package/kernel/mac80211/patches/300-pending_work.patch

   1 --- a/net/mac80211/agg-rx.c
   2 +++ b/net/mac80211/agg-rx.c
   3 @@ -204,6 +204,8 @@ static void ieee80211_send_addba_resp(st
   4                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
   5         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
   6                 memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
   7 +       else if (sdata->vif.type == NL80211_IFTYPE_WDS)
   8 +               memcpy(mgmt->bssid, da, ETH_ALEN);
   9
  10         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  11                                           IEEE80211_STYPE_ACTION);
  12 --- a/net/mac80211/agg-tx.c
  13 +++ b/net/mac80211/agg-tx.c
  14 @@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
  15         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  16         if (sdata->vif.type == NL80211_IFTYPE_AP ||
  17             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  18 -           sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  19 +           sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
  20 +           sdata->vif.type == NL80211_IFTYPE_WDS)
  21                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  22         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  23                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  24 @@ -527,6 +528,7 @@ int ieee80211_start_tx_ba_session(struct
  25             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  26             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  27             sdata->vif.type != NL80211_IFTYPE_AP &&
  28 +           sdata->vif.type != NL80211_IFTYPE_WDS &&
  29             sdata->vif.type != NL80211_IFTYPE_ADHOC)
  30                 return -EINVAL;
  31
  32 --- a/net/mac80211/debugfs_sta.c
  33 +++ b/net/mac80211/debugfs_sta.c
  34 @@ -66,11 +66,11 @@ static ssize_t sta_flags_read(struct fil
  35         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  36
  37         int res = scnprintf(buf, sizeof(buf),
  38 -                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  39 +                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  40                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
  41                             TEST(PS_DRIVER), TEST(AUTHORIZED),
  42                             TEST(SHORT_PREAMBLE),
  43 -                           TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
  44 +                           TEST(WME), TEST(CLEAR_PS_FILT),
  45                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  46                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  47                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
  48 @@ -455,6 +455,15 @@ void ieee80211_sta_debugfs_add(struct st
  49         DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
  50         DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
  51
  52 +       if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
  53 +               debugfs_create_x32("driver_buffered_tids", 0400,
  54 +                                  sta->debugfs.dir,
  55 +                                  (u32 *)&sta->driver_buffered_tids);
  56 +       else
  57 +               debugfs_create_x64("driver_buffered_tids", 0400,
  58 +                                  sta->debugfs.dir,
  59 +                                  (u64 *)&sta->driver_buffered_tids);
  60 +
  61         drv_sta_add_debugfs(local, sdata, &sta->sta, sta->debugfs.dir);
  62  }
  63
  64 --- a/net/mac80211/iface.c
  65 +++ b/net/mac80211/iface.c
  66 @@ -274,6 +274,12 @@ static int ieee80211_check_concurrent_if
  67                         if (iftype == NL80211_IFTYPE_ADHOC &&
  68                             nsdata->vif.type == NL80211_IFTYPE_ADHOC)
  69                                 return -EBUSY;
  70 +                       /*
  71 +                        * will not add another interface while any channel
  72 +                        * switch is active.
  73 +                        */
  74 +                       if (nsdata->vif.csa_active)
  75 +                               return -EBUSY;
  76
  77                         /*
  78                          * The remaining checks are only performed for interfaces
  79 @@ -463,7 +469,6 @@ int ieee80211_do_open(struct wireless_de
  80         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  81         struct net_device *dev = wdev->netdev;
  82         struct ieee80211_local *local = sdata->local;
  83 -       struct sta_info *sta;
  84         u32 changed = 0;
  85         int res;
  86         u32 hw_reconf_flags = 0;
  87 @@ -629,30 +634,8 @@ int ieee80211_do_open(struct wireless_de
  88
  89         set_bit(SDATA_STATE_RUNNING, &sdata->state);
  90
  91 -       if (sdata->vif.type == NL80211_IFTYPE_WDS) {
  92 -               /* Create STA entry for the WDS peer */
  93 -               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
  94 -                                    GFP_KERNEL);
  95 -               if (!sta) {
  96 -                       res = -ENOMEM;
  97 -                       goto err_del_interface;
  98 -               }
  99 -
 100 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 101 -               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 102 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 103 -
 104 -               res = sta_info_insert(sta);
 105 -               if (res) {
 106 -                       /* STA has been freed */
 107 -                       goto err_del_interface;
 108 -               }
 109 -
 110 -               rate_control_rate_init(sta);
 111 -               netif_carrier_on(dev);
 112 -       } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
 113 +       if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 114                 rcu_assign_pointer(local->p2p_sdata, sdata);
 115 -       }
 116
 117         /*
 118          * set_multicast_list will be invoked by the networking core
 119 @@ -809,6 +792,8 @@ static void ieee80211_do_stop(struct iee
 120         cancel_work_sync(&local->dynamic_ps_enable_work);
 121
 122         cancel_work_sync(&sdata->recalc_smps);
 123 +       sdata->vif.csa_active = false;
 124 +       cancel_work_sync(&sdata->csa_finalize_work);
 125
 126         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
 127
 128 @@ -1116,6 +1101,74 @@ static void ieee80211_if_setup(struct ne
 129         dev->destructor = free_netdev;
 130  }
 131
 132 +static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 133 +                                        struct sk_buff *skb)
 134 +{
 135 +       struct ieee80211_local *local = sdata->local;
 136 +       struct ieee80211_rx_status *rx_status;
 137 +       struct ieee802_11_elems elems;
 138 +       struct ieee80211_mgmt *mgmt;
 139 +       struct sta_info *sta;
 140 +       size_t baselen;
 141 +       u32 rates = 0;
 142 +       u16 stype;
 143 +       bool new = false;
 144 +       enum ieee80211_band band;
 145 +       struct ieee80211_supported_band *sband;
 146 +
 147 +       rx_status = IEEE80211_SKB_RXCB(skb);
 148 +       band = rx_status->band;
 149 +       sband = local->hw.wiphy->bands[band];
 150 +       mgmt = (struct ieee80211_mgmt *) skb->data;
 151 +       stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 152 +
 153 +       if (stype != IEEE80211_STYPE_BEACON)
 154 +               return;
 155 +
 156 +       baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
 157 +       if (baselen > skb->len)
 158 +               return;
 159 +
 160 +       ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
 161 +                              skb->len - baselen, false, &elems);
 162 +
 163 +       rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 164 +
 165 +       rcu_read_lock();
 166 +
 167 +       sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
 168 +
 169 +       if (!sta) {
 170 +               rcu_read_unlock();
 171 +               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 172 +                                    GFP_KERNEL);
 173 +               if (!sta)
 174 +                       return;
 175 +
 176 +               new = true;
 177 +       }
 178 +
 179 +       sta->last_rx = jiffies;
 180 +       sta->sta.supp_rates[band] = rates;
 181 +
 182 +       if (elems.ht_cap_elem)
 183 +               ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
 184 +                               elems.ht_cap_elem, sta);
 185 +
 186 +       if (elems.wmm_param)
 187 +               set_sta_flag(sta, WLAN_STA_WME);
 188 +
 189 +       if (new) {
 190 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 191 +               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 192 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 193 +               rate_control_rate_init(sta);
 194 +               sta_info_insert_rcu(sta);
 195 +       }
 196 +
 197 +       rcu_read_unlock();
 198 +}
 199 +
 200  static void ieee80211_iface_work(struct work_struct *work)
 201  {
 202         struct ieee80211_sub_if_data *sdata =
 203 @@ -1220,6 +1273,9 @@ static void ieee80211_iface_work(struct
 204                                 break;
 205                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 206                         break;
 207 +               case NL80211_IFTYPE_WDS:
 208 +                       ieee80211_wds_rx_queued_mgmt(sdata, skb);
 209 +                       break;
 210                 default:
 211                         WARN(1, "frame for unexpected interface type");
 212                         break;
 213 @@ -1282,6 +1338,7 @@ static void ieee80211_setup_sdata(struct
 214         skb_queue_head_init(&sdata->skb_queue);
 215         INIT_WORK(&sdata->work, ieee80211_iface_work);
 216         INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
 217 +       INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
 218
 219         switch (type) {
 220         case NL80211_IFTYPE_P2P_GO:
 221 --- a/net/mac80211/rc80211_minstrel_ht.c
 222 +++ b/net/mac80211/rc80211_minstrel_ht.c
 223 @@ -365,6 +365,14 @@ minstrel_ht_update_stats(struct minstrel
 224                 }
 225         }
 226
 227 +#ifdef CPTCFG_MAC80211_DEBUGFS
 228 +       /* use fixed index if set */
 229 +       if (mp->fixed_rate_idx != -1) {
 230 +               mi->max_tp_rate = mp->fixed_rate_idx;
 231 +               mi->max_tp_rate2 = mp->fixed_rate_idx;
 232 +               mi->max_prob_rate = mp->fixed_rate_idx;
 233 +       }
 234 +#endif
 235
 236         mi->stats_update = jiffies;
 237  }
 238 @@ -774,6 +782,11 @@ minstrel_ht_get_rate(void *priv, struct
 239         info->flags |= mi->tx_flags;
 240         minstrel_ht_check_cck_shortpreamble(mp, mi, txrc->short_preamble);
 241
 242 +#ifdef CPTCFG_MAC80211_DEBUGFS
 243 +       if (mp->fixed_rate_idx != -1)
 244 +               return;
 245 +#endif
 246 +
 247         /* Don't use EAPOL frames for sampling on non-mrr hw */
 248         if (mp->hw->max_rates == 1 &&
 249             txrc->skb->protocol == cpu_to_be16(ETH_P_PAE))
 250 @@ -781,16 +794,6 @@ minstrel_ht_get_rate(void *priv, struct
 251         else
 252                 sample_idx = minstrel_get_sample_rate(mp, mi);
 253
 254 -#ifdef CPTCFG_MAC80211_DEBUGFS
 255 -       /* use fixed index if set */
 256 -       if (mp->fixed_rate_idx != -1) {
 257 -               mi->max_tp_rate = mp->fixed_rate_idx;
 258 -               mi->max_tp_rate2 = mp->fixed_rate_idx;
 259 -               mi->max_prob_rate = mp->fixed_rate_idx;
 260 -               sample_idx = -1;
 261 -       }
 262 -#endif
 263 -
 264         mi->total_packets++;
 265
 266         /* wraparound */
 267 @@ -804,10 +807,18 @@ minstrel_ht_get_rate(void *priv, struct
 268
 269         sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
 270         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
 271 +       rate->count = 1;
 272 +
 273 +       if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
 274 +               int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
 275 +               rate->idx = mp->cck_rates[idx];
 276 +               rate->flags = 0;
 277 +               return;
 278 +       }
 279 +
 280         rate->idx = sample_idx % MCS_GROUP_RATES +
 281                     (sample_group->streams - 1) * MCS_GROUP_RATES;
 282         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
 283 -       rate->count = 1;
 284  }
 285
 286  static void
 287 @@ -820,6 +831,9 @@ minstrel_ht_update_cck(struct minstrel_p
 288         if (sband->band != IEEE80211_BAND_2GHZ)
 289                 return;
 290
 291 +       if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
 292 +               return;
 293 +
 294         mi->cck_supported = 0;
 295         mi->cck_supported_short = 0;
 296         for (i = 0; i < 4; i++) {
 297 --- a/net/mac80211/rx.c
 298 +++ b/net/mac80211/rx.c
 299 @@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx
 300         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 301         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 302
 303 -       /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
 304 -       if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
 305 +       /*
 306 +        * Drop duplicate 802.11 retransmissions
 307 +        * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
 308 +        */
 309 +       if (rx->skb->len >= 24 && rx->sta &&
 310 +           !ieee80211_is_ctl(hdr->frame_control) &&
 311 +           !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
 312 +           !is_multicast_ether_addr(hdr->addr1)) {
 313                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
 314                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
 315                              hdr->seq_ctrl)) {
 316 @@ -2369,6 +2375,7 @@ ieee80211_rx_h_action(struct ieee80211_r
 317                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
 318                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 319                     sdata->vif.type != NL80211_IFTYPE_AP &&
 320 +                   sdata->vif.type != NL80211_IFTYPE_WDS &&
 321                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
 322                         break;
 323
 324 @@ -2720,14 +2727,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
 325
 326         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
 327             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 328 -           sdata->vif.type != NL80211_IFTYPE_STATION)
 329 +           sdata->vif.type != NL80211_IFTYPE_STATION &&
 330 +           sdata->vif.type != NL80211_IFTYPE_WDS)
 331                 return RX_DROP_MONITOR;
 332
 333         switch (stype) {
 334         case cpu_to_le16(IEEE80211_STYPE_AUTH):
 335         case cpu_to_le16(IEEE80211_STYPE_BEACON):
 336         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 337 -               /* process for all: mesh, mlme, ibss */
 338 +               /* process for all: mesh, mlme, ibss, wds */
 339                 break;
 340         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 341         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
 342 @@ -3008,6 +3016,9 @@ static int prepare_for_handlers(struct i
 343         case NL80211_IFTYPE_ADHOC:
 344                 if (!bssid)
 345                         return 0;
 346 +               if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
 347 +                   ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
 348 +                       return 0;
 349                 if (ieee80211_is_beacon(hdr->frame_control)) {
 350                         return 1;
 351                 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
 352 @@ -3059,10 +3070,16 @@ static int prepare_for_handlers(struct i
 353                 }
 354                 break;
 355         case NL80211_IFTYPE_WDS:
 356 -               if (bssid || !ieee80211_is_data(hdr->frame_control))
 357 -                       return 0;
 358                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
 359                         return 0;
 360 +
 361 +               if (ieee80211_is_data(hdr->frame_control) ||
 362 +                   ieee80211_is_action(hdr->frame_control)) {
 363 +                       if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
 364 +                               return 0;
 365 +               } else if (!ieee80211_is_beacon(hdr->frame_control))
 366 +                       return 0;
 367 +
 368                 break;
 369         case NL80211_IFTYPE_P2P_DEVICE:
 370                 if (!ieee80211_is_public_action(hdr, skb->len) &&
 371 --- a/net/mac80211/sta_info.h
 372 +++ b/net/mac80211/sta_info.h
 373 @@ -32,7 +32,6 @@
 374   * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
 375   *     frames.
 376   * @WLAN_STA_WME: Station is a QoS-STA.
 377 - * @WLAN_STA_WDS: Station is one of our WDS peers.
 378   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
 379   *     IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
 380   *     frame to this station is transmitted.
 381 @@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
 382         WLAN_STA_AUTHORIZED,
 383         WLAN_STA_SHORT_PREAMBLE,
 384         WLAN_STA_WME,
 385 -       WLAN_STA_WDS,
 386         WLAN_STA_CLEAR_PS_FILT,
 387         WLAN_STA_MFP,
 388         WLAN_STA_BLOCK_BA,
 389 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 390 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
 391 @@ -135,6 +135,9 @@ static struct ath_frame_info *get_frame_
 392
 393  static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno)
 394  {
 395 +       if (!tid->an->sta)
 396 +               return;
 397 +
 398         ieee80211_send_bar(tid->an->vif, tid->an->sta->addr, tid->tidno,
 399                            seqno << IEEE80211_SEQ_SEQ_SHIFT);
 400  }
 401 @@ -146,6 +149,93 @@ static void ath_set_rates(struct ieee802
 402                                ARRAY_SIZE(bf->rates));
 403  }
 404
 405 +static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 406 +                            struct sk_buff *skb)
 407 +{
 408 +       int q;
 409 +
 410 +       q = skb_get_queue_mapping(skb);
 411 +       if (txq == sc->tx.uapsdq)
 412 +               txq = sc->tx.txq_map[q];
 413 +
 414 +       if (txq != sc->tx.txq_map[q])
 415 +               return;
 416 +
 417 +       if (WARN_ON(--txq->pending_frames < 0))
 418 +               txq->pending_frames = 0;
 419 +
 420 +       if (txq->stopped &&
 421 +           txq->pending_frames < sc->tx.txq_max_pending[q]) {
 422 +               ieee80211_wake_queue(sc->hw, q);
 423 +               txq->stopped = false;
 424 +       }
 425 +}
 426 +
 427 +static struct ath_atx_tid *
 428 +ath_get_skb_tid(struct ath_softc *sc, struct ath_node *an, struct sk_buff *skb)
 429 +{
 430 +       struct ieee80211_hdr *hdr;
 431 +       u8 tidno = 0;
 432 +
 433 +       hdr = (struct ieee80211_hdr *) skb->data;
 434 +       if (ieee80211_is_data_qos(hdr->frame_control))
 435 +               tidno = ieee80211_get_qos_ctl(hdr)[0];
 436 +
 437 +       tidno &= IEEE80211_QOS_CTL_TID_MASK;
 438 +       return ATH_AN_2_TID(an, tidno);
 439 +}
 440 +
 441 +static bool ath_tid_has_buffered(struct ath_atx_tid *tid)
 442 +{
 443 +       return !skb_queue_empty(&tid->buf_q) || !skb_queue_empty(&tid->retry_q);
 444 +}
 445 +
 446 +static struct sk_buff *ath_tid_dequeue(struct ath_atx_tid *tid)
 447 +{
 448 +       struct sk_buff *skb;
 449 +
 450 +       skb = __skb_dequeue(&tid->retry_q);
 451 +       if (!skb)
 452 +               skb = __skb_dequeue(&tid->buf_q);
 453 +
 454 +       return skb;
 455 +}
 456 +
 457 +/*
 458 + * ath_tx_tid_change_state:
 459 + * - clears a-mpdu flag of previous session
 460 + * - force sequence number allocation to fix next BlockAck Window
 461 + */
 462 +static void
 463 +ath_tx_tid_change_state(struct ath_softc *sc, struct ath_atx_tid *tid)
 464 +{
 465 +       struct ath_txq *txq = tid->ac->txq;
 466 +       struct ieee80211_tx_info *tx_info;
 467 +       struct sk_buff *skb, *tskb;
 468 +       struct ath_buf *bf;
 469 +       struct ath_frame_info *fi;
 470 +
 471 +       skb_queue_walk_safe(&tid->buf_q, skb, tskb) {
 472 +               fi = get_frame_info(skb);
 473 +               bf = fi->bf;
 474 +
 475 +               tx_info = IEEE80211_SKB_CB(skb);
 476 +               tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
 477 +
 478 +               if (bf)
 479 +                       continue;
 480 +
 481 +               bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 482 +               if (!bf) {
 483 +                       __skb_unlink(skb, &tid->buf_q);
 484 +                       ath_txq_skb_done(sc, txq, skb);
 485 +                       ieee80211_free_txskb(sc->hw, skb);
 486 +                       continue;
 487 +               }
 488 +       }
 489 +
 490 +}
 491 +
 492  static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 493  {
 494         struct ath_txq *txq = tid->ac->txq;
 495 @@ -160,27 +250,22 @@ static void ath_tx_flush_tid(struct ath_
 496
 497         memset(&ts, 0, sizeof(ts));
 498
 499 -       while ((skb = __skb_dequeue(&tid->buf_q))) {
 500 +       while ((skb = __skb_dequeue(&tid->retry_q))) {
 501                 fi = get_frame_info(skb);
 502                 bf = fi->bf;
 503 -
 504                 if (!bf) {
 505 -                       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 506 -                       if (!bf) {
 507 -                               ieee80211_free_txskb(sc->hw, skb);
 508 -                               continue;
 509 -                       }
 510 +                       ath_txq_skb_done(sc, txq, skb);
 511 +                       ieee80211_free_txskb(sc->hw, skb);
 512 +                       continue;
 513                 }
 514
 515 -               if (fi->retries) {
 516 -                       list_add_tail(&bf->list, &bf_head);
 517 +               if (fi->baw_tracked) {
 518                         ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
 519 -                       ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 520                         sendbar = true;
 521 -               } else {
 522 -                       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 523 -                       ath_tx_send_normal(sc, txq, NULL, skb);
 524                 }
 525 +
 526 +               list_add_tail(&bf->list, &bf_head);
 527 +               ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 528         }
 529
 530         if (sendbar) {
 531 @@ -209,13 +294,16 @@ static void ath_tx_update_baw(struct ath
 532  }
 533
 534  static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
 535 -                            u16 seqno)
 536 +                            struct ath_buf *bf)
 537  {
 538 +       struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
 539 +       u16 seqno = bf->bf_state.seqno;
 540         int index, cindex;
 541
 542         index  = ATH_BA_INDEX(tid->seq_start, seqno);
 543         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
 544         __set_bit(cindex, tid->tx_buf);
 545 +       fi->baw_tracked = 1;
 546
 547         if (index >= ((tid->baw_tail - tid->baw_head) &
 548                 (ATH_TID_MAX_BUFS - 1))) {
 549 @@ -224,12 +312,6 @@ static void ath_tx_addto_baw(struct ath_
 550         }
 551  }
 552
 553 -/*
 554 - * TODO: For frame(s) that are in the retry state, we will reuse the
 555 - * sequence number(s) without setting the retry bit. The
 556 - * alternative is to give up on these and BAR the receiver's window
 557 - * forward.
 558 - */
 559  static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
 560                           struct ath_atx_tid *tid)
 561
 562 @@ -243,7 +325,7 @@ static void ath_tid_drain(struct ath_sof
 563         memset(&ts, 0, sizeof(ts));
 564         INIT_LIST_HEAD(&bf_head);
 565
 566 -       while ((skb = __skb_dequeue(&tid->buf_q))) {
 567 +       while ((skb = ath_tid_dequeue(tid))) {
 568                 fi = get_frame_info(skb);
 569                 bf = fi->bf;
 570
 571 @@ -253,14 +335,8 @@ static void ath_tid_drain(struct ath_sof
 572                 }
 573
 574                 list_add_tail(&bf->list, &bf_head);
 575 -
 576 -               ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
 577                 ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 578         }
 579 -
 580 -       tid->seq_next = tid->seq_start;
 581 -       tid->baw_tail = tid->baw_head;
 582 -       tid->bar_index = -1;
 583  }
 584
 585  static void ath_tx_set_retry(struct ath_softc *sc, struct ath_txq *txq,
 586 @@ -323,6 +399,7 @@ static struct ath_buf* ath_clone_txbuf(s
 587         tbf->bf_buf_addr = bf->bf_buf_addr;
 588         memcpy(tbf->bf_desc, bf->bf_desc, sc->sc_ah->caps.tx_desc_len);
 589         tbf->bf_state = bf->bf_state;
 590 +       tbf->bf_state.stale = false;
 591
 592         return tbf;
 593  }
 594 @@ -380,7 +457,6 @@ static void ath_tx_complete_aggr(struct
 595         struct ieee80211_tx_rate rates[4];
 596         struct ath_frame_info *fi;
 597         int nframes;
 598 -       u8 tidno;
 599         bool flush = !!(ts->ts_status & ATH9K_TX_FLUSH);
 600         int i, retries;
 601         int bar_index = -1;
 602 @@ -406,7 +482,7 @@ static void ath_tx_complete_aggr(struct
 603                 while (bf) {
 604                         bf_next = bf->bf_next;
 605
 606 -                       if (!bf->bf_stale || bf_next != NULL)
 607 +                       if (!bf->bf_state.stale || bf_next != NULL)
 608                                 list_move_tail(&bf->list, &bf_head);
 609
 610                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts, 0);
 611 @@ -417,8 +493,7 @@ static void ath_tx_complete_aggr(struct
 612         }
 613
 614         an = (struct ath_node *)sta->drv_priv;
 615 -       tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
 616 -       tid = ATH_AN_2_TID(an, tidno);
 617 +       tid = ath_get_skb_tid(sc, an, skb);
 618         seq_first = tid->seq_start;
 619         isba = ts->ts_flags & ATH9K_TX_BA;
 620
 621 @@ -430,7 +505,7 @@ static void ath_tx_complete_aggr(struct
 622          * Only BlockAcks have a TID and therefore normal Acks cannot be
 623          * checked
 624          */
 625 -       if (isba && tidno != ts->tid)
 626 +       if (isba && tid->tidno != ts->tid)
 627                 txok = false;
 628
 629         isaggr = bf_isaggr(bf);
 630 @@ -466,7 +541,8 @@ static void ath_tx_complete_aggr(struct
 631                 tx_info = IEEE80211_SKB_CB(skb);
 632                 fi = get_frame_info(skb);
 633
 634 -               if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
 635 +               if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno) ||
 636 +                   !tid->active) {
 637                         /*
 638                          * Outside of the current BlockAck window,
 639                          * maybe part of a previous session
 640 @@ -499,7 +575,7 @@ static void ath_tx_complete_aggr(struct
 641                  * not a holding desc.
 642                  */
 643                 INIT_LIST_HEAD(&bf_head);
 644 -               if (bf_next != NULL || !bf_last->bf_stale)
 645 +               if (bf_next != NULL || !bf_last->bf_state.stale)
 646                         list_move_tail(&bf->list, &bf_head);
 647
 648                 if (!txpending) {
 649 @@ -523,7 +599,7 @@ static void ath_tx_complete_aggr(struct
 650                                 ieee80211_sta_eosp(sta);
 651                         }
 652                         /* retry the un-acked ones */
 653 -                       if (bf->bf_next == NULL && bf_last->bf_stale) {
 654 +                       if (bf->bf_next == NULL && bf_last->bf_state.stale) {
 655                                 struct ath_buf *tbf;
 656
 657                                 tbf = ath_clone_txbuf(sc, bf_last);
 658 @@ -560,7 +636,7 @@ static void ath_tx_complete_aggr(struct
 659                 if (an->sleeping)
 660                         ieee80211_sta_set_buffered(sta, tid->tidno, true);
 661
 662 -               skb_queue_splice(&bf_pending, &tid->buf_q);
 663 +               skb_queue_splice_tail(&bf_pending, &tid->retry_q);
 664                 if (!an->sleeping) {
 665                         ath_tx_queue_tid(txq, tid);
 666
 667 @@ -618,7 +694,7 @@ static void ath_tx_process_buffer(struct
 668         } else
 669                 ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok);
 670
 671 -       if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) && !flush)
 672 +       if (!flush)
 673                 ath_txq_schedule(sc, txq);
 674  }
 675
 676 @@ -792,15 +868,20 @@ static int ath_compute_num_delims(struct
 677
 678  static struct ath_buf *
 679  ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 680 -                       struct ath_atx_tid *tid)
 681 +                       struct ath_atx_tid *tid, struct sk_buff_head **q)
 682  {
 683 +       struct ieee80211_tx_info *tx_info;
 684         struct ath_frame_info *fi;
 685         struct sk_buff *skb;
 686         struct ath_buf *bf;
 687         u16 seqno;
 688
 689         while (1) {
 690 -               skb = skb_peek(&tid->buf_q);
 691 +               *q = &tid->retry_q;
 692 +               if (skb_queue_empty(*q))
 693 +                       *q = &tid->buf_q;
 694 +
 695 +               skb = skb_peek(*q);
 696                 if (!skb)
 697                         break;
 698
 699 @@ -808,13 +889,26 @@ ath_tx_get_tid_subframe(struct ath_softc
 700                 bf = fi->bf;
 701                 if (!fi->bf)
 702                         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 703 +               else
 704 +                       bf->bf_state.stale = false;
 705
 706                 if (!bf) {
 707 -                       __skb_unlink(skb, &tid->buf_q);
 708 +                       __skb_unlink(skb, *q);
 709 +                       ath_txq_skb_done(sc, txq, skb);
 710                         ieee80211_free_txskb(sc->hw, skb);
 711                         continue;
 712                 }
 713
 714 +               bf->bf_next = NULL;
 715 +               bf->bf_lastbf = bf;
 716 +
 717 +               tx_info = IEEE80211_SKB_CB(skb);
 718 +               tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
 719 +               if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
 720 +                       bf->bf_state.bf_type = 0;
 721 +                       return bf;
 722 +               }
 723 +
 724                 bf->bf_state.bf_type = BUF_AMPDU | BUF_AGGR;
 725                 seqno = bf->bf_state.seqno;
 726
 727 @@ -828,73 +922,52 @@ ath_tx_get_tid_subframe(struct ath_softc
 728
 729                         INIT_LIST_HEAD(&bf_head);
 730                         list_add(&bf->list, &bf_head);
 731 -                       __skb_unlink(skb, &tid->buf_q);
 732 +                       __skb_unlink(skb, *q);
 733                         ath_tx_update_baw(sc, tid, seqno);
 734                         ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 735                         continue;
 736                 }
 737
 738 -               bf->bf_next = NULL;
 739 -               bf->bf_lastbf = bf;
 740                 return bf;
 741         }
 742
 743         return NULL;
 744  }
 745
 746 -static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
 747 -                                            struct ath_txq *txq,
 748 -                                            struct ath_atx_tid *tid,
 749 -                                            struct list_head *bf_q,
 750 -                                            int *aggr_len)
 751 +static bool
 752 +ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
 753 +                struct ath_atx_tid *tid, struct list_head *bf_q,
 754 +                struct ath_buf *bf_first, struct sk_buff_head *tid_q,
 755 +                int *aggr_len)
 756  {
 757  #define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
 758 -       struct ath_buf *bf, *bf_first = NULL, *bf_prev = NULL;
 759 -       int rl = 0, nframes = 0, ndelim, prev_al = 0;
 760 +       struct ath_buf *bf = bf_first, *bf_prev = NULL;
 761 +       int nframes = 0, ndelim;
 762         u16 aggr_limit = 0, al = 0, bpad = 0,
 763 -               al_delta, h_baw = tid->baw_size / 2;
 764 -       enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
 765 +           al_delta, h_baw = tid->baw_size / 2;
 766         struct ieee80211_tx_info *tx_info;
 767         struct ath_frame_info *fi;
 768         struct sk_buff *skb;
 769 +       bool closed = false;
 770
 771 -       do {
 772 -               bf = ath_tx_get_tid_subframe(sc, txq, tid);
 773 -               if (!bf) {
 774 -                       status = ATH_AGGR_BAW_CLOSED;
 775 -                       break;
 776 -               }
 777 +       bf = bf_first;
 778 +       aggr_limit = ath_lookup_rate(sc, bf, tid);
 779
 780 +       do {
 781                 skb = bf->bf_mpdu;
 782                 fi = get_frame_info(skb);
 783
 784 -               if (!bf_first)
 785 -                       bf_first = bf;
 786 -
 787 -               if (!rl) {
 788 -                       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 789 -                       aggr_limit = ath_lookup_rate(sc, bf, tid);
 790 -                       rl = 1;
 791 -               }
 792 -
 793                 /* do not exceed aggregation limit */
 794                 al_delta = ATH_AGGR_DELIM_SZ + fi->framelen;
 795 +               if (nframes) {
 796 +                       if (aggr_limit < al + bpad + al_delta ||
 797 +                           ath_lookup_legacy(bf) || nframes >= h_baw)
 798 +                               break;
 799
 800 -               if (nframes &&
 801 -                   ((aggr_limit < (al + bpad + al_delta + prev_al)) ||
 802 -                    ath_lookup_legacy(bf))) {
 803 -                       status = ATH_AGGR_LIMITED;
 804 -                       break;
 805 -               }
 806 -
 807 -               tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 808 -               if (nframes && (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
 809 -                       break;
 810 -
 811 -               /* do not exceed subframe limit */
 812 -               if (nframes >= min((int)h_baw, ATH_AMPDU_SUBFRAME_DEFAULT)) {
 813 -                       status = ATH_AGGR_LIMITED;
 814 -                       break;
 815 +                       tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 816 +                       if ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
 817 +                           !(tx_info->flags & IEEE80211_TX_CTL_AMPDU))
 818 +                               break;
 819                 }
 820
 821                 /* add padding for previous frame to aggregation length */
 822 @@ -912,22 +985,37 @@ static enum ATH_AGGR_STATUS ath_tx_form_
 823                 bf->bf_next = NULL;
 824
 825                 /* link buffers of this frame to the aggregate */
 826 -               if (!fi->retries)
 827 -                       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
 828 +               if (!fi->baw_tracked)
 829 +                       ath_tx_addto_baw(sc, tid, bf);
 830                 bf->bf_state.ndelim = ndelim;
 831
 832 -               __skb_unlink(skb, &tid->buf_q);
 833 +               __skb_unlink(skb, tid_q);
 834                 list_add_tail(&bf->list, bf_q);
 835                 if (bf_prev)
 836                         bf_prev->bf_next = bf;
 837
 838                 bf_prev = bf;
 839
 840 -       } while (!skb_queue_empty(&tid->buf_q));
 841 +               bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 842 +               if (!bf) {
 843 +                       closed = true;
 844 +                       break;
 845 +               }
 846 +       } while (ath_tid_has_buffered(tid));
 847 +
 848 +       bf = bf_first;
 849 +       bf->bf_lastbf = bf_prev;
 850 +
 851 +       if (bf == bf_prev) {
 852 +               al = get_frame_info(bf->bf_mpdu)->framelen;
 853 +               bf->bf_state.bf_type = BUF_AMPDU;
 854 +       } else {
 855 +               TX_STAT_INC(txq->axq_qnum, a_aggr);
 856 +       }
 857
 858         *aggr_len = al;
 859
 860 -       return status;
 861 +       return closed;
 862  #undef PADBYTES
 863  }
 864
 865 @@ -999,7 +1087,7 @@ void ath_update_max_aggr_framelen(struct
 866  }
 867
 868  static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
 869 -                            struct ath_tx_info *info, int len)
 870 +                            struct ath_tx_info *info, int len, bool rts)
 871  {
 872         struct ath_hw *ah = sc->sc_ah;
 873         struct sk_buff *skb;
 874 @@ -1008,6 +1096,7 @@ static void ath_buf_set_rate(struct ath_
 875         const struct ieee80211_rate *rate;
 876         struct ieee80211_hdr *hdr;
 877         struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
 878 +       u32 rts_thresh = sc->hw->wiphy->rts_threshold;
 879         int i;
 880         u8 rix = 0;
 881
 882 @@ -1030,7 +1119,17 @@ static void ath_buf_set_rate(struct ath_
 883                 rix = rates[i].idx;
 884                 info->rates[i].Tries = rates[i].count;
 885
 886 -                   if (rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
 887 +               /*
 888 +                * Handle RTS threshold for unaggregated HT frames.
 889 +                */
 890 +               if (bf_isampdu(bf) && !bf_isaggr(bf) &&
 891 +                   (rates[i].flags & IEEE80211_TX_RC_MCS) &&
 892 +                   unlikely(rts_thresh != (u32) -1)) {
 893 +                       if (!rts_thresh || (len > rts_thresh))
 894 +                               rts = true;
 895 +               }
 896 +
 897 +               if (rts || rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
 898                         info->rates[i].RateFlags |= ATH9K_RATESERIES_RTS_CTS;
 899                         info->flags |= ATH9K_TXDESC_RTSENA;
 900                 } else if (rates[i].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
 901 @@ -1123,6 +1222,8 @@ static void ath_tx_fill_desc(struct ath_
 902         struct ath_hw *ah = sc->sc_ah;
 903         struct ath_buf *bf_first = NULL;
 904         struct ath_tx_info info;
 905 +       u32 rts_thresh = sc->hw->wiphy->rts_threshold;
 906 +       bool rts = false;
 907
 908         memset(&info, 0, sizeof(info));
 909         info.is_first = true;
 910 @@ -1159,7 +1260,22 @@ static void ath_tx_fill_desc(struct ath_
 911                                 info.flags |= (u32) bf->bf_state.bfs_paprd <<
 912                                               ATH9K_TXDESC_PAPRD_S;
 913
 914 -                       ath_buf_set_rate(sc, bf, &info, len);
 915 +                       /*
 916 +                        * mac80211 doesn't handle RTS threshold for HT because
 917 +                        * the decision has to be taken based on AMPDU length
 918 +                        * and aggregation is done entirely inside ath9k.
 919 +                        * Set the RTS/CTS flag for the first subframe based
 920 +                        * on the threshold.
 921 +                        */
 922 +                       if (aggr && (bf == bf_first) &&
 923 +                           unlikely(rts_thresh != (u32) -1)) {
 924 +                               /*
 925 +                                * "len" is the size of the entire AMPDU.
 926 +                                */
 927 +                               if (!rts_thresh || (len > rts_thresh))
 928 +                                       rts = true;
 929 +                       }
 930 +                       ath_buf_set_rate(sc, bf, &info, len, rts);
 931                 }
 932
 933                 info.buf_addr[0] = bf->bf_buf_addr;
 934 @@ -1188,64 +1304,101 @@ static void ath_tx_fill_desc(struct ath_
 935         }
 936  }
 937
 938 -static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 939 -                             struct ath_atx_tid *tid)
 940 +static void
 941 +ath_tx_form_burst(struct ath_softc *sc, struct ath_txq *txq,
 942 +                 struct ath_atx_tid *tid, struct list_head *bf_q,
 943 +                 struct ath_buf *bf_first, struct sk_buff_head *tid_q)
 944  {
 945 -       struct ath_buf *bf;
 946 -       enum ATH_AGGR_STATUS status;
 947 -       struct ieee80211_tx_info *tx_info;
 948 -       struct list_head bf_q;
 949 -       int aggr_len;
 950 +       struct ath_buf *bf = bf_first, *bf_prev = NULL;
 951 +       struct sk_buff *skb;
 952 +       int nframes = 0;
 953
 954         do {
 955 -               if (skb_queue_empty(&tid->buf_q))
 956 -                       return;
 957 +               struct ieee80211_tx_info *tx_info;
 958 +               skb = bf->bf_mpdu;
 959
 960 -               INIT_LIST_HEAD(&bf_q);
 961 +               nframes++;
 962 +               __skb_unlink(skb, tid_q);
 963 +               list_add_tail(&bf->list, bf_q);
 964 +               if (bf_prev)
 965 +                       bf_prev->bf_next = bf;
 966 +               bf_prev = bf;
 967
 968 -               status = ath_tx_form_aggr(sc, txq, tid, &bf_q, &aggr_len);
 969 +               if (nframes >= 2)
 970 +                       break;
 971
 972 -               /*
 973 -                * no frames picked up to be aggregated;
 974 -                * block-ack window is not open.
 975 -                */
 976 -               if (list_empty(&bf_q))
 977 +               bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 978 +               if (!bf)
 979                         break;
 980
 981 -               bf = list_first_entry(&bf_q, struct ath_buf, list);
 982 -               bf->bf_lastbf = list_entry(bf_q.prev, struct ath_buf, list);
 983                 tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 984 +               if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
 985 +                       break;
 986
 987 -               if (tid->ac->clear_ps_filter) {
 988 -                       tid->ac->clear_ps_filter = false;
 989 -                       tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 990 -               } else {
 991 -                       tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
 992 -               }
 993 +               ath_set_rates(tid->an->vif, tid->an->sta, bf);
 994 +       } while (1);
 995 +}
 996
 997 -               /* if only one frame, send as non-aggregate */
 998 -               if (bf == bf->bf_lastbf) {
 999 -                       aggr_len = get_frame_info(bf->bf_mpdu)->framelen;
1000 -                       bf->bf_state.bf_type = BUF_AMPDU;
1001 -               } else {
1002 -                       TX_STAT_INC(txq->axq_qnum, a_aggr);
1003 -               }
1004 +static bool ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
1005 +                             struct ath_atx_tid *tid, bool *stop)
1006 +{
1007 +       struct ath_buf *bf;
1008 +       struct ieee80211_tx_info *tx_info;
1009 +       struct sk_buff_head *tid_q;
1010 +       struct list_head bf_q;
1011 +       int aggr_len = 0;
1012 +       bool aggr, last = true;
1013 +
1014 +       if (!ath_tid_has_buffered(tid))
1015 +               return false;
1016 +
1017 +       INIT_LIST_HEAD(&bf_q);
1018 +
1019 +       bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
1020 +       if (!bf)
1021 +               return false;
1022 +
1023 +       tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
1024 +       aggr = !!(tx_info->flags & IEEE80211_TX_CTL_AMPDU);
1025 +       if ((aggr && txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) ||
1026 +               (!aggr && txq->axq_depth >= ATH_NON_AGGR_MIN_QDEPTH)) {
1027 +               *stop = true;
1028 +               return false;
1029 +       }
1030
1031 -               ath_tx_fill_desc(sc, bf, txq, aggr_len);
1032 -               ath_tx_txqaddbuf(sc, txq, &bf_q, false);
1033 -       } while (txq->axq_ampdu_depth < ATH_AGGR_MIN_QDEPTH &&
1034 -                status != ATH_AGGR_BAW_CLOSED);
1035 +       ath_set_rates(tid->an->vif, tid->an->sta, bf);
1036 +       if (aggr)
1037 +               last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
1038 +                                       tid_q, &aggr_len);
1039 +       else
1040 +               ath_tx_form_burst(sc, txq, tid, &bf_q, bf, tid_q);
1041 +
1042 +       if (list_empty(&bf_q))
1043 +               return false;
1044 +
1045 +       if (tid->ac->clear_ps_filter || tid->an->no_ps_filter) {
1046 +               tid->ac->clear_ps_filter = false;
1047 +               tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1048 +       }
1049 +
1050 +       ath_tx_fill_desc(sc, bf, txq, aggr_len);
1051 +       ath_tx_txqaddbuf(sc, txq, &bf_q, false);
1052 +       return true;
1053  }
1054
1055  int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
1056                       u16 tid, u16 *ssn)
1057  {
1058         struct ath_atx_tid *txtid;
1059 +       struct ath_txq *txq;
1060         struct ath_node *an;
1061         u8 density;
1062
1063         an = (struct ath_node *)sta->drv_priv;
1064         txtid = ATH_AN_2_TID(an, tid);
1065 +       txq = txtid->ac->txq;
1066 +
1067 +       ath_txq_lock(sc, txq);
1068
1069         /* update ampdu factor/density, they may have changed. This may happen
1070          * in HT IBSS when a beacon with HT-info is received after the station
1071 @@ -1258,6 +1411,9 @@ int ath_tx_aggr_start(struct ath_softc *
1072                 an->mpdudensity = density;
1073         }
1074
1075 +       /* force sequence number allocation for pending frames */
1076 +       ath_tx_tid_change_state(sc, txtid);
1077 +
1078         txtid->active = true;
1079         txtid->paused = true;
1080         *ssn = txtid->seq_start = txtid->seq_next;
1081 @@ -1266,6 +1422,8 @@ int ath_tx_aggr_start(struct ath_softc *
1082         memset(txtid->tx_buf, 0, sizeof(txtid->tx_buf));
1083         txtid->baw_head = txtid->baw_tail = 0;
1084
1085 +       ath_txq_unlock_complete(sc, txq);
1086 +
1087         return 0;
1088  }
1089
1090 @@ -1277,8 +1435,9 @@ void ath_tx_aggr_stop(struct ath_softc *
1091
1092         ath_txq_lock(sc, txq);
1093         txtid->active = false;
1094 -       txtid->paused = true;
1095 +       txtid->paused = false;
1096         ath_tx_flush_tid(sc, txtid);
1097 +       ath_tx_tid_change_state(sc, txtid);
1098         ath_txq_unlock_complete(sc, txq);
1099  }
1100
1101 @@ -1302,7 +1461,7 @@ void ath_tx_aggr_sleep(struct ieee80211_
1102
1103                 ath_txq_lock(sc, txq);
1104
1105 -               buffered = !skb_queue_empty(&tid->buf_q);
1106 +               buffered = ath_tid_has_buffered(tid);
1107
1108                 tid->sched = false;
1109                 list_del(&tid->list);
1110 @@ -1334,7 +1493,7 @@ void ath_tx_aggr_wakeup(struct ath_softc
1111                 ath_txq_lock(sc, txq);
1112                 ac->clear_ps_filter = true;
1113
1114 -               if (!skb_queue_empty(&tid->buf_q) && !tid->paused) {
1115 +               if (!tid->paused && ath_tid_has_buffered(tid)) {
1116                         ath_tx_queue_tid(txq, tid);
1117                         ath_txq_schedule(sc, txq);
1118                 }
1119 @@ -1359,7 +1518,7 @@ void ath_tx_aggr_resume(struct ath_softc
1120         tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
1121         tid->paused = false;
1122
1123 -       if (!skb_queue_empty(&tid->buf_q)) {
1124 +       if (ath_tid_has_buffered(tid)) {
1125                 ath_tx_queue_tid(txq, tid);
1126                 ath_txq_schedule(sc, txq);
1127         }
1128 @@ -1379,6 +1538,7 @@ void ath9k_release_buffered_frames(struc
1129         struct ieee80211_tx_info *info;
1130         struct list_head bf_q;
1131         struct ath_buf *bf_tail = NULL, *bf;
1132 +       struct sk_buff_head *tid_q;
1133         int sent = 0;
1134         int i;
1135
1136 @@ -1394,16 +1554,18 @@ void ath9k_release_buffered_frames(struc
1137                         continue;
1138
1139                 ath_txq_lock(sc, tid->ac->txq);
1140 -               while (!skb_queue_empty(&tid->buf_q) && nframes > 0) {
1141 -                       bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid);
1142 +               while (nframes > 0) {
1143 +                       bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid, &tid_q);
1144                         if (!bf)
1145                                 break;
1146
1147 -                       __skb_unlink(bf->bf_mpdu, &tid->buf_q);
1148 +                       __skb_unlink(bf->bf_mpdu, tid_q);
1149                         list_add_tail(&bf->list, &bf_q);
1150                         ath_set_rates(tid->an->vif, tid->an->sta, bf);
1151 -                       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
1152 -                       bf->bf_state.bf_type &= ~BUF_AGGR;
1153 +                       if (bf_isampdu(bf)) {
1154 +                               ath_tx_addto_baw(sc, tid, bf);
1155 +                               bf->bf_state.bf_type &= ~BUF_AGGR;
1156 +                       }
1157                         if (bf_tail)
1158                                 bf_tail->bf_next = bf;
1159
1160 @@ -1412,7 +1574,7 @@ void ath9k_release_buffered_frames(struc
1161                         sent++;
1162                         TX_STAT_INC(txq->axq_qnum, a_queued_hw);
1163
1164 -                       if (skb_queue_empty(&tid->buf_q))
1165 +                       if (an->sta && !ath_tid_has_buffered(tid))
1166                                 ieee80211_sta_set_buffered(an->sta, i, false);
1167                 }
1168                 ath_txq_unlock_complete(sc, tid->ac->txq);
1169 @@ -1571,7 +1733,7 @@ static void ath_drain_txq_list(struct at
1170         while (!list_empty(list)) {
1171                 bf = list_first_entry(list, struct ath_buf, list);
1172
1173 -               if (bf->bf_stale) {
1174 +               if (bf->bf_state.stale) {
1175                         list_del(&bf->list);
1176
1177                         ath_tx_return_buffer(sc, bf);
1178 @@ -1665,25 +1827,27 @@ void ath_tx_cleanupq(struct ath_softc *s
1179   */
1180  void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
1181  {
1182 -       struct ath_atx_ac *ac, *ac_tmp, *last_ac;
1183 +       struct ath_atx_ac *ac, *last_ac;
1184         struct ath_atx_tid *tid, *last_tid;
1185 +       bool sent = false;
1186
1187         if (test_bit(SC_OP_HW_RESET, &sc->sc_flags) ||
1188 -           list_empty(&txq->axq_acq) ||
1189 -           txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
1190 +           list_empty(&txq->axq_acq))
1191                 return;
1192
1193         rcu_read_lock();
1194
1195 -       ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
1196         last_ac = list_entry(txq->axq_acq.prev, struct ath_atx_ac, list);
1197 +       while (!list_empty(&txq->axq_acq)) {
1198 +               bool stop = false;
1199
1200 -       list_for_each_entry_safe(ac, ac_tmp, &txq->axq_acq, list) {
1201 +               ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
1202                 last_tid = list_entry(ac->tid_q.prev, struct ath_atx_tid, list);
1203                 list_del(&ac->list);
1204                 ac->sched = false;
1205
1206                 while (!list_empty(&ac->tid_q)) {
1207 +
1208                         tid = list_first_entry(&ac->tid_q, struct ath_atx_tid,
1209                                                list);
1210                         list_del(&tid->list);
1211 @@ -1692,17 +1856,17 @@ void ath_txq_schedule(struct ath_softc *
1212                         if (tid->paused)
1213                                 continue;
1214
1215 -                       ath_tx_sched_aggr(sc, txq, tid);
1216 +                       if (ath_tx_sched_aggr(sc, txq, tid, &stop))
1217 +                               sent = true;
1218
1219                         /*
1220                          * add tid to round-robin queue if more frames
1221                          * are pending for the tid
1222                          */
1223 -                       if (!skb_queue_empty(&tid->buf_q))
1224 +                       if (ath_tid_has_buffered(tid))
1225                                 ath_tx_queue_tid(txq, tid);
1226
1227 -                       if (tid == last_tid ||
1228 -                           txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
1229 +                       if (stop || tid == last_tid)
1230                                 break;
1231                 }
1232
1233 @@ -1711,9 +1875,17 @@ void ath_txq_schedule(struct ath_softc *
1234                         list_add_tail(&ac->list, &txq->axq_acq);
1235                 }
1236
1237 -               if (ac == last_ac ||
1238 -                   txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
1239 +               if (stop)
1240                         break;
1241 +
1242 +               if (ac == last_ac) {
1243 +                       if (!sent)
1244 +                               break;
1245 +
1246 +                       sent = false;
1247 +                       last_ac = list_entry(txq->axq_acq.prev,
1248 +                                            struct ath_atx_ac, list);
1249 +               }
1250         }
1251
1252         rcu_read_unlock();
1253 @@ -1787,74 +1959,28 @@ static void ath_tx_txqaddbuf(struct ath_
1254                         if (bf_is_ampdu_not_probing(bf))
1255                                 txq->axq_ampdu_depth++;
1256
1257 -                       bf = bf->bf_lastbf->bf_next;
1258 +                       bf_last = bf->bf_lastbf;
1259 +                       bf = bf_last->bf_next;
1260 +                       bf_last->bf_next = NULL;
1261                 }
1262         }
1263  }
1264
1265 -static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
1266 -                             struct ath_atx_tid *tid, struct sk_buff *skb,
1267 -                             struct ath_tx_control *txctl)
1268 -{
1269 -       struct ath_frame_info *fi = get_frame_info(skb);
1270 -       struct list_head bf_head;
1271 -       struct ath_buf *bf;
1272 -
1273 -       /*
1274 -        * Do not queue to h/w when any of the following conditions is true:
1275 -        * - there are pending frames in software queue
1276 -        * - the TID is currently paused for ADDBA/BAR request
1277 -        * - seqno is not within block-ack window
1278 -        * - h/w queue depth exceeds low water mark
1279 -        */
1280 -       if ((!skb_queue_empty(&tid->buf_q) || tid->paused ||
1281 -            !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
1282 -            txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) &&
1283 -           txq != sc->tx.uapsdq) {
1284 -               /*
1285 -                * Add this frame to software queue for scheduling later
1286 -                * for aggregation.
1287 -                */
1288 -               TX_STAT_INC(txq->axq_qnum, a_queued_sw);
1289 -               __skb_queue_tail(&tid->buf_q, skb);
1290 -               if (!txctl->an || !txctl->an->sleeping)
1291 -                       ath_tx_queue_tid(txq, tid);
1292 -               return;
1293 -       }
1294 -
1295 -       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
1296 -       if (!bf) {
1297 -               ieee80211_free_txskb(sc->hw, skb);
1298 -               return;
1299 -       }
1300 -
1301 -       ath_set_rates(tid->an->vif, tid->an->sta, bf);
1302 -       bf->bf_state.bf_type = BUF_AMPDU;
1303 -       INIT_LIST_HEAD(&bf_head);
1304 -       list_add(&bf->list, &bf_head);
1305 -
1306 -       /* Add sub-frame to BAW */
1307 -       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
1308 -
1309 -       /* Queue to h/w without aggregation */
1310 -       TX_STAT_INC(txq->axq_qnum, a_queued_hw);
1311 -       bf->bf_lastbf = bf;
1312 -       ath_tx_fill_desc(sc, bf, txq, fi->framelen);
1313 -       ath_tx_txqaddbuf(sc, txq, &bf_head, false);
1314 -}
1315 -
1316  static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
1317                                struct ath_atx_tid *tid, struct sk_buff *skb)
1318  {
1319 +       struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
1320         struct ath_frame_info *fi = get_frame_info(skb);
1321         struct list_head bf_head;
1322 -       struct ath_buf *bf;
1323 -
1324 -       bf = fi->bf;
1325 +       struct ath_buf *bf = fi->bf;
1326
1327         INIT_LIST_HEAD(&bf_head);
1328         list_add_tail(&bf->list, &bf_head);
1329         bf->bf_state.bf_type = 0;
1330 +       if (tid && (tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
1331 +               bf->bf_state.bf_type = BUF_AMPDU;
1332 +               ath_tx_addto_baw(sc, tid, bf);
1333 +       }
1334
1335         bf->bf_next = NULL;
1336         bf->bf_lastbf = bf;
1337 @@ -1985,6 +2111,7 @@ static int ath_tx_prepare(struct ieee802
1338         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1339         struct ieee80211_sta *sta = txctl->sta;
1340         struct ieee80211_vif *vif = info->control.vif;
1341 +       struct ath_vif *avp;
1342         struct ath_softc *sc = hw->priv;
1343         int frmlen = skb->len + FCS_LEN;
1344         int padpos, padsize;
1345 @@ -1992,6 +2119,10 @@ static int ath_tx_prepare(struct ieee802
1346         /* NOTE:  sta can be NULL according to net/mac80211.h */
1347         if (sta)
1348                 txctl->an = (struct ath_node *)sta->drv_priv;
1349 +       else if (vif && ieee80211_is_data(hdr->frame_control)) {
1350 +               avp = (void *)vif->drv_priv;
1351 +               txctl->an = &avp->mcast_node;
1352 +       }
1353
1354         if (info->control.hw_key)
1355                 frmlen += info->control.hw_key->icv_len;
1356 @@ -2041,7 +2172,6 @@ int ath_tx_start(struct ieee80211_hw *hw
1357         struct ath_txq *txq = txctl->txq;
1358         struct ath_atx_tid *tid = NULL;
1359         struct ath_buf *bf;
1360 -       u8 tidno;
1361         int q;
1362         int ret;
1363
1364 @@ -2069,27 +2199,31 @@ int ath_tx_start(struct ieee80211_hw *hw
1365                 ath_txq_unlock(sc, txq);
1366                 txq = sc->tx.uapsdq;
1367                 ath_txq_lock(sc, txq);
1368 -       }
1369 -
1370 -       if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
1371 -               tidno = ieee80211_get_qos_ctl(hdr)[0] &
1372 -                       IEEE80211_QOS_CTL_TID_MASK;
1373 -               tid = ATH_AN_2_TID(txctl->an, tidno);
1374 +       } else if (txctl->an &&
1375 +                  ieee80211_is_data_present(hdr->frame_control)) {
1376 +               tid = ath_get_skb_tid(sc, txctl->an, skb);
1377
1378                 WARN_ON(tid->ac->txq != txctl->txq);
1379 -       }
1380
1381 -       if ((info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
1382 +               if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
1383 +                       tid->ac->clear_ps_filter = true;
1384 +
1385                 /*
1386 -                * Try aggregation if it's a unicast data frame
1387 -                * and the destination is HT capable.
1388 +                * Add this frame to software queue for scheduling later
1389 +                * for aggregation.
1390                  */
1391 -               ath_tx_send_ampdu(sc, txq, tid, skb, txctl);
1392 +               TX_STAT_INC(txq->axq_qnum, a_queued_sw);
1393 +               __skb_queue_tail(&tid->buf_q, skb);
1394 +               if (!txctl->an->sleeping)
1395 +                       ath_tx_queue_tid(txq, tid);
1396 +
1397 +               ath_txq_schedule(sc, txq);
1398                 goto out;
1399         }
1400
1401         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
1402         if (!bf) {
1403 +               ath_txq_skb_done(sc, txq, skb);
1404                 if (txctl->paprd)
1405                         dev_kfree_skb_any(skb);
1406                 else
1407 @@ -2142,7 +2276,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw
1408
1409                 bf->bf_lastbf = bf;
1410                 ath_set_rates(vif, NULL, bf);
1411 -               ath_buf_set_rate(sc, bf, &info, fi->framelen);
1412 +               ath_buf_set_rate(sc, bf, &info, fi->framelen, false);
1413                 duration += info.rates[0].PktDuration;
1414                 if (bf_tail)
1415                         bf_tail->bf_next = bf;
1416 @@ -2189,7 +2323,7 @@ static void ath_tx_complete(struct ath_s
1417         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
1418         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
1419         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
1420 -       int q, padpos, padsize;
1421 +       int padpos, padsize;
1422         unsigned long flags;
1423
1424         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
1425 @@ -2225,21 +2359,7 @@ static void ath_tx_complete(struct ath_s
1426         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1427
1428         __skb_queue_tail(&txq->complete_q, skb);
1429 -
1430 -       q = skb_get_queue_mapping(skb);
1431 -       if (txq == sc->tx.uapsdq)
1432 -               txq = sc->tx.txq_map[q];
1433 -
1434 -       if (txq == sc->tx.txq_map[q]) {
1435 -               if (WARN_ON(--txq->pending_frames < 0))
1436 -                       txq->pending_frames = 0;
1437 -
1438 -               if (txq->stopped &&
1439 -                   txq->pending_frames < sc->tx.txq_max_pending[q]) {
1440 -                       ieee80211_wake_queue(sc->hw, q);
1441 -                       txq->stopped = false;
1442 -               }
1443 -       }
1444 +       ath_txq_skb_done(sc, txq, skb);
1445  }
1446
1447  static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
1448 @@ -2360,8 +2480,7 @@ static void ath_tx_processq(struct ath_s
1449
1450                 if (list_empty(&txq->axq_q)) {
1451                         txq->axq_link = NULL;
1452 -                       if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
1453 -                               ath_txq_schedule(sc, txq);
1454 +                       ath_txq_schedule(sc, txq);
1455                         break;
1456                 }
1457                 bf = list_first_entry(&txq->axq_q, struct ath_buf, list);
1458 @@ -2375,7 +2494,7 @@ static void ath_tx_processq(struct ath_s
1459                  * it with the STALE flag.
1460                  */
1461                 bf_held = NULL;
1462 -               if (bf->bf_stale) {
1463 +               if (bf->bf_state.stale) {
1464                         bf_held = bf;
1465                         if (list_is_last(&bf_held->list, &txq->axq_q))
1466                                 break;
1467 @@ -2399,7 +2518,7 @@ static void ath_tx_processq(struct ath_s
1468                  * however leave the last descriptor back as the holding
1469                  * descriptor for hw.
1470                  */
1471 -               lastbf->bf_stale = true;
1472 +               lastbf->bf_state.stale = true;
1473                 INIT_LIST_HEAD(&bf_head);
1474                 if (!list_is_singular(&lastbf->list))
1475                         list_cut_position(&bf_head,
1476 @@ -2470,7 +2589,7 @@ void ath_tx_edma_tasklet(struct ath_soft
1477                 }
1478
1479                 bf = list_first_entry(fifo_list, struct ath_buf, list);
1480 -               if (bf->bf_stale) {
1481 +               if (bf->bf_state.stale) {
1482                         list_del(&bf->list);
1483                         ath_tx_return_buffer(sc, bf);
1484                         bf = list_first_entry(fifo_list, struct ath_buf, list);
1485 @@ -2492,7 +2611,7 @@ void ath_tx_edma_tasklet(struct ath_soft
1486                                 ath_tx_txqaddbuf(sc, txq, &bf_q, true);
1487                         }
1488                 } else {
1489 -                       lastbf->bf_stale = true;
1490 +                       lastbf->bf_state.stale = true;
1491                         if (bf != lastbf)
1492                                 list_cut_position(&bf_head, fifo_list,
1493                                                   lastbf->list.prev);
1494 @@ -2583,6 +2702,7 @@ void ath_tx_node_init(struct ath_softc *
1495                 tid->paused    = false;
1496                 tid->active        = false;
1497                 __skb_queue_head_init(&tid->buf_q);
1498 +               __skb_queue_head_init(&tid->retry_q);
1499                 acno = TID_TO_WME_AC(tidno);
1500                 tid->ac = &an->ac[acno];
1501         }
1502 @@ -2590,6 +2710,7 @@ void ath_tx_node_init(struct ath_softc *
1503         for (acno = 0, ac = &an->ac[acno];
1504              acno < IEEE80211_NUM_ACS; acno++, ac++) {
1505                 ac->sched    = false;
1506 +               ac->clear_ps_filter = true;
1507                 ac->txq = sc->tx.txq_map[acno];
1508                 INIT_LIST_HEAD(&ac->tid_q);
1509         }
1510 --- a/drivers/net/wireless/ath/ath9k/main.c
1511 +++ b/drivers/net/wireless/ath/ath9k/main.c
1512 @@ -173,8 +173,7 @@ static void ath_restart_work(struct ath_
1513  {
1514         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
1515
1516 -       if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9485(sc->sc_ah) ||
1517 -           AR_SREV_9550(sc->sc_ah))
1518 +       if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
1519                 ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
1520                                      msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
1521
1522 @@ -209,6 +208,7 @@ static bool ath_complete_reset(struct at
1523         struct ath_hw *ah = sc->sc_ah;
1524         struct ath_common *common = ath9k_hw_common(ah);
1525         unsigned long flags;
1526 +       int i;
1527
1528         if (ath_startrecv(sc) != 0) {
1529                 ath_err(common, "Unable to restart recv logic\n");
1530 @@ -236,10 +236,16 @@ static bool ath_complete_reset(struct at
1531                 }
1532         work:
1533                 ath_restart_work(sc);
1534 -       }
1535
1536 -       if ((ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) && sc->ant_rx != 3)
1537 -               ath_ant_comb_update(sc);
1538 +               for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
1539 +                       if (!ATH_TXQ_SETUP(sc, i))
1540 +                               continue;
1541 +
1542 +                       spin_lock_bh(&sc->tx.txq[i].axq_lock);
1543 +                       ath_txq_schedule(sc, &sc->tx.txq[i]);
1544 +                       spin_unlock_bh(&sc->tx.txq[i].axq_lock);
1545 +               }
1546 +       }
1547
1548         ieee80211_wake_queues(sc->hw);
1549
1550 @@ -543,21 +549,10 @@ chip_reset:
1551
1552  static int ath_reset(struct ath_softc *sc)
1553  {
1554 -       int i, r;
1555 +       int r;
1556
1557         ath9k_ps_wakeup(sc);
1558 -
1559         r = ath_reset_internal(sc, NULL);
1560 -
1561 -       for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
1562 -               if (!ATH_TXQ_SETUP(sc, i))
1563 -                       continue;
1564 -
1565 -               spin_lock_bh(&sc->tx.txq[i].axq_lock);
1566 -               ath_txq_schedule(sc, &sc->tx.txq[i]);
1567 -               spin_unlock_bh(&sc->tx.txq[i].axq_lock);
1568 -       }
1569 -
1570         ath9k_ps_restore(sc);
1571
1572         return r;
1573 @@ -966,6 +961,8 @@ static int ath9k_add_interface(struct ie
1574         struct ath_softc *sc = hw->priv;
1575         struct ath_hw *ah = sc->sc_ah;
1576         struct ath_common *common = ath9k_hw_common(ah);
1577 +       struct ath_vif *avp = (void *)vif->drv_priv;
1578 +       struct ath_node *an = &avp->mcast_node;
1579
1580         mutex_lock(&sc->mutex);
1581
1582 @@ -979,6 +976,12 @@ static int ath9k_add_interface(struct ie
1583         if (ath9k_uses_beacons(vif->type))
1584                 ath9k_beacon_assign_slot(sc, vif);
1585
1586 +       an->sc = sc;
1587 +       an->sta = NULL;
1588 +       an->vif = vif;
1589 +       an->no_ps_filter = true;
1590 +       ath_tx_node_init(sc, an);
1591 +
1592         mutex_unlock(&sc->mutex);
1593         return 0;
1594  }
1595 @@ -1016,6 +1019,7 @@ static void ath9k_remove_interface(struc
1596  {
1597         struct ath_softc *sc = hw->priv;
1598         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
1599 +       struct ath_vif *avp = (void *)vif->drv_priv;
1600
1601         ath_dbg(common, CONFIG, "Detach Interface\n");
1602
1603 @@ -1030,6 +1034,8 @@ static void ath9k_remove_interface(struc
1604         ath9k_calculate_summary_state(hw, NULL);
1605         ath9k_ps_restore(sc);
1606
1607 +       ath_tx_node_cleanup(sc, &avp->mcast_node);
1608 +
1609         mutex_unlock(&sc->mutex);
1610  }
1611
1612 @@ -1193,8 +1199,6 @@ static int ath9k_config(struct ieee80211
1613
1614         if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || reset_channel) {
1615                 struct ieee80211_channel *curchan = hw->conf.chandef.chan;
1616 -               enum nl80211_channel_type channel_type =
1617 -                       cfg80211_get_chandef_type(&conf->chandef);
1618                 int pos = curchan->hw_value;
1619                 int old_pos = -1;
1620                 unsigned long flags;
1621 @@ -1202,8 +1206,8 @@ static int ath9k_config(struct ieee80211
1622                 if (ah->curchan)
1623                         old_pos = ah->curchan - &ah->channels[0];
1624
1625 -               ath_dbg(common, CONFIG, "Set channel: %d MHz type: %d\n",
1626 -                       curchan->center_freq, channel_type);
1627 +               ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
1628 +                       curchan->center_freq, hw->conf.chandef.width);
1629
1630                 /* update survey stats for the old channel before switching */
1631                 spin_lock_irqsave(&common->cc_lock, flags);
1632 @@ -1211,7 +1215,7 @@ static int ath9k_config(struct ieee80211
1633                 spin_unlock_irqrestore(&common->cc_lock, flags);
1634
1635                 ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
1636 -                                         curchan, channel_type);
1637 +                                         &conf->chandef);
1638
1639                 /*
1640                  * If the operating channel changes, change the survey in-use flags
1641 @@ -1374,9 +1378,6 @@ static void ath9k_sta_notify(struct ieee
1642         struct ath_softc *sc = hw->priv;
1643         struct ath_node *an = (struct ath_node *) sta->drv_priv;
1644
1645 -       if (!sta->ht_cap.ht_supported)
1646 -               return;
1647 -
1648         switch (cmd) {
1649         case STA_NOTIFY_SLEEP:
1650                 an->sleeping = true;
1651 @@ -2094,7 +2095,7 @@ static void ath9k_wow_add_pattern(struct
1652  {
1653         struct ath_hw *ah = sc->sc_ah;
1654         struct ath9k_wow_pattern *wow_pattern = NULL;
1655 -       struct cfg80211_wowlan_trig_pkt_pattern *patterns = wowlan->patterns;
1656 +       struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
1657         int mask_len;
1658         s8 i = 0;
1659
1660 --- a/drivers/net/wireless/mwifiex/cfg80211.c
1661 +++ b/drivers/net/wireless/mwifiex/cfg80211.c
1662 @@ -2298,8 +2298,7 @@ EXPORT_SYMBOL_GPL(mwifiex_del_virtual_in
1663
1664  #ifdef CONFIG_PM
1665  static bool
1666 -mwifiex_is_pattern_supported(struct cfg80211_wowlan_trig_pkt_pattern *pat,
1667 -                            s8 *byte_seq)
1668 +mwifiex_is_pattern_supported(struct cfg80211_pkt_pattern *pat, s8 *byte_seq)
1669  {
1670         int j, k, valid_byte_cnt = 0;
1671         bool dont_care_byte = false;
1672 --- a/drivers/net/wireless/ti/wlcore/main.c
1673 +++ b/drivers/net/wireless/ti/wlcore/main.c
1674 @@ -1315,7 +1315,7 @@ static struct sk_buff *wl12xx_alloc_dumm
1675
1676  #ifdef CONFIG_PM
1677  static int
1678 -wl1271_validate_wowlan_pattern(struct cfg80211_wowlan_trig_pkt_pattern *p)
1679 +wl1271_validate_wowlan_pattern(struct cfg80211_pkt_pattern *p)
1680  {
1681         int num_fields = 0, in_field = 0, fields_size = 0;
1682         int i, pattern_len = 0;
1683 @@ -1458,9 +1458,9 @@ void wl1271_rx_filter_flatten_fields(str
1684   * Allocates an RX filter returned through f
1685   * which needs to be freed using rx_filter_free()
1686   */
1687 -static int wl1271_convert_wowlan_pattern_to_rx_filter(
1688 -       struct cfg80211_wowlan_trig_pkt_pattern *p,
1689 -       struct wl12xx_rx_filter **f)
1690 +static int
1691 +wl1271_convert_wowlan_pattern_to_rx_filter(struct cfg80211_pkt_pattern *p,
1692 +                                          struct wl12xx_rx_filter **f)
1693  {
1694         int i, j, ret = 0;
1695         struct wl12xx_rx_filter *filter;
1696 @@ -1562,7 +1562,7 @@ static int wl1271_configure_wowlan(struc
1697
1698         /* Translate WoWLAN patterns into filters */
1699         for (i = 0; i < wow->n_patterns; i++) {
1700 -               struct cfg80211_wowlan_trig_pkt_pattern *p;
1701 +               struct cfg80211_pkt_pattern *p;
1702                 struct wl12xx_rx_filter *filter = NULL;
1703
1704                 p = &wow->patterns[i];
1705 --- a/include/net/cfg80211.h
1706 +++ b/include/net/cfg80211.h
1707 @@ -639,6 +639,30 @@ struct cfg80211_ap_settings {
1708  };
1709
1710  /**
1711 + * struct cfg80211_csa_settings - channel switch settings
1712 + *
1713 + * Used for channel switch
1714 + *
1715 + * @chandef: defines the channel to use after the switch
1716 + * @beacon_csa: beacon data while performing the switch
1717 + * @counter_offset_beacon: offset for the counter within the beacon (tail)
1718 + * @counter_offset_presp: offset for the counter within the probe response
1719 + * @beacon_after: beacon data to be used on the new channel
1720 + * @radar_required: whether radar detection is required on the new channel
1721 + * @block_tx: whether transmissions should be blocked while changing
1722 + * @count: number of beacons until switch
1723 + */
1724 +struct cfg80211_csa_settings {
1725 +       struct cfg80211_chan_def chandef;
1726 +       struct cfg80211_beacon_data beacon_csa;
1727 +       u16 counter_offset_beacon, counter_offset_presp;
1728 +       struct cfg80211_beacon_data beacon_after;
1729 +       bool radar_required;
1730 +       bool block_tx;
1731 +       u8 count;
1732 +};
1733 +
1734 +/**
1735   * enum station_parameters_apply_mask - station parameter values to apply
1736   * @STATION_PARAM_APPLY_UAPSD: apply new uAPSD parameters (uapsd_queues, max_sp)
1737   * @STATION_PARAM_APPLY_CAPABILITY: apply new capability
1738 @@ -1698,7 +1722,7 @@ struct cfg80211_pmksa {
1739  };
1740
1741  /**
1742 - * struct cfg80211_wowlan_trig_pkt_pattern - packet pattern
1743 + * struct cfg80211_pkt_pattern - packet pattern
1744   * @mask: bitmask where to match pattern and where to ignore bytes,
1745   *     one bit per byte, in same format as nl80211
1746   * @pattern: bytes to match where bitmask is 1
1747 @@ -1708,7 +1732,7 @@ struct cfg80211_pmksa {
1748   * Internal note: @mask and @pattern are allocated in one chunk of
1749   * memory, free @mask only!
1750   */
1751 -struct cfg80211_wowlan_trig_pkt_pattern {
1752 +struct cfg80211_pkt_pattern {
1753         u8 *mask, *pattern;
1754         int pattern_len;
1755         int pkt_offset;
1756 @@ -1770,7 +1794,7 @@ struct cfg80211_wowlan {
1757         bool any, disconnect, magic_pkt, gtk_rekey_failure,
1758              eap_identity_req, four_way_handshake,
1759              rfkill_release;
1760 -       struct cfg80211_wowlan_trig_pkt_pattern *patterns;
1761 +       struct cfg80211_pkt_pattern *patterns;
1762         struct cfg80211_wowlan_tcp *tcp;
1763         int n_patterns;
1764  };
1765 @@ -2071,6 +2095,8 @@ struct cfg80211_update_ft_ies_params {
1766   *     driver can take the most appropriate actions.
1767   * @crit_proto_stop: Indicates critical protocol no longer needs increased link
1768   *     reliability. This operation can not fail.
1769 + *
1770 + * @channel_switch: initiate channel-switch procedure (with CSA)
1771   */
1772  struct cfg80211_ops {
1773         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
1774 @@ -2306,6 +2332,10 @@ struct cfg80211_ops {
1775                                     u16 duration);
1776         void    (*crit_proto_stop)(struct wiphy *wiphy,
1777                                    struct wireless_dev *wdev);
1778 +
1779 +       int     (*channel_switch)(struct wiphy *wiphy,
1780 +                                 struct net_device *dev,
1781 +                                 struct cfg80211_csa_settings *params);
1782  };
1783
1784  /*
1785 @@ -2371,6 +2401,8 @@ struct cfg80211_ops {
1786   * @WIPHY_FLAG_OFFCHAN_TX: Device supports direct off-channel TX.
1787   * @WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL: Device supports remain-on-channel call.
1788   * @WIPHY_FLAG_SUPPORTS_5_10_MHZ: Device supports 5 MHz and 10 MHz channels.
1789 + * @WIPHY_FLAG_HAS_CHANNEL_SWITCH: Device supports channel switch in
1790 + *     beaconing mode (AP, IBSS, Mesh, ...).
1791   */
1792  enum wiphy_flags {
1793         WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
1794 @@ -2395,6 +2427,7 @@ enum wiphy_flags {
1795         WIPHY_FLAG_OFFCHAN_TX                   = BIT(20),
1796         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL        = BIT(21),
1797         WIPHY_FLAG_SUPPORTS_5_10_MHZ            = BIT(22),
1798 +       WIPHY_FLAG_HAS_CHANNEL_SWITCH           = BIT(23),
1799  };
1800
1801  /**
1802 --- a/include/uapi/linux/nl80211.h
1803 +++ b/include/uapi/linux/nl80211.h
1804 @@ -648,6 +648,16 @@
1805   * @NL80211_CMD_CRIT_PROTOCOL_STOP: Indicates the connection reliability can
1806   *     return back to normal.
1807   *
1808 + * @NL80211_CMD_CHANNEL_SWITCH: Perform a channel switch by announcing the
1809 + *     the new channel information (Channel Switch Announcement - CSA)
1810 + *     in the beacon for some time (as defined in the
1811 + *     %NL80211_ATTR_CH_SWITCH_COUNT parameter) and then change to the
1812 + *     new channel. Userspace provides the new channel information (using
1813 + *     %NL80211_ATTR_WIPHY_FREQ and the attributes determining channel
1814 + *     width). %NL80211_ATTR_CH_SWITCH_BLOCK_TX may be supplied to inform
1815 + *     other station that transmission must be blocked until the channel
1816 + *     switch is complete.
1817 + *
1818   * @NL80211_CMD_MAX: highest used command number
1819   * @__NL80211_CMD_AFTER_LAST: internal use
1820   */
1821 @@ -810,6 +820,8 @@ enum nl80211_commands {
1822         NL80211_CMD_CRIT_PROTOCOL_START,
1823         NL80211_CMD_CRIT_PROTOCOL_STOP,
1824
1825 +       NL80211_CMD_CHANNEL_SWITCH,
1826 +
1827         /* add new commands above here */
1828
1829         /* used to define NL80211_CMD_MAX below */
1830 @@ -1436,6 +1448,18 @@ enum nl80211_commands {
1831   *     allowed to be used with the first @NL80211_CMD_SET_STATION command to
1832   *     update a TDLS peer STA entry.
1833   *
1834 + * @NL80211_ATTR_CH_SWITCH_COUNT: u32 attribute specifying the number of TBTT's
1835 + *     until the channel switch event.
1836 + * @NL80211_ATTR_CH_SWITCH_BLOCK_TX: flag attribute specifying that transmission
1837 + *     must be blocked on the current channel (before the channel switch
1838 + *     operation).
1839 + * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
1840 + *     for the time while performing a channel switch.
1841 + * @NL80211_ATTR_CSA_C_OFF_BEACON: Offset of the channel switch counter
1842 + *     field in the beacons tail (%NL80211_ATTR_BEACON_TAIL).
1843 + * @NL80211_ATTR_CSA_C_OFF_PRESP: Offset of the channel switch counter
1844 + *     field in the probe response (%NL80211_ATTR_PROBE_RESP).
1845 + *
1846   * @NL80211_ATTR_MAX: highest attribute number currently defined
1847   * @__NL80211_ATTR_AFTER_LAST: internal use
1848   */
1849 @@ -1736,6 +1760,12 @@ enum nl80211_attrs {
1850
1851         NL80211_ATTR_PEER_AID,
1852
1853 +       NL80211_ATTR_CH_SWITCH_COUNT,
1854 +       NL80211_ATTR_CH_SWITCH_BLOCK_TX,
1855 +       NL80211_ATTR_CSA_IES,
1856 +       NL80211_ATTR_CSA_C_OFF_BEACON,
1857 +       NL80211_ATTR_CSA_C_OFF_PRESP,
1858 +
1859         /* add attributes here, update the policy in nl80211.c */
1860
1861         __NL80211_ATTR_AFTER_LAST,
1862 @@ -3060,11 +3090,11 @@ enum nl80211_tx_power_setting {
1863  };
1864
1865  /**
1866 - * enum nl80211_wowlan_packet_pattern_attr - WoWLAN packet pattern attribute
1867 - * @__NL80211_WOWLAN_PKTPAT_INVALID: invalid number for nested attribute
1868 - * @NL80211_WOWLAN_PKTPAT_PATTERN: the pattern, values where the mask has
1869 + * enum nl80211_packet_pattern_attr - packet pattern attribute
1870 + * @__NL80211_PKTPAT_INVALID: invalid number for nested attribute
1871 + * @NL80211_PKTPAT_PATTERN: the pattern, values where the mask has
1872   *     a zero bit are ignored
1873 - * @NL80211_WOWLAN_PKTPAT_MASK: pattern mask, must be long enough to have
1874 + * @NL80211_PKTPAT_MASK: pattern mask, must be long enough to have
1875   *     a bit for each byte in the pattern. The lowest-order bit corresponds
1876   *     to the first byte of the pattern, but the bytes of the pattern are
1877   *     in a little-endian-like format, i.e. the 9th byte of the pattern
1878 @@ -3075,23 +3105,23 @@ enum nl80211_tx_power_setting {
1879   *     Note that the pattern matching is done as though frames were not
1880   *     802.11 frames but 802.3 frames, i.e. the frame is fully unpacked
1881   *     first (including SNAP header unpacking) and then matched.
1882 - * @NL80211_WOWLAN_PKTPAT_OFFSET: packet offset, pattern is matched after
1883 + * @NL80211_PKTPAT_OFFSET: packet offset, pattern is matched after
1884   *     these fixed number of bytes of received packet
1885 - * @NUM_NL80211_WOWLAN_PKTPAT: number of attributes
1886 - * @MAX_NL80211_WOWLAN_PKTPAT: max attribute number
1887 + * @NUM_NL80211_PKTPAT: number of attributes
1888 + * @MAX_NL80211_PKTPAT: max attribute number
1889   */
1890 -enum nl80211_wowlan_packet_pattern_attr {
1891 -       __NL80211_WOWLAN_PKTPAT_INVALID,
1892 -       NL80211_WOWLAN_PKTPAT_MASK,
1893 -       NL80211_WOWLAN_PKTPAT_PATTERN,
1894 -       NL80211_WOWLAN_PKTPAT_OFFSET,
1895 +enum nl80211_packet_pattern_attr {
1896 +       __NL80211_PKTPAT_INVALID,
1897 +       NL80211_PKTPAT_MASK,
1898 +       NL80211_PKTPAT_PATTERN,
1899 +       NL80211_PKTPAT_OFFSET,
1900
1901 -       NUM_NL80211_WOWLAN_PKTPAT,
1902 -       MAX_NL80211_WOWLAN_PKTPAT = NUM_NL80211_WOWLAN_PKTPAT - 1,
1903 +       NUM_NL80211_PKTPAT,
1904 +       MAX_NL80211_PKTPAT = NUM_NL80211_PKTPAT - 1,
1905  };
1906
1907  /**
1908 - * struct nl80211_wowlan_pattern_support - pattern support information
1909 + * struct nl80211_pattern_support - packet pattern support information
1910   * @max_patterns: maximum number of patterns supported
1911   * @min_pattern_len: minimum length of each pattern
1912   * @max_pattern_len: maximum length of each pattern
1913 @@ -3101,13 +3131,22 @@ enum nl80211_wowlan_packet_pattern_attr
1914   * that is part of %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED in the
1915   * capability information given by the kernel to userspace.
1916   */
1917 -struct nl80211_wowlan_pattern_support {
1918 +struct nl80211_pattern_support {
1919         __u32 max_patterns;
1920         __u32 min_pattern_len;
1921         __u32 max_pattern_len;
1922         __u32 max_pkt_offset;
1923  } __attribute__((packed));
1924
1925 +/* only for backward compatibility */
1926 +#define __NL80211_WOWLAN_PKTPAT_INVALID __NL80211_PKTPAT_INVALID
1927 +#define NL80211_WOWLAN_PKTPAT_MASK NL80211_PKTPAT_MASK
1928 +#define NL80211_WOWLAN_PKTPAT_PATTERN NL80211_PKTPAT_PATTERN
1929 +#define NL80211_WOWLAN_PKTPAT_OFFSET NL80211_PKTPAT_OFFSET
1930 +#define NUM_NL80211_WOWLAN_PKTPAT NUM_NL80211_PKTPAT
1931 +#define MAX_NL80211_WOWLAN_PKTPAT MAX_NL80211_PKTPAT
1932 +#define nl80211_wowlan_pattern_support nl80211_pattern_support
1933 +
1934  /**
1935   * enum nl80211_wowlan_triggers - WoWLAN trigger definitions
1936   * @__NL80211_WOWLAN_TRIG_INVALID: invalid number for nested attributes
1937 @@ -3127,7 +3166,7 @@ struct nl80211_wowlan_pattern_support {
1938   *     pattern matching is done after the packet is converted to the MSDU.
1939   *
1940   *     In %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED, it is a binary attribute
1941 - *     carrying a &struct nl80211_wowlan_pattern_support.
1942 + *     carrying a &struct nl80211_pattern_support.
1943   *
1944   *     When reporting wakeup. it is a u32 attribute containing the 0-based
1945   *     index of the pattern that caused the wakeup, in the patterns passed
1946 @@ -3284,7 +3323,7 @@ struct nl80211_wowlan_tcp_data_token_fea
1947   * @NL80211_WOWLAN_TCP_WAKE_PAYLOAD: wake packet payload, for advertising a
1948   *     u32 attribute holding the maximum length
1949   * @NL80211_WOWLAN_TCP_WAKE_MASK: Wake packet payload mask, not used for
1950 - *     feature advertising. The mask works like @NL80211_WOWLAN_PKTPAT_MASK
1951 + *     feature advertising. The mask works like @NL80211_PKTPAT_MASK
1952   *     but on the TCP payload only.
1953   * @NUM_NL80211_WOWLAN_TCP: number of TCP attributes
1954   * @MAX_NL80211_WOWLAN_TCP: highest attribute number
1955 --- a/net/mac80211/mesh_ps.c
1956 +++ b/net/mac80211/mesh_ps.c
1957 @@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(str
1958         enum nl80211_mesh_power_mode pm;
1959         bool do_buffer;
1960
1961 +       /* For non-assoc STA, prevent buffering or frame transmission */
1962 +       if (sta->sta_state < IEEE80211_STA_ASSOC)
1963 +               return;
1964 +
1965         /*
1966          * use peer-specific power mode if peering is established and the
1967          * peer's power mode is known
1968 --- a/net/wireless/nl80211.c
1969 +++ b/net/wireless/nl80211.c
1970 @@ -349,6 +349,11 @@ static const struct nla_policy nl80211_p
1971         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
1972                                   .len = IEEE80211_MAX_DATA_LEN },
1973         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
1974 +       [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
1975 +       [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
1976 +       [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
1977 +       [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
1978 +       [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
1979  };
1980
1981  /* policy for the key attributes */
1982 @@ -441,10 +446,12 @@ static int nl80211_prepare_wdev_dump(str
1983                         goto out_unlock;
1984                 }
1985                 *rdev = wiphy_to_dev((*wdev)->wiphy);
1986 -               cb->args[0] = (*rdev)->wiphy_idx;
1987 +               /* 0 is the first index - add 1 to parse only once */
1988 +               cb->args[0] = (*rdev)->wiphy_idx + 1;
1989                 cb->args[1] = (*wdev)->identifier;
1990         } else {
1991 -               struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
1992 +               /* subtract the 1 again here */
1993 +               struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1994                 struct wireless_dev *tmp;
1995
1996                 if (!wiphy) {
1997 @@ -974,7 +981,7 @@ static int nl80211_send_wowlan(struct sk
1998                 return -ENOBUFS;
1999
2000         if (dev->wiphy.wowlan->n_patterns) {
2001 -               struct nl80211_wowlan_pattern_support pat = {
2002 +               struct nl80211_pattern_support pat = {
2003                         .max_patterns = dev->wiphy.wowlan->n_patterns,
2004                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
2005                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
2006 @@ -1393,6 +1400,8 @@ static int nl80211_send_wiphy(struct cfg
2007                 if (state->split) {
2008                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2009                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2010 +                       if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2011 +                               CMD(channel_switch, CHANNEL_SWITCH);
2012                 }
2013
2014  #ifdef CPTCFG_NL80211_TESTMODE
2015 @@ -1568,8 +1577,10 @@ static int nl80211_dump_wiphy(struct sk_
2016         rtnl_lock();
2017         if (!state) {
2018                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2019 -               if (!state)
2020 +               if (!state) {
2021 +                       rtnl_unlock();
2022                         return -ENOMEM;
2023 +               }
2024                 state->filter_wiphy = -1;
2025                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2026                 if (ret) {
2027 @@ -2620,8 +2631,8 @@ static int nl80211_get_key(struct sk_buf
2028
2029         hdr = nl80211hdr_put(msg, genl_info_snd_portid(info), info->snd_seq, 0,
2030                              NL80211_CMD_NEW_KEY);
2031 -       if (IS_ERR(hdr))
2032 -               return PTR_ERR(hdr);
2033 +       if (!hdr)
2034 +               return -ENOBUFS;
2035
2036         cookie.msg = msg;
2037         cookie.idx = key_idx;
2038 @@ -4770,9 +4781,9 @@ do {                                                                          \
2039         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
2040                                   mask, NL80211_MESHCONF_FORWARDING,
2041                                   nla_get_u8);
2042 -       FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
2043 +       FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
2044                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
2045 -                                 nla_get_u32);
2046 +                                 nla_get_s32);
2047         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
2048                                   mask, NL80211_MESHCONF_HT_OPMODE,
2049                                   nla_get_u16);
2050 @@ -5578,6 +5589,111 @@ static int nl80211_start_radar_detection
2051         return err;
2052  }
2053
2054 +static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
2055 +{
2056 +       struct cfg80211_registered_device *rdev = info->user_ptr[0];
2057 +       struct net_device *dev = info->user_ptr[1];
2058 +       struct wireless_dev *wdev = dev->ieee80211_ptr;
2059 +       struct cfg80211_csa_settings params;
2060 +       /* csa_attrs is defined static to avoid waste of stack size - this
2061 +        * function is called under RTNL lock, so this should not be a problem.
2062 +        */
2063 +       static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
2064 +       u8 radar_detect_width = 0;
2065 +       int err;
2066 +
2067 +       if (!rdev->ops->channel_switch ||
2068 +           !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
2069 +               return -EOPNOTSUPP;
2070 +
2071 +       /* may add IBSS support later */
2072 +       if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2073 +           dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2074 +               return -EOPNOTSUPP;
2075 +
2076 +       memset(&params, 0, sizeof(params));
2077 +
2078 +       if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
2079 +           !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
2080 +               return -EINVAL;
2081 +
2082 +       /* only important for AP, IBSS and mesh create IEs internally */
2083 +       if (!info->attrs[NL80211_ATTR_CSA_IES])
2084 +               return -EINVAL;
2085 +
2086 +       /* useless if AP is not running */
2087 +       if (!wdev->beacon_interval)
2088 +               return -EINVAL;
2089 +
2090 +       params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
2091 +
2092 +       err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
2093 +       if (err)
2094 +               return err;
2095 +
2096 +       err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
2097 +                              info->attrs[NL80211_ATTR_CSA_IES],
2098 +                              nl80211_policy);
2099 +       if (err)
2100 +               return err;
2101 +
2102 +       err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
2103 +       if (err)
2104 +               return err;
2105 +
2106 +       if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
2107 +               return -EINVAL;
2108 +
2109 +       params.counter_offset_beacon =
2110 +               nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
2111 +       if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
2112 +               return -EINVAL;
2113 +
2114 +       /* sanity check - counters should be the same */
2115 +       if (params.beacon_csa.tail[params.counter_offset_beacon] !=
2116 +           params.count)
2117 +               return -EINVAL;
2118 +
2119 +       if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
2120 +               params.counter_offset_presp =
2121 +                       nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
2122 +               if (params.counter_offset_presp >=
2123 +                   params.beacon_csa.probe_resp_len)
2124 +                       return -EINVAL;
2125 +
2126 +               if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
2127 +                   params.count)
2128 +                       return -EINVAL;
2129 +       }
2130 +
2131 +       err = nl80211_parse_chandef(rdev, info, &params.chandef);
2132 +       if (err)
2133 +               return err;
2134 +
2135 +       if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
2136 +               return -EINVAL;
2137 +
2138 +       err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
2139 +       if (err < 0) {
2140 +               return err;
2141 +       } else if (err) {
2142 +               radar_detect_width = BIT(params.chandef.width);
2143 +               params.radar_required = true;
2144 +       }
2145 +
2146 +       err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
2147 +                                          params.chandef.chan,
2148 +                                          CHAN_MODE_SHARED,
2149 +                                          radar_detect_width);
2150 +       if (err)
2151 +               return err;
2152 +
2153 +       if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
2154 +               params.block_tx = true;
2155 +
2156 +       return rdev_channel_switch(rdev, dev, &params);
2157 +}
2158 +
2159  static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
2160                             u32 seq, int flags,
2161                             struct cfg80211_registered_device *rdev,
2162 @@ -6507,6 +6623,9 @@ static int nl80211_testmode_dump(struct
2163                                            NL80211_CMD_TESTMODE);
2164                 struct nlattr *tmdata;
2165
2166 +               if (!hdr)
2167 +                       break;
2168 +
2169                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
2170                         genlmsg_cancel(skb, hdr);
2171                         break;
2172 @@ -6615,12 +6734,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_ev
2173
2174  void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
2175  {
2176 +       struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
2177         void *hdr = ((void **)skb->cb)[1];
2178         struct nlattr *data = ((void **)skb->cb)[2];
2179
2180         nla_nest_end(skb, data);
2181         genlmsg_end(skb, hdr);
2182 -       genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
2183 +       genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
2184 +                               nl80211_testmode_mcgrp.id, gfp);
2185  }
2186  EXPORT_SYMBOL(cfg80211_testmode_event);
2187  #endif
2188 @@ -6949,9 +7070,8 @@ static int nl80211_remain_on_channel(str
2189
2190         hdr = nl80211hdr_put(msg, genl_info_snd_portid(info), info->snd_seq, 0,
2191                              NL80211_CMD_REMAIN_ON_CHANNEL);
2192 -
2193 -       if (IS_ERR(hdr)) {
2194 -               err = PTR_ERR(hdr);
2195 +       if (!hdr) {
2196 +               err = -ENOBUFS;
2197                 goto free_msg;
2198         }
2199
2200 @@ -7249,9 +7369,8 @@ static int nl80211_tx_mgmt(struct sk_buf
2201
2202                 hdr = nl80211hdr_put(msg, genl_info_snd_portid(info), info->snd_seq, 0,
2203                                      NL80211_CMD_FRAME);
2204 -
2205 -               if (IS_ERR(hdr)) {
2206 -                       err = PTR_ERR(hdr);
2207 +               if (!hdr) {
2208 +                       err = -ENOBUFS;
2209                         goto free_msg;
2210                 }
2211         }
2212 @@ -7593,12 +7712,11 @@ static int nl80211_send_wowlan_patterns(
2213                 if (!nl_pat)
2214                         return -ENOBUFS;
2215                 pat_len = wowlan->patterns[i].pattern_len;
2216 -               if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
2217 -                           DIV_ROUND_UP(pat_len, 8),
2218 +               if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
2219                             wowlan->patterns[i].mask) ||
2220 -                   nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
2221 -                           pat_len, wowlan->patterns[i].pattern) ||
2222 -                   nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
2223 +                   nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
2224 +                           wowlan->patterns[i].pattern) ||
2225 +                   nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
2226                                 wowlan->patterns[i].pkt_offset))
2227                         return -ENOBUFS;
2228                 nla_nest_end(msg, nl_pat);
2229 @@ -7939,7 +8057,7 @@ static int nl80211_set_wowlan(struct sk_
2230                 struct nlattr *pat;
2231                 int n_patterns = 0;
2232                 int rem, pat_len, mask_len, pkt_offset;
2233 -               struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
2234 +               struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
2235
2236                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
2237                                     rem)
2238 @@ -7958,26 +8076,25 @@ static int nl80211_set_wowlan(struct sk_
2239
2240                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
2241                                     rem) {
2242 -                       nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
2243 -                                 nla_data(pat), nla_len(pat), NULL);
2244 +                       nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
2245 +                                 nla_len(pat), NULL);
2246                         err = -EINVAL;
2247 -                       if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
2248 -                           !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
2249 +                       if (!pat_tb[NL80211_PKTPAT_MASK] ||
2250 +                           !pat_tb[NL80211_PKTPAT_PATTERN])
2251                                 goto error;
2252 -                       pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
2253 +                       pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
2254                         mask_len = DIV_ROUND_UP(pat_len, 8);
2255 -                       if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
2256 -                           mask_len)
2257 +                       if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
2258                                 goto error;
2259                         if (pat_len > wowlan->pattern_max_len ||
2260                             pat_len < wowlan->pattern_min_len)
2261                                 goto error;
2262
2263 -                       if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
2264 +                       if (!pat_tb[NL80211_PKTPAT_OFFSET])
2265                                 pkt_offset = 0;
2266                         else
2267                                 pkt_offset = nla_get_u32(
2268 -                                       pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
2269 +                                       pat_tb[NL80211_PKTPAT_OFFSET]);
2270                         if (pkt_offset > wowlan->max_pkt_offset)
2271                                 goto error;
2272                         new_triggers.patterns[i].pkt_offset = pkt_offset;
2273 @@ -7991,11 +8108,11 @@ static int nl80211_set_wowlan(struct sk_
2274                         new_triggers.patterns[i].pattern =
2275                                 new_triggers.patterns[i].mask + mask_len;
2276                         memcpy(new_triggers.patterns[i].mask,
2277 -                              nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
2278 +                              nla_data(pat_tb[NL80211_PKTPAT_MASK]),
2279                                mask_len);
2280                         new_triggers.patterns[i].pattern_len = pat_len;
2281                         memcpy(new_triggers.patterns[i].pattern,
2282 -                              nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
2283 +                              nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
2284                                pat_len);
2285                         i++;
2286                 }
2287 @@ -8130,9 +8247,8 @@ static int nl80211_probe_client(struct s
2288
2289         hdr = nl80211hdr_put(msg, genl_info_snd_portid(info), info->snd_seq, 0,
2290                              NL80211_CMD_PROBE_CLIENT);
2291 -
2292 -       if (IS_ERR(hdr)) {
2293 -               err = PTR_ERR(hdr);
2294 +       if (!hdr) {
2295 +               err = -ENOBUFS;
2296                 goto free_msg;
2297         }
2298
2299 @@ -9041,7 +9157,15 @@ static struct genl_ops nl80211_ops[] = {
2300                 .flags = GENL_ADMIN_PERM,
2301                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
2302                                   NL80211_FLAG_NEED_RTNL,
2303 -       }
2304 +       },
2305 +       {
2306 +               .cmd = NL80211_CMD_CHANNEL_SWITCH,
2307 +               .doit = nl80211_channel_switch,
2308 +               .policy = nl80211_policy,
2309 +               .flags = GENL_ADMIN_PERM,
2310 +               .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
2311 +                                 NL80211_FLAG_NEED_RTNL,
2312 +       },
2313  };
2314
2315  static struct genl_multicast_group nl80211_mlme_mcgrp = {
2316 @@ -10066,7 +10190,8 @@ void cfg80211_mgmt_tx_status(struct wire
2317
2318         genlmsg_end(msg, hdr);
2319
2320 -       genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
2321 +       genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
2322 +                               nl80211_mlme_mcgrp.id, gfp);
2323         return;
2324
2325   nla_put_failure:
2326 --- a/net/wireless/reg.c
2327 +++ b/net/wireless/reg.c
2328 @@ -2247,10 +2247,13 @@ int reg_device_uevent(struct device *dev
2329
2330  void wiphy_regulatory_register(struct wiphy *wiphy)
2331  {
2332 +       struct regulatory_request *lr;
2333 +
2334         if (!reg_dev_ignore_cell_hint(wiphy))
2335                 reg_num_devs_support_basehint++;
2336
2337 -       wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
2338 +       lr = get_last_request();
2339 +       wiphy_update_regulatory(wiphy, lr->initiator);
2340  }
2341
2342  void wiphy_regulatory_deregister(struct wiphy *wiphy)
2343 @@ -2279,7 +2282,9 @@ void wiphy_regulatory_deregister(struct
2344  static void reg_timeout_work(struct work_struct *work)
2345  {
2346         REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
2347 +       rtnl_lock();
2348         restore_regulatory_settings(true);
2349 +       rtnl_unlock();
2350  }
2351
2352  int __init regulatory_init(void)
2353 --- a/net/wireless/sme.c
2354 +++ b/net/wireless/sme.c
2355 @@ -34,8 +34,10 @@ struct cfg80211_conn {
2356                 CFG80211_CONN_SCAN_AGAIN,
2357                 CFG80211_CONN_AUTHENTICATE_NEXT,
2358                 CFG80211_CONN_AUTHENTICATING,
2359 +               CFG80211_CONN_AUTH_FAILED,
2360                 CFG80211_CONN_ASSOCIATE_NEXT,
2361                 CFG80211_CONN_ASSOCIATING,
2362 +               CFG80211_CONN_ASSOC_FAILED,
2363                 CFG80211_CONN_DEAUTH,
2364                 CFG80211_CONN_CONNECTED,
2365         } state;
2366 @@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct
2367                                           NULL, 0,
2368                                           params->key, params->key_len,
2369                                           params->key_idx, NULL, 0);
2370 +       case CFG80211_CONN_AUTH_FAILED:
2371 +               return -ENOTCONN;
2372         case CFG80211_CONN_ASSOCIATE_NEXT:
2373                 BUG_ON(!rdev->ops->assoc);
2374                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
2375 @@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct
2376                                              WLAN_REASON_DEAUTH_LEAVING,
2377                                              false);
2378                 return err;
2379 +       case CFG80211_CONN_ASSOC_FAILED:
2380 +               cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
2381 +                                    NULL, 0,
2382 +                                    WLAN_REASON_DEAUTH_LEAVING, false);
2383 +               return -ENOTCONN;
2384         case CFG80211_CONN_DEAUTH:
2385                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
2386                                      NULL, 0,
2387                                      WLAN_REASON_DEAUTH_LEAVING, false);
2388 +               /* free directly, disconnected event already sent */
2389 +               cfg80211_sme_free(wdev);
2390                 return 0;
2391         default:
2392                 return 0;
2393 @@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct w
2394                 return true;
2395         }
2396
2397 -       wdev->conn->state = CFG80211_CONN_DEAUTH;
2398 +       wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
2399         schedule_work(&rdev->conn_work);
2400         return false;
2401  }
2402 @@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless
2403
2404  void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
2405  {
2406 -       cfg80211_sme_free(wdev);
2407 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
2408 +
2409 +       if (!wdev->conn)
2410 +               return;
2411 +
2412 +       wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
2413 +       schedule_work(&rdev->conn_work);
2414  }
2415
2416  void cfg80211_sme_disassoc(struct wireless_dev *wdev)
2417 @@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wirele
2418
2419  void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
2420  {
2421 -       cfg80211_sme_disassoc(wdev);
2422 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
2423 +
2424 +       if (!wdev->conn)
2425 +               return;
2426 +
2427 +       wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
2428 +       schedule_work(&rdev->conn_work);
2429  }
2430
2431  static int cfg80211_sme_connect(struct wireless_dev *wdev,
2432 @@ -953,21 +976,19 @@ int cfg80211_disconnect(struct cfg80211_
2433                         struct net_device *dev, u16 reason, bool wextev)
2434  {
2435         struct wireless_dev *wdev = dev->ieee80211_ptr;
2436 -       int err;
2437 +       int err = 0;
2438
2439         ASSERT_WDEV_LOCK(wdev);
2440
2441         kfree(wdev->connect_keys);
2442         wdev->connect_keys = NULL;
2443
2444 -       if (wdev->conn) {
2445 +       if (wdev->conn)
2446                 err = cfg80211_sme_disconnect(wdev, reason);
2447 -       } else if (!rdev->ops->disconnect) {
2448 +       else if (!rdev->ops->disconnect)
2449                 cfg80211_mlme_down(rdev, dev);
2450 -               err = 0;
2451 -       } else {
2452 +       else if (wdev->current_bss)
2453                 err = rdev_disconnect(rdev, dev, reason);
2454 -       }
2455
2456         return err;
2457  }
2458 --- a/net/mac80211/rc80211_minstrel.c
2459 +++ b/net/mac80211/rc80211_minstrel.c
2460 @@ -203,6 +203,15 @@ minstrel_update_stats(struct minstrel_pr
2461         memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
2462         mi->max_prob_rate = tmp_prob_rate;
2463
2464 +#ifdef CPTCFG_MAC80211_DEBUGFS
2465 +       /* use fixed index if set */
2466 +       if (mp->fixed_rate_idx != -1) {
2467 +               mi->max_tp_rate[0] = mp->fixed_rate_idx;
2468 +               mi->max_tp_rate[1] = mp->fixed_rate_idx;
2469 +               mi->max_prob_rate = mp->fixed_rate_idx;
2470 +       }
2471 +#endif
2472 +
2473         /* Reset update timer */
2474         mi->stats_update = jiffies;
2475
2476 @@ -290,7 +299,7 @@ minstrel_get_rate(void *priv, struct iee
2477         struct minstrel_rate *msr, *mr;
2478         unsigned int ndx;
2479         bool mrr_capable;
2480 -       bool prev_sample = mi->prev_sample;
2481 +       bool prev_sample;
2482         int delta;
2483         int sampling_ratio;
2484
2485 @@ -310,10 +319,16 @@ minstrel_get_rate(void *priv, struct iee
2486         /* increase sum packet counter */
2487         mi->packet_count++;
2488
2489 +#ifdef CPTCFG_MAC80211_DEBUGFS
2490 +       if (mp->fixed_rate_idx != -1)
2491 +               return;
2492 +#endif
2493 +
2494         delta = (mi->packet_count * sampling_ratio / 100) -
2495                         (mi->sample_count + mi->sample_deferred / 2);
2496
2497         /* delta < 0: no sampling required */
2498 +       prev_sample = mi->prev_sample;
2499         mi->prev_sample = false;
2500         if (delta < 0 || (!mrr_capable && prev_sample))
2501                 return;
2502 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
2503 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
2504 @@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_
2505         spin_unlock_irqrestore(&queue->index_lock, irqflags);
2506  }
2507
2508 -void rt2x00queue_pause_queue(struct data_queue *queue)
2509 +void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
2510  {
2511 -       if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
2512 -           !test_bit(QUEUE_STARTED, &queue->flags) ||
2513 -           test_and_set_bit(QUEUE_PAUSED, &queue->flags))
2514 -               return;
2515 -
2516         switch (queue->qid) {
2517         case QID_AC_VO:
2518         case QID_AC_VI:
2519 @@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data
2520                 break;
2521         }
2522  }
2523 +void rt2x00queue_pause_queue(struct data_queue *queue)
2524 +{
2525 +       if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
2526 +           !test_bit(QUEUE_STARTED, &queue->flags) ||
2527 +           test_and_set_bit(QUEUE_PAUSED, &queue->flags))
2528 +               return;
2529 +
2530 +       rt2x00queue_pause_queue_nocheck(queue);
2531 +}
2532  EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
2533
2534  void rt2x00queue_unpause_queue(struct data_queue *queue)
2535 @@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_
2536                 return;
2537         }
2538
2539 -       rt2x00queue_pause_queue(queue);
2540 +       rt2x00queue_pause_queue_nocheck(queue);
2541
2542         queue->rt2x00dev->ops->lib->stop_queue(queue);
2543
2544 --- a/net/mac80211/mlme.c
2545 +++ b/net/mac80211/mlme.c
2546 @@ -31,10 +31,12 @@
2547  #include "led.h"
2548
2549  #define IEEE80211_AUTH_TIMEOUT         (HZ / 5)
2550 +#define IEEE80211_AUTH_TIMEOUT_LONG    (HZ / 2)
2551  #define IEEE80211_AUTH_TIMEOUT_SHORT   (HZ / 10)
2552  #define IEEE80211_AUTH_MAX_TRIES       3
2553  #define IEEE80211_AUTH_WAIT_ASSOC      (HZ * 5)
2554  #define IEEE80211_ASSOC_TIMEOUT                (HZ / 5)
2555 +#define IEEE80211_ASSOC_TIMEOUT_LONG   (HZ / 2)
2556  #define IEEE80211_ASSOC_TIMEOUT_SHORT  (HZ / 10)
2557  #define IEEE80211_ASSOC_MAX_TRIES      3
2558
2559 @@ -209,8 +211,9 @@ ieee80211_determine_chantype(struct ieee
2560                              struct ieee80211_channel *channel,
2561                              const struct ieee80211_ht_operation *ht_oper,
2562                              const struct ieee80211_vht_operation *vht_oper,
2563 -                            struct cfg80211_chan_def *chandef, bool verbose)
2564 +                            struct cfg80211_chan_def *chandef, bool tracking)
2565  {
2566 +       struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2567         struct cfg80211_chan_def vht_chandef;
2568         u32 ht_cfreq, ret;
2569
2570 @@ -229,7 +232,7 @@ ieee80211_determine_chantype(struct ieee
2571         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
2572                                                   channel->band);
2573         /* check that channel matches the right operating channel */
2574 -       if (channel->center_freq != ht_cfreq) {
2575 +       if (!tracking && channel->center_freq != ht_cfreq) {
2576                 /*
2577                  * It's possible that some APs are confused here;
2578                  * Netgear WNDR3700 sometimes reports 4 higher than
2579 @@ -237,11 +240,10 @@ ieee80211_determine_chantype(struct ieee
2580                  * since we look at probe response/beacon data here
2581                  * it should be OK.
2582                  */
2583 -               if (verbose)
2584 -                       sdata_info(sdata,
2585 -                                  "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
2586 -                                  channel->center_freq, ht_cfreq,
2587 -                                  ht_oper->primary_chan, channel->band);
2588 +               sdata_info(sdata,
2589 +                          "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
2590 +                          channel->center_freq, ht_cfreq,
2591 +                          ht_oper->primary_chan, channel->band);
2592                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
2593                 goto out;
2594         }
2595 @@ -295,7 +297,7 @@ ieee80211_determine_chantype(struct ieee
2596                                 channel->band);
2597                 break;
2598         default:
2599 -               if (verbose)
2600 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2601                         sdata_info(sdata,
2602                                    "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
2603                                    vht_oper->chan_width);
2604 @@ -304,7 +306,7 @@ ieee80211_determine_chantype(struct ieee
2605         }
2606
2607         if (!cfg80211_chandef_valid(&vht_chandef)) {
2608 -               if (verbose)
2609 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2610                         sdata_info(sdata,
2611                                    "AP VHT information is invalid, disable VHT\n");
2612                 ret = IEEE80211_STA_DISABLE_VHT;
2613 @@ -317,7 +319,7 @@ ieee80211_determine_chantype(struct ieee
2614         }
2615
2616         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
2617 -               if (verbose)
2618 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2619                         sdata_info(sdata,
2620                                    "AP VHT information doesn't match HT, disable VHT\n");
2621                 ret = IEEE80211_STA_DISABLE_VHT;
2622 @@ -333,18 +335,27 @@ out:
2623         if (ret & IEEE80211_STA_DISABLE_VHT)
2624                 vht_chandef = *chandef;
2625
2626 +       /*
2627 +        * Ignore the DISABLED flag when we're already connected and only
2628 +        * tracking the APs beacon for bandwidth changes - otherwise we
2629 +        * might get disconnected here if we connect to an AP, update our
2630 +        * regulatory information based on the AP's country IE and the
2631 +        * information we have is wrong/outdated and disables the channel
2632 +        * that we're actually using for the connection to the AP.
2633 +        */
2634         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
2635 -                                       IEEE80211_CHAN_DISABLED)) {
2636 +                                       tracking ? 0 :
2637 +                                                  IEEE80211_CHAN_DISABLED)) {
2638                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
2639                         ret = IEEE80211_STA_DISABLE_HT |
2640                               IEEE80211_STA_DISABLE_VHT;
2641 -                       goto out;
2642 +                       break;
2643                 }
2644
2645                 ret |= chandef_downgrade(chandef);
2646         }
2647
2648 -       if (chandef->width != vht_chandef.width && verbose)
2649 +       if (chandef->width != vht_chandef.width && !tracking)
2650                 sdata_info(sdata,
2651                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
2652
2653 @@ -384,7 +395,7 @@ static int ieee80211_config_bw(struct ie
2654
2655         /* calculate new channel (type) based on HT/VHT operation IEs */
2656         flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
2657 -                                            vht_oper, &chandef, false);
2658 +                                            vht_oper, &chandef, true);
2659
2660         /*
2661          * Downgrade the new channel if we associated with restricted
2662 @@ -1043,6 +1054,13 @@ ieee80211_sta_process_chanswitch(struct
2663                 if (!ieee80211_operating_class_to_band(
2664                                 elems->ext_chansw_ie->new_operating_class,
2665                                 &new_band)) {
2666 +                       /*
2667 +                        * Some APs send invalid ECSA IEs in probe response
2668 +                        * frames, so check for these and ignore them.
2669 +                        */
2670 +                       if (beacon && elems->ext_chansw_ie->new_ch_num == 0 &&
2671 +                           elems->ext_chansw_ie->new_operating_class == 0)
2672 +                               return;
2673                         sdata_info(sdata,
2674                                    "cannot understand ECSA IE operating class %d, disconnecting\n",
2675                                    elems->ext_chansw_ie->new_operating_class);
2676 @@ -1110,6 +1128,15 @@ ieee80211_sta_process_chanswitch(struct
2677         case -1:
2678                 cfg80211_chandef_create(&new_chandef, new_chan,
2679                                         NL80211_CHAN_NO_HT);
2680 +               /* keep width for 5/10 MHz channels */
2681 +               switch (sdata->vif.bss_conf.chandef.width) {
2682 +               case NL80211_CHAN_WIDTH_5:
2683 +               case NL80211_CHAN_WIDTH_10:
2684 +                       new_chandef.width = sdata->vif.bss_conf.chandef.width;
2685 +                       break;
2686 +               default:
2687 +                       break;
2688 +               }
2689                 break;
2690         }
2691
2692 @@ -3394,10 +3421,13 @@ static int ieee80211_probe_auth(struct i
2693
2694         if (tx_flags == 0) {
2695                 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
2696 -               ifmgd->auth_data->timeout_started = true;
2697 +               auth_data->timeout_started = true;
2698                 run_again(sdata, auth_data->timeout);
2699         } else {
2700 -               auth_data->timeout_started = false;
2701 +               auth_data->timeout =
2702 +                       round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
2703 +               auth_data->timeout_started = true;
2704 +               run_again(sdata, auth_data->timeout);
2705         }
2706
2707         return 0;
2708 @@ -3434,7 +3464,11 @@ static int ieee80211_do_assoc(struct iee
2709                 assoc_data->timeout_started = true;
2710                 run_again(sdata, assoc_data->timeout);
2711         } else {
2712 -               assoc_data->timeout_started = false;
2713 +               assoc_data->timeout =
2714 +                       round_jiffies_up(jiffies +
2715 +                                        IEEE80211_ASSOC_TIMEOUT_LONG);
2716 +               assoc_data->timeout_started = true;
2717 +               run_again(sdata, assoc_data->timeout);
2718         }
2719
2720         return 0;
2721 @@ -3829,7 +3863,7 @@ static int ieee80211_prep_channel(struct
2722         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
2723                                                      cbss->channel,
2724                                                      ht_oper, vht_oper,
2725 -                                                    &chandef, true);
2726 +                                                    &chandef, false);
2727
2728         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
2729                                       local->rx_chains);
2730 --- a/net/wireless/core.c
2731 +++ b/net/wireless/core.c
2732 @@ -772,6 +772,7 @@ void cfg80211_leave(struct cfg80211_regi
2733                 cfg80211_leave_mesh(rdev, dev);
2734                 break;
2735         case NL80211_IFTYPE_AP:
2736 +       case NL80211_IFTYPE_P2P_GO:
2737                 cfg80211_stop_ap(rdev, dev);
2738                 break;
2739         default:
2740 --- a/drivers/net/wireless/rtlwifi/Kconfig
2741 +++ b/drivers/net/wireless/rtlwifi/Kconfig
2742 @@ -1,29 +1,22 @@
2743 -config RTLWIFI
2744 -       tristate "Realtek wireless card support"
2745 +menuconfig RTL_CARDS
2746 +       tristate "Realtek rtlwifi family of devices"
2747         depends on m
2748 -       depends on MAC80211
2749 -       select BACKPORT_FW_LOADER
2750 -       ---help---
2751 -         This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
2752 -         drivers.  This module does nothing by itself - the various front-end
2753 -         drivers need to be enabled to support any desired devices.
2754 -
2755 -         If you choose to build as a module, it'll be called rtlwifi.
2756 -
2757 -config RTLWIFI_DEBUG
2758 -       bool "Debugging output for rtlwifi driver family"
2759 -       depends on RTLWIFI
2760 +       depends on MAC80211 && (PCI || USB)
2761         default y
2762         ---help---
2763 -       To use the module option that sets the dynamic-debugging level for,
2764 -       the front-end driver, this parameter must be "Y". For memory-limited
2765 -       systems, choose "N". If in doubt, choose "Y".
2766 +         This option will enable support for the Realtek mac80211-based
2767 +         wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
2768 +         rtl8723eu, and rtl8188eu share some common code.
2769 +
2770 +if RTL_CARDS
2771
2772  config RTL8192CE
2773         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
2774         depends on m
2775 -       depends on RTLWIFI && PCI
2776 +       depends on PCI
2777         select RTL8192C_COMMON
2778 +       select RTLWIFI
2779 +       select RTLWIFI_PCI
2780         ---help---
2781         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
2782         wireless network adapters.
2783 @@ -33,7 +26,9 @@ config RTL8192CE
2784  config RTL8192SE
2785         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
2786         depends on m
2787 -       depends on RTLWIFI && PCI
2788 +       depends on PCI
2789 +       select RTLWIFI
2790 +       select RTLWIFI_PCI
2791         ---help---
2792         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
2793         wireless network adapters.
2794 @@ -43,7 +38,9 @@ config RTL8192SE
2795  config RTL8192DE
2796         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
2797         depends on m
2798 -       depends on RTLWIFI && PCI
2799 +       depends on PCI
2800 +       select RTLWIFI
2801 +       select RTLWIFI_PCI
2802         ---help---
2803         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
2804         wireless network adapters.
2805 @@ -53,7 +50,9 @@ config RTL8192DE
2806  config RTL8723AE
2807         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
2808         depends on m
2809 -       depends on RTLWIFI && PCI
2810 +       depends on PCI
2811 +       select RTLWIFI
2812 +       select RTLWIFI_PCI
2813         ---help---
2814         This is the driver for Realtek RTL8723AE 802.11n PCIe
2815         wireless network adapters.
2816 @@ -63,7 +62,9 @@ config RTL8723AE
2817  config RTL8188EE
2818         tristate "Realtek RTL8188EE Wireless Network Adapter"
2819         depends on m
2820 -       depends on RTLWIFI && PCI
2821 +       depends on PCI
2822 +       select RTLWIFI
2823 +       select RTLWIFI_PCI
2824         ---help---
2825         This is the driver for Realtek RTL8188EE 802.11n PCIe
2826         wireless network adapters.
2827 @@ -73,7 +74,9 @@ config RTL8188EE
2828  config RTL8192CU
2829         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
2830         depends on m
2831 -       depends on RTLWIFI && USB
2832 +       depends on USB
2833 +       select RTLWIFI
2834 +       select RTLWIFI_USB
2835         select RTL8192C_COMMON
2836         ---help---
2837         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
2838 @@ -81,8 +84,32 @@ config RTL8192CU
2839
2840         If you choose to build it as a module, it will be called rtl8192cu
2841
2842 +config RTLWIFI
2843 +       tristate
2844 +       depends on m
2845 +       select BACKPORT_FW_LOADER
2846 +
2847 +config RTLWIFI_PCI
2848 +       tristate
2849 +       depends on m
2850 +
2851 +config RTLWIFI_USB
2852 +       tristate
2853 +       depends on m
2854 +
2855 +config RTLWIFI_DEBUG
2856 +       bool "Debugging output for rtlwifi driver family"
2857 +       depends on RTLWIFI
2858 +       default y
2859 +       ---help---
2860 +       To use the module option that sets the dynamic-debugging level for,
2861 +       the front-end driver, this parameter must be "Y". For memory-limited
2862 +       systems, choose "N". If in doubt, choose "Y".
2863 +
2864  config RTL8192C_COMMON
2865         tristate
2866         depends on m
2867         depends on RTL8192CE || RTL8192CU
2868 -       default m
2869 +       default y
2870 +
2871 +endif
2872 --- a/drivers/net/wireless/rtlwifi/Makefile
2873 +++ b/drivers/net/wireless/rtlwifi/Makefile
2874 @@ -12,13 +12,11 @@ rtlwifi-objs        :=              \
2875
2876  rtl8192c_common-objs +=                \
2877
2878 -ifneq ($(CONFIG_PCI),)
2879 -rtlwifi-objs   += pci.o
2880 -endif
2881 +obj-$(CPTCFG_RTLWIFI_PCI)      += rtl_pci.o
2882 +rtl_pci-objs   :=              pci.o
2883
2884 -ifneq ($(CONFIG_USB),)
2885 -rtlwifi-objs   += usb.o
2886 -endif
2887 +obj-$(CPTCFG_RTLWIFI_USB)      += rtl_usb.o
2888 +rtl_usb-objs   :=              usb.o
2889
2890  obj-$(CPTCFG_RTL8192C_COMMON)  += rtl8192c/
2891  obj-$(CPTCFG_RTL8192CE)                += rtl8192ce/
2892 --- a/drivers/net/wireless/rtlwifi/ps.h
2893 +++ b/drivers/net/wireless/rtlwifi/ps.h
2894 @@ -49,5 +49,6 @@ void rtl_swlps_rf_awake(struct ieee80211
2895  void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
2896  void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
2897  void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
2898 +void rtl_lps_change_work_callback(struct work_struct *work);
2899
2900  #endif
2901 --- a/drivers/net/wireless/rtlwifi/base.c
2902 +++ b/drivers/net/wireless/rtlwifi/base.c
2903 @@ -173,6 +173,7 @@ u8 rtl_tid_to_ac(u8 tid)
2904  {
2905         return tid_to_ac[tid];
2906  }
2907 +EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
2908
2909  static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
2910                                   struct ieee80211_sta_ht_cap *ht_cap)
2911 @@ -407,6 +408,7 @@ void rtl_deinit_deferred_work(struct iee
2912         cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
2913         cancel_delayed_work(&rtlpriv->works.fwevt_wq);
2914  }
2915 +EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
2916
2917  void rtl_init_rfkill(struct ieee80211_hw *hw)
2918  {
2919 @@ -440,6 +442,7 @@ void rtl_deinit_rfkill(struct ieee80211_
2920  {
2921         wiphy_rfkill_stop_polling(hw->wiphy);
2922  }
2923 +EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
2924
2925  int rtl_init_core(struct ieee80211_hw *hw)
2926  {
2927 @@ -490,10 +493,12 @@ int rtl_init_core(struct ieee80211_hw *h
2928
2929         return 0;
2930  }
2931 +EXPORT_SYMBOL_GPL(rtl_init_core);
2932
2933  void rtl_deinit_core(struct ieee80211_hw *hw)
2934  {
2935  }
2936 +EXPORT_SYMBOL_GPL(rtl_deinit_core);
2937
2938  void rtl_init_rx_config(struct ieee80211_hw *hw)
2939  {
2940 @@ -502,6 +507,7 @@ void rtl_init_rx_config(struct ieee80211
2941
2942         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
2943  }
2944 +EXPORT_SYMBOL_GPL(rtl_init_rx_config);
2945
2946  /*********************************************************
2947   *
2948 @@ -880,6 +886,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_h
2949
2950         return true;
2951  }
2952 +EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
2953
2954  void rtl_get_tcb_desc(struct ieee80211_hw *hw,
2955                       struct ieee80211_tx_info *info,
2956 @@ -1053,6 +1060,7 @@ bool rtl_action_proc(struct ieee80211_hw
2957
2958         return true;
2959  }
2960 +EXPORT_SYMBOL_GPL(rtl_action_proc);
2961
2962  /*should call before software enc*/
2963  u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
2964 @@ -1126,6 +1134,7 @@ u8 rtl_is_special_data(struct ieee80211_
2965
2966         return false;
2967  }
2968 +EXPORT_SYMBOL_GPL(rtl_is_special_data);
2969
2970  /*********************************************************
2971   *
2972 @@ -1301,6 +1310,7 @@ void rtl_beacon_statistic(struct ieee802
2973
2974         rtlpriv->link_info.bcn_rx_inperiod++;
2975  }
2976 +EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
2977
2978  void rtl_watchdog_wq_callback(void *data)
2979  {
2980 @@ -1794,6 +1804,7 @@ void rtl_recognize_peer(struct ieee80211
2981
2982         mac->vendor = vendor;
2983  }
2984 +EXPORT_SYMBOL_GPL(rtl_recognize_peer);
2985
2986  /*********************************************************
2987   *
2988 @@ -1850,6 +1861,7 @@ struct attribute_group rtl_attribute_gro
2989         .name = "rtlsysfs",
2990         .attrs = rtl_sysfs_entries,
2991  };
2992 +EXPORT_SYMBOL_GPL(rtl_attribute_group);
2993
2994  MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
2995  MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
2996 @@ -1857,7 +1869,8 @@ MODULE_AUTHOR("Larry Finger       <Larry.FInge
2997  MODULE_LICENSE("GPL");
2998  MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
2999
3000 -struct rtl_global_var global_var = {};
3001 +struct rtl_global_var rtl_global_var = {};
3002 +EXPORT_SYMBOL_GPL(rtl_global_var);
3003
3004  static int __init rtl_core_module_init(void)
3005  {
3006 @@ -1865,8 +1878,8 @@ static int __init rtl_core_module_init(v
3007                 pr_err("Unable to register rtl_rc, use default RC !!\n");
3008
3009         /* init some global vars */
3010 -       INIT_LIST_HEAD(&global_var.glb_priv_list);
3011 -       spin_lock_init(&global_var.glb_list_lock);
3012 +       INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
3013 +       spin_lock_init(&rtl_global_var.glb_list_lock);
3014
3015         return 0;
3016  }
3017 --- a/drivers/net/wireless/rtlwifi/base.h
3018 +++ b/drivers/net/wireless/rtlwifi/base.h
3019 @@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211
3020  u8 rtl_tid_to_ac(u8 tid);
3021  extern struct attribute_group rtl_attribute_group;
3022  void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
3023 -extern struct rtl_global_var global_var;
3024 +extern struct rtl_global_var rtl_global_var;
3025  int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
3026                          bool isht, u8 desc_rate, bool first_ampdu);
3027  bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
3028 --- a/drivers/net/wireless/rtlwifi/core.c
3029 +++ b/drivers/net/wireless/rtlwifi/core.c
3030 @@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
3031         .rfkill_poll = rtl_op_rfkill_poll,
3032         .flush = rtl_op_flush,
3033  };
3034 +EXPORT_SYMBOL_GPL(rtl_ops);
3035 --- a/drivers/net/wireless/rtlwifi/debug.c
3036 +++ b/drivers/net/wireless/rtlwifi/debug.c
3037 @@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211
3038
3039         /*Init Debug flag enable condition */
3040  }
3041 +EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
3042 --- a/drivers/net/wireless/rtlwifi/efuse.c
3043 +++ b/drivers/net/wireless/rtlwifi/efuse.c
3044 @@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw
3045
3046         *pbuf = (u8) (value32 & 0xff);
3047  }
3048 +EXPORT_SYMBOL_GPL(read_efuse_byte);
3049
3050  void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
3051  {
3052 --- a/drivers/net/wireless/rtlwifi/pci.c
3053 +++ b/drivers/net/wireless/rtlwifi/pci.c
3054 @@ -35,6 +35,13 @@
3055  #include "efuse.h"
3056  #include <linux/export.h>
3057  #include <linux/kmemleak.h>
3058 +#include <linux/module.h>
3059 +
3060 +MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
3061 +MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
3062 +MODULE_AUTHOR("Larry Finger    <Larry.FInger@lwfinger.net>");
3063 +MODULE_LICENSE("GPL");
3064 +MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
3065
3066  static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
3067         PCI_VENDOR_ID_INTEL,
3068 @@ -1008,19 +1015,6 @@ static void _rtl_pci_prepare_bcn_tasklet
3069         return;
3070  }
3071
3072 -static void rtl_lps_change_work_callback(struct work_struct *work)
3073 -{
3074 -       struct rtl_works *rtlworks =
3075 -           container_of(work, struct rtl_works, lps_change_work);
3076 -       struct ieee80211_hw *hw = rtlworks->hw;
3077 -       struct rtl_priv *rtlpriv = rtl_priv(hw);
3078 -
3079 -       if (rtlpriv->enter_ps)
3080 -               rtl_lps_enter(hw);
3081 -       else
3082 -               rtl_lps_leave(hw);
3083 -}
3084 -
3085  static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
3086  {
3087         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
3088 @@ -1899,7 +1893,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
3089         rtlpriv->rtlhal.interface = INTF_PCI;
3090         rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
3091         rtlpriv->intf_ops = &rtl_pci_ops;
3092 -       rtlpriv->glb_var = &global_var;
3093 +       rtlpriv->glb_var = &rtl_global_var;
3094
3095         /*
3096          *init dbgp flags before all
3097 --- a/drivers/net/wireless/rtlwifi/ps.c
3098 +++ b/drivers/net/wireless/rtlwifi/ps.c
3099 @@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw
3100
3101         spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
3102  }
3103 +EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
3104
3105  /*for FW LPS*/
3106
3107 @@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_h
3108                          "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
3109         }
3110  }
3111 +EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
3112
3113  void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
3114  {
3115 @@ -611,6 +613,19 @@ void rtl_swlps_rf_sleep(struct ieee80211
3116                         MSECS(sleep_intv * mac->vif->bss_conf.beacon_int - 40));
3117  }
3118
3119 +void rtl_lps_change_work_callback(struct work_struct *work)
3120 +{
3121 +       struct rtl_works *rtlworks =
3122 +           container_of(work, struct rtl_works, lps_change_work);
3123 +       struct ieee80211_hw *hw = rtlworks->hw;
3124 +       struct rtl_priv *rtlpriv = rtl_priv(hw);
3125 +
3126 +       if (rtlpriv->enter_ps)
3127 +               rtl_lps_enter(hw);
3128 +       else
3129 +               rtl_lps_leave(hw);
3130 +}
3131 +EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
3132
3133  void rtl_swlps_wq_callback(void *data)
3134  {
3135 @@ -922,3 +937,4 @@ void rtl_p2p_info(struct ieee80211_hw *h
3136         else
3137                 rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
3138  }
3139 +EXPORT_SYMBOL_GPL(rtl_p2p_info);
3140 --- a/drivers/net/wireless/rtlwifi/usb.c
3141 +++ b/drivers/net/wireless/rtlwifi/usb.c
3142 @@ -32,6 +32,13 @@
3143  #include "ps.h"
3144  #include "rtl8192c/fw_common.h"
3145  #include <linux/export.h>
3146 +#include <linux/module.h>
3147 +
3148 +MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
3149 +MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
3150 +MODULE_AUTHOR("Larry Finger    <Larry.FInger@lwfinger.net>");
3151 +MODULE_LICENSE("GPL");
3152 +MODULE_DESCRIPTION("USB basic driver for rtlwifi");
3153
3154  #define        REALTEK_USB_VENQT_READ                  0xC0
3155  #define        REALTEK_USB_VENQT_WRITE                 0x40
3156 @@ -1070,6 +1077,8 @@ int rtl_usb_probe(struct usb_interface *
3157         spin_lock_init(&rtlpriv->locks.usb_lock);
3158         INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
3159                   rtl_fill_h2c_cmd_work_callback);
3160 +       INIT_WORK(&rtlpriv->works.lps_change_work,
3161 +                 rtl_lps_change_work_callback);
3162
3163         rtlpriv->usb_data_index = 0;
3164         init_completion(&rtlpriv->firmware_loading_complete);
3165 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
3166 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
3167 @@ -72,17 +72,12 @@ struct ath_config {
3168  /*************************/
3169
3170  #define ATH_TXBUF_RESET(_bf) do {                              \
3171 -               (_bf)->bf_stale = false;                        \
3172                 (_bf)->bf_lastbf = NULL;                        \
3173                 (_bf)->bf_next = NULL;                          \
3174                 memset(&((_bf)->bf_state), 0,                   \
3175                        sizeof(struct ath_buf_state));           \
3176         } while (0)
3177
3178 -#define ATH_RXBUF_RESET(_bf) do {              \
3179 -               (_bf)->bf_stale = false;        \
3180 -       } while (0)
3181 -
3182  /**
3183   * enum buffer_type - Buffer type flags
3184   *
3185 @@ -137,7 +132,8 @@ int ath_descdma_setup(struct ath_softc *
3186  #define ATH_AGGR_ENCRYPTDELIM      10
3187  /* minimum h/w qdepth to be sustained to maximize aggregation */
3188  #define ATH_AGGR_MIN_QDEPTH        2
3189 -#define ATH_AMPDU_SUBFRAME_DEFAULT 32
3190 +/* minimum h/w qdepth for non-aggregated traffic */
3191 +#define ATH_NON_AGGR_MIN_QDEPTH    8
3192
3193  #define IEEE80211_SEQ_SEQ_SHIFT    4
3194  #define IEEE80211_SEQ_MAX          4096
3195 @@ -174,12 +170,6 @@ int ath_descdma_setup(struct ath_softc *
3196
3197  #define ATH_TX_COMPLETE_POLL_INT       1000
3198
3199 -enum ATH_AGGR_STATUS {
3200 -       ATH_AGGR_DONE,
3201 -       ATH_AGGR_BAW_CLOSED,
3202 -       ATH_AGGR_LIMITED,
3203 -};
3204 -
3205  #define ATH_TXFIFO_DEPTH 8
3206  struct ath_txq {
3207         int mac80211_qnum; /* mac80211 queue number, -1 means not mac80211 Q */
3208 @@ -201,10 +191,10 @@ struct ath_txq {
3209
3210  struct ath_atx_ac {
3211         struct ath_txq *txq;
3212 -       int sched;
3213         struct list_head list;
3214         struct list_head tid_q;
3215         bool clear_ps_filter;
3216 +       bool sched;
3217  };
3218
3219  struct ath_frame_info {
3220 @@ -212,14 +202,16 @@ struct ath_frame_info {
3221         int framelen;
3222         enum ath9k_key_type keytype;
3223         u8 keyix;
3224 -       u8 retries;
3225         u8 rtscts_rate;
3226 +       u8 retries : 7;
3227 +       u8 baw_tracked : 1;
3228  };
3229
3230  struct ath_buf_state {
3231         u8 bf_type;
3232         u8 bfs_paprd;
3233         u8 ndelim;
3234 +       bool stale;
3235         u16 seqno;
3236         unsigned long bfs_paprd_timestamp;
3237  };
3238 @@ -233,7 +225,6 @@ struct ath_buf {
3239         void *bf_desc;                  /* virtual addr of desc */
3240         dma_addr_t bf_daddr;            /* physical addr of desc */
3241         dma_addr_t bf_buf_addr; /* physical addr of data buffer, for DMA */
3242 -       bool bf_stale;
3243         struct ieee80211_tx_rate rates[4];
3244         struct ath_buf_state bf_state;
3245  };
3246 @@ -241,16 +232,18 @@ struct ath_buf {
3247  struct ath_atx_tid {
3248         struct list_head list;
3249         struct sk_buff_head buf_q;
3250 +       struct sk_buff_head retry_q;
3251         struct ath_node *an;
3252         struct ath_atx_ac *ac;
3253         unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
3254 -       int bar_index;
3255         u16 seq_start;
3256         u16 seq_next;
3257         u16 baw_size;
3258 -       int tidno;
3259 +       u8 tidno;
3260         int baw_head;   /* first un-acked tx buffer */
3261         int baw_tail;   /* next unused tx buffer slot */
3262 +
3263 +       s8 bar_index;
3264         bool sched;
3265         bool paused;
3266         bool active;
3267 @@ -262,12 +255,13 @@ struct ath_node {
3268         struct ieee80211_vif *vif; /* interface with which we're associated */
3269         struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
3270         struct ath_atx_ac ac[IEEE80211_NUM_ACS];
3271 -       int ps_key;
3272
3273         u16 maxampdu;
3274         u8 mpdudensity;
3275 +       s8 ps_key;
3276
3277         bool sleeping;
3278 +       bool no_ps_filter;
3279
3280  #if defined(CPTCFG_MAC80211_DEBUGFS) && defined(CPTCFG_ATH9K_DEBUGFS)
3281         struct dentry *node_stat;
3282 @@ -317,6 +311,7 @@ struct ath_rx {
3283         struct ath_descdma rxdma;
3284         struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
3285
3286 +       struct ath_buf *buf_hold;
3287         struct sk_buff *frag;
3288
3289         u32 ampdu_ref;
3290 @@ -367,6 +362,7 @@ void ath9k_release_buffered_frames(struc
3291  /********/
3292
3293  struct ath_vif {
3294 +       struct ath_node mcast_node;
3295         int av_bslot;
3296         bool primary_sta_vif;
3297         __le64 tsf_adjust; /* TSF adjustment for staggered beacons */
3298 @@ -585,19 +581,14 @@ static inline void ath_fill_led_pin(stru
3299  #define ATH_ANT_DIV_COMB_MAX_COUNT 100
3300  #define ATH_ANT_DIV_COMB_ALT_ANT_RATIO 30
3301  #define ATH_ANT_DIV_COMB_ALT_ANT_RATIO2 20
3302 +#define ATH_ANT_DIV_COMB_ALT_ANT_RATIO_LOW_RSSI 50
3303 +#define ATH_ANT_DIV_COMB_ALT_ANT_RATIO2_LOW_RSSI 50
3304
3305  #define ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA -1
3306  #define ATH_ANT_DIV_COMB_LNA1_DELTA_HI -4
3307  #define ATH_ANT_DIV_COMB_LNA1_DELTA_MID -2
3308  #define ATH_ANT_DIV_COMB_LNA1_DELTA_LOW 2
3309
3310 -enum ath9k_ant_div_comb_lna_conf {
3311 -       ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2,
3312 -       ATH_ANT_DIV_COMB_LNA2,
3313 -       ATH_ANT_DIV_COMB_LNA1,
3314 -       ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2,
3315 -};
3316 -
3317  struct ath_ant_comb {
3318         u16 count;
3319         u16 total_pkt_count;
3320 @@ -614,27 +605,36 @@ struct ath_ant_comb {
3321         int rssi_first;
3322         int rssi_second;
3323         int rssi_third;
3324 +       int ant_ratio;
3325 +       int ant_ratio2;
3326         bool alt_good;
3327         int quick_scan_cnt;
3328 -       int main_conf;
3329 +       enum ath9k_ant_div_comb_lna_conf main_conf;
3330         enum ath9k_ant_div_comb_lna_conf first_quick_scan_conf;
3331         enum ath9k_ant_div_comb_lna_conf second_quick_scan_conf;
3332         bool first_ratio;
3333         bool second_ratio;
3334         unsigned long scan_start_time;
3335 +
3336 +       /*
3337 +        * Card-specific config values.
3338 +        */
3339 +       int low_rssi_thresh;
3340 +       int fast_div_bias;
3341  };
3342
3343  void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
3344 -void ath_ant_comb_update(struct ath_softc *sc);
3345
3346  /********************/
3347  /* Main driver core */
3348  /********************/
3349
3350 -#define ATH9K_PCI_CUS198 0x0001
3351 -#define ATH9K_PCI_CUS230 0x0002
3352 -#define ATH9K_PCI_CUS217 0x0004
3353 -#define ATH9K_PCI_WOW    0x0008
3354 +#define ATH9K_PCI_CUS198     0x0001
3355 +#define ATH9K_PCI_CUS230     0x0002
3356 +#define ATH9K_PCI_CUS217     0x0004
3357 +#define ATH9K_PCI_WOW        0x0008
3358 +#define ATH9K_PCI_BT_ANT_DIV 0x0010
3359 +#define ATH9K_PCI_D3_L1_WAR  0x0020
3360
3361  /*
3362   * Default cache line size, in bytes.
3363 --- a/drivers/net/wireless/ath/ath9k/debug.c
3364 +++ b/drivers/net/wireless/ath/ath9k/debug.c
3365 @@ -270,25 +270,29 @@ static const struct file_operations fops
3366         .llseek = default_llseek,
3367  };
3368
3369 -static ssize_t read_file_ant_diversity(struct file *file, char __user *user_buf,
3370 -                                      size_t count, loff_t *ppos)
3371 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
3372 +
3373 +static ssize_t read_file_bt_ant_diversity(struct file *file,
3374 +                                         char __user *user_buf,
3375 +                                         size_t count, loff_t *ppos)
3376  {
3377         struct ath_softc *sc = file->private_data;
3378         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
3379         char buf[32];
3380         unsigned int len;
3381
3382 -       len = sprintf(buf, "%d\n", common->antenna_diversity);
3383 +       len = sprintf(buf, "%d\n", common->bt_ant_diversity);
3384         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
3385  }
3386
3387 -static ssize_t write_file_ant_diversity(struct file *file,
3388 -                                       const char __user *user_buf,
3389 -                                       size_t count, loff_t *ppos)
3390 +static ssize_t write_file_bt_ant_diversity(struct file *file,
3391 +                                          const char __user *user_buf,
3392 +                                          size_t count, loff_t *ppos)
3393  {
3394         struct ath_softc *sc = file->private_data;
3395         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
3396 -       unsigned long antenna_diversity;
3397 +       struct ath9k_hw_capabilities *pCap = &sc->sc_ah->caps;
3398 +       unsigned long bt_ant_diversity;
3399         char buf[32];
3400         ssize_t len;
3401
3402 @@ -296,26 +300,147 @@ static ssize_t write_file_ant_diversity(
3403         if (copy_from_user(buf, user_buf, len))
3404                 return -EFAULT;
3405
3406 -       if (!AR_SREV_9565(sc->sc_ah))
3407 +       if (!(pCap->hw_caps & ATH9K_HW_CAP_BT_ANT_DIV))
3408                 goto exit;
3409
3410         buf[len] = '\0';
3411 -       if (strict_strtoul(buf, 0, &antenna_diversity))
3412 +       if (kstrtoul(buf, 0, &bt_ant_diversity))
3413                 return -EINVAL;
3414
3415 -       common->antenna_diversity = !!antenna_diversity;
3416 +       common->bt_ant_diversity = !!bt_ant_diversity;
3417         ath9k_ps_wakeup(sc);
3418 -       ath_ant_comb_update(sc);
3419 -       ath_dbg(common, CONFIG, "Antenna diversity: %d\n",
3420 -               common->antenna_diversity);
3421 +       ath9k_hw_set_bt_ant_diversity(sc->sc_ah, common->bt_ant_diversity);
3422 +       ath_dbg(common, CONFIG, "Enable WLAN/BT RX Antenna diversity: %d\n",
3423 +               common->bt_ant_diversity);
3424         ath9k_ps_restore(sc);
3425  exit:
3426         return count;
3427  }
3428
3429 -static const struct file_operations fops_ant_diversity = {
3430 -       .read = read_file_ant_diversity,
3431 -       .write = write_file_ant_diversity,
3432 +static const struct file_operations fops_bt_ant_diversity = {
3433 +       .read = read_file_bt_ant_diversity,
3434 +       .write = write_file_bt_ant_diversity,
3435 +       .open = simple_open,
3436 +       .owner = THIS_MODULE,
3437 +       .llseek = default_llseek,
3438 +};
3439 +
3440 +#endif
3441 +
3442 +void ath9k_debug_stat_ant(struct ath_softc *sc,
3443 +                         struct ath_hw_antcomb_conf *div_ant_conf,
3444 +                         int main_rssi_avg, int alt_rssi_avg)
3445 +{
3446 +       struct ath_antenna_stats *as_main = &sc->debug.stats.ant_stats[ANT_MAIN];
3447 +       struct ath_antenna_stats *as_alt = &sc->debug.stats.ant_stats[ANT_ALT];
3448 +
3449 +       as_main->lna_attempt_cnt[div_ant_conf->main_lna_conf]++;
3450 +       as_alt->lna_attempt_cnt[div_ant_conf->alt_lna_conf]++;
3451 +
3452 +       as_main->rssi_avg = main_rssi_avg;
3453 +       as_alt->rssi_avg = alt_rssi_avg;
3454 +}
3455 +
3456 +static ssize_t read_file_antenna_diversity(struct file *file,
3457 +                                          char __user *user_buf,
3458 +                                          size_t count, loff_t *ppos)
3459 +{
3460 +       struct ath_softc *sc = file->private_data;
3461 +       struct ath_hw *ah = sc->sc_ah;
3462 +       struct ath9k_hw_capabilities *pCap = &ah->caps;
3463 +       struct ath_antenna_stats *as_main = &sc->debug.stats.ant_stats[ANT_MAIN];
3464 +       struct ath_antenna_stats *as_alt = &sc->debug.stats.ant_stats[ANT_ALT];
3465 +       struct ath_hw_antcomb_conf div_ant_conf;
3466 +       unsigned int len = 0, size = 1024;
3467 +       ssize_t retval = 0;
3468 +       char *buf;
3469 +       char *lna_conf_str[4] = {"LNA1_MINUS_LNA2",
3470 +                                "LNA2",
3471 +                                "LNA1",
3472 +                                "LNA1_PLUS_LNA2"};
3473 +
3474 +       buf = kzalloc(size, GFP_KERNEL);
3475 +       if (buf == NULL)
3476 +               return -ENOMEM;
3477 +
3478 +       if (!(pCap->hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)) {
3479 +               len += snprintf(buf + len, size - len, "%s\n",
3480 +                               "Antenna Diversity Combining is disabled");
3481 +               goto exit;
3482 +       }
3483 +
3484 +       ath9k_ps_wakeup(sc);
3485 +       ath9k_hw_antdiv_comb_conf_get(ah, &div_ant_conf);
3486 +       len += snprintf(buf + len, size - len, "Current MAIN config : %s\n",
3487 +                       lna_conf_str[div_ant_conf.main_lna_conf]);
3488 +       len += snprintf(buf + len, size - len, "Current ALT config  : %s\n",
3489 +                       lna_conf_str[div_ant_conf.alt_lna_conf]);
3490 +       len += snprintf(buf + len, size - len, "Average MAIN RSSI   : %d\n",
3491 +                       as_main->rssi_avg);
3492 +       len += snprintf(buf + len, size - len, "Average ALT RSSI    : %d\n\n",
3493 +                       as_alt->rssi_avg);
3494 +       ath9k_ps_restore(sc);
3495 +
3496 +       len += snprintf(buf + len, size - len, "Packet Receive Cnt:\n");
3497 +       len += snprintf(buf + len, size - len, "-------------------\n");
3498 +
3499 +       len += snprintf(buf + len, size - len, "%30s%15s\n",
3500 +                       "MAIN", "ALT");
3501 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3502 +                       "TOTAL COUNT",
3503 +                       as_main->recv_cnt,
3504 +                       as_alt->recv_cnt);
3505 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3506 +                       "LNA1",
3507 +                       as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1],
3508 +                       as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1]);
3509 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3510 +                       "LNA2",
3511 +                       as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2],
3512 +                       as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2]);
3513 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3514 +                       "LNA1 + LNA2",
3515 +                       as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
3516 +                       as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
3517 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3518 +                       "LNA1 - LNA2",
3519 +                       as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
3520 +                       as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
3521 +
3522 +       len += snprintf(buf + len, size - len, "\nLNA Config Attempts:\n");
3523 +       len += snprintf(buf + len, size - len, "--------------------\n");
3524 +
3525 +       len += snprintf(buf + len, size - len, "%30s%15s\n",
3526 +                       "MAIN", "ALT");
3527 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3528 +                       "LNA1",
3529 +                       as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1],
3530 +                       as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1]);
3531 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3532 +                       "LNA2",
3533 +                       as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2],
3534 +                       as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2]);
3535 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3536 +                       "LNA1 + LNA2",
3537 +                       as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
3538 +                       as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
3539 +       len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
3540 +                       "LNA1 - LNA2",
3541 +                       as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
3542 +                       as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
3543 +
3544 +exit:
3545 +       if (len > size)
3546 +               len = size;
3547 +
3548 +       retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
3549 +       kfree(buf);
3550 +
3551 +       return retval;
3552 +}
3553 +
3554 +static const struct file_operations fops_antenna_diversity = {
3555 +       .read = read_file_antenna_diversity,
3556         .open = simple_open,
3557         .owner = THIS_MODULE,
3558         .llseek = default_llseek,
3559 @@ -607,6 +732,28 @@ static ssize_t read_file_xmit(struct fil
3560         return retval;
3561  }
3562
3563 +static ssize_t print_queue(struct ath_softc *sc, struct ath_txq *txq,
3564 +                          char *buf, ssize_t size)
3565 +{
3566 +       ssize_t len = 0;
3567 +
3568 +       ath_txq_lock(sc, txq);
3569 +
3570 +       len += snprintf(buf + len, size - len, "%s: %d ",
3571 +                       "qnum", txq->axq_qnum);
3572 +       len += snprintf(buf + len, size - len, "%s: %2d ",
3573 +                       "qdepth", txq->axq_depth);
3574 +       len += snprintf(buf + len, size - len, "%s: %2d ",
3575 +                       "ampdu-depth", txq->axq_ampdu_depth);
3576 +       len += snprintf(buf + len, size - len, "%s: %3d ",
3577 +                       "pending", txq->pending_frames);
3578 +       len += snprintf(buf + len, size - len, "%s: %d\n",
3579 +                       "stopped", txq->stopped);
3580 +
3581 +       ath_txq_unlock(sc, txq);
3582 +       return len;
3583 +}
3584 +
3585  static ssize_t read_file_queues(struct file *file, char __user *user_buf,
3586                                 size_t count, loff_t *ppos)
3587  {
3588 @@ -624,24 +771,13 @@ static ssize_t read_file_queues(struct f
3589
3590         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
3591                 txq = sc->tx.txq_map[i];
3592 -               len += snprintf(buf + len, size - len, "(%s): ", qname[i]);
3593 -
3594 -               ath_txq_lock(sc, txq);
3595 -
3596 -               len += snprintf(buf + len, size - len, "%s: %d ",
3597 -                               "qnum", txq->axq_qnum);
3598 -               len += snprintf(buf + len, size - len, "%s: %2d ",
3599 -                               "qdepth", txq->axq_depth);
3600 -               len += snprintf(buf + len, size - len, "%s: %2d ",
3601 -                               "ampdu-depth", txq->axq_ampdu_depth);
3602 -               len += snprintf(buf + len, size - len, "%s: %3d ",
3603 -                               "pending", txq->pending_frames);
3604 -               len += snprintf(buf + len, size - len, "%s: %d\n",
3605 -                               "stopped", txq->stopped);
3606 -
3607 -               ath_txq_unlock(sc, txq);
3608 +               len += snprintf(buf + len, size - len, "(%s):  ", qname[i]);
3609 +               len += print_queue(sc, txq, buf + len, size - len);
3610         }
3611
3612 +       len += snprintf(buf + len, size - len, "(CAB): ");
3613 +       len += print_queue(sc, sc->beacon.cabq, buf + len, size - len);
3614 +
3615         if (len > size)
3616                 len = size;
3617
3618 @@ -1818,9 +1954,11 @@ int ath9k_init_debug(struct ath_hw *ah)
3619                            sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
3620         debugfs_create_u32("gpio_val", S_IRUSR | S_IWUSR,
3621                            sc->debug.debugfs_phy, &sc->sc_ah->gpio_val);
3622 -       debugfs_create_file("diversity", S_IRUSR | S_IWUSR,
3623 -                           sc->debug.debugfs_phy, sc, &fops_ant_diversity);
3624 +       debugfs_create_file("antenna_diversity", S_IRUSR,
3625 +                           sc->debug.debugfs_phy, sc, &fops_antenna_diversity);
3626  #ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
3627 +       debugfs_create_file("bt_ant_diversity", S_IRUSR | S_IWUSR,
3628 +                           sc->debug.debugfs_phy, sc, &fops_bt_ant_diversity);
3629         debugfs_create_file("btcoex", S_IRUSR, sc->debug.debugfs_phy, sc,
3630                             &fops_btcoex);
3631  #endif
3632 --- a/net/mac80211/ibss.c
3633 +++ b/net/mac80211/ibss.c
3634 @@ -30,13 +30,14 @@
3635
3636  #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
3637  #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
3638 +#define IEEE80211_IBSS_RSN_INACTIVITY_LIMIT (10 * HZ)
3639
3640  #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
3641
3642
3643  static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
3644                                       const u8 *bssid, const int beacon_int,
3645 -                                     struct ieee80211_channel *chan,
3646 +                                     struct cfg80211_chan_def *req_chandef,
3647                                       const u32 basic_rates,
3648                                       const u16 capability, u64 tsf,
3649                                       bool creator)
3650 @@ -51,6 +52,7 @@ static void __ieee80211_sta_join_ibss(st
3651         u32 bss_change;
3652         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
3653         struct cfg80211_chan_def chandef;
3654 +       struct ieee80211_channel *chan;
3655         struct beacon_data *presp;
3656         int frame_len;
3657
3658 @@ -81,7 +83,9 @@ static void __ieee80211_sta_join_ibss(st
3659
3660         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
3661
3662 -       chandef = ifibss->chandef;
3663 +       /* make a copy of the chandef, it could be modified below. */
3664 +       chandef = *req_chandef;
3665 +       chan = chandef.chan;
3666         if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
3667                 chandef.width = NL80211_CHAN_WIDTH_20;
3668                 chandef.center_freq1 = chan->center_freq;
3669 @@ -259,10 +263,12 @@ static void ieee80211_sta_join_ibss(stru
3670         struct cfg80211_bss *cbss =
3671                 container_of((void *)bss, struct cfg80211_bss, priv);
3672         struct ieee80211_supported_band *sband;
3673 +       struct cfg80211_chan_def chandef;
3674         u32 basic_rates;
3675         int i, j;
3676         u16 beacon_int = cbss->beacon_interval;
3677         const struct cfg80211_bss_ies *ies;
3678 +       enum nl80211_channel_type chan_type;
3679         u64 tsf;
3680
3681         sdata_assert_lock(sdata);
3682 @@ -270,6 +276,26 @@ static void ieee80211_sta_join_ibss(stru
3683         if (beacon_int < 10)
3684                 beacon_int = 10;
3685
3686 +       switch (sdata->u.ibss.chandef.width) {
3687 +       case NL80211_CHAN_WIDTH_20_NOHT:
3688 +       case NL80211_CHAN_WIDTH_20:
3689 +       case NL80211_CHAN_WIDTH_40:
3690 +               chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
3691 +               cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
3692 +               break;
3693 +       case NL80211_CHAN_WIDTH_5:
3694 +       case NL80211_CHAN_WIDTH_10:
3695 +               cfg80211_chandef_create(&chandef, cbss->channel,
3696 +                                       NL80211_CHAN_WIDTH_20_NOHT);
3697 +               chandef.width = sdata->u.ibss.chandef.width;
3698 +               break;
3699 +       default:
3700 +               /* fall back to 20 MHz for unsupported modes */
3701 +               cfg80211_chandef_create(&chandef, cbss->channel,
3702 +                                       NL80211_CHAN_WIDTH_20_NOHT);
3703 +               break;
3704 +       }
3705 +
3706         sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
3707
3708         basic_rates = 0;
3709 @@ -294,7 +320,7 @@ static void ieee80211_sta_join_ibss(stru
3710
3711         __ieee80211_sta_join_ibss(sdata, cbss->bssid,
3712                                   beacon_int,
3713 -                                 cbss->channel,
3714 +                                 &chandef,
3715                                   basic_rates,
3716                                   cbss->capability,
3717                                   tsf, false);
3718 @@ -672,6 +698,33 @@ static int ieee80211_sta_active_ibss(str
3719         return active;
3720  }
3721
3722 +static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
3723 +{
3724 +       struct ieee80211_local *local = sdata->local;
3725 +       struct sta_info *sta, *tmp;
3726 +       unsigned long exp_time = IEEE80211_IBSS_INACTIVITY_LIMIT;
3727 +       unsigned long exp_rsn_time = IEEE80211_IBSS_RSN_INACTIVITY_LIMIT;
3728 +
3729 +       mutex_lock(&local->sta_mtx);
3730 +
3731 +       list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
3732 +               if (sdata != sta->sdata)
3733 +                       continue;
3734 +
3735 +               if (time_after(jiffies, sta->last_rx + exp_time) ||
3736 +                   (time_after(jiffies, sta->last_rx + exp_rsn_time) &&
3737 +                    sta->sta_state != IEEE80211_STA_AUTHORIZED)) {
3738 +                       sta_dbg(sta->sdata, "expiring inactive %sSTA %pM\n",
3739 +                               sta->sta_state != IEEE80211_STA_AUTHORIZED ?
3740 +                               "not authorized " : "", sta->sta.addr);
3741 +
3742 +                       WARN_ON(__sta_info_destroy(sta));
3743 +               }
3744 +       }
3745 +
3746 +       mutex_unlock(&local->sta_mtx);
3747 +}
3748 +
3749  /*
3750   * This function is called with state == IEEE80211_IBSS_MLME_JOINED
3751   */
3752 @@ -685,7 +738,7 @@ static void ieee80211_sta_merge_ibss(str
3753         mod_timer(&ifibss->timer,
3754                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
3755
3756 -       ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
3757 +       ieee80211_ibss_sta_expire(sdata);
3758
3759         if (time_before(jiffies, ifibss->last_scan_completed +
3760                        IEEE80211_IBSS_MERGE_INTERVAL))
3761 @@ -736,7 +789,7 @@ static void ieee80211_sta_create_ibss(st
3762                 sdata->drop_unencrypted = 0;
3763
3764         __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
3765 -                                 ifibss->chandef.chan, ifibss->basic_rates,
3766 +                                 &ifibss->chandef, ifibss->basic_rates,
3767                                   capability, 0, true);
3768  }
3769
3770 @@ -792,6 +845,17 @@ static void ieee80211_sta_find_ibss(stru
3771                 return;
3772         }
3773
3774 +       /* if a fixed bssid and a fixed freq have been provided create the IBSS
3775 +        * directly and do not waste time scanning
3776 +        */
3777 +       if (ifibss->fixed_bssid && ifibss->fixed_channel) {
3778 +               sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
3779 +                          bssid);
3780 +               ieee80211_sta_create_ibss(sdata);
3781 +               return;
3782 +       }
3783 +
3784 +
3785         ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
3786
3787         /* Selected IBSS not found in current scan results - try to scan */
3788 @@ -1138,6 +1202,7 @@ int ieee80211_ibss_leave(struct ieee8021
3789         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
3790         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
3791                                                 BSS_CHANGED_IBSS);
3792 +       ieee80211_vif_release_channel(sdata);
3793         synchronize_rcu();
3794         kfree(presp);
3795
3796 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
3797 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
3798 @@ -632,6 +632,22 @@ static void ar9003_hw_override_ini(struc
3799
3800         REG_SET_BIT(ah, AR_PHY_CCK_DETECT,
3801                     AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
3802 +
3803 +       if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
3804 +               REG_WRITE(ah, AR_GLB_SWREG_DISCONT_MODE,
3805 +                         AR_GLB_SWREG_DISCONT_EN_BT_WLAN);
3806 +
3807 +               if (REG_READ_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_0,
3808 +                                  AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL))
3809 +                       ah->enabled_cals |= TX_IQ_CAL;
3810 +               else
3811 +                       ah->enabled_cals &= ~TX_IQ_CAL;
3812 +
3813 +               if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE)
3814 +                       ah->enabled_cals |= TX_CL_CAL;
3815 +               else
3816 +                       ah->enabled_cals &= ~TX_CL_CAL;
3817 +       }
3818  }
3819
3820  static void ar9003_hw_prog_ini(struct ath_hw *ah,
3821 @@ -814,29 +830,12 @@ static int ar9003_hw_process_ini(struct
3822         if (chan->channel == 2484)
3823                 ar9003_hw_prog_ini(ah, &ah->iniCckfirJapan2484, 1);
3824
3825 -       if (AR_SREV_9462(ah) || AR_SREV_9565(ah))
3826 -               REG_WRITE(ah, AR_GLB_SWREG_DISCONT_MODE,
3827 -                         AR_GLB_SWREG_DISCONT_EN_BT_WLAN);
3828 -
3829         ah->modes_index = modesIndex;
3830         ar9003_hw_override_ini(ah);
3831         ar9003_hw_set_channel_regs(ah, chan);
3832         ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
3833         ath9k_hw_apply_txpower(ah, chan, false);
3834
3835 -       if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
3836 -               if (REG_READ_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_0,
3837 -                                  AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL))
3838 -                       ah->enabled_cals |= TX_IQ_CAL;
3839 -               else
3840 -                       ah->enabled_cals &= ~TX_IQ_CAL;
3841 -
3842 -               if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE)
3843 -                       ah->enabled_cals |= TX_CL_CAL;
3844 -               else
3845 -                       ah->enabled_cals &= ~TX_CL_CAL;
3846 -       }
3847 -
3848         return 0;
3849  }
3850
3851 @@ -1173,6 +1172,10 @@ skip_ws_det:
3852                  * is_on == 0 means MRC CCK is OFF (more noise imm)
3853                  */
3854                 bool is_on = param ? 1 : 0;
3855 +
3856 +               if (ah->caps.rx_chainmask == 1)
3857 +                       break;
3858 +
3859                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
3860                               AR_PHY_MRC_CCK_ENABLE, is_on);
3861                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
3862 @@ -1413,65 +1416,111 @@ static void ar9003_hw_antdiv_comb_conf_s
3863         REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
3864  }
3865
3866 -static void ar9003_hw_antctrl_shared_chain_lnadiv(struct ath_hw *ah,
3867 -                                                 bool enable)
3868 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
3869 +
3870 +static void ar9003_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
3871  {
3872 +       struct ath9k_hw_capabilities *pCap = &ah->caps;
3873         u8 ant_div_ctl1;
3874         u32 regval;
3875
3876 -       if (!AR_SREV_9565(ah))
3877 +       if (!AR_SREV_9485(ah) && !AR_SREV_9565(ah))
3878                 return;
3879
3880 -       ah->shared_chain_lnadiv = enable;
3881 +       if (AR_SREV_9485(ah)) {
3882 +               regval = ar9003_hw_ant_ctrl_common_2_get(ah,
3883 +                                                IS_CHAN_2GHZ(ah->curchan));
3884 +               if (enable) {
3885 +                       regval &= ~AR_SWITCH_TABLE_COM2_ALL;
3886 +                       regval |= ah->config.ant_ctrl_comm2g_switch_enable;
3887 +               }
3888 +               REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2,
3889 +                             AR_SWITCH_TABLE_COM2_ALL, regval);
3890 +       }
3891 +
3892         ant_div_ctl1 = ah->eep_ops->get_eeprom(ah, EEP_ANT_DIV_CTL1);
3893
3894 +       /*
3895 +        * Set MAIN/ALT LNA conf.
3896 +        * Set MAIN/ALT gain_tb.
3897 +        */
3898         regval = REG_READ(ah, AR_PHY_MC_GAIN_CTRL);
3899         regval &= (~AR_ANT_DIV_CTRL_ALL);
3900         regval |= (ant_div_ctl1 & 0x3f) << AR_ANT_DIV_CTRL_ALL_S;
3901 -       regval &= ~AR_PHY_ANT_DIV_LNADIV;
3902 -       regval |= ((ant_div_ctl1 >> 6) & 0x1) << AR_PHY_ANT_DIV_LNADIV_S;
3903 -
3904 -       if (enable)
3905 -               regval |= AR_ANT_DIV_ENABLE;
3906 -
3907         REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
3908
3909 -       regval = REG_READ(ah, AR_PHY_CCK_DETECT);
3910 -       regval &= ~AR_FAST_DIV_ENABLE;
3911 -       regval |= ((ant_div_ctl1 >> 7) & 0x1) << AR_FAST_DIV_ENABLE_S;
3912 -
3913 -       if (enable)
3914 -               regval |= AR_FAST_DIV_ENABLE;
3915 -
3916 -       REG_WRITE(ah, AR_PHY_CCK_DETECT, regval);
3917 -
3918 -       if (enable) {
3919 -               REG_SET_BIT(ah, AR_PHY_MC_GAIN_CTRL,
3920 -                           (1 << AR_PHY_ANT_SW_RX_PROT_S));
3921 -               if (ah->curchan && IS_CHAN_2GHZ(ah->curchan))
3922 -                       REG_SET_BIT(ah, AR_PHY_RESTART,
3923 -                                   AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
3924 -               REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV,
3925 -                           AR_BTCOEX_WL_LNADIV_FORCE_ON);
3926 -       } else {
3927 -               REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL, AR_ANT_DIV_ENABLE);
3928 -               REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
3929 -                           (1 << AR_PHY_ANT_SW_RX_PROT_S));
3930 -               REG_CLR_BIT(ah, AR_PHY_CCK_DETECT, AR_FAST_DIV_ENABLE);
3931 -               REG_CLR_BIT(ah, AR_BTCOEX_WL_LNADIV,
3932 -                           AR_BTCOEX_WL_LNADIV_FORCE_ON);
3933 -
3934 +       if (AR_SREV_9485_11_OR_LATER(ah)) {
3935 +               /*
3936 +                * Enable LNA diversity.
3937 +                */
3938                 regval = REG_READ(ah, AR_PHY_MC_GAIN_CTRL);
3939 -               regval &= ~(AR_PHY_ANT_DIV_MAIN_LNACONF |
3940 -                       AR_PHY_ANT_DIV_ALT_LNACONF |
3941 -                       AR_PHY_ANT_DIV_MAIN_GAINTB |
3942 -                       AR_PHY_ANT_DIV_ALT_GAINTB);
3943 -               regval |= (AR_PHY_ANT_DIV_LNA1 << AR_PHY_ANT_DIV_MAIN_LNACONF_S);
3944 -               regval |= (AR_PHY_ANT_DIV_LNA2 << AR_PHY_ANT_DIV_ALT_LNACONF_S);
3945 +               regval &= ~AR_PHY_ANT_DIV_LNADIV;
3946 +               regval |= ((ant_div_ctl1 >> 6) & 0x1) << AR_PHY_ANT_DIV_LNADIV_S;
3947 +               if (enable)
3948 +                       regval |= AR_ANT_DIV_ENABLE;
3949 +
3950                 REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
3951 +
3952 +               /*
3953 +                * Enable fast antenna diversity.
3954 +                */
3955 +               regval = REG_READ(ah, AR_PHY_CCK_DETECT);
3956 +               regval &= ~AR_FAST_DIV_ENABLE;
3957 +               regval |= ((ant_div_ctl1 >> 7) & 0x1) << AR_FAST_DIV_ENABLE_S;
3958 +               if (enable)
3959 +                       regval |= AR_FAST_DIV_ENABLE;
3960 +
3961 +               REG_WRITE(ah, AR_PHY_CCK_DETECT, regval);
3962 +
3963 +               if (pCap->hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) {
3964 +                       regval = REG_READ(ah, AR_PHY_MC_GAIN_CTRL);
3965 +                       regval &= (~(AR_PHY_ANT_DIV_MAIN_LNACONF |
3966 +                                    AR_PHY_ANT_DIV_ALT_LNACONF |
3967 +                                    AR_PHY_ANT_DIV_ALT_GAINTB |
3968 +                                    AR_PHY_ANT_DIV_MAIN_GAINTB));
3969 +                       /*
3970 +                        * Set MAIN to LNA1 and ALT to LNA2 at the
3971 +                        * beginning.
3972 +                        */
3973 +                       regval |= (ATH_ANT_DIV_COMB_LNA1 <<
3974 +                                  AR_PHY_ANT_DIV_MAIN_LNACONF_S);
3975 +                       regval |= (ATH_ANT_DIV_COMB_LNA2 <<
3976 +                                  AR_PHY_ANT_DIV_ALT_LNACONF_S);
3977 +                       REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
3978 +               }
3979 +       } else if (AR_SREV_9565(ah)) {
3980 +               if (enable) {
3981 +                       REG_SET_BIT(ah, AR_PHY_MC_GAIN_CTRL,
3982 +                                   (1 << AR_PHY_ANT_SW_RX_PROT_S));
3983 +                       if (ah->curchan && IS_CHAN_2GHZ(ah->curchan))
3984 +                               REG_SET_BIT(ah, AR_PHY_RESTART,
3985 +                                           AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
3986 +                       REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV,
3987 +                                   AR_BTCOEX_WL_LNADIV_FORCE_ON);
3988 +               } else {
3989 +                       REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL, AR_ANT_DIV_ENABLE);
3990 +                       REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
3991 +                                   (1 << AR_PHY_ANT_SW_RX_PROT_S));
3992 +                       REG_CLR_BIT(ah, AR_PHY_CCK_DETECT, AR_FAST_DIV_ENABLE);
3993 +                       REG_CLR_BIT(ah, AR_BTCOEX_WL_LNADIV,
3994 +                                   AR_BTCOEX_WL_LNADIV_FORCE_ON);
3995 +
3996 +                       regval = REG_READ(ah, AR_PHY_MC_GAIN_CTRL);
3997 +                       regval &= ~(AR_PHY_ANT_DIV_MAIN_LNACONF |
3998 +                                   AR_PHY_ANT_DIV_ALT_LNACONF |
3999 +                                   AR_PHY_ANT_DIV_MAIN_GAINTB |
4000 +                                   AR_PHY_ANT_DIV_ALT_GAINTB);
4001 +                       regval |= (ATH_ANT_DIV_COMB_LNA1 <<
4002 +                                  AR_PHY_ANT_DIV_MAIN_LNACONF_S);
4003 +                       regval |= (ATH_ANT_DIV_COMB_LNA2 <<
4004 +                                  AR_PHY_ANT_DIV_ALT_LNACONF_S);
4005 +                       REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
4006 +               }
4007         }
4008  }
4009
4010 +#endif
4011 +
4012  static int ar9003_hw_fast_chan_change(struct ath_hw *ah,
4013                                       struct ath9k_channel *chan,
4014                                       u8 *ini_reloaded)
4015 @@ -1518,6 +1567,18 @@ static int ar9003_hw_fast_chan_change(st
4016
4017         REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
4018
4019 +       if (AR_SREV_9462_20_OR_LATER(ah)) {
4020 +               /*
4021 +                * CUS217 mix LNA mode.
4022 +                */
4023 +               if (ar9003_hw_get_rx_gain_idx(ah) == 2) {
4024 +                       REG_WRITE_ARRAY(&ah->ini_modes_rxgain_bb_core,
4025 +                                       1, regWrites);
4026 +                       REG_WRITE_ARRAY(&ah->ini_modes_rxgain_bb_postamble,
4027 +                                       modesIndex, regWrites);
4028 +               }
4029 +       }
4030 +
4031         /*
4032          * For 5GHz channels requiring Fast Clock, apply
4033          * different modal values.
4034 @@ -1528,7 +1589,11 @@ static int ar9003_hw_fast_chan_change(st
4035         if (AR_SREV_9565(ah))
4036                 REG_WRITE_ARRAY(&ah->iniModesFastClock, 1, regWrites);
4037
4038 -       REG_WRITE_ARRAY(&ah->iniAdditional, 1, regWrites);
4039 +       /*
4040 +        * JAPAN regulatory.
4041 +        */
4042 +       if (chan->channel == 2484)
4043 +               ar9003_hw_prog_ini(ah, &ah->iniCckfirJapan2484, 1);
4044
4045         ah->modes_index = modesIndex;
4046         *ini_reloaded = true;
4047 @@ -1631,11 +1696,14 @@ void ar9003_hw_attach_phy_ops(struct ath
4048
4049         ops->antdiv_comb_conf_get = ar9003_hw_antdiv_comb_conf_get;
4050         ops->antdiv_comb_conf_set = ar9003_hw_antdiv_comb_conf_set;
4051 -       ops->antctrl_shared_chain_lnadiv = ar9003_hw_antctrl_shared_chain_lnadiv;
4052         ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
4053         ops->spectral_scan_trigger = ar9003_hw_spectral_scan_trigger;
4054         ops->spectral_scan_wait = ar9003_hw_spectral_scan_wait;
4055
4056 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
4057 +       ops->set_bt_ant_diversity = ar9003_hw_set_bt_ant_diversity;
4058 +#endif
4059 +
4060         ar9003_hw_set_nf_limits(ah);
4061         ar9003_hw_set_radar_conf(ah);
4062         memcpy(ah->nf_regs, ar9300_cca_regs, sizeof(ah->nf_regs));
4063 --- a/drivers/net/wireless/ath/ath9k/recv.c
4064 +++ b/drivers/net/wireless/ath/ath9k/recv.c
4065 @@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_s
4066         struct ath_desc *ds;
4067         struct sk_buff *skb;
4068
4069 -       ATH_RXBUF_RESET(bf);
4070 -
4071         ds = bf->bf_desc;
4072         ds->ds_link = 0; /* link to null */
4073         ds->ds_data = bf->bf_buf_addr;
4074 @@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_s
4075         sc->rx.rxlink = &ds->ds_link;
4076  }
4077
4078 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
4079 +{
4080 +       if (sc->rx.buf_hold)
4081 +               ath_rx_buf_link(sc, sc->rx.buf_hold);
4082 +
4083 +       sc->rx.buf_hold = bf;
4084 +}
4085 +
4086  static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
4087  {
4088         /* XXX block beacon interrupts */
4089 @@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct
4090
4091         skb = bf->bf_mpdu;
4092
4093 -       ATH_RXBUF_RESET(bf);
4094         memset(skb->data, 0, ah->caps.rx_status_len);
4095         dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
4096                                 ah->caps.rx_status_len, DMA_TO_DEVICE);
4097 @@ -185,7 +190,7 @@ static void ath_rx_edma_cleanup(struct a
4098
4099  static void ath_rx_edma_init_queue(struct ath_rx_edma *rx_edma, int size)
4100  {
4101 -       skb_queue_head_init(&rx_edma->rx_fifo);
4102 +       __skb_queue_head_init(&rx_edma->rx_fifo);
4103         rx_edma->rx_fifo_hwsize = size;
4104  }
4105
4106 @@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
4107         if (list_empty(&sc->rx.rxbuf))
4108                 goto start_recv;
4109
4110 +       sc->rx.buf_hold = NULL;
4111         sc->rx.rxlink = NULL;
4112         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
4113                 ath_rx_buf_link(sc, bf);
4114 @@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_b
4115         }
4116
4117         bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
4118 +       if (bf == sc->rx.buf_hold)
4119 +               return NULL;
4120 +
4121         ds = bf->bf_desc;
4122
4123         /*
4124 @@ -755,7 +764,6 @@ static bool ath9k_rx_accept(struct ath_c
4125         bool is_mc, is_valid_tkip, strip_mic, mic_error;
4126         struct ath_hw *ah = common->ah;
4127         __le16 fc;
4128 -       u8 rx_status_len = ah->caps.rx_status_len;
4129
4130         fc = hdr->frame_control;
4131
4132 @@ -777,25 +785,6 @@ static bool ath9k_rx_accept(struct ath_c
4133             !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
4134                 rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
4135
4136 -       if (!rx_stats->rs_datalen) {
4137 -               RX_STAT_INC(rx_len_err);
4138 -               return false;
4139 -       }
4140 -
4141 -        /*
4142 -         * rs_status follows rs_datalen so if rs_datalen is too large
4143 -         * we can take a hint that hardware corrupted it, so ignore
4144 -         * those frames.
4145 -         */
4146 -       if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len)) {
4147 -               RX_STAT_INC(rx_len_err);
4148 -               return false;
4149 -       }
4150 -
4151 -       /* Only use error bits from the last fragment */
4152 -       if (rx_stats->rs_more)
4153 -               return true;
4154 -
4155         mic_error = is_valid_tkip && !ieee80211_is_ctl(fc) &&
4156                 !ieee80211_has_morefrags(fc) &&
4157                 !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
4158 @@ -814,8 +803,6 @@ static bool ath9k_rx_accept(struct ath_c
4159                         rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
4160                         mic_error = false;
4161                 }
4162 -               if (rx_stats->rs_status & ATH9K_RXERR_PHY)
4163 -                       return false;
4164
4165                 if ((rx_stats->rs_status & ATH9K_RXERR_DECRYPT) ||
4166                     (!is_mc && (rx_stats->rs_status & ATH9K_RXERR_KEYMISS))) {
4167 @@ -898,129 +885,65 @@ static int ath9k_process_rate(struct ath
4168
4169  static void ath9k_process_rssi(struct ath_common *common,
4170                                struct ieee80211_hw *hw,
4171 -                              struct ieee80211_hdr *hdr,
4172 -                              struct ath_rx_status *rx_stats)
4173 +                              struct ath_rx_status *rx_stats,
4174 +                              struct ieee80211_rx_status *rxs)
4175  {
4176         struct ath_softc *sc = hw->priv;
4177         struct ath_hw *ah = common->ah;
4178         int last_rssi;
4179         int rssi = rx_stats->rs_rssi;
4180
4181 -       if (!rx_stats->is_mybeacon ||
4182 -           ((ah->opmode != NL80211_IFTYPE_STATION) &&
4183 -            (ah->opmode != NL80211_IFTYPE_ADHOC)))
4184 +       /*
4185 +        * RSSI is not available for subframes in an A-MPDU.
4186 +        */
4187 +       if (rx_stats->rs_moreaggr) {
4188 +               rxs->flag |= RX_FLAG_NO_SIGNAL_VAL;
4189                 return;
4190 -
4191 -       if (rx_stats->rs_rssi != ATH9K_RSSI_BAD && !rx_stats->rs_moreaggr)
4192 -               ATH_RSSI_LPF(sc->last_rssi, rx_stats->rs_rssi);
4193 -
4194 -       last_rssi = sc->last_rssi;
4195 -       if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
4196 -               rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
4197 -       if (rssi < 0)
4198 -               rssi = 0;
4199 -
4200 -       /* Update Beacon RSSI, this is used by ANI. */
4201 -       ah->stats.avgbrssi = rssi;
4202 -}
4203 -
4204 -/*
4205 - * For Decrypt or Demic errors, we only mark packet status here and always push
4206 - * up the frame up to let mac80211 handle the actual error case, be it no
4207 - * decryption key or real decryption error. This let us keep statistics there.
4208 - */
4209 -static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
4210 -                                  struct ieee80211_hdr *hdr,
4211 -                                  struct ath_rx_status *rx_stats,
4212 -                                  struct ieee80211_rx_status *rx_status,
4213 -                                  bool *decrypt_error)
4214 -{
4215 -       struct ieee80211_hw *hw = sc->hw;
4216 -       struct ath_hw *ah = sc->sc_ah;
4217 -       struct ath_common *common = ath9k_hw_common(ah);
4218 -       bool discard_current = sc->rx.discard_next;
4219 -
4220 -       sc->rx.discard_next = rx_stats->rs_more;
4221 -       if (discard_current)
4222 -               return -EINVAL;
4223 +       }
4224
4225         /*
4226 -        * everything but the rate is checked here, the rate check is done
4227 -        * separately to avoid doing two lookups for a rate for each frame.
4228 +        * Check if the RSSI for the last subframe in an A-MPDU
4229 +        * or an unaggregated frame is valid.
4230          */
4231 -       if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
4232 -               return -EINVAL;
4233 -
4234 -       /* Only use status info from the last fragment */
4235 -       if (rx_stats->rs_more)
4236 -               return 0;
4237 +       if (rx_stats->rs_rssi == ATH9K_RSSI_BAD) {
4238 +               rxs->flag |= RX_FLAG_NO_SIGNAL_VAL;
4239 +               return;
4240 +       }
4241
4242 -       if (ath9k_process_rate(common, hw, rx_stats, rx_status))
4243 -               return -EINVAL;
4244 +       /*
4245 +        * Update Beacon RSSI, this is used by ANI.
4246 +        */
4247 +       if (rx_stats->is_mybeacon &&
4248 +           ((ah->opmode == NL80211_IFTYPE_STATION) ||
4249 +            (ah->opmode == NL80211_IFTYPE_ADHOC))) {
4250 +               ATH_RSSI_LPF(sc->last_rssi, rx_stats->rs_rssi);
4251 +               last_rssi = sc->last_rssi;
4252
4253 -       ath9k_process_rssi(common, hw, hdr, rx_stats);
4254 +               if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
4255 +                       rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
4256 +               if (rssi < 0)
4257 +                       rssi = 0;
4258
4259 -       rx_status->band = hw->conf.chandef.chan->band;
4260 -       rx_status->freq = hw->conf.chandef.chan->center_freq;
4261 -       rx_status->signal = ah->noise + rx_stats->rs_rssi;
4262 -       rx_status->antenna = rx_stats->rs_antenna;
4263 -       rx_status->flag |= RX_FLAG_MACTIME_END;
4264 -       if (rx_stats->rs_moreaggr)
4265 -               rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
4266 +               ah->stats.avgbrssi = rssi;
4267 +       }
4268
4269 -       sc->rx.discard_next = false;
4270 -       return 0;
4271 +       rxs->signal = ah->noise + rx_stats->rs_rssi;
4272  }
4273
4274 -static void ath9k_rx_skb_postprocess(struct ath_common *common,
4275 -                                    struct sk_buff *skb,
4276 -                                    struct ath_rx_status *rx_stats,
4277 -                                    struct ieee80211_rx_status *rxs,
4278 -                                    bool decrypt_error)
4279 +static void ath9k_process_tsf(struct ath_rx_status *rs,
4280 +                             struct ieee80211_rx_status *rxs,
4281 +                             u64 tsf)
4282  {
4283 -       struct ath_hw *ah = common->ah;
4284 -       struct ieee80211_hdr *hdr;
4285 -       int hdrlen, padpos, padsize;
4286 -       u8 keyix;
4287 -       __le16 fc;
4288 +       u32 tsf_lower = tsf & 0xffffffff;
4289
4290 -       /* see if any padding is done by the hw and remove it */
4291 -       hdr = (struct ieee80211_hdr *) skb->data;
4292 -       hdrlen = ieee80211_get_hdrlen_from_skb(skb);
4293 -       fc = hdr->frame_control;
4294 -       padpos = ieee80211_hdrlen(fc);
4295 +       rxs->mactime = (tsf & ~0xffffffffULL) | rs->rs_tstamp;
4296 +       if (rs->rs_tstamp > tsf_lower &&
4297 +           unlikely(rs->rs_tstamp - tsf_lower > 0x10000000))
4298 +               rxs->mactime -= 0x100000000ULL;
4299
4300 -       /* The MAC header is padded to have 32-bit boundary if the
4301 -        * packet payload is non-zero. The general calculation for
4302 -        * padsize would take into account odd header lengths:
4303 -        * padsize = (4 - padpos % 4) % 4; However, since only
4304 -        * even-length headers are used, padding can only be 0 or 2
4305 -        * bytes and we can optimize this a bit. In addition, we must
4306 -        * not try to remove padding from short control frames that do
4307 -        * not have payload. */
4308 -       padsize = padpos & 3;
4309 -       if (padsize && skb->len>=padpos+padsize+FCS_LEN) {
4310 -               memmove(skb->data + padsize, skb->data, padpos);
4311 -               skb_pull(skb, padsize);
4312 -       }
4313 -
4314 -       keyix = rx_stats->rs_keyix;
4315 -
4316 -       if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
4317 -           ieee80211_has_protected(fc)) {
4318 -               rxs->flag |= RX_FLAG_DECRYPTED;
4319 -       } else if (ieee80211_has_protected(fc)
4320 -                  && !decrypt_error && skb->len >= hdrlen + 4) {
4321 -               keyix = skb->data[hdrlen + 3] >> 6;
4322 -
4323 -               if (test_bit(keyix, common->keymap))
4324 -                       rxs->flag |= RX_FLAG_DECRYPTED;
4325 -       }
4326 -       if (ah->sw_mgmt_crypto &&
4327 -           (rxs->flag & RX_FLAG_DECRYPTED) &&
4328 -           ieee80211_is_mgmt(fc))
4329 -               /* Use software decrypt for management frames. */
4330 -               rxs->flag &= ~RX_FLAG_DECRYPTED;
4331 +       if (rs->rs_tstamp < tsf_lower &&
4332 +           unlikely(tsf_lower - rs->rs_tstamp > 0x10000000))
4333 +               rxs->mactime += 0x100000000ULL;
4334  }
4335
4336  #ifdef CPTCFG_ATH9K_DEBUGFS
4337 @@ -1133,6 +1056,234 @@ static int ath_process_fft(struct ath_so
4338  #endif
4339  }
4340
4341 +static bool ath9k_is_mybeacon(struct ath_softc *sc, struct ieee80211_hdr *hdr)
4342 +{
4343 +       struct ath_hw *ah = sc->sc_ah;
4344 +       struct ath_common *common = ath9k_hw_common(ah);
4345 +
4346 +       if (ieee80211_is_beacon(hdr->frame_control)) {
4347 +               RX_STAT_INC(rx_beacons);
4348 +               if (!is_zero_ether_addr(common->curbssid) &&
4349 +                   ether_addr_equal(hdr->addr3, common->curbssid))
4350 +                       return true;
4351 +       }
4352 +
4353 +       return false;
4354 +}
4355 +
4356 +/*
4357 + * For Decrypt or Demic errors, we only mark packet status here and always push
4358 + * up the frame up to let mac80211 handle the actual error case, be it no
4359 + * decryption key or real decryption error. This let us keep statistics there.
4360 + */
4361 +static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
4362 +                                  struct sk_buff *skb,
4363 +                                  struct ath_rx_status *rx_stats,
4364 +                                  struct ieee80211_rx_status *rx_status,
4365 +                                  bool *decrypt_error, u64 tsf)
4366 +{
4367 +       struct ieee80211_hw *hw = sc->hw;
4368 +       struct ath_hw *ah = sc->sc_ah;
4369 +       struct ath_common *common = ath9k_hw_common(ah);
4370 +       struct ieee80211_hdr *hdr;
4371 +       bool discard_current = sc->rx.discard_next;
4372 +       int ret = 0;
4373 +
4374 +       /*
4375 +        * Discard corrupt descriptors which are marked in
4376 +        * ath_get_next_rx_buf().
4377 +        */
4378 +       sc->rx.discard_next = rx_stats->rs_more;
4379 +       if (discard_current)
4380 +               return -EINVAL;
4381 +
4382 +       /*
4383 +        * Discard zero-length packets.
4384 +        */
4385 +       if (!rx_stats->rs_datalen) {
4386 +               RX_STAT_INC(rx_len_err);
4387 +               return -EINVAL;
4388 +       }
4389 +
4390 +        /*
4391 +         * rs_status follows rs_datalen so if rs_datalen is too large
4392 +         * we can take a hint that hardware corrupted it, so ignore
4393 +         * those frames.
4394 +         */
4395 +       if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
4396 +               RX_STAT_INC(rx_len_err);
4397 +               return -EINVAL;
4398 +       }
4399 +
4400 +       /* Only use status info from the last fragment */
4401 +       if (rx_stats->rs_more)
4402 +               return 0;
4403 +
4404 +       /*
4405 +        * Return immediately if the RX descriptor has been marked
4406 +        * as corrupt based on the various error bits.
4407 +        *
4408 +        * This is different from the other corrupt descriptor
4409 +        * condition handled above.
4410 +        */
4411 +       if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
4412 +               ret = -EINVAL;
4413 +               goto exit;
4414 +       }
4415 +
4416 +       hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
4417 +
4418 +       ath9k_process_tsf(rx_stats, rx_status, tsf);
4419 +       ath_debug_stat_rx(sc, rx_stats);
4420 +
4421 +       /*
4422 +        * Process PHY errors and return so that the packet
4423 +        * can be dropped.
4424 +        */
4425 +       if (rx_stats->rs_status & ATH9K_RXERR_PHY) {
4426 +               ath9k_dfs_process_phyerr(sc, hdr, rx_stats, rx_status->mactime);
4427 +               if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
4428 +                       RX_STAT_INC(rx_spectral);
4429 +
4430 +               ret = -EINVAL;
4431 +               goto exit;
4432 +       }
4433 +
4434 +       /*
4435 +        * everything but the rate is checked here, the rate check is done
4436 +        * separately to avoid doing two lookups for a rate for each frame.
4437 +        */
4438 +       if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
4439 +               ret = -EINVAL;
4440 +               goto exit;
4441 +       }
4442 +
4443 +       rx_stats->is_mybeacon = ath9k_is_mybeacon(sc, hdr);
4444 +       if (rx_stats->is_mybeacon) {
4445 +               sc->hw_busy_count = 0;
4446 +               ath_start_rx_poll(sc, 3);
4447 +       }
4448 +
4449 +       if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
4450 +               ret =-EINVAL;
4451 +               goto exit;
4452 +       }
4453 +
4454 +       ath9k_process_rssi(common, hw, rx_stats, rx_status);
4455 +
4456 +       rx_status->band = hw->conf.chandef.chan->band;
4457 +       rx_status->freq = hw->conf.chandef.chan->center_freq;
4458 +       rx_status->antenna = rx_stats->rs_antenna;
4459 +       rx_status->flag |= RX_FLAG_MACTIME_END;
4460 +
4461 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
4462 +       if (ieee80211_is_data_present(hdr->frame_control) &&
4463 +           !ieee80211_is_qos_nullfunc(hdr->frame_control))
4464 +               sc->rx.num_pkts++;
4465 +#endif
4466 +
4467 +exit:
4468 +       sc->rx.discard_next = false;
4469 +       return ret;
4470 +}
4471 +
4472 +static void ath9k_rx_skb_postprocess(struct ath_common *common,
4473 +                                    struct sk_buff *skb,
4474 +                                    struct ath_rx_status *rx_stats,
4475 +                                    struct ieee80211_rx_status *rxs,
4476 +                                    bool decrypt_error)
4477 +{
4478 +       struct ath_hw *ah = common->ah;
4479 +       struct ieee80211_hdr *hdr;
4480 +       int hdrlen, padpos, padsize;
4481 +       u8 keyix;
4482 +       __le16 fc;
4483 +
4484 +       /* see if any padding is done by the hw and remove it */
4485 +       hdr = (struct ieee80211_hdr *) skb->data;
4486 +       hdrlen = ieee80211_get_hdrlen_from_skb(skb);
4487 +       fc = hdr->frame_control;
4488 +       padpos = ieee80211_hdrlen(fc);
4489 +
4490 +       /* The MAC header is padded to have 32-bit boundary if the
4491 +        * packet payload is non-zero. The general calculation for
4492 +        * padsize would take into account odd header lengths:
4493 +        * padsize = (4 - padpos % 4) % 4; However, since only
4494 +        * even-length headers are used, padding can only be 0 or 2
4495 +        * bytes and we can optimize this a bit. In addition, we must
4496 +        * not try to remove padding from short control frames that do
4497 +        * not have payload. */
4498 +       padsize = padpos & 3;
4499 +       if (padsize && skb->len>=padpos+padsize+FCS_LEN) {
4500 +               memmove(skb->data + padsize, skb->data, padpos);
4501 +               skb_pull(skb, padsize);
4502 +       }
4503 +
4504 +       keyix = rx_stats->rs_keyix;
4505 +
4506 +       if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
4507 +           ieee80211_has_protected(fc)) {
4508 +               rxs->flag |= RX_FLAG_DECRYPTED;
4509 +       } else if (ieee80211_has_protected(fc)
4510 +                  && !decrypt_error && skb->len >= hdrlen + 4) {
4511 +               keyix = skb->data[hdrlen + 3] >> 6;
4512 +
4513 +               if (test_bit(keyix, common->keymap))
4514 +                       rxs->flag |= RX_FLAG_DECRYPTED;
4515 +       }
4516 +       if (ah->sw_mgmt_crypto &&
4517 +           (rxs->flag & RX_FLAG_DECRYPTED) &&
4518 +           ieee80211_is_mgmt(fc))
4519 +               /* Use software decrypt for management frames. */
4520 +               rxs->flag &= ~RX_FLAG_DECRYPTED;
4521 +}
4522 +
4523 +/*
4524 + * Run the LNA combining algorithm only in these cases:
4525 + *
4526 + * Standalone WLAN cards with both LNA/Antenna diversity
4527 + * enabled in the EEPROM.
4528 + *
4529 + * WLAN+BT cards which are in the supported card list
4530 + * in ath_pci_id_table and the user has loaded the
4531 + * driver with "bt_ant_diversity" set to true.
4532 + */
4533 +static void ath9k_antenna_check(struct ath_softc *sc,
4534 +                               struct ath_rx_status *rs)
4535 +{
4536 +       struct ath_hw *ah = sc->sc_ah;
4537 +       struct ath9k_hw_capabilities *pCap = &ah->caps;
4538 +       struct ath_common *common = ath9k_hw_common(ah);
4539 +
4540 +       if (!(ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB))
4541 +               return;
4542 +
4543 +       /*
4544 +        * All MPDUs in an aggregate will use the same LNA
4545 +        * as the first MPDU.
4546 +        */
4547 +       if (rs->rs_isaggr && !rs->rs_firstaggr)
4548 +               return;
4549 +
4550 +       /*
4551 +        * Change the default rx antenna if rx diversity
4552 +        * chooses the other antenna 3 times in a row.
4553 +        */
4554 +       if (sc->rx.defant != rs->rs_antenna) {
4555 +               if (++sc->rx.rxotherant >= 3)
4556 +                       ath_setdefantenna(sc, rs->rs_antenna);
4557 +       } else {
4558 +               sc->rx.rxotherant = 0;
4559 +       }
4560 +
4561 +       if (pCap->hw_caps & ATH9K_HW_CAP_BT_ANT_DIV) {
4562 +               if (common->bt_ant_diversity)
4563 +                       ath_ant_comb_scan(sc, rs);
4564 +       } else {
4565 +               ath_ant_comb_scan(sc, rs);
4566 +       }
4567 +}
4568 +
4569  static void ath9k_apply_ampdu_details(struct ath_softc *sc,
4570         struct ath_rx_status *rs, struct ieee80211_rx_status *rxs)
4571  {
4572 @@ -1159,15 +1310,12 @@ int ath_rx_tasklet(struct ath_softc *sc,
4573         struct ath_hw *ah = sc->sc_ah;
4574         struct ath_common *common = ath9k_hw_common(ah);
4575         struct ieee80211_hw *hw = sc->hw;
4576 -       struct ieee80211_hdr *hdr;
4577         int retval;
4578         struct ath_rx_status rs;
4579         enum ath9k_rx_qtype qtype;
4580         bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
4581         int dma_type;
4582 -       u8 rx_status_len = ah->caps.rx_status_len;
4583         u64 tsf = 0;
4584 -       u32 tsf_lower = 0;
4585         unsigned long flags;
4586         dma_addr_t new_buf_addr;
4587
4588 @@ -1179,7 +1327,6 @@ int ath_rx_tasklet(struct ath_softc *sc,
4589         qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
4590
4591         tsf = ath9k_hw_gettsf64(ah);
4592 -       tsf_lower = tsf & 0xffffffff;
4593
4594         do {
4595                 bool decrypt_error = false;
4596 @@ -1206,55 +1353,14 @@ int ath_rx_tasklet(struct ath_softc *sc,
4597                 else
4598                         hdr_skb = skb;
4599
4600 -               hdr = (struct ieee80211_hdr *) (hdr_skb->data + rx_status_len);
4601                 rxs = IEEE80211_SKB_RXCB(hdr_skb);
4602 -               if (ieee80211_is_beacon(hdr->frame_control)) {
4603 -                       RX_STAT_INC(rx_beacons);
4604 -                       if (!is_zero_ether_addr(common->curbssid) &&
4605 -                           ether_addr_equal(hdr->addr3, common->curbssid))
4606 -                               rs.is_mybeacon = true;
4607 -                       else
4608 -                               rs.is_mybeacon = false;
4609 -               }
4610 -               else
4611 -                       rs.is_mybeacon = false;
4612 -
4613 -               if (ieee80211_is_data_present(hdr->frame_control) &&
4614 -                   !ieee80211_is_qos_nullfunc(hdr->frame_control))
4615 -                       sc->rx.num_pkts++;
4616 -
4617 -               ath_debug_stat_rx(sc, &rs);
4618 -
4619                 memset(rxs, 0, sizeof(struct ieee80211_rx_status));
4620
4621 -               rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
4622 -               if (rs.rs_tstamp > tsf_lower &&
4623 -                   unlikely(rs.rs_tstamp - tsf_lower > 0x10000000))
4624 -                       rxs->mactime -= 0x100000000ULL;
4625 -
4626 -               if (rs.rs_tstamp < tsf_lower &&
4627 -                   unlikely(tsf_lower - rs.rs_tstamp > 0x10000000))
4628 -                       rxs->mactime += 0x100000000ULL;
4629 -
4630 -               if (rs.rs_phyerr == ATH9K_PHYERR_RADAR)
4631 -                       ath9k_dfs_process_phyerr(sc, hdr, &rs, rxs->mactime);
4632 -
4633 -               if (rs.rs_status & ATH9K_RXERR_PHY) {
4634 -                       if (ath_process_fft(sc, hdr, &rs, rxs->mactime)) {
4635 -                               RX_STAT_INC(rx_spectral);
4636 -                               goto requeue_drop_frag;
4637 -                       }
4638 -               }
4639 -
4640 -               retval = ath9k_rx_skb_preprocess(sc, hdr, &rs, rxs,
4641 -                                                &decrypt_error);
4642 +               retval = ath9k_rx_skb_preprocess(sc, hdr_skb, &rs, rxs,
4643 +                                                &decrypt_error, tsf);
4644                 if (retval)
4645                         goto requeue_drop_frag;
4646
4647 -               if (rs.is_mybeacon) {
4648 -                       sc->hw_busy_count = 0;
4649 -                       ath_start_rx_poll(sc, 3);
4650 -               }
4651                 /* Ensure we always have an skb to requeue once we are done
4652                  * processing the current buffer's skb */
4653                 requeue_skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_ATOMIC);
4654 @@ -1308,8 +1414,6 @@ int ath_rx_tasklet(struct ath_softc *sc,
4655                         sc->rx.frag = skb;
4656                         goto requeue;
4657                 }
4658 -               if (rs.rs_status & ATH9K_RXERR_CORRUPT_DESC)
4659 -                       goto requeue_drop_frag;
4660
4661                 if (sc->rx.frag) {
4662                         int space = skb->len - skb_tailroom(hdr_skb);
4663 @@ -1328,22 +1432,6 @@ int ath_rx_tasklet(struct ath_softc *sc,
4664                         skb = hdr_skb;
4665                 }
4666
4667 -
4668 -               if (ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) {
4669 -
4670 -                       /*
4671 -                        * change the default rx antenna if rx diversity
4672 -                        * chooses the other antenna 3 times in a row.
4673 -                        */
4674 -                       if (sc->rx.defant != rs.rs_antenna) {
4675 -                               if (++sc->rx.rxotherant >= 3)
4676 -                                       ath_setdefantenna(sc, rs.rs_antenna);
4677 -                       } else {
4678 -                               sc->rx.rxotherant = 0;
4679 -                       }
4680 -
4681 -               }
4682 -
4683                 if (rxs->flag & RX_FLAG_MMIC_STRIPPED)
4684                         skb_trim(skb, skb->len - 8);
4685
4686 @@ -1355,8 +1443,7 @@ int ath_rx_tasklet(struct ath_softc *sc,
4687                         ath_rx_ps(sc, skb, rs.is_mybeacon);
4688                 spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
4689
4690 -               if ((ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) && sc->ant_rx == 3)
4691 -                       ath_ant_comb_scan(sc, &rs);
4692 +               ath9k_antenna_check(sc, &rs);
4693
4694                 ath9k_apply_ampdu_details(sc, &rs, rxs);
4695
4696 @@ -1375,7 +1462,7 @@ requeue:
4697                 if (edma) {
4698                         ath_rx_edma_buf_link(sc, qtype);
4699                 } else {
4700 -                       ath_rx_buf_link(sc, bf);
4701 +                       ath_rx_buf_relink(sc, bf);
4702                         ath9k_hw_rxena(ah);
4703                 }
4704         } while (1);
4705 --- a/drivers/net/wireless/ath/ath9k/init.c
4706 +++ b/drivers/net/wireless/ath/ath9k/init.c
4707 @@ -53,9 +53,9 @@ static int ath9k_btcoex_enable;
4708  module_param_named(btcoex_enable, ath9k_btcoex_enable, int, 0444);
4709  MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
4710
4711 -static int ath9k_enable_diversity;
4712 -module_param_named(enable_diversity, ath9k_enable_diversity, int, 0444);
4713 -MODULE_PARM_DESC(enable_diversity, "Enable Antenna diversity for AR9565");
4714 +static int ath9k_bt_ant_diversity;
4715 +module_param_named(bt_ant_diversity, ath9k_bt_ant_diversity, int, 0444);
4716 +MODULE_PARM_DESC(bt_ant_diversity, "Enable WLAN/BT RX antenna diversity");
4717
4718  bool is_ath9k_unloaded;
4719  /* We use the hw_value as an index into our private channel structure */
4720 @@ -516,6 +516,7 @@ static void ath9k_init_misc(struct ath_s
4721  static void ath9k_init_platform(struct ath_softc *sc)
4722  {
4723         struct ath_hw *ah = sc->sc_ah;
4724 +       struct ath9k_hw_capabilities *pCap = &ah->caps;
4725         struct ath_common *common = ath9k_hw_common(ah);
4726
4727         if (common->bus_ops->ath_bus_type != ATH_PCI)
4728 @@ -525,12 +526,27 @@ static void ath9k_init_platform(struct a
4729                                ATH9K_PCI_CUS230)) {
4730                 ah->config.xlna_gpio = 9;
4731                 ah->config.xatten_margin_cfg = true;
4732 +               ah->config.alt_mingainidx = true;
4733 +               ah->config.ant_ctrl_comm2g_switch_enable = 0x000BBB88;
4734 +               sc->ant_comb.low_rssi_thresh = 20;
4735 +               sc->ant_comb.fast_div_bias = 3;
4736
4737                 ath_info(common, "Set parameters for %s\n",
4738                          (sc->driver_data & ATH9K_PCI_CUS198) ?
4739                          "CUS198" : "CUS230");
4740 -       } else if (sc->driver_data & ATH9K_PCI_CUS217) {
4741 +       }
4742 +
4743 +       if (sc->driver_data & ATH9K_PCI_CUS217)
4744                 ath_info(common, "CUS217 card detected\n");
4745 +
4746 +       if (sc->driver_data & ATH9K_PCI_BT_ANT_DIV) {
4747 +               pCap->hw_caps |= ATH9K_HW_CAP_BT_ANT_DIV;
4748 +               ath_info(common, "Set BT/WLAN RX diversity capability\n");
4749 +       }
4750 +
4751 +       if (sc->driver_data & ATH9K_PCI_D3_L1_WAR) {
4752 +               ah->config.pcie_waen = 0x0040473b;
4753 +               ath_info(common, "Enable WAR for ASPM D3/L1\n");
4754         }
4755  }
4756
4757 @@ -584,6 +600,7 @@ static int ath9k_init_softc(u16 devid, s
4758  {
4759         struct ath9k_platform_data *pdata = sc->dev->platform_data;
4760         struct ath_hw *ah = NULL;
4761 +       struct ath9k_hw_capabilities *pCap;
4762         struct ath_common *common;
4763         int ret = 0, i;
4764         int csz = 0;
4765 @@ -600,6 +617,7 @@ static int ath9k_init_softc(u16 devid, s
4766         ah->reg_ops.rmw = ath9k_reg_rmw;
4767         atomic_set(&ah->intr_ref_cnt, -1);
4768         sc->sc_ah = ah;
4769 +       pCap = &ah->caps;
4770
4771         sc->dfs_detector = dfs_pattern_detector_init(ah, NL80211_DFS_UNSET);
4772
4773 @@ -631,11 +649,15 @@ static int ath9k_init_softc(u16 devid, s
4774         ath9k_init_platform(sc);
4775
4776         /*
4777 -        * Enable Antenna diversity only when BTCOEX is disabled
4778 -        * and the user manually requests the feature.
4779 +        * Enable WLAN/BT RX Antenna diversity only when:
4780 +        *
4781 +        * - BTCOEX is disabled.
4782 +        * - the user manually requests the feature.
4783 +        * - the HW cap is set using the platform data.
4784          */
4785 -       if (!common->btcoex_enabled && ath9k_enable_diversity)
4786 -               common->antenna_diversity = 1;
4787 +       if (!common->btcoex_enabled && ath9k_bt_ant_diversity &&
4788 +           (pCap->hw_caps & ATH9K_HW_CAP_BT_ANT_DIV))
4789 +               common->bt_ant_diversity = 1;
4790
4791         spin_lock_init(&common->cc_lock);
4792
4793 @@ -710,13 +732,15 @@ static void ath9k_init_band_txpower(stru
4794         struct ieee80211_supported_band *sband;
4795         struct ieee80211_channel *chan;
4796         struct ath_hw *ah = sc->sc_ah;
4797 +       struct cfg80211_chan_def chandef;
4798         int i;
4799
4800         sband = &sc->sbands[band];
4801         for (i = 0; i < sband->n_channels; i++) {
4802                 chan = &sband->channels[i];
4803                 ah->curchan = &ah->channels[chan->hw_value];
4804 -               ath9k_cmn_update_ichannel(ah->curchan, chan, NL80211_CHAN_HT20);
4805 +               cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_HT20);
4806 +               ath9k_cmn_update_ichannel(ah->curchan, &chandef);
4807                 ath9k_hw_set_txpowerlimit(ah, MAX_RATE_POWER, true);
4808         }
4809  }
4810 @@ -802,7 +826,8 @@ void ath9k_set_hw_capab(struct ath_softc
4811                 IEEE80211_HW_PS_NULLFUNC_STACK |
4812                 IEEE80211_HW_SPECTRUM_MGMT |
4813                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
4814 -               IEEE80211_HW_SUPPORTS_RC_TABLE;
4815 +               IEEE80211_HW_SUPPORTS_RC_TABLE |
4816 +               IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
4817
4818         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
4819                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
4820 --- a/drivers/net/wireless/ath/carl9170/main.c
4821 +++ b/drivers/net/wireless/ath/carl9170/main.c
4822 @@ -1878,7 +1878,8 @@ void *carl9170_alloc(size_t priv_size)
4823                      IEEE80211_HW_PS_NULLFUNC_STACK |
4824                      IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
4825                      IEEE80211_HW_SUPPORTS_RC_TABLE |
4826 -                    IEEE80211_HW_SIGNAL_DBM;
4827 +                    IEEE80211_HW_SIGNAL_DBM |
4828 +                    IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
4829
4830         if (!modparam_noht) {
4831                 /*
4832 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
4833 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
4834 @@ -6133,7 +6133,8 @@ static int rt2800_probe_hw_mode(struct r
4835             IEEE80211_HW_SUPPORTS_PS |
4836             IEEE80211_HW_PS_NULLFUNC_STACK |
4837             IEEE80211_HW_AMPDU_AGGREGATION |
4838 -           IEEE80211_HW_REPORTS_TX_ACK_STATUS;
4839 +           IEEE80211_HW_REPORTS_TX_ACK_STATUS |
4840 +           IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
4841
4842         /*
4843          * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
4844 --- a/include/net/mac80211.h
4845 +++ b/include/net/mac80211.h
4846 @@ -152,11 +152,14 @@ struct ieee80211_low_level_stats {
4847   * @IEEE80211_CHANCTX_CHANGE_WIDTH: The channel width changed
4848   * @IEEE80211_CHANCTX_CHANGE_RX_CHAINS: The number of RX chains changed
4849   * @IEEE80211_CHANCTX_CHANGE_RADAR: radar detection flag changed
4850 + * @IEEE80211_CHANCTX_CHANGE_CHANNEL: switched to another operating channel,
4851 + *     this is used only with channel switching with CSA
4852   */
4853  enum ieee80211_chanctx_change {
4854         IEEE80211_CHANCTX_CHANGE_WIDTH          = BIT(0),
4855         IEEE80211_CHANCTX_CHANGE_RX_CHAINS      = BIT(1),
4856         IEEE80211_CHANCTX_CHANGE_RADAR          = BIT(2),
4857 +       IEEE80211_CHANCTX_CHANGE_CHANNEL        = BIT(3),
4858  };
4859
4860  /**
4861 @@ -1080,6 +1083,7 @@ enum ieee80211_vif_flags {
4862   * @addr: address of this interface
4863   * @p2p: indicates whether this AP or STA interface is a p2p
4864   *     interface, i.e. a GO or p2p-sta respectively
4865 + * @csa_active: marks whether a channel switch is going on
4866   * @driver_flags: flags/capabilities the driver has for this interface,
4867   *     these need to be set (or cleared) when the interface is added
4868   *     or, if supported by the driver, the interface type is changed
4869 @@ -1102,6 +1106,7 @@ struct ieee80211_vif {
4870         struct ieee80211_bss_conf bss_conf;
4871         u8 addr[ETH_ALEN];
4872         bool p2p;
4873 +       bool csa_active;
4874
4875         u8 cab_queue;
4876         u8 hw_queue[IEEE80211_NUM_ACS];
4877 @@ -1499,6 +1504,7 @@ enum ieee80211_hw_flags {
4878         IEEE80211_HW_SUPPORTS_RC_TABLE                  = 1<<24,
4879         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
4880         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
4881 +       IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
4882  };
4883
4884  /**
4885 @@ -2633,6 +2639,16 @@ enum ieee80211_roc_type {
4886   * @ipv6_addr_change: IPv6 address assignment on the given interface changed.
4887   *     Currently, this is only called for managed or P2P client interfaces.
4888   *     This callback is optional; it must not sleep.
4889 + *
4890 + * @channel_switch_beacon: Starts a channel switch to a new channel.
4891 + *     Beacons are modified to include CSA or ECSA IEs before calling this
4892 + *     function. The corresponding count fields in these IEs must be
4893 + *     decremented, and when they reach zero the driver must call
4894 + *     ieee80211_csa_finish(). Drivers which use ieee80211_beacon_get()
4895 + *     get the csa counter decremented by mac80211, but must check if it is
4896 + *     zero using ieee80211_csa_is_complete() after the beacon has been
4897 + *     transmitted and then call ieee80211_csa_finish().
4898 + *
4899   */
4900  struct ieee80211_ops {
4901         void (*tx)(struct ieee80211_hw *hw,
4902 @@ -2830,6 +2846,9 @@ struct ieee80211_ops {
4903                                  struct ieee80211_vif *vif,
4904                                  struct inet6_dev *idev);
4905  #endif
4906 +       void (*channel_switch_beacon)(struct ieee80211_hw *hw,
4907 +                                     struct ieee80211_vif *vif,
4908 +                                     struct cfg80211_chan_def *chandef);
4909  };
4910
4911  /**
4912 @@ -3325,6 +3344,25 @@ static inline struct sk_buff *ieee80211_
4913  }
4914
4915  /**
4916 + * ieee80211_csa_finish - notify mac80211 about channel switch
4917 + * @vif: &struct ieee80211_vif pointer from the add_interface callback.
4918 + *
4919 + * After a channel switch announcement was scheduled and the counter in this
4920 + * announcement hit zero, this function must be called by the driver to
4921 + * notify mac80211 that the channel can be changed.
4922 + */
4923 +void ieee80211_csa_finish(struct ieee80211_vif *vif);
4924 +
4925 +/**
4926 + * ieee80211_csa_is_complete - find out if counters reached zero
4927 + * @vif: &struct ieee80211_vif pointer from the add_interface callback.
4928 + *
4929 + * This function returns whether the channel switch counters reached zero.
4930 + */
4931 +bool ieee80211_csa_is_complete(struct ieee80211_vif *vif);
4932 +
4933 +
4934 +/**
4935   * ieee80211_proberesp_get - retrieve a Probe Response template
4936   * @hw: pointer obtained from ieee80211_alloc_hw().
4937   * @vif: &struct ieee80211_vif pointer from the add_interface callback.
4938 --- a/net/mac80211/cfg.c
4939 +++ b/net/mac80211/cfg.c
4940 @@ -854,8 +854,8 @@ static int ieee80211_set_probe_resp(stru
4941         return 0;
4942  }
4943
4944 -static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
4945 -                                  struct cfg80211_beacon_data *params)
4946 +int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
4947 +                           struct cfg80211_beacon_data *params)
4948  {
4949         struct beacon_data *new, *old;
4950         int new_head_len, new_tail_len;
4951 @@ -1018,6 +1018,12 @@ static int ieee80211_change_beacon(struc
4952
4953         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4954
4955 +       /* don't allow changing the beacon while CSA is in place - offset
4956 +        * of channel switch counter may change
4957 +        */
4958 +       if (sdata->vif.csa_active)
4959 +               return -EBUSY;
4960 +
4961         old = rtnl_dereference(sdata->u.ap.beacon);
4962         if (!old)
4963                 return -ENOENT;
4964 @@ -1042,6 +1048,10 @@ static int ieee80211_stop_ap(struct wiph
4965                 return -ENOENT;
4966         old_probe_resp = rtnl_dereference(sdata->u.ap.probe_resp);
4967
4968 +       /* abort any running channel switch */
4969 +       sdata->vif.csa_active = false;
4970 +       cancel_work_sync(&sdata->csa_finalize_work);
4971 +
4972         /* turn off carrier for this interface and dependent VLANs */
4973         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
4974                 netif_carrier_off(vlan->dev);
4975 @@ -2784,6 +2794,178 @@ static int ieee80211_start_radar_detecti
4976         return 0;
4977  }
4978
4979 +static struct cfg80211_beacon_data *
4980 +cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
4981 +{
4982 +       struct cfg80211_beacon_data *new_beacon;
4983 +       u8 *pos;
4984 +       int len;
4985 +
4986 +       len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
4987 +             beacon->proberesp_ies_len + beacon->assocresp_ies_len +
4988 +             beacon->probe_resp_len;
4989 +
4990 +       new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
4991 +       if (!new_beacon)
4992 +               return NULL;
4993 +
4994 +       pos = (u8 *)(new_beacon + 1);
4995 +       if (beacon->head_len) {
4996 +               new_beacon->head_len = beacon->head_len;
4997 +               new_beacon->head = pos;
4998 +               memcpy(pos, beacon->head, beacon->head_len);
4999 +               pos += beacon->head_len;
5000 +       }
5001 +       if (beacon->tail_len) {
5002 +               new_beacon->tail_len = beacon->tail_len;
5003 +               new_beacon->tail = pos;
5004 +               memcpy(pos, beacon->tail, beacon->tail_len);
5005 +               pos += beacon->tail_len;
5006 +       }
5007 +       if (beacon->beacon_ies_len) {
5008 +               new_beacon->beacon_ies_len = beacon->beacon_ies_len;
5009 +               new_beacon->beacon_ies = pos;
5010 +               memcpy(pos, beacon->beacon_ies, beacon->beacon_ies_len);
5011 +               pos += beacon->beacon_ies_len;
5012 +       }
5013 +       if (beacon->proberesp_ies_len) {
5014 +               new_beacon->proberesp_ies_len = beacon->proberesp_ies_len;
5015 +               new_beacon->proberesp_ies = pos;
5016 +               memcpy(pos, beacon->proberesp_ies, beacon->proberesp_ies_len);
5017 +               pos += beacon->proberesp_ies_len;
5018 +       }
5019 +       if (beacon->assocresp_ies_len) {
5020 +               new_beacon->assocresp_ies_len = beacon->assocresp_ies_len;
5021 +               new_beacon->assocresp_ies = pos;
5022 +               memcpy(pos, beacon->assocresp_ies, beacon->assocresp_ies_len);
5023 +               pos += beacon->assocresp_ies_len;
5024 +       }
5025 +       if (beacon->probe_resp_len) {
5026 +               new_beacon->probe_resp_len = beacon->probe_resp_len;
5027 +               beacon->probe_resp = pos;
5028 +               memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
5029 +               pos += beacon->probe_resp_len;
5030 +       }
5031 +
5032 +       return new_beacon;
5033 +}
5034 +
5035 +void ieee80211_csa_finalize_work(struct work_struct *work)
5036 +{
5037 +       struct ieee80211_sub_if_data *sdata =
5038 +               container_of(work, struct ieee80211_sub_if_data,
5039 +                            csa_finalize_work);
5040 +       struct ieee80211_local *local = sdata->local;
5041 +       int err, changed;
5042 +
5043 +       if (!ieee80211_sdata_running(sdata))
5044 +               return;
5045 +
5046 +       if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
5047 +               return;
5048 +
5049 +       sdata->radar_required = sdata->csa_radar_required;
5050 +       err = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
5051 +                                          &changed);
5052 +       if (WARN_ON(err < 0))
5053 +               return;
5054 +
5055 +       err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
5056 +       if (err < 0)
5057 +               return;
5058 +
5059 +       changed |= err;
5060 +       kfree(sdata->u.ap.next_beacon);
5061 +       sdata->u.ap.next_beacon = NULL;
5062 +       sdata->vif.csa_active = false;
5063 +
5064 +       ieee80211_wake_queues_by_reason(&sdata->local->hw,
5065 +                                       IEEE80211_MAX_QUEUE_MAP,
5066 +                                       IEEE80211_QUEUE_STOP_REASON_CSA);
5067 +
5068 +       ieee80211_bss_info_change_notify(sdata, changed);
5069 +
5070 +       cfg80211_ch_switch_notify(sdata->dev, &local->csa_chandef);
5071 +}
5072 +
5073 +static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
5074 +                                   struct cfg80211_csa_settings *params)
5075 +{
5076 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
5077 +       struct ieee80211_local *local = sdata->local;
5078 +       struct ieee80211_chanctx_conf *chanctx_conf;
5079 +       struct ieee80211_chanctx *chanctx;
5080 +       int err, num_chanctx;
5081 +
5082 +       if (!list_empty(&local->roc_list) || local->scanning)
5083 +               return -EBUSY;
5084 +
5085 +       if (sdata->wdev.cac_started)
5086 +               return -EBUSY;
5087 +
5088 +       if (cfg80211_chandef_identical(&params->chandef,
5089 +                                      &sdata->vif.bss_conf.chandef))
5090 +               return -EINVAL;
5091 +
5092 +       rcu_read_lock();
5093 +       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
5094 +       if (!chanctx_conf) {
5095 +               rcu_read_unlock();
5096 +               return -EBUSY;
5097 +       }
5098 +
5099 +       /* don't handle for multi-VIF cases */
5100 +       chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
5101 +       if (chanctx->refcount > 1) {
5102 +               rcu_read_unlock();
5103 +               return -EBUSY;
5104 +       }
5105 +       num_chanctx = 0;
5106 +       list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
5107 +               num_chanctx++;
5108 +       rcu_read_unlock();
5109 +
5110 +       if (num_chanctx > 1)
5111 +               return -EBUSY;
5112 +
5113 +       /* don't allow another channel switch if one is already active. */
5114 +       if (sdata->vif.csa_active)
5115 +               return -EBUSY;
5116 +
5117 +       /* only handle AP for now. */
5118 +       switch (sdata->vif.type) {
5119 +       case NL80211_IFTYPE_AP:
5120 +               break;
5121 +       default:
5122 +               return -EOPNOTSUPP;
5123 +       }
5124 +
5125 +       sdata->u.ap.next_beacon = cfg80211_beacon_dup(&params->beacon_after);
5126 +       if (!sdata->u.ap.next_beacon)
5127 +               return -ENOMEM;
5128 +
5129 +       sdata->csa_counter_offset_beacon = params->counter_offset_beacon;
5130 +       sdata->csa_counter_offset_presp = params->counter_offset_presp;
5131 +       sdata->csa_radar_required = params->radar_required;
5132 +
5133 +       if (params->block_tx)
5134 +               ieee80211_stop_queues_by_reason(&local->hw,
5135 +                               IEEE80211_MAX_QUEUE_MAP,
5136 +                               IEEE80211_QUEUE_STOP_REASON_CSA);
5137 +
5138 +       err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
5139 +       if (err < 0)
5140 +               return err;
5141 +
5142 +       local->csa_chandef = params->chandef;
5143 +       sdata->vif.csa_active = true;
5144 +
5145 +       ieee80211_bss_info_change_notify(sdata, err);
5146 +       drv_channel_switch_beacon(sdata, &params->chandef);
5147 +
5148 +       return 0;
5149 +}
5150 +
5151  static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5152                              struct ieee80211_channel *chan, bool offchan,
5153                              unsigned int wait, const u8 *buf, size_t len,
5154 @@ -3332,7 +3514,7 @@ static int ieee80211_probe_client(struct
5155                 return -EINVAL;
5156         }
5157         band = chanctx_conf->def.chan->band;
5158 -       sta = sta_info_get(sdata, peer);
5159 +       sta = sta_info_get_bss(sdata, peer);
5160         if (sta) {
5161                 qos = test_sta_flag(sta, WLAN_STA_WME);
5162         } else {
5163 @@ -3501,4 +3683,5 @@ struct cfg80211_ops mac80211_config_ops
5164         .get_et_strings = ieee80211_get_et_strings,
5165         .get_channel = ieee80211_cfg_get_channel,
5166         .start_radar_detection = ieee80211_start_radar_detection,
5167 +       .channel_switch = ieee80211_channel_switch,
5168  };
5169 --- a/net/mac80211/chan.c
5170 +++ b/net/mac80211/chan.c
5171 @@ -410,6 +410,64 @@ int ieee80211_vif_use_channel(struct iee
5172         return ret;
5173  }
5174
5175 +int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
5176 +                                const struct cfg80211_chan_def *chandef,
5177 +                                u32 *changed)
5178 +{
5179 +       struct ieee80211_local *local = sdata->local;
5180 +       struct ieee80211_chanctx_conf *conf;
5181 +       struct ieee80211_chanctx *ctx;
5182 +       int ret;
5183 +       u32 chanctx_changed = 0;
5184 +
5185 +       /* should never be called if not performing a channel switch. */
5186 +       if (WARN_ON(!sdata->vif.csa_active))
5187 +               return -EINVAL;
5188 +
5189 +       if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
5190 +                                    IEEE80211_CHAN_DISABLED))
5191 +               return -EINVAL;
5192 +
5193 +       mutex_lock(&local->chanctx_mtx);
5194 +       conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
5195 +                                        lockdep_is_held(&local->chanctx_mtx));
5196 +       if (!conf) {
5197 +               ret = -EINVAL;
5198 +               goto out;
5199 +       }
5200 +
5201 +       ctx = container_of(conf, struct ieee80211_chanctx, conf);
5202 +       if (ctx->refcount != 1) {
5203 +               ret = -EINVAL;
5204 +               goto out;
5205 +       }
5206 +
5207 +       if (sdata->vif.bss_conf.chandef.width != chandef->width) {
5208 +               chanctx_changed = IEEE80211_CHANCTX_CHANGE_WIDTH;
5209 +               *changed |= BSS_CHANGED_BANDWIDTH;
5210 +       }
5211 +
5212 +       sdata->vif.bss_conf.chandef = *chandef;
5213 +       ctx->conf.def = *chandef;
5214 +
5215 +       chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
5216 +       drv_change_chanctx(local, ctx, chanctx_changed);
5217 +
5218 +       if (!local->use_chanctx) {
5219 +               local->_oper_chandef = *chandef;
5220 +               ieee80211_hw_config(local, 0);
5221 +       }
5222 +
5223 +       ieee80211_recalc_chanctx_chantype(local, ctx);
5224 +       ieee80211_recalc_smps_chanctx(local, ctx);
5225 +       ieee80211_recalc_radar_chanctx(local, ctx);
5226 +
5227 +       ret = 0;
5228 + out:
5229 +       mutex_unlock(&local->chanctx_mtx);
5230 +       return ret;
5231 +}
5232 +
5233  int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
5234                                    const struct cfg80211_chan_def *chandef,
5235                                    u32 *changed)
5236 --- a/net/mac80211/driver-ops.h
5237 +++ b/net/mac80211/driver-ops.h
5238 @@ -1104,4 +1104,17 @@ static inline void drv_ipv6_addr_change(
5239  }
5240  #endif
5241
5242 +static inline void
5243 +drv_channel_switch_beacon(struct ieee80211_sub_if_data *sdata,
5244 +                         struct cfg80211_chan_def *chandef)
5245 +{
5246 +       struct ieee80211_local *local = sdata->local;
5247 +
5248 +       if (local->ops->channel_switch_beacon) {
5249 +               trace_drv_channel_switch_beacon(local, sdata, chandef);
5250 +               local->ops->channel_switch_beacon(&local->hw, &sdata->vif,
5251 +                                                 chandef);
5252 +       }
5253 +}
5254 +
5255  #endif /* __MAC80211_DRIVER_OPS */
5256 --- a/net/mac80211/ieee80211_i.h
5257 +++ b/net/mac80211/ieee80211_i.h
5258 @@ -53,9 +53,6 @@ struct ieee80211_local;
5259   * increased memory use (about 2 kB of RAM per entry). */
5260  #define IEEE80211_FRAGMENT_MAX 4
5261
5262 -#define TU_TO_JIFFIES(x)       (usecs_to_jiffies((x) * 1024))
5263 -#define TU_TO_EXP_TIME(x)      (jiffies + TU_TO_JIFFIES(x))
5264 -
5265  /* power level hasn't been configured (or set to automatic) */
5266  #define IEEE80211_UNSET_POWER_LEVEL    INT_MIN
5267
5268 @@ -259,6 +256,8 @@ struct ieee80211_if_ap {
5269         struct beacon_data __rcu *beacon;
5270         struct probe_resp __rcu *probe_resp;
5271
5272 +       /* to be used after channel switch. */
5273 +       struct cfg80211_beacon_data *next_beacon;
5274         struct list_head vlans;
5275
5276         struct ps_data ps;
5277 @@ -713,6 +712,11 @@ struct ieee80211_sub_if_data {
5278
5279         struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
5280
5281 +       struct work_struct csa_finalize_work;
5282 +       int csa_counter_offset_beacon;
5283 +       int csa_counter_offset_presp;
5284 +       bool csa_radar_required;
5285 +
5286         /* used to reconfigure hardware SM PS */
5287         struct work_struct recalc_smps;
5288
5289 @@ -1346,6 +1350,9 @@ void ieee80211_roc_notify_destroy(struct
5290  void ieee80211_sw_roc_work(struct work_struct *work);
5291  void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
5292
5293 +/* channel switch handling */
5294 +void ieee80211_csa_finalize_work(struct work_struct *work);
5295 +
5296  /* interface handling */
5297  int ieee80211_iface_init(void);
5298  void ieee80211_iface_exit(void);
5299 @@ -1367,6 +1374,8 @@ void ieee80211_del_virtual_monitor(struc
5300
5301  bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata);
5302  void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata);
5303 +int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
5304 +                           struct cfg80211_beacon_data *params);
5305
5306  static inline bool ieee80211_sdata_running(struct ieee80211_sub_if_data *sdata)
5307  {
5308 @@ -1627,6 +1636,11 @@ int __must_check
5309  ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
5310                                const struct cfg80211_chan_def *chandef,
5311                                u32 *changed);
5312 +/* NOTE: only use ieee80211_vif_change_channel() for channel switch */
5313 +int __must_check
5314 +ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
5315 +                            const struct cfg80211_chan_def *chandef,
5316 +                            u32 *changed);
5317  void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
5318  void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
5319  void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
5320 --- a/net/mac80211/trace.h
5321 +++ b/net/mac80211/trace.h
5322 @@ -1906,6 +1906,32 @@ TRACE_EVENT(api_radar_detected,
5323         )
5324  );
5325
5326 +TRACE_EVENT(drv_channel_switch_beacon,
5327 +       TP_PROTO(struct ieee80211_local *local,
5328 +                struct ieee80211_sub_if_data *sdata,
5329 +                struct cfg80211_chan_def *chandef),
5330 +
5331 +       TP_ARGS(local, sdata, chandef),
5332 +
5333 +       TP_STRUCT__entry(
5334 +               LOCAL_ENTRY
5335 +               VIF_ENTRY
5336 +               CHANDEF_ENTRY
5337 +       ),
5338 +
5339 +       TP_fast_assign(
5340 +               LOCAL_ASSIGN;
5341 +               VIF_ASSIGN;
5342 +               CHANDEF_ASSIGN(chandef);
5343 +       ),
5344 +
5345 +       TP_printk(
5346 +               LOCAL_PR_FMT VIF_PR_FMT " channel switch to " CHANDEF_PR_FMT,
5347 +               LOCAL_PR_ARG, VIF_PR_ARG, CHANDEF_PR_ARG
5348 +       )
5349 +);
5350 +
5351 +
5352  #ifdef CPTCFG_MAC80211_MESSAGE_TRACING
5353  #undef TRACE_SYSTEM
5354  #define TRACE_SYSTEM mac80211_msg
5355 --- a/net/mac80211/tx.c
5356 +++ b/net/mac80211/tx.c
5357 @@ -1101,7 +1101,8 @@ ieee80211_tx_prepare(struct ieee80211_su
5358                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
5359                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
5360                         return TX_DROP;
5361 -       } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
5362 +       } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
5363 +                                 IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
5364                    tx->sdata->control_port_protocol == tx->skb->protocol) {
5365                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
5366         }
5367 @@ -2326,6 +2327,81 @@ static int ieee80211_beacon_add_tim(stru
5368         return 0;
5369  }
5370
5371 +void ieee80211_csa_finish(struct ieee80211_vif *vif)
5372 +{
5373 +       struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5374 +
5375 +       ieee80211_queue_work(&sdata->local->hw,
5376 +                            &sdata->csa_finalize_work);
5377 +}
5378 +EXPORT_SYMBOL(ieee80211_csa_finish);
5379 +
5380 +static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
5381 +                                struct beacon_data *beacon)
5382 +{
5383 +       struct probe_resp *resp;
5384 +       int counter_offset_beacon = sdata->csa_counter_offset_beacon;
5385 +       int counter_offset_presp = sdata->csa_counter_offset_presp;
5386 +
5387 +       /* warn if the driver did not check for/react to csa completeness */
5388 +       if (WARN_ON(((u8 *)beacon->tail)[counter_offset_beacon] == 0))
5389 +               return;
5390 +
5391 +       ((u8 *)beacon->tail)[counter_offset_beacon]--;
5392 +
5393 +       if (sdata->vif.type == NL80211_IFTYPE_AP &&
5394 +           counter_offset_presp) {
5395 +               rcu_read_lock();
5396 +               resp = rcu_dereference(sdata->u.ap.probe_resp);
5397 +
5398 +               /* if nl80211 accepted the offset, this should not happen. */
5399 +               if (WARN_ON(!resp)) {
5400 +                       rcu_read_unlock();
5401 +                       return;
5402 +               }
5403 +               resp->data[counter_offset_presp]--;
5404 +               rcu_read_unlock();
5405 +       }
5406 +}
5407 +
5408 +bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
5409 +{
5410 +       struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5411 +       struct beacon_data *beacon = NULL;
5412 +       u8 *beacon_data;
5413 +       size_t beacon_data_len;
5414 +       int counter_beacon = sdata->csa_counter_offset_beacon;
5415 +       int ret = false;
5416 +
5417 +       if (!ieee80211_sdata_running(sdata))
5418 +               return false;
5419 +
5420 +       rcu_read_lock();
5421 +       if (vif->type == NL80211_IFTYPE_AP) {
5422 +               struct ieee80211_if_ap *ap = &sdata->u.ap;
5423 +
5424 +               beacon = rcu_dereference(ap->beacon);
5425 +               if (WARN_ON(!beacon || !beacon->tail))
5426 +                       goto out;
5427 +               beacon_data = beacon->tail;
5428 +               beacon_data_len = beacon->tail_len;
5429 +       } else {
5430 +               WARN_ON(1);
5431 +               goto out;
5432 +       }
5433 +
5434 +       if (WARN_ON(counter_beacon > beacon_data_len))
5435 +               goto out;
5436 +
5437 +       if (beacon_data[counter_beacon] == 0)
5438 +               ret = true;
5439 + out:
5440 +       rcu_read_unlock();
5441 +
5442 +       return ret;
5443 +}
5444 +EXPORT_SYMBOL(ieee80211_csa_is_complete);
5445 +
5446  struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
5447                                          struct ieee80211_vif *vif,
5448                                          u16 *tim_offset, u16 *tim_length)
5449 @@ -2356,6 +2432,9 @@ struct sk_buff *ieee80211_beacon_get_tim
5450                 struct beacon_data *beacon = rcu_dereference(ap->beacon);
5451
5452                 if (beacon) {
5453 +                       if (sdata->vif.csa_active)
5454 +                               ieee80211_update_csa(sdata, beacon);
5455 +
5456                         /*
5457                          * headroom, head length,
5458                          * tail length and maximum TIM length
5459 --- a/net/wireless/rdev-ops.h
5460 +++ b/net/wireless/rdev-ops.h
5461 @@ -923,4 +923,16 @@ static inline void rdev_crit_proto_stop(
5462         trace_rdev_return_void(&rdev->wiphy);
5463  }
5464
5465 +static inline int rdev_channel_switch(struct cfg80211_registered_device *rdev,
5466 +                                     struct net_device *dev,
5467 +                                     struct cfg80211_csa_settings *params)
5468 +{
5469 +       int ret;
5470 +
5471 +       trace_rdev_channel_switch(&rdev->wiphy, dev, params);
5472 +       ret = rdev->ops->channel_switch(&rdev->wiphy, dev, params);
5473 +       trace_rdev_return_int(&rdev->wiphy, ret);
5474 +       return ret;
5475 +}
5476 +
5477  #endif /* __CFG80211_RDEV_OPS */
5478 --- a/net/wireless/trace.h
5479 +++ b/net/wireless/trace.h
5480 @@ -1841,6 +1841,39 @@ TRACE_EVENT(rdev_crit_proto_stop,
5481                   WIPHY_PR_ARG, WDEV_PR_ARG)
5482  );
5483
5484 +TRACE_EVENT(rdev_channel_switch,
5485 +       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
5486 +                struct cfg80211_csa_settings *params),
5487 +       TP_ARGS(wiphy, netdev, params),
5488 +       TP_STRUCT__entry(
5489 +               WIPHY_ENTRY
5490 +               NETDEV_ENTRY
5491 +               CHAN_DEF_ENTRY
5492 +               __field(u16, counter_offset_beacon)
5493 +               __field(u16, counter_offset_presp)
5494 +               __field(bool, radar_required)
5495 +               __field(bool, block_tx)
5496 +               __field(u8, count)
5497 +       ),
5498 +       TP_fast_assign(
5499 +               WIPHY_ASSIGN;
5500 +               NETDEV_ASSIGN;
5501 +               CHAN_DEF_ASSIGN(&params->chandef);
5502 +               __entry->counter_offset_beacon = params->counter_offset_beacon;
5503 +               __entry->counter_offset_presp = params->counter_offset_presp;
5504 +               __entry->radar_required = params->radar_required;
5505 +               __entry->block_tx = params->block_tx;
5506 +               __entry->count = params->count;
5507 +       ),
5508 +       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT
5509 +                 ", block_tx: %d, count: %u, radar_required: %d"
5510 +                 ", counter offsets (beacon/presp): %u/%u",
5511 +                 WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG,
5512 +                 __entry->block_tx, __entry->count, __entry->radar_required,
5513 +                 __entry->counter_offset_beacon,
5514 +                 __entry->counter_offset_presp)
5515 +);
5516 +
5517  /*************************************************************
5518   *          cfg80211 exported functions traces              *
5519   *************************************************************/
5520 --- a/drivers/net/wireless/ath/ath.h
5521 +++ b/drivers/net/wireless/ath/ath.h
5522 @@ -159,7 +159,7 @@ struct ath_common {
5523
5524         bool btcoex_enabled;
5525         bool disable_ani;
5526 -       bool antenna_diversity;
5527 +       bool bt_ant_diversity;
5528  };
5529
5530  struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
5531 --- a/drivers/net/wireless/ath/ath9k/antenna.c
5532 +++ b/drivers/net/wireless/ath/ath9k/antenna.c
5533 @@ -16,37 +16,119 @@
5534
5535  #include "ath9k.h"
5536
5537 -static inline bool ath_is_alt_ant_ratio_better(int alt_ratio, int maxdelta,
5538 +/*
5539 + * AR9285
5540 + * ======
5541 + *
5542 + * EEPROM has 2 4-bit fields containing the card configuration.
5543 + *
5544 + * antdiv_ctl1:
5545 + * ------------
5546 + * bb_enable_ant_div_lnadiv : 1
5547 + * bb_ant_div_alt_gaintb    : 1
5548 + * bb_ant_div_main_gaintb   : 1
5549 + * bb_enable_ant_fast_div   : 1
5550 + *
5551 + * antdiv_ctl2:
5552 + * -----------
5553 + * bb_ant_div_alt_lnaconf  : 2
5554 + * bb_ant_div_main_lnaconf : 2
5555 + *
5556 + * The EEPROM bits are used as follows:
5557 + * ------------------------------------
5558 + *
5559 + * bb_enable_ant_div_lnadiv      - Enable LNA path rx antenna diversity/combining.
5560 + *                                 Set in AR_PHY_MULTICHAIN_GAIN_CTL.
5561 + *
5562 + * bb_ant_div_[alt/main]_gaintb  - 0 -> Antenna config Alt/Main uses gaintable 0
5563 + *                                 1 -> Antenna config Alt/Main uses gaintable 1
5564 + *                                 Set in AR_PHY_MULTICHAIN_GAIN_CTL.
5565 + *
5566 + * bb_enable_ant_fast_div        - Enable fast antenna diversity.
5567 + *                                 Set in AR_PHY_CCK_DETECT.
5568 + *
5569 + * bb_ant_div_[alt/main]_lnaconf - Alt/Main LNA diversity/combining input config.
5570 + *                                 Set in AR_PHY_MULTICHAIN_GAIN_CTL.
5571 + *                                 10=LNA1
5572 + *                                 01=LNA2
5573 + *                                 11=LNA1+LNA2
5574 + *                                 00=LNA1-LNA2
5575 + *
5576 + * AR9485 / AR9565 / AR9331
5577 + * ========================
5578 + *
5579 + * The same bits are present in the EEPROM, but the location in the
5580 + * EEPROM is different (ant_div_control in ar9300_BaseExtension_1).
5581 + *
5582 + * ant_div_alt_lnaconf      ==> bit 0~1
5583 + * ant_div_main_lnaconf     ==> bit 2~3
5584 + * ant_div_alt_gaintb       ==> bit 4
5585 + * ant_div_main_gaintb      ==> bit 5
5586 + * enable_ant_div_lnadiv    ==> bit 6
5587 + * enable_ant_fast_div      ==> bit 7
5588 + */
5589 +
5590 +static inline bool ath_is_alt_ant_ratio_better(struct ath_ant_comb *antcomb,
5591 +                                              int alt_ratio, int maxdelta,
5592                                                int mindelta, int main_rssi_avg,
5593                                                int alt_rssi_avg, int pkt_count)
5594  {
5595 -       return (((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
5596 -                (alt_rssi_avg > main_rssi_avg + maxdelta)) ||
5597 -               (alt_rssi_avg > main_rssi_avg + mindelta)) && (pkt_count > 50);
5598 +       if (pkt_count <= 50)
5599 +               return false;
5600 +
5601 +       if (alt_rssi_avg > main_rssi_avg + mindelta)
5602 +               return true;
5603 +
5604 +       if (alt_ratio >= antcomb->ant_ratio2 &&
5605 +           alt_rssi_avg >= antcomb->low_rssi_thresh &&
5606 +           (alt_rssi_avg > main_rssi_avg + maxdelta))
5607 +               return true;
5608 +
5609 +       return false;
5610  }
5611
5612 -static inline bool ath_ant_div_comb_alt_check(u8 div_group, int alt_ratio,
5613 -                                             int curr_main_set, int curr_alt_set,
5614 -                                             int alt_rssi_avg, int main_rssi_avg)
5615 +static inline bool ath_ant_div_comb_alt_check(struct ath_hw_antcomb_conf *conf,
5616 +                                             struct ath_ant_comb *antcomb,
5617 +                                             int alt_ratio, int alt_rssi_avg,
5618 +                                             int main_rssi_avg)
5619  {
5620 -       bool result = false;
5621 -       switch (div_group) {
5622 +       bool result, set1, set2;
5623 +
5624 +       result = set1 = set2 = false;
5625 +
5626 +       if (conf->main_lna_conf == ATH_ANT_DIV_COMB_LNA2 &&
5627 +           conf->alt_lna_conf == ATH_ANT_DIV_COMB_LNA1)
5628 +               set1 = true;
5629 +
5630 +       if (conf->main_lna_conf == ATH_ANT_DIV_COMB_LNA1 &&
5631 +           conf->alt_lna_conf == ATH_ANT_DIV_COMB_LNA2)
5632 +               set2 = true;
5633 +
5634 +       switch (conf->div_group) {
5635         case 0:
5636                 if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
5637                         result = true;
5638                 break;
5639         case 1:
5640         case 2:
5641 -               if ((((curr_main_set == ATH_ANT_DIV_COMB_LNA2) &&
5642 -                     (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) &&
5643 -                     (alt_rssi_avg >= (main_rssi_avg - 5))) ||
5644 -                    ((curr_main_set == ATH_ANT_DIV_COMB_LNA1) &&
5645 -                     (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) &&
5646 -                     (alt_rssi_avg >= (main_rssi_avg - 2)))) &&
5647 -                   (alt_rssi_avg >= 4))
5648 +               if (alt_rssi_avg < 4 || alt_rssi_avg < antcomb->low_rssi_thresh)
5649 +                       break;
5650 +
5651 +               if ((set1 && (alt_rssi_avg >= (main_rssi_avg - 5))) ||
5652 +                   (set2 && (alt_rssi_avg >= (main_rssi_avg - 2))) ||
5653 +                   (alt_ratio > antcomb->ant_ratio))
5654                         result = true;
5655 -               else
5656 -                       result = false;
5657 +
5658 +               break;
5659 +       case 3:
5660 +               if (alt_rssi_avg < 4 || alt_rssi_avg < antcomb->low_rssi_thresh)
5661 +                       break;
5662 +
5663 +               if ((set1 && (alt_rssi_avg >= (main_rssi_avg - 3))) ||
5664 +                   (set2 && (alt_rssi_avg >= (main_rssi_avg + 3))) ||
5665 +                   (alt_ratio > antcomb->ant_ratio))
5666 +                       result = true;
5667 +
5668                 break;
5669         }
5670
5671 @@ -108,6 +190,74 @@ static void ath_lnaconf_alt_good_scan(st
5672         }
5673  }
5674
5675 +static void ath_ant_set_alt_ratio(struct ath_ant_comb *antcomb,
5676 +                                 struct ath_hw_antcomb_conf *conf)
5677 +{
5678 +       /* set alt to the conf with maximun ratio */
5679 +       if (antcomb->first_ratio && antcomb->second_ratio) {
5680 +               if (antcomb->rssi_second > antcomb->rssi_third) {
5681 +                       /* first alt*/
5682 +                       if ((antcomb->first_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1) ||
5683 +                           (antcomb->first_quick_scan_conf == ATH_ANT_DIV_COMB_LNA2))
5684 +                               /* Set alt LNA1 or LNA2*/
5685 +                               if (conf->main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
5686 +                                       conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
5687 +                               else
5688 +                                       conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
5689 +                       else
5690 +                               /* Set alt to A+B or A-B */
5691 +                               conf->alt_lna_conf =
5692 +                                       antcomb->first_quick_scan_conf;
5693 +               } else if ((antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1) ||
5694 +                          (antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA2)) {
5695 +                       /* Set alt LNA1 or LNA2 */
5696 +                       if (conf->main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
5697 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
5698 +                       else
5699 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
5700 +               } else {
5701 +                       /* Set alt to A+B or A-B */
5702 +                       conf->alt_lna_conf = antcomb->second_quick_scan_conf;
5703 +               }
5704 +       } else if (antcomb->first_ratio) {
5705 +               /* first alt */
5706 +               if ((antcomb->first_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1) ||
5707 +                   (antcomb->first_quick_scan_conf == ATH_ANT_DIV_COMB_LNA2))
5708 +                       /* Set alt LNA1 or LNA2 */
5709 +                       if (conf->main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
5710 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
5711 +                       else
5712 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
5713 +               else
5714 +                       /* Set alt to A+B or A-B */
5715 +                       conf->alt_lna_conf = antcomb->first_quick_scan_conf;
5716 +       } else if (antcomb->second_ratio) {
5717 +               /* second alt */
5718 +               if ((antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1) ||
5719 +                   (antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA2))
5720 +                       /* Set alt LNA1 or LNA2 */
5721 +                       if (conf->main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
5722 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
5723 +                       else
5724 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
5725 +               else
5726 +                       /* Set alt to A+B or A-B */
5727 +                       conf->alt_lna_conf = antcomb->second_quick_scan_conf;
5728 +       } else {
5729 +               /* main is largest */
5730 +               if ((antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) ||
5731 +                   (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2))
5732 +                       /* Set alt LNA1 or LNA2 */
5733 +                       if (conf->main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
5734 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
5735 +                       else
5736 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
5737 +               else
5738 +                       /* Set alt to A+B or A-B */
5739 +                       conf->alt_lna_conf = antcomb->main_conf;
5740 +       }
5741 +}
5742 +
5743  static void ath_select_ant_div_from_quick_scan(struct ath_ant_comb *antcomb,
5744                                        struct ath_hw_antcomb_conf *div_ant_conf,
5745                                        int main_rssi_avg, int alt_rssi_avg,
5746 @@ -129,7 +279,7 @@ static void ath_select_ant_div_from_quic
5747
5748                 if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
5749                         /* main is LNA1 */
5750 -                       if (ath_is_alt_ant_ratio_better(alt_ratio,
5751 +                       if (ath_is_alt_ant_ratio_better(antcomb, alt_ratio,
5752                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
5753                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
5754                                                 main_rssi_avg, alt_rssi_avg,
5755 @@ -138,7 +288,7 @@ static void ath_select_ant_div_from_quic
5756                         else
5757                                 antcomb->first_ratio = false;
5758                 } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
5759 -                       if (ath_is_alt_ant_ratio_better(alt_ratio,
5760 +                       if (ath_is_alt_ant_ratio_better(antcomb, alt_ratio,
5761                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
5762                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
5763                                                 main_rssi_avg, alt_rssi_avg,
5764 @@ -147,11 +297,11 @@ static void ath_select_ant_div_from_quic
5765                         else
5766                                 antcomb->first_ratio = false;
5767                 } else {
5768 -                       if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
5769 -                             (alt_rssi_avg > main_rssi_avg +
5770 -                              ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
5771 -                            (alt_rssi_avg > main_rssi_avg)) &&
5772 -                           (antcomb->total_pkt_count > 50))
5773 +                       if (ath_is_alt_ant_ratio_better(antcomb, alt_ratio,
5774 +                                               ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
5775 +                                               0,
5776 +                                               main_rssi_avg, alt_rssi_avg,
5777 +                                               antcomb->total_pkt_count))
5778                                 antcomb->first_ratio = true;
5779                         else
5780                                 antcomb->first_ratio = false;
5781 @@ -164,17 +314,21 @@ static void ath_select_ant_div_from_quic
5782                 antcomb->rssi_first = main_rssi_avg;
5783                 antcomb->rssi_third = alt_rssi_avg;
5784
5785 -               if (antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1)
5786 +               switch(antcomb->second_quick_scan_conf) {
5787 +               case ATH_ANT_DIV_COMB_LNA1:
5788                         antcomb->rssi_lna1 = alt_rssi_avg;
5789 -               else if (antcomb->second_quick_scan_conf ==
5790 -                        ATH_ANT_DIV_COMB_LNA2)
5791 +                       break;
5792 +               case ATH_ANT_DIV_COMB_LNA2:
5793                         antcomb->rssi_lna2 = alt_rssi_avg;
5794 -               else if (antcomb->second_quick_scan_conf ==
5795 -                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2) {
5796 +                       break;
5797 +               case ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2:
5798                         if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2)
5799                                 antcomb->rssi_lna2 = main_rssi_avg;
5800                         else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1)
5801                                 antcomb->rssi_lna1 = main_rssi_avg;
5802 +                       break;
5803 +               default:
5804 +                       break;
5805                 }
5806
5807                 if (antcomb->rssi_lna2 > antcomb->rssi_lna1 +
5808 @@ -184,7 +338,7 @@ static void ath_select_ant_div_from_quic
5809                         div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
5810
5811                 if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
5812 -                       if (ath_is_alt_ant_ratio_better(alt_ratio,
5813 +                       if (ath_is_alt_ant_ratio_better(antcomb, alt_ratio,
5814                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
5815                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
5816                                                 main_rssi_avg, alt_rssi_avg,
5817 @@ -193,7 +347,7 @@ static void ath_select_ant_div_from_quic
5818                         else
5819                                 antcomb->second_ratio = false;
5820                 } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
5821 -                       if (ath_is_alt_ant_ratio_better(alt_ratio,
5822 +                       if (ath_is_alt_ant_ratio_better(antcomb, alt_ratio,
5823                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
5824                                                 ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
5825                                                 main_rssi_avg, alt_rssi_avg,
5826 @@ -202,105 +356,18 @@ static void ath_select_ant_div_from_quic
5827                         else
5828                                 antcomb->second_ratio = false;
5829                 } else {
5830 -                       if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
5831 -                             (alt_rssi_avg > main_rssi_avg +
5832 -                              ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
5833 -                            (alt_rssi_avg > main_rssi_avg)) &&
5834 -                           (antcomb->total_pkt_count > 50))
5835 +                       if (ath_is_alt_ant_ratio_better(antcomb, alt_ratio,
5836 +                                               ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
5837 +                                               0,
5838 +                                               main_rssi_avg, alt_rssi_avg,
5839 +                                               antcomb->total_pkt_count))
5840                                 antcomb->second_ratio = true;
5841                         else
5842                                 antcomb->second_ratio = false;
5843                 }
5844
5845 -               /* set alt to the conf with maximun ratio */
5846 -               if (antcomb->first_ratio && antcomb->second_ratio) {
5847 -                       if (antcomb->rssi_second > antcomb->rssi_third) {
5848 -                               /* first alt*/
5849 -                               if ((antcomb->first_quick_scan_conf ==
5850 -                                   ATH_ANT_DIV_COMB_LNA1) ||
5851 -                                   (antcomb->first_quick_scan_conf ==
5852 -                                   ATH_ANT_DIV_COMB_LNA2))
5853 -                                       /* Set alt LNA1 or LNA2*/
5854 -                                       if (div_ant_conf->main_lna_conf ==
5855 -                                           ATH_ANT_DIV_COMB_LNA2)
5856 -                                               div_ant_conf->alt_lna_conf =
5857 -                                                       ATH_ANT_DIV_COMB_LNA1;
5858 -                                       else
5859 -                                               div_ant_conf->alt_lna_conf =
5860 -                                                       ATH_ANT_DIV_COMB_LNA2;
5861 -                               else
5862 -                                       /* Set alt to A+B or A-B */
5863 -                                       div_ant_conf->alt_lna_conf =
5864 -                                               antcomb->first_quick_scan_conf;
5865 -                       } else if ((antcomb->second_quick_scan_conf ==
5866 -                                  ATH_ANT_DIV_COMB_LNA1) ||
5867 -                                  (antcomb->second_quick_scan_conf ==
5868 -                                  ATH_ANT_DIV_COMB_LNA2)) {
5869 -                               /* Set alt LNA1 or LNA2 */
5870 -                               if (div_ant_conf->main_lna_conf ==
5871 -                                   ATH_ANT_DIV_COMB_LNA2)
5872 -                                       div_ant_conf->alt_lna_conf =
5873 -                                               ATH_ANT_DIV_COMB_LNA1;
5874 -                               else
5875 -                                       div_ant_conf->alt_lna_conf =
5876 -                                               ATH_ANT_DIV_COMB_LNA2;
5877 -                       } else {
5878 -                               /* Set alt to A+B or A-B */
5879 -                               div_ant_conf->alt_lna_conf =
5880 -                                       antcomb->second_quick_scan_conf;
5881 -                       }
5882 -               } else if (antcomb->first_ratio) {
5883 -                       /* first alt */
5884 -                       if ((antcomb->first_quick_scan_conf ==
5885 -                           ATH_ANT_DIV_COMB_LNA1) ||
5886 -                           (antcomb->first_quick_scan_conf ==
5887 -                           ATH_ANT_DIV_COMB_LNA2))
5888 -                                       /* Set alt LNA1 or LNA2 */
5889 -                               if (div_ant_conf->main_lna_conf ==
5890 -                                   ATH_ANT_DIV_COMB_LNA2)
5891 -                                       div_ant_conf->alt_lna_conf =
5892 -                                                       ATH_ANT_DIV_COMB_LNA1;
5893 -                               else
5894 -                                       div_ant_conf->alt_lna_conf =
5895 -                                                       ATH_ANT_DIV_COMB_LNA2;
5896 -                       else
5897 -                               /* Set alt to A+B or A-B */
5898 -                               div_ant_conf->alt_lna_conf =
5899 -                                               antcomb->first_quick_scan_conf;
5900 -               } else if (antcomb->second_ratio) {
5901 -                               /* second alt */
5902 -                       if ((antcomb->second_quick_scan_conf ==
5903 -                           ATH_ANT_DIV_COMB_LNA1) ||
5904 -                           (antcomb->second_quick_scan_conf ==
5905 -                           ATH_ANT_DIV_COMB_LNA2))
5906 -                               /* Set alt LNA1 or LNA2 */
5907 -                               if (div_ant_conf->main_lna_conf ==
5908 -                                   ATH_ANT_DIV_COMB_LNA2)
5909 -                                       div_ant_conf->alt_lna_conf =
5910 -                                               ATH_ANT_DIV_COMB_LNA1;
5911 -                               else
5912 -                                       div_ant_conf->alt_lna_conf =
5913 -                                               ATH_ANT_DIV_COMB_LNA2;
5914 -                       else
5915 -                               /* Set alt to A+B or A-B */
5916 -                               div_ant_conf->alt_lna_conf =
5917 -                                               antcomb->second_quick_scan_conf;
5918 -               } else {
5919 -                       /* main is largest */
5920 -                       if ((antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) ||
5921 -                           (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2))
5922 -                               /* Set alt LNA1 or LNA2 */
5923 -                               if (div_ant_conf->main_lna_conf ==
5924 -                                   ATH_ANT_DIV_COMB_LNA2)
5925 -                                       div_ant_conf->alt_lna_conf =
5926 -                                                       ATH_ANT_DIV_COMB_LNA1;
5927 -                               else
5928 -                                       div_ant_conf->alt_lna_conf =
5929 -                                                       ATH_ANT_DIV_COMB_LNA2;
5930 -                       else
5931 -                               /* Set alt to A+B or A-B */
5932 -                               div_ant_conf->alt_lna_conf = antcomb->main_conf;
5933 -               }
5934 +               ath_ant_set_alt_ratio(antcomb, div_ant_conf);
5935 +
5936                 break;
5937         default:
5938                 break;
5939 @@ -430,8 +497,7 @@ static void ath_ant_div_conf_fast_divbia
5940                         ant_conf->fast_div_bias = 0x1;
5941                         break;
5942                 case 0x10: /* LNA2 A-B */
5943 -                       if (!(antcomb->scan) &&
5944 -                               (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
5945 +                       if (!antcomb->scan && (alt_ratio > antcomb->ant_ratio))
5946                                 ant_conf->fast_div_bias = 0x1;
5947                         else
5948                                 ant_conf->fast_div_bias = 0x2;
5949 @@ -440,15 +506,13 @@ static void ath_ant_div_conf_fast_divbia
5950                         ant_conf->fast_div_bias = 0x1;
5951                         break;
5952                 case 0x13: /* LNA2 A+B */
5953 -                       if (!(antcomb->scan) &&
5954 -                               (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
5955 +                       if (!antcomb->scan && (alt_ratio > antcomb->ant_ratio))
5956                                 ant_conf->fast_div_bias = 0x1;
5957                         else
5958                                 ant_conf->fast_div_bias = 0x2;
5959                         break;
5960                 case 0x20: /* LNA1 A-B */
5961 -                       if (!(antcomb->scan) &&
5962 -                               (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
5963 +                       if (!antcomb->scan && (alt_ratio > antcomb->ant_ratio))
5964                                 ant_conf->fast_div_bias = 0x1;
5965                         else
5966                                 ant_conf->fast_div_bias = 0x2;
5967 @@ -457,8 +521,7 @@ static void ath_ant_div_conf_fast_divbia
5968                         ant_conf->fast_div_bias = 0x1;
5969                         break;
5970                 case 0x23: /* LNA1 A+B */
5971 -                       if (!(antcomb->scan) &&
5972 -                               (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
5973 +                       if (!antcomb->scan && (alt_ratio > antcomb->ant_ratio))
5974                                 ant_conf->fast_div_bias = 0x1;
5975                         else
5976                                 ant_conf->fast_div_bias = 0x2;
5977 @@ -475,6 +538,9 @@ static void ath_ant_div_conf_fast_divbia
5978                 default:
5979                         break;
5980                 }
5981 +
5982 +               if (antcomb->fast_div_bias)
5983 +                       ant_conf->fast_div_bias = antcomb->fast_div_bias;
5984         } else if (ant_conf->div_group == 3) {
5985                 switch ((ant_conf->main_lna_conf << 4) |
5986                         ant_conf->alt_lna_conf) {
5987 @@ -540,6 +606,138 @@ static void ath_ant_div_conf_fast_divbia
5988         }
5989  }
5990
5991 +static void ath_ant_try_scan(struct ath_ant_comb *antcomb,
5992 +                            struct ath_hw_antcomb_conf *conf,
5993 +                            int curr_alt_set, int alt_rssi_avg,
5994 +                            int main_rssi_avg)
5995 +{
5996 +       switch (curr_alt_set) {
5997 +       case ATH_ANT_DIV_COMB_LNA2:
5998 +               antcomb->rssi_lna2 = alt_rssi_avg;
5999 +               antcomb->rssi_lna1 = main_rssi_avg;
6000 +               antcomb->scan = true;
6001 +               /* set to A+B */
6002 +               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6003 +               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6004 +               break;
6005 +       case ATH_ANT_DIV_COMB_LNA1:
6006 +               antcomb->rssi_lna1 = alt_rssi_avg;
6007 +               antcomb->rssi_lna2 = main_rssi_avg;
6008 +               antcomb->scan = true;
6009 +               /* set to A+B */
6010 +               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6011 +               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6012 +               break;
6013 +       case ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2:
6014 +               antcomb->rssi_add = alt_rssi_avg;
6015 +               antcomb->scan = true;
6016 +               /* set to A-B */
6017 +               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
6018 +               break;
6019 +       case ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2:
6020 +               antcomb->rssi_sub = alt_rssi_avg;
6021 +               antcomb->scan = false;
6022 +               if (antcomb->rssi_lna2 >
6023 +                   (antcomb->rssi_lna1 + ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
6024 +                       /* use LNA2 as main LNA */
6025 +                       if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
6026 +                           (antcomb->rssi_add > antcomb->rssi_sub)) {
6027 +                               /* set to A+B */
6028 +                               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6029 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6030 +                       } else if (antcomb->rssi_sub >
6031 +                                  antcomb->rssi_lna1) {
6032 +                               /* set to A-B */
6033 +                               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6034 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
6035 +                       } else {
6036 +                               /* set to LNA1 */
6037 +                               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6038 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6039 +                       }
6040 +               } else {
6041 +                       /* use LNA1 as main LNA */
6042 +                       if ((antcomb->rssi_add > antcomb->rssi_lna2) &&
6043 +                           (antcomb->rssi_add > antcomb->rssi_sub)) {
6044 +                               /* set to A+B */
6045 +                               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6046 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6047 +                       } else if (antcomb->rssi_sub >
6048 +                                  antcomb->rssi_lna1) {
6049 +                               /* set to A-B */
6050 +                               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6051 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
6052 +                       } else {
6053 +                               /* set to LNA2 */
6054 +                               conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6055 +                               conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6056 +                       }
6057 +               }
6058 +               break;
6059 +       default:
6060 +               break;
6061 +       }
6062 +}
6063 +
6064 +static bool ath_ant_try_switch(struct ath_hw_antcomb_conf *div_ant_conf,
6065 +                              struct ath_ant_comb *antcomb,
6066 +                              int alt_ratio, int alt_rssi_avg,
6067 +                              int main_rssi_avg, int curr_main_set,
6068 +                              int curr_alt_set)
6069 +{
6070 +       bool ret = false;
6071 +
6072 +       if (ath_ant_div_comb_alt_check(div_ant_conf, antcomb, alt_ratio,
6073 +                                      alt_rssi_avg, main_rssi_avg)) {
6074 +               if (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) {
6075 +                       /*
6076 +                        * Switch main and alt LNA.
6077 +                        */
6078 +                       div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6079 +                       div_ant_conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6080 +               } else if (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) {
6081 +                       div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6082 +                       div_ant_conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6083 +               }
6084 +
6085 +               ret = true;
6086 +       } else if ((curr_alt_set != ATH_ANT_DIV_COMB_LNA1) &&
6087 +                  (curr_alt_set != ATH_ANT_DIV_COMB_LNA2)) {
6088 +               /*
6089 +                 Set alt to another LNA.
6090 +               */
6091 +               if (curr_main_set == ATH_ANT_DIV_COMB_LNA2)
6092 +                       div_ant_conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1;
6093 +               else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1)
6094 +                       div_ant_conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6095 +
6096 +               ret = true;
6097 +       }
6098 +
6099 +       return ret;
6100 +}
6101 +
6102 +static bool ath_ant_short_scan_check(struct ath_ant_comb *antcomb)
6103 +{
6104 +       int alt_ratio;
6105 +
6106 +       if (!antcomb->scan || !antcomb->alt_good)
6107 +               return false;
6108 +
6109 +       if (time_after(jiffies, antcomb->scan_start_time +
6110 +                      msecs_to_jiffies(ATH_ANT_DIV_COMB_SHORT_SCAN_INTR)))
6111 +               return true;
6112 +
6113 +       if (antcomb->total_pkt_count == ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT) {
6114 +               alt_ratio = ((antcomb->alt_recv_cnt * 100) /
6115 +                            antcomb->total_pkt_count);
6116 +               if (alt_ratio < antcomb->ant_ratio)
6117 +                       return true;
6118 +       }
6119 +
6120 +       return false;
6121 +}
6122 +
6123  void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs)
6124  {
6125         struct ath_hw_antcomb_conf div_ant_conf;
6126 @@ -549,41 +747,46 @@ void ath_ant_comb_scan(struct ath_softc
6127         int main_rssi = rs->rs_rssi_ctl0;
6128         int alt_rssi = rs->rs_rssi_ctl1;
6129         int rx_ant_conf,  main_ant_conf;
6130 -       bool short_scan = false;
6131 +       bool short_scan = false, ret;
6132
6133         rx_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_CURRENT_SHIFT) &
6134                        ATH_ANT_RX_MASK;
6135         main_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_MAIN_SHIFT) &
6136                          ATH_ANT_RX_MASK;
6137
6138 +       if (alt_rssi >= antcomb->low_rssi_thresh) {
6139 +               antcomb->ant_ratio = ATH_ANT_DIV_COMB_ALT_ANT_RATIO;
6140 +               antcomb->ant_ratio2 = ATH_ANT_DIV_COMB_ALT_ANT_RATIO2;
6141 +       } else {
6142 +               antcomb->ant_ratio = ATH_ANT_DIV_COMB_ALT_ANT_RATIO_LOW_RSSI;
6143 +               antcomb->ant_ratio2 = ATH_ANT_DIV_COMB_ALT_ANT_RATIO2_LOW_RSSI;
6144 +       }
6145 +
6146         /* Record packet only when both main_rssi and  alt_rssi is positive */
6147         if (main_rssi > 0 && alt_rssi > 0) {
6148                 antcomb->total_pkt_count++;
6149                 antcomb->main_total_rssi += main_rssi;
6150                 antcomb->alt_total_rssi  += alt_rssi;
6151 +
6152                 if (main_ant_conf == rx_ant_conf)
6153                         antcomb->main_recv_cnt++;
6154                 else
6155                         antcomb->alt_recv_cnt++;
6156         }
6157
6158 -       /* Short scan check */
6159 -       if (antcomb->scan && antcomb->alt_good) {
6160 -               if (time_after(jiffies, antcomb->scan_start_time +
6161 -                   msecs_to_jiffies(ATH_ANT_DIV_COMB_SHORT_SCAN_INTR)))
6162 -                       short_scan = true;
6163 -               else
6164 -                       if (antcomb->total_pkt_count ==
6165 -                           ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT) {
6166 -                               alt_ratio = ((antcomb->alt_recv_cnt * 100) /
6167 -                                           antcomb->total_pkt_count);
6168 -                               if (alt_ratio < ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
6169 -                                       short_scan = true;
6170 -                       }
6171 +       if (main_ant_conf == rx_ant_conf) {
6172 +               ANT_STAT_INC(ANT_MAIN, recv_cnt);
6173 +               ANT_LNA_INC(ANT_MAIN, rx_ant_conf);
6174 +       } else {
6175 +               ANT_STAT_INC(ANT_ALT, recv_cnt);
6176 +               ANT_LNA_INC(ANT_ALT, rx_ant_conf);
6177         }
6178
6179 +       /* Short scan check */
6180 +       short_scan = ath_ant_short_scan_check(antcomb);
6181 +
6182         if (((antcomb->total_pkt_count < ATH_ANT_DIV_COMB_MAX_PKTCOUNT) ||
6183 -           rs->rs_moreaggr) && !short_scan)
6184 +            rs->rs_moreaggr) && !short_scan)
6185                 return;
6186
6187         if (antcomb->total_pkt_count) {
6188 @@ -595,15 +798,13 @@ void ath_ant_comb_scan(struct ath_softc
6189                                  antcomb->total_pkt_count);
6190         }
6191
6192 -
6193         ath9k_hw_antdiv_comb_conf_get(sc->sc_ah, &div_ant_conf);
6194         curr_alt_set = div_ant_conf.alt_lna_conf;
6195         curr_main_set = div_ant_conf.main_lna_conf;
6196 -
6197         antcomb->count++;
6198
6199         if (antcomb->count == ATH_ANT_DIV_COMB_MAX_COUNT) {
6200 -               if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO) {
6201 +               if (alt_ratio > antcomb->ant_ratio) {
6202                         ath_lnaconf_alt_good_scan(antcomb, div_ant_conf,
6203                                                   main_rssi_avg);
6204                         antcomb->alt_good = true;
6205 @@ -617,153 +818,47 @@ void ath_ant_comb_scan(struct ath_softc
6206         }
6207
6208         if (!antcomb->scan) {
6209 -               if (ath_ant_div_comb_alt_check(div_ant_conf.div_group,
6210 -                                       alt_ratio, curr_main_set, curr_alt_set,
6211 -                                       alt_rssi_avg, main_rssi_avg)) {
6212 -                       if (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) {
6213 -                               /* Switch main and alt LNA */
6214 -                               div_ant_conf.main_lna_conf =
6215 -                                               ATH_ANT_DIV_COMB_LNA2;
6216 -                               div_ant_conf.alt_lna_conf  =
6217 -                                               ATH_ANT_DIV_COMB_LNA1;
6218 -                       } else if (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) {
6219 -                               div_ant_conf.main_lna_conf =
6220 -                                               ATH_ANT_DIV_COMB_LNA1;
6221 -                               div_ant_conf.alt_lna_conf  =
6222 -                                               ATH_ANT_DIV_COMB_LNA2;
6223 -                       }
6224 -
6225 -                       goto div_comb_done;
6226 -               } else if ((curr_alt_set != ATH_ANT_DIV_COMB_LNA1) &&
6227 -                          (curr_alt_set != ATH_ANT_DIV_COMB_LNA2)) {
6228 -                       /* Set alt to another LNA */
6229 -                       if (curr_main_set == ATH_ANT_DIV_COMB_LNA2)
6230 -                               div_ant_conf.alt_lna_conf =
6231 -                                               ATH_ANT_DIV_COMB_LNA1;
6232 -                       else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1)
6233 -                               div_ant_conf.alt_lna_conf =
6234 -                                               ATH_ANT_DIV_COMB_LNA2;
6235 -
6236 -                       goto div_comb_done;
6237 -               }
6238 -
6239 -               if ((alt_rssi_avg < (main_rssi_avg +
6240 -                                    div_ant_conf.lna1_lna2_delta)))
6241 +               ret = ath_ant_try_switch(&div_ant_conf, antcomb, alt_ratio,
6242 +                                        alt_rssi_avg, main_rssi_avg,
6243 +                                        curr_main_set, curr_alt_set);
6244 +               if (ret)
6245                         goto div_comb_done;
6246         }
6247
6248 +       if (!antcomb->scan &&
6249 +           (alt_rssi_avg < (main_rssi_avg + div_ant_conf.lna1_lna2_delta)))
6250 +               goto div_comb_done;
6251 +
6252         if (!antcomb->scan_not_start) {
6253 -               switch (curr_alt_set) {
6254 -               case ATH_ANT_DIV_COMB_LNA2:
6255 -                       antcomb->rssi_lna2 = alt_rssi_avg;
6256 -                       antcomb->rssi_lna1 = main_rssi_avg;
6257 -                       antcomb->scan = true;
6258 -                       /* set to A+B */
6259 -                       div_ant_conf.main_lna_conf =
6260 -                               ATH_ANT_DIV_COMB_LNA1;
6261 -                       div_ant_conf.alt_lna_conf  =
6262 -                               ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6263 -                       break;
6264 -               case ATH_ANT_DIV_COMB_LNA1:
6265 -                       antcomb->rssi_lna1 = alt_rssi_avg;
6266 -                       antcomb->rssi_lna2 = main_rssi_avg;
6267 -                       antcomb->scan = true;
6268 -                       /* set to A+B */
6269 -                       div_ant_conf.main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
6270 -                       div_ant_conf.alt_lna_conf  =
6271 -                               ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6272 -                       break;
6273 -               case ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2:
6274 -                       antcomb->rssi_add = alt_rssi_avg;
6275 -                       antcomb->scan = true;
6276 -                       /* set to A-B */
6277 -                       div_ant_conf.alt_lna_conf =
6278 -                               ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
6279 -                       break;
6280 -               case ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2:
6281 -                       antcomb->rssi_sub = alt_rssi_avg;
6282 -                       antcomb->scan = false;
6283 -                       if (antcomb->rssi_lna2 >
6284 -                           (antcomb->rssi_lna1 +
6285 -                           ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
6286 -                               /* use LNA2 as main LNA */
6287 -                               if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
6288 -                                   (antcomb->rssi_add > antcomb->rssi_sub)) {
6289 -                                       /* set to A+B */
6290 -                                       div_ant_conf.main_lna_conf =
6291 -                                               ATH_ANT_DIV_COMB_LNA2;
6292 -                                       div_ant_conf.alt_lna_conf  =
6293 -                                               ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6294 -                               } else if (antcomb->rssi_sub >
6295 -                                          antcomb->rssi_lna1) {
6296 -                                       /* set to A-B */
6297 -                                       div_ant_conf.main_lna_conf =
6298 -                                               ATH_ANT_DIV_COMB_LNA2;
6299 -                                       div_ant_conf.alt_lna_conf =
6300 -                                               ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
6301 -                               } else {
6302 -                                       /* set to LNA1 */
6303 -                                       div_ant_conf.main_lna_conf =
6304 -                                               ATH_ANT_DIV_COMB_LNA2;
6305 -                                       div_ant_conf.alt_lna_conf =
6306 -                                               ATH_ANT_DIV_COMB_LNA1;
6307 -                               }
6308 -                       } else {
6309 -                               /* use LNA1 as main LNA */
6310 -                               if ((antcomb->rssi_add > antcomb->rssi_lna2) &&
6311 -                                   (antcomb->rssi_add > antcomb->rssi_sub)) {
6312 -                                       /* set to A+B */
6313 -                                       div_ant_conf.main_lna_conf =
6314 -                                               ATH_ANT_DIV_COMB_LNA1;
6315 -                                       div_ant_conf.alt_lna_conf  =
6316 -                                               ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
6317 -                               } else if (antcomb->rssi_sub >
6318 -                                          antcomb->rssi_lna1) {
6319 -                                       /* set to A-B */
6320 -                                       div_ant_conf.main_lna_conf =
6321 -                                               ATH_ANT_DIV_COMB_LNA1;
6322 -                                       div_ant_conf.alt_lna_conf =
6323 -                                               ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
6324 -                               } else {
6325 -                                       /* set to LNA2 */
6326 -                                       div_ant_conf.main_lna_conf =
6327 -                                               ATH_ANT_DIV_COMB_LNA1;
6328 -                                       div_ant_conf.alt_lna_conf =
6329 -                                               ATH_ANT_DIV_COMB_LNA2;
6330 -                               }
6331 -                       }
6332 -                       break;
6333 -               default:
6334 -                       break;
6335 -               }
6336 +               ath_ant_try_scan(antcomb, &div_ant_conf, curr_alt_set,
6337 +                                alt_rssi_avg, main_rssi_avg);
6338         } else {
6339                 if (!antcomb->alt_good) {
6340                         antcomb->scan_not_start = false;
6341                         /* Set alt to another LNA */
6342                         if (curr_main_set == ATH_ANT_DIV_COMB_LNA2) {
6343                                 div_ant_conf.main_lna_conf =
6344 -                                               ATH_ANT_DIV_COMB_LNA2;
6345 +                                       ATH_ANT_DIV_COMB_LNA2;
6346                                 div_ant_conf.alt_lna_conf =
6347 -                                               ATH_ANT_DIV_COMB_LNA1;
6348 +                                       ATH_ANT_DIV_COMB_LNA1;
6349                         } else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1) {
6350                                 div_ant_conf.main_lna_conf =
6351 -                                               ATH_ANT_DIV_COMB_LNA1;
6352 +                                       ATH_ANT_DIV_COMB_LNA1;
6353                                 div_ant_conf.alt_lna_conf =
6354 -                                               ATH_ANT_DIV_COMB_LNA2;
6355 +                                       ATH_ANT_DIV_COMB_LNA2;
6356                         }
6357                         goto div_comb_done;
6358                 }
6359 +               ath_select_ant_div_from_quick_scan(antcomb, &div_ant_conf,
6360 +                                                  main_rssi_avg, alt_rssi_avg,
6361 +                                                  alt_ratio);
6362 +               antcomb->quick_scan_cnt++;
6363         }
6364
6365 -       ath_select_ant_div_from_quick_scan(antcomb, &div_ant_conf,
6366 -                                          main_rssi_avg, alt_rssi_avg,
6367 -                                          alt_ratio);
6368 -
6369 -       antcomb->quick_scan_cnt++;
6370 -
6371  div_comb_done:
6372         ath_ant_div_conf_fast_divbias(&div_ant_conf, antcomb, alt_ratio);
6373         ath9k_hw_antdiv_comb_conf_set(sc->sc_ah, &div_ant_conf);
6374 +       ath9k_debug_stat_ant(sc, &div_ant_conf, main_rssi_avg, alt_rssi_avg);
6375
6376         antcomb->scan_start_time = jiffies;
6377         antcomb->total_pkt_count = 0;
6378 @@ -772,26 +867,3 @@ div_comb_done:
6379         antcomb->main_recv_cnt = 0;
6380         antcomb->alt_recv_cnt = 0;
6381  }
6382 -
6383 -void ath_ant_comb_update(struct ath_softc *sc)
6384 -{
6385 -       struct ath_hw *ah = sc->sc_ah;
6386 -       struct ath_common *common = ath9k_hw_common(ah);
6387 -       struct ath_hw_antcomb_conf div_ant_conf;
6388 -       u8 lna_conf;
6389 -
6390 -       ath9k_hw_antdiv_comb_conf_get(ah, &div_ant_conf);
6391 -
6392 -       if (sc->ant_rx == 1)
6393 -               lna_conf = ATH_ANT_DIV_COMB_LNA1;
6394 -       else
6395 -               lna_conf = ATH_ANT_DIV_COMB_LNA2;
6396 -
6397 -       div_ant_conf.main_lna_conf = lna_conf;
6398 -       div_ant_conf.alt_lna_conf = lna_conf;
6399 -
6400 -       ath9k_hw_antdiv_comb_conf_set(ah, &div_ant_conf);
6401 -
6402 -       if (common->antenna_diversity)
6403 -               ath9k_hw_antctrl_shared_chain_lnadiv(ah, true);
6404 -}
6405 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
6406 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
6407 @@ -610,7 +610,15 @@ static void ar5008_hw_override_ini(struc
6408         REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
6409
6410         if (AR_SREV_9280_20_OR_LATER(ah)) {
6411 -               val = REG_READ(ah, AR_PCU_MISC_MODE2);
6412 +               /*
6413 +                * For AR9280 and above, there is a new feature that allows
6414 +                * Multicast search based on both MAC Address and Key ID.
6415 +                * By default, this feature is enabled. But since the driver
6416 +                * is not using this feature, we switch it off; otherwise
6417 +                * multicast search based on MAC addr only will fail.
6418 +                */
6419 +               val = REG_READ(ah, AR_PCU_MISC_MODE2) &
6420 +                       (~AR_ADHOC_MCAST_KEYID_ENABLE);
6421
6422                 if (!AR_SREV_9271(ah))
6423                         val &= ~AR_PCU_MISC_MODE2_HWWAR1;
6424 --- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
6425 +++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
6426 @@ -555,6 +555,69 @@ static void ar9002_hw_antdiv_comb_conf_s
6427         REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regval);
6428  }
6429
6430 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
6431 +
6432 +static void ar9002_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
6433 +{
6434 +       struct ath_btcoex_hw *btcoex = &ah->btcoex_hw;
6435 +       u8 antdiv_ctrl1, antdiv_ctrl2;
6436 +       u32 regval;
6437 +
6438 +       if (enable) {
6439 +               antdiv_ctrl1 = ATH_BT_COEX_ANTDIV_CONTROL1_ENABLE;
6440 +               antdiv_ctrl2 = ATH_BT_COEX_ANTDIV_CONTROL2_ENABLE;
6441 +
6442 +               /*
6443 +                * Don't disable BT ant to allow BB to control SWCOM.
6444 +                */
6445 +               btcoex->bt_coex_mode2 &= (~(AR_BT_DISABLE_BT_ANT));
6446 +               REG_WRITE(ah, AR_BT_COEX_MODE2, btcoex->bt_coex_mode2);
6447 +
6448 +               REG_WRITE(ah, AR_PHY_SWITCH_COM, ATH_BT_COEX_ANT_DIV_SWITCH_COM);
6449 +               REG_RMW(ah, AR_PHY_SWITCH_CHAIN_0, 0, 0xf0000000);
6450 +       } else {
6451 +               /*
6452 +                * Disable antenna diversity, use LNA1 only.
6453 +                */
6454 +               antdiv_ctrl1 = ATH_BT_COEX_ANTDIV_CONTROL1_FIXED_A;
6455 +               antdiv_ctrl2 = ATH_BT_COEX_ANTDIV_CONTROL2_FIXED_A;
6456 +
6457 +               /*
6458 +                * Disable BT Ant. to allow concurrent BT and WLAN receive.
6459 +                */
6460 +               btcoex->bt_coex_mode2 |= AR_BT_DISABLE_BT_ANT;
6461 +               REG_WRITE(ah, AR_BT_COEX_MODE2, btcoex->bt_coex_mode2);
6462 +
6463 +               /*
6464 +                * Program SWCOM table to make sure RF switch always parks
6465 +                * at BT side.
6466 +                */
6467 +               REG_WRITE(ah, AR_PHY_SWITCH_COM, 0);
6468 +               REG_RMW(ah, AR_PHY_SWITCH_CHAIN_0, 0, 0xf0000000);
6469 +       }
6470 +
6471 +       regval = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
6472 +       regval &= (~(AR_PHY_9285_ANT_DIV_CTL_ALL));
6473 +        /*
6474 +        * Clear ant_fast_div_bias [14:9] since for WB195,
6475 +        * the main LNA is always LNA1.
6476 +        */
6477 +       regval &= (~(AR_PHY_9285_FAST_DIV_BIAS));
6478 +       regval |= SM(antdiv_ctrl1, AR_PHY_9285_ANT_DIV_CTL);
6479 +       regval |= SM(antdiv_ctrl2, AR_PHY_9285_ANT_DIV_ALT_LNACONF);
6480 +       regval |= SM((antdiv_ctrl2 >> 2), AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
6481 +       regval |= SM((antdiv_ctrl1 >> 1), AR_PHY_9285_ANT_DIV_ALT_GAINTB);
6482 +       regval |= SM((antdiv_ctrl1 >> 2), AR_PHY_9285_ANT_DIV_MAIN_GAINTB);
6483 +       REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regval);
6484 +
6485 +       regval = REG_READ(ah, AR_PHY_CCK_DETECT);
6486 +       regval &= (~AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
6487 +       regval |= SM((antdiv_ctrl1 >> 3), AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
6488 +       REG_WRITE(ah, AR_PHY_CCK_DETECT, regval);
6489 +}
6490 +
6491 +#endif
6492 +
6493  static void ar9002_hw_spectral_scan_config(struct ath_hw *ah,
6494                                     struct ath_spec_scan *param)
6495  {
6496 @@ -634,5 +697,9 @@ void ar9002_hw_attach_phy_ops(struct ath
6497         ops->spectral_scan_trigger = ar9002_hw_spectral_scan_trigger;
6498         ops->spectral_scan_wait = ar9002_hw_spectral_scan_wait;
6499
6500 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
6501 +       ops->set_bt_ant_diversity = ar9002_hw_set_bt_ant_diversity;
6502 +#endif
6503 +
6504         ar9002_hw_set_nf_limits(ah);
6505  }
6506 --- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
6507 +++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
6508 @@ -317,13 +317,15 @@
6509  #define AR_PHY_9285_ANT_DIV_ALT_GAINTB_S    29
6510  #define AR_PHY_9285_ANT_DIV_MAIN_GAINTB     0x40000000
6511  #define AR_PHY_9285_ANT_DIV_MAIN_GAINTB_S   30
6512 -#define AR_PHY_9285_ANT_DIV_LNA1            2
6513 -#define AR_PHY_9285_ANT_DIV_LNA2            1
6514 -#define AR_PHY_9285_ANT_DIV_LNA1_PLUS_LNA2  3
6515 -#define AR_PHY_9285_ANT_DIV_LNA1_MINUS_LNA2 0
6516  #define AR_PHY_9285_ANT_DIV_GAINTB_0        0
6517  #define AR_PHY_9285_ANT_DIV_GAINTB_1        1
6518
6519 +#define ATH_BT_COEX_ANTDIV_CONTROL1_ENABLE  0x0b
6520 +#define ATH_BT_COEX_ANTDIV_CONTROL2_ENABLE  0x09
6521 +#define ATH_BT_COEX_ANTDIV_CONTROL1_FIXED_A 0x04
6522 +#define ATH_BT_COEX_ANTDIV_CONTROL2_FIXED_A 0x09
6523 +#define ATH_BT_COEX_ANT_DIV_SWITCH_COM      0x66666666
6524 +
6525  #define AR_PHY_EXT_CCA0             0x99b8
6526  #define AR_PHY_EXT_CCA0_THRESH62    0x000000FF
6527  #define AR_PHY_EXT_CCA0_THRESH62_S  0
6528 --- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
6529 +++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
6530 @@ -3541,13 +3541,12 @@ static u16 ar9003_switch_com_spdt_get(st
6531         return le16_to_cpu(ar9003_modal_header(ah, is2ghz)->switchcomspdt);
6532  }
6533
6534 -
6535 -static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
6536 +u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
6537  {
6538         return le32_to_cpu(ar9003_modal_header(ah, is2ghz)->antCtrlCommon);
6539  }
6540
6541 -static u32 ar9003_hw_ant_ctrl_common_2_get(struct ath_hw *ah, bool is2ghz)
6542 +u32 ar9003_hw_ant_ctrl_common_2_get(struct ath_hw *ah, bool is2ghz)
6543  {
6544         return le32_to_cpu(ar9003_modal_header(ah, is2ghz)->antCtrlCommon2);
6545  }
6546 @@ -3561,6 +3560,7 @@ static u16 ar9003_hw_ant_ctrl_chain_get(
6547
6548  static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
6549  {
6550 +       struct ath_common *common = ath9k_hw_common(ah);
6551         struct ath9k_hw_capabilities *pCap = &ah->caps;
6552         int chain;
6553         u32 regval, value, gpio;
6554 @@ -3614,6 +3614,11 @@ static void ar9003_hw_ant_ctrl_apply(str
6555         }
6556
6557         value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
6558 +       if (AR_SREV_9485(ah) && common->bt_ant_diversity) {
6559 +               regval &= ~AR_SWITCH_TABLE_COM2_ALL;
6560 +               regval |= ah->config.ant_ctrl_comm2g_switch_enable;
6561 +
6562 +       }
6563         REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
6564
6565         if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
6566 @@ -3645,8 +3650,11 @@ static void ar9003_hw_ant_ctrl_apply(str
6567                 regval &= (~AR_PHY_ANT_DIV_LNADIV);
6568                 regval |= ((value >> 6) & 0x1) << AR_PHY_ANT_DIV_LNADIV_S;
6569
6570 +               if (AR_SREV_9485(ah) && common->bt_ant_diversity)
6571 +                       regval |= AR_ANT_DIV_ENABLE;
6572 +
6573                 if (AR_SREV_9565(ah)) {
6574 -                       if (ah->shared_chain_lnadiv) {
6575 +                       if (common->bt_ant_diversity) {
6576                                 regval |= (1 << AR_PHY_ANT_SW_RX_PROT_S);
6577                         } else {
6578                                 regval &= ~(1 << AR_PHY_ANT_DIV_LNADIV_S);
6579 @@ -3656,10 +3664,14 @@ static void ar9003_hw_ant_ctrl_apply(str
6580
6581                 REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
6582
6583 -               /*enable fast_div */
6584 +               /* enable fast_div */
6585                 regval = REG_READ(ah, AR_PHY_CCK_DETECT);
6586                 regval &= (~AR_FAST_DIV_ENABLE);
6587                 regval |= ((value >> 7) & 0x1) << AR_FAST_DIV_ENABLE_S;
6588 +
6589 +               if (AR_SREV_9485(ah) && common->bt_ant_diversity)
6590 +                       regval |= AR_FAST_DIV_ENABLE;
6591 +
6592                 REG_WRITE(ah, AR_PHY_CCK_DETECT, regval);
6593
6594                 if (pCap->hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) {
6595 @@ -3673,9 +3685,9 @@ static void ar9003_hw_ant_ctrl_apply(str
6596                                      AR_PHY_ANT_DIV_ALT_GAINTB |
6597                                      AR_PHY_ANT_DIV_MAIN_GAINTB));
6598                         /* by default use LNA1 for the main antenna */
6599 -                       regval |= (AR_PHY_ANT_DIV_LNA1 <<
6600 +                       regval |= (ATH_ANT_DIV_COMB_LNA1 <<
6601                                    AR_PHY_ANT_DIV_MAIN_LNACONF_S);
6602 -                       regval |= (AR_PHY_ANT_DIV_LNA2 <<
6603 +                       regval |= (ATH_ANT_DIV_COMB_LNA2 <<
6604                                    AR_PHY_ANT_DIV_ALT_LNACONF_S);
6605                         REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
6606                 }
6607 @@ -3813,6 +3825,11 @@ static void ar9003_hw_atten_apply(struct
6608                         else
6609                                 value = ar9003_hw_atten_chain_get_margin(ah, i, chan);
6610
6611 +                       if (ah->config.alt_mingainidx)
6612 +                               REG_RMW_FIELD(ah, AR_PHY_EXT_ATTEN_CTL_0,
6613 +                                             AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
6614 +                                             value);
6615 +
6616                         REG_RMW_FIELD(ah, ext_atten_reg[i],
6617                                       AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
6618                                       value);
6619 --- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
6620 +++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
6621 @@ -334,6 +334,8 @@ struct ar9300_eeprom {
6622
6623  s32 ar9003_hw_get_tx_gain_idx(struct ath_hw *ah);
6624  s32 ar9003_hw_get_rx_gain_idx(struct ath_hw *ah);
6625 +u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz);
6626 +u32 ar9003_hw_ant_ctrl_common_2_get(struct ath_hw *ah, bool is2ghz);
6627
6628  u8 *ar9003_get_spur_chan_ptr(struct ath_hw *ah, bool is_2ghz);
6629
6630 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
6631 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
6632 @@ -148,6 +148,8 @@
6633  #define AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S   28
6634  #define AR_PHY_EXT_CCA_THRESH62 0x007F0000
6635  #define AR_PHY_EXT_CCA_THRESH62_S       16
6636 +#define AR_PHY_EXTCHN_PWRTHR1_ANT_DIV_ALT_ANT_MINGAINIDX    0x0000FF00
6637 +#define AR_PHY_EXTCHN_PWRTHR1_ANT_DIV_ALT_ANT_MINGAINIDX_S  8
6638  #define AR_PHY_EXT_MINCCA_PWR   0x01FF0000
6639  #define AR_PHY_EXT_MINCCA_PWR_S 16
6640  #define AR_PHY_EXT_CYCPWR_THR1 0x0000FE00L
6641 @@ -296,11 +298,6 @@
6642  #define AR_PHY_ANT_DIV_MAIN_GAINTB              0x40000000
6643  #define AR_PHY_ANT_DIV_MAIN_GAINTB_S            30
6644
6645 -#define AR_PHY_ANT_DIV_LNA1_MINUS_LNA2          0x0
6646 -#define AR_PHY_ANT_DIV_LNA2                     0x1
6647 -#define AR_PHY_ANT_DIV_LNA1                     0x2
6648 -#define AR_PHY_ANT_DIV_LNA1_PLUS_LNA2           0x3
6649 -
6650  #define AR_PHY_EXTCHN_PWRTHR1   (AR_AGC_BASE + 0x2c)
6651  #define AR_PHY_EXT_CHN_WIN      (AR_AGC_BASE + 0x30)
6652  #define AR_PHY_20_40_DET_THR    (AR_AGC_BASE + 0x34)
6653 --- a/drivers/net/wireless/ath/ath9k/debug.h
6654 +++ b/drivers/net/wireless/ath/ath9k/debug.h
6655 @@ -28,9 +28,13 @@ struct fft_sample_tlv;
6656  #ifdef CPTCFG_ATH9K_DEBUGFS
6657  #define TX_STAT_INC(q, c) sc->debug.stats.txstats[q].c++
6658  #define RESET_STAT_INC(sc, type) sc->debug.stats.reset[type]++
6659 +#define ANT_STAT_INC(i, c) sc->debug.stats.ant_stats[i].c++
6660 +#define ANT_LNA_INC(i, c) sc->debug.stats.ant_stats[i].lna_recv_cnt[c]++;
6661  #else
6662  #define TX_STAT_INC(q, c) do { } while (0)
6663  #define RESET_STAT_INC(sc, type) do { } while (0)
6664 +#define ANT_STAT_INC(i, c) do { } while (0)
6665 +#define ANT_LNA_INC(i, c) do { } while (0)
6666  #endif
6667
6668  enum ath_reset_type {
6669 @@ -243,11 +247,22 @@ struct ath_rx_stats {
6670         u32 rx_spectral;
6671  };
6672
6673 +#define ANT_MAIN 0
6674 +#define ANT_ALT  1
6675 +
6676 +struct ath_antenna_stats {
6677 +       u32 recv_cnt;
6678 +       u32 rssi_avg;
6679 +       u32 lna_recv_cnt[4];
6680 +       u32 lna_attempt_cnt[4];
6681 +};
6682 +
6683  struct ath_stats {
6684         struct ath_interrupt_stats istats;
6685         struct ath_tx_stats txstats[ATH9K_NUM_TX_QUEUES];
6686         struct ath_rx_stats rxstats;
6687         struct ath_dfs_stats dfs_stats;
6688 +       struct ath_antenna_stats ant_stats[2];
6689         u32 reset[__RESET_TYPE_MAX];
6690  };
6691
6692 @@ -281,10 +296,11 @@ void ath9k_sta_remove_debugfs(struct iee
6693                               struct ieee80211_vif *vif,
6694                               struct ieee80211_sta *sta,
6695                               struct dentry *dir);
6696 -
6697  void ath_debug_send_fft_sample(struct ath_softc *sc,
6698                                struct fft_sample_tlv *fft_sample);
6699 -
6700 +void ath9k_debug_stat_ant(struct ath_softc *sc,
6701 +                         struct ath_hw_antcomb_conf *div_ant_conf,
6702 +                         int main_rssi_avg, int alt_rssi_avg);
6703  #else
6704
6705  #define RX_STAT_INC(c) /* NOP */
6706 @@ -297,12 +313,10 @@ static inline int ath9k_init_debug(struc
6707  static inline void ath9k_deinit_debug(struct ath_softc *sc)
6708  {
6709  }
6710 -
6711  static inline void ath_debug_stat_interrupt(struct ath_softc *sc,
6712                                             enum ath9k_int status)
6713  {
6714  }
6715 -
6716  static inline void ath_debug_stat_tx(struct ath_softc *sc,
6717                                      struct ath_buf *bf,
6718                                      struct ath_tx_status *ts,
6719 @@ -310,11 +324,16 @@ static inline void ath_debug_stat_tx(str
6720                                      unsigned int flags)
6721  {
6722  }
6723 -
6724  static inline void ath_debug_stat_rx(struct ath_softc *sc,
6725                                      struct ath_rx_status *rs)
6726  {
6727  }
6728 +static inline void ath9k_debug_stat_ant(struct ath_softc *sc,
6729 +                                       struct ath_hw_antcomb_conf *div_ant_conf,
6730 +                                       int main_rssi_avg, int alt_rssi_avg)
6731 +{
6732 +
6733 +}
6734
6735  #endif /* CPTCFG_ATH9K_DEBUGFS */
6736
6737 --- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
6738 +++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
6739 @@ -812,6 +812,7 @@ static void ath9k_hw_4k_set_gain(struct
6740  static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
6741                                          struct ath9k_channel *chan)
6742  {
6743 +       struct ath9k_hw_capabilities *pCap = &ah->caps;
6744         struct modal_eep_4k_header *pModal;
6745         struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
6746         struct base_eep_header_4k *pBase = &eep->baseEepHeader;
6747 @@ -858,6 +859,24 @@ static void ath9k_hw_4k_set_board_values
6748
6749                 REG_WRITE(ah, AR_PHY_CCK_DETECT, regVal);
6750                 regVal = REG_READ(ah, AR_PHY_CCK_DETECT);
6751 +
6752 +               if (pCap->hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) {
6753 +                       /*
6754 +                        * If diversity combining is enabled,
6755 +                        * set MAIN to LNA1 and ALT to LNA2 initially.
6756 +                        */
6757 +                       regVal = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
6758 +                       regVal &= (~(AR_PHY_9285_ANT_DIV_MAIN_LNACONF |
6759 +                                    AR_PHY_9285_ANT_DIV_ALT_LNACONF));
6760 +
6761 +                       regVal |= (ATH_ANT_DIV_COMB_LNA1 <<
6762 +                                  AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S);
6763 +                       regVal |= (ATH_ANT_DIV_COMB_LNA2 <<
6764 +                                  AR_PHY_9285_ANT_DIV_ALT_LNACONF_S);
6765 +                       regVal &= (~(AR_PHY_9285_FAST_DIV_BIAS));
6766 +                       regVal |= (0 << AR_PHY_9285_FAST_DIV_BIAS_S);
6767 +                       REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regVal);
6768 +               }
6769         }
6770
6771         if (pModal->version >= 2) {
6772 --- a/drivers/net/wireless/ath/ath9k/hw-ops.h
6773 +++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
6774 @@ -78,13 +78,16 @@ static inline void ath9k_hw_antdiv_comb_
6775         ath9k_hw_ops(ah)->antdiv_comb_conf_set(ah, antconf);
6776  }
6777
6778 -static inline void ath9k_hw_antctrl_shared_chain_lnadiv(struct ath_hw *ah,
6779 -                                                       bool enable)
6780 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
6781 +
6782 +static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
6783  {
6784 -       if (ath9k_hw_ops(ah)->antctrl_shared_chain_lnadiv)
6785 -               ath9k_hw_ops(ah)->antctrl_shared_chain_lnadiv(ah, enable);
6786 +       if (ath9k_hw_ops(ah)->set_bt_ant_diversity)
6787 +               ath9k_hw_ops(ah)->set_bt_ant_diversity(ah, enable);
6788  }
6789
6790 +#endif
6791 +
6792  /* Private hardware call ops */
6793
6794  /* PHY ops */
6795 --- a/drivers/net/wireless/ath/ath9k/hw.c
6796 +++ b/drivers/net/wireless/ath/ath9k/hw.c
6797 @@ -450,7 +450,6 @@ static void ath9k_hw_init_config(struct
6798         ah->config.ack_6mb = 0x0;
6799         ah->config.cwm_ignore_extcca = 0;
6800         ah->config.pcie_clock_req = 0;
6801 -       ah->config.pcie_waen = 0;
6802         ah->config.analog_shiftreg = 1;
6803
6804         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
6805 @@ -1069,7 +1068,7 @@ void ath9k_hw_init_global_settings(struc
6806                 if (IS_CHAN_A_FAST_CLOCK(ah, chan))
6807                     tx_lat += 11;
6808
6809 -               sifstime *= 2;
6810 +               sifstime = 32;
6811                 ack_offset = 16;
6812                 slottime = 13;
6813         } else if (IS_CHAN_QUARTER_RATE(chan)) {
6814 @@ -1079,7 +1078,7 @@ void ath9k_hw_init_global_settings(struc
6815                 if (IS_CHAN_A_FAST_CLOCK(ah, chan))
6816                     tx_lat += 22;
6817
6818 -               sifstime *= 4;
6819 +               sifstime = 64;
6820                 ack_offset = 32;
6821                 slottime = 21;
6822         } else {
6823 @@ -1116,7 +1115,6 @@ void ath9k_hw_init_global_settings(struc
6824                 ctstimeout += 48 - sifstime - ah->slottime;
6825         }
6826
6827 -
6828         ath9k_hw_set_sifs_time(ah, sifstime);
6829         ath9k_hw_setslottime(ah, slottime);
6830         ath9k_hw_set_ack_timeout(ah, acktimeout);
6831 @@ -1496,16 +1494,18 @@ static bool ath9k_hw_channel_change(stru
6832                                     struct ath9k_channel *chan)
6833  {
6834         struct ath_common *common = ath9k_hw_common(ah);
6835 +       struct ath9k_hw_capabilities *pCap = &ah->caps;
6836 +       bool band_switch = false, mode_diff = false;
6837 +       u8 ini_reloaded = 0;
6838         u32 qnum;
6839         int r;
6840 -       bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
6841 -       bool band_switch, mode_diff;
6842 -       u8 ini_reloaded;
6843 -
6844 -       band_switch = (chan->channelFlags & (CHANNEL_2GHZ | CHANNEL_5GHZ)) !=
6845 -                     (ah->curchan->channelFlags & (CHANNEL_2GHZ |
6846 -                                                   CHANNEL_5GHZ));
6847 -       mode_diff = (chan->chanmode != ah->curchan->chanmode);
6848 +
6849 +       if (pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH) {
6850 +               u32 cur = ah->curchan->channelFlags & (CHANNEL_2GHZ | CHANNEL_5GHZ);
6851 +               u32 new = chan->channelFlags & (CHANNEL_2GHZ | CHANNEL_5GHZ);
6852 +               band_switch = (cur != new);
6853 +               mode_diff = (chan->chanmode != ah->curchan->chanmode);
6854 +       }
6855
6856         for (qnum = 0; qnum < AR_NUM_QCU; qnum++) {
6857                 if (ath9k_hw_numtxpending(ah, qnum)) {
6858 @@ -1520,11 +1520,12 @@ static bool ath9k_hw_channel_change(stru
6859                 return false;
6860         }
6861
6862 -       if (edma && (band_switch || mode_diff)) {
6863 +       if (band_switch || mode_diff) {
6864                 ath9k_hw_mark_phy_inactive(ah);
6865                 udelay(5);
6866
6867 -               ath9k_hw_init_pll(ah, NULL);
6868 +               if (band_switch)
6869 +                       ath9k_hw_init_pll(ah, chan);
6870
6871                 if (ath9k_hw_fast_chan_change(ah, chan, &ini_reloaded)) {
6872                         ath_err(common, "Failed to do fast channel change\n");
6873 @@ -1541,22 +1542,21 @@ static bool ath9k_hw_channel_change(stru
6874         }
6875         ath9k_hw_set_clockrate(ah);
6876         ath9k_hw_apply_txpower(ah, chan, false);
6877 -       ath9k_hw_rfbus_done(ah);
6878
6879         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
6880                 ath9k_hw_set_delta_slope(ah, chan);
6881
6882         ath9k_hw_spur_mitigate_freq(ah, chan);
6883
6884 -       if (edma && (band_switch || mode_diff)) {
6885 -               ah->ah_flags |= AH_FASTCC;
6886 -               if (band_switch || ini_reloaded)
6887 -                       ah->eep_ops->set_board_values(ah, chan);
6888 +       if (band_switch || ini_reloaded)
6889 +               ah->eep_ops->set_board_values(ah, chan);
6890
6891 -               ath9k_hw_init_bb(ah, chan);
6892 +       ath9k_hw_init_bb(ah, chan);
6893 +       ath9k_hw_rfbus_done(ah);
6894
6895 -               if (band_switch || ini_reloaded)
6896 -                       ath9k_hw_init_cal(ah, chan);
6897 +       if (band_switch || ini_reloaded) {
6898 +               ah->ah_flags |= AH_FASTCC;
6899 +               ath9k_hw_init_cal(ah, chan);
6900                 ah->ah_flags &= ~AH_FASTCC;
6901         }
6902
6903 @@ -1778,16 +1778,11 @@ static void ath9k_hw_init_desc(struct at
6904  /*
6905   * Fast channel change:
6906   * (Change synthesizer based on channel freq without resetting chip)
6907 - *
6908 - * Don't do FCC when
6909 - *   - Flag is not set
6910 - *   - Chip is just coming out of full sleep
6911 - *   - Channel to be set is same as current channel
6912 - *   - Channel flags are different, (eg.,moving from 2GHz to 5GHz channel)
6913   */
6914  static int ath9k_hw_do_fastcc(struct ath_hw *ah, struct ath9k_channel *chan)
6915  {
6916         struct ath_common *common = ath9k_hw_common(ah);
6917 +       struct ath9k_hw_capabilities *pCap = &ah->caps;
6918         int ret;
6919
6920         if (AR_SREV_9280(ah) && common->bus_ops->ath_bus_type == ATH_PCI)
6921 @@ -1806,9 +1801,21 @@ static int ath9k_hw_do_fastcc(struct ath
6922             (CHANNEL_HALF | CHANNEL_QUARTER))
6923                 goto fail;
6924
6925 -       if ((chan->channelFlags & CHANNEL_ALL) !=
6926 -           (ah->curchan->channelFlags & CHANNEL_ALL))
6927 -               goto fail;
6928 +       /*
6929 +        * If cross-band fcc is not supoprted, bail out if
6930 +        * either channelFlags or chanmode differ.
6931 +        *
6932 +        * chanmode will be different if the HT operating mode
6933 +        * changes because of CSA.
6934 +        */
6935 +       if (!(pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH)) {
6936 +               if ((chan->channelFlags & CHANNEL_ALL) !=
6937 +                   (ah->curchan->channelFlags & CHANNEL_ALL))
6938 +                       goto fail;
6939 +
6940 +               if (chan->chanmode != ah->curchan->chanmode)
6941 +                       goto fail;
6942 +       }
6943
6944         if (!ath9k_hw_check_alive(ah))
6945                 goto fail;
6946 @@ -2047,7 +2054,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
6947
6948         ath9k_hw_apply_gpio_override(ah);
6949
6950 -       if (AR_SREV_9565(ah) && ah->shared_chain_lnadiv)
6951 +       if (AR_SREV_9565(ah) && common->bt_ant_diversity)
6952                 REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV, AR_BTCOEX_WL_LNADIV_FORCE_ON);
6953
6954         return 0;
6955 @@ -2550,34 +2557,28 @@ int ath9k_hw_fill_cap_info(struct ath_hw
6956         if (AR_SREV_9287_11_OR_LATER(ah) || AR_SREV_9271(ah))
6957                 pCap->hw_caps |= ATH9K_HW_CAP_SGI_20;
6958
6959 -       if (AR_SREV_9285(ah))
6960 +       if (AR_SREV_9285(ah)) {
6961                 if (ah->eep_ops->get_eeprom(ah, EEP_MODAL_VER) >= 3) {
6962                         ant_div_ctl1 =
6963                                 ah->eep_ops->get_eeprom(ah, EEP_ANT_DIV_CTL1);
6964 -                       if ((ant_div_ctl1 & 0x1) && ((ant_div_ctl1 >> 3) & 0x1))
6965 +                       if ((ant_div_ctl1 & 0x1) && ((ant_div_ctl1 >> 3) & 0x1)) {
6966                                 pCap->hw_caps |= ATH9K_HW_CAP_ANT_DIV_COMB;
6967 +                               ath_info(common, "Enable LNA combining\n");
6968 +                       }
6969                 }
6970 +       }
6971 +
6972         if (AR_SREV_9300_20_OR_LATER(ah)) {
6973                 if (ah->eep_ops->get_eeprom(ah, EEP_CHAIN_MASK_REDUCE))
6974                         pCap->hw_caps |= ATH9K_HW_CAP_APM;
6975         }
6976
6977 -
6978         if (AR_SREV_9330(ah) || AR_SREV_9485(ah) || AR_SREV_9565(ah)) {
6979                 ant_div_ctl1 = ah->eep_ops->get_eeprom(ah, EEP_ANT_DIV_CTL1);
6980 -               /*
6981 -                * enable the diversity-combining algorithm only when
6982 -                * both enable_lna_div and enable_fast_div are set
6983 -                *              Table for Diversity
6984 -                * ant_div_alt_lnaconf          bit 0-1
6985 -                * ant_div_main_lnaconf         bit 2-3
6986 -                * ant_div_alt_gaintb           bit 4
6987 -                * ant_div_main_gaintb          bit 5
6988 -                * enable_ant_div_lnadiv        bit 6
6989 -                * enable_ant_fast_div          bit 7
6990 -                */
6991 -               if ((ant_div_ctl1 >> 0x6) == 0x3)
6992 +               if ((ant_div_ctl1 >> 0x6) == 0x3) {
6993                         pCap->hw_caps |= ATH9K_HW_CAP_ANT_DIV_COMB;
6994 +                       ath_info(common, "Enable LNA combining\n");
6995 +               }
6996         }
6997
6998         if (ath9k_hw_dfs_tested(ah))
6999 @@ -2610,6 +2611,13 @@ int ath9k_hw_fill_cap_info(struct ath_hw
7000             ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
7001                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
7002
7003 +       /*
7004 +        * Fast channel change across bands is available
7005 +        * only for AR9462 and AR9565.
7006 +        */
7007 +       if (AR_SREV_9462(ah) || AR_SREV_9565(ah))
7008 +               pCap->hw_caps |= ATH9K_HW_CAP_FCC_BAND_SWITCH;
7009 +
7010         return 0;
7011  }
7012
7013 --- a/drivers/net/wireless/ath/ath9k/hw.h
7014 +++ b/drivers/net/wireless/ath/ath9k/hw.h
7015 @@ -247,6 +247,8 @@ enum ath9k_hw_caps {
7016         ATH9K_HW_CAP_DFS                        = BIT(16),
7017         ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(17),
7018         ATH9K_HW_CAP_PAPRD                      = BIT(18),
7019 +       ATH9K_HW_CAP_FCC_BAND_SWITCH            = BIT(19),
7020 +       ATH9K_HW_CAP_BT_ANT_DIV                 = BIT(20),
7021  };
7022
7023  /*
7024 @@ -309,8 +311,11 @@ struct ath9k_ops_config {
7025         u16 ani_poll_interval; /* ANI poll interval in ms */
7026
7027         /* Platform specific config */
7028 +       u32 aspm_l1_fix;
7029         u32 xlna_gpio;
7030 +       u32 ant_ctrl_comm2g_switch_enable;
7031         bool xatten_margin_cfg;
7032 +       bool alt_mingainidx;
7033  };
7034
7035  enum ath9k_int {
7036 @@ -716,11 +721,14 @@ struct ath_hw_ops {
7037                         struct ath_hw_antcomb_conf *antconf);
7038         void (*antdiv_comb_conf_set)(struct ath_hw *ah,
7039                         struct ath_hw_antcomb_conf *antconf);
7040 -       void (*antctrl_shared_chain_lnadiv)(struct ath_hw *hw, bool enable);
7041         void (*spectral_scan_config)(struct ath_hw *ah,
7042                                      struct ath_spec_scan *param);
7043         void (*spectral_scan_trigger)(struct ath_hw *ah);
7044         void (*spectral_scan_wait)(struct ath_hw *ah);
7045 +
7046 +#ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT
7047 +       void (*set_bt_ant_diversity)(struct ath_hw *hw, bool enable);
7048 +#endif
7049  };
7050
7051  struct ath_nf_limits {
7052 @@ -765,7 +773,6 @@ struct ath_hw {
7053         bool aspm_enabled;
7054         bool is_monitoring;
7055         bool need_an_top2_fixup;
7056 -       bool shared_chain_lnadiv;
7057         u16 tx_trig_level;
7058
7059         u32 nf_regs[6];
7060 --- a/drivers/net/wireless/ath/ath9k/pci.c
7061 +++ b/drivers/net/wireless/ath/ath9k/pci.c
7062 @@ -29,6 +29,60 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_i
7063         { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
7064         { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
7065         { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
7066 +
7067 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7068 +                        0x002A,
7069 +                        PCI_VENDOR_ID_AZWAVE,
7070 +                        0x1C71),
7071 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7072 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7073 +                        0x002A,
7074 +                        PCI_VENDOR_ID_FOXCONN,
7075 +                        0xE01F),
7076 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7077 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7078 +                        0x002A,
7079 +                        0x11AD, /* LITEON */
7080 +                        0x6632),
7081 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7082 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7083 +                        0x002A,
7084 +                        0x11AD, /* LITEON */
7085 +                        0x6642),
7086 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7087 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7088 +                        0x002A,
7089 +                        PCI_VENDOR_ID_QMI,
7090 +                        0x0306),
7091 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7092 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7093 +                        0x002A,
7094 +                        0x185F, /* WNC */
7095 +                        0x309D),
7096 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7097 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7098 +                        0x002A,
7099 +                        0x10CF, /* Fujitsu */
7100 +                        0x147C),
7101 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7102 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7103 +                        0x002A,
7104 +                        0x10CF, /* Fujitsu */
7105 +                        0x147D),
7106 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7107 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7108 +                        0x002A,
7109 +                        0x10CF, /* Fujitsu */
7110 +                        0x1536),
7111 +         .driver_data = ATH9K_PCI_D3_L1_WAR },
7112 +
7113 +       /* AR9285 card for Asus */
7114 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7115 +                        0x002B,
7116 +                        PCI_VENDOR_ID_AZWAVE,
7117 +                        0x2C37),
7118 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7119 +
7120         { PCI_VDEVICE(ATHEROS, 0x002B) }, /* PCI-E */
7121         { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
7122         { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI   */
7123 @@ -40,29 +94,106 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_i
7124                          0x0032,
7125                          PCI_VENDOR_ID_AZWAVE,
7126                          0x2086),
7127 -         .driver_data = ATH9K_PCI_CUS198 },
7128 +         .driver_data = ATH9K_PCI_CUS198 | ATH9K_PCI_BT_ANT_DIV },
7129         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7130                          0x0032,
7131                          PCI_VENDOR_ID_AZWAVE,
7132                          0x1237),
7133 -         .driver_data = ATH9K_PCI_CUS198 },
7134 +         .driver_data = ATH9K_PCI_CUS198 | ATH9K_PCI_BT_ANT_DIV },
7135         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7136                          0x0032,
7137                          PCI_VENDOR_ID_AZWAVE,
7138                          0x2126),
7139 -         .driver_data = ATH9K_PCI_CUS198 },
7140 +         .driver_data = ATH9K_PCI_CUS198 | ATH9K_PCI_BT_ANT_DIV },
7141 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7142 +                        0x0032,
7143 +                        PCI_VENDOR_ID_AZWAVE,
7144 +                        0x126A),
7145 +         .driver_data = ATH9K_PCI_CUS198 | ATH9K_PCI_BT_ANT_DIV },
7146
7147         /* PCI-E CUS230 */
7148         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7149                          0x0032,
7150                          PCI_VENDOR_ID_AZWAVE,
7151                          0x2152),
7152 -         .driver_data = ATH9K_PCI_CUS230 },
7153 +         .driver_data = ATH9K_PCI_CUS230 | ATH9K_PCI_BT_ANT_DIV },
7154         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7155                          0x0032,
7156                          PCI_VENDOR_ID_FOXCONN,
7157                          0xE075),
7158 -         .driver_data = ATH9K_PCI_CUS230 },
7159 +         .driver_data = ATH9K_PCI_CUS230 | ATH9K_PCI_BT_ANT_DIV },
7160 +
7161 +       /* WB225 */
7162 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7163 +                        0x0032,
7164 +                        PCI_VENDOR_ID_ATHEROS,
7165 +                        0x3119),
7166 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7167 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7168 +                        0x0032,
7169 +                        PCI_VENDOR_ID_ATHEROS,
7170 +                        0x3122),
7171 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7172 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7173 +                        0x0032,
7174 +                        0x185F, /* WNC */
7175 +                        0x3119),
7176 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7177 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7178 +                        0x0032,
7179 +                        0x185F, /* WNC */
7180 +                        0x3027),
7181 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7182 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7183 +                        0x0032,
7184 +                        PCI_VENDOR_ID_SAMSUNG,
7185 +                        0x4105),
7186 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7187 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7188 +                        0x0032,
7189 +                        PCI_VENDOR_ID_SAMSUNG,
7190 +                        0x4106),
7191 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7192 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7193 +                        0x0032,
7194 +                        PCI_VENDOR_ID_SAMSUNG,
7195 +                        0x410D),
7196 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7197 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7198 +                        0x0032,
7199 +                        PCI_VENDOR_ID_SAMSUNG,
7200 +                        0x410E),
7201 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7202 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7203 +                        0x0032,
7204 +                        PCI_VENDOR_ID_SAMSUNG,
7205 +                        0x410F),
7206 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7207 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7208 +                        0x0032,
7209 +                        PCI_VENDOR_ID_SAMSUNG,
7210 +                        0xC706),
7211 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7212 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7213 +                        0x0032,
7214 +                        PCI_VENDOR_ID_SAMSUNG,
7215 +                        0xC680),
7216 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7217 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7218 +                        0x0032,
7219 +                        PCI_VENDOR_ID_SAMSUNG,
7220 +                        0xC708),
7221 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7222 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7223 +                        0x0032,
7224 +                        PCI_VENDOR_ID_LENOVO,
7225 +                        0x3218),
7226 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7227 +       { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
7228 +                        0x0032,
7229 +                        PCI_VENDOR_ID_LENOVO,
7230 +                        0x3219),
7231 +         .driver_data = ATH9K_PCI_BT_ANT_DIV },
7232
7233         { PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
7234         { PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
7235 @@ -229,6 +360,22 @@ static void ath_pci_aspm_init(struct ath
7236                 return;
7237         }
7238
7239 +       /*
7240 +        * 0x70c - Ack Frequency Register.
7241 +        *
7242 +        * Bits 27:29 - DEFAULT_L1_ENTRANCE_LATENCY.
7243 +        *
7244 +        * 000 : 1 us
7245 +        * 001 : 2 us
7246 +        * 010 : 4 us
7247 +        * 011 : 8 us
7248 +        * 100 : 16 us
7249 +        * 101 : 32 us
7250 +        * 110/111 : 64 us
7251 +        */
7252 +       if (AR_SREV_9462(ah))
7253 +               pci_read_config_dword(pdev, 0x70c, &ah->config.aspm_l1_fix);
7254 +
7255         pcie_capability_read_word(parent, PCI_EXP_LNKCTL, &aspm);
7256         if (aspm & (PCI_EXP_LNKCTL_ASPM_L0S | PCI_EXP_LNKCTL_ASPM_L1)) {
7257                 ah->aspm_enabled = true;
7258 --- a/drivers/net/wireless/ath/ath9k/phy.h
7259 +++ b/drivers/net/wireless/ath/ath9k/phy.h
7260 @@ -48,4 +48,11 @@
7261  #define AR_PHY_PLL_CONTROL 0x16180
7262  #define AR_PHY_PLL_MODE 0x16184
7263
7264 +enum ath9k_ant_div_comb_lna_conf {
7265 +       ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2,
7266 +       ATH_ANT_DIV_COMB_LNA2,
7267 +       ATH_ANT_DIV_COMB_LNA1,
7268 +       ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2,
7269 +};
7270 +
7271  #endif
7272 --- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
7273 +++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
7274 @@ -73,7 +73,6 @@
7275  #include "iwl-prph.h"
7276
7277  /* A TimeUnit is 1024 microsecond */
7278 -#define TU_TO_JIFFIES(_tu)     (usecs_to_jiffies((_tu) * 1024))
7279  #define MSEC_TO_TU(_msec)      (_msec*1000/1024)
7280
7281  /*
7282 @@ -191,8 +190,7 @@ static void iwl_mvm_te_handle_notif(stru
7283                 iwl_mvm_te_clear_data(mvm, te_data);
7284         } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
7285                 te_data->running = true;
7286 -               te_data->end_jiffies = jiffies +
7287 -                       TU_TO_JIFFIES(te_data->duration);
7288 +               te_data->end_jiffies = TU_TO_EXP_TIME(te_data->duration);
7289
7290                 if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
7291                         set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
7292 @@ -329,8 +327,7 @@ void iwl_mvm_protect_session(struct iwl_
7293         lockdep_assert_held(&mvm->mutex);
7294
7295         if (te_data->running &&
7296 -           time_after(te_data->end_jiffies,
7297 -                      jiffies + TU_TO_JIFFIES(min_duration))) {
7298 +           time_after(te_data->end_jiffies, TU_TO_EXP_TIME(min_duration))) {
7299                 IWL_DEBUG_TE(mvm, "We have enough time in the current TE: %u\n",
7300                              jiffies_to_msecs(te_data->end_jiffies - jiffies));
7301                 return;
7302 --- a/include/linux/ieee80211.h
7303 +++ b/include/linux/ieee80211.h
7304 @@ -2279,4 +2279,8 @@ static inline bool ieee80211_check_tim(c
7305         return !!(tim->virtual_map[index] & mask);
7306  }
7307
7308 +/* convert time units */
7309 +#define TU_TO_JIFFIES(x)       (usecs_to_jiffies((x) * 1024))
7310 +#define TU_TO_EXP_TIME(x)      (jiffies + TU_TO_JIFFIES(x))
7311 +
7312  #endif /* LINUX_IEEE80211_H */
7313 --- a/net/mac80211/rate.c
7314 +++ b/net/mac80211/rate.c
7315 @@ -210,7 +210,7 @@ static bool rc_no_data_or_no_ack_use_min
7316                 !ieee80211_is_data(fc);
7317  }
7318
7319 -static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
7320 +static void rc_send_low_basicrate(s8 *idx, u32 basic_rates,
7321                                   struct ieee80211_supported_band *sband)
7322  {
7323         u8 i;
7324 @@ -272,28 +272,37 @@ static void __rate_control_send_low(stru
7325  }
7326
7327
7328 -bool rate_control_send_low(struct ieee80211_sta *sta,
7329 +bool rate_control_send_low(struct ieee80211_sta *pubsta,
7330                            void *priv_sta,
7331                            struct ieee80211_tx_rate_control *txrc)
7332  {
7333         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
7334         struct ieee80211_supported_band *sband = txrc->sband;
7335 +       struct sta_info *sta;
7336         int mcast_rate;
7337 +       bool use_basicrate = false;
7338
7339 -       if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
7340 -               __rate_control_send_low(txrc->hw, sband, sta, info);
7341 +       if (!pubsta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
7342 +               __rate_control_send_low(txrc->hw, sband, pubsta, info);
7343
7344 -               if (!sta && txrc->bss) {
7345 +               if (!pubsta && txrc->bss) {
7346                         mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
7347                         if (mcast_rate > 0) {
7348                                 info->control.rates[0].idx = mcast_rate - 1;
7349                                 return true;
7350                         }
7351 +                       use_basicrate = true;
7352 +               } else if (pubsta) {
7353 +                       sta = container_of(pubsta, struct sta_info, sta);
7354 +                       if (ieee80211_vif_is_mesh(&sta->sdata->vif))
7355 +                               use_basicrate = true;
7356 +               }
7357
7358 -                       rc_send_low_broadcast(&info->control.rates[0].idx,
7359 +               if (use_basicrate)
7360 +                       rc_send_low_basicrate(&info->control.rates[0].idx,
7361                                               txrc->bss_conf->basic_rates,
7362                                               sband);
7363 -               }
7364 +
7365                 return true;
7366         }
7367         return false;
7368 --- a/drivers/net/wireless/ath/ath9k/Kconfig
7369 +++ b/drivers/net/wireless/ath/ath9k/Kconfig
7370 @@ -60,7 +60,7 @@ config ATH9K_AHB
7371
7372  config ATH9K_DEBUGFS
7373         bool "Atheros ath9k debugging"
7374 -       depends on ATH9K
7375 +       depends on ATH9K && DEBUG_FS
7376         select MAC80211_DEBUGFS
7377         depends on RELAY
7378         ---help---
7379 --- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
7380 +++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
7381 @@ -269,13 +269,12 @@ static void ar9002_hw_configpcipowersave
7382                         if (ah->config.pcie_waen & AR_WA_D3_L1_DISABLE)
7383                                 val |= AR_WA_D3_L1_DISABLE;
7384                 } else {
7385 -                       if (((AR_SREV_9285(ah) ||
7386 -                             AR_SREV_9271(ah) ||
7387 -                             AR_SREV_9287(ah)) &&
7388 -                            (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)) ||
7389 -                           (AR_SREV_9280(ah) &&
7390 -                            (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE))) {
7391 -                               val |= AR_WA_D3_L1_DISABLE;
7392 +                       if (AR_SREV_9285(ah) || AR_SREV_9271(ah) || AR_SREV_9287(ah)) {
7393 +                               if (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)
7394 +                                       val |= AR_WA_D3_L1_DISABLE;
7395 +                       } else if (AR_SREV_9280(ah)) {
7396 +                               if (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE)
7397 +                                       val |= AR_WA_D3_L1_DISABLE;
7398                         }
7399                 }
7400
7401 @@ -297,24 +296,18 @@ static void ar9002_hw_configpcipowersave
7402         } else {
7403                 if (ah->config.pcie_waen) {
7404                         val = ah->config.pcie_waen;
7405 -                       if (!power_off)
7406 -                               val &= (~AR_WA_D3_L1_DISABLE);
7407 +                       val &= (~AR_WA_D3_L1_DISABLE);
7408                 } else {
7409 -                       if (AR_SREV_9285(ah) ||
7410 -                           AR_SREV_9271(ah) ||
7411 -                           AR_SREV_9287(ah)) {
7412 +                       if (AR_SREV_9285(ah) || AR_SREV_9271(ah) || AR_SREV_9287(ah)) {
7413                                 val = AR9285_WA_DEFAULT;
7414 -                               if (!power_off)
7415 -                                       val &= (~AR_WA_D3_L1_DISABLE);
7416 -                       }
7417 -                       else if (AR_SREV_9280(ah)) {
7418 +                               val &= (~AR_WA_D3_L1_DISABLE);
7419 +                       } else if (AR_SREV_9280(ah)) {
7420                                 /*
7421                                  * For AR9280 chips, bit 22 of 0x4004
7422                                  * needs to be set.
7423                                  */
7424                                 val = AR9280_WA_DEFAULT;
7425 -                               if (!power_off)
7426 -                                       val &= (~AR_WA_D3_L1_DISABLE);
7427 +                               val &= (~AR_WA_D3_L1_DISABLE);
7428                         } else {
7429                                 val = AR_WA_DEFAULT;
7430                         }
7431 --- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
7432 +++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
7433 @@ -153,7 +153,7 @@ static void ar9003_hw_init_mode_regs(str
7434                 if (!ah->is_clk_25mhz)
7435                         INIT_INI_ARRAY(&ah->iniAdditional,
7436                                        ar9340_1p0_radio_core_40M);
7437 -       } else if (AR_SREV_9485_11(ah)) {
7438 +       } else if (AR_SREV_9485_11_OR_LATER(ah)) {
7439                 /* mac */
7440                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
7441                                 ar9485_1_1_mac_core);
7442 @@ -424,7 +424,7 @@ static void ar9003_tx_gain_table_mode0(s
7443         else if (AR_SREV_9340(ah))
7444                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7445                         ar9340Modes_lowest_ob_db_tx_gain_table_1p0);
7446 -       else if (AR_SREV_9485_11(ah))
7447 +       else if (AR_SREV_9485_11_OR_LATER(ah))
7448                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7449                         ar9485_modes_lowest_ob_db_tx_gain_1_1);
7450         else if (AR_SREV_9550(ah))
7451 @@ -458,7 +458,7 @@ static void ar9003_tx_gain_table_mode1(s
7452         else if (AR_SREV_9340(ah))
7453                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7454                         ar9340Modes_high_ob_db_tx_gain_table_1p0);
7455 -       else if (AR_SREV_9485_11(ah))
7456 +       else if (AR_SREV_9485_11_OR_LATER(ah))
7457                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7458                         ar9485Modes_high_ob_db_tx_gain_1_1);
7459         else if (AR_SREV_9580(ah))
7460 @@ -492,7 +492,7 @@ static void ar9003_tx_gain_table_mode2(s
7461         else if (AR_SREV_9340(ah))
7462                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7463                         ar9340Modes_low_ob_db_tx_gain_table_1p0);
7464 -       else if (AR_SREV_9485_11(ah))
7465 +       else if (AR_SREV_9485_11_OR_LATER(ah))
7466                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7467                         ar9485Modes_low_ob_db_tx_gain_1_1);
7468         else if (AR_SREV_9580(ah))
7469 @@ -517,7 +517,7 @@ static void ar9003_tx_gain_table_mode3(s
7470         else if (AR_SREV_9340(ah))
7471                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7472                         ar9340Modes_high_power_tx_gain_table_1p0);
7473 -       else if (AR_SREV_9485_11(ah))
7474 +       else if (AR_SREV_9485_11_OR_LATER(ah))
7475                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7476                         ar9485Modes_high_power_tx_gain_1_1);
7477         else if (AR_SREV_9580(ah))
7478 @@ -552,7 +552,7 @@ static void ar9003_tx_gain_table_mode4(s
7479
7480  static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
7481  {
7482 -       if (AR_SREV_9485_11(ah))
7483 +       if (AR_SREV_9485_11_OR_LATER(ah))
7484                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7485                         ar9485Modes_green_ob_db_tx_gain_1_1);
7486         else if (AR_SREV_9340(ah))
7487 @@ -571,7 +571,7 @@ static void ar9003_tx_gain_table_mode6(s
7488         if (AR_SREV_9340(ah))
7489                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7490                         ar9340Modes_low_ob_db_and_spur_tx_gain_table_1p0);
7491 -       else if (AR_SREV_9485_11(ah))
7492 +       else if (AR_SREV_9485_11_OR_LATER(ah))
7493                 INIT_INI_ARRAY(&ah->iniModesTxGain,
7494                         ar9485Modes_green_spur_ob_db_tx_gain_1_1);
7495         else if (AR_SREV_9580(ah))
7496 @@ -611,7 +611,7 @@ static void ar9003_rx_gain_table_mode0(s
7497         else if (AR_SREV_9340(ah))
7498                 INIT_INI_ARRAY(&ah->iniModesRxGain,
7499                                 ar9340Common_rx_gain_table_1p0);
7500 -       else if (AR_SREV_9485_11(ah))
7501 +       else if (AR_SREV_9485_11_OR_LATER(ah))
7502                 INIT_INI_ARRAY(&ah->iniModesRxGain,
7503                                ar9485_common_rx_gain_1_1);
7504         else if (AR_SREV_9550(ah)) {
7505 @@ -644,7 +644,7 @@ static void ar9003_rx_gain_table_mode1(s
7506         else if (AR_SREV_9340(ah))
7507                 INIT_INI_ARRAY(&ah->iniModesRxGain,
7508                         ar9340Common_wo_xlna_rx_gain_table_1p0);
7509 -       else if (AR_SREV_9485_11(ah))
7510 +       else if (AR_SREV_9485_11_OR_LATER(ah))
7511                 INIT_INI_ARRAY(&ah->iniModesRxGain,
7512                         ar9485Common_wo_xlna_rx_gain_1_1);
7513         else if (AR_SREV_9462_21(ah))
7514 @@ -745,16 +745,25 @@ static void ar9003_hw_init_mode_gain_reg
7515  static void ar9003_hw_configpcipowersave(struct ath_hw *ah,
7516                                          bool power_off)
7517  {
7518 +       /*
7519 +        * Increase L1 Entry Latency. Some WB222 boards don't have
7520 +        * this change in eeprom/OTP.
7521 +        *
7522 +        */
7523 +       if (AR_SREV_9462(ah)) {
7524 +               u32 val = ah->config.aspm_l1_fix;
7525 +               if ((val & 0xff000000) == 0x17000000) {
7526 +                       val &= 0x00ffffff;
7527 +                       val |= 0x27000000;
7528 +                       REG_WRITE(ah, 0x570c, val);
7529 +               }
7530 +       }
7531 +
7532         /* Nothing to do on restore for 11N */
7533         if (!power_off /* !restore */) {
7534                 /* set bit 19 to allow forcing of pcie core into L1 state */
7535                 REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
7536 -
7537 -               /* Several PCIe massages to ensure proper behaviour */
7538 -               if (ah->config.pcie_waen)
7539 -                       REG_WRITE(ah, AR_WA, ah->config.pcie_waen);
7540 -               else
7541 -                       REG_WRITE(ah, AR_WA, ah->WARegVal);
7542 +               REG_WRITE(ah, AR_WA, ah->WARegVal);
7543         }
7544
7545         /*
7546 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
7547 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
7548 @@ -491,6 +491,7 @@ int ath9k_hw_process_rxdesc_edma(struct
7549         rxs->rs_rate = MS(rxsp->status1, AR_RxRate);
7550         rxs->rs_more = (rxsp->status2 & AR_RxMore) ? 1 : 0;
7551
7552 +       rxs->rs_firstaggr = (rxsp->status11 & AR_RxFirstAggr) ? 1 : 0;
7553         rxs->rs_isaggr = (rxsp->status11 & AR_RxAggr) ? 1 : 0;
7554         rxs->rs_moreaggr = (rxsp->status11 & AR_RxMoreAggr) ? 1 : 0;
7555         rxs->rs_antenna = (MS(rxsp->status4, AR_RxAntenna) & 0x7);
7556 --- a/drivers/net/wireless/ath/ath9k/common.c
7557 +++ b/drivers/net/wireless/ath/ath9k/common.c
7558 @@ -49,37 +49,40 @@ int ath9k_cmn_get_hw_crypto_keytype(stru
7559  }
7560  EXPORT_SYMBOL(ath9k_cmn_get_hw_crypto_keytype);
7561
7562 -static u32 ath9k_get_extchanmode(struct ieee80211_channel *chan,
7563 -                                enum nl80211_channel_type channel_type)
7564 +static u32 ath9k_get_extchanmode(struct cfg80211_chan_def *chandef)
7565  {
7566         u32 chanmode = 0;
7567
7568 -       switch (chan->band) {
7569 +       switch (chandef->chan->band) {
7570         case IEEE80211_BAND_2GHZ:
7571 -               switch (channel_type) {
7572 -               case NL80211_CHAN_NO_HT:
7573 -               case NL80211_CHAN_HT20:
7574 +               switch (chandef->width) {
7575 +               case NL80211_CHAN_WIDTH_20_NOHT:
7576 +               case NL80211_CHAN_WIDTH_20:
7577                         chanmode = CHANNEL_G_HT20;
7578                         break;
7579 -               case NL80211_CHAN_HT40PLUS:
7580 -                       chanmode = CHANNEL_G_HT40PLUS;
7581 +               case NL80211_CHAN_WIDTH_40:
7582 +                       if (chandef->center_freq1 > chandef->chan->center_freq)
7583 +                               chanmode = CHANNEL_G_HT40PLUS;
7584 +                       else
7585 +                               chanmode = CHANNEL_G_HT40MINUS;
7586                         break;
7587 -               case NL80211_CHAN_HT40MINUS:
7588 -                       chanmode = CHANNEL_G_HT40MINUS;
7589 +               default:
7590                         break;
7591                 }
7592                 break;
7593         case IEEE80211_BAND_5GHZ:
7594 -               switch (channel_type) {
7595 -               case NL80211_CHAN_NO_HT:
7596 -               case NL80211_CHAN_HT20:
7597 +               switch (chandef->width) {
7598 +               case NL80211_CHAN_WIDTH_20_NOHT:
7599 +               case NL80211_CHAN_WIDTH_20:
7600                         chanmode = CHANNEL_A_HT20;
7601                         break;
7602 -               case NL80211_CHAN_HT40PLUS:
7603 -                       chanmode = CHANNEL_A_HT40PLUS;
7604 +               case NL80211_CHAN_WIDTH_40:
7605 +                       if (chandef->center_freq1 > chandef->chan->center_freq)
7606 +                               chanmode = CHANNEL_A_HT40PLUS;
7607 +                       else
7608 +                               chanmode = CHANNEL_A_HT40MINUS;
7609                         break;
7610 -               case NL80211_CHAN_HT40MINUS:
7611 -                       chanmode = CHANNEL_A_HT40MINUS;
7612 +               default:
7613                         break;
7614                 }
7615                 break;
7616 @@ -94,13 +97,12 @@ static u32 ath9k_get_extchanmode(struct
7617   * Update internal channel flags.
7618   */
7619  void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
7620 -                              struct ieee80211_channel *chan,
7621 -                              enum nl80211_channel_type channel_type)
7622 +                              struct cfg80211_chan_def *chandef)
7623  {
7624 -       ichan->channel = chan->center_freq;
7625 -       ichan->chan = chan;
7626 +       ichan->channel = chandef->chan->center_freq;
7627 +       ichan->chan = chandef->chan;
7628
7629 -       if (chan->band == IEEE80211_BAND_2GHZ) {
7630 +       if (chandef->chan->band == IEEE80211_BAND_2GHZ) {
7631                 ichan->chanmode = CHANNEL_G;
7632                 ichan->channelFlags = CHANNEL_2GHZ | CHANNEL_OFDM;
7633         } else {
7634 @@ -108,8 +110,22 @@ void ath9k_cmn_update_ichannel(struct at
7635                 ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
7636         }
7637
7638 -       if (channel_type != NL80211_CHAN_NO_HT)
7639 -               ichan->chanmode = ath9k_get_extchanmode(chan, channel_type);
7640 +       switch (chandef->width) {
7641 +       case NL80211_CHAN_WIDTH_5:
7642 +               ichan->channelFlags |= CHANNEL_QUARTER;
7643 +               break;
7644 +       case NL80211_CHAN_WIDTH_10:
7645 +               ichan->channelFlags |= CHANNEL_HALF;
7646 +               break;
7647 +       case NL80211_CHAN_WIDTH_20_NOHT:
7648 +               break;
7649 +       case NL80211_CHAN_WIDTH_20:
7650 +       case NL80211_CHAN_WIDTH_40:
7651 +               ichan->chanmode = ath9k_get_extchanmode(chandef);
7652 +               break;
7653 +       default:
7654 +               WARN_ON(1);
7655 +       }
7656  }
7657  EXPORT_SYMBOL(ath9k_cmn_update_ichannel);
7658
7659 @@ -125,8 +141,7 @@ struct ath9k_channel *ath9k_cmn_get_curc
7660
7661         chan_idx = curchan->hw_value;
7662         channel = &ah->channels[chan_idx];
7663 -       ath9k_cmn_update_ichannel(channel, curchan,
7664 -                                 cfg80211_get_chandef_type(&hw->conf.chandef));
7665 +       ath9k_cmn_update_ichannel(channel, &hw->conf.chandef);
7666
7667         return channel;
7668  }
7669 --- a/drivers/net/wireless/ath/ath9k/common.h
7670 +++ b/drivers/net/wireless/ath/ath9k/common.h
7671 @@ -44,8 +44,7 @@
7672
7673  int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
7674  void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
7675 -                              struct ieee80211_channel *chan,
7676 -                              enum nl80211_channel_type channel_type);
7677 +                              struct cfg80211_chan_def *chandef);
7678  struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
7679                                                struct ath_hw *ah);
7680  int ath9k_cmn_count_streams(unsigned int chainmask, int max);
7681 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c
7682 +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
7683 @@ -115,10 +115,10 @@ static int hif_usb_send_regout(struct hi
7684         cmd->skb = skb;
7685         cmd->hif_dev = hif_dev;
7686
7687 -       usb_fill_bulk_urb(urb, hif_dev->udev,
7688 -                        usb_sndbulkpipe(hif_dev->udev, USB_REG_OUT_PIPE),
7689 +       usb_fill_int_urb(urb, hif_dev->udev,
7690 +                        usb_sndintpipe(hif_dev->udev, USB_REG_OUT_PIPE),
7691                          skb->data, skb->len,
7692 -                        hif_usb_regout_cb, cmd);
7693 +                        hif_usb_regout_cb, cmd, 1);
7694
7695         usb_anchor_urb(urb, &hif_dev->regout_submitted);
7696         ret = usb_submit_urb(urb, GFP_KERNEL);
7697 @@ -723,11 +723,11 @@ static void ath9k_hif_usb_reg_in_cb(stru
7698                         return;
7699                 }
7700
7701 -               usb_fill_bulk_urb(urb, hif_dev->udev,
7702 -                                usb_rcvbulkpipe(hif_dev->udev,
7703 +               usb_fill_int_urb(urb, hif_dev->udev,
7704 +                                usb_rcvintpipe(hif_dev->udev,
7705                                                  USB_REG_IN_PIPE),
7706                                  nskb->data, MAX_REG_IN_BUF_SIZE,
7707 -                                ath9k_hif_usb_reg_in_cb, nskb);
7708 +                                ath9k_hif_usb_reg_in_cb, nskb, 1);
7709         }
7710
7711  resubmit:
7712 @@ -909,11 +909,11 @@ static int ath9k_hif_usb_alloc_reg_in_ur
7713                         goto err_skb;
7714                 }
7715
7716 -               usb_fill_bulk_urb(urb, hif_dev->udev,
7717 -                                 usb_rcvbulkpipe(hif_dev->udev,
7718 +               usb_fill_int_urb(urb, hif_dev->udev,
7719 +                                 usb_rcvintpipe(hif_dev->udev,
7720                                                   USB_REG_IN_PIPE),
7721                                   skb->data, MAX_REG_IN_BUF_SIZE,
7722 -                                 ath9k_hif_usb_reg_in_cb, skb);
7723 +                                 ath9k_hif_usb_reg_in_cb, skb, 1);
7724
7725                 /* Anchor URB */
7726                 usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
7727 @@ -1031,9 +1031,7 @@ static int ath9k_hif_usb_download_fw(str
7728
7729  static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
7730  {
7731 -       struct usb_host_interface *alt = &hif_dev->interface->altsetting[0];
7732 -       struct usb_endpoint_descriptor *endp;
7733 -       int ret, idx;
7734 +       int ret;
7735
7736         ret = ath9k_hif_usb_download_fw(hif_dev);
7737         if (ret) {
7738 @@ -1043,20 +1041,6 @@ static int ath9k_hif_usb_dev_init(struct
7739                 return ret;
7740         }
7741
7742 -       /* On downloading the firmware to the target, the USB descriptor of EP4
7743 -        * is 'patched' to change the type of the endpoint to Bulk. This will
7744 -        * bring down CPU usage during the scan period.
7745 -        */
7746 -       for (idx = 0; idx < alt->desc.bNumEndpoints; idx++) {
7747 -               endp = &alt->endpoint[idx].desc;
7748 -               if ((endp->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
7749 -                               == USB_ENDPOINT_XFER_INT) {
7750 -                       endp->bmAttributes &= ~USB_ENDPOINT_XFERTYPE_MASK;
7751 -                       endp->bmAttributes |= USB_ENDPOINT_XFER_BULK;
7752 -                       endp->bInterval = 0;
7753 -               }
7754 -       }
7755 -
7756         /* Alloc URBs */
7757         ret = ath9k_hif_usb_alloc_urbs(hif_dev);
7758         if (ret) {
7759 @@ -1268,7 +1252,7 @@ static void ath9k_hif_usb_reboot(struct
7760         if (!buf)
7761                 return;
7762
7763 -       ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, USB_REG_OUT_PIPE),
7764 +       ret = usb_interrupt_msg(udev, usb_sndintpipe(udev, USB_REG_OUT_PIPE),
7765                            buf, 4, NULL, HZ);
7766         if (ret)
7767                 dev_err(&udev->dev, "ath9k_htc: USB reboot failed\n");
7768 --- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
7769 +++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
7770 @@ -1203,16 +1203,13 @@ static int ath9k_htc_config(struct ieee8
7771
7772         if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || chip_reset) {
7773                 struct ieee80211_channel *curchan = hw->conf.chandef.chan;
7774 -               enum nl80211_channel_type channel_type =
7775 -                       cfg80211_get_chandef_type(&hw->conf.chandef);
7776                 int pos = curchan->hw_value;
7777
7778                 ath_dbg(common, CONFIG, "Set channel: %d MHz\n",
7779                         curchan->center_freq);
7780
7781                 ath9k_cmn_update_ichannel(&priv->ah->channels[pos],
7782 -                                         hw->conf.chandef.chan,
7783 -                                         channel_type);
7784 +                                         &hw->conf.chandef);
7785
7786                 if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
7787                         ath_err(common, "Unable to set channel\n");
7788 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
7789 +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
7790 @@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct
7791         struct ieee80211_conf *cur_conf = &priv->hw->conf;
7792         bool txok;
7793         int slot;
7794 +       int hdrlen, padsize;
7795
7796         slot = strip_drv_header(priv, skb);
7797         if (slot < 0) {
7798 @@ -504,6 +505,15 @@ send_mac80211:
7799
7800         ath9k_htc_tx_clear_slot(priv, slot);
7801
7802 +       /* Remove padding before handing frame back to mac80211 */
7803 +       hdrlen = ieee80211_get_hdrlen_from_skb(skb);
7804 +
7805 +       padsize = hdrlen & 3;
7806 +       if (padsize && skb->len > hdrlen + padsize) {
7807 +               memmove(skb->data + padsize, skb->data, hdrlen);
7808 +               skb_pull(skb, padsize);
7809 +       }
7810 +
7811         /* Send status to mac80211 */
7812         ieee80211_tx_status(priv->hw, skb);
7813  }
7814 --- a/drivers/net/wireless/ath/ath9k/link.c
7815 +++ b/drivers/net/wireless/ath/ath9k/link.c
7816 @@ -41,7 +41,7 @@ void ath_tx_complete_poll_work(struct wo
7817                                 txq->axq_tx_inprogress = true;
7818                         }
7819                 }
7820 -               ath_txq_unlock_complete(sc, txq);
7821 +               ath_txq_unlock(sc, txq);
7822         }
7823
7824         if (needreset) {
7825 --- a/drivers/net/wireless/ath/ath9k/mac.c
7826 +++ b/drivers/net/wireless/ath/ath9k/mac.c
7827 @@ -583,9 +583,9 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
7828         rs->rs_rate = MS(ads.ds_rxstatus0, AR_RxRate);
7829         rs->rs_more = (ads.ds_rxstatus1 & AR_RxMore) ? 1 : 0;
7830
7831 +       rs->rs_firstaggr = (ads.ds_rxstatus8 & AR_RxFirstAggr) ? 1 : 0;
7832         rs->rs_isaggr = (ads.ds_rxstatus8 & AR_RxAggr) ? 1 : 0;
7833 -       rs->rs_moreaggr =
7834 -               (ads.ds_rxstatus8 & AR_RxMoreAggr) ? 1 : 0;
7835 +       rs->rs_moreaggr = (ads.ds_rxstatus8 & AR_RxMoreAggr) ? 1 : 0;
7836         rs->rs_antenna = MS(ads.ds_rxstatus3, AR_RxAntenna);
7837
7838         /* directly mapped flags for ieee80211_rx_status */
7839 --- a/drivers/net/wireless/ath/ath9k/mac.h
7840 +++ b/drivers/net/wireless/ath/ath9k/mac.h
7841 @@ -140,6 +140,7 @@ struct ath_rx_status {
7842         int8_t rs_rssi_ext1;
7843         int8_t rs_rssi_ext2;
7844         u8 rs_isaggr;
7845 +       u8 rs_firstaggr;
7846         u8 rs_moreaggr;
7847         u8 rs_num_delims;
7848         u8 rs_flags;
7849 @@ -569,6 +570,7 @@ struct ar5416_desc {
7850  #define AR_RxAggr           0x00020000
7851  #define AR_PostDelimCRCErr  0x00040000
7852  #define AR_RxStatusRsvd71   0x3ff80000
7853 +#define AR_RxFirstAggr      0x20000000
7854  #define AR_DecryptBusyErr   0x40000000
7855  #define AR_KeyMiss          0x80000000
7856
7857 --- a/drivers/net/wireless/ath/ath9k/rc.c
7858 +++ b/drivers/net/wireless/ath/ath9k/rc.c
7859 @@ -1324,8 +1324,8 @@ static void ath_rate_update(void *priv,
7860                 ath_rc_init(sc, priv_sta);
7861
7862                 ath_dbg(ath9k_hw_common(sc->sc_ah), CONFIG,
7863 -                       "Operating HT Bandwidth changed to: %d\n",
7864 -                       cfg80211_get_chandef_type(&sc->hw->conf.chandef));
7865 +                       "Operating Bandwidth changed to: %d\n",
7866 +                       sc->hw->conf.chandef.width);
7867         }
7868  }
7869
7870 --- a/drivers/net/wireless/ath/ath9k/reg.h
7871 +++ b/drivers/net/wireless/ath/ath9k/reg.h
7872 @@ -893,9 +893,9 @@
7873
7874  #define AR_SREV_9485(_ah) \
7875         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
7876 -#define AR_SREV_9485_11(_ah) \
7877 -       (AR_SREV_9485(_ah) && \
7878 -        ((_ah)->hw_version.macRev == AR_SREV_REVISION_9485_11))
7879 +#define AR_SREV_9485_11_OR_LATER(_ah) \
7880 +       (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485) && \
7881 +        ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9485_11))
7882  #define AR_SREV_9485_OR_LATER(_ah) \
7883         (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9485))
7884
7885 --- a/net/mac80211/main.c
7886 +++ b/net/mac80211/main.c
7887 @@ -101,7 +101,7 @@ static u32 ieee80211_hw_conf_chan(struct
7888         struct ieee80211_sub_if_data *sdata;
7889         struct cfg80211_chan_def chandef = {};
7890         u32 changed = 0;
7891 -       int power;
7892 +       int power = 0;
7893         u32 offchannel_flag;
7894
7895         offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
7896 @@ -155,16 +155,16 @@ static u32 ieee80211_hw_conf_chan(struct
7897                 changed |= IEEE80211_CONF_CHANGE_SMPS;
7898         }
7899
7900 -       power = chandef.chan->max_power;
7901 -
7902         rcu_read_lock();
7903         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
7904                 if (!rcu_access_pointer(sdata->vif.chanctx_conf))
7905                         continue;
7906 -               power = min(power, sdata->vif.bss_conf.txpower);
7907 +               power = max(power, sdata->vif.bss_conf.txpower);
7908         }
7909         rcu_read_unlock();
7910
7911 +       power = min(power, chandef.chan->max_power);
7912 +
7913         if (local->hw.conf.power_level != power) {
7914                 changed |= IEEE80211_CONF_CHANGE_POWER;
7915                 local->hw.conf.power_level = power;
7916 --- a/net/mac80211/status.c
7917 +++ b/net/mac80211/status.c
7918 @@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct
7919         struct ieee80211_local *local = sta->local;
7920         struct ieee80211_sub_if_data *sdata = sta->sdata;
7921
7922 +       if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
7923 +               sta->last_rx = jiffies;
7924 +
7925         if (ieee80211_is_data_qos(mgmt->frame_control)) {
7926                 struct ieee80211_hdr *hdr = (void *) skb->data;
7927                 u8 *qc = ieee80211_get_qos_ctl(hdr);