rt2x00: fix crash when using TKIP on USB devices
[openwrt.git] / package / kernel / mac80211 / patches / 300-pending_work.patch
1 commit 1186edbef91f15722e5bdf56326ce0abc2935ce7
2 Author: Stanislaw Gruszka <sgruszka@redhat.com>
3 Date:   Tue Jun 10 12:51:06 2014 +0200
4
5     rt2x00: disable TKIP on USB
6     
7     On USB we can not get atomically TKIP key. We have to disable support
8     for TKIP acceleration on USB hardware to avoid bug as showed bellow.
9     
10     [  860.827243] BUG: scheduling while atomic: hostapd/3397/0x00000002
11     <snip>
12     [  860.827280] Call Trace:
13     [  860.827282]  [<ffffffff81682ea6>] dump_stack+0x4d/0x66
14     [  860.827284]  [<ffffffff8167eb9b>] __schedule_bug+0x47/0x55
15     [  860.827285]  [<ffffffff81685bb3>] __schedule+0x733/0x7b0
16     [  860.827287]  [<ffffffff81685c59>] schedule+0x29/0x70
17     [  860.827289]  [<ffffffff81684f8a>] schedule_timeout+0x15a/0x2b0
18     [  860.827291]  [<ffffffff8105ac50>] ? ftrace_raw_event_tick_stop+0xc0/0xc0
19     [  860.827294]  [<ffffffff810c13c2>] ? __module_text_address+0x12/0x70
20     [  860.827296]  [<ffffffff81686823>] wait_for_completion_timeout+0xb3/0x140
21     [  860.827298]  [<ffffffff81080fc0>] ? wake_up_state+0x20/0x20
22     [  860.827301]  [<ffffffff814d5b3d>] usb_start_wait_urb+0x7d/0x150
23     [  860.827303]  [<ffffffff814d5cd5>] usb_control_msg+0xc5/0x110
24     [  860.827305]  [<ffffffffa02fb0c6>] rt2x00usb_vendor_request+0xc6/0x160  [rt2x00usb]
25     [  860.827307]  [<ffffffffa02fb215>] rt2x00usb_vendor_req_buff_lock+0x75/0x150 [rt2x00usb]
26     [  860.827309]  [<ffffffffa02fb393>] rt2x00usb_vendor_request_buff+0xa3/0xe0 [rt2x00usb]
27     [  860.827311]  [<ffffffffa023d1a3>] rt2x00usb_register_multiread+0x33/0x40 [rt2800usb]
28     [  860.827314]  [<ffffffffa05805f9>] rt2800_get_tkip_seq+0x39/0x50  [rt2800lib]
29     [  860.827321]  [<ffffffffa0480f88>] ieee80211_get_key+0x218/0x2a0  [mac80211]
30     [  860.827322]  [<ffffffff815cc68c>] ? __nlmsg_put+0x6c/0x80
31     [  860.827329]  [<ffffffffa051b02e>] nl80211_get_key+0x22e/0x360 [cfg80211]
32     
33     Cc: stable@vger.kernel.org
34     Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
35     Reported-and-tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
36     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
37     Signed-off-by: John W. Linville <linville@tuxdriver.com>
38
39 commit 5f313a15da92dda80ac4c9a137bc42d7d0b49adf
40 Author: Rafał Miłecki <zajec5@gmail.com>
41 Date:   Thu Jun 12 09:28:38 2014 +0200
42
43     b43: fix frequency reported on G-PHY with /new/ firmware
44
45 commit d3a58df87a2e4c2301ac843604202d290a48440b
46 Author: Avraham Stern <avraham.stern@intel.com>
47 Date:   Thu May 22 12:17:47 2014 +0300
48
49     mac80211: set new interfaces as idle upon init
50     
51     Mark new interfaces as idle to allow operations that require that
52     interfaces are idle to take place. Interface types that are always
53     not idle (like AP interfaces) will be set as not idle when they are
54     assigned a channel context.
55     
56     Signed-off-by: Avraham Stern <avraham.stern@intel.com>
57     Signed-off-by: Emmanuel Grumbach<emmanuel.grumbach@intel.com>
58     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
59
60 commit 923eaf367206e01f22c97aee22300e332d071916
61 Author: Arik Nemtsov <arik@wizery.com>
62 Date:   Mon May 26 14:40:51 2014 +0300
63
64     mac80211: don't check netdev state for debugfs read/write
65     
66     Doing so will lead to an oops for a p2p-dev interface, since it has
67     no netdev.
68     
69     Cc: stable@vger.kernel.org
70     Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
71     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
72     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
73
74 commit a9fb54169b197f31aff24c8d6270dd1e56cde395
75 Author: chaitanya.mgit@gmail.com <chaitanya.mgit@gmail.com>
76 Date:   Mon May 26 18:01:44 2014 +0530
77
78     regdb: Generalize the mW to dBm power conversion
79     
80     Generalize the power conversion from mW to dBm
81     using log. This should fix the below compilation
82     error for country NO which adds a new power value
83     2000mW which is not handled earlier.
84     
85      CC [M]  net/wireless/wext-sme.o
86      CC [M]  net/wireless/regdb.o
87     net/wireless/regdb.c:1130:1: error: Unknown undeclared here (not in
88     a function)
89     net/wireless/regdb.c:1130:9: error: expected } before power
90     make[2]: *** [net/wireless/regdb.o] Error 1
91     make[1]: *** [net/wireless] Error 2
92     make: *** [net] Error 2
93     
94     Reported-By:  John Walker <john@x109.net>
95     Signed-off-by: Chaitanya T K <chaitanya.mgit@gmail.com>
96     Acked-by: John W. Linville <linville@tuxdriver.com>
97     [remove unneeded parentheses, fix rounding by using %.0f]
98     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
99
100 commit c7d37a66e345df2fdf1aa7b2c9a6d3d53846ca5b
101 Author: Krzysztof Hałasa <khalasa@piap.pl>
102 Date:   Mon May 26 14:14:46 2014 +0200
103
104     mac80211: fix IBSS join by initializing last_scan_completed
105     
106     Without this fix, freshly rebooted Linux creates a new IBSS
107     instead of joining an existing one. Only when jiffies counter
108     overflows after 5 minutes the IBSS can be successfully joined.
109     
110     Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
111     [edit commit message slightly]
112     Cc: stable@vger.kernel.org
113     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
114
115 commit 34171dc0d623be2c1032416bf7d3819f388ed70d
116 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
117 Date:   Sun May 25 15:35:41 2014 +0300
118
119     mac80211: fix virtual monitor interface addition
120     
121     Since the commit below, cfg80211_chandef_dfs_required()
122     will warn if it gets a an NL80211_IFTYPE_UNSPECIFIED iftype
123     as explicitely written in the commit log.
124     When an virtual monitor interface is added, its type is set
125     in ieee80211_sub_if_data.vif.type, but not in
126     ieee80211_sub_if_data.wdev.iftype which is passed to
127     cfg80211_chandef_dfs_required() hence resulting in the
128     following warning:
129     
130     WARNING: CPU: 1 PID: 21265 at net/wireless/chan.c:376 cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]()
131     Modules linked in: [...]
132     CPU: 1 PID: 21265 Comm: ifconfig Tainted: G        W  O 3.13.11+ #12
133     Hardware name: Dell Inc. Latitude E6410/0667CC, BIOS A01 03/05/2010
134      0000000000000009 ffff88008f5fdb08 ffffffff817d4219 ffff88008f5fdb50
135      ffff88008f5fdb40 ffffffff8106f57d 0000000000000000 0000000000000000
136      ffff880081062fb8 ffff8800810604e0 0000000000000001 ffff88008f5fdba0
137     Call Trace:
138      [<ffffffff817d4219>] dump_stack+0x4d/0x66
139      [<ffffffff8106f57d>] warn_slowpath_common+0x7d/0xa0
140      [<ffffffff8106f5ec>] warn_slowpath_fmt+0x4c/0x50
141      [<ffffffffa04ea4ec>] cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]
142      [<ffffffffa06b1024>] ieee80211_vif_use_channel+0x94/0x500 [mac80211]
143      [<ffffffffa0684e6b>] ieee80211_add_virtual_monitor+0x1ab/0x5c0 [mac80211]
144      [<ffffffffa0686ae5>] ieee80211_do_open+0xe75/0x1580 [mac80211]
145      [<ffffffffa0687259>] ieee80211_open+0x69/0x70 [mac80211]
146     [snip]
147     
148     Fixes: 00ec75fc5a64 ("cfg80211: pass the actual iftype when calling cfg80211_chandef_dfs_required()")
149     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
150     Acked-by: Luciano Coelho <luciano.coelho@intel.com>
151     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
152
153 commit d93cc72b37b4e2c314e1c499e80e8801907c2fea
154 Author: Michal Kazior <michal.kazior@tieto.com>
155 Date:   Thu Jun 5 14:21:37 2014 +0200
156
157     mac80211: use csa counter offsets instead of csa_active
158     
159     vif->csa_active is protected by mutexes only. This
160     means it is unreliable to depend on it on codeflow
161     in non-sleepable beacon and CSA code. There was no
162     guarantee to have vif->csa_active update be
163     visible before beacons are updated on SMP systems.
164     
165     Using csa counter offsets which are embedded in
166     beacon struct (and thus are protected with single
167     RCU assignment) is much safer.
168     
169     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
170     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
171
172 commit d2746694fcdef24e0a7a1947d8c70082cde81a26
173 Author: Michal Kazior <michal.kazior@tieto.com>
174 Date:   Thu Jun 5 14:21:36 2014 +0200
175
176     mac80211: move csa counters from sdata to beacon/presp
177     
178     Having csa counters part of beacon and probe_resp
179     structures makes it easier to get rid of possible
180     races between setting a beacon and updating
181     counters on SMP systems by guaranteeing counters
182     are always consistent against given beacon struct.
183     
184     While at it relax WARN_ON into WARN_ON_ONCE to
185     prevent spamming logs and racing.
186     
187     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
188     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
189
190 commit 5dcb54f3a1a8cd7e0331e773487574f9743615db
191 Author: Janusz Dziedzic <janusz.dziedzic@tieto.com>
192 Date:   Thu Jun 5 08:12:57 2014 +0200
193
194     mac80211: allow tx via monitor iface when DFS
195     
196     Allow send frames using monitor interface
197     when DFS chandef and we pass CAC (beaconing
198     allowed).
199     
200     This fix problem when old kernel and new backports used,
201     in such case hostapd create/use also monitor interface.
202     Before this patch all frames hostapd send using monitor
203     iface were dropped when AP was configured on DFS channel.
204     
205     Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
206     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
207
208 commit 6f09a1beb0d2007572248c986780562219bd206f
209 Author: Johannes Berg <johannes.berg@intel.com>
210 Date:   Wed Jun 4 17:31:56 2014 +0200
211
212     cfg80211: make ethtool the driver's responsibility
213     
214     Currently, cfg80211 tries to implement ethtool, but that doesn't
215     really scale well, with all the different operations. Make the
216     lower-level driver responsible for it, which currently only has
217     an effect on mac80211. It will similarly not scale well at that
218     level though, since mac80211 also has many drivers.
219     
220     To cleanly implement this in mac80211, introduce a new file and
221     move some code to appropriate places.
222     
223     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
224
225 commit 6b0c6f133de8f90caeb1c4a902e6140567c5bf96
226 Author: Johannes Berg <johannes.berg@intel.com>
227 Date:   Wed Jun 4 17:06:23 2014 +0200
228
229     mac80211: remove weak WEP IV accounting
230     
231     Since WEP is practically dead, there seems very little
232     point in keeping WEP weak IV accounting.
233     
234     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
235
236 commit aecdc89fb4664c76baa4bbd46008f220532309ff
237 Author: Luciano Coelho <luciano.coelho@intel.com>
238 Date:   Fri May 23 11:04:50 2014 +0300
239
240     ath9k/ath10k: remove unnecessary channel_switch_beacon callbacks
241     
242     The channel_switch_beacon callback is optional, so it doesn't have to
243     be defined if it's not going to do anything useful with it.  Both
244     ath9k and ath10k define the callback and just returns.  This commit
245     removes them.
246     
247     Cc: Michal Kazior <michal.kazior@tieto.com>
248     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
249     Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
250
251 commit 60ccc107c9b9fb732fdee1f76bb2dad44f0e1798
252 Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
253 Date:   Tue May 27 16:58:02 2014 +0530
254
255     ath9k: Fix deadlock while updating p2p beacon timer
256     
257     pm_lock is taken twice while syncing HW TSF of p2p vif.
258     Fix this by taking the lock at caller side.
259     
260     Cc: Felix Fietkau <nbd@openwrt.org>
261     Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
262     Signed-off-by: John W. Linville <linville@tuxdriver.com>
263
264 commit f3831a4e3903dbc1a57d5df56deb6a143fd001bc
265 Author: Stanislaw Gruszka <sgruszka@redhat.com>
266 Date:   Thu Jun 5 13:52:27 2014 +0200
267
268     rt2x00: do not initialize BCN_OFFSET registers
269     
270     We setup BCN_OFFSET{0,1} registers dynamically, don't have to
271     initialize them.
272     
273     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
274
275 commit e5c58ca7a48d4c82f282749a978052c47fd95998
276 Author: Stanislaw Gruszka <sgruszka@redhat.com>
277 Date:   Thu Jun 5 13:52:26 2014 +0200
278
279     rt2x00: change order when stop beaconing
280     
281     When no beaconing is needed, first stop beacon queue (disable beaconing
282     globally) to avoid possible sending of not prepared beacon on short
283     period after clearing beacon and before stop of BCN queue.
284     
285     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
286
287 commit 382c1b9e03f52d0cd741ef1d942cad0f649f0744
288 Author: Stanislaw Gruszka <sgruszka@redhat.com>
289 Date:   Thu Jun 5 13:52:25 2014 +0200
290
291     rt2x00: change default MAC_BSSID_DW1_BSS_BCN_NUM
292     
293     We setup MAC_BSSID_DW1_BSS_BCN_NUM dynamically when numbers of active
294     beacons increase. Change default to 0 to tell hardware that we want to
295     send only one beacon as default.
296     
297     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
298
299 commit 3b400571dd033e46fa7e76c5bb92a3ce8198afa9
300 Author: Stanislaw Gruszka <sgruszka@redhat.com>
301 Date:   Thu Jun 5 13:52:24 2014 +0200
302
303     rt2x00: change beaconing setup on RT2800
304     
305     As reported by Matthias, on 5572 chip, even if we clear up TXWI
306     of corresponding beacon, hardware still try to send it or do other
307     action that increase power consumption peak up to 1A.
308     
309     To avoid the issue, setup beaconing dynamically by configuring offsets
310     of currently active beacons and MAC_BSSID_DW1_BSS_BCN_NUM variable,
311     which limit number of beacons that hardware will try to send.
312     
313     Reported-by: Matthias Fend <Matthias.Fend@wolfvision.net>
314     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
315
316 commit 916e591b2cc41f7e572992175ca56d866d7bc958
317 Author: Stanislaw Gruszka <sgruszka@redhat.com>
318 Date:   Thu Jun 5 13:52:23 2014 +0200
319
320     rt2x00: change beaconing locking
321     
322     This patch is needed for further changes to keep global variables
323     consistent when changing beaconing on diffrent vif's.
324     
325     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
326
327 commit 930b0dffd1731f3f418f9132faea720a23b7af61
328 Author: Johannes Berg <johannes.berg@intel.com>
329 Date:   Tue Jun 3 11:18:47 2014 +0200
330
331     mac80211: fix station/driver powersave race
332     
333     It is currently possible to have a race due to the station PS
334     unblock work like this:
335      * station goes to sleep with frames buffered in the driver
336      * driver blocks wakeup
337      * station wakes up again
338      * driver flushes/returns frames, and unblocks, which schedules
339        the unblock work
340      * unblock work starts to run, and checks that the station is
341        awake (i.e. that the WLAN_STA_PS_STA flag isn't set)
342      * we process a received frame with PM=1, setting the flag again
343      * ieee80211_sta_ps_deliver_wakeup() runs, delivering all frames
344        to the driver, and then clearing the WLAN_STA_PS_DRIVER and
345        WLAN_STA_PS_STA flags
346     
347     In this scenario, mac80211 will think that the station is awake,
348     while it really is asleep, and any TX'ed frames should be filtered
349     by the device (it will know that the station is sleeping) but then
350     passed to mac80211 again, which will not buffer it either as it
351     thinks the station is awake, and eventually the packets will be
352     dropped.
353     
354     Fix this by moving the clearing of the flags to exactly where we
355     learn about the situation. This creates a problem of reordering,
356     so introduce another flag indicating that delivery is being done,
357     this new flag also queues frames and is cleared only while the
358     spinlock is held (which the queuing code also holds) so that any
359     concurrent delivery/TX is handled correctly.
360     
361     Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
362     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
363
364 commit 6df35206bc6c1c6aad1d8077df5786b4a7f77873
365 Author: Felix Fietkau <nbd@openwrt.org>
366 Date:   Fri May 23 19:58:14 2014 +0200
367
368     mac80211: reduce packet loss notifications under load
369     
370     During strong signal fluctuations under high throughput, few consecutive
371     failed A-MPDU transmissions can easily trigger packet loss notification,
372     and thus (in AP mode) client disconnection.
373     
374     Reduce the number of false positives by checking the A-MPDU status flag
375     and treating a failed A-MPDU as a single packet.
376     
377     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
378
379 commit 7b7843a36fbcc568834404c7430ff895d8502131
380 Author: Felix Fietkau <nbd@openwrt.org>
381 Date:   Fri May 23 19:26:32 2014 +0200
382
383     mac80211: fix a memory leak on sta rate selection table
384     
385     Cc: stable@vger.kernel.org
386     Reported-by: Christophe Prévotaux <cprevotaux@nltinc.com>
387     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
388
389 commit 96892d6aa0a153423070addf3070bc79578b3897
390 Author: Felix Fietkau <nbd@openwrt.org>
391 Date:   Mon May 19 21:20:49 2014 +0200
392
393     ath9k: avoid passing buffers to the hardware during flush
394     
395     The commit "ath9k: fix possible hang on flush" changed the receive code
396     to always link rx descriptors of processed frames, even when flushing.
397     In some cases, this leads to flushed rx buffers being passed to the
398     hardware while rx is already stopped.
399     
400     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
401
402 --- a/drivers/net/wireless/ath/ath9k/recv.c
403 +++ b/drivers/net/wireless/ath/ath9k/recv.c
404 @@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_slee
405   * buffer (or rx fifo). This can incorrectly acknowledge packets
406   * to a sender if last desc is self-linked.
407   */
408 -static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
409 +static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf,
410 +                           bool flush)
411  {
412         struct ath_hw *ah = sc->sc_ah;
413         struct ath_common *common = ath9k_hw_common(ah);
414 @@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_s
415                              common->rx_bufsize,
416                              0);
417  
418 -       if (sc->rx.rxlink == NULL)
419 -               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
420 -       else
421 +       if (sc->rx.rxlink)
422                 *sc->rx.rxlink = bf->bf_daddr;
423 +       else if (!flush)
424 +               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
425  
426         sc->rx.rxlink = &ds->ds_link;
427  }
428  
429 -static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
430 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf,
431 +                             bool flush)
432  {
433         if (sc->rx.buf_hold)
434 -               ath_rx_buf_link(sc, sc->rx.buf_hold);
435 +               ath_rx_buf_link(sc, sc->rx.buf_hold, flush);
436  
437         sc->rx.buf_hold = bf;
438  }
439 @@ -442,7 +444,7 @@ int ath_startrecv(struct ath_softc *sc)
440         sc->rx.buf_hold = NULL;
441         sc->rx.rxlink = NULL;
442         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
443 -               ath_rx_buf_link(sc, bf);
444 +               ath_rx_buf_link(sc, bf, false);
445         }
446  
447         /* We could have deleted elements so the list may be empty now */
448 @@ -1118,12 +1120,12 @@ requeue_drop_frag:
449  requeue:
450                 list_add_tail(&bf->list, &sc->rx.rxbuf);
451  
452 -               if (edma) {
453 -                       ath_rx_edma_buf_link(sc, qtype);
454 -               } else {
455 -                       ath_rx_buf_relink(sc, bf);
456 +               if (!edma) {
457 +                       ath_rx_buf_relink(sc, bf, flush);
458                         if (!flush)
459                                 ath9k_hw_rxena(ah);
460 +               } else if (!flush) {
461 +                       ath_rx_edma_buf_link(sc, qtype);
462                 }
463  
464                 if (!budget--)
465 --- a/net/mac80211/sta_info.c
466 +++ b/net/mac80211/sta_info.c
467 @@ -100,7 +100,8 @@ static void __cleanup_single_sta(struct 
468         struct ps_data *ps;
469  
470         if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
471 -           test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
472 +           test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
473 +           test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
474                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
475                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
476                         ps = &sdata->bss->ps;
477 @@ -111,6 +112,7 @@ static void __cleanup_single_sta(struct 
478  
479                 clear_sta_flag(sta, WLAN_STA_PS_STA);
480                 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
481 +               clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
482  
483                 atomic_dec(&ps->num_sta_ps);
484                 sta_info_recalc_tim(sta);
485 @@ -125,7 +127,7 @@ static void __cleanup_single_sta(struct 
486         if (ieee80211_vif_is_mesh(&sdata->vif))
487                 mesh_sta_cleanup(sta);
488  
489 -       cancel_work_sync(&sta->drv_unblock_wk);
490 +       cancel_work_sync(&sta->drv_deliver_wk);
491  
492         /*
493          * Destroy aggregation state here. It would be nice to wait for the
494 @@ -227,6 +229,7 @@ struct sta_info *sta_info_get_by_idx(str
495   */
496  void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
497  {
498 +       struct ieee80211_sta_rates *rates;
499         int i;
500  
501         if (sta->rate_ctrl)
502 @@ -238,6 +241,10 @@ void sta_info_free(struct ieee80211_loca
503                 kfree(sta->tx_lat);
504         }
505  
506 +       rates = rcu_dereference_protected(sta->sta.rates, true);
507 +       if (rates)
508 +               kfree(rates);
509 +
510         sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
511  
512         kfree(sta);
513 @@ -252,33 +259,23 @@ static void sta_info_hash_add(struct iee
514         rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
515  }
516  
517 -static void sta_unblock(struct work_struct *wk)
518 +static void sta_deliver_ps_frames(struct work_struct *wk)
519  {
520         struct sta_info *sta;
521  
522 -       sta = container_of(wk, struct sta_info, drv_unblock_wk);
523 +       sta = container_of(wk, struct sta_info, drv_deliver_wk);
524  
525         if (sta->dead)
526                 return;
527  
528 -       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
529 -               local_bh_disable();
530 +       local_bh_disable();
531 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA))
532                 ieee80211_sta_ps_deliver_wakeup(sta);
533 -               local_bh_enable();
534 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
535 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
536 -
537 -               local_bh_disable();
538 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
539                 ieee80211_sta_ps_deliver_poll_response(sta);
540 -               local_bh_enable();
541 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD)) {
542 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
543 -
544 -               local_bh_disable();
545 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
546                 ieee80211_sta_ps_deliver_uapsd(sta);
547 -               local_bh_enable();
548 -       } else
549 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
550 +       local_bh_enable();
551  }
552  
553  static int sta_prepare_rate_control(struct ieee80211_local *local,
554 @@ -340,7 +337,7 @@ struct sta_info *sta_info_alloc(struct i
555  
556         spin_lock_init(&sta->lock);
557         spin_lock_init(&sta->ps_lock);
558 -       INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
559 +       INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
560         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
561         mutex_init(&sta->ampdu_mlme.mtx);
562  #ifdef CPTCFG_MAC80211_MESH
563 @@ -1140,8 +1137,15 @@ void ieee80211_sta_ps_deliver_wakeup(str
564         }
565  
566         ieee80211_add_pending_skbs(local, &pending);
567 -       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
568 -       clear_sta_flag(sta, WLAN_STA_PS_STA);
569 +
570 +       /* now we're no longer in the deliver code */
571 +       clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
572 +
573 +       /* The station might have polled and then woken up before we responded,
574 +        * so clear these flags now to avoid them sticking around.
575 +        */
576 +       clear_sta_flag(sta, WLAN_STA_PSPOLL);
577 +       clear_sta_flag(sta, WLAN_STA_UAPSD);
578         spin_unlock(&sta->ps_lock);
579  
580         atomic_dec(&ps->num_sta_ps);
581 @@ -1542,10 +1546,26 @@ void ieee80211_sta_block_awake(struct ie
582  
583         trace_api_sta_block_awake(sta->local, pubsta, block);
584  
585 -       if (block)
586 +       if (block) {
587                 set_sta_flag(sta, WLAN_STA_PS_DRIVER);
588 -       else if (test_sta_flag(sta, WLAN_STA_PS_DRIVER))
589 -               ieee80211_queue_work(hw, &sta->drv_unblock_wk);
590 +               return;
591 +       }
592 +
593 +       if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
594 +               return;
595 +
596 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
597 +               set_sta_flag(sta, WLAN_STA_PS_DELIVER);
598 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
599 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
600 +       } else if (test_sta_flag(sta, WLAN_STA_PSPOLL) ||
601 +                  test_sta_flag(sta, WLAN_STA_UAPSD)) {
602 +               /* must be asleep in this case */
603 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
604 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
605 +       } else {
606 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
607 +       }
608  }
609  EXPORT_SYMBOL(ieee80211_sta_block_awake);
610  
611 @@ -1703,3 +1723,137 @@ u8 sta_info_tx_streams(struct sta_info *
612         return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
613                         >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
614  }
615 +
616 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
617 +{
618 +       struct ieee80211_sub_if_data *sdata = sta->sdata;
619 +       struct ieee80211_local *local = sdata->local;
620 +       struct rate_control_ref *ref = local->rate_ctrl;
621 +       struct timespec uptime;
622 +       u64 packets = 0;
623 +       u32 thr = 0;
624 +       int i, ac;
625 +
626 +       sinfo->generation = sdata->local->sta_generation;
627 +
628 +       sinfo->filled = STATION_INFO_INACTIVE_TIME |
629 +                       STATION_INFO_RX_BYTES64 |
630 +                       STATION_INFO_TX_BYTES64 |
631 +                       STATION_INFO_RX_PACKETS |
632 +                       STATION_INFO_TX_PACKETS |
633 +                       STATION_INFO_TX_RETRIES |
634 +                       STATION_INFO_TX_FAILED |
635 +                       STATION_INFO_TX_BITRATE |
636 +                       STATION_INFO_RX_BITRATE |
637 +                       STATION_INFO_RX_DROP_MISC |
638 +                       STATION_INFO_BSS_PARAM |
639 +                       STATION_INFO_CONNECTED_TIME |
640 +                       STATION_INFO_STA_FLAGS |
641 +                       STATION_INFO_BEACON_LOSS_COUNT;
642 +
