_unlock();
1776 -
1777 -       if (channel) {
1778 -               q = 0;
1779 -               do {
1780 -                       survey.filled = 0;
1781 -                       if (drv_get_survey(local, q, &survey) != 0) {
1782 -                               survey.filled = 0;
1783 -                               break;
1784 -                       }
1785 -                       q++;
1786 -               } while (channel != survey.channel);
1787 -       }
1788 -
1789 -       if (survey.filled)
1790 -               data[i++] = survey.channel->center_freq;
1791 -       else
1792 -               data[i++] = 0;
1793 -       if (survey.filled & SURVEY_INFO_NOISE_DBM)
1794 -               data[i++] = (u8)survey.noise;
1795 -       else
1796 -               data[i++] = -1LL;
1797 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
1798 -               data[i++] = survey.channel_time;
1799 -       else
1800 -               data[i++] = -1LL;
1801 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
1802 -               data[i++] = survey.channel_time_busy;
1803 -       else
1804 -               data[i++] = -1LL;
1805 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
1806 -               data[i++] = survey.channel_time_ext_busy;
1807 -       else
1808 -               data[i++] = -1LL;
1809 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
1810 -               data[i++] = survey.channel_time_rx;
1811 -       else
1812 -               data[i++] = -1LL;
1813 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
1814 -               data[i++] = survey.channel_time_tx;
1815 -       else
1816 -               data[i++] = -1LL;
1817 -
1818 -       mutex_unlock(&local->sta_mtx);
1819 -
1820 -       if (WARN_ON(i != STA_STATS_LEN))
1821 -               return;
1822 -
1823 -       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
1824 -}
1825 -
1826 -static void ieee80211_get_et_strings(struct wiphy *wiphy,
1827 -                                    struct net_device *dev,
1828 -                                    u32 sset, u8 *data)
1829 -{
1830 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1831 -       int sz_sta_stats = 0;
1832 -
1833 -       if (sset == ETH_SS_STATS) {
1834 -               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
1835 -               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
1836 -       }
1837 -       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
1838 -}
1839 -
1840  static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
1841                                   int idx, u8 *mac, struct station_info *sinfo)
1842  {
1843 @@ -875,7 +554,8 @@ static int ieee80211_set_monitor_channel
1844  }
1845  
1846  static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
1847 -                                   const u8 *resp, size_t resp_len)
1848 +                                   const u8 *resp, size_t resp_len,
1849 +                                   const struct ieee80211_csa_settings *csa)
1850  {
1851         struct probe_resp *new, *old;
1852  
1853 @@ -891,6 +571,11 @@ static int ieee80211_set_probe_resp(stru
1854         new->len = resp_len;
1855         memcpy(new->data, resp, resp_len);
1856  
1857 +       if (csa)
1858 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_presp,
1859 +                      csa->n_counter_offsets_presp *
1860 +                      sizeof(new->csa_counter_offsets[0]));
1861 +
1862         rcu_assign_pointer(sdata->u.ap.probe_resp, new);
1863         if (old)
1864                 kfree_rcu(old, rcu_head);
1865 @@ -899,7 +584,8 @@ static int ieee80211_set_probe_resp(stru
1866  }
1867  
1868  static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
1869 -                                  struct cfg80211_beacon_data *params)
1870 +                                  struct cfg80211_beacon_data *params,
1871 +                                  const struct ieee80211_csa_settings *csa)
1872  {
1873         struct beacon_data *new, *old;
1874         int new_head_len, new_tail_len;
1875 @@ -943,6 +629,13 @@ static int ieee80211_assign_beacon(struc
1876         new->head_len = new_head_len;
1877         new->tail_len = new_tail_len;
1878  
1879 +       if (csa) {
1880 +               new->csa_current_counter = csa->count;
1881 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_beacon,
1882 +                      csa->n_counter_offsets_beacon *
1883 +                      sizeof(new->csa_counter_offsets[0]));
1884 +       }
1885 +
1886         /* copy in head */
1887         if (params->head)
1888                 memcpy(new->head, params->head, new_head_len);
1889 @@ -957,7 +650,7 @@ static int ieee80211_assign_beacon(struc
1890                         memcpy(new->tail, old->tail, new_tail_len);
1891  
1892         err = ieee80211_set_probe_resp(sdata, params->probe_resp,
1893 -                                      params->probe_resp_len);
1894 +                                      params->probe_resp_len, csa);
1895         if (err < 0)
1896                 return err;
1897         if (err == 0)
1898 @@ -1042,7 +735,7 @@ static int ieee80211_start_ap(struct wip
1899                 sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow |=
1900                                         IEEE80211_P2P_OPPPS_ENABLE_BIT;
1901  
1902 -       err = ieee80211_assign_beacon(sdata, &params->beacon);
1903 +       err = ieee80211_assign_beacon(sdata, &params->beacon, NULL);
1904         if (err < 0) {
1905                 ieee80211_vif_release_channel(sdata);
1906                 return err;
1907 @@ -1090,7 +783,7 @@ static int ieee80211_change_beacon(struc
1908         if (!old)
1909                 return -ENOENT;
1910  
1911 -       err = ieee80211_assign_beacon(sdata, params);
1912 +       err = ieee80211_assign_beacon(sdata, params, NULL);
1913         if (err < 0)
1914                 return err;
1915         ieee80211_bss_info_change_notify(sdata, err);
1916 @@ -3073,7 +2766,8 @@ static int ieee80211_set_after_csa_beaco
1917  
1918         switch (sdata->vif.type) {
1919         case NL80211_IFTYPE_AP:
1920 -               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
1921 +               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
1922 +                                             NULL);
1923                 kfree(sdata->u.ap.next_beacon);
1924                 sdata->u.ap.next_beacon = NULL;
1925  
1926 @@ -3176,6 +2870,7 @@ static int ieee80211_set_csa_beacon(stru
1927                                     struct cfg80211_csa_settings *params,
1928                                     u32 *changed)
1929  {
1930 +       struct ieee80211_csa_settings csa = {};
1931         int err;
1932  
1933         switch (sdata->vif.type) {
1934 @@ -3210,20 +2905,13 @@ static int ieee80211_set_csa_beacon(stru
1935                      IEEE80211_MAX_CSA_COUNTERS_NUM))
1936                         return -EINVAL;
1937  
1938 -               /* make sure we don't have garbage in other counters */
1939 -               memset(sdata->csa_counter_offset_beacon, 0,
1940 -                      sizeof(sdata->csa_counter_offset_beacon));
1941 -               memset(sdata->csa_counter_offset_presp, 0,
1942 -                      sizeof(sdata->csa_counter_offset_presp));
1943 -
1944 -               memcpy(sdata->csa_counter_offset_beacon,
1945 -                      params->counter_offsets_beacon,
1946 -                      params->n_counter_offsets_beacon * sizeof(u16));
1947 -               memcpy(sdata->csa_counter_offset_presp,
1948 -                      params->counter_offsets_presp,
1949 -                      params->n_counter_offsets_presp * sizeof(u16));
1950 +               csa.counter_offsets_beacon = params->counter_offsets_beacon;
1951 +               csa.counter_offsets_presp = params->counter_offsets_presp;
1952 +               csa.n_counter_offsets_beacon = params->n_counter_offsets_beacon;
1953 +               csa.n_counter_offsets_presp = params->n_counter_offsets_presp;
1954 +               csa.count = params->count;
1955  
1956 -               err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
1957 +               err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa);
1958                 if (err < 0) {
1959                         kfree(sdata->u.ap.next_beacon);
1960                         return err;
1961 @@ -3367,7 +3055,6 @@ __ieee80211_channel_switch(struct wiphy 
1962         sdata->csa_radar_required = params->radar_required;
1963         sdata->csa_chandef = params->chandef;
1964         sdata->csa_block_tx = params->block_tx;
1965 -       sdata->csa_current_counter = params->count;
1966         sdata->vif.csa_active = true;
1967  
1968         if (sdata->csa_block_tx)
1969 @@ -3515,10 +3202,23 @@ static int ieee80211_mgmt_tx(struct wiph
1970              sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
1971             params->n_csa_offsets) {
1972                 int i;
1973 -               u8 c = sdata->csa_current_counter;
1974 +               struct beacon_data *beacon = NULL;
1975 +
1976 +               rcu_read_lock();
1977  
1978 -               for (i = 0; i < params->n_csa_offsets; i++)
1979 -                       data[params->csa_offsets[i]] = c;
1980 +               if (sdata->vif.type == NL80211_IFTYPE_AP)
1981 +                       beacon = rcu_dereference(sdata->u.ap.beacon);
1982 +               else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1983 +                       beacon = rcu_dereference(sdata->u.ibss.presp);
1984 +               else if (ieee80211_vif_is_mesh(&sdata->vif))
1985 +                       beacon = rcu_dereference(sdata->u.mesh.beacon);
1986 +
1987 +               if (beacon)
1988 +                       for (i = 0; i < params->n_csa_offsets; i++)
1989 +                               data[params->csa_offsets[i]] =
1990 +                                       beacon->csa_current_counter;
1991 +
1992 +               rcu_read_unlock();
1993         }
1994  
1995         IEEE80211_SKB_CB(skb)->flags = flags;
1996 @@ -3598,21 +3298,6 @@ static int ieee80211_get_antenna(struct 
1997         return drv_get_antenna(local, tx_ant, rx_ant);
1998  }
1999  
2000 -static int ieee80211_set_ringparam(struct wiphy *wiphy, u32 tx, u32 rx)
2001 -{
2002 -       struct ieee80211_local *local = wiphy_priv(wiphy);
2003 -
2004 -       return drv_set_ringparam(local, tx, rx);
2005 -}
2006 -
2007 -static void ieee80211_get_ringparam(struct wiphy *wiphy,
2008 -                                   u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max)
2009 -{
2010 -       struct ieee80211_local *local = wiphy_priv(wiphy);
2011 -
2012 -       drv_get_ringparam(local, tx, tx_max, rx, rx_max);
2013 -}
2014 -
2015  static int ieee80211_set_rekey_data(struct wiphy *wiphy,
2016                                     struct net_device *dev,
2017                                     struct cfg80211_gtk_rekey_data *data)
2018 @@ -3844,8 +3529,6 @@ const struct cfg80211_ops mac80211_confi
2019         .mgmt_frame_register = ieee80211_mgmt_frame_register,
2020         .set_antenna = ieee80211_set_antenna,
2021         .get_antenna = ieee80211_get_antenna,
2022 -       .set_ringparam = ieee80211_set_ringparam,
2023 -       .get_ringparam = ieee80211_get_ringparam,
2024         .set_rekey_data = ieee80211_set_rekey_data,
2025         .tdls_oper = ieee80211_tdls_oper,
2026         .tdls_mgmt = ieee80211_tdls_mgmt,
2027 @@ -3854,9 +3537,6 @@ const struct cfg80211_ops mac80211_confi
2028  #ifdef CONFIG_PM
2029         .set_wakeup = ieee80211_set_wakeup,
2030  #endif
2031 -       .get_et_sset_count = ieee80211_get_et_sset_count,
2032 -       .get_et_stats = ieee80211_get_et_stats,
2033 -       .get_et_strings = ieee80211_get_et_strings,
2034         .get_channel = ieee80211_cfg_get_channel,
2035         .start_radar_detection = ieee80211_start_radar_detection,
2036         .channel_switch = ieee80211_channel_switch,
2037 --- a/net/mac80211/debugfs_sta.c
2038 +++ b/net/mac80211/debugfs_sta.c
2039 @@ -587,7 +587,6 @@ void ieee80211_sta_debugfs_add(struct st
2040         DEBUGFS_ADD_COUNTER(tx_filtered, tx_filtered_count);
2041         DEBUGFS_ADD_COUNTER(tx_retry_failed, tx_retry_failed);
2042         DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
2043 -       DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
2044  
2045         if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
2046                 debugfs_create_x32("driver_buffered_tids", 0400,
2047 --- a/net/mac80211/wep.c
2048 +++ b/net/mac80211/wep.c
2049 @@ -271,22 +271,6 @@ static int ieee80211_wep_decrypt(struct 
2050         return ret;
2051  }
2052  
2053 -
2054 -static bool ieee80211_wep_is_weak_iv(struct sk_buff *skb,
2055 -                                    struct ieee80211_key *key)
2056 -{
2057 -       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2058 -       unsigned int hdrlen;
2059 -       u8 *ivpos;
2060 -       u32 iv;
2061 -
2062 -       hdrlen = ieee80211_hdrlen(hdr->frame_control);
2063 -       ivpos = skb->data + hdrlen;
2064 -       iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
2065 -
2066 -       return ieee80211_wep_weak_iv(iv, key->conf.keylen);
2067 -}
2068 -
2069  ieee80211_rx_result
2070  ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
2071  {
2072 @@ -301,16 +285,12 @@ ieee80211_crypto_wep_decrypt(struct ieee
2073         if (!(status->flag & RX_FLAG_DECRYPTED)) {
2074                 if (skb_linearize(rx->skb))
2075                         return RX_DROP_UNUSABLE;
2076 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2077 -                       rx->sta->wep_weak_iv_count++;
2078                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
2079                         return RX_DROP_UNUSABLE;
2080         } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
2081                 if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) +
2082                                             IEEE80211_WEP_IV_LEN))
2083                         return RX_DROP_UNUSABLE;
2084 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2085 -                       rx->sta->wep_weak_iv_count++;
2086                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
2087                 /* remove ICV */
2088                 if (pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN))
2089 --- a/include/net/cfg80211.h
2090 +++ b/include/net/cfg80211.h
2091 @@ -2278,16 +2278,6 @@ struct cfg80211_qos_map {
2092   *
2093   * @set_noack_map: Set the NoAck Map for the TIDs.
2094   *
2095 - * @get_et_sset_count:  Ethtool API to get string-set count.
2096 - *     See @ethtool_ops.get_sset_count
2097 - *
2098 - * @get_et_stats:  Ethtool API to get a set of u64 stats.
2099 - *     See @ethtool_ops.get_ethtool_stats
2100 - *
2101 - * @get_et_strings:  Ethtool API to get a set of strings to describe stats
2102 - *     and perhaps other supported types of ethtool data-sets.
2103 - *     See @ethtool_ops.get_strings
2104 - *
2105   * @get_channel: Get the current operating channel for the virtual interface.
2106   *     For monitor interfaces, it should return %NULL unless there's a single
2107   *     current monitoring channel.
2108 @@ -2529,13 +2519,6 @@ struct cfg80211_ops {
2109                                   struct net_device *dev,
2110                                   u16 noack_map);
2111  
2112 -       int     (*get_et_sset_count)(struct wiphy *wiphy,
2113 -                                    struct net_device *dev, int sset);
2114 -       void    (*get_et_stats)(struct wiphy *wiphy, struct net_device *dev,
2115 -                               struct ethtool_stats *stats, u64 *data);
2116 -       void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
2117 -                                 u32 sset, u8 *data);
2118 -
2119         int     (*get_channel)(struct wiphy *wiphy,
2120                                struct wireless_dev *wdev,
2121                                struct cfg80211_chan_def *chandef);
2122 @@ -4846,6 +4829,10 @@ void cfg80211_stop_iface(struct wiphy *w
2123   */
2124  void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
2125  
2126 +
2127 +/* ethtool helper */
2128 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info);
2129 +
2130  /* Logging, debugging and troubleshooting/diagnostic helpers. */
2131  
2132  /* wiphy_printk helpers, similar to dev_printk */
2133 --- a/net/mac80211/Makefile
2134 +++ b/net/mac80211/Makefile
2135 @@ -17,6 +17,7 @@ mac80211-y := \
2136         aes_ccm.o \
2137         aes_cmac.o \
2138         cfg.o \
2139 +       ethtool.o \
2140         rx.o \
2141         spectmgmt.o \
2142         tx.o \
2143 --- a/net/mac80211/ieee80211_i.h
2144 +++ b/net/mac80211/ieee80211_i.h
2145 @@ -229,16 +229,29 @@ struct ieee80211_rx_data {
2146         u16 tkip_iv16;
2147  };
2148  
2149 +struct ieee80211_csa_settings {
2150 +       const u16 *counter_offsets_beacon;
2151 +       const u16 *counter_offsets_presp;
2152 +
2153 +       int n_counter_offsets_beacon;
2154 +       int n_counter_offsets_presp;
2155 +
2156 +       u8 count;
2157 +};
2158 +
2159  struct beacon_data {
2160         u8 *head, *tail;
2161         int head_len, tail_len;
2162         struct ieee80211_meshconf_ie *meshconf;
2163 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2164 +       u8 csa_current_counter;
2165         struct rcu_head rcu_head;
2166  };
2167  
2168  struct probe_resp {
2169         struct rcu_head rcu_head;
2170         int len;
2171 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2172         u8 data[0];
2173  };
2174  
2175 @@ -754,8 +767,6 @@ struct ieee80211_sub_if_data {
2176         struct mac80211_qos_map __rcu *qos_map;
2177  
2178         struct work_struct csa_finalize_work;
2179 -       u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM];
2180 -       u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM];
2181         bool csa_radar_required;
2182         bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
2183         struct cfg80211_chan_def csa_chandef;
2184 @@ -767,7 +778,6 @@ struct ieee80211_sub_if_data {
2185         struct ieee80211_chanctx *reserved_chanctx;
2186         struct cfg80211_chan_def reserved_chandef;
2187         bool reserved_radar_required;
2188 -       u8 csa_current_counter;
2189  
2190         /* used to reconfigure hardware SM PS */
2191         struct work_struct recalc_smps;
2192 @@ -1850,6 +1860,8 @@ int ieee80211_tdls_oper(struct wiphy *wi
2193                         const u8 *peer, enum nl80211_tdls_operation oper);
2194  
2195  
2196 +extern const struct ethtool_ops ieee80211_ethtool_ops;
2197 +
2198  #ifdef CPTCFG_MAC80211_NOINLINE
2199  #define debug_noinline noinline
2200  #else
2201 --- a/net/mac80211/iface.c
2202 +++ b/net/mac80211/iface.c
2203 @@ -399,6 +399,7 @@ int ieee80211_add_virtual_monitor(struct
2204         sdata->vif.type = NL80211_IFTYPE_MONITOR;
2205         snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
2206                  wiphy_name(local->hw.wiphy));
2207 +       sdata->wdev.iftype = NL80211_IFTYPE_MONITOR;
2208  
2209         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2210  
2211 @@ -1303,6 +1304,7 @@ static void ieee80211_setup_sdata(struct
2212         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
2213         sdata->control_port_no_encrypt = false;
2214         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2215 +       sdata->vif.bss_conf.idle = true;
2216  
2217         sdata->noack_map = 0;
2218  
2219 @@ -1721,6 +1723,8 @@ int ieee80211_if_add(struct ieee80211_lo
2220  
2221                 ndev->features |= local->hw.netdev_features;
2222  
2223 +               netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
2224 +
2225                 ret = register_netdevice(ndev);
2226                 if (ret) {
2227                         free_netdev(ndev);
2228 --- a/net/wireless/core.c
2229 +++ b/net/wireless/core.c
2230 @@ -25,7 +25,6 @@
2231  #include "sysfs.h"
2232  #include "debugfs.h"
2233  #include "wext-compat.h"
2234 -#include "ethtool.h"
2235  #include "rdev-ops.h"
2236  
2237  /* name for sysfs, %d is appended */
2238 @@ -940,8 +939,6 @@ static int cfg80211_netdev_notifier_call
2239                 /* allow mac80211 to determine the timeout */
2240                 wdev->ps_timeout = -1;
2241  
2242 -               netdev_set_default_ethtool_ops(dev, &cfg80211_ethtool_ops);
2243 -
2244                 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
2245                      wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
2246                      wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
2247 --- a/net/wireless/ethtool.c
2248 +++ b/net/wireless/ethtool.c
2249 @@ -1,11 +1,9 @@
2250  #include <linux/utsname.h>
2251  #include <net/cfg80211.h>
2252  #include "core.h"
2253 -#include "ethtool.h"
2254  #include "rdev-ops.h"
2255  
2256 -static void cfg80211_get_drvinfo(struct net_device *dev,
2257 -                                       struct ethtool_drvinfo *info)
2258 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
2259  {
2260         struct wireless_dev *wdev = dev->ieee80211_ptr;
2261  
2262 @@ -23,84 +21,4 @@ static void cfg80211_get_drvinfo(struct 
2263         strlcpy(info->bus_info, dev_name(wiphy_dev(wdev->wiphy)),
2264                 sizeof(info->bus_info));
2265  }
2266 -
2267 -static int cfg80211_get_regs_len(struct net_device *dev)
2268 -{
2269 -       /* For now, return 0... */
2270 -       return 0;
2271 -}
2272 -
2273 -static void cfg80211_get_regs(struct net_device *dev, struct ethtool_regs *regs,
2274 -                       void *data)
2275 -{
2276 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2277 -
2278 -       regs->version = wdev->wiphy->hw_version;
2279 -       regs->len = 0;
2280 -}
2281 -
2282 -static void cfg80211_get_ringparam(struct net_device *dev,
2283 -                                  struct ethtool_ringparam *rp)
2284 -{
2285 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2286 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2287 -
2288 -       memset(rp, 0, sizeof(*rp));
2289 -
2290 -       if (rdev->ops->get_ringparam)
2291 -               rdev_get_ringparam(rdev, &rp->tx_pending, &rp->tx_max_pending,
2292 -                                  &rp->rx_pending, &rp->rx_max_pending);
2293 -}
2294 -
2295 -static int cfg80211_set_ringparam(struct net_device *dev,
2296 -                                 struct ethtool_ringparam *rp)
2297 -{
2298 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2299 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2300 -
2301 -       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2302 -               return -EINVAL;
2303 -
2304 -       if (rdev->ops->set_ringparam)
2305 -               return rdev_set_ringparam(rdev, rp->tx_pending, rp->rx_pending);
2306 -
2307 -       return -ENOTSUPP;
2308 -}
2309 -
2310 -static int cfg80211_get_sset_count(struct net_device *dev, int sset)
2311 -{
2312 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2313 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2314 -       if (rdev->ops->get_et_sset_count)
2315 -               return rdev_get_et_sset_count(rdev, dev, sset);
2316 -       return -EOPNOTSUPP;
2317 -}
2318 -
2319 -static void cfg80211_get_stats(struct net_device *dev,
2320 -                              struct ethtool_stats *stats, u64 *data)
2321 -{
2322 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2323 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2324 -       if (rdev->ops->get_et_stats)
2325 -               rdev_get_et_stats(rdev, dev, stats, data);
2326 -}
2327 -
2328 -static void cfg80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
2329 -{
2330 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2331 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2332 -       if (rdev->ops->get_et_strings)
2333 -               rdev_get_et_strings(rdev, dev, sset, data);
2334 -}
2335 -
2336 -const struct ethtool_ops cfg80211_ethtool_ops = {
2337 -       .get_drvinfo = cfg80211_get_drvinfo,
2338 -       .get_regs_len = cfg80211_get_regs_len,
2339 -       .get_regs = cfg80211_get_regs,
2340 -       .get_link = ethtool_op_get_link,
2341 -       .get_ringparam = cfg80211_get_ringparam,
2342 -       .set_ringparam = cfg80211_set_ringparam,
2343 -       .get_strings = cfg80211_get_strings,
2344 -       .get_ethtool_stats = cfg80211_get_stats,
2345 -       .get_sset_count = cfg80211_get_sset_count,
2346 -};
2347 +EXPORT_SYMBOL(cfg80211_get_drvinfo);
2348 --- a/net/wireless/ethtool.h
2349 +++ /dev/null
2350 @@ -1,6 +0,0 @@
2351 -#ifndef __CFG80211_ETHTOOL__
2352 -#define __CFG80211_ETHTOOL__
2353 -
2354 -extern const struct ethtool_ops cfg80211_ethtool_ops;
2355 -
2356 -#endif /* __CFG80211_ETHTOOL__ */
2357 --- a/net/wireless/rdev-ops.h
2358 +++ b/net/wireless/rdev-ops.h
2359 @@ -714,25 +714,6 @@ static inline int rdev_get_antenna(struc
2360         return ret;
2361  }
2362  
2363 -static inline int rdev_set_ringparam(struct cfg80211_registered_device *rdev,
2364 -                                    u32 tx, u32 rx)
2365 -{
2366 -       int ret;
2367 -       trace_rdev_set_ringparam(&rdev->wiphy, tx, rx);
2368 -       ret = rdev->ops->set_ringparam(&rdev->wiphy, tx, rx);
2369 -       trace_rdev_return_int(&rdev->wiphy, ret);
2370 -       return ret;
2371 -}
2372 -
2373 -static inline void rdev_get_ringparam(struct cfg80211_registered_device *rdev,
2374 -                                     u32 *tx, u32 *tx_max, u32 *rx,
2375 -                                     u32 *rx_max)
2376 -{
2377 -       trace_rdev_get_ringparam(&rdev->wiphy);
2378 -       rdev->ops->get_ringparam(&rdev->wiphy, tx, tx_max, rx, rx_max);
2379 -       trace_rdev_return_void_tx_rx(&rdev->wiphy, *tx, *tx_max, *rx, *rx_max);
2380 -}
2381 -
2382  static inline int
2383  rdev_sched_scan_start(struct cfg80211_registered_device *rdev,
2384                       struct net_device *dev,
2385 @@ -816,35 +797,6 @@ static inline int rdev_set_noack_map(str
2386  }
2387  
2388  static inline int
2389 -rdev_get_et_sset_count(struct cfg80211_registered_device *rdev,
2390 -                      struct net_device *dev, int sset)
2391 -{
2392 -       int ret;
2393 -       trace_rdev_get_et_sset_count(&rdev->wiphy, dev, sset);
2394 -       ret = rdev->ops->get_et_sset_count(&rdev->wiphy, dev, sset);
2395 -       trace_rdev_return_int(&rdev->wiphy, ret);
2396 -       return ret;
2397 -}
2398 -
2399 -static inline void rdev_get_et_stats(struct cfg80211_registered_device *rdev,
2400 -                                    struct net_device *dev,
2401 -                                    struct ethtool_stats *stats, u64 *data)
2402 -{
2403 -       trace_rdev_get_et_stats(&rdev->wiphy, dev);
2404 -       rdev->ops->get_et_stats(&rdev->wiphy, dev, stats, data);
2405 -       trace_rdev_return_void(&rdev->wiphy);
2406 -}
2407 -
2408 -static inline void rdev_get_et_strings(struct cfg80211_registered_device *rdev,
2409 -                                      struct net_device *dev, u32 sset,
2410 -                                      u8 *data)
2411 -{
2412 -       trace_rdev_get_et_strings(&rdev->wiphy, dev, sset);
2413 -       rdev->ops->get_et_strings(&rdev->wiphy, dev, sset, data);
2414 -       trace_rdev_return_void(&rdev->wiphy);
2415 -}
2416 -
2417 -static inline int
2418  rdev_get_channel(struct cfg80211_registered_device *rdev,
2419                  struct wireless_dev *wdev,
2420                  struct cfg80211_chan_def *chandef)
2421 --- a/net/wireless/trace.h
2422 +++ b/net/wireless/trace.h
2423 @@ -298,11 +298,6 @@ DEFINE_EVENT(wiphy_only_evt, rdev_return
2424         TP_ARGS(wiphy)
2425  );
2426  
2427 -DEFINE_EVENT(wiphy_only_evt, rdev_get_ringparam,
2428 -       TP_PROTO(struct wiphy *wiphy),
2429 -       TP_ARGS(wiphy)
2430 -);
2431 -
2432  DEFINE_EVENT(wiphy_only_evt, rdev_get_antenna,
2433         TP_PROTO(struct wiphy *wiphy),
2434         TP_ARGS(wiphy)
2435 @@ -580,11 +575,6 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_stop
2436         TP_ARGS(wiphy, netdev)
2437  );
2438  
2439 -DEFINE_EVENT(wiphy_netdev_evt, rdev_get_et_stats,
2440 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2441 -       TP_ARGS(wiphy, netdev)
2442 -);
2443 -
2444  DEFINE_EVENT(wiphy_netdev_evt, rdev_sched_scan_stop,
2445         TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2446         TP_ARGS(wiphy, netdev)
2447 @@ -1439,11 +1429,6 @@ DECLARE_EVENT_CLASS(tx_rx_evt,
2448                   WIPHY_PR_ARG, __entry->tx, __entry->rx)
2449  );
2450  
2451 -DEFINE_EVENT(tx_rx_evt, rdev_set_ringparam,
2452 -       TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2453 -       TP_ARGS(wiphy, rx, tx)
2454 -);
2455 -
2456  DEFINE_EVENT(tx_rx_evt, rdev_set_antenna,
2457         TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2458         TP_ARGS(wiphy, rx, tx)
2459 @@ -1725,40 +1710,6 @@ TRACE_EVENT(rdev_set_noack_map,
2460                   WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->noack_map)
2461  );
2462  
2463 -TRACE_EVENT(rdev_get_et_sset_count,
2464 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int sset),
2465 -       TP_ARGS(wiphy, netdev, sset),
2466 -       TP_STRUCT__entry(
2467 -               WIPHY_ENTRY
2468 -               NETDEV_ENTRY
2469 -               __field(int, sset)
2470 -       ),
2471 -       TP_fast_assign(
2472 -               WIPHY_ASSIGN;
2473 -               NETDEV_ASSIGN;
2474 -               __entry->sset = sset;
2475 -       ),
2476 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %d",
2477 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2478 -);
2479 -
2480 -TRACE_EVENT(rdev_get_et_strings,
2481 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u32 sset),
2482 -       TP_ARGS(wiphy, netdev, sset),
2483 -       TP_STRUCT__entry(
2484 -               WIPHY_ENTRY
2485 -               NETDEV_ENTRY
2486 -               __field(u32, sset)
2487 -       ),
2488 -       TP_fast_assign(
2489 -               WIPHY_ASSIGN;
2490 -               NETDEV_ASSIGN;
2491 -               __entry->sset = sset;
2492 -       ),
2493 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %u",
2494 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2495 -);
2496 -
2497  DEFINE_EVENT(wiphy_wdev_evt, rdev_get_channel,
2498         TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
2499         TP_ARGS(wiphy, wdev)
2500 --- /dev/null
2501 +++ b/net/mac80211/ethtool.c
2502 @@ -0,0 +1,244 @@
2503 +/*
2504 + * mac80211 ethtool hooks for cfg80211
2505 + *
2506 + * Copied from cfg.c - originally
2507 + * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
2508 + * Copyright 2014      Intel Corporation (Author: Johannes Berg)
2509 + *
2510 + * This file is GPLv2 as found in COPYING.
2511 + */
2512 +#include <linux/types.h>
2513 +#include <net/cfg80211.h>
2514 +#include "ieee80211_i.h"
2515 +#include "sta_info.h"
2516 +#include "driver-ops.h"
2517 +
2518 +static int ieee80211_set_ringparam(struct net_device *dev,
2519 +                                  struct ethtool_ringparam *rp)
2520 +{
2521 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2522 +
2523 +       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2524 +               return -EINVAL;
2525 +
2526 +       return drv_set_ringparam(local, rp->tx_pending, rp->rx_pending);
2527 +}
2528 +
2529 +static void ieee80211_get_ringparam(struct net_device *dev,
2530 +                                   struct ethtool_ringparam *rp)
2531 +{
2532 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2533 +
2534 +       memset(rp, 0, sizeof(*rp));
2535 +
2536 +       drv_get_ringparam(local, &rp->tx_pending, &rp->tx_max_pending,
2537 +                         &rp->rx_pending, &rp->rx_max_pending);
2538 +}
2539 +
2540 +static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
2541 +       "rx_packets", "rx_bytes",
2542 +       "rx_duplicates", "rx_fragments", "rx_dropped",
2543 +       "tx_packets", "tx_bytes", "tx_fragments",
2544 +       "tx_filtered", "tx_retry_failed", "tx_retries",
2545 +       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
2546 +       "channel", "noise", "ch_time", "ch_time_busy",
2547 +       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
2548 +};
2549 +#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
2550 +
2551 +static int ieee80211_get_sset_count(struct net_device *dev, int sset)
2552 +{
2553 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2554 +       int rv = 0;
2555 +
2556 +       if (sset == ETH_SS_STATS)
2557 +               rv += STA_STATS_LEN;
2558 +
2559 +       rv += drv_get_et_sset_count(sdata, sset);
2560 +
2561 +       if (rv == 0)
2562 +               return -EOPNOTSUPP;
2563 +       return rv;
2564 +}
2565 +
2566 +static void ieee80211_get_stats(struct net_device *dev,
2567 +                               struct ethtool_stats *stats,
2568 +                               u64 *data)
2569 +{
2570 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2571 +       struct ieee80211_chanctx_conf *chanctx_conf;
2572 +       struct ieee80211_channel *channel;
2573 +       struct sta_info *sta;
2574 +       struct ieee80211_local *local = sdata->local;
2575 +       struct station_info sinfo;
2576 +       struct survey_info survey;
2577 +       int i, q;
2578 +#define STA_STATS_SURVEY_LEN 7
2579 +
2580 +       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
2581 +
2582 +#define ADD_STA_STATS(sta)                             \
2583 +       do {                                            \
2584 +               data[i++] += sta->rx_packets;           \
2585 +               data[i++] += sta->rx_bytes;             \
2586 +               data[i++] += sta->num_duplicates;       \
2587 +               data[i++] += sta->rx_fragments;         \
2588 +               data[i++] += sta->rx_dropped;           \
2589 +                                                       \
2590 +               data[i++] += sinfo.tx_packets;          \
2591 +               data[i++] += sinfo.tx_bytes;            \
2592 +               data[i++] += sta->tx_fragments;         \
2593 +               data[i++] += sta->tx_filtered_count;    \
2594 +               data[i++] += sta->tx_retry_failed;      \
2595 +               data[i++] += sta->tx_retry_count;       \
2596 +               data[i++] += sta->beacon_loss_count;    \
2597 +       } while (0)
2598 +
2599 +       /* For Managed stations, find the single station based on BSSID
2600 +        * and use that.  For interface types, iterate through all available
2601 +        * stations and add stats for any station that is assigned to this
2602 +        * network device.
2603 +        */
2604 +
2605 +       mutex_lock(&local->sta_mtx);
2606 +
2607 +       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2608 +               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
2609 +
2610 +               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
2611 +                       goto do_survey;
2612 +
2613 +               sinfo.filled = 0;
2614 +               sta_set_sinfo(sta, &sinfo);
2615 +
2616 +               i = 0;
2617 +               ADD_STA_STATS(sta);
2618 +
2619 +               data[i++] = sta->sta_state;
2620 +
2621 +
2622 +               if (sinfo.filled & STATION_INFO_TX_BITRATE)
2623 +                       data[i] = 100000 *
2624 +                               cfg80211_calculate_bitrate(&sinfo.txrate);
2625 +               i++;
2626 +               if (sinfo.filled & STATION_INFO_RX_BITRATE)
2627 +                       data[i] = 100000 *
2628 +                               cfg80211_calculate_bitrate(&sinfo.rxrate);
2629 +               i++;
2630 +
2631 +               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
2632 +                       data[i] = (u8)sinfo.signal_avg;
2633 +               i++;
2634 +       } else {
2635 +               list_for_each_entry(sta, &local->sta_list, list) {
2636 +                       /* Make sure this station belongs to the proper dev */
2637 +                       if (sta->sdata->dev != dev)
2638 +                               continue;
2639 +
2640 +                       sinfo.filled = 0;
2641 +                       sta_set_sinfo(sta, &sinfo);
2642 +                       i = 0;
2643 +                       ADD_STA_STATS(sta);
2644 +               }
2645 +       }
2646 +
2647 +do_survey:
2648 +       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
2649 +       /* Get survey stats for current channel */
2650 +       survey.filled = 0;
2651 +
2652 +       rcu_read_lock();
2653 +       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2654 +       if (chanctx_conf)
2655 +               channel = chanctx_conf->def.chan;
2656 +       else
2657 +               channel = NULL;
2658 +       rcu_read_unlock();
2659 +
2660 +       if (channel) {
2661 +               q = 0;
2662 +               do {
2663 +                       survey.filled = 0;
2664 +                       if (drv_get_survey(local, q, &survey) != 0) {
2665 +                               survey.filled = 0;
2666 +                               break;
2667 +                       }
2668 +                       q++;
2669 +               } while (channel != survey.channel);
2670 +       }
2671 +
2672 +       if (survey.filled)
2673 +               data[i++] = survey.channel->center_freq;
2674 +       else
2675 +               data[i++] = 0;
2676 +       if (survey.filled & SURVEY_INFO_NOISE_DBM)
2677 +               data[i++] = (u8)survey.noise;
2678 +       else
2679 +               data[i++] = -1LL;
2680 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
2681 +               data[i++] = survey.channel_time;
2682 +       else
2683 +               data[i++] = -1LL;
2684 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
2685 +               data[i++] = survey.channel_time_busy;
2686 +       else
2687 +               data[i++] = -1LL;
2688 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
2689 +               data[i++] = survey.channel_time_ext_busy;
2690 +       else
2691 +               data[i++] = -1LL;
2692 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
2693 +               data[i++] = survey.channel_time_rx;
2694 +       else
2695 +               data[i++] = -1LL;
2696 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
2697 +               data[i++] = survey.channel_time_tx;
2698 +       else
2699 +               data[i++] = -1LL;
2700 +
2701 +       mutex_unlock(&local->sta_mtx);
2702 +
2703 +       if (WARN_ON(i != STA_STATS_LEN))
2704 +               return;
2705 +
2706 +       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
2707 +}
2708 +
2709 +static void ieee80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
2710 +{
2711 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2712 +       int sz_sta_stats = 0;
2713 +
2714 +       if (sset == ETH_SS_STATS) {
2715 +               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
2716 +               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
2717 +       }
2718 +       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
2719 +}
2720 +
2721 +static int ieee80211_get_regs_len(struct net_device *dev)
2722 +{
2723 +       return 0;
2724 +}
2725 +
2726 +static void ieee80211_get_regs(struct net_device *dev,
2727 +                              struct ethtool_regs *regs,
2728 +                              void *data)
2729 +{
2730 +       struct wireless_dev *wdev = dev->ieee80211_ptr;
2731 +
2732 +       regs->version = wdev->wiphy->hw_version;
2733 +       regs->len = 0;
2734 +}
2735 +
2736 +const struct ethtool_ops ieee80211_ethtool_ops = {
2737 +       .get_drvinfo = cfg80211_get_drvinfo,
2738 +       .get_regs_len = ieee80211_get_regs_len,
2739 +       .get_regs = ieee80211_get_regs,
2740 +       .get_link = ethtool_op_get_link,
2741 +       .get_ringparam = ieee80211_get_ringparam,
2742 +       .set_ringparam = ieee80211_set_ringparam,
2743 +       .get_strings = ieee80211_get_strings,
2744 +       .get_ethtool_stats = ieee80211_get_stats,
2745 +       .get_sset_count = ieee80211_get_sset_count,
2746 +};
2747 --- a/net/mac80211/ibss.c
2748 +++ b/net/mac80211/ibss.c
2749 @@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80
2750                 *pos++ = csa_settings->block_tx ? 1 : 0;
2751                 *pos++ = ieee80211_frequency_to_channel(
2752                                 csa_settings->chandef.chan->center_freq);
2753 -               sdata->csa_counter_offset_beacon[0] = (pos - presp->head);
2754 +               presp->csa_counter_offsets[0] = (pos - presp->head);
2755                 *pos++ = csa_settings->count;
2756         }
2757  
2758 @@ -1677,6 +1677,7 @@ int ieee80211_ibss_join(struct ieee80211
2759         sdata->u.ibss.control_port = params->control_port;
2760         sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
2761         sdata->u.ibss.basic_rates = params->basic_rates;
2762 +       sdata->u.ibss.last_scan_completed = jiffies;
2763  
2764         /* fix basic_rates if channel does not support these rates */
2765         rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
2766 --- a/net/mac80211/mesh.c
2767 +++ b/net/mac80211/mesh.c
2768 @@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee8
2769                 *pos++ = 0x0;
2770                 *pos++ = ieee80211_frequency_to_channel(
2771                                 csa->settings.chandef.chan->center_freq);
2772 -               sdata->csa_counter_offset_beacon[0] = hdr_len + 6;
2773 +               bcn->csa_counter_offsets[0] = hdr_len + 6;
2774                 *pos++ = csa->settings.count;
2775                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
2776                 *pos++ = 6;
2777 --- a/net/wireless/genregdb.awk
2778 +++ b/net/wireless/genregdb.awk
2779 @@ -65,17 +65,7 @@ function parse_reg_rule()
2780         sub(/,/, "", units)
2781         dfs_cac = $9
2782         if (units == "mW") {
2783 -               if (power == 100) {
2784 -                       power = 20
2785 -               } else if (power == 200) {
2786 -                       power = 23
2787 -               } else if (power == 500) {
2788 -                       power = 27
2789 -               } else if (power == 1000) {
2790 -                       power = 30
2791 -               } else {
2792 -                       print "Unknown power value in database!"
2793 -               }
2794 +               power = 10 * log(power)/log(10)
2795         } else {
2796                 dfs_cac = $8
2797         }
2798 @@ -114,7 +104,7 @@ function parse_reg_rule()
2799  
2800         }
2801         flags = flags "0"
2802 -       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
2803 +       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %.0f, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
2804         rules++
2805  }
2806  
2807 --- a/net/mac80211/debugfs_netdev.c
2808 +++ b/net/mac80211/debugfs_netdev.c
2809 @@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
2810         ssize_t ret = -EINVAL;
2811  
2812         read_lock(&dev_base_lock);
2813 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
2814 -               ret = (*format)(sdata, buf, sizeof(buf));
2815 +       ret = (*format)(sdata, buf, sizeof(buf));
2816         read_unlock(&dev_base_lock);
2817  
2818         if (ret >= 0)
2819 @@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
2820  
2821         ret = -ENODEV;
2822         rtnl_lock();
2823 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
2824 -               ret = (*write)(sdata, buf, count);
2825 +       ret = (*write)(sdata, buf, count);
2826         rtnl_unlock();
2827  
2828         return ret;
2829 --- a/drivers/net/wireless/b43/xmit.c
2830 +++ b/drivers/net/wireless/b43/xmit.c
2831 @@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struc
2832                 break;
2833         case B43_PHYTYPE_G:
2834                 status.band = IEEE80211_BAND_2GHZ;
2835 -               /* chanid is the radio channel cookie value as used
2836 -                * to tune the radio. */
2837 -               status.freq = chanid + 2400;
2838 +               /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
2839 +                * has been modified to be compatible with N-PHY and others.
2840 +                */
2841 +               if (dev->fw.rev >= 508)
2842 +                       status.freq = ieee80211_channel_to_frequency(chanid, status.band);
2843 +               else
2844 +                       status.freq = chanid + 2400;
2845                 break;
2846         case B43_PHYTYPE_N:
2847         case B43_PHYTYPE_LP:
2848 --- a/drivers/net/wireless/b43/main.c
2849 +++ b/drivers/net/wireless/b43/main.c
2850 @@ -5216,6 +5216,7 @@ static int b43_wireless_core_attach(stru
2851         /* We don't support 5 GHz on some PHYs yet */
2852         switch (dev->phy.type) {
2853         case B43_PHYTYPE_A:
2854 +       case B43_PHYTYPE_G:
2855         case B43_PHYTYPE_N:
2856         case B43_PHYTYPE_LP:
2857         case B43_PHYTYPE_HT: