package/kernel/mac80211/patches/300-pending_work.patch

   1 --- a/net/mac80211/agg-rx.c
   2 +++ b/net/mac80211/agg-rx.c
   3 @@ -204,6 +204,8 @@ static void ieee80211_send_addba_resp(st
   4                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
   5         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
   6                 memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
   7 +       else if (sdata->vif.type == NL80211_IFTYPE_WDS)
   8 +               memcpy(mgmt->bssid, da, ETH_ALEN);
   9
  10         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  11                                           IEEE80211_STYPE_ACTION);
  12 --- a/net/mac80211/agg-tx.c
  13 +++ b/net/mac80211/agg-tx.c
  14 @@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
  15         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  16         if (sdata->vif.type == NL80211_IFTYPE_AP ||
  17             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  18 -           sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  19 +           sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
  20 +           sdata->vif.type == NL80211_IFTYPE_WDS)
  21                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  22         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  23                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  24 @@ -527,6 +528,7 @@ int ieee80211_start_tx_ba_session(struct
  25             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  26             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  27             sdata->vif.type != NL80211_IFTYPE_AP &&
  28 +           sdata->vif.type != NL80211_IFTYPE_WDS &&
  29             sdata->vif.type != NL80211_IFTYPE_ADHOC)
  30                 return -EINVAL;
  31
  32 --- a/net/mac80211/debugfs_sta.c
  33 +++ b/net/mac80211/debugfs_sta.c
  34 @@ -66,11 +66,11 @@ static ssize_t sta_flags_read(struct fil
  35         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  36
  37         int res = scnprintf(buf, sizeof(buf),
  38 -                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  39 +                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  40                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
  41                             TEST(PS_DRIVER), TEST(AUTHORIZED),
  42                             TEST(SHORT_PREAMBLE),
  43 -                           TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
  44 +                           TEST(WME), TEST(CLEAR_PS_FILT),
  45                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  46                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  47                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
  48 --- a/net/mac80211/iface.c
  49 +++ b/net/mac80211/iface.c
  50 @@ -463,7 +463,6 @@ int ieee80211_do_open(struct wireless_de
  51         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  52         struct net_device *dev = wdev->netdev;
  53         struct ieee80211_local *local = sdata->local;
  54 -       struct sta_info *sta;
  55         u32 changed = 0;
  56         int res;
  57         u32 hw_reconf_flags = 0;
  58 @@ -629,30 +628,8 @@ int ieee80211_do_open(struct wireless_de
  59
  60         set_bit(SDATA_STATE_RUNNING, &sdata->state);
  61
  62 -       if (sdata->vif.type == NL80211_IFTYPE_WDS) {
  63 -               /* Create STA entry for the WDS peer */
  64 -               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
  65 -                                    GFP_KERNEL);
  66 -               if (!sta) {
  67 -                       res = -ENOMEM;
  68 -                       goto err_del_interface;
  69 -               }
  70 -
  71 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
  72 -               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
  73 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
  74 -
  75 -               res = sta_info_insert(sta);
  76 -               if (res) {
  77 -                       /* STA has been freed */
  78 -                       goto err_del_interface;
  79 -               }
  80 -
  81 -               rate_control_rate_init(sta);
  82 -               netif_carrier_on(dev);
  83 -       } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
  84 +       if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
  85                 rcu_assign_pointer(local->p2p_sdata, sdata);
  86 -       }
  87
  88         /*
  89          * set_multicast_list will be invoked by the networking core
  90 @@ -1116,6 +1093,74 @@ static void ieee80211_if_setup(struct ne
  91         dev->destructor = free_netdev;
  92  }
  93
  94 +static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
  95 +                                        struct sk_buff *skb)
  96 +{
  97 +       struct ieee80211_local *local = sdata->local;
  98 +       struct ieee80211_rx_status *rx_status;
  99 +       struct ieee802_11_elems elems;
 100 +       struct ieee80211_mgmt *mgmt;
 101 +       struct sta_info *sta;
 102 +       size_t baselen;
 103 +       u32 rates = 0;
 104 +       u16 stype;
 105 +       bool new = false;
 106 +       enum ieee80211_band band;
 107 +       struct ieee80211_supported_band *sband;
 108 +
 109 +       rx_status = IEEE80211_SKB_RXCB(skb);
 110 +       band = rx_status->band;
 111 +       sband = local->hw.wiphy->bands[band];
 112 +       mgmt = (struct ieee80211_mgmt *) skb->data;
 113 +       stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 114 +
 115 +       if (stype != IEEE80211_STYPE_BEACON)
 116 +               return;
 117 +
 118 +       baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
 119 +       if (baselen > skb->len)
 120 +               return;
 121 +
 122 +       ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
 123 +                              skb->len - baselen, false, &elems);
 124 +
 125 +       rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 126 +
 127 +       rcu_read_lock();
 128 +
 129 +       sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
 130 +
 131 +       if (!sta) {
 132 +               rcu_read_unlock();
 133 +               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 134 +                                    GFP_KERNEL);
 135 +               if (!sta)
 136 +                       return;
 137 +
 138 +               new = true;
 139 +       }
 140 +
 141 +       sta->last_rx = jiffies;
 142 +       sta->sta.supp_rates[band] = rates;
 143 +
 144 +       if (elems.ht_cap_elem)
 145 +               ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
 146 +                               elems.ht_cap_elem, sta);
 147 +
 148 +       if (elems.wmm_param)
 149 +               set_sta_flag(sta, WLAN_STA_WME);
 150 +
 151 +       if (new) {
 152 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 153 +               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 154 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 155 +               rate_control_rate_init(sta);
 156 +               sta_info_insert_rcu(sta);
 157 +       }
 158 +
 159 +       rcu_read_unlock();
 160 +}
 161 +
 162  static void ieee80211_iface_work(struct work_struct *work)
 163  {
 164         struct ieee80211_sub_if_data *sdata =
 165 @@ -1220,6 +1265,9 @@ static void ieee80211_iface_work(struct
 166                                 break;
 167                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 168                         break;
 169 +               case NL80211_IFTYPE_WDS:
 170 +                       ieee80211_wds_rx_queued_mgmt(sdata, skb);
 171 +                       break;
 172                 default:
 173                         WARN(1, "frame for unexpected interface type");
 174                         break;
 175 --- a/net/mac80211/rc80211_minstrel_ht.c
 176 +++ b/net/mac80211/rc80211_minstrel_ht.c
 177 @@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct
 178
 179         sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
 180         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
 181 +       rate->count = 1;
 182 +
 183 +       if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
 184 +               int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
 185 +               rate->idx = mp->cck_rates[idx];
 186 +               rate->flags = 0;
 187 +               return;
 188 +       }
 189 +
 190         rate->idx = sample_idx % MCS_GROUP_RATES +
 191                     (sample_group->streams - 1) * MCS_GROUP_RATES;
 192         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
 193 -       rate->count = 1;
 194  }
 195
 196  static void
 197 --- a/net/mac80211/rx.c
 198 +++ b/net/mac80211/rx.c
 199 @@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx
 200         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 201         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 202
 203 -       /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
 204 -       if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
 205 +       /*
 206 +        * Drop duplicate 802.11 retransmissions
 207 +        * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
 208 +        */
 209 +       if (rx->skb->len >= 24 && rx->sta &&
 210 +           !ieee80211_is_ctl(hdr->frame_control) &&
 211 +           !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
 212 +           !is_multicast_ether_addr(hdr->addr1)) {
 213                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
 214                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
 215                              hdr->seq_ctrl)) {
 216 @@ -2369,6 +2375,7 @@ ieee80211_rx_h_action(struct ieee80211_r
 217                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
 218                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 219                     sdata->vif.type != NL80211_IFTYPE_AP &&
 220 +                   sdata->vif.type != NL80211_IFTYPE_WDS &&
 221                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
 222                         break;
 223
 224 @@ -2720,14 +2727,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
 225
 226         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
 227             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 228 -           sdata->vif.type != NL80211_IFTYPE_STATION)
 229 +           sdata->vif.type != NL80211_IFTYPE_STATION &&
 230 +           sdata->vif.type != NL80211_IFTYPE_WDS)
 231                 return RX_DROP_MONITOR;
 232
 233         switch (stype) {
 234         case cpu_to_le16(IEEE80211_STYPE_AUTH):
 235         case cpu_to_le16(IEEE80211_STYPE_BEACON):
 236         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 237 -               /* process for all: mesh, mlme, ibss */
 238 +               /* process for all: mesh, mlme, ibss, wds */
 239                 break;
 240         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 241         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
 242 @@ -3059,10 +3067,16 @@ static int prepare_for_handlers(struct i
 243                 }
 244                 break;
 245         case NL80211_IFTYPE_WDS:
 246 -               if (bssid || !ieee80211_is_data(hdr->frame_control))
 247 -                       return 0;
 248                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
 249                         return 0;
 250 +
 251 +               if (ieee80211_is_data(hdr->frame_control) ||
 252 +                   ieee80211_is_action(hdr->frame_control)) {
 253 +                       if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
 254 +                               return 0;
 255 +               } else if (!ieee80211_is_beacon(hdr->frame_control))
 256 +                       return 0;
 257 +
 258                 break;
 259         case NL80211_IFTYPE_P2P_DEVICE:
 260                 if (!ieee80211_is_public_action(hdr, skb->len) &&
 261 --- a/net/mac80211/sta_info.h
 262 +++ b/net/mac80211/sta_info.h
 263 @@ -32,7 +32,6 @@
 264   * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
 265   *     frames.
 266   * @WLAN_STA_WME: Station is a QoS-STA.
 267 - * @WLAN_STA_WDS: Station is one of our WDS peers.
 268   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
 269   *     IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
 270   *     frame to this station is transmitted.
 271 @@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
 272         WLAN_STA_AUTHORIZED,
 273         WLAN_STA_SHORT_PREAMBLE,
 274         WLAN_STA_WME,
 275 -       WLAN_STA_WDS,
 276         WLAN_STA_CLEAR_PS_FILT,
 277         WLAN_STA_MFP,
 278         WLAN_STA_BLOCK_BA,
 279 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 280 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
 281 @@ -135,6 +135,9 @@ static struct ath_frame_info *get_frame_
 282
 283  static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno)
 284  {
 285 +       if (!tid->an->sta)
 286 +               return;
 287 +
 288         ieee80211_send_bar(tid->an->vif, tid->an->sta->addr, tid->tidno,
 289                            seqno << IEEE80211_SEQ_SEQ_SHIFT);
 290  }
 291 @@ -146,6 +149,93 @@ static void ath_set_rates(struct ieee802
 292                                ARRAY_SIZE(bf->rates));
 293  }
 294
 295 +static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 296 +                            struct sk_buff *skb)
 297 +{
 298 +       int q;
 299 +
 300 +       q = skb_get_queue_mapping(skb);
 301 +       if (txq == sc->tx.uapsdq)
 302 +               txq = sc->tx.txq_map[q];
 303 +
 304 +       if (txq != sc->tx.txq_map[q])
 305 +               return;
 306 +
 307 +       if (WARN_ON(--txq->pending_frames < 0))
 308 +               txq->pending_frames = 0;
 309 +
 310 +       if (txq->stopped &&
 311 +           txq->pending_frames < sc->tx.txq_max_pending[q]) {
 312 +               ieee80211_wake_queue(sc->hw, q);
 313 +               txq->stopped = false;
 314 +       }
 315 +}
 316 +
 317 +static struct ath_atx_tid *
 318 +ath_get_skb_tid(struct ath_softc *sc, struct ath_node *an, struct sk_buff *skb)
 319 +{
 320 +       struct ieee80211_hdr *hdr;
 321 +       u8 tidno = 0;
 322 +
 323 +       hdr = (struct ieee80211_hdr *) skb->data;
 324 +       if (ieee80211_is_data_qos(hdr->frame_control))
 325 +               tidno = ieee80211_get_qos_ctl(hdr)[0];
 326 +
 327 +       tidno &= IEEE80211_QOS_CTL_TID_MASK;
 328 +       return ATH_AN_2_TID(an, tidno);
 329 +}
 330 +
 331 +static bool ath_tid_has_buffered(struct ath_atx_tid *tid)
 332 +{
 333 +       return !skb_queue_empty(&tid->buf_q) || !skb_queue_empty(&tid->retry_q);
 334 +}
 335 +
 336 +static struct sk_buff *ath_tid_dequeue(struct ath_atx_tid *tid)
 337 +{
 338 +       struct sk_buff *skb;
 339 +
 340 +       skb = __skb_dequeue(&tid->retry_q);
 341 +       if (!skb)
 342 +               skb = __skb_dequeue(&tid->buf_q);
 343 +
 344 +       return skb;
 345 +}
 346 +
 347 +/*
 348 + * ath_tx_tid_change_state:
 349 + * - clears a-mpdu flag of previous session
 350 + * - force sequence number allocation to fix next BlockAck Window
 351 + */
 352 +static void
 353 +ath_tx_tid_change_state(struct ath_softc *sc, struct ath_atx_tid *tid)
 354 +{
 355 +       struct ath_txq *txq = tid->ac->txq;
 356 +       struct ieee80211_tx_info *tx_info;
 357 +       struct sk_buff *skb, *tskb;
 358 +       struct ath_buf *bf;
 359 +       struct ath_frame_info *fi;
 360 +
 361 +       skb_queue_walk_safe(&tid->buf_q, skb, tskb) {
 362 +               fi = get_frame_info(skb);
 363 +               bf = fi->bf;
 364 +
 365 +               tx_info = IEEE80211_SKB_CB(skb);
 366 +               tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
 367 +
 368 +               if (bf)
 369 +                       continue;
 370 +
 371 +               bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 372 +               if (!bf) {
 373 +                       __skb_unlink(skb, &tid->buf_q);
 374 +                       ath_txq_skb_done(sc, txq, skb);
 375 +                       ieee80211_free_txskb(sc->hw, skb);
 376 +                       continue;
 377 +               }
 378 +       }
 379 +
 380 +}
 381 +
 382  static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 383  {
 384         struct ath_txq *txq = tid->ac->txq;
 385 @@ -160,27 +250,22 @@ static void ath_tx_flush_tid(struct ath_
 386
 387         memset(&ts, 0, sizeof(ts));
 388
 389 -       while ((skb = __skb_dequeue(&tid->buf_q))) {
 390 +       while ((skb = __skb_dequeue(&tid->retry_q))) {
 391                 fi = get_frame_info(skb);
 392                 bf = fi->bf;
 393 -
 394                 if (!bf) {
 395 -                       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 396 -                       if (!bf) {
 397 -                               ieee80211_free_txskb(sc->hw, skb);
 398 -                               continue;
 399 -                       }
 400 +                       ath_txq_skb_done(sc, txq, skb);
 401 +                       ieee80211_free_txskb(sc->hw, skb);
 402 +                       continue;
 403                 }
 404
 405 -               if (fi->retries) {
 406 -                       list_add_tail(&bf->list, &bf_head);
 407 +               if (fi->baw_tracked) {
 408                         ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
 409 -                       ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 410                         sendbar = true;
 411 -               } else {
 412 -                       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 413 -                       ath_tx_send_normal(sc, txq, NULL, skb);
 414                 }
 415 +
 416 +               list_add_tail(&bf->list, &bf_head);
 417 +               ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 418         }
 419
 420         if (sendbar) {
 421 @@ -209,13 +294,16 @@ static void ath_tx_update_baw(struct ath
 422  }
 423
 424  static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
 425 -                            u16 seqno)
 426 +                            struct ath_buf *bf)
 427  {
 428 +       struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
 429 +       u16 seqno = bf->bf_state.seqno;
 430         int index, cindex;
 431
 432         index  = ATH_BA_INDEX(tid->seq_start, seqno);
 433         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
 434         __set_bit(cindex, tid->tx_buf);
 435 +       fi->baw_tracked = 1;
 436
 437         if (index >= ((tid->baw_tail - tid->baw_head) &
 438                 (ATH_TID_MAX_BUFS - 1))) {
 439 @@ -224,12 +312,6 @@ static void ath_tx_addto_baw(struct ath_
 440         }
 441  }
 442
 443 -/*
 444 - * TODO: For frame(s) that are in the retry state, we will reuse the
 445 - * sequence number(s) without setting the retry bit. The
 446 - * alternative is to give up on these and BAR the receiver's window
 447 - * forward.
 448 - */
 449  static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
 450                           struct ath_atx_tid *tid)
 451
 452 @@ -243,7 +325,7 @@ static void ath_tid_drain(struct ath_sof
 453         memset(&ts, 0, sizeof(ts));
 454         INIT_LIST_HEAD(&bf_head);
 455
 456 -       while ((skb = __skb_dequeue(&tid->buf_q))) {
 457 +       while ((skb = ath_tid_dequeue(tid))) {
 458                 fi = get_frame_info(skb);
 459                 bf = fi->bf;
 460
 461 @@ -253,14 +335,8 @@ static void ath_tid_drain(struct ath_sof
 462                 }
 463
 464                 list_add_tail(&bf->list, &bf_head);
 465 -
 466 -               ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
 467                 ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 468         }
 469 -
 470 -       tid->seq_next = tid->seq_start;
 471 -       tid->baw_tail = tid->baw_head;
 472 -       tid->bar_index = -1;
 473  }
 474
 475  static void ath_tx_set_retry(struct ath_softc *sc, struct ath_txq *txq,
 476 @@ -380,7 +456,6 @@ static void ath_tx_complete_aggr(struct
 477         struct ieee80211_tx_rate rates[4];
 478         struct ath_frame_info *fi;
 479         int nframes;
 480 -       u8 tidno;
 481         bool flush = !!(ts->ts_status & ATH9K_TX_FLUSH);
 482         int i, retries;
 483         int bar_index = -1;
 484 @@ -406,7 +481,7 @@ static void ath_tx_complete_aggr(struct
 485                 while (bf) {
 486                         bf_next = bf->bf_next;
 487
 488 -                       if (!bf->bf_stale || bf_next != NULL)
 489 +                       if (!bf->bf_state.stale || bf_next != NULL)
 490                                 list_move_tail(&bf->list, &bf_head);
 491
 492                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts, 0);
 493 @@ -417,8 +492,7 @@ static void ath_tx_complete_aggr(struct
 494         }
 495
 496         an = (struct ath_node *)sta->drv_priv;
 497 -       tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
 498 -       tid = ATH_AN_2_TID(an, tidno);
 499 +       tid = ath_get_skb_tid(sc, an, skb);
 500         seq_first = tid->seq_start;
 501         isba = ts->ts_flags & ATH9K_TX_BA;
 502
 503 @@ -430,7 +504,7 @@ static void ath_tx_complete_aggr(struct
 504          * Only BlockAcks have a TID and therefore normal Acks cannot be
 505          * checked
 506          */
 507 -       if (isba && tidno != ts->tid)
 508 +       if (isba && tid->tidno != ts->tid)
 509                 txok = false;
 510
 511         isaggr = bf_isaggr(bf);
 512 @@ -466,7 +540,8 @@ static void ath_tx_complete_aggr(struct
 513                 tx_info = IEEE80211_SKB_CB(skb);
 514                 fi = get_frame_info(skb);
 515
 516 -               if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
 517 +               if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno) ||
 518 +                   !tid->active) {
 519                         /*
 520                          * Outside of the current BlockAck window,
 521                          * maybe part of a previous session
 522 @@ -499,7 +574,7 @@ static void ath_tx_complete_aggr(struct
 523                  * not a holding desc.
 524                  */
 525                 INIT_LIST_HEAD(&bf_head);
 526 -               if (bf_next != NULL || !bf_last->bf_stale)
 527 +               if (bf_next != NULL || !bf_last->bf_state.stale)
 528                         list_move_tail(&bf->list, &bf_head);
 529
 530                 if (!txpending) {
 531 @@ -523,7 +598,7 @@ static void ath_tx_complete_aggr(struct
 532                                 ieee80211_sta_eosp(sta);
 533                         }
 534                         /* retry the un-acked ones */
 535 -                       if (bf->bf_next == NULL && bf_last->bf_stale) {
 536 +                       if (bf->bf_next == NULL && bf_last->bf_state.stale) {
 537                                 struct ath_buf *tbf;
 538
 539                                 tbf = ath_clone_txbuf(sc, bf_last);
 540 @@ -560,7 +635,7 @@ static void ath_tx_complete_aggr(struct
 541                 if (an->sleeping)
 542                         ieee80211_sta_set_buffered(sta, tid->tidno, true);
 543
 544 -               skb_queue_splice(&bf_pending, &tid->buf_q);
 545 +               skb_queue_splice_tail(&bf_pending, &tid->retry_q);
 546                 if (!an->sleeping) {
 547                         ath_tx_queue_tid(txq, tid);
 548
 549 @@ -618,7 +693,7 @@ static void ath_tx_process_buffer(struct
 550         } else
 551                 ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok);
 552
 553 -       if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) && !flush)
 554 +       if (!flush)
 555                 ath_txq_schedule(sc, txq);
 556  }
 557
 558 @@ -792,15 +867,20 @@ static int ath_compute_num_delims(struct
 559
 560  static struct ath_buf *
 561  ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 562 -                       struct ath_atx_tid *tid)
 563 +                       struct ath_atx_tid *tid, struct sk_buff_head **q)
 564  {
 565 +       struct ieee80211_tx_info *tx_info;
 566         struct ath_frame_info *fi;
 567         struct sk_buff *skb;
 568         struct ath_buf *bf;
 569         u16 seqno;
 570
 571         while (1) {
 572 -               skb = skb_peek(&tid->buf_q);
 573 +               *q = &tid->retry_q;
 574 +               if (skb_queue_empty(*q))
 575 +                       *q = &tid->buf_q;
 576 +
 577 +               skb = skb_peek(*q);
 578                 if (!skb)
 579                         break;
 580
 581 @@ -808,13 +888,26 @@ ath_tx_get_tid_subframe(struct ath_softc
 582                 bf = fi->bf;
 583                 if (!fi->bf)
 584                         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 585 +               else
 586 +                       bf->bf_state.stale = false;
 587
 588                 if (!bf) {
 589 -                       __skb_unlink(skb, &tid->buf_q);
 590 +                       __skb_unlink(skb, *q);
 591 +                       ath_txq_skb_done(sc, txq, skb);
 592                         ieee80211_free_txskb(sc->hw, skb);
 593                         continue;
 594                 }
 595
 596 +               bf->bf_next = NULL;
 597 +               bf->bf_lastbf = bf;
 598 +
 599 +               tx_info = IEEE80211_SKB_CB(skb);
 600 +               tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
 601 +               if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
 602 +                       bf->bf_state.bf_type = 0;
 603 +                       return bf;
 604 +               }
 605 +
 606                 bf->bf_state.bf_type = BUF_AMPDU | BUF_AGGR;
 607                 seqno = bf->bf_state.seqno;
 608
 609 @@ -828,73 +921,52 @@ ath_tx_get_tid_subframe(struct ath_softc
 610
 611                         INIT_LIST_HEAD(&bf_head);
 612                         list_add(&bf->list, &bf_head);
 613 -                       __skb_unlink(skb, &tid->buf_q);
 614 +                       __skb_unlink(skb, *q);
 615                         ath_tx_update_baw(sc, tid, seqno);
 616                         ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 617                         continue;
 618                 }
 619
 620 -               bf->bf_next = NULL;
 621 -               bf->bf_lastbf = bf;
 622                 return bf;
 623         }
 624
 625         return NULL;
 626  }
 627
 628 -static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
 629 -                                            struct ath_txq *txq,
 630 -                                            struct ath_atx_tid *tid,
 631 -                                            struct list_head *bf_q,
 632 -                                            int *aggr_len)
 633 +static bool
 634 +ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
 635 +                struct ath_atx_tid *tid, struct list_head *bf_q,
 636 +                struct ath_buf *bf_first, struct sk_buff_head *tid_q,
 637 +                int *aggr_len)
 638  {
 639  #define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
 640 -       struct ath_buf *bf, *bf_first = NULL, *bf_prev = NULL;
 641 -       int rl = 0, nframes = 0, ndelim, prev_al = 0;
 642 +       struct ath_buf *bf = bf_first, *bf_prev = NULL;
 643 +       int nframes = 0, ndelim;
 644         u16 aggr_limit = 0, al = 0, bpad = 0,
 645 -               al_delta, h_baw = tid->baw_size / 2;
 646 -       enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
 647 +           al_delta, h_baw = tid->baw_size / 2;
 648         struct ieee80211_tx_info *tx_info;
 649         struct ath_frame_info *fi;
 650         struct sk_buff *skb;
 651 +       bool closed = false;
 652
 653 -       do {
 654 -               bf = ath_tx_get_tid_subframe(sc, txq, tid);
 655 -               if (!bf) {
 656 -                       status = ATH_AGGR_BAW_CLOSED;
 657 -                       break;
 658 -               }
 659 +       bf = bf_first;
 660 +       aggr_limit = ath_lookup_rate(sc, bf, tid);
 661
 662 +       do {
 663                 skb = bf->bf_mpdu;
 664                 fi = get_frame_info(skb);
 665
 666 -               if (!bf_first)
 667 -                       bf_first = bf;
 668 -
 669 -               if (!rl) {
 670 -                       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 671 -                       aggr_limit = ath_lookup_rate(sc, bf, tid);
 672 -                       rl = 1;
 673 -               }
 674 -
 675                 /* do not exceed aggregation limit */
 676                 al_delta = ATH_AGGR_DELIM_SZ + fi->framelen;
 677 +               if (nframes) {
 678 +                       if (aggr_limit < al + bpad + al_delta ||
 679 +                           ath_lookup_legacy(bf) || nframes >= h_baw)
 680 +                               break;
 681
 682 -               if (nframes &&
 683 -                   ((aggr_limit < (al + bpad + al_delta + prev_al)) ||
 684 -                    ath_lookup_legacy(bf))) {
 685 -                       status = ATH_AGGR_LIMITED;
 686 -                       break;
 687 -               }
 688 -
 689 -               tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 690 -               if (nframes && (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
 691 -                       break;
 692 -
 693 -               /* do not exceed subframe limit */
 694 -               if (nframes >= min((int)h_baw, ATH_AMPDU_SUBFRAME_DEFAULT)) {
 695 -                       status = ATH_AGGR_LIMITED;
 696 -                       break;
 697 +                       tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 698 +                       if ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
 699 +                           !(tx_info->flags & IEEE80211_TX_CTL_AMPDU))
 700 +                               break;
 701                 }
 702
 703                 /* add padding for previous frame to aggregation length */
 704 @@ -912,22 +984,37 @@ static enum ATH_AGGR_STATUS ath_tx_form_
 705                 bf->bf_next = NULL;
 706
 707                 /* link buffers of this frame to the aggregate */
 708 -               if (!fi->retries)
 709 -                       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
 710 +               if (!fi->baw_tracked)
 711 +                       ath_tx_addto_baw(sc, tid, bf);
 712                 bf->bf_state.ndelim = ndelim;
 713
 714 -               __skb_unlink(skb, &tid->buf_q);
 715 +               __skb_unlink(skb, tid_q);
 716                 list_add_tail(&bf->list, bf_q);
 717                 if (bf_prev)
 718                         bf_prev->bf_next = bf;
 719
 720                 bf_prev = bf;
 721
 722 -       } while (!skb_queue_empty(&tid->buf_q));
 723 +               bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 724 +               if (!bf) {
 725 +                       closed = true;
 726 +                       break;
 727 +               }
 728 +       } while (ath_tid_has_buffered(tid));
 729 +
 730 +       bf = bf_first;
 731 +       bf->bf_lastbf = bf_prev;
 732 +
 733 +       if (bf == bf_prev) {
 734 +               al = get_frame_info(bf->bf_mpdu)->framelen;
 735 +               bf->bf_state.bf_type = BUF_AMPDU;
 736 +       } else {
 737 +               TX_STAT_INC(txq->axq_qnum, a_aggr);
 738 +       }
 739
 740         *aggr_len = al;
 741
 742 -       return status;
 743 +       return closed;
 744  #undef PADBYTES
 745  }
 746
 747 @@ -1188,53 +1275,86 @@ static void ath_tx_fill_desc(struct ath_
 748         }
 749  }
 750
 751 -static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 752 -                             struct ath_atx_tid *tid)
 753 +static void
 754 +ath_tx_form_burst(struct ath_softc *sc, struct ath_txq *txq,
 755 +                 struct ath_atx_tid *tid, struct list_head *bf_q,
 756 +                 struct ath_buf *bf_first, struct sk_buff_head *tid_q)
 757  {
 758 -       struct ath_buf *bf;
 759 -       enum ATH_AGGR_STATUS status;
 760 -       struct ieee80211_tx_info *tx_info;
 761 -       struct list_head bf_q;
 762 -       int aggr_len;
 763 +       struct ath_buf *bf = bf_first, *bf_prev = NULL;
 764 +       struct sk_buff *skb;
 765 +       int nframes = 0;
 766
 767         do {
 768 -               if (skb_queue_empty(&tid->buf_q))
 769 -                       return;
 770 +               struct ieee80211_tx_info *tx_info;
 771 +               skb = bf->bf_mpdu;
 772
 773 -               INIT_LIST_HEAD(&bf_q);
 774 +               nframes++;
 775 +               __skb_unlink(skb, tid_q);
 776 +               list_add_tail(&bf->list, bf_q);
 777 +               if (bf_prev)
 778 +                       bf_prev->bf_next = bf;
 779 +               bf_prev = bf;
 780
 781 -               status = ath_tx_form_aggr(sc, txq, tid, &bf_q, &aggr_len);
 782 +               if (nframes >= 2)
 783 +                       break;
 784
 785 -               /*
 786 -                * no frames picked up to be aggregated;
 787 -                * block-ack window is not open.
 788 -                */
 789 -               if (list_empty(&bf_q))
 790 +               bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 791 +               if (!bf)
 792                         break;
 793
 794 -               bf = list_first_entry(&bf_q, struct ath_buf, list);
 795 -               bf->bf_lastbf = list_entry(bf_q.prev, struct ath_buf, list);
 796                 tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 797 +               if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
 798 +                       break;
 799
 800 -               if (tid->ac->clear_ps_filter) {
 801 -                       tid->ac->clear_ps_filter = false;
 802 -                       tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 803 -               } else {
 804 -                       tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
 805 -               }
 806 +               ath_set_rates(tid->an->vif, tid->an->sta, bf);
 807 +       } while (1);
 808 +}
 809
 810 -               /* if only one frame, send as non-aggregate */
 811 -               if (bf == bf->bf_lastbf) {
 812 -                       aggr_len = get_frame_info(bf->bf_mpdu)->framelen;
 813 -                       bf->bf_state.bf_type = BUF_AMPDU;
 814 -               } else {
 815 -                       TX_STAT_INC(txq->axq_qnum, a_aggr);
 816 -               }
 817 +static bool ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 818 +                             struct ath_atx_tid *tid, bool *stop)
 819 +{
 820 +       struct ath_buf *bf;
 821 +       struct ieee80211_tx_info *tx_info;
 822 +       struct sk_buff_head *tid_q;
 823 +       struct list_head bf_q;
 824 +       int aggr_len = 0;
 825 +       bool aggr, last = true;
 826 +
 827 +       if (!ath_tid_has_buffered(tid))
 828 +               return false;
 829 +
 830 +       INIT_LIST_HEAD(&bf_q);
 831 +
 832 +       bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 833 +       if (!bf)
 834 +               return false;
 835 +
 836 +       tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 837 +       aggr = !!(tx_info->flags & IEEE80211_TX_CTL_AMPDU);
 838 +       if ((aggr && txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) ||
 839 +               (!aggr && txq->axq_depth >= ATH_NON_AGGR_MIN_QDEPTH)) {
 840 +               *stop = true;
 841 +               return false;
 842 +       }
 843 +
 844 +       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 845 +       if (aggr)
 846 +               last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
 847 +                                       tid_q, &aggr_len);
 848 +       else
 849 +               ath_tx_form_burst(sc, txq, tid, &bf_q, bf, tid_q);
 850
 851 -               ath_tx_fill_desc(sc, bf, txq, aggr_len);
 852 -               ath_tx_txqaddbuf(sc, txq, &bf_q, false);
 853 -       } while (txq->axq_ampdu_depth < ATH_AGGR_MIN_QDEPTH &&
 854 -                status != ATH_AGGR_BAW_CLOSED);
 855 +       if (list_empty(&bf_q))
 856 +               return false;
 857 +
 858 +       if (tid->ac->clear_ps_filter || tid->an->no_ps_filter) {
 859 +               tid->ac->clear_ps_filter = false;
 860 +               tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 861 +       }
 862 +
 863 +       ath_tx_fill_desc(sc, bf, txq, aggr_len);
 864 +       ath_tx_txqaddbuf(sc, txq, &bf_q, false);
 865 +       return true;
 866  }
 867
 868  int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
 869 @@ -1258,6 +1378,9 @@ int ath_tx_aggr_start(struct ath_softc *
 870                 an->mpdudensity = density;
 871         }
 872
 873 +       /* force sequence number allocation for pending frames */
 874 +       ath_tx_tid_change_state(sc, txtid);
 875 +
 876         txtid->active = true;
 877         txtid->paused = true;
 878         *ssn = txtid->seq_start = txtid->seq_next;
 879 @@ -1277,8 +1400,9 @@ void ath_tx_aggr_stop(struct ath_softc *
 880
 881         ath_txq_lock(sc, txq);
 882         txtid->active = false;
 883 -       txtid->paused = true;
 884 +       txtid->paused = false;
 885         ath_tx_flush_tid(sc, txtid);
 886 +       ath_tx_tid_change_state(sc, txtid);
 887         ath_txq_unlock_complete(sc, txq);
 888  }
 889
 890 @@ -1302,7 +1426,7 @@ void ath_tx_aggr_sleep(struct ieee80211_
 891
 892                 ath_txq_lock(sc, txq);
 893
 894 -               buffered = !skb_queue_empty(&tid->buf_q);
 895 +               buffered = ath_tid_has_buffered(tid);
 896
 897                 tid->sched = false;
 898                 list_del(&tid->list);
 899 @@ -1334,7 +1458,7 @@ void ath_tx_aggr_wakeup(struct ath_softc
 900                 ath_txq_lock(sc, txq);
 901                 ac->clear_ps_filter = true;
 902
 903 -               if (!skb_queue_empty(&tid->buf_q) && !tid->paused) {
 904 +               if (!tid->paused && ath_tid_has_buffered(tid)) {
 905                         ath_tx_queue_tid(txq, tid);
 906                         ath_txq_schedule(sc, txq);
 907                 }
 908 @@ -1359,7 +1483,7 @@ void ath_tx_aggr_resume(struct ath_softc
 909         tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
 910         tid->paused = false;
 911
 912 -       if (!skb_queue_empty(&tid->buf_q)) {
 913 +       if (ath_tid_has_buffered(tid)) {
 914                 ath_tx_queue_tid(txq, tid);
 915                 ath_txq_schedule(sc, txq);
 916         }
 917 @@ -1379,6 +1503,7 @@ void ath9k_release_buffered_frames(struc
 918         struct ieee80211_tx_info *info;
 919         struct list_head bf_q;
 920         struct ath_buf *bf_tail = NULL, *bf;
 921 +       struct sk_buff_head *tid_q;
 922         int sent = 0;
 923         int i;
 924
 925 @@ -1394,15 +1519,15 @@ void ath9k_release_buffered_frames(struc
 926                         continue;
 927
 928                 ath_txq_lock(sc, tid->ac->txq);
 929 -               while (!skb_queue_empty(&tid->buf_q) && nframes > 0) {
 930 -                       bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid);
 931 +               while (nframes > 0) {
 932 +                       bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid, &tid_q);
 933                         if (!bf)
 934                                 break;
 935
 936 -                       __skb_unlink(bf->bf_mpdu, &tid->buf_q);
 937 +                       __skb_unlink(bf->bf_mpdu, tid_q);
 938                         list_add_tail(&bf->list, &bf_q);
 939                         ath_set_rates(tid->an->vif, tid->an->sta, bf);
 940 -                       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
 941 +                       ath_tx_addto_baw(sc, tid, bf);
 942                         bf->bf_state.bf_type &= ~BUF_AGGR;
 943                         if (bf_tail)
 944                                 bf_tail->bf_next = bf;
 945 @@ -1412,7 +1537,7 @@ void ath9k_release_buffered_frames(struc
 946                         sent++;
 947                         TX_STAT_INC(txq->axq_qnum, a_queued_hw);
 948
 949 -                       if (skb_queue_empty(&tid->buf_q))
 950 +                       if (an->sta && !ath_tid_has_buffered(tid))
 951                                 ieee80211_sta_set_buffered(an->sta, i, false);
 952                 }
 953                 ath_txq_unlock_complete(sc, tid->ac->txq);
 954 @@ -1571,7 +1696,7 @@ static void ath_drain_txq_list(struct at
 955         while (!list_empty(list)) {
 956                 bf = list_first_entry(list, struct ath_buf, list);
 957
 958 -               if (bf->bf_stale) {
 959 +               if (bf->bf_state.stale) {
 960                         list_del(&bf->list);
 961
 962                         ath_tx_return_buffer(sc, bf);
 963 @@ -1665,25 +1790,27 @@ void ath_tx_cleanupq(struct ath_softc *s
 964   */
 965  void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
 966  {
 967 -       struct ath_atx_ac *ac, *ac_tmp, *last_ac;
 968 +       struct ath_atx_ac *ac, *last_ac;
 969         struct ath_atx_tid *tid, *last_tid;
 970 +       bool sent = false;
 971
 972         if (test_bit(SC_OP_HW_RESET, &sc->sc_flags) ||
 973 -           list_empty(&txq->axq_acq) ||
 974 -           txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
 975 +           list_empty(&txq->axq_acq))
 976                 return;
 977
 978         rcu_read_lock();
 979
 980 -       ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
 981         last_ac = list_entry(txq->axq_acq.prev, struct ath_atx_ac, list);
 982 +       while (!list_empty(&txq->axq_acq)) {
 983 +               bool stop = false;
 984
 985 -       list_for_each_entry_safe(ac, ac_tmp, &txq->axq_acq, list) {
 986 +               ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
 987                 last_tid = list_entry(ac->tid_q.prev, struct ath_atx_tid, list);
 988                 list_del(&ac->list);
 989                 ac->sched = false;
 990
 991                 while (!list_empty(&ac->tid_q)) {
 992 +
 993                         tid = list_first_entry(&ac->tid_q, struct ath_atx_tid,
 994                                                list);
 995                         list_del(&tid->list);
 996 @@ -1692,17 +1819,17 @@ void ath_txq_schedule(struct ath_softc *
 997                         if (tid->paused)
 998                                 continue;
 999
1000 -                       ath_tx_sched_aggr(sc, txq, tid);
1001 +                       if (ath_tx_sched_aggr(sc, txq, tid, &stop))
1002 +                               sent = true;
1003
1004                         /*
1005                          * add tid to round-robin queue if more frames
1006                          * are pending for the tid
1007                          */
1008 -                       if (!skb_queue_empty(&tid->buf_q))
1009 +                       if (ath_tid_has_buffered(tid))
1010                                 ath_tx_queue_tid(txq, tid);
1011
1012 -                       if (tid == last_tid ||
1013 -                           txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
1014 +                       if (stop || tid == last_tid)
1015                                 break;
1016                 }
1017
1018 @@ -1711,9 +1838,17 @@ void ath_txq_schedule(struct ath_softc *
1019                         list_add_tail(&ac->list, &txq->axq_acq);
1020                 }
1021
1022 -               if (ac == last_ac ||
1023 -                   txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
1024 +               if (stop)
1025                         break;
1026 +
1027 +               if (ac == last_ac) {
1028 +                       if (!sent)
1029 +                               break;
1030 +
1031 +                       sent = false;
1032 +                       last_ac = list_entry(txq->axq_acq.prev,
1033 +                                            struct ath_atx_ac, list);
1034 +               }
1035         }
1036
1037         rcu_read_unlock();
1038 @@ -1792,57 +1927,6 @@ static void ath_tx_txqaddbuf(struct ath_
1039         }
1040  }
1041
1042 -static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
1043 -                             struct ath_atx_tid *tid, struct sk_buff *skb,
1044 -                             struct ath_tx_control *txctl)
1045 -{
1046 -       struct ath_frame_info *fi = get_frame_info(skb);
1047 -       struct list_head bf_head;
1048 -       struct ath_buf *bf;
1049 -
1050 -       /*
1051 -        * Do not queue to h/w when any of the following conditions is true:
1052 -        * - there are pending frames in software queue
1053 -        * - the TID is currently paused for ADDBA/BAR request
1054 -        * - seqno is not within block-ack window
1055 -        * - h/w queue depth exceeds low water mark
1056 -        */
1057 -       if ((!skb_queue_empty(&tid->buf_q) || tid->paused ||
1058 -            !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
1059 -            txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) &&
1060 -           txq != sc->tx.uapsdq) {
1061 -               /*
1062 -                * Add this frame to software queue for scheduling later
1063 -                * for aggregation.
1064 -                */
1065 -               TX_STAT_INC(txq->axq_qnum, a_queued_sw);
1066 -               __skb_queue_tail(&tid->buf_q, skb);
1067 -               if (!txctl->an || !txctl->an->sleeping)
1068 -                       ath_tx_queue_tid(txq, tid);
1069 -               return;
1070 -       }
1071 -
1072 -       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
1073 -       if (!bf) {
1074 -               ieee80211_free_txskb(sc->hw, skb);
1075 -               return;
1076 -       }
1077 -
1078 -       ath_set_rates(tid->an->vif, tid->an->sta, bf);
1079 -       bf->bf_state.bf_type = BUF_AMPDU;
1080 -       INIT_LIST_HEAD(&bf_head);
1081 -       list_add(&bf->list, &bf_head);
1082 -
1083 -       /* Add sub-frame to BAW */
1084 -       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
1085 -
1086 -       /* Queue to h/w without aggregation */
1087 -       TX_STAT_INC(txq->axq_qnum, a_queued_hw);
1088 -       bf->bf_lastbf = bf;
1089 -       ath_tx_fill_desc(sc, bf, txq, fi->framelen);
1090 -       ath_tx_txqaddbuf(sc, txq, &bf_head, false);
1091 -}
1092 -
1093  static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
1094                                struct ath_atx_tid *tid, struct sk_buff *skb)
1095  {
1096 @@ -1985,6 +2069,7 @@ static int ath_tx_prepare(struct ieee802
1097         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1098         struct ieee80211_sta *sta = txctl->sta;
1099         struct ieee80211_vif *vif = info->control.vif;
1100 +       struct ath_vif *avp;
1101         struct ath_softc *sc = hw->priv;
1102         int frmlen = skb->len + FCS_LEN;
1103         int padpos, padsize;
1104 @@ -1992,6 +2077,10 @@ static int ath_tx_prepare(struct ieee802
1105         /* NOTE:  sta can be NULL according to net/mac80211.h */
1106         if (sta)
1107                 txctl->an = (struct ath_node *)sta->drv_priv;
1108 +       else if (vif && ieee80211_is_data(hdr->frame_control)) {
1109 +               avp = (void *)vif->drv_priv;
1110 +               txctl->an = &avp->mcast_node;
1111 +       }
1112
1113         if (info->control.hw_key)
1114                 frmlen += info->control.hw_key->icv_len;
1115 @@ -2041,7 +2130,6 @@ int ath_tx_start(struct ieee80211_hw *hw
1116         struct ath_txq *txq = txctl->txq;
1117         struct ath_atx_tid *tid = NULL;
1118         struct ath_buf *bf;
1119 -       u8 tidno;
1120         int q;
1121         int ret;
1122
1123 @@ -2069,27 +2157,31 @@ int ath_tx_start(struct ieee80211_hw *hw
1124                 ath_txq_unlock(sc, txq);
1125                 txq = sc->tx.uapsdq;
1126                 ath_txq_lock(sc, txq);
1127 -       }
1128 -
1129 -       if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
1130 -               tidno = ieee80211_get_qos_ctl(hdr)[0] &
1131 -                       IEEE80211_QOS_CTL_TID_MASK;
1132 -               tid = ATH_AN_2_TID(txctl->an, tidno);
1133 +       } else if (txctl->an &&
1134 +                  ieee80211_is_data_present(hdr->frame_control)) {
1135 +               tid = ath_get_skb_tid(sc, txctl->an, skb);
1136
1137                 WARN_ON(tid->ac->txq != txctl->txq);
1138 -       }
1139
1140 -       if ((info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
1141 +               if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
1142 +                       tid->ac->clear_ps_filter = true;
1143 +
1144                 /*
1145 -                * Try aggregation if it's a unicast data frame
1146 -                * and the destination is HT capable.
1147 +                * Add this frame to software queue for scheduling later
1148 +                * for aggregation.
1149                  */
1150 -               ath_tx_send_ampdu(sc, txq, tid, skb, txctl);
1151 +               TX_STAT_INC(txq->axq_qnum, a_queued_sw);
1152 +               __skb_queue_tail(&tid->buf_q, skb);
1153 +               if (!txctl->an->sleeping)
1154 +                       ath_tx_queue_tid(txq, tid);
1155 +
1156 +               ath_txq_schedule(sc, txq);
1157                 goto out;
1158         }
1159
1160         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
1161         if (!bf) {
1162 +               ath_txq_skb_done(sc, txq, skb);
1163                 if (txctl->paprd)
1164                         dev_kfree_skb_any(skb);
1165                 else
1166 @@ -2189,7 +2281,7 @@ static void ath_tx_complete(struct ath_s
1167         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
1168         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
1169         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
1170 -       int q, padpos, padsize;
1171 +       int padpos, padsize;
1172         unsigned long flags;
1173
1174         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
1175 @@ -2225,21 +2317,7 @@ static void ath_tx_complete(struct ath_s
1176         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1177
1178         __skb_queue_tail(&txq->complete_q, skb);
1179 -
1180 -       q = skb_get_queue_mapping(skb);
1181 -       if (txq == sc->tx.uapsdq)
1182 -               txq = sc->tx.txq_map[q];
1183 -
1184 -       if (txq == sc->tx.txq_map[q]) {
1185 -               if (WARN_ON(--txq->pending_frames < 0))
1186 -                       txq->pending_frames = 0;
1187 -
1188 -               if (txq->stopped &&
1189 -                   txq->pending_frames < sc->tx.txq_max_pending[q]) {
1190 -                       ieee80211_wake_queue(sc->hw, q);
1191 -                       txq->stopped = false;
1192 -               }
1193 -       }
1194 +       ath_txq_skb_done(sc, txq, skb);
1195  }
1196
1197  static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
1198 @@ -2360,8 +2438,7 @@ static void ath_tx_processq(struct ath_s
1199
1200                 if (list_empty(&txq->axq_q)) {
1201                         txq->axq_link = NULL;
1202 -                       if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
1203 -                               ath_txq_schedule(sc, txq);
1204 +                       ath_txq_schedule(sc, txq);
1205                         break;
1206                 }
1207                 bf = list_first_entry(&txq->axq_q, struct ath_buf, list);
1208 @@ -2375,7 +2452,7 @@ static void ath_tx_processq(struct ath_s
1209                  * it with the STALE flag.
1210                  */
1211                 bf_held = NULL;
1212 -               if (bf->bf_stale) {
1213 +               if (bf->bf_state.stale) {
1214                         bf_held = bf;
1215                         if (list_is_last(&bf_held->list, &txq->axq_q))
1216                                 break;
1217 @@ -2399,7 +2476,7 @@ static void ath_tx_processq(struct ath_s
1218                  * however leave the last descriptor back as the holding
1219                  * descriptor for hw.
1220                  */
1221 -               lastbf->bf_stale = true;
1222 +               lastbf->bf_state.stale = true;
1223                 INIT_LIST_HEAD(&bf_head);
1224                 if (!list_is_singular(&lastbf->list))
1225                         list_cut_position(&bf_head,
1226 @@ -2470,7 +2547,7 @@ void ath_tx_edma_tasklet(struct ath_soft
1227                 }
1228
1229                 bf = list_first_entry(fifo_list, struct ath_buf, list);
1230 -               if (bf->bf_stale) {
1231 +               if (bf->bf_state.stale) {
1232                         list_del(&bf->list);
1233                         ath_tx_return_buffer(sc, bf);
1234                         bf = list_first_entry(fifo_list, struct ath_buf, list);
1235 @@ -2492,7 +2569,7 @@ void ath_tx_edma_tasklet(struct ath_soft
1236                                 ath_tx_txqaddbuf(sc, txq, &bf_q, true);
1237                         }
1238                 } else {
1239 -                       lastbf->bf_stale = true;
1240 +                       lastbf->bf_state.stale = true;
1241                         if (bf != lastbf)
1242                                 list_cut_position(&bf_head, fifo_list,
1243                                                   lastbf->list.prev);
1244 @@ -2583,6 +2660,7 @@ void ath_tx_node_init(struct ath_softc *
1245                 tid->paused    = false;
1246                 tid->active        = false;
1247                 __skb_queue_head_init(&tid->buf_q);
1248 +               __skb_queue_head_init(&tid->retry_q);
1249                 acno = TID_TO_WME_AC(tidno);
1250                 tid->ac = &an->ac[acno];
1251         }
1252 @@ -2590,6 +2668,7 @@ void ath_tx_node_init(struct ath_softc *
1253         for (acno = 0, ac = &an->ac[acno];
1254              acno < IEEE80211_NUM_ACS; acno++, ac++) {
1255                 ac->sched    = false;
1256 +               ac->clear_ps_filter = true;
1257                 ac->txq = sc->tx.txq_map[acno];
1258                 INIT_LIST_HEAD(&ac->tid_q);
1259         }
1260 --- a/drivers/net/wireless/ath/ath9k/main.c
1261 +++ b/drivers/net/wireless/ath/ath9k/main.c
1262 @@ -966,6 +966,8 @@ static int ath9k_add_interface(struct ie
1263         struct ath_softc *sc = hw->priv;
1264         struct ath_hw *ah = sc->sc_ah;
1265         struct ath_common *common = ath9k_hw_common(ah);
1266 +       struct ath_vif *avp = (void *)vif->drv_priv;
1267 +       struct ath_node *an = &avp->mcast_node;
1268
1269         mutex_lock(&sc->mutex);
1270
1271 @@ -979,6 +981,12 @@ static int ath9k_add_interface(struct ie
1272         if (ath9k_uses_beacons(vif->type))
1273                 ath9k_beacon_assign_slot(sc, vif);
1274
1275 +       an->sc = sc;
1276 +       an->sta = NULL;
1277 +       an->vif = vif;
1278 +       an->no_ps_filter = true;
1279 +       ath_tx_node_init(sc, an);
1280 +
1281         mutex_unlock(&sc->mutex);
1282         return 0;
1283  }
1284 @@ -1016,6 +1024,7 @@ static void ath9k_remove_interface(struc
1285  {
1286         struct ath_softc *sc = hw->priv;
1287         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
1288 +       struct ath_vif *avp = (void *)vif->drv_priv;
1289
1290         ath_dbg(common, CONFIG, "Detach Interface\n");
1291
1292 @@ -1030,6 +1039,8 @@ static void ath9k_remove_interface(struc
1293         ath9k_calculate_summary_state(hw, NULL);
1294         ath9k_ps_restore(sc);
1295
1296 +       ath_tx_node_cleanup(sc, &avp->mcast_node);
1297 +
1298         mutex_unlock(&sc->mutex);
1299  }
1300
1301 @@ -1374,9 +1385,6 @@ static void ath9k_sta_notify(struct ieee
1302         struct ath_softc *sc = hw->priv;
1303         struct ath_node *an = (struct ath_node *) sta->drv_priv;
1304
1305 -       if (!sta->ht_cap.ht_supported)
1306 -               return;
1307 -
1308         switch (cmd) {
1309         case STA_NOTIFY_SLEEP:
1310                 an->sleeping = true;
1311 @@ -2094,7 +2102,7 @@ static void ath9k_wow_add_pattern(struct
1312  {
1313         struct ath_hw *ah = sc->sc_ah;
1314         struct ath9k_wow_pattern *wow_pattern = NULL;
1315 -       struct cfg80211_wowlan_trig_pkt_pattern *patterns = wowlan->patterns;
1316 +       struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
1317         int mask_len;
1318         s8 i = 0;
1319
1320 --- a/drivers/net/wireless/mwifiex/cfg80211.c
1321 +++ b/drivers/net/wireless/mwifiex/cfg80211.c
1322 @@ -2298,8 +2298,7 @@ EXPORT_SYMBOL_GPL(mwifiex_del_virtual_in
1323
1324  #ifdef CONFIG_PM
1325  static bool
1326 -mwifiex_is_pattern_supported(struct cfg80211_wowlan_trig_pkt_pattern *pat,
1327 -                            s8 *byte_seq)
1328 +mwifiex_is_pattern_supported(struct cfg80211_pkt_pattern *pat, s8 *byte_seq)
1329  {
1330         int j, k, valid_byte_cnt = 0;
1331         bool dont_care_byte = false;
1332 --- a/drivers/net/wireless/ti/wlcore/main.c
1333 +++ b/drivers/net/wireless/ti/wlcore/main.c
1334 @@ -1315,7 +1315,7 @@ static struct sk_buff *wl12xx_alloc_dumm
1335
1336  #ifdef CONFIG_PM
1337  static int
1338 -wl1271_validate_wowlan_pattern(struct cfg80211_wowlan_trig_pkt_pattern *p)
1339 +wl1271_validate_wowlan_pattern(struct cfg80211_pkt_pattern *p)
1340  {
1341         int num_fields = 0, in_field = 0, fields_size = 0;
1342         int i, pattern_len = 0;
1343 @@ -1458,9 +1458,9 @@ void wl1271_rx_filter_flatten_fields(str
1344   * Allocates an RX filter returned through f
1345   * which needs to be freed using rx_filter_free()
1346   */
1347 -static int wl1271_convert_wowlan_pattern_to_rx_filter(
1348 -       struct cfg80211_wowlan_trig_pkt_pattern *p,
1349 -       struct wl12xx_rx_filter **f)
1350 +static int
1351 +wl1271_convert_wowlan_pattern_to_rx_filter(struct cfg80211_pkt_pattern *p,
1352 +                                          struct wl12xx_rx_filter **f)
1353  {
1354         int i, j, ret = 0;
1355         struct wl12xx_rx_filter *filter;
1356 @@ -1562,7 +1562,7 @@ static int wl1271_configure_wowlan(struc
1357
1358         /* Translate WoWLAN patterns into filters */
1359         for (i = 0; i < wow->n_patterns; i++) {
1360 -               struct cfg80211_wowlan_trig_pkt_pattern *p;
1361 +               struct cfg80211_pkt_pattern *p;
1362                 struct wl12xx_rx_filter *filter = NULL;
1363
1364                 p = &wow->patterns[i];
1365 --- a/include/net/cfg80211.h
1366 +++ b/include/net/cfg80211.h
1367 @@ -1698,7 +1698,7 @@ struct cfg80211_pmksa {
1368  };
1369
1370  /**
1371 - * struct cfg80211_wowlan_trig_pkt_pattern - packet pattern
1372 + * struct cfg80211_pkt_pattern - packet pattern
1373   * @mask: bitmask where to match pattern and where to ignore bytes,
1374   *     one bit per byte, in same format as nl80211
1375   * @pattern: bytes to match where bitmask is 1
1376 @@ -1708,7 +1708,7 @@ struct cfg80211_pmksa {
1377   * Internal note: @mask and @pattern are allocated in one chunk of
1378   * memory, free @mask only!
1379   */
1380 -struct cfg80211_wowlan_trig_pkt_pattern {
1381 +struct cfg80211_pkt_pattern {
1382         u8 *mask, *pattern;
1383         int pattern_len;
1384         int pkt_offset;
1385 @@ -1770,7 +1770,7 @@ struct cfg80211_wowlan {
1386         bool any, disconnect, magic_pkt, gtk_rekey_failure,
1387              eap_identity_req, four_way_handshake,
1388              rfkill_release;
1389 -       struct cfg80211_wowlan_trig_pkt_pattern *patterns;
1390 +       struct cfg80211_pkt_pattern *patterns;
1391         struct cfg80211_wowlan_tcp *tcp;
1392         int n_patterns;
1393  };
1394 --- a/include/uapi/linux/nl80211.h
1395 +++ b/include/uapi/linux/nl80211.h
1396 @@ -3060,11 +3060,11 @@ enum nl80211_tx_power_setting {
1397  };
1398
1399  /**
1400 - * enum nl80211_wowlan_packet_pattern_attr - WoWLAN packet pattern attribute
1401 - * @__NL80211_WOWLAN_PKTPAT_INVALID: invalid number for nested attribute
1402 - * @NL80211_WOWLAN_PKTPAT_PATTERN: the pattern, values where the mask has
1403 + * enum nl80211_packet_pattern_attr - packet pattern attribute
1404 + * @__NL80211_PKTPAT_INVALID: invalid number for nested attribute
1405 + * @NL80211_PKTPAT_PATTERN: the pattern, values where the mask has
1406   *     a zero bit are ignored
1407 - * @NL80211_WOWLAN_PKTPAT_MASK: pattern mask, must be long enough to have
1408 + * @NL80211_PKTPAT_MASK: pattern mask, must be long enough to have
1409   *     a bit for each byte in the pattern. The lowest-order bit corresponds
1410   *     to the first byte of the pattern, but the bytes of the pattern are
1411   *     in a little-endian-like format, i.e. the 9th byte of the pattern
1412 @@ -3075,23 +3075,23 @@ enum nl80211_tx_power_setting {
1413   *     Note that the pattern matching is done as though frames were not
1414   *     802.11 frames but 802.3 frames, i.e. the frame is fully unpacked
1415   *     first (including SNAP header unpacking) and then matched.
1416 - * @NL80211_WOWLAN_PKTPAT_OFFSET: packet offset, pattern is matched after
1417 + * @NL80211_PKTPAT_OFFSET: packet offset, pattern is matched after
1418   *     these fixed number of bytes of received packet
1419 - * @NUM_NL80211_WOWLAN_PKTPAT: number of attributes
1420 - * @MAX_NL80211_WOWLAN_PKTPAT: max attribute number
1421 + * @NUM_NL80211_PKTPAT: number of attributes
1422 + * @MAX_NL80211_PKTPAT: max attribute number
1423   */
1424 -enum nl80211_wowlan_packet_pattern_attr {
1425 -       __NL80211_WOWLAN_PKTPAT_INVALID,
1426 -       NL80211_WOWLAN_PKTPAT_MASK,
1427 -       NL80211_WOWLAN_PKTPAT_PATTERN,
1428 -       NL80211_WOWLAN_PKTPAT_OFFSET,
1429 +enum nl80211_packet_pattern_attr {
1430 +       __NL80211_PKTPAT_INVALID,
1431 +       NL80211_PKTPAT_MASK,
1432 +       NL80211_PKTPAT_PATTERN,
1433 +       NL80211_PKTPAT_OFFSET,
1434
1435 -       NUM_NL80211_WOWLAN_PKTPAT,
1436 -       MAX_NL80211_WOWLAN_PKTPAT = NUM_NL80211_WOWLAN_PKTPAT - 1,
1437 +       NUM_NL80211_PKTPAT,
1438 +       MAX_NL80211_PKTPAT = NUM_NL80211_PKTPAT - 1,
1439  };
1440
1441  /**
1442 - * struct nl80211_wowlan_pattern_support - pattern support information
1443 + * struct nl80211_pattern_support - packet pattern support information
1444   * @max_patterns: maximum number of patterns supported
1445   * @min_pattern_len: minimum length of each pattern
1446   * @max_pattern_len: maximum length of each pattern
1447 @@ -3101,13 +3101,22 @@ enum nl80211_wowlan_packet_pattern_attr
1448   * that is part of %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED in the
1449   * capability information given by the kernel to userspace.
1450   */
1451 -struct nl80211_wowlan_pattern_support {
1452 +struct nl80211_pattern_support {
1453         __u32 max_patterns;
1454         __u32 min_pattern_len;
1455         __u32 max_pattern_len;
1456         __u32 max_pkt_offset;
1457  } __attribute__((packed));
1458
1459 +/* only for backward compatibility */
1460 +#define __NL80211_WOWLAN_PKTPAT_INVALID __NL80211_PKTPAT_INVALID
1461 +#define NL80211_WOWLAN_PKTPAT_MASK NL80211_PKTPAT_MASK
1462 +#define NL80211_WOWLAN_PKTPAT_PATTERN NL80211_PKTPAT_PATTERN
1463 +#define NL80211_WOWLAN_PKTPAT_OFFSET NL80211_PKTPAT_OFFSET
1464 +#define NUM_NL80211_WOWLAN_PKTPAT NUM_NL80211_PKTPAT
1465 +#define MAX_NL80211_WOWLAN_PKTPAT MAX_NL80211_PKTPAT
1466 +#define nl80211_wowlan_pattern_support nl80211_pattern_support
1467 +
1468  /**
1469   * enum nl80211_wowlan_triggers - WoWLAN trigger definitions
1470   * @__NL80211_WOWLAN_TRIG_INVALID: invalid number for nested attributes
1471 @@ -3127,7 +3136,7 @@ struct nl80211_wowlan_pattern_support {
1472   *     pattern matching is done after the packet is converted to the MSDU.
1473   *
1474   *     In %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED, it is a binary attribute
1475 - *     carrying a &struct nl80211_wowlan_pattern_support.
1476 + *     carrying a &struct nl80211_pattern_support.
1477   *
1478   *     When reporting wakeup. it is a u32 attribute containing the 0-based
1479   *     index of the pattern that caused the wakeup, in the patterns passed
1480 @@ -3284,7 +3293,7 @@ struct nl80211_wowlan_tcp_data_token_fea
1481   * @NL80211_WOWLAN_TCP_WAKE_PAYLOAD: wake packet payload, for advertising a
1482   *     u32 attribute holding the maximum length
1483   * @NL80211_WOWLAN_TCP_WAKE_MASK: Wake packet payload mask, not used for
1484 - *     feature advertising. The mask works like @NL80211_WOWLAN_PKTPAT_MASK
1485 + *     feature advertising. The mask works like @NL80211_PKTPAT_MASK
1486   *     but on the TCP payload only.
1487   * @NUM_NL80211_WOWLAN_TCP: number of TCP attributes
1488   * @MAX_NL80211_WOWLAN_TCP: highest attribute number
1489 --- a/net/mac80211/mesh_ps.c
1490 +++ b/net/mac80211/mesh_ps.c
1491 @@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(str
1492         enum nl80211_mesh_power_mode pm;
1493         bool do_buffer;
1494
1495 +       /* For non-assoc STA, prevent buffering or frame transmission */
1496 +       if (sta->sta_state < IEEE80211_STA_ASSOC)
1497 +               return;
1498 +
1499         /*
1500          * use peer-specific power mode if peering is established and the
1501          * peer's power mode is known
1502 --- a/net/wireless/nl80211.c
1503 +++ b/net/wireless/nl80211.c
1504 @@ -441,10 +441,12 @@ static int nl80211_prepare_wdev_dump(str
1505                         goto out_unlock;
1506                 }
1507                 *rdev = wiphy_to_dev((*wdev)->wiphy);
1508 -               cb->args[0] = (*rdev)->wiphy_idx;
1509 +               /* 0 is the first index - add 1 to parse only once */
1510 +               cb->args[0] = (*rdev)->wiphy_idx + 1;
1511                 cb->args[1] = (*wdev)->identifier;
1512         } else {
1513 -               struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
1514 +               /* subtract the 1 again here */
1515 +               struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1516                 struct wireless_dev *tmp;
1517
1518                 if (!wiphy) {
1519 @@ -974,7 +976,7 @@ static int nl80211_send_wowlan(struct sk
1520                 return -ENOBUFS;
1521
1522         if (dev->wiphy.wowlan->n_patterns) {
1523 -               struct nl80211_wowlan_pattern_support pat = {
1524 +               struct nl80211_pattern_support pat = {
1525                         .max_patterns = dev->wiphy.wowlan->n_patterns,
1526                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
1527                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
1528 @@ -1568,8 +1570,10 @@ static int nl80211_dump_wiphy(struct sk_
1529         rtnl_lock();
1530         if (!state) {
1531                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1532 -               if (!state)
1533 +               if (!state) {
1534 +                       rtnl_unlock();
1535                         return -ENOMEM;
1536 +               }
1537                 state->filter_wiphy = -1;
1538                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1539                 if (ret) {
1540 @@ -6615,12 +6619,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_ev
1541
1542  void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
1543  {
1544 +       struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
1545         void *hdr = ((void **)skb->cb)[1];
1546         struct nlattr *data = ((void **)skb->cb)[2];
1547
1548         nla_nest_end(skb, data);
1549         genlmsg_end(skb, hdr);
1550 -       genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
1551 +       genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
1552 +                               nl80211_testmode_mcgrp.id, gfp);
1553  }
1554  EXPORT_SYMBOL(cfg80211_testmode_event);
1555  #endif
1556 @@ -7593,12 +7599,11 @@ static int nl80211_send_wowlan_patterns(
1557                 if (!nl_pat)
1558                         return -ENOBUFS;
1559                 pat_len = wowlan->patterns[i].pattern_len;
1560 -               if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
1561 -                           DIV_ROUND_UP(pat_len, 8),
1562 +               if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
1563                             wowlan->patterns[i].mask) ||
1564 -                   nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
1565 -                           pat_len, wowlan->patterns[i].pattern) ||
1566 -                   nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
1567 +                   nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
1568 +                           wowlan->patterns[i].pattern) ||
1569 +                   nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
1570                                 wowlan->patterns[i].pkt_offset))
1571                         return -ENOBUFS;
1572                 nla_nest_end(msg, nl_pat);
1573 @@ -7939,7 +7944,7 @@ static int nl80211_set_wowlan(struct sk_
1574                 struct nlattr *pat;
1575                 int n_patterns = 0;
1576                 int rem, pat_len, mask_len, pkt_offset;
1577 -               struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
1578 +               struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
1579
1580                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
1581                                     rem)
1582 @@ -7958,26 +7963,25 @@ static int nl80211_set_wowlan(struct sk_
1583
1584                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
1585                                     rem) {
1586 -                       nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
1587 -                                 nla_data(pat), nla_len(pat), NULL);
1588 +                       nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
1589 +                                 nla_len(pat), NULL);
1590                         err = -EINVAL;
1591 -                       if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
1592 -                           !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
1593 +                       if (!pat_tb[NL80211_PKTPAT_MASK] ||
1594 +                           !pat_tb[NL80211_PKTPAT_PATTERN])
1595                                 goto error;
1596 -                       pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
1597 +                       pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
1598                         mask_len = DIV_ROUND_UP(pat_len, 8);
1599 -                       if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
1600 -                           mask_len)
1601 +                       if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
1602                                 goto error;
1603                         if (pat_len > wowlan->pattern_max_len ||
1604                             pat_len < wowlan->pattern_min_len)
1605                                 goto error;
1606
1607 -                       if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
1608 +                       if (!pat_tb[NL80211_PKTPAT_OFFSET])
1609                                 pkt_offset = 0;
1610                         else
1611                                 pkt_offset = nla_get_u32(
1612 -                                       pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
1613 +                                       pat_tb[NL80211_PKTPAT_OFFSET]);
1614                         if (pkt_offset > wowlan->max_pkt_offset)
1615                                 goto error;
1616                         new_triggers.patterns[i].pkt_offset = pkt_offset;
1617 @@ -7991,11 +7995,11 @@ static int nl80211_set_wowlan(struct sk_
1618                         new_triggers.patterns[i].pattern =
1619                                 new_triggers.patterns[i].mask + mask_len;
1620                         memcpy(new_triggers.patterns[i].mask,
1621 -                              nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
1622 +                              nla_data(pat_tb[NL80211_PKTPAT_MASK]),
1623                                mask_len);
1624                         new_triggers.patterns[i].pattern_len = pat_len;
1625                         memcpy(new_triggers.patterns[i].pattern,
1626 -                              nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
1627 +                              nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
1628                                pat_len);
1629                         i++;
1630                 }
1631 @@ -10066,7 +10070,8 @@ void cfg80211_mgmt_tx_status(struct wire
1632
1633         genlmsg_end(msg, hdr);
1634
1635 -       genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
1636 +       genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
1637 +                               nl80211_mlme_mcgrp.id, gfp);
1638         return;
1639
1640   nla_put_failure:
1641 --- a/net/wireless/reg.c
1642 +++ b/net/wireless/reg.c
1643 @@ -2247,10 +2247,13 @@ int reg_device_uevent(struct device *dev
1644
1645  void wiphy_regulatory_register(struct wiphy *wiphy)
1646  {
1647 +       struct regulatory_request *lr;
1648 +
1649         if (!reg_dev_ignore_cell_hint(wiphy))
1650                 reg_num_devs_support_basehint++;
1651
1652 -       wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
1653 +       lr = get_last_request();
1654 +       wiphy_update_regulatory(wiphy, lr->initiator);
1655  }
1656
1657  void wiphy_regulatory_deregister(struct wiphy *wiphy)
1658 @@ -2279,7 +2282,9 @@ void wiphy_regulatory_deregister(struct
1659  static void reg_timeout_work(struct work_struct *work)
1660  {
1661         REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
1662 +       rtnl_lock();
1663         restore_regulatory_settings(true);
1664 +       rtnl_unlock();
1665  }
1666
1667  int __init regulatory_init(void)
1668 --- a/net/wireless/sme.c
1669 +++ b/net/wireless/sme.c
1670 @@ -34,8 +34,10 @@ struct cfg80211_conn {
1671                 CFG80211_CONN_SCAN_AGAIN,
1672                 CFG80211_CONN_AUTHENTICATE_NEXT,
1673                 CFG80211_CONN_AUTHENTICATING,
1674 +               CFG80211_CONN_AUTH_FAILED,
1675                 CFG80211_CONN_ASSOCIATE_NEXT,
1676                 CFG80211_CONN_ASSOCIATING,
1677 +               CFG80211_CONN_ASSOC_FAILED,
1678                 CFG80211_CONN_DEAUTH,
1679                 CFG80211_CONN_CONNECTED,
1680         } state;
1681 @@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct
1682                                           NULL, 0,
1683                                           params->key, params->key_len,
1684                                           params->key_idx, NULL, 0);
1685 +       case CFG80211_CONN_AUTH_FAILED:
1686 +               return -ENOTCONN;
1687         case CFG80211_CONN_ASSOCIATE_NEXT:
1688                 BUG_ON(!rdev->ops->assoc);
1689                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
1690 @@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct
1691                                              WLAN_REASON_DEAUTH_LEAVING,
1692                                              false);
1693                 return err;
1694 +       case CFG80211_CONN_ASSOC_FAILED:
1695 +               cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
1696 +                                    NULL, 0,
1697 +                                    WLAN_REASON_DEAUTH_LEAVING, false);
1698 +               return -ENOTCONN;
1699         case CFG80211_CONN_DEAUTH:
1700                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
1701                                      NULL, 0,
1702                                      WLAN_REASON_DEAUTH_LEAVING, false);
1703 +               /* free directly, disconnected event already sent */
1704 +               cfg80211_sme_free(wdev);
1705                 return 0;
1706         default:
1707                 return 0;
1708 @@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct w
1709                 return true;
1710         }
1711
1712 -       wdev->conn->state = CFG80211_CONN_DEAUTH;
1713 +       wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
1714         schedule_work(&rdev->conn_work);
1715         return false;
1716  }
1717 @@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless
1718
1719  void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
1720  {
1721 -       cfg80211_sme_free(wdev);
1722 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
1723 +
1724 +       if (!wdev->conn)
1725 +               return;
1726 +
1727 +       wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
1728 +       schedule_work(&rdev->conn_work);
1729  }
1730
1731  void cfg80211_sme_disassoc(struct wireless_dev *wdev)
1732 @@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wirele
1733
1734  void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
1735  {
1736 -       cfg80211_sme_disassoc(wdev);
1737 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
1738 +
1739 +       if (!wdev->conn)
1740 +               return;
1741 +
1742 +       wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
1743 +       schedule_work(&rdev->conn_work);
1744  }
1745
1746  static int cfg80211_sme_connect(struct wireless_dev *wdev,
1747 --- a/net/mac80211/rc80211_minstrel.c
1748 +++ b/net/mac80211/rc80211_minstrel.c
1749 @@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct iee
1750         struct minstrel_rate *msr, *mr;
1751         unsigned int ndx;
1752         bool mrr_capable;
1753 -       bool prev_sample = mi->prev_sample;
1754 +       bool prev_sample;
1755         int delta;
1756         int sampling_ratio;
1757
1758 @@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct iee
1759                         (mi->sample_count + mi->sample_deferred / 2);
1760
1761         /* delta < 0: no sampling required */
1762 +       prev_sample = mi->prev_sample;
1763         mi->prev_sample = false;
1764         if (delta < 0 || (!mrr_capable && prev_sample))
1765                 return;
1766 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
1767 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
1768 @@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_
1769         spin_unlock_irqrestore(&queue->index_lock, irqflags);
1770  }
1771
1772 -void rt2x00queue_pause_queue(struct data_queue *queue)
1773 +void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
1774  {
1775 -       if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
1776 -           !test_bit(QUEUE_STARTED, &queue->flags) ||
1777 -           test_and_set_bit(QUEUE_PAUSED, &queue->flags))
1778 -               return;
1779 -
1780         switch (queue->qid) {
1781         case QID_AC_VO:
1782         case QID_AC_VI:
1783 @@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data
1784                 break;
1785         }
1786  }
1787 +void rt2x00queue_pause_queue(struct data_queue *queue)
1788 +{
1789 +       if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
1790 +           !test_bit(QUEUE_STARTED, &queue->flags) ||
1791 +           test_and_set_bit(QUEUE_PAUSED, &queue->flags))
1792 +               return;
1793 +
1794 +       rt2x00queue_pause_queue_nocheck(queue);
1795 +}
1796  EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
1797
1798  void rt2x00queue_unpause_queue(struct data_queue *queue)
1799 @@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_
1800                 return;
1801         }
1802
1803 -       rt2x00queue_pause_queue(queue);
1804 +       rt2x00queue_pause_queue_nocheck(queue);
1805
1806         queue->rt2x00dev->ops->lib->stop_queue(queue);
1807
1808 --- a/net/mac80211/mlme.c
1809 +++ b/net/mac80211/mlme.c
1810 @@ -31,10 +31,12 @@
1811  #include "led.h"
1812
1813  #define IEEE80211_AUTH_TIMEOUT         (HZ / 5)
1814 +#define IEEE80211_AUTH_TIMEOUT_LONG    (HZ / 2)
1815  #define IEEE80211_AUTH_TIMEOUT_SHORT   (HZ / 10)
1816  #define IEEE80211_AUTH_MAX_TRIES       3
1817  #define IEEE80211_AUTH_WAIT_ASSOC      (HZ * 5)
1818  #define IEEE80211_ASSOC_TIMEOUT                (HZ / 5)
1819 +#define IEEE80211_ASSOC_TIMEOUT_LONG   (HZ / 2)
1820  #define IEEE80211_ASSOC_TIMEOUT_SHORT  (HZ / 10)
1821  #define IEEE80211_ASSOC_MAX_TRIES      3
1822
1823 @@ -209,8 +211,9 @@ ieee80211_determine_chantype(struct ieee
1824                              struct ieee80211_channel *channel,
1825                              const struct ieee80211_ht_operation *ht_oper,
1826                              const struct ieee80211_vht_operation *vht_oper,
1827 -                            struct cfg80211_chan_def *chandef, bool verbose)
1828 +                            struct cfg80211_chan_def *chandef, bool tracking)
1829  {
1830 +       struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1831         struct cfg80211_chan_def vht_chandef;
1832         u32 ht_cfreq, ret;
1833
1834 @@ -229,7 +232,7 @@ ieee80211_determine_chantype(struct ieee
1835         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
1836                                                   channel->band);
1837         /* check that channel matches the right operating channel */
1838 -       if (channel->center_freq != ht_cfreq) {
1839 +       if (!tracking && channel->center_freq != ht_cfreq) {
1840                 /*
1841                  * It's possible that some APs are confused here;
1842                  * Netgear WNDR3700 sometimes reports 4 higher than
1843 @@ -237,11 +240,10 @@ ieee80211_determine_chantype(struct ieee
1844                  * since we look at probe response/beacon data here
1845                  * it should be OK.
1846                  */
1847 -               if (verbose)
1848 -                       sdata_info(sdata,
1849 -                                  "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
1850 -                                  channel->center_freq, ht_cfreq,
1851 -                                  ht_oper->primary_chan, channel->band);
1852 +               sdata_info(sdata,
1853 +                          "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
1854 +                          channel->center_freq, ht_cfreq,
1855 +                          ht_oper->primary_chan, channel->band);
1856                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
1857                 goto out;
1858         }
1859 @@ -295,7 +297,7 @@ ieee80211_determine_chantype(struct ieee
1860                                 channel->band);
1861                 break;
1862         default:
1863 -               if (verbose)
1864 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
1865                         sdata_info(sdata,
1866                                    "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
1867                                    vht_oper->chan_width);
1868 @@ -304,7 +306,7 @@ ieee80211_determine_chantype(struct ieee
1869         }
1870
1871         if (!cfg80211_chandef_valid(&vht_chandef)) {
1872 -               if (verbose)
1873 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
1874                         sdata_info(sdata,
1875                                    "AP VHT information is invalid, disable VHT\n");
1876                 ret = IEEE80211_STA_DISABLE_VHT;
1877 @@ -317,7 +319,7 @@ ieee80211_determine_chantype(struct ieee
1878         }
1879
1880         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
1881 -               if (verbose)
1882 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
1883                         sdata_info(sdata,
1884                                    "AP VHT information doesn't match HT, disable VHT\n");
1885                 ret = IEEE80211_STA_DISABLE_VHT;
1886 @@ -333,18 +335,27 @@ out:
1887         if (ret & IEEE80211_STA_DISABLE_VHT)
1888                 vht_chandef = *chandef;
1889
1890 +       /*
1891 +        * Ignore the DISABLED flag when we're already connected and only
1892 +        * tracking the APs beacon for bandwidth changes - otherwise we
1893 +        * might get disconnected here if we connect to an AP, update our
1894 +        * regulatory information based on the AP's country IE and the
1895 +        * information we have is wrong/outdated and disables the channel
1896 +        * that we're actually using for the connection to the AP.
1897 +        */
1898         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
1899 -                                       IEEE80211_CHAN_DISABLED)) {
1900 +                                       tracking ? 0 :
1901 +                                                  IEEE80211_CHAN_DISABLED)) {
1902                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
1903                         ret = IEEE80211_STA_DISABLE_HT |
1904                               IEEE80211_STA_DISABLE_VHT;
1905 -                       goto out;
1906 +                       break;
1907                 }
1908
1909                 ret |= chandef_downgrade(chandef);
1910         }
1911
1912 -       if (chandef->width != vht_chandef.width && verbose)
1913 +       if (chandef->width != vht_chandef.width && !tracking)
1914                 sdata_info(sdata,
1915                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
1916
1917 @@ -384,7 +395,7 @@ static int ieee80211_config_bw(struct ie
1918
1919         /* calculate new channel (type) based on HT/VHT operation IEs */
1920         flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
1921 -                                            vht_oper, &chandef, false);
1922 +                                            vht_oper, &chandef, true);
1923
1924         /*
1925          * Downgrade the new channel if we associated with restricted
1926 @@ -3394,10 +3405,13 @@ static int ieee80211_probe_auth(struct i
1927
1928         if (tx_flags == 0) {
1929                 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
1930 -               ifmgd->auth_data->timeout_started = true;
1931 +               auth_data->timeout_started = true;
1932                 run_again(sdata, auth_data->timeout);
1933         } else {
1934 -               auth_data->timeout_started = false;
1935 +               auth_data->timeout =
1936 +                       round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
1937 +               auth_data->timeout_started = true;
1938 +               run_again(sdata, auth_data->timeout);
1939         }
1940
1941         return 0;
1942 @@ -3434,7 +3448,11 @@ static int ieee80211_do_assoc(struct iee
1943                 assoc_data->timeout_started = true;
1944                 run_again(sdata, assoc_data->timeout);
1945         } else {
1946 -               assoc_data->timeout_started = false;
1947 +               assoc_data->timeout =
1948 +                       round_jiffies_up(jiffies +
1949 +                                        IEEE80211_ASSOC_TIMEOUT_LONG);
1950 +               assoc_data->timeout_started = true;
1951 +               run_again(sdata, assoc_data->timeout);
1952         }
1953
1954         return 0;
1955 @@ -3829,7 +3847,7 @@ static int ieee80211_prep_channel(struct
1956         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
1957                                                      cbss->channel,
1958                                                      ht_oper, vht_oper,
1959 -                                                    &chandef, true);
1960 +                                                    &chandef, false);
1961
1962         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
1963                                       local->rx_chains);
1964 --- a/net/wireless/core.c
1965 +++ b/net/wireless/core.c
1966 @@ -772,6 +772,7 @@ void cfg80211_leave(struct cfg80211_regi
1967                 cfg80211_leave_mesh(rdev, dev);
1968                 break;
1969         case NL80211_IFTYPE_AP:
1970 +       case NL80211_IFTYPE_P2P_GO:
1971                 cfg80211_stop_ap(rdev, dev);
1972                 break;
1973         default:
1974 --- a/drivers/net/wireless/rtlwifi/Kconfig
1975 +++ b/drivers/net/wireless/rtlwifi/Kconfig
1976 @@ -1,29 +1,22 @@
1977 -config RTLWIFI
1978 -       tristate "Realtek wireless card support"
1979 +menuconfig RTL_CARDS
1980 +       tristate "Realtek rtlwifi family of devices"
1981         depends on m
1982 -       depends on MAC80211
1983 -       select BACKPORT_FW_LOADER
1984 -       ---help---
1985 -         This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
1986 -         drivers.  This module does nothing by itself - the various front-end
1987 -         drivers need to be enabled to support any desired devices.
1988 -
1989 -         If you choose to build as a module, it'll be called rtlwifi.
1990 -
1991 -config RTLWIFI_DEBUG
1992 -       bool "Debugging output for rtlwifi driver family"
1993 -       depends on RTLWIFI
1994 +       depends on MAC80211 && (PCI || USB)
1995         default y
1996         ---help---
1997 -       To use the module option that sets the dynamic-debugging level for,
1998 -       the front-end driver, this parameter must be "Y". For memory-limited
1999 -       systems, choose "N". If in doubt, choose "Y".
2000 +         This option will enable support for the Realtek mac80211-based
2001 +         wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
2002 +         rtl8723eu, and rtl8188eu share some common code.
2003 +
2004 +if RTL_CARDS
2005
2006  config RTL8192CE
2007         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
2008         depends on m
2009 -       depends on RTLWIFI && PCI
2010 +       depends on PCI
2011         select RTL8192C_COMMON
2012 +       select RTLWIFI
2013 +       select RTLWIFI_PCI
2014         ---help---
2015         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
2016         wireless network adapters.
2017 @@ -33,7 +26,9 @@ config RTL8192CE
2018  config RTL8192SE
2019         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
2020         depends on m
2021 -       depends on RTLWIFI && PCI
2022 +       depends on PCI
2023 +       select RTLWIFI
2024 +       select RTLWIFI_PCI
2025         ---help---
2026         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
2027         wireless network adapters.
2028 @@ -43,7 +38,9 @@ config RTL8192SE
2029  config RTL8192DE
2030         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
2031         depends on m
2032 -       depends on RTLWIFI && PCI
2033 +       depends on PCI
2034 +       select RTLWIFI
2035 +       select RTLWIFI_PCI
2036         ---help---
2037         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
2038         wireless network adapters.
2039 @@ -53,7 +50,9 @@ config RTL8192DE
2040  config RTL8723AE
2041         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
2042         depends on m
2043 -       depends on RTLWIFI && PCI
2044 +       depends on PCI
2045 +       select RTLWIFI
2046 +       select RTLWIFI_PCI
2047         ---help---
2048         This is the driver for Realtek RTL8723AE 802.11n PCIe
2049         wireless network adapters.
2050 @@ -63,7 +62,9 @@ config RTL8723AE
2051  config RTL8188EE
2052         tristate "Realtek RTL8188EE Wireless Network Adapter"
2053         depends on m
2054 -       depends on RTLWIFI && PCI
2055 +       depends on PCI
2056 +       select RTLWIFI
2057 +       select RTLWIFI_PCI
2058         ---help---
2059         This is the driver for Realtek RTL8188EE 802.11n PCIe
2060         wireless network adapters.
2061 @@ -73,7 +74,9 @@ config RTL8188EE
2062  config RTL8192CU
2063         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
2064         depends on m
2065 -       depends on RTLWIFI && USB
2066 +       depends on USB
2067 +       select RTLWIFI
2068 +       select RTLWIFI_USB
2069         select RTL8192C_COMMON
2070         ---help---
2071         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
2072 @@ -81,8 +84,32 @@ config RTL8192CU
2073
2074         If you choose to build it as a module, it will be called rtl8192cu
2075
2076 +config RTLWIFI
2077 +       tristate "Realtek common driver part"
2078 +       depends on m
2079 +       select BACKPORT_FW_LOADER
2080 +
2081 +config RTLWIFI_PCI
2082 +       depends on m
2083 +       tristate
2084 +
2085 +config RTLWIFI_USB
2086 +       depends on m
2087 +       tristate
2088 +
2089 +config RTLWIFI_DEBUG
2090 +       bool "Debugging output for rtlwifi driver family"
2091 +       depends on RTLWIFI
2092 +       default y
2093 +       ---help---
2094 +       To use the module option that sets the dynamic-debugging level for,
2095 +       the front-end driver, this parameter must be "Y". For memory-limited
2096 +       systems, choose "N". If in doubt, choose "Y".
2097 +
2098  config RTL8192C_COMMON
2099         tristate
2100         depends on m
2101         depends on RTL8192CE || RTL8192CU
2102         default m
2103 +
2104 +endif
2105 --- a/drivers/net/wireless/rtlwifi/Makefile
2106 +++ b/drivers/net/wireless/rtlwifi/Makefile
2107 @@ -12,13 +12,11 @@ rtlwifi-objs        :=              \
2108
2109  rtl8192c_common-objs +=                \
2110
2111 -ifneq ($(CONFIG_PCI),)
2112 -rtlwifi-objs   += pci.o
2113 -endif
2114 +obj-$(CPTCFG_RTLWIFI_PCI)      += rtl_pci.o
2115 +rtl_pci-objs   :=              pci.o
2116
2117 -ifneq ($(CONFIG_USB),)
2118 -rtlwifi-objs   += usb.o
2119 -endif
2120 +obj-$(CPTCFG_RTLWIFI_USB)      += rtl_usb.o
2121 +rtl_usb-objs   :=              usb.o
2122
2123  obj-$(CPTCFG_RTL8192C_COMMON)  += rtl8192c/
2124  obj-$(CPTCFG_RTL8192CE)                += rtl8192ce/
2125 --- a/drivers/net/wireless/rtlwifi/base.c
2126 +++ b/drivers/net/wireless/rtlwifi/base.c
2127 @@ -173,6 +173,7 @@ u8 rtl_tid_to_ac(u8 tid)
2128  {
2129         return tid_to_ac[tid];
2130  }
2131 +EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
2132
2133  static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
2134                                   struct ieee80211_sta_ht_cap *ht_cap)
2135 @@ -407,6 +408,7 @@ void rtl_deinit_deferred_work(struct iee
2136         cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
2137         cancel_delayed_work(&rtlpriv->works.fwevt_wq);
2138  }
2139 +EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
2140
2141  void rtl_init_rfkill(struct ieee80211_hw *hw)
2142  {
2143 @@ -440,6 +442,7 @@ void rtl_deinit_rfkill(struct ieee80211_
2144  {
2145         wiphy_rfkill_stop_polling(hw->wiphy);
2146  }
2147 +EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
2148
2149  int rtl_init_core(struct ieee80211_hw *hw)
2150  {
2151 @@ -490,10 +493,12 @@ int rtl_init_core(struct ieee80211_hw *h
2152
2153         return 0;
2154  }
2155 +EXPORT_SYMBOL_GPL(rtl_init_core);
2156
2157  void rtl_deinit_core(struct ieee80211_hw *hw)
2158  {
2159  }
2160 +EXPORT_SYMBOL_GPL(rtl_deinit_core);
2161
2162  void rtl_init_rx_config(struct ieee80211_hw *hw)
2163  {
2164 @@ -502,6 +507,7 @@ void rtl_init_rx_config(struct ieee80211
2165
2166         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
2167  }
2168 +EXPORT_SYMBOL_GPL(rtl_init_rx_config);
2169
2170  /*********************************************************
2171   *
2172 @@ -880,6 +886,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_h
2173
2174         return true;
2175  }
2176 +EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
2177
2178  void rtl_get_tcb_desc(struct ieee80211_hw *hw,
2179                       struct ieee80211_tx_info *info,
2180 @@ -1053,6 +1060,7 @@ bool rtl_action_proc(struct ieee80211_hw
2181
2182         return true;
2183  }
2184 +EXPORT_SYMBOL_GPL(rtl_action_proc);
2185
2186  /*should call before software enc*/
2187  u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
2188 @@ -1126,6 +1134,7 @@ u8 rtl_is_special_data(struct ieee80211_
2189
2190         return false;
2191  }
2192 +EXPORT_SYMBOL_GPL(rtl_is_special_data);
2193
2194  /*********************************************************
2195   *
2196 @@ -1301,6 +1310,7 @@ void rtl_beacon_statistic(struct ieee802
2197
2198         rtlpriv->link_info.bcn_rx_inperiod++;
2199  }
2200 +EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
2201
2202  void rtl_watchdog_wq_callback(void *data)
2203  {
2204 @@ -1794,6 +1804,7 @@ void rtl_recognize_peer(struct ieee80211
2205
2206         mac->vendor = vendor;
2207  }
2208 +EXPORT_SYMBOL_GPL(rtl_recognize_peer);
2209
2210  /*********************************************************
2211   *
2212 @@ -1850,6 +1861,7 @@ struct attribute_group rtl_attribute_gro
2213         .name = "rtlsysfs",
2214         .attrs = rtl_sysfs_entries,
2215  };
2216 +EXPORT_SYMBOL_GPL(rtl_attribute_group);
2217
2218  MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
2219  MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
2220 @@ -1857,7 +1869,8 @@ MODULE_AUTHOR("Larry Finger       <Larry.FInge
2221  MODULE_LICENSE("GPL");
2222  MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
2223
2224 -struct rtl_global_var global_var = {};
2225 +struct rtl_global_var rtl_global_var = {};
2226 +EXPORT_SYMBOL_GPL(rtl_global_var);
2227
2228  static int __init rtl_core_module_init(void)
2229  {
2230 @@ -1865,8 +1878,8 @@ static int __init rtl_core_module_init(v
2231                 pr_err("Unable to register rtl_rc, use default RC !!\n");
2232
2233         /* init some global vars */
2234 -       INIT_LIST_HEAD(&global_var.glb_priv_list);
2235 -       spin_lock_init(&global_var.glb_list_lock);
2236 +       INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
2237 +       spin_lock_init(&rtl_global_var.glb_list_lock);
2238
2239         return 0;
2240  }
2241 --- a/drivers/net/wireless/rtlwifi/base.h
2242 +++ b/drivers/net/wireless/rtlwifi/base.h
2243 @@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211
2244  u8 rtl_tid_to_ac(u8 tid);
2245  extern struct attribute_group rtl_attribute_group;
2246  void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
2247 -extern struct rtl_global_var global_var;
2248 +extern struct rtl_global_var rtl_global_var;
2249  int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
2250                          bool isht, u8 desc_rate, bool first_ampdu);
2251  bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
2252 --- a/drivers/net/wireless/rtlwifi/core.c
2253 +++ b/drivers/net/wireless/rtlwifi/core.c
2254 @@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
2255         .rfkill_poll = rtl_op_rfkill_poll,
2256         .flush = rtl_op_flush,
2257  };
2258 +EXPORT_SYMBOL_GPL(rtl_ops);
2259 --- a/drivers/net/wireless/rtlwifi/debug.c
2260 +++ b/drivers/net/wireless/rtlwifi/debug.c
2261 @@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211
2262
2263         /*Init Debug flag enable condition */
2264  }
2265 +EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
2266 --- a/drivers/net/wireless/rtlwifi/efuse.c
2267 +++ b/drivers/net/wireless/rtlwifi/efuse.c
2268 @@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw
2269
2270         *pbuf = (u8) (value32 & 0xff);
2271  }
2272 +EXPORT_SYMBOL_GPL(read_efuse_byte);
2273
2274  void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
2275  {
2276 --- a/drivers/net/wireless/rtlwifi/pci.c
2277 +++ b/drivers/net/wireless/rtlwifi/pci.c
2278 @@ -35,6 +35,13 @@
2279  #include "efuse.h"
2280  #include <linux/export.h>
2281  #include <linux/kmemleak.h>
2282 +#include <linux/module.h>
2283 +
2284 +MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
2285 +MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
2286 +MODULE_AUTHOR("Larry Finger    <Larry.FInger@lwfinger.net>");
2287 +MODULE_LICENSE("GPL");
2288 +MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
2289
2290  static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
2291         PCI_VENDOR_ID_INTEL,
2292 @@ -1899,7 +1906,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
2293         rtlpriv->rtlhal.interface = INTF_PCI;
2294         rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
2295         rtlpriv->intf_ops = &rtl_pci_ops;
2296 -       rtlpriv->glb_var = &global_var;
2297 +       rtlpriv->glb_var = &rtl_global_var;
2298
2299         /*
2300          *init dbgp flags before all
2301 --- a/drivers/net/wireless/rtlwifi/ps.c
2302 +++ b/drivers/net/wireless/rtlwifi/ps.c
2303 @@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw
2304
2305         spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
2306  }
2307 +EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
2308
2309  /*for FW LPS*/
2310
2311 @@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_h
2312                          "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
2313         }
2314  }
2315 +EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
2316
2317  void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
2318  {
2319 @@ -922,3 +924,4 @@ void rtl_p2p_info(struct ieee80211_hw *h
2320         else
2321                 rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
2322  }
2323 +EXPORT_SYMBOL_GPL(rtl_p2p_info);
2324 --- a/drivers/net/wireless/rtlwifi/usb.c
2325 +++ b/drivers/net/wireless/rtlwifi/usb.c
2326 @@ -32,6 +32,13 @@
2327  #include "ps.h"
2328  #include "rtl8192c/fw_common.h"
2329  #include <linux/export.h>
2330 +#include <linux/module.h>
2331 +
2332 +MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
2333 +MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
2334 +MODULE_AUTHOR("Larry Finger    <Larry.FInger@lwfinger.net>");
2335 +MODULE_LICENSE("GPL");
2336 +MODULE_DESCRIPTION("USB basic driver for rtlwifi");
2337
2338  #define        REALTEK_USB_VENQT_READ                  0xC0
2339  #define        REALTEK_USB_VENQT_WRITE                 0x40
2340 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
2341 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
2342 @@ -72,17 +72,12 @@ struct ath_config {
2343  /*************************/
2344
2345  #define ATH_TXBUF_RESET(_bf) do {                              \
2346 -               (_bf)->bf_stale = false;                        \
2347                 (_bf)->bf_lastbf = NULL;                        \
2348                 (_bf)->bf_next = NULL;                          \
2349                 memset(&((_bf)->bf_state), 0,                   \
2350                        sizeof(struct ath_buf_state));           \
2351         } while (0)
2352
2353 -#define ATH_RXBUF_RESET(_bf) do {              \
2354 -               (_bf)->bf_stale = false;        \
2355 -       } while (0)
2356 -
2357  /**
2358   * enum buffer_type - Buffer type flags
2359   *
2360 @@ -137,7 +132,8 @@ int ath_descdma_setup(struct ath_softc *
2361  #define ATH_AGGR_ENCRYPTDELIM      10
2362  /* minimum h/w qdepth to be sustained to maximize aggregation */
2363  #define ATH_AGGR_MIN_QDEPTH        2
2364 -#define ATH_AMPDU_SUBFRAME_DEFAULT 32
2365 +/* minimum h/w qdepth for non-aggregated traffic */
2366 +#define ATH_NON_AGGR_MIN_QDEPTH    8
2367
2368  #define IEEE80211_SEQ_SEQ_SHIFT    4
2369  #define IEEE80211_SEQ_MAX          4096
2370 @@ -174,12 +170,6 @@ int ath_descdma_setup(struct ath_softc *
2371
2372  #define ATH_TX_COMPLETE_POLL_INT       1000
2373
2374 -enum ATH_AGGR_STATUS {
2375 -       ATH_AGGR_DONE,
2376 -       ATH_AGGR_BAW_CLOSED,
2377 -       ATH_AGGR_LIMITED,
2378 -};
2379 -
2380  #define ATH_TXFIFO_DEPTH 8
2381  struct ath_txq {
2382         int mac80211_qnum; /* mac80211 queue number, -1 means not mac80211 Q */
2383 @@ -201,10 +191,10 @@ struct ath_txq {
2384
2385  struct ath_atx_ac {
2386         struct ath_txq *txq;
2387 -       int sched;
2388         struct list_head list;
2389         struct list_head tid_q;
2390         bool clear_ps_filter;
2391 +       bool sched;
2392  };
2393
2394  struct ath_frame_info {
2395 @@ -212,14 +202,16 @@ struct ath_frame_info {
2396         int framelen;
2397         enum ath9k_key_type keytype;
2398         u8 keyix;
2399 -       u8 retries;
2400         u8 rtscts_rate;
2401 +       u8 retries : 7;
2402 +       u8 baw_tracked : 1;
2403  };
2404
2405  struct ath_buf_state {
2406         u8 bf_type;
2407         u8 bfs_paprd;
2408         u8 ndelim;
2409 +       bool stale;
2410         u16 seqno;
2411         unsigned long bfs_paprd_timestamp;
2412  };
2413 @@ -233,7 +225,6 @@ struct ath_buf {
2414         void *bf_desc;                  /* virtual addr of desc */
2415         dma_addr_t bf_daddr;            /* physical addr of desc */
2416         dma_addr_t bf_buf_addr; /* physical addr of data buffer, for DMA */
2417 -       bool bf_stale;
2418         struct ieee80211_tx_rate rates[4];
2419         struct ath_buf_state bf_state;
2420  };
2421 @@ -241,16 +232,18 @@ struct ath_buf {
2422  struct ath_atx_tid {
2423         struct list_head list;
2424         struct sk_buff_head buf_q;
2425 +       struct sk_buff_head retry_q;
2426         struct ath_node *an;
2427         struct ath_atx_ac *ac;
2428         unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
2429 -       int bar_index;
2430         u16 seq_start;
2431         u16 seq_next;
2432         u16 baw_size;
2433 -       int tidno;
2434 +       u8 tidno;
2435         int baw_head;   /* first un-acked tx buffer */
2436         int baw_tail;   /* next unused tx buffer slot */
2437 +
2438 +       s8 bar_index;
2439         bool sched;
2440         bool paused;
2441         bool active;
2442 @@ -262,12 +255,13 @@ struct ath_node {
2443         struct ieee80211_vif *vif; /* interface with which we're associated */
2444         struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
2445         struct ath_atx_ac ac[IEEE80211_NUM_ACS];
2446 -       int ps_key;
2447
2448         u16 maxampdu;
2449         u8 mpdudensity;
2450 +       s8 ps_key;
2451
2452         bool sleeping;
2453 +       bool no_ps_filter;
2454
2455  #if defined(CPTCFG_MAC80211_DEBUGFS) && defined(CPTCFG_ATH9K_DEBUGFS)
2456         struct dentry *node_stat;
2457 @@ -317,6 +311,7 @@ struct ath_rx {
2458         struct ath_descdma rxdma;
2459         struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
2460
2461 +       struct ath_buf *buf_hold;
2462         struct sk_buff *frag;
2463
2464         u32 ampdu_ref;
2465 @@ -367,6 +362,7 @@ void ath9k_release_buffered_frames(struc
2466  /********/
2467
2468  struct ath_vif {
2469 +       struct ath_node mcast_node;
2470         int av_bslot;
2471         bool primary_sta_vif;
2472         __le64 tsf_adjust; /* TSF adjustment for staggered beacons */
2473 --- a/drivers/net/wireless/ath/ath9k/debug.c
2474 +++ b/drivers/net/wireless/ath/ath9k/debug.c
2475 @@ -607,6 +607,28 @@ static ssize_t read_file_xmit(struct fil
2476         return retval;
2477  }
2478
2479 +static ssize_t print_queue(struct ath_softc *sc, struct ath_txq *txq,
2480 +                          char *buf, ssize_t size)
2481 +{
2482 +       ssize_t len = 0;
2483 +
2484 +       ath_txq_lock(sc, txq);
2485 +
2486 +       len += snprintf(buf + len, size - len, "%s: %d ",
2487 +                       "qnum", txq->axq_qnum);
2488 +       len += snprintf(buf + len, size - len, "%s: %2d ",
2489 +                       "qdepth", txq->axq_depth);
2490 +       len += snprintf(buf + len, size - len, "%s: %2d ",
2491 +                       "ampdu-depth", txq->axq_ampdu_depth);
2492 +       len += snprintf(buf + len, size - len, "%s: %3d ",
2493 +                       "pending", txq->pending_frames);
2494 +       len += snprintf(buf + len, size - len, "%s: %d\n",
2495 +                       "stopped", txq->stopped);
2496 +
2497 +       ath_txq_unlock(sc, txq);
2498 +       return len;
2499 +}
2500 +
2501  static ssize_t read_file_queues(struct file *file, char __user *user_buf,
2502                                 size_t count, loff_t *ppos)
2503  {
2504 @@ -624,24 +646,13 @@ static ssize_t read_file_queues(struct f
2505
2506         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2507                 txq = sc->tx.txq_map[i];
2508 -               len += snprintf(buf + len, size - len, "(%s): ", qname[i]);
2509 -
2510 -               ath_txq_lock(sc, txq);
2511 -
2512 -               len += snprintf(buf + len, size - len, "%s: %d ",
2513 -                               "qnum", txq->axq_qnum);
2514 -               len += snprintf(buf + len, size - len, "%s: %2d ",
2515 -                               "qdepth", txq->axq_depth);
2516 -               len += snprintf(buf + len, size - len, "%s: %2d ",
2517 -                               "ampdu-depth", txq->axq_ampdu_depth);
2518 -               len += snprintf(buf + len, size - len, "%s: %3d ",
2519 -                               "pending", txq->pending_frames);
2520 -               len += snprintf(buf + len, size - len, "%s: %d\n",
2521 -                               "stopped", txq->stopped);
2522 -
2523 -               ath_txq_unlock(sc, txq);
2524 +               len += snprintf(buf + len, size - len, "(%s):  ", qname[i]);
2525 +               len += print_queue(sc, txq, buf + len, size - len);
2526         }
2527
2528 +       len += snprintf(buf + len, size - len, "(CAB): ");
2529 +       len += print_queue(sc, sc->beacon.cabq, buf + len, size - len);
2530 +
2531         if (len > size)
2532                 len = size;
2533
2534 --- a/net/mac80211/ibss.c
2535 +++ b/net/mac80211/ibss.c
2536 @@ -792,6 +792,17 @@ static void ieee80211_sta_find_ibss(stru
2537                 return;
2538         }
2539
2540 +       /* if a fixed bssid and a fixed freq have been provided create the IBSS
2541 +        * directly and do not waste time scanning
2542 +        */
2543 +       if (ifibss->fixed_bssid && ifibss->fixed_channel) {
2544 +               sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
2545 +                          bssid);
2546 +               ieee80211_sta_create_ibss(sdata);
2547 +               return;
2548 +       }
2549 +
2550 +
2551         ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
2552
2553         /* Selected IBSS not found in current scan results - try to scan */
2554 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
2555 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
2556 @@ -1173,6 +1173,10 @@ skip_ws_det:
2557                  * is_on == 0 means MRC CCK is OFF (more noise imm)
2558                  */
2559                 bool is_on = param ? 1 : 0;
2560 +
2561 +               if (ah->caps.rx_chainmask == 1)
2562 +                       break;
2563 +
2564                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
2565                               AR_PHY_MRC_CCK_ENABLE, is_on);
2566                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
2567 --- a/drivers/net/wireless/ath/ath9k/recv.c
2568 +++ b/drivers/net/wireless/ath/ath9k/recv.c
2569 @@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_s
2570         struct ath_desc *ds;
2571         struct sk_buff *skb;
2572
2573 -       ATH_RXBUF_RESET(bf);
2574 -
2575         ds = bf->bf_desc;
2576         ds->ds_link = 0; /* link to null */
2577         ds->ds_data = bf->bf_buf_addr;
2578 @@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_s
2579         sc->rx.rxlink = &ds->ds_link;
2580  }
2581
2582 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
2583 +{
2584 +       if (sc->rx.buf_hold)
2585 +               ath_rx_buf_link(sc, sc->rx.buf_hold);
2586 +
2587 +       sc->rx.buf_hold = bf;
2588 +}
2589 +
2590  static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
2591  {
2592         /* XXX block beacon interrupts */
2593 @@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct
2594
2595         skb = bf->bf_mpdu;
2596
2597 -       ATH_RXBUF_RESET(bf);
2598         memset(skb->data, 0, ah->caps.rx_status_len);
2599         dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
2600                                 ah->caps.rx_status_len, DMA_TO_DEVICE);
2601 @@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
2602         if (list_empty(&sc->rx.rxbuf))
2603                 goto start_recv;
2604
2605 +       sc->rx.buf_hold = NULL;
2606         sc->rx.rxlink = NULL;
2607         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
2608                 ath_rx_buf_link(sc, bf);
2609 @@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_b
2610         }
2611
2612         bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
2613 +       if (bf == sc->rx.buf_hold)
2614 +               return NULL;
2615 +
2616         ds = bf->bf_desc;
2617
2618         /*
2619 @@ -1375,7 +1384,7 @@ requeue:
2620                 if (edma) {
2621                         ath_rx_edma_buf_link(sc, qtype);
2622                 } else {
2623 -                       ath_rx_buf_link(sc, bf);
2624 +                       ath_rx_buf_relink(sc, bf);
2625                         ath9k_hw_rxena(ah);
2626                 }
2627         } while (1);