643 +       do_posix_clock_monotonic_gettime(&uptime);
644 +       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
645 +
646 +       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
647 +       sinfo->tx_bytes = 0;
648 +       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
649 +               sinfo->tx_bytes += sta->tx_bytes[ac];
650 +               packets += sta->tx_packets[ac];
651 +       }
652 +       sinfo->tx_packets = packets;
653 +       sinfo->rx_bytes = sta->rx_bytes;
654 +       sinfo->rx_packets = sta->rx_packets;
655 +       sinfo->tx_retries = sta->tx_retry_count;
656 +       sinfo->tx_failed = sta->tx_retry_failed;
657 +       sinfo->rx_dropped_misc = sta->rx_dropped;
658 +       sinfo->beacon_loss_count = sta->beacon_loss_count;
659 +
660 +       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
661 +           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
662 +               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
663 +               if (!local->ops->get_rssi ||
664 +                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
665 +                       sinfo->signal = (s8)sta->last_signal;
666 +               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
667 +       }
668 +       if (sta->chains) {
669 +               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
670 +                                STATION_INFO_CHAIN_SIGNAL_AVG;
671 +
672 +               sinfo->chains = sta->chains;
673 +               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
674 +                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
675 +                       sinfo->chain_signal_avg[i] =
676 +                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
677 +               }
678 +       }
679 +
680 +       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
681 +       sta_set_rate_info_rx(sta, &sinfo->rxrate);
682 +
683 +       if (ieee80211_vif_is_mesh(&sdata->vif)) {
684 +#ifdef CPTCFG_MAC80211_MESH
685 +               sinfo->filled |= STATION_INFO_LLID |
686 +                                STATION_INFO_PLID |
687 +                                STATION_INFO_PLINK_STATE |
688 +                                STATION_INFO_LOCAL_PM |
689 +                                STATION_INFO_PEER_PM |
690 +                                STATION_INFO_NONPEER_PM;
691 +
692 +               sinfo->llid = sta->llid;
693 +               sinfo->plid = sta->plid;
694 +               sinfo->plink_state = sta->plink_state;
695 +               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
696 +                       sinfo->filled |= STATION_INFO_T_OFFSET;
697 +                       sinfo->t_offset = sta->t_offset;
698 +               }
699 +               sinfo->local_pm = sta->local_pm;
700 +               sinfo->peer_pm = sta->peer_pm;
701 +               sinfo->nonpeer_pm = sta->nonpeer_pm;
702 +#endif
703 +       }
704 +
705 +       sinfo->bss_param.flags = 0;
706 +       if (sdata->vif.bss_conf.use_cts_prot)
707 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
708 +       if (sdata->vif.bss_conf.use_short_preamble)
709 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
710 +       if (sdata->vif.bss_conf.use_short_slot)
711 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
712 +       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
713 +       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
714 +
715 +       sinfo->sta_flags.set = 0;
716 +       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
717 +                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
718 +                               BIT(NL80211_STA_FLAG_WME) |
719 +                               BIT(NL80211_STA_FLAG_MFP) |
720 +                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
721 +                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
722 +                               BIT(NL80211_STA_FLAG_TDLS_PEER);
723 +       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
724 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
725 +       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
726 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
727 +       if (test_sta_flag(sta, WLAN_STA_WME))
728 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
729 +       if (test_sta_flag(sta, WLAN_STA_MFP))
730 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
731 +       if (test_sta_flag(sta, WLAN_STA_AUTH))
732 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
733 +       if (test_sta_flag(sta, WLAN_STA_ASSOC))
734 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
735 +       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
736 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
737 +
738 +       /* check if the driver has a SW RC implementation */
739 +       if (ref && ref->ops->get_expected_throughput)
740 +               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
741 +       else
742 +               thr = drv_get_expected_throughput(local, &sta->sta);
743 +
744 +       if (thr != 0) {
745 +               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
746 +               sinfo->expected_throughput = thr;
747 +       }
748 +}
749 --- a/net/mac80211/status.c
750 +++ b/net/mac80211/status.c
751 @@ -541,6 +541,23 @@ static void ieee80211_tx_latency_end_msr
752   */
753  #define STA_LOST_PKT_THRESHOLD 50
754  
755 +static void ieee80211_lost_packet(struct sta_info *sta, struct sk_buff *skb)
756 +{
757 +       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
758 +
759 +       /* This packet was aggregated but doesn't carry status info */
760 +       if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
761 +           !(info->flags & IEEE80211_TX_STAT_AMPDU))
762 +               return;
763 +
764 +       if (++sta->lost_packets < STA_LOST_PKT_THRESHOLD)
765 +               return;
766 +
767 +       cfg80211_cqm_pktloss_notify(sta->sdata->dev, sta->sta.addr,
768 +                                   sta->lost_packets, GFP_ATOMIC);
769 +       sta->lost_packets = 0;
770 +}
771 +
772  void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
773  {
774         struct sk_buff *skb2;
775 @@ -680,12 +697,8 @@ void ieee80211_tx_status(struct ieee8021
776                         if (info->flags & IEEE80211_TX_STAT_ACK) {
777                                 if (sta->lost_packets)
778                                         sta->lost_packets = 0;
779 -                       } else if (++sta->lost_packets >= STA_LOST_PKT_THRESHOLD) {
780 -                               cfg80211_cqm_pktloss_notify(sta->sdata->dev,
781 -                                                           sta->sta.addr,
782 -                                                           sta->lost_packets,
783 -                                                           GFP_ATOMIC);
784 -                               sta->lost_packets = 0;
785 +                       } else {
786 +                               ieee80211_lost_packet(sta, skb);
787                         }
788                 }
789  
790 --- a/net/mac80211/rx.c
791 +++ b/net/mac80211/rx.c
792 @@ -1107,6 +1107,8 @@ static void sta_ps_end(struct sta_info *
793                 return;
794         }
795  
796 +       set_sta_flag(sta, WLAN_STA_PS_DELIVER);
797 +       clear_sta_flag(sta, WLAN_STA_PS_STA);
798         ieee80211_sta_ps_deliver_wakeup(sta);
799  }
800  
801 --- a/net/mac80211/sta_info.h
802 +++ b/net/mac80211/sta_info.h
803 @@ -82,6 +82,7 @@ enum ieee80211_sta_info_flags {
804         WLAN_STA_TOFFSET_KNOWN,
805         WLAN_STA_MPSP_OWNER,
806         WLAN_STA_MPSP_RECIPIENT,
807 +       WLAN_STA_PS_DELIVER,
808  };
809  
810  #define ADDBA_RESP_INTERVAL HZ
811 @@ -265,7 +266,7 @@ struct ieee80211_tx_latency_stat {
812   * @last_rx_rate_vht_nss: rx status nss of last data packet
813   * @lock: used for locking all fields that require locking, see comments
814   *     in the header file.
815 - * @drv_unblock_wk: used for driver PS unblocking
816 + * @drv_deliver_wk: used for delivering frames after driver PS unblocking
817   * @listen_interval: listen interval of this station, when we're acting as AP
818   * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
819   * @ps_lock: used for powersave (when mac80211 is the AP) related locking
820 @@ -278,7 +279,6 @@ struct ieee80211_tx_latency_stat {
821   * @driver_buffered_tids: bitmap of TIDs the driver has data buffered on
822   * @rx_packets: Number of MSDUs received from this STA
823   * @rx_bytes: Number of bytes received from this STA
824 - * @wep_weak_iv_count: number of weak WEP IVs received from this station
825   * @last_rx: time (in jiffies) when last frame was received from this STA
826   * @last_connected: time (in seconds) when a station got connected
827   * @num_duplicates: number of duplicate frames received from this STA
828 @@ -345,7 +345,7 @@ struct sta_info {
829         void *rate_ctrl_priv;
830         spinlock_t lock;
831  
832 -       struct work_struct drv_unblock_wk;
833 +       struct work_struct drv_deliver_wk;
834  
835         u16 listen_interval;
836  
837 @@ -367,7 +367,6 @@ struct sta_info {
838         /* Updated from RX path only, no locking requirements */
839         unsigned long rx_packets;
840         u64 rx_bytes;
841 -       unsigned long wep_weak_iv_count;
842         unsigned long last_rx;
843         long last_connected;
844         unsigned long num_duplicates;
845 @@ -628,6 +627,8 @@ void sta_set_rate_info_tx(struct sta_inf
846                           struct rate_info *rinfo);
847  void sta_set_rate_info_rx(struct sta_info *sta,
848                           struct rate_info *rinfo);
849 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo);
850 +
851  void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
852                           unsigned long exp_time);
853  u8 sta_info_tx_streams(struct sta_info *sta);
854 --- a/net/mac80211/tx.c
855 +++ b/net/mac80211/tx.c
856 @@ -469,7 +469,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
857                 return TX_CONTINUE;
858  
859         if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
860 -                     test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
861 +                     test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
862 +                     test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
863                      !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
864                 int ac = skb_get_queue_mapping(tx->skb);
865  
866 @@ -486,7 +487,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
867                  * ahead and Tx the packet.
868                  */
869                 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
870 -                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
871 +                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
872 +                   !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
873                         spin_unlock(&sta->ps_lock);
874                         return TX_CONTINUE;
875                 }
876 @@ -1618,12 +1620,12 @@ netdev_tx_t ieee80211_monitor_start_xmit
877  {
878         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
879         struct ieee80211_chanctx_conf *chanctx_conf;
880 -       struct ieee80211_channel *chan;
881         struct ieee80211_radiotap_header *prthdr =
882                 (struct ieee80211_radiotap_header *)skb->data;
883         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
884         struct ieee80211_hdr *hdr;
885         struct ieee80211_sub_if_data *tmp_sdata, *sdata;
886 +       struct cfg80211_chan_def *chandef;
887         u16 len_rthdr;
888         int hdrlen;
889  
890 @@ -1721,9 +1723,9 @@ netdev_tx_t ieee80211_monitor_start_xmit
891         }
892  
893         if (chanctx_conf)
894 -               chan = chanctx_conf->def.chan;
895 +               chandef = &chanctx_conf->def;
896         else if (!local->use_chanctx)
897 -               chan = local->_oper_chandef.chan;
898 +               chandef = &local->_oper_chandef;
899         else
900                 goto fail_rcu;
901  
902 @@ -1743,10 +1745,11 @@ netdev_tx_t ieee80211_monitor_start_xmit
903          * radar detection by itself. We can do that later by adding a
904          * monitor flag interfaces used for AP support.
905          */
906 -       if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)))
907 +       if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
908 +                                    sdata->vif.type))
909                 goto fail_rcu;
910  
911 -       ieee80211_xmit(sdata, skb, chan->band);
912 +       ieee80211_xmit(sdata, skb, chandef->chan->band);
913         rcu_read_unlock();
914  
915         return NETDEV_TX_OK;
916 @@ -2425,7 +2428,7 @@ static void ieee80211_set_csa(struct iee
917         u8 *beacon_data;
918         size_t beacon_data_len;
919         int i;
920 -       u8 count = sdata->csa_current_counter;
921 +       u8 count = beacon->csa_current_counter;
922  
923         switch (sdata->vif.type) {
924         case NL80211_IFTYPE_AP:
925 @@ -2444,46 +2447,54 @@ static void ieee80211_set_csa(struct iee
926                 return;
927         }
928  
929 +       rcu_read_lock();
930         for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
931 -               u16 counter_offset_beacon =
932 -                       sdata->csa_counter_offset_beacon[i];
933 -               u16 counter_offset_presp = sdata->csa_counter_offset_presp[i];
934 -
935 -               if (counter_offset_beacon) {
936 -                       if (WARN_ON(counter_offset_beacon >= beacon_data_len))
937 -                               return;
938 -
939 -                       beacon_data[counter_offset_beacon] = count;
940 -               }
941 -
942 -               if (sdata->vif.type == NL80211_IFTYPE_AP &&
943 -                   counter_offset_presp) {
944 -                       rcu_read_lock();
945 -                       resp = rcu_dereference(sdata->u.ap.probe_resp);
946 +               resp = rcu_dereference(sdata->u.ap.probe_resp);
947  
948 -                       /* If nl80211 accepted the offset, this should
949 -                        * not happen.
950 -                        */
951 -                       if (WARN_ON(!resp)) {
952 +               if (beacon->csa_counter_offsets[i]) {
953 +                       if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
954 +                                        beacon_data_len)) {
955                                 rcu_read_unlock();
956                                 return;
957                         }
958 -                       resp->data[counter_offset_presp] = count;
959 -                       rcu_read_unlock();
960 +
961 +                       beacon_data[beacon->csa_counter_offsets[i]] = count;
962                 }
963 +
964 +               if (sdata->vif.type == NL80211_IFTYPE_AP && resp &&
965 +                   resp->csa_counter_offsets)
966 +                       resp->data[resp->csa_counter_offsets[i]] = count;
967         }
968 +       rcu_read_unlock();
969  }
970  
971  u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
972  {
973         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
974 +       struct beacon_data *beacon = NULL;
975 +       u8 count = 0;
976 +
977 +       rcu_read_lock();
978 +
979 +       if (sdata->vif.type == NL80211_IFTYPE_AP)
980 +               beacon = rcu_dereference(sdata->u.ap.beacon);
981 +       else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
982 +               beacon = rcu_dereference(sdata->u.ibss.presp);
983 +       else if (ieee80211_vif_is_mesh(&sdata->vif))
984 +               beacon = rcu_dereference(sdata->u.mesh.beacon);
985 +
986 +       if (!beacon)
987 +               goto unlock;
988  
989 -       sdata->csa_current_counter--;
990 +       beacon->csa_current_counter--;
991  
992         /* the counter should never reach 0 */
993 -       WARN_ON(!sdata->csa_current_counter);
994 +       WARN_ON_ONCE(!beacon->csa_current_counter);
995 +       count = beacon->csa_current_counter;
996  
997 -       return sdata->csa_current_counter;
998 +unlock:
999 +       rcu_read_unlock();
1000 +       return count;
1001  }
1002  EXPORT_SYMBOL(ieee80211_csa_update_counter);
1003  
1004 @@ -2493,7 +2504,6 @@ bool ieee80211_csa_is_complete(struct ie
1005         struct beacon_data *beacon = NULL;
1006         u8 *beacon_data;
1007         size_t beacon_data_len;
1008 -       int counter_beacon = sdata->csa_counter_offset_beacon[0];
1009         int ret = false;
1010  
1011         if (!ieee80211_sdata_running(sdata))
1012 @@ -2531,10 +2541,13 @@ bool ieee80211_csa_is_complete(struct ie
1013                 goto out;
1014         }
1015  
1016 -       if (WARN_ON(counter_beacon > beacon_data_len))
1017 +       if (!beacon->csa_counter_offsets[0])
1018 +               goto out;
1019 +
1020 +       if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
1021                 goto out;
1022  
1023 -       if (beacon_data[counter_beacon] == 1)
1024 +       if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
1025                 ret = true;
1026   out:
1027         rcu_read_unlock();
1028 @@ -2550,6 +2563,7 @@ __ieee80211_beacon_get(struct ieee80211_
1029                        bool is_template)
1030  {
1031         struct ieee80211_local *local = hw_to_local(hw);
1032 +       struct beacon_data *beacon = NULL;
1033         struct sk_buff *skb = NULL;
1034         struct ieee80211_tx_info *info;
1035         struct ieee80211_sub_if_data *sdata = NULL;
1036 @@ -2571,10 +2585,10 @@ __ieee80211_beacon_get(struct ieee80211_
1037  
1038         if (sdata->vif.type == NL80211_IFTYPE_AP) {
1039                 struct ieee80211_if_ap *ap = &sdata->u.ap;
1040 -               struct beacon_data *beacon = rcu_dereference(ap->beacon);
1041  
1042 +               beacon = rcu_dereference(ap->beacon);
1043                 if (beacon) {
1044 -                       if (sdata->vif.csa_active) {
1045 +                       if (beacon->csa_counter_offsets[0]) {
1046                                 if (!is_template)
1047                                         ieee80211_csa_update_counter(vif);
1048  
1049 @@ -2615,37 +2629,37 @@ __ieee80211_beacon_get(struct ieee80211_
1050         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1051                 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1052                 struct ieee80211_hdr *hdr;
1053 -               struct beacon_data *presp = rcu_dereference(ifibss->presp);
1054  
1055 -               if (!presp)
1056 +               beacon = rcu_dereference(ifibss->presp);
1057 +               if (!beacon)
1058                         goto out;
1059  
1060 -               if (sdata->vif.csa_active) {
1061 +               if (beacon->csa_counter_offsets[0]) {
1062                         if (!is_template)
1063                                 ieee80211_csa_update_counter(vif);
1064  
1065 -                       ieee80211_set_csa(sdata, presp);
1066 +                       ieee80211_set_csa(sdata, beacon);
1067                 }
1068  
1069 -               skb = dev_alloc_skb(local->tx_headroom + presp->head_len +
1070 +               skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
1071                                     local->hw.extra_beacon_tailroom);
1072                 if (!skb)
1073                         goto out;
1074                 skb_reserve(skb, local->tx_headroom);
1075 -               memcpy(skb_put(skb, presp->head_len), presp->head,
1076 -                      presp->head_len);
1077 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1078 +                      beacon->head_len);
1079  
1080                 hdr = (struct ieee80211_hdr *) skb->data;
1081                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1082                                                  IEEE80211_STYPE_BEACON);
1083         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
1084                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1085 -               struct beacon_data *bcn = rcu_dereference(ifmsh->beacon);
1086  
1087 -               if (!bcn)
1088 +               beacon = rcu_dereference(ifmsh->beacon);
1089 +               if (!beacon)
1090                         goto out;
1091  
1092 -               if (sdata->vif.csa_active) {
1093 +               if (beacon->csa_counter_offsets[0]) {
1094                         if (!is_template)
1095                                 /* TODO: For mesh csa_counter is in TU, so
1096                                  * decrementing it by one isn't correct, but
1097 @@ -2654,40 +2668,42 @@ __ieee80211_beacon_get(struct ieee80211_
1098                                  */
1099                                 ieee80211_csa_update_counter(vif);
1100  
1101 -                       ieee80211_set_csa(sdata, bcn);
1102 +                       ieee80211_set_csa(sdata, beacon);
1103                 }
1104  
1105                 if (ifmsh->sync_ops)
1106 -                       ifmsh->sync_ops->adjust_tbtt(sdata, bcn);
1107 +                       ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
1108  
1109                 skb = dev_alloc_skb(local->tx_headroom +
1110 -                                   bcn->head_len +
1111 +                                   beacon->head_len +
1112                                     256 + /* TIM IE */
1113 -                                   bcn->tail_len +
1114 +                                   beacon->tail_len +
1115                                     local->hw.extra_beacon_tailroom);
1116                 if (!skb)
1117                         goto out;
1118                 skb_reserve(skb, local->tx_headroom);
1119 -               memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
1120 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1121 +                      beacon->head_len);
1122                 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
1123  
1124                 if (offs) {
1125 -                       offs->tim_offset = bcn->head_len;
1126 -                       offs->tim_length = skb->len - bcn->head_len;
1127 +                       offs->tim_offset = beacon->head_len;
1128 +                       offs->tim_length = skb->len - beacon->head_len;
1129                 }
1130  
1131 -               memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
1132 +               memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
1133 +                      beacon->tail_len);
1134         } else {
1135                 WARN_ON(1);
1136                 goto out;
1137         }
1138  
1139         /* CSA offsets */
1140 -       if (offs) {
1141 +       if (offs && beacon) {
1142                 int i;
1143  
1144                 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
1145 -                       u16 csa_off = sdata->csa_counter_offset_beacon[i];
1146 +                       u16 csa_off = beacon->csa_counter_offsets[i];
1147  
1148                         if (!csa_off)
1149                                 continue;
1150 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
1151 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
1152 @@ -947,6 +947,40 @@ static inline u8 rt2800_get_beacon_offse
1153         return BEACON_BASE_TO_OFFSET(rt2800_hw_beacon_base(rt2x00dev, index));
1154  }
1155  
1156 +static void rt2800_update_beacons_setup(struct rt2x00_dev *rt2x00dev)
1157 +{
1158 +       struct data_queue *queue = rt2x00dev->bcn;
1159 +       struct queue_entry *entry;
1160 +       int i, bcn_num = 0;
1161 +       u64 off, reg = 0;
1162 +       u32 bssid_dw1;
1163 +
1164 +       /*
1165 +        * Setup offsets of all active beacons in BCN_OFFSET{0,1} registers.
1166 +        */
1167 +       for (i = 0; i < queue->limit; i++) {
1168 +               entry = &queue->entries[i];
1169 +               if (!test_bit(ENTRY_BCN_ENABLED, &entry->flags))
1170 +                       continue;
1171 +               off = rt2800_get_beacon_offset(rt2x00dev, entry->entry_idx);
1172 +               reg |= off << (8 * bcn_num);
1173 +               bcn_num++;
1174 +       }
1175 +
1176 +       WARN_ON_ONCE(bcn_num != rt2x00dev->intf_beaconing);
1177 +
1178 +       rt2800_register_write(rt2x00dev, BCN_OFFSET0, (u32) reg);
1179 +       rt2800_register_write(rt2x00dev, BCN_OFFSET1, (u32) (reg >> 32));
1180 +
1181 +       /*
1182 +        * H/W sends up to MAC_BSSID_DW1_BSS_BCN_NUM + 1 consecutive beacons.
1183 +        */
1184 +       rt2800_register_read(rt2x00dev, MAC_BSSID_DW1, &bssid_dw1);
1185 +       rt2x00_set_field32(&bssid_dw1, MAC_BSSID_DW1_BSS_BCN_NUM,
1186 +                          bcn_num > 0 ? bcn_num - 1 : 0);
1187 +       rt2800_register_write(rt2x00dev, MAC_BSSID_DW1, bssid_dw1);
1188 +}
1189 +
1190  void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
1191  {
1192         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
1193 @@ -1003,6 +1037,12 @@ void rt2800_write_beacon(struct queue_en
1194  
1195         rt2800_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
1196                                    entry->skb->len + padding_len);
1197 +       __set_bit(ENTRY_BCN_ENABLED, &entry->flags);
1198 +
1199 +       /*
1200 +        * Change global beacons settings.
1201 +        */
1202 +       rt2800_update_beacons_setup(rt2x00dev);
1203  
1204         /*
1205          * Restore beaconing state.
1206 @@ -1053,8 +1093,13 @@ void rt2800_clear_beacon(struct queue_en
1207          * Clear beacon.
1208          */
1209         rt2800_clear_beacon_register(rt2x00dev, entry->entry_idx);
1210 +       __clear_bit(ENTRY_BCN_ENABLED, &entry->flags);
1211  
1212         /*
1213 +        * Change global beacons settings.
1214 +        */
1215 +       rt2800_update_beacons_setup(rt2x00dev);
1216 +       /*
1217          * Restore beaconing state.
1218          */
1219         rt2800_register_write(rt2x00dev, BCN_TIME_CFG, orig_reg);
1220 @@ -1556,7 +1601,7 @@ void rt2800_config_intf(struct rt2x00_de
1221                 if (!is_zero_ether_addr((const u8 *)conf->bssid)) {
1222                         reg = le32_to_cpu(conf->bssid[1]);
1223                         rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 3);
1224 -                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 7);
1225 +                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
1226                         conf->bssid[1] = cpu_to_le32(reg);
1227                 }
1228  
1229 @@ -4517,28 +4562,6 @@ static int rt2800_init_registers(struct 
1230         if (ret)
1231                 return ret;
1232  
1233 -       rt2800_register_read(rt2x00dev, BCN_OFFSET0, &reg);
1234 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0,
1235 -                          rt2800_get_beacon_offset(rt2x00dev, 0));
1236 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1,
1237 -                          rt2800_get_beacon_offset(rt2x00dev, 1));
1238 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2,
1239 -                          rt2800_get_beacon_offset(rt2x00dev, 2));
1240 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3,
1241 -                          rt2800_get_beacon_offset(rt2x00dev, 3));
1242 -       rt2800_register_write(rt2x00dev, BCN_OFFSET0, reg);
1243 -
1244 -       rt2800_register_read(rt2x00dev, BCN_OFFSET1, &reg);
1245 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4,
1246 -                          rt2800_get_beacon_offset(rt2x00dev, 4));
1247 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5,
1248 -                          rt2800_get_beacon_offset(rt2x00dev, 5));
1249 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6,
1250 -                          rt2800_get_beacon_offset(rt2x00dev, 6));
1251 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7,
1252 -                          rt2800_get_beacon_offset(rt2x00dev, 7));
1253 -       rt2800_register_write(rt2x00dev, BCN_OFFSET1, reg);
1254 -
1255         rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
1256         rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
1257  
1258 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
1259 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
1260 @@ -141,8 +141,11 @@ static void rt2x00lib_intf_scheduled_ite
1261         if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
1262                 return;
1263  
1264 -       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags))
1265 +       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags)) {
1266 +               mutex_lock(&intf->beacon_skb_mutex);
1267                 rt2x00queue_update_beacon(rt2x00dev, vif);
1268 +               mutex_unlock(&intf->beacon_skb_mutex);
1269 +       }
1270  }
1271  
1272  static void rt2x00lib_intf_scheduled(struct work_struct *work)
1273 @@ -216,7 +219,7 @@ static void rt2x00lib_beaconupdate_iter(
1274          * never be called for USB devices.
1275          */
1276         WARN_ON(rt2x00_is_usb(rt2x00dev));
1277 -       rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1278 +       rt2x00queue_update_beacon(rt2x00dev, vif);
1279  }
1280  
1281  void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
1282 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
1283 +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
1284 @@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_h
1285         crypto.cipher = rt2x00crypto_key_to_cipher(key);
1286         if (crypto.cipher == CIPHER_NONE)
1287                 return -EOPNOTSUPP;
1288 +       if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
1289 +               return -EOPNOTSUPP;
1290  
1291         crypto.cmd = cmd;
1292  
1293 @@ -624,25 +626,24 @@ void rt2x00mac_bss_info_changed(struct i
1294          * Start/stop beaconing.
1295          */
1296         if (changes & BSS_CHANGED_BEACON_ENABLED) {
1297 +               mutex_lock(&intf->beacon_skb_mutex);
1298                 if (!bss_conf->enable_beacon && intf->enable_beacon) {
1299                         rt2x00dev->intf_beaconing--;
1300                         intf->enable_beacon = false;
1301 -                       /*
1302 -                        * Clear beacon in the H/W for this vif. This is needed
1303 -                        * to disable beaconing on this particular interface
1304 -                        * and keep it running on other interfaces.
1305 -                        */
1306 -                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1307  
1308                         if (rt2x00dev->intf_beaconing == 0) {
1309                                 /*
1310                                  * Last beaconing interface disabled
1311                                  * -> stop beacon queue.
1312                                  */
1313 -                               mutex_lock(&intf->beacon_skb_mutex);
1314                                 rt2x00queue_stop_queue(rt2x00dev->bcn);
1315 -                               mutex_unlock(&intf->beacon_skb_mutex);
1316                         }
1317 +                       /*
1318 +                        * Clear beacon in the H/W for this vif. This is needed
1319 +                        * to disable beaconing on this particular interface
1320 +                        * and keep it running on other interfaces.
1321 +                        */
1322 +                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1323                 } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
1324                         rt2x00dev->intf_beaconing++;
1325                         intf->enable_beacon = true;
1326 @@ -658,11 +659,10 @@ void rt2x00mac_bss_info_changed(struct i
1327                                  * First beaconing interface enabled
1328                                  * -> start beacon queue.
1329                                  */
1330 -                               mutex_lock(&intf->beacon_skb_mutex);
1331                                 rt2x00queue_start_queue(rt2x00dev->bcn);
1332 -                               mutex_unlock(&intf->beacon_skb_mutex);
1333                         }
1334                 }
1335 +               mutex_unlock(&intf->beacon_skb_mutex);
1336         }
1337  
1338         /*
1339 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
1340 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
1341 @@ -754,8 +754,6 @@ int rt2x00queue_clear_beacon(struct rt2x
1342         if (unlikely(!intf->beacon))
1343                 return -ENOBUFS;
1344  
1345 -       mutex_lock(&intf->beacon_skb_mutex);
1346 -
1347         /*
1348          * Clean up the beacon skb.
1349          */
1350 @@ -768,13 +766,11 @@ int rt2x00queue_clear_beacon(struct rt2x
1351         if (rt2x00dev->ops->lib->clear_beacon)
1352                 rt2x00dev->ops->lib->clear_beacon(intf->beacon);
1353  
1354 -       mutex_unlock(&intf->beacon_skb_mutex);
1355 -
1356         return 0;
1357  }
1358  
1359 -int rt2x00queue_update_beacon_locked(struct rt2x00_dev *rt2x00dev,
1360 -                                    struct ieee80211_vif *vif)
1361 +int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1362 +                             struct ieee80211_vif *vif)
1363  {
1364         struct rt2x00_intf *intf = vif_to_intf(vif);
1365         struct skb_frame_desc *skbdesc;
1366 @@ -815,19 +811,6 @@ int rt2x00queue_update_beacon_locked(str
1367  
1368  }
1369  
1370 -int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1371 -                             struct ieee80211_vif *vif)
1372 -{
1373 -       struct rt2x00_intf *intf = vif_to_intf(vif);
1374 -       int ret;
1375 -
1376 -       mutex_lock(&intf->beacon_skb_mutex);
1377 -       ret = rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1378 -       mutex_unlock(&intf->beacon_skb_mutex);
1379 -
1380 -       return ret;
1381 -}
1382 -
1383  bool rt2x00queue_for_each_entry(struct data_queue *queue,
1384                                 enum queue_index start,
1385                                 enum queue_index end,
1386 --- a/drivers/net/wireless/rt2x00/rt2x00queue.h
1387 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
1388 @@ -353,6 +353,7 @@ struct txentry_desc {
1389   */
1390  enum queue_entry_flags {
1391         ENTRY_BCN_ASSIGNED,
1392 +       ENTRY_BCN_ENABLED,
1393         ENTRY_OWNER_DEVICE_DATA,
1394         ENTRY_DATA_PENDING,
1395         ENTRY_DATA_IO_FAILED,
1396 --- a/drivers/net/wireless/ath/ath9k/main.c
1397 +++ b/drivers/net/wireless/ath/ath9k/main.c
1398 @@ -1757,7 +1757,6 @@ out:
1399  void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif)
1400  {
1401         struct ath_vif *avp = (void *)vif->drv_priv;
1402 -       unsigned long flags;
1403         u32 tsf;
1404  
1405         if (!sc->p2p_ps_timer)
1406 @@ -1767,14 +1766,9 @@ void ath9k_update_p2p_ps(struct ath_soft
1407                 return;
1408  
1409         sc->p2p_ps_vif = avp;
1410 -
1411 -       spin_lock_irqsave(&sc->sc_pm_lock, flags);
1412 -       if (!(sc->ps_flags & PS_BEACON_SYNC)) {
1413 -               tsf = ath9k_hw_gettsf32(sc->sc_ah);
1414 -               ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1415 -               ath9k_update_p2p_ps_timer(sc, avp);
1416 -       }
1417 -       spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1418 +       tsf = ath9k_hw_gettsf32(sc->sc_ah);
1419 +       ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1420 +       ath9k_update_p2p_ps_timer(sc, avp);
1421  }
1422  
1423  static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
1424 @@ -1791,6 +1785,7 @@ static void ath9k_bss_info_changed(struc
1425         struct ath_hw *ah = sc->sc_ah;
1426         struct ath_common *common = ath9k_hw_common(ah);
1427         struct ath_vif *avp = (void *)vif->drv_priv;
1428 +       unsigned long flags;
1429         int slottime;
1430  
1431         ath9k_ps_wakeup(sc);
1432 @@ -1853,7 +1848,10 @@ static void ath9k_bss_info_changed(struc
1433  
1434         if (changed & BSS_CHANGED_P2P_PS) {
1435                 spin_lock_bh(&sc->sc_pcu_lock);
1436 -               ath9k_update_p2p_ps(sc, vif);
1437 +               spin_lock_irqsave(&sc->sc_pm_lock, flags);
1438 +               if (!(sc->ps_flags & PS_BEACON_SYNC))
1439 +                       ath9k_update_p2p_ps(sc, vif);
1440 +               spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1441                 spin_unlock_bh(&sc->sc_pcu_lock);
1442         }
1443  
1444 @@ -2232,14 +2230,6 @@ static void ath9k_sw_scan_complete(struc
1445         clear_bit(ATH_OP_SCANNING, &common->op_flags);
1446  }
1447  
1448 -static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
1449 -                                       struct ieee80211_vif *vif,
1450 -                                       struct cfg80211_chan_def *chandef)
1451 -{
1452 -       /* depend on vif->csa_active only */
1453 -       return;
1454 -}
1455 -
1456  struct ieee80211_ops ath9k_ops = {
1457         .tx                 = ath9k_tx,
1458         .start              = ath9k_start,
1459 @@ -2287,5 +2277,4 @@ struct ieee80211_ops ath9k_ops = {
1460  #endif
1461         .sw_scan_start      = ath9k_sw_scan_start,
1462         .sw_scan_complete   = ath9k_sw_scan_complete,
1463 -       .channel_switch_beacon     = ath9k_channel_switch_beacon,
1464  };
1465 --- a/drivers/net/wireless/ath/ath10k/mac.c
1466 +++ b/drivers/net/wireless/ath/ath10k/mac.c
1467 @@ -4142,14 +4142,6 @@ static int ath10k_set_bitrate_mask(struc
1468                                            fixed_nss, force_sgi);
1469  }
1470  
1471 -static void ath10k_channel_switch_beacon(struct ieee80211_hw *hw,
1472 -                                        struct ieee80211_vif *vif,
1473 -                                        struct cfg80211_chan_def *chandef)
1474 -{
1475 -       /* there's no need to do anything here. vif->csa_active is enough */
1476 -       return;
1477 -}
1478 -
1479  static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
1480                                  struct ieee80211_vif *vif,
1481                                  struct ieee80211_sta *sta,
1482 @@ -4256,7 +4248,6 @@ static const struct ieee80211_ops ath10k
1483         .restart_complete               = ath10k_restart_complete,
1484         .get_survey                     = ath10k_get_survey,
1485         .set_bitrate_mask               = ath10k_set_bitrate_mask,
1486 -       .channel_switch_beacon          = ath10k_channel_switch_beacon,
1487         .sta_rc_update                  = ath10k_sta_rc_update,
1488         .get_tsf                        = ath10k_get_tsf,
1489  #ifdef CONFIG_PM
1490 --- a/net/mac80211/cfg.c
1491 +++ b/net/mac80211/cfg.c
1492 @@ -468,327 +468,6 @@ void sta_set_rate_info_rx(struct sta_inf
1493                 rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
1494  }
1495  
1496 -static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
1497 -{
1498 -       struct ieee80211_sub_if_data *sdata = sta->sdata;
1499 -       struct ieee80211_local *local = sdata->local;
1500 -       struct rate_control_ref *ref = local->rate_ctrl;
1501 -       struct timespec uptime;
1502 -       u64 packets = 0;
1503 -       u32 thr = 0;
1504 -       int i, ac;
1505 -
1506 -       sinfo->generation = sdata->local->sta_generation;
1507 -
1508 -       sinfo->filled = STATION_INFO_INACTIVE_TIME |
1509 -                       STATION_INFO_RX_BYTES64 |
1510 -                       STATION_INFO_TX_BYTES64 |
1511 -                       STATION_INFO_RX_PACKETS |
1512 -                       STATION_INFO_TX_PACKETS |
1513 -                       STATION_INFO_TX_RETRIES |
1514 -                       STATION_INFO_TX_FAILED |
1515 -                       STATION_INFO_TX_BITRATE |
1516 -                       STATION_INFO_RX_BITRATE |
1517 -                       STATION_INFO_RX_DROP_MISC |
1518 -                       STATION_INFO_BSS_PARAM |
1519 -                       STATION_INFO_CONNECTED_TIME |
1520 -                       STATION_INFO_STA_FLAGS |
1521 -                       STATION_INFO_BEACON_LOSS_COUNT;
1522 -
1523 -       do_posix_clock_monotonic_gettime(&uptime);
1524 -       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
1525 -
1526 -       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
1527 -       sinfo->tx_bytes = 0;
1528 -       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1529 -               sinfo->tx_bytes += sta->tx_bytes[ac];
1530 -               packets += sta->tx_packets[ac];
1531 -       }
1532 -       sinfo->tx_packets = packets;
1533 -       sinfo->rx_bytes = sta->rx_bytes;
1534 -       sinfo->rx_packets = sta->rx_packets;
1535 -       sinfo->tx_retries = sta->tx_retry_count;
1536 -       sinfo->tx_failed = sta->tx_retry_failed;
1537 -       sinfo->rx_dropped_misc = sta->rx_dropped;
1538 -       sinfo->beacon_loss_count = sta->beacon_loss_count;
1539 -
1540 -       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
1541 -           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
1542 -               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
1543 -               if (!local->ops->get_rssi ||
1544 -                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
1545 -                       sinfo->signal = (s8)sta->last_signal;
1546 -               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
1547 -       }
1548 -       if (sta->chains) {
1549 -               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
1550 -                                STATION_INFO_CHAIN_SIGNAL_AVG;
1551 -
1552 -               sinfo->chains = sta->chains;
1553 -               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
1554 -                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
1555 -                       sinfo->chain_signal_avg[i] =
1556 -                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
1557 -               }
1558 -       }
1559 -
1560 -       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
1561 -       sta_set_rate_info_rx(sta, &sinfo->rxrate);
1562 -
1563 -       if (ieee80211_vif_is_mesh(&sdata->vif)) {
1564 -#ifdef CPTCFG_MAC80211_MESH
1565 -               sinfo->filled |= STATION_INFO_LLID |
1566 -                                STATION_INFO_PLID |
1567 -                                STATION_INFO_PLINK_STATE |
1568 -                                STATION_INFO_LOCAL_PM |
1569 -                                STATION_INFO_PEER_PM |
1570 -                                STATION_INFO_NONPEER_PM;
1571 -
1572 -               sinfo->llid = sta->llid;
1573 -               sinfo->plid = sta->plid;
1574 -               sinfo->plink_state = sta->plink_state;
1575 -               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
1576 -                       sinfo->filled |= STATION_INFO_T_OFFSET;
1577 -                       sinfo->t_offset = sta->t_offset;
1578 -               }
1579 -               sinfo->local_pm = sta->local_pm;
1580 -               sinfo->peer_pm = sta->peer_pm;
1581 -               sinfo->nonpeer_pm = sta->nonpeer_pm;
1582 -#endif
1583 -       }
1584 -
1585 -       sinfo->bss_param.flags = 0;
1586 -       if (sdata->vif.bss_conf.use_cts_prot)
1587 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
1588 -       if (sdata->vif.bss_conf.use_short_preamble)
1589 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
1590 -       if (sdata->vif.bss_conf.use_short_slot)
1591 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
1592 -       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
1593 -       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
1594 -
1595 -       sinfo->sta_flags.set = 0;
1596 -       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
1597 -                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
1598 -                               BIT(NL80211_STA_FLAG_WME) |
1599 -                               BIT(NL80211_STA_FLAG_MFP) |
1600 -                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1601 -                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
1602 -                               BIT(NL80211_STA_FLAG_TDLS_PEER);
1603 -       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1604 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
1605 -       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
1606 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
1607 -       if (test_sta_flag(sta, WLAN_STA_WME))
1608 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
1609 -       if (test_sta_flag(sta, WLAN_STA_MFP))
1610 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
1611 -       if (test_sta_flag(sta, WLAN_STA_AUTH))
1612 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
1613 -       if (test_sta_flag(sta, WLAN_STA_ASSOC))
1614 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1615 -       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
1616 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
1617 -
1618 -       /* check if the driver has a SW RC implementation */
1619 -       if (ref && ref->ops->get_expected_throughput)
1620 -               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
1621 -       else
1622 -               thr = drv_get_expected_throughput(local, &sta->sta);
1623 -
1624 -       if (thr != 0) {
1625 -               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
1626 -               sinfo->expected_throughput = thr;
1627 -       }
1628 -}
1629 -
1630 -static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
1631 -       "rx_packets", "rx_bytes", "wep_weak_iv_count",
1632 -       "rx_duplicates", "rx_fragments", "rx_dropped",
1633 -       "tx_packets", "tx_bytes", "tx_fragments",
1634 -       "tx_filtered", "tx_retry_failed", "tx_retries",
1635 -       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
1636 -       "channel", "noise", "ch_time", "ch_time_busy",
1637 -       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
1638 -};
1639 -#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
1640 -
1641 -static int ieee80211_get_et_sset_count(struct wiphy *wiphy,
1642 -                                      struct net_device *dev,
1643 -                                      int sset)
1644 -{
1645 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1646 -       int rv = 0;
1647 -
1648 -       if (sset == ETH_SS_STATS)
1649 -               rv += STA_STATS_LEN;
1650 -
1651 -       rv += drv_get_et_sset_count(sdata, sset);
1652 -
1653 -       if (rv == 0)
1654 -               return -EOPNOTSUPP;
1655 -       return rv;
1656 -}
1657 -
1658 -static void ieee80211_get_et_stats(struct wiphy *wiphy,
1659 -                                  struct net_device *dev,
1660 -                                  struct ethtool_stats *stats,
1661 -                                  u64 *data)
1662 -{
1663 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1664 -       struct ieee80211_chanctx_conf *chanctx_conf;
1665 -       struct ieee80211_channel *channel;
1666 -       struct sta_info *sta;
1667 -       struct ieee80211_local *local = sdata->local;
1668 -       struct station_info sinfo;
1669 -       struct survey_info survey;
1670 -       int i, q;
1671 -#define STA_STATS_SURVEY_LEN 7
1672 -
1673 -       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
1674 -
1675 -#define ADD_STA_STATS(sta)                             \
1676 -       do {                                            \
1677 -               data[i++] += sta->rx_packets;           \
1678 -               data[i++] += sta->rx_bytes;             \
1679 -               data[i++] += sta->wep_weak_iv_count;    \
1680 -               data[i++] += sta->num_duplicates;       \
1681 -               data[i++] += sta->rx_fragments;         \
1682 -               data[i++] += sta->rx_dropped;           \
1683 -                                                       \
1684 -               data[i++] += sinfo.tx_packets;          \
1685 -               data[i++] += sinfo.tx_bytes;            \
1686 -               data[i++] += sta->tx_fragments;         \
1687 -               data[i++] += sta->tx_filtered_count;    \
1688 -               data[i++] += sta->tx_retry_failed;      \
1689 -               data[i++] += sta->tx_retry_count;       \
1690 -               data[i++] += sta->beacon_loss_count;    \
1691 -       } while (0)
1692 -
1693 -       /* For Managed stations, find the single station based on BSSID
1694 -        * and use that.  For interface types, iterate through all available
1695 -        * stations and add stats for any station that is assigned to this
1696 -        * network device.
1697 -        */
1698 -
1699 -       mutex_lock(&local->sta_mtx);
1700 -
1701 -       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
1702 -               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
1703 -
1704 -               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
1705 -                       goto do_survey;
1706 -
1707 -               sinfo.filled = 0;
1708 -               sta_set_sinfo(sta, &sinfo);
1709 -
1710 -               i = 0;
1711 -               ADD_STA_STATS(sta);
1712 -
1713 -               data[i++] = sta->sta_state;
1714 -
1715 -
1716 -               if (sinfo.filled & STATION_INFO_TX_BITRATE)
1717 -                       data[i] = 100000 *
1718 -                               cfg80211_calculate_bitrate(&sinfo.txrate);
1719 -               i++;
1720 -               if (sinfo.filled & STATION_INFO_RX_BITRATE)
1721 -                       data[i] = 100000 *
1722 -                               cfg80211_calculate_bitrate(&sinfo.rxrate);
1723 -               i++;
1724 -
1725 -               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
1726 -                       data[i] = (u8)sinfo.signal_avg;
1727 -               i++;
1728 -       } else {
1729 -               list_for_each_entry(sta, &local->sta_list, list) {
1730 -                       /* Make sure this station belongs to the proper dev */
1731 -                       if (sta->sdata->dev != dev)
1732 -                               continue;
1733 -
1734 -                       sinfo.filled = 0;
1735 -                       sta_set_sinfo(sta, &sinfo);
1736 -                       i = 0;
1737 -                       ADD_STA_STATS(sta);
1738 -               }
1739 -       }
1740 -
1741 -do_survey:
1742 -       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
1743 -       /* Get survey stats for current channel */
1744 -       survey.filled = 0;
1745 -
1746 -       rcu_read_lock();
1747 -       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1748 -       if (chanctx_conf)
1749 -               channel = chanctx_conf->def.chan;
1750 -       else
1751 -               channel = NULL;
1752 -       rcu_read_unlock();
1753 -
1754 -       if (channel) {
1755 -               q = 0;
1756 -               do {
1757 -                       survey.filled = 0;
1758 -                       if (drv_get_survey(local, q, &survey) != 0) {
1759 -                               survey.filled = 0;
1760 -                               break;
1761 -                       }
1762 -                       q++;
1763 -               } while (channel != survey.channel);
1764 -       }
1765 -
1766 -       if (survey.filled)
1767 -               data[i++] = survey.channel->center_freq;
1768 -       else
1769 -               data[i++] = 0;
1770 -       if (survey.filled & SURVEY_INFO_NOISE_DBM)
1771 -               data[i++] = (u8)survey.noise;
1772 -       else
1773 -               data[i++] = -1LL;
1774 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
1775 -               data[i++] = survey.channel_time;
1776 -       else
1777 -               data[i++] = -1LL;
1778 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
1779 -               data[i++] = survey.channel_time_busy;
1780 -       else
1781 -               data[i++] = -1LL;
1782 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
1783 -               data[i++] = survey.channel_time_ext_busy;
1784 -       else
1785 -               data[i++] = -1LL;
1786 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
1787 -               data[i++] = survey.channel_time_rx;
1788 -       else
1789 -               data[i++] = -1LL;
1790 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
1791 -               data[i++] = survey.channel_time_tx;
1792 -       else
1793 -               data[i++] = -1LL;
1794 -
1795 -       mutex_unlock(&local->sta_mtx);
1796 -
1797 -       if (WARN_ON(i != STA_STATS_LEN))
1798 -               return;
1799 -
1800 -       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
1801 -}
1802 -
1803 -static void ieee80211_get_et_strings(struct wiphy *wiphy,
1804 -                                    struct net_device *dev,
1805 -                                    u32 sset, u8 *data)
1806 -{
1807 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1808 -       int sz_sta_stats = 0;
1809 -
1810 -       if (sset == ETH_SS_STATS) {
1811 -               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
1812 -               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
1813 -       }
1814 -       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
1815 -}
1816 -
1817  static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
1818                                   int idx, u8 *mac, struct station_info *sinfo)
1819  {
1820 @@ -875,7 +554,8 @@ static int ieee80211_set_monitor_channel
1821  }
1822  
1823  static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
1824 -                                   const u8 *resp, size_t resp_len)
1825 +                                   const u8 *resp, size_t resp_len,
1826 +                                   const struct ieee80211_csa_settings *csa)
1827  {
1828         struct probe_resp *new, *old;
1829  
1830 @@ -891,6 +571,11 @@ static int ieee80211_set_probe_resp(stru
1831         new->len = resp_len;
1832         memcpy(new->data, resp, resp_len);
1833  
1834 +       if (csa)
1835 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_presp,
1836 +                      csa->n_counter_offsets_presp *
1837 +                      sizeof(new->csa_counter_offsets[0]));
1838 +
1839         rcu_assign_pointer(sdata->u.ap.probe_resp, new);
1840         if (old)
1841                 kfree_rcu(old, rcu_head);
1842 @@ -899,7 +584,8 @@ static int ieee80211_set_probe_resp(stru
1843  }
1844  
1845  static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
1846 -                                  struct cfg80211_beacon_data *params)
1847 +                                  struct cfg80211_beacon_data *params,
1848 +                                  const struct ieee80211_csa_settings *csa)
1849  {
1850         struct beacon_data *new, *old;
1851         int new_head_len, new_tail_len;
1852 @@ -943,6 +629,13 @@ static int ieee80211_assign_beacon(struc
1853         new->head_len = new_head_len;
1854         new->tail_len = new_tail_len;
1855  
1856 +       if (csa) {
1857 +               new->csa_current_counter = csa->count;
1858 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_beacon,
1859 +                      csa->n_counter_offsets_beacon *
1860 +                      sizeof(new->csa_counter_offsets[0]));
1861 +       }
1862 +
1863         /* copy in head */
1864         if (params->head)
1865                 memcpy(new->head, params->head, new_head_len);
1866 @@ -957,7 +650,7 @@ static int ieee80211_assign_beacon(struc
1867                         memcpy(new->tail, old->tail, new_tail_len);
1868  
1869         err = ieee80211_set_probe_resp(sdata, params->probe_resp,
1870 -                                      params->probe_resp_len);
1871 +                                      params->probe_resp_len, csa);
1872         if (err < 0)
1873                 return err;
1874         if (err == 0)
1875 @@ -1042,7 +735,7 @@ static int ieee80211_start_ap(struct wip
1876                 sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow |=
1877                                         IEEE80211_P2P_OPPPS_ENABLE_BIT;
1878  
1879 -       err = ieee80211_assign_beacon(sdata, &params->beacon);
1880 +       err = ieee80211_assign_beacon(sdata, &params->beacon, NULL);
1881         if (err < 0) {
1882                 ieee80211_vif_release_channel(sdata);
1883                 return err;
1884 @@ -1090,7 +783,7 @@ static int ieee80211_change_beacon(struc
1885         if (!old)
1886                 return -ENOENT;
1887  
1888 -       err = ieee80211_assign_beacon(sdata, params);
1889 +       err = ieee80211_assign_beacon(sdata, params, NULL);
1890         if (err < 0)
1891                 return err;
1892         ieee80211_bss_info_change_notify(sdata, err);
1893 @@ -3073,7 +2766,8 @@ static int ieee80211_set_after_csa_beaco
1894  
1895         switch (sdata->vif.type) {
1896         case NL80211_IFTYPE_AP:
1897 -               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
1898 +               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
1899 +                                             NULL);
1900                 kfree(sdata->u.ap.next_beacon);
1901                 sdata->u.ap.next_beacon = NULL;
1902  
1903 @@ -3176,6 +2870,7 @@ static int ieee80211_set_csa_beacon(stru
1904                                     struct cfg80211_csa_settings *params,
1905                                     u32 *changed)
1906  {
1907 +       struct ieee80211_csa_settings csa = {};
1908         int err;
1909  
1910         switch (sdata->vif.type) {
1911 @@ -3210,20 +2905,13 @@ static int ieee80211_set_csa_beacon(stru
1912                      IEEE80211_MAX_CSA_COUNTERS_NUM))
1913                         return -EINVAL;
1914  
1915 -               /* make sure we don't have garbage in other counters */
1916 -               memset(sdata->csa_counter_offset_beacon, 0,
1917 -                      sizeof(sdata->csa_counter_offset_beacon));
1918 -               memset(sdata->csa_counter_offset_presp, 0,
1919 -                      sizeof(sdata->csa_counter_offset_presp));
1920 -
1921 -               memcpy(sdata->csa_counter_offset_beacon,
1922 -                      params->counter_offsets_beacon,
1923 -                      params->n_counter_offsets_beacon * sizeof(u16));
1924 -               memcpy(sdata->csa_counter_offset_presp,
1925 -                      params->counter_offsets_presp,
1926 -                      params->n_counter_offsets_presp * sizeof(u16));
1927 +               csa.counter_offsets_beacon = params->counter_offsets_beacon;
1928 +               csa.counter_offsets_presp = params->counter_offsets_presp;
1929 +               csa.n_counter_offsets_beacon = params->n_counter_offsets_beacon;
1930 +               csa.n_counter_offsets_presp = params->n_counter_offsets_presp;
1931 +               csa.count = params->count;
1932  
1933 -               err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
1934 +               err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa);
1935                 if (err < 0) {
1936                         kfree(sdata->u.ap.next_beacon);
1937                         return err;
1938 @@ -3367,7 +3055,6 @@ __ieee80211_channel_switch(struct wiphy 
1939         sdata->csa_radar_required = params->radar_required;
1940         sdata->csa_chandef = params->chandef;
1941         sdata->csa_block_tx = params->block_tx;
1942 -       sdata->csa_current_counter = params->count;
1943         sdata->vif.csa_active = true;
1944  
1945         if (sdata->csa_block_tx)
1946 @@ -3515,10 +3202,23 @@ static int ieee80211_mgmt_tx(struct wiph
1947              sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
1948             params->n_csa_offsets) {
1949                 int i;
1950 -               u8 c = sdata->csa_current_counter;
1951 +               struct beacon_data *beacon = NULL;
1952 +
1953 +               rcu_read_lock();
1954  
1955 -               for (i = 0; i < params->n_csa_offsets; i++)
1956 -                       data[params->csa_offsets[i]] = c;
1957 +               if (sdata->vif.type == NL80211_IFTYPE_AP)
1958 +                       beacon = rcu_dereference(sdata->u.ap.beacon);
1959 +               else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1960 +                       beacon = rcu_dereference(sdata->u.ibss.presp);
1961 +               else if (ieee80211_vif_is_mesh(&sdata->vif))
1962 +                       beacon = rcu_dereference(sdata->u.mesh.beacon);
1963 +
1964 +               if (beacon)
1965 +                       for (i = 0; i < params->n_csa_offsets; i++)
1966 +                               data[params->csa_offsets[i]] =
1967 +                                       beacon->csa_current_counter;
1968 +
1969 +               rcu_read_unlock();
1970         }
1971  
1972         IEEE80211_SKB_CB(skb)->flags = flags;
1973 @@ -3598,21 +3298,6 @@ static int ieee80211_get_antenna(struct 
1974         return drv_get_antenna(local, tx_ant, rx_ant);
1975  }
1976  
1977 -static int ieee80211_set_ringparam(struct wiphy *wiphy, u32 tx, u32 rx)
1978 -{
1979 -       struct ieee80211_local *local = wiphy_priv(wiphy);
1980 -
1981 -       return drv_set_ringparam(local, tx, rx);
1982 -}
1983 -
1984 -static void ieee80211_get_ringparam(struct wiphy *wiphy,
1985 -                                   u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max)
1986 -{
1987 -       struct ieee80211_local *local = wiphy_priv(wiphy);
1988 -
1989 -       drv_get_ringparam(local, tx, tx_max, rx, rx_max);
1990 -}
1991 -
1992  static int ieee80211_set_rekey_data(struct wiphy *wiphy,
1993                                     struct net_device *dev,
1994                                     struct cfg80211_gtk_rekey_data *data)
1995 @@ -3844,8 +3529,6 @@ const struct cfg80211_ops mac80211_confi
1996         .mgmt_frame_register = ieee80211_mgmt_frame_register,
1997         .set_antenna = ieee80211_set_antenna,
1998         .get_antenna = ieee80211_get_antenna,
1999 -       .set_ringparam = ieee80211_set_ringparam,
2000 -       .get_ringparam = ieee80211_get_ringparam,
2001         .set_rekey_data = ieee80211_set_rekey_data,
2002         .tdls_oper = ieee80211_tdls_oper,
2003         .tdls_mgmt = ieee80211_tdls_mgmt,
2004 @@ -3854,9 +3537,6 @@ const struct cfg80211_ops mac80211_confi
2005  #ifdef CONFIG_PM
2006         .set_wakeup = ieee80211_set_wakeup,
2007  #endif
2008 -       .get_et_sset_count = ieee80211_get_et_sset_count,
2009 -       .get_et_stats = ieee80211_get_et_stats,
2010 -       .get_et_strings = ieee80211_get_et_strings,
2011         .get_channel = ieee80211_cfg_get_channel,
2012         .start_radar_detection = ieee80211_start_radar_detection,
2013         .channel_switch = ieee80211_channel_switch,
2014 --- a/net/mac80211/debugfs_sta.c
2015 +++ b/net/mac80211/debugfs_sta.c
2016 @@ -587,7 +587,6 @@ void ieee80211_sta_debugfs_add(struct st
2017         DEBUGFS_ADD_COUNTER(tx_filtered, tx_filtered_count);
2018         DEBUGFS_ADD_COUNTER(tx_retry_failed, tx_retry_failed);
2019         DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
2020 -       DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
2021  
2022         if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
2023                 debugfs_create_x32("driver_buffered_tids", 0400,
2024 --- a/net/mac80211/wep.c
2025 +++ b/net/mac80211/wep.c
2026 @@ -271,22 +271,6 @@ static int ieee80211_wep_decrypt(struct 
2027         return ret;
2028  }
2029  
2030 -
2031 -static bool ieee80211_wep_is_weak_iv(struct sk_buff *skb,
2032 -                                    struct ieee80211_key *key)
2033 -{
2034 -       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2035 -       unsigned int hdrlen;
2036 -       u8 *ivpos;
2037 -       u32 iv;
2038 -
2039 -       hdrlen = ieee80211_hdrlen(hdr->frame_control);
2040 -       ivpos = skb->data + hdrlen;
2041 -       iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
2042 -
2043 -       return ieee80211_wep_weak_iv(iv, key->conf.keylen);
2044 -}
2045 -
2046  ieee80211_rx_result
2047  ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
2048  {
2049 @@ -301,16 +285,12 @@ ieee80211_crypto_wep_decrypt(struct ieee
2050         if (!(status->flag & RX_FLAG_DECRYPTED)) {
2051                 if (skb_linearize(rx->skb))
2052                         return RX_DROP_UNUSABLE;
2053 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2054 -                       rx->sta->wep_weak_iv_count++;
2055                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
2056                         return RX_DROP_UNUSABLE;
2057         } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
2058                 if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) +
2059                                             IEEE80211_WEP_IV_LEN))
2060                         return RX_DROP_UNUSABLE;
2061 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2062 -                       rx->sta->wep_weak_iv_count++;
2063                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
2064                 /* remove ICV */
2065                 if (pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN))
2066 --- a/include/net/cfg80211.h
2067 +++ b/include/net/cfg80211.h
2068 @@ -2278,16 +2278,6 @@ struct cfg80211_qos_map {
2069   *
2070   * @set_noack_map: Set the NoAck Map for the TIDs.
2071   *
2072 - * @get_et_sset_count:  Ethtool API to get string-set count.
2073 - *     See @ethtool_ops.get_sset_count
2074 - *
2075 - * @get_et_stats:  Ethtool API to get a set of u64 stats.
2076 - *     See @ethtool_ops.get_ethtool_stats
2077 - *
2078 - * @get_et_strings:  Ethtool API to get a set of strings to describe stats
2079 - *     and perhaps other supported types of ethtool data-sets.
2080 - *     See @ethtool_ops.get_strings
2081 - *
2082   * @get_channel: Get the current operating channel for the virtual interface.
2083   *     For monitor interfaces, it should return %NULL unless there's a single
2084   *     current monitoring channel.
2085 @@ -2529,13 +2519,6 @@ struct cfg80211_ops {
2086                                   struct net_device *dev,
2087                                   u16 noack_map);
2088  
2089 -       int     (*get_et_sset_count)(struct wiphy *wiphy,
2090 -                                    struct net_device *dev, int sset);
2091 -       void    (*get_et_stats)(struct wiphy *wiphy, struct net_device *dev,
2092 -                               struct ethtool_stats *stats, u64 *data);
2093 -       void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
2094 -                                 u32 sset, u8 *data);
2095 -
2096         int     (*get_channel)(struct wiphy *wiphy,
2097                                struct wireless_dev *wdev,
2098                                struct cfg80211_chan_def *chandef);
2099 @@ -4846,6 +4829,10 @@ void cfg80211_stop_iface(struct wiphy *w
2100   */
2101  void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
2102  
2103 +
2104 +/* ethtool helper */
2105 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info);
2106 +
2107  /* Logging, debugging and troubleshooting/diagnostic helpers. */
2108  
2109  /* wiphy_printk helpers, similar to dev_printk */
2110 --- a/net/mac80211/Makefile
2111 +++ b/net/mac80211/Makefile
2112 @@ -17,6 +17,7 @@ mac80211-y := \
2113         aes_ccm.o \
2114         aes_cmac.o \
2115         cfg.o \
2116 +       ethtool.o \
2117         rx.o \
2118         spectmgmt.o \
2119         tx.o \
2120 --- a/net/mac80211/ieee80211_i.h
2121 +++ b/net/mac80211/ieee80211_i.h
2122 @@ -229,16 +229,29 @@ struct ieee80211_rx_data {
2123         u16 tkip_iv16;
2124  };
2125  
2126 +struct ieee80211_csa_settings {
2127 +       const u16 *counter_offsets_beacon;
2128 +       const u16 *counter_offsets_presp;
2129 +
2130 +       int n_counter_offsets_beacon;
2131 +       int n_counter_offsets_presp;
2132 +
2133 +       u8 count;
2134 +};
2135 +
2136  struct beacon_data {
2137         u8 *head, *tail;
2138         int head_len, tail_len;
2139         struct ieee80211_meshconf_ie *meshconf;
2140 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2141 +       u8 csa_current_counter;
2142         struct rcu_head rcu_head;
2143  };
2144  
2145  struct probe_resp {
2146         struct rcu_head rcu_head;
2147         int len;
2148 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2149         u8 data[0];
2150  };
2151  
2152 @@ -754,8 +767,6 @@ struct ieee80211_sub_if_data {
2153         struct mac80211_qos_map __rcu *qos_map;
2154  
2155         struct work_struct csa_finalize_work;
2156 -       u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM];
2157 -       u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM];
2158         bool csa_radar_required;
2159         bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
2160         struct cfg80211_chan_def csa_chandef;
2161 @@ -767,7 +778,6 @@ struct ieee80211_sub_if_data {
2162         struct ieee80211_chanctx *reserved_chanctx;
2163         struct cfg80211_chan_def reserved_chandef;
2164         bool reserved_radar_required;
2165 -       u8 csa_current_counter;
2166  
2167         /* used to reconfigure hardware SM PS */
2168         struct work_struct recalc_smps;
2169 @@ -1850,6 +1860,8 @@ int ieee80211_tdls_oper(struct wiphy *wi
2170                         const u8 *peer, enum nl80211_tdls_operation oper);
2171  
2172  
2173 +extern const struct ethtool_ops ieee80211_ethtool_ops;
2174 +
2175  #ifdef CPTCFG_MAC80211_NOINLINE
2176  #define debug_noinline noinline
2177  #else
2178 --- a/net/mac80211/iface.c
2179 +++ b/net/mac80211/iface.c
2180 @@ -399,6 +399,7 @@ int ieee80211_add_virtual_monitor(struct
2181         sdata->vif.type = NL80211_IFTYPE_MONITOR;
2182         snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
2183                  wiphy_name(local->hw.wiphy));
2184 +       sdata->wdev.iftype = NL80211_IFTYPE_MONITOR;
2185  
2186         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2187  
2188 @@ -1303,6 +1304,7 @@ static void ieee80211_setup_sdata(struct
2189         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
2190         sdata->control_port_no_encrypt = false;
2191         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2192 +       sdata->vif.bss_conf.idle = true;
2193  
2194         sdata->noack_map = 0;
2195  
2196 @@ -1721,6 +1723,8 @@ int ieee80211_if_add(struct ieee80211_lo
2197  
2198                 ndev->features |= local->hw.netdev_features;
2199  
2200 +               netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
2201 +
2202                 ret = register_netdevice(ndev);
2203                 if (ret) {
2204                         free_netdev(ndev);
2205 --- a/net/wireless/core.c
2206 +++ b/net/wireless/core.c
2207 @@ -25,7 +25,6 @@
2208  #include "sysfs.h"
2209  #include "debugfs.h"
2210  #include "wext-compat.h"
2211 -#include "ethtool.h"
2212  #include "rdev-ops.h"
2213  
2214  /* name for sysfs, %d is appended */
2215 @@ -940,8 +939,6 @@ static int cfg80211_netdev_notifier_call
2216                 /* allow mac80211 to determine the timeout */
2217                 wdev->ps_timeout = -1;
2218  
2219 -               netdev_set_default_ethtool_ops(dev, &cfg80211_ethtool_ops);
2220 -
2221                 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
2222                      wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
2223                      wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
2224 --- a/net/wireless/ethtool.c
2225 +++ b/net/wireless/ethtool.c
2226 @@ -1,11 +1,9 @@
2227  #include <linux/utsname.h>
2228  #include <net/cfg80211.h>
2229  #include "core.h"
2230 -#include "ethtool.h"
2231  #include "rdev-ops.h"
2232  
2233 -static void cfg80211_get_drvinfo(struct net_device *dev,
2234 -                                       struct ethtool_drvinfo *info)
2235 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
2236  {
2237         struct wireless_dev *wdev = dev->ieee80211_ptr;
2238  
2239 @@ -23,84 +21,4 @@ static void cfg80211_get_drvinfo(struct 
2240         strlcpy(info->bus_info, dev_name(wiphy_dev(wdev->wiphy)),
2241                 sizeof(info->bus_info));
2242  }
2243 -
2244 -static int cfg80211_get_regs_len(struct net_device *dev)
2245 -{
2246 -       /* For now, return 0... */
2247 -       return 0;
2248 -}
2249 -
2250 -static void cfg80211_get_regs(struct net_device *dev, struct ethtool_regs *regs,
2251 -                       void *data)
2252 -{
2253 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2254 -
2255 -       regs->version = wdev->wiphy->hw_version;
2256 -       regs->len = 0;
2257 -}
2258 -
2259 -static void cfg80211_get_ringparam(struct net_device *dev,
2260 -                                  struct ethtool_ringparam *rp)
2261 -{
2262 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2263 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2264 -
2265 -       memset(rp, 0, sizeof(*rp));
2266 -
2267 -       if (rdev->ops->get_ringparam)
2268 -               rdev_get_ringparam(rdev, &rp->tx_pending, &rp->tx_max_pending,
2269 -                                  &rp->rx_pending, &rp->rx_max_pending);
2270 -}
2271 -
2272 -static int cfg80211_set_ringparam(struct net_device *dev,
2273 -                                 struct ethtool_ringparam *rp)
2274 -{
2275 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2276 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2277 -
2278 -       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2279 -               return -EINVAL;
2280 -
2281 -       if (rdev->ops->set_ringparam)
2282 -               return rdev_set_ringparam(rdev, rp->tx_pending, rp->rx_pending);
2283 -
2284 -       return -ENOTSUPP;
2285 -}
2286 -
2287 -static int cfg80211_get_sset_count(struct net_device *dev, int sset)
2288 -{
2289 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2290 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2291 -       if (rdev->ops->get_et_sset_count)
2292 -               return rdev_get_et_sset_count(rdev, dev, sset);
2293 -       return -EOPNOTSUPP;
2294 -}
2295 -
2296 -static void cfg80211_get_stats(struct net_device *dev,
2297 -                              struct ethtool_stats *stats, u64 *data)
2298 -{
2299 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2300 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2301 -       if (rdev->ops->get_et_stats)
2302 -               rdev_get_et_stats(rdev, dev, stats, data);
2303 -}
2304 -
2305 -static void cfg80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
2306 -{
2307 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2308 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2309 -       if (rdev->ops->get_et_strings)
2310 -               rdev_get_et_strings(rdev, dev, sset, data);
2311 -}
2312 -
2313 -const struct ethtool_ops cfg80211_ethtool_ops = {
2314 -       .get_drvinfo = cfg80211_get_drvinfo,
2315 -       .get_regs_len = cfg80211_get_regs_len,
2316 -       .get_regs = cfg80211_get_regs,
2317 -       .get_link = ethtool_op_get_link,
2318 -       .get_ringparam = cfg80211_get_ringparam,
2319 -       .set_ringparam = cfg80211_set_ringparam,
2320 -       .get_strings = cfg80211_get_strings,
2321 -       .get_ethtool_stats = cfg80211_get_stats,
2322 -       .get_sset_count = cfg80211_get_sset_count,
2323 -};
2324 +EXPORT_SYMBOL(cfg80211_get_drvinfo);
2325 --- a/net/wireless/ethtool.h
2326 +++ /dev/null
2327 @@ -1,6 +0,0 @@
2328 -#ifndef __CFG80211_ETHTOOL__
2329 -#define __CFG80211_ETHTOOL__
2330 -
2331 -extern const struct ethtool_ops cfg80211_ethtool_ops;
2332 -
2333 -#endif /* __CFG80211_ETHTOOL__ */
2334 --- a/net/wireless/rdev-ops.h
2335 +++ b/net/wireless/rdev-ops.h
2336 @@ -714,25 +714,6 @@ static inline int rdev_get_antenna(struc
2337         return ret;
2338  }
2339  
2340 -static inline int rdev_set_ringparam(struct cfg80211_registered_device *rdev,
2341 -                                    u32 tx, u32 rx)
2342 -{
2343 -       int ret;
2344 -       trace_rdev_set_ringparam(&rdev->wiphy, tx, rx);
2345 -       ret = rdev->ops->set_ringparam(&rdev->wiphy, tx, rx);
2346 -       trace_rdev_return_int(&rdev->wiphy, ret);
2347 -       return ret;
2348 -}
2349 -
2350 -static inline void rdev_get_ringparam(struct cfg80211_registered_device *rdev,
2351 -                                     u32 *tx, u32 *tx_max, u32 *rx,
2352 -                                     u32 *rx_max)
2353 -{
2354 -       trace_rdev_get_ringparam(&rdev->wiphy);
2355 -       rdev->ops->get_ringparam(&rdev->wiphy, tx, tx_max, rx, rx_max);
2356 -       trace_rdev_return_void_tx_rx(&rdev->wiphy, *tx, *tx_max, *rx, *rx_max);
2357 -}
2358 -
2359  static inline int
2360  rdev_sched_scan_start(struct cfg80211_registered_device *rdev,
2361                       struct net_device *dev,
2362 @@ -816,35 +797,6 @@ static inline int rdev_set_noack_map(str
2363  }
2364  
2365  static inline int
2366 -rdev_get_et_sset_count(struct cfg80211_registered_device *rdev,
2367 -                      struct net_device *dev, int sset)
2368 -{
2369 -       int ret;
2370 -       trace_rdev_get_et_sset_count(&rdev->wiphy, dev, sset);
2371 -       ret = rdev->ops->get_et_sset_count(&rdev->wiphy, dev, sset);
2372 -       trace_rdev_return_int(&rdev->wiphy, ret);
2373 -       return ret;
2374 -}
2375 -
2376 -static inline void rdev_get_et_stats(struct cfg80211_registered_device *rdev,
2377 -                                    struct net_device *dev,
2378 -                                    struct ethtool_stats *stats, u64 *data)
2379 -{
2380 -       trace_rdev_get_et_stats(&rdev->wiphy, dev);
2381 -       rdev->ops->get_et_stats(&rdev->wiphy, dev, stats, data);
2382 -       trace_rdev_return_void(&rdev->wiphy);
2383 -}
2384 -
2385 -static inline void rdev_get_et_strings(struct cfg80211_registered_device *rdev,
2386 -                                      struct net_device *dev, u32 sset,
2387 -                                      u8 *data)
2388 -{
2389 -       trace_rdev_get_et_strings(&rdev->wiphy, dev, sset);
2390 -       rdev->ops->get_et_strings(&rdev->wiphy, dev, sset, data);
2391 -       trace_rdev_return_void(&rdev->wiphy);
2392 -}
2393 -
2394 -static inline int
2395  rdev_get_channel(struct cfg80211_registered_device *rdev,
2396                  struct wireless_dev *wdev,
2397                  struct cfg80211_chan_def *chandef)
2398 --- a/net/wireless/trace.h
2399 +++ b/net/wireless/trace.h
2400 @@ -298,11 +298,6 @@ DEFINE_EVENT(wiphy_only_evt, rdev_return
2401         TP_ARGS(wiphy)
2402  );
2403  
2404 -DEFINE_EVENT(wiphy_only_evt, rdev_get_ringparam,
2405 -       TP_PROTO(struct wiphy *wiphy),
2406 -       TP_ARGS(wiphy)
2407 -);
2408 -
2409  DEFINE_EVENT(wiphy_only_evt, rdev_get_antenna,
2410         TP_PROTO(struct wiphy *wiphy),
2411         TP_ARGS(wiphy)
2412 @@ -580,11 +575,6 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_stop
2413         TP_ARGS(wiphy, netdev)
2414  );
2415  
2416 -DEFINE_EVENT(wiphy_netdev_evt, rdev_get_et_stats,
2417 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2418 -       TP_ARGS(wiphy, netdev)
2419 -);
2420 -
2421  DEFINE_EVENT(wiphy_netdev_evt, rdev_sched_scan_stop,
2422         TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2423         TP_ARGS(wiphy, netdev)
2424 @@ -1439,11 +1429,6 @@ DECLARE_EVENT_CLASS(tx_rx_evt,
2425                   WIPHY_PR_ARG, __entry->tx, __entry->rx)
2426  );
2427  
2428 -DEFINE_EVENT(tx_rx_evt, rdev_set_ringparam,
2429 -       TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2430 -       TP_ARGS(wiphy, rx, tx)
2431 -);
2432 -
2433  DEFINE_EVENT(tx_rx_evt, rdev_set_antenna,
2434         TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2435         TP_ARGS(wiphy, rx, tx)
2436 @@ -1725,40 +1710,6 @@ TRACE_EVENT(rdev_set_noack_map,
2437                   WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->noack_map)
2438  );
2439  
2440 -TRACE_EVENT(rdev_get_et_sset_count,
2441 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int sset),
2442 -       TP_ARGS(wiphy, netdev, sset),
2443 -       TP_STRUCT__entry(
2444 -               WIPHY_ENTRY
2445 -               NETDEV_ENTRY
2446 -               __field(int, sset)
2447 -       ),
2448 -       TP_fast_assign(
2449 -               WIPHY_ASSIGN;
2450 -               NETDEV_ASSIGN;
2451 -               __entry->sset = sset;
2452 -       ),
2453 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %d",
2454 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2455 -);
2456 -
2457 -TRACE_EVENT(rdev_get_et_strings,
2458 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u32 sset),
2459 -       TP_ARGS(wiphy, netdev, sset),
2460 -       TP_STRUCT__entry(
2461 -               WIPHY_ENTRY
2462 -               NETDEV_ENTRY
2463 -               __field(u32, sset)
2464 -       ),
2465 -       TP_fast_assign(
2466 -               WIPHY_ASSIGN;
2467 -               NETDEV_ASSIGN;
2468 -               __entry->sset = sset;
2469 -       ),
2470 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %u",
2471 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2472 -);
2473 -
2474  DEFINE_EVENT(wiphy_wdev_evt, rdev_get_channel,
2475         TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
2476         TP_ARGS(wiphy, wdev)
2477 --- /dev/null
2478 +++ b/net/mac80211/ethtool.c
2479 @@ -0,0 +1,244 @@
2480 +/*
2481 + * mac80211 ethtool hooks for cfg80211
2482 + *
2483 + * Copied from cfg.c - originally
2484 + * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
2485 + * Copyright 2014      Intel Corporation (Author: Johannes Berg)
2486 + *
2487 + * This file is GPLv2 as found in COPYING.
2488 + */
2489 +#include <linux/types.h>
2490 +#include <net/cfg80211.h>
2491 +#include "ieee80211_i.h"
2492 +#include "sta_info.h"
2493 +#include "driver-ops.h"
2494 +
2495 +static int ieee80211_set_ringparam(struct net_device *dev,
2496 +                                  struct ethtool_ringparam *rp)
2497 +{
2498 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2499 +
2500 +       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2501 +               return -EINVAL;
2502 +
2503 +       return drv_set_ringparam(local, rp->tx_pending, rp->rx_pending);
2504 +}
2505 +
2506 +static void ieee80211_get_ringparam(struct net_device *dev,
2507 +                                   struct ethtool_ringparam *rp)
2508 +{
2509 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2510 +
2511 +       memset(rp, 0, sizeof(*rp));
2512 +
2513 +       drv_get_ringparam(local, &rp->tx_pending, &rp->tx_max_pending,
2514 +                         &rp->rx_pending, &rp->rx_max_pending);
2515 +}
2516 +
2517 +static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
2518 +       "rx_packets", "rx_bytes",
2519 +       "rx_duplicates", "rx_fragments", "rx_dropped",
2520 +       "tx_packets", "tx_bytes", "tx_fragments",
2521 +       "tx_filtered", "tx_retry_failed", "tx_retries",
2522 +       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
2523 +       "channel", "noise", "ch_time", "ch_time_busy",
2524 +       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
2525 +};
2526 +#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
2527 +
2528 +static int ieee80211_get_sset_count(struct net_device *dev, int sset)
2529 +{
2530 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2531 +       int rv = 0;
2532 +
2533 +       if (sset == ETH_SS_STATS)
2534 +               rv += STA_STATS_LEN;
2535 +
2536 +       rv += drv_get_et_sset_count(sdata, sset);
2537 +
2538 +       if (rv == 0)
2539 +               return -EOPNOTSUPP;
2540 +       return rv;
2541 +}
2542 +
2543 +static void ieee80211_get_stats(struct net_device *dev,
2544 +                               struct ethtool_stats *stats,
2545 +                               u64 *data)
2546 +{
2547 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2548 +       struct ieee80211_chanctx_conf *chanctx_conf;
2549 +       struct ieee80211_channel *channel;
2550 +       struct sta_info *sta;
2551 +       struct ieee80211_local *local = sdata->local;
2552 +       struct station_info sinfo;
2553 +       struct survey_info survey;
2554 +       int i, q;
2555 +#define STA_STATS_SURVEY_LEN 7
2556 +
2557 +       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
2558 +
2559 +#define ADD_STA_STATS(sta)                             \
2560 +       do {                                            \
2561 +               data[i++] += sta->rx_packets;           \
2562 +               data[i++] += sta->rx_bytes;             \
2563 +               data[i++] += sta->num_duplicates;       \
2564 +               data[i++] += sta->rx_fragments;         \
2565 +               data[i++] += sta->rx_dropped;           \
2566 +                                                       \
2567 +               data[i++] += sinfo.tx_packets;          \
2568 +               data[i++] += sinfo.tx_bytes;            \
2569 +               data[i++] += sta->tx_fragments;         \
2570 +               data[i++] += sta->tx_filtered_count;    \
2571 +               data[i++] += sta->tx_retry_failed;      \
2572 +               data[i++] += sta->tx_retry_count;       \
2573 +               data[i++] += sta->beacon_loss_count;    \
2574 +       } while (0)
2575 +
2576 +       /* For Managed stations, find the single station based on BSSID
2577 +        * and use that.  For interface types, iterate through all available
2578 +        * stations and add stats for any station that is assigned to this
2579 +        * network device.
2580 +        */
2581 +
2582 +       mutex_lock(&local->sta_mtx);
2583 +
2584 +       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2585 +               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
2586 +
2587 +               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
2588 +                       goto do_survey;
2589 +
2590 +               sinfo.filled = 0;
2591 +               sta_set_sinfo(sta, &sinfo);
2592 +
2593 +               i = 0;
2594 +               ADD_STA_STATS(sta);
2595 +
2596 +               data[i++] = sta->sta_state;
2597 +
2598 +
2599 +               if (sinfo.filled & STATION_INFO_TX_BITRATE)
2600 +                       data[i] = 100000 *
2601 +                               cfg80211_calculate_bitrate(&sinfo.txrate);
2602 +               i++;
2603 +               if (sinfo.filled & STATION_INFO_RX_BITRATE)
2604 +                       data[i] = 100000 *
2605 +                               cfg80211_calculate_bitrate(&sinfo.rxrate);
2606 +               i++;
2607 +
2608 +               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
2609 +                       data[i] = (u8)sinfo.signal_avg;
2610 +               i++;
2611 +       } else {
2612 +               list_for_each_entry(sta, &local->sta_list, list) {
2613 +                       /* Make sure this station belongs to the proper dev */
2614 +                       if (sta->sdata->dev != dev)
2615 +                               continue;
2616 +
2617 +                       sinfo.filled = 0;
2618 +                       sta_set_sinfo(sta, &sinfo);
2619 +                       i = 0;
2620 +                       ADD_STA_STATS(sta);
2621 +               }
2622 +       }
2623 +
2624 +do_survey:
2625 +       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
2626 +       /* Get survey stats for current channel */
2627 +       survey.filled = 0;
2628 +
2629 +       rcu_read_lock();
2630 +       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2631 +       if (chanctx_conf)
2632 +               channel = chanctx_conf->def.chan;
2633 +       else
2634 +               channel = NULL;
2635 +       rcu_read_unlock();
2636 +
2637 +       if (channel) {
2638 +               q = 0;
2639 +               do {
2640 +                       survey.filled = 0;
2641 +                       if (drv_get_survey(local, q, &survey) != 0) {
2642 +                               survey.filled = 0;
2643 +                               break;
2644 +                       }
2645 +                       q++;
2646 +               } while (channel != survey.channel);
2647 +       }
2648 +
2649 +       if (survey.filled)
2650 +               data[i++] = survey.channel->center_freq;
2651 +       else
2652 +               data[i++] = 0;
2653 +       if (survey.filled & SURVEY_INFO_NOISE_DBM)
2654 +               data[i++] = (u8)survey.noise;
2655 +       else
2656 +               data[i++] = -1LL;
2657 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
2658 +               data[i++] = survey.channel_time;
2659 +       else
2660 +               data[i++] = -1LL;
2661 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
2662 +               data[i++] = survey.channel_time_busy;
2663 +       else
2664 +               data[i++] = -1LL;
2665 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
2666 +               data[i++] = survey.channel_time_ext_busy;
2667 +       else
2668 +               data[i++] = -1LL;
2669 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
2670 +               data[i++] = survey.channel_time_rx;
2671 +       else
2672 +               data[i++] = -1LL;
2673 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
2674 +               data[i++] = survey.channel_time_tx;
2675 +       else
2676 +               data[i++] = -1LL;
2677 +
2678 +       mutex_unlock(&local->sta_mtx);
2679 +
2680 +       if (WARN_ON(i != STA_STATS_LEN))
2681 +               return;
2682 +
2683 +       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
2684 +}
2685 +
2686 +static void ieee80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
2687 +{
2688 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2689 +       int sz_sta_stats = 0;
2690 +
2691 +       if (sset == ETH_SS_STATS) {
2692 +               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
2693 +               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
2694 +       }
2695 +       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
2696 +}
2697 +
2698 +static int ieee80211_get_regs_len(struct net_device *dev)
2699 +{
2700 +       return 0;
2701 +}
2702 +
2703 +static void ieee80211_get_regs(struct net_device *dev,
2704 +                              struct ethtool_regs *regs,
2705 +                              void *data)
2706 +{
2707 +       struct wireless_dev *wdev = dev->ieee80211_ptr;
2708 +
2709 +       regs->version = wdev->wiphy->hw_version;
2710 +       regs->len = 0;
2711 +}
2712 +
2713 +const struct ethtool_ops ieee80211_ethtool_ops = {
2714 +       .get_drvinfo = cfg80211_get_drvinfo,
2715 +       .get_regs_len = ieee80211_get_regs_len,
2716 +       .get_regs = ieee80211_get_regs,
2717 +       .get_link = ethtool_op_get_link,
2718 +       .get_ringparam = ieee80211_get_ringparam,
2719 +       .set_ringparam = ieee80211_set_ringparam,
2720 +       .get_strings = ieee80211_get_strings,
2721 +       .get_ethtool_stats = ieee80211_get_stats,
2722 +       .get_sset_count = ieee80211_get_sset_count,
2723 +};
2724 --- a/net/mac80211/ibss.c
2725 +++ b/net/mac80211/ibss.c
2726 @@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80
2727                 *pos++ = csa_settings->block_tx ? 1 : 0;
2728                 *pos++ = ieee80211_frequency_to_channel(
2729                                 csa_settings->chandef.chan->center_freq);
2730 -               sdata->csa_counter_offset_beacon[0] = (pos - presp->head);
2731 +               presp->csa_counter_offsets[0] = (pos - presp->head);
2732                 *pos++ = csa_settings->count;
2733         }
2734  
2735 @@ -1677,6 +1677,7 @@ int ieee80211_ibss_join(struct ieee80211
2736         sdata->u.ibss.control_port = params->control_port;
2737         sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
2738         sdata->u.ibss.basic_rates = params->basic_rates;
2739 +       sdata->u.ibss.last_scan_completed = jiffies;
2740  
2741         /* fix basic_rates if channel does not support these rates */
2742         rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
2743 --- a/net/mac80211/mesh.c
2744 +++ b/net/mac80211/mesh.c
2745 @@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee8
2746                 *pos++ = 0x0;
2747                 *pos++ = ieee80211_frequency_to_channel(
2748                                 csa->settings.chandef.chan->center_freq);
2749 -               sdata->csa_counter_offset_beacon[0] = hdr_len + 6;
2750 +               bcn->csa_counter_offsets[0] = hdr_len + 6;
2751                 *pos++ = csa->settings.count;
2752                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
2753                 *pos++ = 6;
2754 --- a/net/wireless/genregdb.awk
2755 +++ b/net/wireless/genregdb.awk
2756 @@ -65,17 +65,7 @@ function parse_reg_rule()
2757         sub(/,/, "", units)
2758         dfs_cac = $9
2759         if (units == "mW") {
2760 -               if (power == 100) {
2761 -                       power = 20
2762 -               } else if (power == 200) {
2763 -                       power = 23
2764 -               } else if (power == 500) {
2765 -                       power = 27
2766 -               } else if (power == 1000) {
2767 -                       power = 30
2768 -               } else {
2769 -                       print "Unknown power value in database!"
2770 -               }
2771 +               power = 10 * log(power)/log(10)
2772         } else {
2773                 dfs_cac = $8
2774         }
2775 @@ -114,7 +104,7 @@ function parse_reg_rule()
2776  
2777         }
2778         flags = flags "0"
2779 -       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
2780 +       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %.0f, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
2781         rules++
2782  }
2783  
2784 --- a/net/mac80211/debugfs_netdev.c
2785 +++ b/net/mac80211/debugfs_netdev.c
2786 @@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
2787         ssize_t ret = -EINVAL;
2788  
2789         read_lock(&dev_base_lock);
2790 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
2791 -               ret = (*format)(sdata, buf, sizeof(buf));
2792 +       ret = (*format)(sdata, buf, sizeof(buf));
2793         read_unlock(&dev_base_lock);
2794  
2795         if (ret >= 0)
2796 @@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
2797  
2798         ret = -ENODEV;
2799         rtnl_lock();
2800 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
2801 -               ret = (*write)(sdata, buf, count);
2802 +       ret = (*write)(sdata, buf, count);
2803         rtnl_unlock();
2804  
2805         return ret;
2806 --- a/drivers/net/wireless/b43/xmit.c
2807 +++ b/drivers/net/wireless/b43/xmit.c
2808 @@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struc
2809                 break;
2810         case B43_PHYTYPE_G:
2811                 status.band = IEEE80211_BAND_2GHZ;
2812 -               /* chanid is the radio channel cookie value as used
2813 -                * to tune the radio. */
2814 -               status.freq = chanid + 2400;
2815 +               /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
2816 +                * has been modified to be compatible with N-PHY and others.
2817 +                */
2818 +               if (dev->fw.rev >= 508)
2819 +                       status.freq = ieee80211_channel_to_frequency(chanid, status.band);
2820 +               else
2821 +                       status.freq = chanid + 2400;
2822                 break;
2823         case B43_PHYTYPE_N:
2824         case B43_PHYTYPE_LP: