a74bd2b3eb3b5269bb45c09780688538ed4f3535
[openwrt.git] / package / kernel / mac80211 / patches / 300-pending_work.patch
1 commit c977493766310a825f406836636ffd66e1447783
2 Author: Felix Fietkau <nbd@openwrt.org>
3 Date:   Mon Mar 10 19:52:56 2014 +0100
4
5     ath9k_hw: remove ANI function restrictions for AP mode
6     
7     The primary purpose of this piece of code was to selectively disable
8     OFDM weak signal detection. The checks for this are elsewhere, and an
9     earlier commit relaxed the restrictions for older chips, which are more
10     sensitive to interference.
11     
12     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
13
14 commit 8d804f1af11e4e058b1e8453327777d73a585cb8
15 Author: Felix Fietkau <nbd@openwrt.org>
16 Date:   Sun Mar 9 11:25:43 2014 +0100
17
18     ath9k: clean up and enhance ANI debugfs file
19     
20     Unify scnprintf calls and include the current OFDM/CCK immunity level.
21     
22     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
23
24 commit 22e298b5a3a8a49e33805d4e351965123dede35b
25 Author: Felix Fietkau <nbd@openwrt.org>
26 Date:   Sun Mar 9 10:58:47 2014 +0100
27
28     ath9k: fix ready time of the multicast buffer queue
29     
30     qi->tqi_readyTime is written directly to registers that expect
31     microseconds as unit instead of TU.
32     When setting the CABQ ready time, cur_conf->beacon_interval is in TU, so
33     convert it to microseconds before passing it to ath9k_hw.
34     
35     This should hopefully fix some Tx DMA issues with buffered multicast
36     frames in AP mode.
37     
38     Cc: stable@vger.kernel.org
39     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
40
41 commit fcb064fdd5a27bec8d24099bc0172468f34c97cb
42 Author: Felix Fietkau <nbd@openwrt.org>
43 Date:   Sun Mar 9 09:43:09 2014 +0100
44
45     ath9k_hw: fix unreachable code in baseband hang detection code
46     
47     The commit "ath9k: reduce baseband hang detection false positive rate"
48     added a delay in the loop checking the baseband state, however it was
49     unreachable due to previous 'continue' statements.
50     
51     Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
52     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
53
54 commit 31959d8df39319e32c6d5ba9c135727be90cfad7
55 Author: Michal Kazior <michal.kazior@tieto.com>
56 Date:   Fri Mar 7 08:09:38 2014 +0100
57
58     mac80211: fix possible NULL dereference
59     
60     If chanctx is missing on a given vif then the band
61     is assumed to be 2GHz. However if hw doesn't
62     support 2GHz band then mac80211 ended up with a
63     NULL dereference.
64     
65     This fixes a splat:
66     
67     [ 4605.207223] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
68     [ 4605.210789] IP: [<ffffffffa07b5635>] ieee80211_parse_bitrates+0x65/0x110 [mac80211]
69     
70     The splat was preceeded by WARN_ON(!chanctx_conf)
71     in ieee80211_get_sdata_band().
72     
73     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
74
75 commit 6c5a3ffa0a2d22c091a2717f427259bacf77ac5e
76 Author: Michael Braun <michael-dev@fami-braun.de>
77 Date:   Thu Mar 6 15:08:43 2014 +0100
78
79     mac80211: fix WPA with VLAN on AP side with ps-sta again
80     
81     commit de74a1d9032f4d37ea453ad2a647e1aff4cd2591
82       "mac80211: fix WPA with VLAN on AP side with ps-sta"
83     fixed an issue where queued multicast packets would
84     be sent out encrypted with the key of an other bss.
85     
86     commit "7cbf9d017dbb5e3276de7d527925d42d4c11e732"
87       "mac80211: fix oops on mesh PS broadcast forwarding"
88     essentially reverted it, because vif.type cannot be AP_VLAN
89     due to the check to vif.type in ieee80211_get_buffered_bc before.
90     
91     As the later commit intended to fix the MESH case, fix it
92     by checking for IFTYPE_AP instead of IFTYPE_AP_VLAN.
93     
94     Fixes: 7cbf9d017dbb
95     Cc: <stable@vger.kernel.org> # 3.10.x
96     Cc: <stable@vger.kernel.org> # 3.11.x
97     Cc: <stable@vger.kernel.org> # 3.12.x
98     Cc: <stable@vger.kernel.org> # 3.13.x
99     Cc: <linux-wireless@vger.kernel.org>
100     Cc: <projekt-wlan@fem.tu-ilmenau.de>
101     Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
102
103 commit 9d6ab9bdb9b368a6cf9519f0f92509b5b2c297ec
104 Author: Johannes Berg <johannes.berg@intel.com>
105 Date:   Mon Mar 3 14:19:08 2014 +0100
106
107     cfg80211: remove racy beacon_interval assignment
108     
109     In case of AP mode, the beacon interval is already reset to
110     zero inside cfg80211_stop_ap(), and in the other modes it
111     isn't relevant. Remove the assignment to remove a potential
112     race since the assignment isn't properly locked.
113     
114     Reported-by: Michal Kazior <michal.kazior@tieto.com>
115     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
116
117 commit 1abdeca3c6fb9cf1f84f85e78ed8d1c33bd69db0
118 Author: Felix Fietkau <nbd@openwrt.org>
119 Date:   Fri Feb 28 18:52:56 2014 +0100
120
121     ath9k_hw: tweak noise immunity thresholds for older chipsets
122     
123     Older chipsets are more sensitive to high PHY error counts, and the
124     current noise immunity thresholds were based on tests run at QCA with
125     newer chipsets.
126     
127     This patch brings back the values from the old ANI implementation for
128     old chipsets, and it also disables weak signal detection on an earlier
129     noise immunity level, to improve overall radio stability on affected
130     devices.
131     
132     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
133
134 commit 431e506da5953adc3b65af25f4b90873d528c115
135 Author: Felix Fietkau <nbd@openwrt.org>
136 Date:   Fri Feb 28 18:44:13 2014 +0100
137
138     ath9k_hw: toggle weak signal detection in AP mode on older chipsets
139     
140     The commit 80b4205b "ath9k: Fix OFDM weak signal detection for AP mode"
141     prevented weak signal detection changes from taking effect in AP mode on
142     all chipsets, claiming it is "not allowed".
143     
144     The main reason for not disabling weak signal detection in AP mode is
145     that typically beacon RSSI is used to track whether it is needed to
146     boost range, and this is unavailable in AP mode for obvious reasons.
147     
148     The problem with not disabling weak signal detection is that older
149     chipsets are very sensitive to high PHY error counts. When faced with
150     heavy noise, this can lead to an excessive amount of "Failed to stop
151     TX DMA" errors in the field.
152     
153     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
154
155 commit 98d1a6c5b14688ed030e81b889f607be308e0df9
156 Author: Felix Fietkau <nbd@openwrt.org>
157 Date:   Mon Feb 24 22:20:32 2014 +0100
158
159     ath9k: fix invalid descriptor discarding
160     
161     Only set sc->rx.discard_next to rx_stats->rs_more when actually
162     discarding the current descriptor.
163     
164     Also, fix a detection of broken descriptors:
165     First the code checks if the current descriptor is not done.
166     Then it checks if the next descriptor is done.
167     Add a check that afterwards checks the first descriptor again, because
168     it might have been completed in the mean time.
169     
170     This fixes a regression introduced in
171     commit 723e711356b5a8a95728a890e254e8b0d47b55cf
172     "ath9k: fix handling of broken descriptors"
173     
174     Cc: stable@vger.kernel.org
175     Reported-by: Marco André Dinis <marcoandredinis@gmail.com>
176     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
177
178 commit 52a46300e782fe6994466523eb2b0b59091ea59f
179 Author: Felix Fietkau <nbd@openwrt.org>
180 Date:   Mon Feb 24 11:43:50 2014 +0100
181
182     ath9k: reduce baseband hang detection false positive rate
183     
184     Check if the baseband state remains stable, and add a small delay
185     between register reads.
186     
187     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
188
189 commit 118945bb12082e9d4edddc868d88143164e0f440
190 Author: Felix Fietkau <nbd@openwrt.org>
191 Date:   Sat Feb 22 14:55:23 2014 +0100
192
193     ath5k: set SURVEY_INFO_IN_USE on get_survey
194     
195     Only one channel is returned - the one currently being used.
196     
197     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
198
199 commit ee41f72476e1ea44283dfe1cbf75b9543a1e15c8
200 Author: Felix Fietkau <nbd@openwrt.org>
201 Date:   Sat Feb 22 14:44:52 2014 +0100
202
203     ath9k: make some hardware reset log messages debug-only
204     
205     On some chips, baseband watchdog hangs are more common than others, and
206     the driver has support for handling them.
207     Interrupts even after a watchdog hang are also quite common, so there's
208     not much point in spamming the user's logfiles.
209     
210     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
211
212 commit b14fbb554fc65a2e0b5c41a319269b0350f187e7
213 Author: Felix Fietkau <nbd@openwrt.org>
214 Date:   Sat Feb 22 14:35:25 2014 +0100
215
216     ath9k: do not set half/quarter channel flags in AR_PHY_MODE
217     
218     5/10 MHz channel bandwidth is configured via the PLL clock, instead of
219     the AR_PHY_MODE register. Using that register is AR93xx specific, and
220     makes the mode incompatible with earlier chipsets.
221     
222     In some early versions, these flags were apparently applied at the wrong
223     point in time and thus did not cause connectivity issues, however now
224     they are causing problems, as pointed out in this OpenWrt ticket:
225     
226     https://dev.openwrt.org/ticket/14916
227     
228     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
229
230 commit 0f1cb7be2551b30b02cd54c897e0e29e483cfda5
231 Author: Felix Fietkau <nbd@openwrt.org>
232 Date:   Sat Feb 22 13:43:29 2014 +0100
233
234     ath9k: fix ps-poll responses under a-mpdu sessions
235     
236     When passing tx frames to the U-APSD queue for powersave poll responses,
237     the ath_atx_tid pointer needs to be passed to ath_tx_setup_buffer for
238     proper sequence number accounting.
239     
240     This fixes high latency and connection stability issues with ath9k
241     running as AP and a few kinds of mobile phones as client, when PS-Poll
242     is heavily used
243     
244     Cc: stable@vger.kernel.org
245     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
246
247 commit d5d87a37bbd6066b2c3c5d0bd0fe2a6e2ea45cc5
248 Author: Felix Fietkau <nbd@openwrt.org>
249 Date:   Fri Feb 21 11:39:59 2014 +0100
250
251     ath9k: list more reset causes in debugfs
252     
253     Number of MAC hangs and stuck beacons were missing
254     
255     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
256
257 commit d84856012e0f10fe598a5ad3b7b869397a089e07
258 Author: Johannes Berg <johannes.berg@intel.com>
259 Date:   Thu Feb 20 11:19:58 2014 +0100
260
261     mac80211: fix station wakeup powersave race
262     
263     Consider the following (relatively unlikely) scenario:
264      1) station goes to sleep while frames are buffered in driver
265      2) driver blocks wakeup (until no more frames are buffered)
266      3) station wakes up again
267      4) driver unblocks wakeup
268     
269     In this case, the current mac80211 code will do the following:
270      1) WLAN_STA_PS_STA set
271      2) WLAN_STA_PS_DRIVER set
272      3) - nothing -
273      4) WLAN_STA_PS_DRIVER cleared
274     
275     As a result, no frames will be delivered to the client, even
276     though it is awake, until it sends another frame to us that
277     triggers ieee80211_sta_ps_deliver_wakeup() in sta_ps_end().
278     
279     Since we now take the PS spinlock, we can fix this while at
280     the same time removing the complexity with the pending skb
281     queue function. This was broken since my commit 50a9432daeec
282     ("mac80211: fix powersaving clients races") due to removing
283     the clearing of WLAN_STA_PS_STA in the RX path.
284     
285     While at it, fix a cleanup path issue when a station is
286     removed while the driver is still blocking its wakeup.
287     
288     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
289
290 commit 798f2786602cbe93e6b928299614aa36ebf50692
291 Author: Johannes Berg <johannes.berg@intel.com>
292 Date:   Mon Feb 17 20:49:03 2014 +0100
293
294     mac80211: insert stations before adding to driver
295     
296     There's a race condition in mac80211 because we add stations
297     to the internal lists after adding them to the driver, which
298     means that (for example) the following can happen:
299      1. a station connects and is added
300      2. first, it is added to the driver
301      3. then, it is added to the mac80211 lists
302     
303     If the station goes to sleep between steps 2 and 3, and the
304     firmware/hardware records it as being asleep, mac80211 will
305     never instruct the driver to wake it up again as it never
306     realized it went to sleep since the RX path discarded the
307     frame as a "spurious class 3 frame", no station entry was
308     present yet.
309     
310     Fix this by adding the station in software first, and only
311     then adding it to the driver. That way, any state that the
312     driver changes will be reflected properly in mac80211's
313     station state. The problematic part is the roll-back if the
314     driver fails to add the station, in that case a bit more is
315     needed. To not make that overly complex prevent starting BA
316     sessions in the meantime.
317     
318     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
319
320 commit b9ba6a520cb07ab3aa7aaaf9ce4a0bc7a6bc06fe
321 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
322 Date:   Thu Feb 20 09:22:11 2014 +0200
323
324     mac80211: fix AP powersave TX vs. wakeup race
325     
326     There is a race between the TX path and the STA wakeup: while
327     a station is sleeping, mac80211 buffers frames until it wakes
328     up, then the frames are transmitted. However, the RX and TX
329     path are concurrent, so the packet indicating wakeup can be
330     processed while a packet is being transmitted.
331     
332     This can lead to a situation where the buffered frames list
333     is emptied on the one side, while a frame is being added on
334     the other side, as the station is still seen as sleeping in
335     the TX path.
336     
337     As a result, the newly added frame will not be send anytime
338     soon. It might be sent much later (and out of order) when the
339     station goes to sleep and wakes up the next time.
340     
341     Additionally, it can lead to the crash below.
342     
343     Fix all this by synchronising both paths with a new lock.
344     Both path are not fastpath since they handle PS situations.
345     
346     In a later patch we'll remove the extra skb queue locks to
347     reduce locking overhead.
348     
349     BUG: unable to handle kernel
350     NULL pointer dereference at 000000b0
351     IP: [<ff6f1791>] ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
352     *pde = 00000000
353     Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
354     EIP: 0060:[<ff6f1791>] EFLAGS: 00210282 CPU: 1
355     EIP is at ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
356     EAX: e5900da0 EBX: 00000000 ECX: 00000001 EDX: 00000000
357     ESI: e41d00c0 EDI: e5900da0 EBP: ebe458e4 ESP: ebe458b0
358      DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
359     CR0: 8005003b CR2: 000000b0 CR3: 25a78000 CR4: 000407d0
360     DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
361     DR6: ffff0ff0 DR7: 00000400
362     Process iperf (pid: 3934, ti=ebe44000 task=e757c0b0 task.ti=ebe44000)
363     iwlwifi 0000:02:00.0: I iwl_pcie_enqueue_hcmd Sending command LQ_CMD (#4e), seq: 0x0903, 92 bytes at 3[3]:9
364     Stack:
365      e403b32c ebe458c4 00200002 00200286 e403b338 ebe458cc c10960bb e5900da0
366      ff76a6ec ebe458d8 00000000 e41d00c0 e5900da0 ebe458f0 ff6f1b75 e403b210
367      ebe4598c ff723dc1 00000000 ff76a6ec e597c978 e403b758 00000002 00000002
368     Call Trace:
369      [<ff6f1b75>] ieee80211_free_txskb+0x15/0x20 [mac80211]
370      [<ff723dc1>] invoke_tx_handlers+0x1661/0x1780 [mac80211]
371      [<ff7248a5>] ieee80211_tx+0x75/0x100 [mac80211]
372      [<ff7249bf>] ieee80211_xmit+0x8f/0xc0 [mac80211]
373      [<ff72550e>] ieee80211_subif_start_xmit+0x4fe/0xe20 [mac80211]
374      [<c149ef70>] dev_hard_start_xmit+0x450/0x950
375      [<c14b9aa9>] sch_direct_xmit+0xa9/0x250
376      [<c14b9c9b>] __qdisc_run+0x4b/0x150
377      [<c149f732>] dev_queue_xmit+0x2c2/0xca0
378     
379     Cc: stable@vger.kernel.org
380     Reported-by: Yaara Rozenblum <yaara.rozenblum@intel.com>
381     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
382     Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
383     [reword commit log, use a separate lock]
384     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
385
386 commit 80e419de0dff38436b30d363311c625766193f86
387 Author: Inbal Hacohen <Inbal.Hacohen@intel.com>
388 Date:   Wed Feb 12 09:32:27 2014 +0200
389
390     cfg80211: bugfix in regulatory user hint process
391     
392     After processing hint_user, we would want to schedule the
393     timeout work only if we are actually waiting to CRDA. This happens
394     when the status is not "IGNORE" nor "ALREADY_SET".
395     
396     Signed-off-by: Inbal Hacohen <Inbal.Hacohen@intel.com>
397     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
398
399 commit 6514c93afede55284e2cb63359aadedb85884c80
400 Author: Jouni Malinen <jouni@qca.qualcomm.com>
401 Date:   Tue Feb 18 20:41:08 2014 +0200
402
403     ath9k: Enable U-APSD AP mode support
404     
405     mac80211 handles the actual operations, so ath9k can just indicate
406     support for this. Based on initial tests, this combination seems to
407     work fine.
408     
409     Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
410
411 commit a63caf0a357ad5c1f08d6b7827dc76c451445017
412 Author: Stanislaw Gruszka <sgruszka@redhat.com>
413 Date:   Wed Feb 19 13:15:17 2014 +0100
414
415     ath9k: protect tid->sched check
416     
417     We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That
418     is race condition which can result of doing list_del(&tid->list) twice
419     (second time with poisoned list node) and cause crash like shown below:
420     
421     [424271.637220] BUG: unable to handle kernel paging request at 00100104
422     [424271.637328] IP: [<f90fc072>] ath_tx_aggr_sleep+0x62/0xe0 [ath9k]
423     ...
424     [424271.639953] Call Trace:
425     [424271.639998]  [<f90f6900>] ? ath9k_get_survey+0x110/0x110 [ath9k]
426     [424271.640083]  [<f90f6942>] ath9k_sta_notify+0x42/0x50 [ath9k]
427     [424271.640177]  [<f809cfef>] sta_ps_start+0x8f/0x1c0 [mac80211]
428     [424271.640258]  [<c10f730e>] ? free_compound_page+0x2e/0x40
429     [424271.640346]  [<f809e915>] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211]
430     [424271.640437]  [<c112f048>] ? kmem_cache_free+0x1d8/0x1f0
431     [424271.640510]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
432     [424271.640578]  [<c10fc23c>] ? put_page+0x2c/0x40
433     [424271.640640]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
434     [424271.640706]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
435     [424271.640787]  [<f809dde3>] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211]
436     [424271.640897]  [<f80a07a0>] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211]
437     [424271.641009]  [<f809e22d>] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211]
438     [424271.641104]  [<c13846ce>] ? ip_output+0x7e/0xd0
439     [424271.641182]  [<f80a1057>] ieee80211_rx+0x307/0x7c0 [mac80211]
440     [424271.641266]  [<f90fa6ee>] ath_rx_tasklet+0x88e/0xf70 [ath9k]
441     [424271.641358]  [<f80a0f2c>] ? ieee80211_rx+0x1dc/0x7c0 [mac80211]
442     [424271.641445]  [<f90f82db>] ath9k_tasklet+0xcb/0x130 [ath9k]
443     
444     Bug report:
445     https://bugzilla.kernel.org/show_bug.cgi?id=70551
446     
447     Reported-and-tested-by: Max Sydorenko <maxim.stargazer@gmail.com>
448     Cc: stable@vger.kernel.org
449     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
450
451 commit 82ed9e3ccc02797df2ffe4b78127c4cd5f799a41
452 Author: Felix Fietkau <nbd@openwrt.org>
453 Date:   Tue Feb 11 15:54:13 2014 +0100
454
455     mac80211: send control port protocol frames to the VO queue
456     
457     Improves reliability of wifi connections with WPA, since authentication
458     frames are prioritized over normal traffic and also typically exempt
459     from aggregation.
460     
461     Cc: stable@vger.kernel.org
462     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
463
464 commit d4426800f71e972feaa33e04c5801fc730627bdd
465 Author: Stanislaw Gruszka <stf_xl@wp.pl>
466 Date:   Mon Feb 10 22:38:28 2014 +0100
467
468     rtl8187: fix regression on MIPS without coherent DMA
469     
470     This patch fixes regression caused by commit a16dad77634 "MIPS: Fix
471     potencial corruption". That commit fixes one corruption scenario in
472     cost of adding another one, which actually start to cause crashes
473     on Yeeloong laptop when rtl8187 driver is used.
474     
475     For correct DMA read operation on machines without DMA coherence, kernel
476     have to invalidate cache, such it will refill later with new data that
477     device wrote to memory, when that data is needed to process. We can only
478     invalidate full cache line. Hence when cache line includes both dma
479     buffer and some other data (written in cache, but not yet in main
480     memory), the other data can not hit memory due to invalidation. That
481     happen on rtl8187 where struct rtl8187_priv fields are located just
482     before and after small buffers that are passed to USB layer and DMA
483     is performed on them.
484     
485     To fix the problem we align buffers and reserve space after them to make
486     them match cache line.
487     
488     This patch does not resolve all possible MIPS problems entirely, for
489     that we have to assure that we always map cache aligned buffers for DMA,
490     what can be complex or even not possible. But patch fixes visible and
491     reproducible regression and seems other possible corruptions do not
492     happen in practice, since Yeeloong laptop works stable without rtl8187
493     driver.
494     
495     Bug report:
496     https://bugzilla.kernel.org/show_bug.cgi?id=54391
497     
498     Reported-by: Petr Pisar <petr.pisar@atlas.cz>
499     Bisected-by: Tom Li <biergaizi2009@gmail.com>
500     Reported-and-tested-by: Tom Li <biergaizi2009@gmail.com>
501     Cc: stable@vger.kernel.org
502     Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
503
504 commit e2f141d67ad1e7fe10aaab61811e8a409dfb2442
505 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
506 Date:   Fri Feb 7 10:29:55 2014 +0530
507
508     ath9k: Calculate IQ-CAL median
509     
510     This patch adds a routine to calculate the median IQ correction
511     values for AR955x, which is used for outlier detection.
512     The normal method which is used for all other chips is
513     bypassed for AR955x.
514     
515     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
516
517 commit c52a6fce0820c8d0687443ab86058ae03b478c8f
518 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
519 Date:   Fri Feb 7 10:29:54 2014 +0530
520
521     ath9k: Expand the IQ coefficient array
522     
523     This will be used for storing data for mutiple
524     IQ calibration runs, for AR955x.
525     
526     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
527
528 commit 034969ff5c2b6431d10e07c1938f0b916da85cc3
529 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
530 Date:   Fri Feb 7 10:29:53 2014 +0530
531
532     ath9k: Modify IQ calibration for AR955x
533     
534     IQ calibration post-processing for AR955x is different
535     from other chips - instead of just doing it as part
536     of AGC calibration once, it is triggered 3 times and
537     a median is determined. This patch adds initial support
538     for changing the calibration behavior for AR955x.
539     
540     Also, to simplify things, a helper routine to issue/poll
541     AGC calibration is used.
542     
543     For non-AR955x chips, the iqcal_idx (which will be used
544     in subsequent patches) is set to zero.
545     
546     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
547
548 commit 9b1ed6454e6f3511f24266be99b4e403f243f6a8
549 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
550 Date:   Fri Feb 7 10:29:52 2014 +0530
551
552     ath9k: Fix magnitude/phase calculation
553     
554     Incorrect values are programmed in the registers
555     containing the IQ correction coefficients by the IQ-CAL
556     post-processing code. Fix this.
557     
558     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
559
560 commit 36f93484f96f79171dcecb67c5ef0c3de22531a6
561 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
562 Date:   Fri Feb 7 10:29:51 2014 +0530
563
564     ath9k: Rename ar9003_hw_tx_iqcal_load_avg_2_passes
565     
566     Use ar9003_hw_tx_iq_cal_outlier_detection instead.
567     
568     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
569
570 commit 3af09a7f5d21dd5fd15b973ce6a91a575da30417
571 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
572 Date:   Fri Feb 7 10:29:50 2014 +0530
573
574     ath9k: Check explicitly for IQ calibration
575     
576     In chips like AR955x, the initvals contain the information
577     whether IQ calibration is to be done in the HW when an
578     AGC calibration is triggered. Check if IQ-CAL is enabled
579     in the initvals before flagging 'txiqcal_done' as true.
580     
581     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
582
583 commit cb4969634b93c4643a32cc3fbd27d2b288b25771
584 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
585 Date:   Fri Feb 7 10:29:49 2014 +0530
586
587     ath9k: Fix IQ cal post processing for SoC
588     
589     Calibration data is not reused for SoC chips, so
590     call ar9003_hw_tx_iq_cal_post_proc() with the correct
591     argument. The 'is_reusable' flag is currently used
592     only for PC-OEM chips, but it makes things clearer to
593     specify it explicity.
594     
595     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
596
597 commit e138e0ef9560c46ce93dbb22a728a57888e94d1c
598 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
599 Date:   Mon Feb 3 13:31:37 2014 +0530
600
601     ath9k: Fix TX power calculation
602     
603     The commit, "ath9k_hw: Fix incorrect Tx control power in AR9003 template"
604     fixed the incorrect values in the eeprom templates, but if
605     boards have already been calibrated with incorrect values,
606     they would still be using the wrong TX power. Fix this by assigning
607     a default value in such cases.
608     
609     Cc: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
610     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
611
612 commit b9f268b5b01331c3c82179abca551429450e9417
613 Author: Michal Kazior <michal.kazior@tieto.com>
614 Date:   Wed Jan 29 14:22:27 2014 +0100
615
616     cfg80211: consider existing DFS interfaces
617     
618     It was possible to break interface combinations in
619     the following way:
620     
621      combo 1: iftype = AP, num_ifaces = 2, num_chans = 2,
622      combo 2: iftype = AP, num_ifaces = 1, num_chans = 1, radar = HT20
623     
624     With the above interface combinations it was
625     possible to:
626     
627      step 1. start AP on DFS channel by matching combo 2
628      step 2. start AP on non-DFS channel by matching combo 1
629     
630     This was possible beacuse (step 2) did not consider
631     if other interfaces require radar detection.
632     
633     The patch changes how cfg80211 tracks channels -
634     instead of channel itself now a complete chandef
635     is stored.
636     
637     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
638     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
639
640 commit bc9c62f5f511cc395c62dbf4cdd437f23db53b28
641 Author: Antonio Quartulli <antonio@open-mesh.com>
642 Date:   Wed Jan 29 17:53:43 2014 +0100
643
644     cfg80211: fix channel configuration in IBSS join
645     
646     When receiving an IBSS_JOINED event select the BSS object
647     based on the {bssid, channel} couple rather than the bssid
648     only.
649     With the current approach if another cell having the same
650     BSSID (but using a different channel) exists then cfg80211
651     picks up the wrong BSS object.
652     The result is a mismatching channel configuration between
653     cfg80211 and the driver, that can lead to any sort of
654     problem.
655     
656     The issue can be triggered by having an IBSS sitting on
657     given channel and then asking the driver to create a new
658     cell using the same BSSID but with a different frequency.
659     By passing the channel to cfg80211_get_bss() we can solve
660     this ambiguity and retrieve/create the correct BSS object.
661     All the users of cfg80211_ibss_joined() have been changed
662     accordingly.
663     
664     Moreover WARN when cfg80211_ibss_joined() gets a NULL
665     channel as argument and remove a bogus call of the same
666     function in ath6kl (it does not make sense to call
667     cfg80211_ibss_joined() with a zero BSSID on ibss-leave).
668     
669     Cc: Kalle Valo <kvalo@qca.qualcomm.com>
670     Cc: Arend van Spriel <arend@broadcom.com>
671     Cc: Bing Zhao <bzhao@marvell.com>
672     Cc: Jussi Kivilinna <jussi.kivilinna@iki.fi>
673     Cc: libertas-dev@lists.infradead.org
674     Acked-by: Kalle Valo <kvalo@qca.qualcomm.com>
675     Signed-off-by: Antonio Quartulli <antonio@open-mesh.com>
676     [minor code cleanup in ath6kl]
677     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
678
679 commit 7e0c41cb41f215aba2c39b1c237bb4d42ec49a85
680 Author: Johannes Berg <johannes.berg@intel.com>
681 Date:   Fri Jan 24 14:41:44 2014 +0100
682
683     mac80211: fix bufferable MMPDU RX handling
684     
685     Action, disassoc and deauth frames are bufferable, and as such don't
686     have the PM bit in the frame control field reserved which means we
687     need to react to the bit when receiving in such a frame.
688     
689     Fix this by introducing a new helper ieee80211_is_bufferable_mmpdu()
690     and using it for the RX path that currently ignores the PM bit in
691     any non-data frames for doze->wake transitions, but listens to it in
692     all frames for wake->doze transitions, both of which are wrong.
693     
694     Also use the new helper in the TX path to clean up the code.
695     
696     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
697
698 commit fc0df6d2343636e3f48a069330d5b972e3d8659d
699 Author: Janusz Dziedzic <janusz.dziedzic@tieto.com>
700 Date:   Fri Jan 24 14:29:21 2014 +0100
701
702     cfg80211: set preset_chandef after channel switch
703     
704     Set preset_chandef in channel switch notification.
705     In other case we will have old preset_chandef.
706     
707     Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
708     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
709
710 commit cdec895e2344987ff171cece96e25d7407a3ebf6
711 Author: Simon Wunderlich <simon@open-mesh.com>
712 Date:   Fri Jan 24 23:48:29 2014 +0100
713
714     mac80211: send ibss probe responses with noack flag
715     
716     Responding to probe requests for scanning clients will often create
717     excessive retries, as it happens quite often that the scanning client
718     already left the channel. Therefore do it like hostapd and send probe
719     responses for wildcard SSID only once by using the noack flag.
720     
721     Signed-off-by: Simon Wunderlich <simon@open-mesh.com>
722     [fix typo & 'wildcard SSID' in commit log]
723     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
724
725 commit 0b865d1e6b9c05052adae9315df7cb195dc60c3b
726 Author: Luciano Coelho <luciano.coelho@intel.com>
727 Date:   Tue Jan 28 17:09:08 2014 +0200
728
729     mac80211: ibss: remove unnecessary call to release channel
730     
731     The ieee80211_vif_use_channel() function calls
732     ieee80211_vif_release_channel(), so there's no need to call it
733     explicitly in __ieee80211_sta_join_ibss().
734     
735     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
736     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
737
738 commit e1b6c17e971f0a51ff86c2dac2584c63cd999cd7
739 Author: Michal Kazior <michal.kazior@tieto.com>
740 Date:   Wed Jan 29 07:56:21 2014 +0100
741
742     mac80211: add missing CSA locking
743     
744     The patch adds a missing sdata lock and adds a few
745     lockdeps for easier maintenance.
746     
747     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
748     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
749
750 commit ad17ba7d14d225b109b73c177cd446afb8050598
751 Author: Michal Kazior <michal.kazior@tieto.com>
752 Date:   Wed Jan 29 07:56:20 2014 +0100
753
754     mac80211: fix sdata->radar_required locking
755     
756     radar_required setting wasn't protected by
757     local->mtx in some places. This should prevent
758     from scanning/radar detection/roc colliding.
759     
760     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
761     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
762
763 commit 5fcd5f1808813a3d9e502fd756e01bee8a79c85d
764 Author: Michal Kazior <michal.kazior@tieto.com>
765 Date:   Wed Jan 29 07:56:19 2014 +0100
766
767     mac80211: move csa_active setting in STA CSA
768     
769     The sdata->vif.csa_active could be left set after,
770     e.g. channel context constraints check fail in STA
771     mode leaving the interface in a strange state for
772     a brief period of time until it is disconnected.
773     This was harmless but ugly.
774     
775     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
776     Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
777     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
778
779 commit e486da4b7eed71821c6b4c1bb9ac62ffd3ab13e9
780 Author: Michal Kazior <michal.kazior@tieto.com>
781 Date:   Wed Jan 29 07:56:18 2014 +0100
782
783     mac80211: fix possible memory leak on AP CSA failure
784     
785     If CSA for AP interface failed and the interface
786     was not stopped afterwards another CSA request
787     would leak sdata->u.ap.next_beacon.
788     
789     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
790     Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
791     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
792
793 commit 3a77ba08940682bf3d52cf14f980337324af9d4a
794 Author: Johannes Berg <johannes.berg@intel.com>
795 Date:   Sat Feb 1 00:33:29 2014 +0100
796
797     mac80211: fix fragmentation code, particularly for encryption
798     
799     The "new" fragmentation code (since my rewrite almost 5 years ago)
800     erroneously sets skb->len rather than using skb_trim() to adjust
801     the length of the first fragment after copying out all the others.
802     This leaves the skb tail pointer pointing to after where the data
803     originally ended, and thus causes the encryption MIC to be written
804     at that point, rather than where it belongs: immediately after the
805     data.
806     
807     The impact of this is that if software encryption is done, then
808      a) encryption doesn't work for the first fragment, the connection
809         becomes unusable as the first fragment will never be properly
810         verified at the receiver, the MIC is practically guaranteed to
811         be wrong
812      b) we leak up to 8 bytes of plaintext (!) of the packet out into
813         the air
814     
815     This is only mitigated by the fact that many devices are capable
816     of doing encryption in hardware, in which case this can't happen
817     as the tail pointer is irrelevant in that case. Additionally,
818     fragmentation is not used very frequently and would normally have
819     to be configured manually.
820     
821     Fix this by using skb_trim() properly.
822     
823     Cc: stable@vger.kernel.org
824     Fixes: 2de8e0d999b8 ("mac80211: rewrite fragmentation")
825     Reported-by: Jouni Malinen <j@w1.fi>
826     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
827
828 commit de5f242e0c10e841017e37eb8c38974a642dbca8
829 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
830 Date:   Tue Jan 28 06:21:59 2014 +0530
831
832     ath9k: Fix build error on ARM
833     
834     Use mdelay instead of udelay to fix this error:
835     
836     ERROR: "__bad_udelay" [drivers/net/wireless/ath/ath9k/ath9k_hw.ko] undefined!
837     make[1]: *** [__modpost] Error 1
838     make: *** [modules] Error 2
839     
840     Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
841     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
842
843 commit 8e3ea7a51dfc61810fcefd947f6edcf61125252a
844 Author: Geert Uytterhoeven <geert@linux-m68k.org>
845 Date:   Sun Jan 26 11:53:21 2014 +0100
846
847     ath9k: Fix uninitialized variable in ath9k_has_tx_pending()
848     
849     drivers/net/wireless/ath/ath9k/main.c: In function ‘ath9k_has_tx_pending’:
850     drivers/net/wireless/ath/ath9k/main.c:1869: warning: ‘npend’ may be used uninitialized in this function
851     
852     Introduced by commit 10e2318103f5941aa70c318afe34bc41f1b98529 ("ath9k:
853     optimize ath9k_flush").
854     
855     Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
856
857 commit a4a634a6937ebdd827fa58e8fcdb8ca49a3769f6
858 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
859 Date:   Mon Jan 27 11:07:42 2014 +0200
860
861     mac80211: release the channel in error path in start_ap
862     
863     When the driver cannot start the AP or when the assignement
864     of the beacon goes wrong, we need to unassign the vif.
865     
866     Cc: stable@vger.kernel.org
867     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
868     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
869
870 commit dfb6889a75c601aedb7450b7e606668e77da6679
871 Author: Johannes Berg <johannes.berg@intel.com>
872 Date:   Wed Jan 22 11:14:19 2014 +0200
873
874     cfg80211: send scan results from work queue
875     
876     Due to the previous commit, when a scan finishes, it is in theory
877     possible to hit the following sequence:
878      1. interface starts being removed
879      2. scan is cancelled by driver and cfg80211 is notified
880      3. scan done work is scheduled
881      4. interface is removed completely, rdev->scan_req is freed,
882         event sent to userspace but scan done work remains pending
883      5. new scan is requested on another virtual interface
884      6. scan done work runs, freeing the still-running scan
885     
886     To fix this situation, hang on to the scan done message and block
887     new scans while that is the case, and only send the message from
888     the work function, regardless of whether the scan_req is already
889     freed from interface removal. This makes step 5 above impossible
890     and changes step 6 to be
891      5. scan done work runs, sending the scan done message
892     
893     As this can't work for wext, so we send the message immediately,
894     but this shouldn't be an issue since we still return -EBUSY.
895     
896     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
897
898 commit 45b7ab41fc08627d9a8428cb413d5d84662a9707
899 Author: Johannes Berg <johannes.berg@intel.com>
900 Date:   Wed Jan 22 11:14:18 2014 +0200
901
902     cfg80211: fix scan done race
903     
904     When an interface/wdev is removed, any ongoing scan should be
905     cancelled by the driver. This will make it call cfg80211, which
906     only queues a work struct. If interface/wdev removal is quick
907     enough, this can leave the scan request pending and processed
908     only after the interface is gone, causing a use-after-free.
909     
910     Fix this by making sure the scan request is not pending after
911     the interface is destroyed. We can't flush or cancel the work
912     item due to locking concerns, but when it'll run it shouldn't
913     find anything to do. This leaves a potential issue, if a new
914     scan gets requested before the work runs, it prematurely stops
915     the running scan, potentially causing another crash. I'll fix
916     that in the next patch.
917     
918     This was particularly observed with P2P_DEVICE wdevs, likely
919     because freeing them is quicker than freeing netdevs.
920     
921     Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
922     Fixes: 4a58e7c38443 ("cfg80211: don't "leak" uncompleted scans")
923     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
924
925 commit ae04fa489ab31b5a10d3cc8399f52761175d4321
926 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
927 Date:   Thu Jan 23 14:28:16 2014 +0200
928
929     mac80211: avoid deadlock revealed by lockdep
930     
931     sdata->u.ap.request_smps_work can’t be flushed synchronously
932     under wdev_lock(wdev) since ieee80211_request_smps_ap_work
933     itself locks the same lock.
934     While at it, reset the driver_smps_mode when the ap is
935     stopped to its default: OFF.
936     
937     This solves:
938     
939     ======================================================
940     [ INFO: possible circular locking dependency detected ]
941     3.12.0-ipeer+ #2 Tainted: G           O
942     -------------------------------------------------------
943     rmmod/2867 is trying to acquire lock:
944       ((&sdata->u.ap.request_smps_work)){+.+...}, at: [<c105b8d0>] flush_work+0x0/0x90
945     
946     but task is already holding lock:
947       (&wdev->mtx){+.+.+.}, at: [<f9b32626>] cfg80211_stop_ap+0x26/0x230 [cfg80211]
948     
949     which lock already depends on the new lock.
950     
951     the existing dependency chain (in reverse order) is:
952     
953     -> #1 (&wdev->mtx){+.+.+.}:
954             [<c10aefa9>] lock_acquire+0x79/0xe0
955             [<c1607a1a>] mutex_lock_nested+0x4a/0x360
956             [<fb06288b>] ieee80211_request_smps_ap_work+0x2b/0x50 [mac80211]
957             [<c105cdd8>] process_one_work+0x198/0x450
958             [<c105d469>] worker_thread+0xf9/0x320
959             [<c10669ff>] kthread+0x9f/0xb0
960             [<c1613397>] ret_from_kernel_thread+0x1b/0x28
961     
962     -> #0 ((&sdata->u.ap.request_smps_work)){+.+...}:
963             [<c10ae9df>] __lock_acquire+0x183f/0x1910
964             [<c10aefa9>] lock_acquire+0x79/0xe0
965             [<c105b917>] flush_work+0x47/0x90
966             [<c105d867>] __cancel_work_timer+0x67/0xe0
967             [<c105d90f>] cancel_work_sync+0xf/0x20
968             [<fb0765cc>] ieee80211_stop_ap+0x8c/0x340 [mac80211]
969             [<f9b3268c>] cfg80211_stop_ap+0x8c/0x230 [cfg80211]
970             [<f9b0d8f9>] cfg80211_leave+0x79/0x100 [cfg80211]
971             [<f9b0da72>] cfg80211_netdev_notifier_call+0xf2/0x4f0 [cfg80211]
972             [<c160f2c9>] notifier_call_chain+0x59/0x130
973             [<c106c6de>] __raw_notifier_call_chain+0x1e/0x30
974             [<c106c70f>] raw_notifier_call_chain+0x1f/0x30
975             [<c14f8213>] call_netdevice_notifiers_info+0x33/0x70
976             [<c14f8263>] call_netdevice_notifiers+0x13/0x20
977             [<c14f82a4>] __dev_close_many+0x34/0xb0
978             [<c14f83fe>] dev_close_many+0x6e/0xc0
979             [<c14f9c77>] rollback_registered_many+0xa7/0x1f0
980             [<c14f9dd4>] unregister_netdevice_many+0x14/0x60
981             [<fb06f4d9>] ieee80211_remove_interfaces+0xe9/0x170 [mac80211]
982             [<fb055116>] ieee80211_unregister_hw+0x56/0x110 [mac80211]
983             [<fa3e9396>] iwl_op_mode_mvm_stop+0x26/0xe0 [iwlmvm]
984             [<f9b9d8ca>] _iwl_op_mode_stop+0x3a/0x70 [iwlwifi]
985             [<f9b9d96f>] iwl_opmode_deregister+0x6f/0x90 [iwlwifi]
986             [<fa405179>] __exit_compat+0xd/0x19 [iwlmvm]
987             [<c10b8bf9>] SyS_delete_module+0x179/0x2b0
988             [<c1613421>] sysenter_do_call+0x12/0x32
989     
990     Fixes: 687da132234f ("mac80211: implement SMPS for AP")
991     Cc: <stable@vger.kernel.org> [3.13]
992     Reported-by: Ilan Peer <ilan.peer@intel.com>
993     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
994     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
995
996 commit 178b205e96217164fd7c30113464250d0b6f5eca
997 Author: Johannes Berg <johannes.berg@intel.com>
998 Date:   Thu Jan 23 16:32:29 2014 +0100
999
1000     cfg80211: re-enable 5/10 MHz support
1001     
1002     Unfortunately I forgot this during the merge window, but the
1003     patch seems small enough to go in as a fix. The userspace API
1004     bug that was the reason for disabling it has long been fixed.
1005     
1006     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1007
1008 commit 110a1c79acda14edc83b7c8dc5af9c7ddd23eb61
1009 Author: Pontus Fuchs <pontus.fuchs@gmail.com>
1010 Date:   Thu Jan 16 15:00:40 2014 +0100
1011
1012     nl80211: Reset split_start when netlink skb is exhausted
1013     
1014     When the netlink skb is exhausted split_start is left set. In the
1015     subsequent retry, with a larger buffer, the dump is continued from the
1016     failing point instead of from the beginning.
1017     
1018     This was causing my rt28xx based USB dongle to now show up when
1019     running "iw list" with an old iw version without split dump support.
1020     
1021     Cc: stable@vger.kernel.org
1022     Fixes: 3713b4e364ef ("nl80211: allow splitting wiphy information in dumps")
1023     Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
1024     [avoid the entire workaround when state->split is set]
1025     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1026
1027 commit b4c31b45ffc7ef110fa9ecc34d7878fe7c5b9da4
1028 Author: Eliad Peller <eliad@wizery.com>
1029 Date:   Sun Jan 12 11:06:37 2014 +0200
1030
1031     mac80211: move roc cookie assignment earlier
1032     
1033     ieee80211_start_roc_work() might add a new roc
1034     to existing roc, and tell cfg80211 it has already
1035     started.
1036     
1037     However, this might happen before the roc cookie
1038     was set, resulting in REMAIN_ON_CHANNEL (started)
1039     event with null cookie. Consequently, it can make
1040     wpa_supplicant go out of sync.
1041     
1042     Fix it by setting the roc cookie earlier.
1043     
1044     Cc: stable@vger.kernel.org
1045     Signed-off-by: Eliad Peller <eliad@wizery.com>
1046     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1047
1048 commit cfdc9157bfd7bcf88ab4dae08873a9907eba984c
1049 Author: Johannes Berg <johannes.berg@intel.com>
1050 Date:   Fri Jan 24 14:06:29 2014 +0100
1051
1052     nl80211: send event when AP operation is stopped
1053     
1054     There are a few cases, e.g. suspend, where an AP interface is
1055     stopped by the kernel rather than by userspace request, most
1056     commonly when suspending. To let userspace know about this,
1057     send the NL80211_CMD_STOP_AP command as an event every time
1058     an AP interface is stopped. This also happens when userspace
1059     did in fact request the AP stop, but that's not a problem.
1060     
1061     For full-MAC drivers this may need to be extended to also
1062     cover cases where the device stopped the AP operation for
1063     some reason, this a bit more complicated because then all
1064     cfg80211 state also needs to be reset; such API is not part
1065     of this patch.
1066     
1067     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1068
1069 commit d5d567eda7704f190379ca852a8f9a4112e3eee3
1070 Author: Johannes Berg <johannes.berg@intel.com>
1071 Date:   Thu Jan 23 16:20:29 2014 +0100
1072
1073     mac80211: add length check in ieee80211_is_robust_mgmt_frame()
1074     
1075     A few places weren't checking that the frame passed to the
1076     function actually has enough data even though the function
1077     clearly documents it must have a payload byte. Make this
1078     safer by changing the function to take an skb and checking
1079     the length inside. The old version is preserved for now as
1080     the rtl* drivers use it and don't have a correct skb.
1081     
1082     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1083
1084 commit f8f6d212a047fc65c7d3442dfc038f65517236fc
1085 Author: Johannes Berg <johannes.berg@intel.com>
1086 Date:   Fri Jan 24 10:53:53 2014 +0100
1087
1088     nl80211: fix scheduled scan RSSI matchset attribute confusion
1089     
1090     The scheduled scan matchsets were intended to be a list of filters,
1091     with the found BSS having to pass at least one of them to be passed
1092     to the host. When the RSSI attribute was added, however, this was
1093     broken and currently wpa_supplicant adds that attribute in its own
1094     matchset; however, it doesn't intend that to mean that anything
1095     that passes the RSSI filter should be passed to the host, instead
1096     it wants it to mean that everything needs to also have higher RSSI.
1097     
1098     This is semantically problematic because we have a list of filters
1099     like [ SSID1, SSID2, SSID3, RSSI ] with no real indication which
1100     one should be OR'ed and which one AND'ed.
1101     
1102     To fix this, move the RSSI filter attribute into each matchset. As
1103     we need to stay backward compatible, treat a matchset with only the
1104     RSSI attribute as a "default RSSI filter" for all other matchsets,
1105     but only if there are other matchsets (an RSSI-only matchset by
1106     itself is still desirable.)
1107     
1108     To make driver implementation easier, keep a global min_rssi_thold
1109     for the entire request as well. The only affected driver is ath6kl.
1110     
1111     I found this when I looked into the code after Raja Mani submitted
1112     a patch fixing the n_match_sets calculation to disregard the RSSI,
1113     but that patch didn't address the semantic issue.
1114     
1115     Reported-by: Raja Mani <rmani@qti.qualcomm.com>
1116     Acked-by: Luciano Coelho <luciano.coelho@intel.com>
1117     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1118
1119 commit de553e8545e65a6dc4e45f43df7e1443d4291922
1120 Author: Johannes Berg <johannes.berg@intel.com>
1121 Date:   Fri Jan 24 10:17:47 2014 +0100
1122
1123     nl80211: check nla_parse() return values
1124     
1125     If there's a policy, then nla_parse() return values must be
1126     checked, otherwise the policy is useless and there's nothing
1127     that ensures the attributes are actually what we expect them
1128     to be.
1129     
1130     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1131
1132 commit 652204a0733e9e1c54661d6f9d36e2e1e3b22bb1
1133 Author: Karl Beldan <karl.beldan@rivierawaves.com>
1134 Date:   Thu Jan 23 20:06:34 2014 +0100
1135
1136     mac80211: send {ADD,DEL}BA on AC_VO like other mgmt frames, as per spec
1137     
1138     ATM, {ADD,DEL}BA and BAR frames are sent on the AC matching the TID of
1139     the BA parameters. In the discussion [1] about this patch, Johannes
1140     recalled that it fixed some races with the DELBA and indeed this
1141     behavior was introduced in [2].
1142     While [2] is right for the BARs, the part queueing the {ADD,DEL}BAs on
1143     their BA params TID AC violates the spec and is more a workaround for
1144     some drivers. Helmut expressed some concerns wrt such drivers, in
1145     particular DELBAs in rt2x00.
1146     
1147     ATM, DELBAs are sent after a driver has called (hence "purposely")
1148     ieee80211_start_tx_ba_cb_irqsafe and Johannes and Emmanuel gave some
1149     details wrt intentions behind the split of the IEEE80211_AMPDU_TX_STOP_*
1150     given to the driver ampdu_action supposed to call this function, which
1151     could prove handy to people trying to do the right thing in faulty
1152     drivers (if their fw/hw don't get in their way).
1153     
1154     [1] http://mid.gmane.org/1390391564-18481-1-git-send-email-karl.beldan@gmail.com
1155     [2] Commit: cf6bb79ad828 ("mac80211: Use appropriate TID for sending BAR, ADDBA and DELBA frames")
1156     
1157     Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com>
1158     Cc: Helmut Schaa <helmut.schaa@googlemail.com>
1159     Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
1160     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1161 --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
1162 +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
1163 @@ -790,7 +790,7 @@ void ath6kl_cfg80211_connect_event(struc
1164         if (nw_type & ADHOC_NETWORK) {
1165                 ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "ad-hoc %s selected\n",
1166                            nw_type & ADHOC_CREATOR ? "creator" : "joiner");
1167 -               cfg80211_ibss_joined(vif->ndev, bssid, GFP_KERNEL);
1168 +               cfg80211_ibss_joined(vif->ndev, bssid, chan, GFP_KERNEL);
1169                 cfg80211_put_bss(ar->wiphy, bss);
1170                 return;
1171         }
1172 @@ -861,13 +861,9 @@ void ath6kl_cfg80211_disconnect_event(st
1173         }
1174  
1175         if (vif->nw_type & ADHOC_NETWORK) {
1176 -               if (vif->wdev.iftype != NL80211_IFTYPE_ADHOC) {
1177 +               if (vif->wdev.iftype != NL80211_IFTYPE_ADHOC)
1178                         ath6kl_dbg(ATH6KL_DBG_WLAN_CFG,
1179                                    "%s: ath6k not in ibss mode\n", __func__);
1180 -                       return;
1181 -               }
1182 -               memset(bssid, 0, ETH_ALEN);
1183 -               cfg80211_ibss_joined(vif->ndev, bssid, GFP_KERNEL);
1184                 return;
1185         }
1186  
1187 @@ -3256,6 +3252,15 @@ static int ath6kl_cfg80211_sscan_start(s
1188         struct ath6kl_vif *vif = netdev_priv(dev);
1189         u16 interval;
1190         int ret, rssi_thold;
1191 +       int n_match_sets = request->n_match_sets;
1192 +
1193 +       /*
1194 +        * If there's a matchset w/o an SSID, then assume it's just for
1195 +        * the RSSI (nothing else is currently supported) and ignore it.
1196 +        * The device only supports a global RSSI filter that we set below.
1197 +        */
1198 +       if (n_match_sets == 1 && !request->match_sets[0].ssid.ssid_len)
1199 +               n_match_sets = 0;
1200  
1201         if (ar->state != ATH6KL_STATE_ON)
1202                 return -EIO;
1203 @@ -3268,11 +3273,11 @@ static int ath6kl_cfg80211_sscan_start(s
1204         ret = ath6kl_set_probed_ssids(ar, vif, request->ssids,
1205                                       request->n_ssids,
1206                                       request->match_sets,
1207 -                                     request->n_match_sets);
1208 +                                     n_match_sets);
1209         if (ret < 0)
1210                 return ret;
1211  
1212 -       if (!request->n_match_sets) {
1213 +       if (!n_match_sets) {
1214                 ret = ath6kl_wmi_bssfilter_cmd(ar->wmi, vif->fw_vif_idx,
1215                                                ALL_BSS_FILTER, 0);
1216                 if (ret < 0)
1217 @@ -3286,12 +3291,12 @@ static int ath6kl_cfg80211_sscan_start(s
1218  
1219         if (test_bit(ATH6KL_FW_CAPABILITY_RSSI_SCAN_THOLD,
1220                      ar->fw_capabilities)) {
1221 -               if (request->rssi_thold <= NL80211_SCAN_RSSI_THOLD_OFF)
1222 +               if (request->min_rssi_thold <= NL80211_SCAN_RSSI_THOLD_OFF)
1223                         rssi_thold = 0;
1224 -               else if (request->rssi_thold < -127)
1225 +               else if (request->min_rssi_thold < -127)
1226                         rssi_thold = -127;
1227                 else
1228 -                       rssi_thold = request->rssi_thold;
1229 +                       rssi_thold = request->min_rssi_thold;
1230  
1231                 ret = ath6kl_wmi_set_rssi_filter_cmd(ar->wmi, vif->fw_vif_idx,
1232                                                      rssi_thold);
1233 --- a/drivers/net/wireless/ath/ath9k/hw.c
1234 +++ b/drivers/net/wireless/ath/ath9k/hw.c
1235 @@ -1316,7 +1316,7 @@ static bool ath9k_hw_set_reset(struct at
1236         if (AR_SREV_9300_20_OR_LATER(ah))
1237                 udelay(50);
1238         else if (AR_SREV_9100(ah))
1239 -               udelay(10000);
1240 +               mdelay(10);
1241         else
1242                 udelay(100);
1243  
1244 @@ -1534,7 +1534,7 @@ EXPORT_SYMBOL(ath9k_hw_check_nav);
1245  bool ath9k_hw_check_alive(struct ath_hw *ah)
1246  {
1247         int count = 50;
1248 -       u32 reg;
1249 +       u32 reg, last_val;
1250  
1251         if (AR_SREV_9300(ah))
1252                 return !ath9k_hw_detect_mac_hang(ah);
1253 @@ -1542,9 +1542,14 @@ bool ath9k_hw_check_alive(struct ath_hw 
1254         if (AR_SREV_9285_12_OR_LATER(ah))
1255                 return true;
1256  
1257 +       last_val = REG_READ(ah, AR_OBS_BUS_1);
1258         do {
1259                 reg = REG_READ(ah, AR_OBS_BUS_1);
1260 +               if (reg != last_val)
1261 +                       return true;
1262  
1263 +               udelay(1);
1264 +               last_val = reg;
1265                 if ((reg & 0x7E7FFFEF) == 0x00702400)
1266                         continue;
1267  
1268 @@ -2051,9 +2056,8 @@ static bool ath9k_hw_set_power_awake(str
1269  
1270         REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
1271                     AR_RTC_FORCE_WAKE_EN);
1272 -
1273         if (AR_SREV_9100(ah))
1274 -               udelay(10000);
1275 +               mdelay(10);
1276         else
1277                 udelay(50);
1278  
1279 --- a/drivers/net/wireless/ath/ath9k/main.c
1280 +++ b/drivers/net/wireless/ath/ath9k/main.c
1281 @@ -451,7 +451,7 @@ void ath9k_tasklet(unsigned long data)
1282                  * interrupts are enabled in the reset routine.
1283                  */
1284                 atomic_inc(&ah->intr_ref_cnt);
1285 -               ath_dbg(common, ANY, "FATAL: Skipping interrupts\n");
1286 +               ath_dbg(common, RESET, "FATAL: Skipping interrupts\n");
1287                 goto out;
1288         }
1289  
1290 @@ -471,7 +471,7 @@ void ath9k_tasklet(unsigned long data)
1291                          * interrupts are enabled in the reset routine.
1292                          */
1293                         atomic_inc(&ah->intr_ref_cnt);
1294 -                       ath_dbg(common, ANY,
1295 +                       ath_dbg(common, RESET,
1296                                 "BB_WATCHDOG: Skipping interrupts\n");
1297                         goto out;
1298                 }
1299 @@ -484,7 +484,7 @@ void ath9k_tasklet(unsigned long data)
1300                         type = RESET_TYPE_TX_GTT;
1301                         ath9k_queue_reset(sc, type);
1302                         atomic_inc(&ah->intr_ref_cnt);
1303 -                       ath_dbg(common, ANY,
1304 +                       ath_dbg(common, RESET,
1305                                 "GTT: Skipping interrupts\n");
1306                         goto out;
1307                 }
1308 @@ -1866,7 +1866,7 @@ static void ath9k_set_coverage_class(str
1309  
1310  static bool ath9k_has_tx_pending(struct ath_softc *sc)
1311  {
1312 -       int i, npend;
1313 +       int i, npend = 0;
1314  
1315         for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
1316                 if (!ATH_TXQ_SETUP(sc, i))
1317 --- a/drivers/net/wireless/iwlwifi/mvm/scan.c
1318 +++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
1319 @@ -595,6 +595,9 @@ static void iwl_scan_offload_build_ssid(
1320          * config match list.
1321          */
1322         for (i = 0; i < req->n_match_sets && i < PROBE_OPTION_MAX; i++) {
1323 +               /* skip empty SSID matchsets */
1324 +               if (!req->match_sets[i].ssid.ssid_len)
1325 +                       continue;
1326                 scan->direct_scan[i].id = WLAN_EID_SSID;
1327                 scan->direct_scan[i].len = req->match_sets[i].ssid.ssid_len;
1328                 memcpy(scan->direct_scan[i].ssid, req->match_sets[i].ssid.ssid,
1329 --- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
1330 +++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
1331 @@ -452,7 +452,7 @@ bool rtl88ee_rx_query_desc(struct ieee80
1332                         /* During testing, hdr was NULL */
1333                         return false;
1334                 }
1335 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1336 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1337                     (ieee80211_has_protected(hdr->frame_control)))
1338                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1339                 else
1340 --- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
1341 +++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
1342 @@ -393,7 +393,7 @@ bool rtl92ce_rx_query_desc(struct ieee80
1343                         /* In testing, hdr was NULL here */
1344                         return false;
1345                 }
1346 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1347 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1348                     (ieee80211_has_protected(hdr->frame_control)))
1349                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1350                 else
1351 --- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
1352 +++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
1353 @@ -310,7 +310,7 @@ bool rtl92se_rx_query_desc(struct ieee80
1354                         /* during testing, hdr was NULL here */
1355                         return false;
1356                 }
1357 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1358 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1359                         (ieee80211_has_protected(hdr->frame_control)))
1360                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1361                 else
1362 --- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
1363 +++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
1364 @@ -334,7 +334,7 @@ bool rtl8723ae_rx_query_desc(struct ieee
1365                         /* during testing, hdr could be NULL here */
1366                         return false;
1367                 }
1368 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1369 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1370                         (ieee80211_has_protected(hdr->frame_control)))
1371                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1372                 else
1373 --- a/include/linux/ieee80211.h
1374 +++ b/include/linux/ieee80211.h
1375 @@ -597,6 +597,20 @@ static inline int ieee80211_is_qos_nullf
1376  }
1377  
1378  /**
1379 + * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
1380 + * @fc: frame control field in little-endian byteorder
1381 + */
1382 +static inline bool ieee80211_is_bufferable_mmpdu(__le16 fc)
1383 +{
1384 +       /* IEEE 802.11-2012, definition of "bufferable management frame";
1385 +        * note that this ignores the IBSS special case. */
1386 +       return ieee80211_is_mgmt(fc) &&
1387 +              (ieee80211_is_action(fc) ||
1388 +               ieee80211_is_disassoc(fc) ||
1389 +               ieee80211_is_deauth(fc));
1390 +}
1391 +
1392 +/**
1393   * ieee80211_is_first_frag - check if IEEE80211_SCTL_FRAG is not set
1394   * @seq_ctrl: frame sequence control bytes in little-endian byteorder
1395   */
1396 @@ -2192,10 +2206,10 @@ static inline u8 *ieee80211_get_DA(struc
1397  }
1398  
1399  /**
1400 - * ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
1401 + * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
1402   * @hdr: the frame (buffer must include at least the first octet of payload)
1403   */
1404 -static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
1405 +static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
1406  {
1407         if (ieee80211_is_disassoc(hdr->frame_control) ||
1408             ieee80211_is_deauth(hdr->frame_control))
1409 @@ -2224,6 +2238,17 @@ static inline bool ieee80211_is_robust_m
1410  }
1411  
1412  /**
1413 + * ieee80211_is_robust_mgmt_frame - check if skb contains a robust mgmt frame
1414 + * @skb: the skb containing the frame, length will be checked
1415 + */
1416 +static inline bool ieee80211_is_robust_mgmt_frame(struct sk_buff *skb)
1417 +{
1418 +       if (skb->len < 25)
1419 +               return false;
1420 +       return _ieee80211_is_robust_mgmt_frame((void *)skb->data);
1421 +}
1422 +
1423 +/**
1424   * ieee80211_is_public_action - check if frame is a public action frame
1425   * @hdr: the frame
1426   * @len: length of the frame
1427 --- a/include/net/cfg80211.h
1428 +++ b/include/net/cfg80211.h
1429 @@ -1395,9 +1395,11 @@ struct cfg80211_scan_request {
1430   * struct cfg80211_match_set - sets of attributes to match
1431   *
1432   * @ssid: SSID to be matched
1433 + * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
1434   */
1435  struct cfg80211_match_set {
1436         struct cfg80211_ssid ssid;
1437 +       s32 rssi_thold;
1438  };
1439  
1440  /**
1441 @@ -1420,7 +1422,8 @@ struct cfg80211_match_set {
1442   * @dev: the interface
1443   * @scan_start: start time of the scheduled scan
1444   * @channels: channels to scan
1445 - * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
1446 + * @min_rssi_thold: for drivers only supporting a single threshold, this
1447 + *     contains the minimum over all matchsets
1448   */
1449  struct cfg80211_sched_scan_request {
1450         struct cfg80211_ssid *ssids;
1451 @@ -1433,7 +1436,7 @@ struct cfg80211_sched_scan_request {
1452         u32 flags;
1453         struct cfg80211_match_set *match_sets;
1454         int n_match_sets;
1455 -       s32 rssi_thold;
1456 +       s32 min_rssi_thold;
1457  
1458         /* internal */
1459         struct wiphy *wiphy;
1460 @@ -3130,8 +3133,8 @@ struct cfg80211_cached_keys;
1461   * @identifier: (private) Identifier used in nl80211 to identify this
1462   *     wireless device if it has no netdev
1463   * @current_bss: (private) Used by the internal configuration code
1464 - * @channel: (private) Used by the internal configuration code to track
1465 - *     the user-set AP, monitor and WDS channel
1466 + * @chandef: (private) Used by the internal configuration code to track
1467 + *     the user-set channel definition.
1468   * @preset_chandef: (private) Used by the internal configuration code to
1469   *     track the channel to be used for AP later
1470   * @bssid: (private) Used by the internal configuration code
1471 @@ -3195,9 +3198,7 @@ struct wireless_dev {
1472  
1473         struct cfg80211_internal_bss *current_bss; /* associated / joined */
1474         struct cfg80211_chan_def preset_chandef;
1475 -
1476 -       /* for AP and mesh channel tracking */
1477 -       struct ieee80211_channel *channel;
1478 +       struct cfg80211_chan_def chandef;
1479  
1480         bool ibss_fixed;
1481         bool ibss_dfs_possible;
1482 @@ -3879,6 +3880,7 @@ void cfg80211_michael_mic_failure(struct
1483   *
1484   * @dev: network device
1485   * @bssid: the BSSID of the IBSS joined
1486 + * @channel: the channel of the IBSS joined
1487   * @gfp: allocation flags
1488   *
1489   * This function notifies cfg80211 that the device joined an IBSS or
1490 @@ -3888,7 +3890,8 @@ void cfg80211_michael_mic_failure(struct
1491   * with the locally generated beacon -- this guarantees that there is
1492   * always a scan result for this IBSS. cfg80211 will handle the rest.
1493   */
1494 -void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
1495 +void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
1496 +                         struct ieee80211_channel *channel, gfp_t gfp);
1497  
1498  /**
1499   * cfg80211_notify_new_candidate - notify cfg80211 of a new mesh peer candidate
1500 --- a/include/uapi/linux/nl80211.h
1501 +++ b/include/uapi/linux/nl80211.h
1502 @@ -2442,9 +2442,15 @@ enum nl80211_reg_rule_attr {
1503   * enum nl80211_sched_scan_match_attr - scheduled scan match attributes
1504   * @__NL80211_SCHED_SCAN_MATCH_ATTR_INVALID: attribute number 0 is reserved
1505   * @NL80211_SCHED_SCAN_MATCH_ATTR_SSID: SSID to be used for matching,
1506 - * only report BSS with matching SSID.
1507 + *     only report BSS with matching SSID.
1508   * @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI: RSSI threshold (in dBm) for reporting a
1509 - *     BSS in scan results. Filtering is turned off if not specified.
1510 + *     BSS in scan results. Filtering is turned off if not specified. Note that
1511 + *     if this attribute is in a match set of its own, then it is treated as
1512 + *     the default value for all matchsets with an SSID, rather than being a
1513 + *     matchset of its own without an RSSI filter. This is due to problems with
1514 + *     how this API was implemented in the past. Also, due to the same problem,
1515 + *     the only way to create a matchset with only an RSSI filter (with this
1516 + *     attribute) is if there's only a single matchset with the RSSI attribute.
1517   * @NL80211_SCHED_SCAN_MATCH_ATTR_MAX: highest scheduled scan filter
1518   *     attribute number currently defined
1519   * @__NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST: internal use
1520 --- a/net/mac80211/agg-tx.c
1521 +++ b/net/mac80211/agg-tx.c
1522 @@ -107,7 +107,7 @@ static void ieee80211_send_addba_request
1523         mgmt->u.action.u.addba_req.start_seq_num =
1524                                         cpu_to_le16(start_seq_num << 4);
1525  
1526 -       ieee80211_tx_skb_tid(sdata, skb, tid);
1527 +       ieee80211_tx_skb(sdata, skb);
1528  }
1529  
1530  void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
1531 --- a/net/mac80211/cfg.c
1532 +++ b/net/mac80211/cfg.c
1533 @@ -970,9 +970,9 @@ static int ieee80211_start_ap(struct wip
1534         /* TODO: make hostapd tell us what it wants */
1535         sdata->smps_mode = IEEE80211_SMPS_OFF;
1536         sdata->needed_rx_chains = sdata->local->rx_chains;
1537 -       sdata->radar_required = params->radar_required;
1538  
1539         mutex_lock(&local->mtx);
1540 +       sdata->radar_required = params->radar_required;
1541         err = ieee80211_vif_use_channel(sdata, &params->chandef,
1542                                         IEEE80211_CHANCTX_SHARED);
1543         mutex_unlock(&local->mtx);
1544 @@ -1021,8 +1021,10 @@ static int ieee80211_start_ap(struct wip
1545                                         IEEE80211_P2P_OPPPS_ENABLE_BIT;
1546  
1547         err = ieee80211_assign_beacon(sdata, &params->beacon);
1548 -       if (err < 0)
1549 +       if (err < 0) {
1550 +               ieee80211_vif_release_channel(sdata);
1551                 return err;
1552 +       }
1553         changed |= err;
1554  
1555         err = drv_start_ap(sdata->local, sdata);
1556 @@ -1032,6 +1034,7 @@ static int ieee80211_start_ap(struct wip
1557                 if (old)
1558                         kfree_rcu(old, rcu_head);
1559                 RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
1560 +               ieee80211_vif_release_channel(sdata);
1561                 return err;
1562         }
1563  
1564 @@ -1053,6 +1056,7 @@ static int ieee80211_change_beacon(struc
1565         int err;
1566  
1567         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1568 +       sdata_assert_lock(sdata);
1569  
1570         /* don't allow changing the beacon while CSA is in place - offset
1571          * of channel switch counter may change
1572 @@ -1080,6 +1084,8 @@ static int ieee80211_stop_ap(struct wiph
1573         struct probe_resp *old_probe_resp;
1574         struct cfg80211_chan_def chandef;
1575  
1576 +       sdata_assert_lock(sdata);
1577 +
1578         old_beacon = sdata_dereference(sdata->u.ap.beacon, sdata);
1579         if (!old_beacon)
1580                 return -ENOENT;
1581 @@ -1090,8 +1096,6 @@ static int ieee80211_stop_ap(struct wiph
1582         kfree(sdata->u.ap.next_beacon);
1583         sdata->u.ap.next_beacon = NULL;
1584  
1585 -       cancel_work_sync(&sdata->u.ap.request_smps_work);
1586 -
1587         /* turn off carrier for this interface and dependent VLANs */
1588         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
1589                 netif_carrier_off(vlan->dev);
1590 @@ -1103,6 +1107,7 @@ static int ieee80211_stop_ap(struct wiph
1591         kfree_rcu(old_beacon, rcu_head);
1592         if (old_probe_resp)
1593                 kfree_rcu(old_probe_resp, rcu_head);
1594 +       sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
1595  
1596         __sta_info_flush(sdata, true);
1597         ieee80211_free_keys(sdata, true);
1598 @@ -1988,6 +1993,9 @@ static int ieee80211_change_bss(struct w
1599  
1600         band = ieee80211_get_sdata_band(sdata);
1601  
1602 +       if (WARN_ON(!wiphy->bands[band]))
1603 +               return -EINVAL;
1604 +
1605         if (params->use_cts_prot >= 0) {
1606                 sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
1607                 changed |= BSS_CHANGED_ERP_CTS_PROT;
1608 @@ -2638,6 +2646,24 @@ static int ieee80211_start_roc_work(stru
1609         INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
1610         INIT_LIST_HEAD(&roc->dependents);
1611  
1612 +       /*
1613 +        * cookie is either the roc cookie (for normal roc)
1614 +        * or the SKB (for mgmt TX)
1615 +        */
1616 +       if (!txskb) {
1617 +               /* local->mtx protects this */
1618 +               local->roc_cookie_counter++;
1619 +               roc->cookie = local->roc_cookie_counter;
1620 +               /* wow, you wrapped 64 bits ... more likely a bug */
1621 +               if (WARN_ON(roc->cookie == 0)) {
1622 +                       roc->cookie = 1;
1623 +                       local->roc_cookie_counter++;
1624 +               }
1625 +               *cookie = roc->cookie;
1626 +       } else {
1627 +               *cookie = (unsigned long)txskb;
1628 +       }
1629 +
1630         /* if there's one pending or we're scanning, queue this one */
1631         if (!list_empty(&local->roc_list) ||
1632             local->scanning || local->radar_detect_enabled)
1633 @@ -2772,24 +2798,6 @@ static int ieee80211_start_roc_work(stru
1634         if (!queued)
1635                 list_add_tail(&roc->list, &local->roc_list);
1636  
1637 -       /*
1638 -        * cookie is either the roc cookie (for normal roc)
1639 -        * or the SKB (for mgmt TX)
1640 -        */
1641 -       if (!txskb) {
1642 -               /* local->mtx protects this */
1643 -               local->roc_cookie_counter++;
1644 -               roc->cookie = local->roc_cookie_counter;
1645 -               /* wow, you wrapped 64 bits ... more likely a bug */
1646 -               if (WARN_ON(roc->cookie == 0)) {
1647 -                       roc->cookie = 1;
1648 -                       local->roc_cookie_counter++;
1649 -               }
1650 -               *cookie = roc->cookie;
1651 -       } else {
1652 -               *cookie = (unsigned long)txskb;
1653 -       }
1654 -
1655         return 0;
1656  }
1657  
1658 @@ -3004,8 +3012,10 @@ void ieee80211_csa_finalize_work(struct 
1659         if (!ieee80211_sdata_running(sdata))
1660                 goto unlock;
1661  
1662 -       sdata->radar_required = sdata->csa_radar_required;
1663 +       sdata_assert_lock(sdata);
1664 +
1665         mutex_lock(&local->mtx);
1666 +       sdata->radar_required = sdata->csa_radar_required;
1667         err = ieee80211_vif_change_channel(sdata, &changed);
1668         mutex_unlock(&local->mtx);
1669         if (WARN_ON(err < 0))
1670 @@ -3022,13 +3032,13 @@ void ieee80211_csa_finalize_work(struct 
1671         switch (sdata->vif.type) {
1672         case NL80211_IFTYPE_AP:
1673                 err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
1674 +               kfree(sdata->u.ap.next_beacon);
1675 +               sdata->u.ap.next_beacon = NULL;
1676 +
1677                 if (err < 0)
1678                         goto unlock;
1679  
1680                 changed |= err;
1681 -               kfree(sdata->u.ap.next_beacon);
1682 -               sdata->u.ap.next_beacon = NULL;
1683 -
1684                 ieee80211_bss_info_change_notify(sdata, err);
1685                 break;
1686         case NL80211_IFTYPE_ADHOC:
1687 @@ -3066,7 +3076,7 @@ int ieee80211_channel_switch(struct wiph
1688         struct ieee80211_if_mesh __maybe_unused *ifmsh;
1689         int err, num_chanctx;
1690  
1691 -       lockdep_assert_held(&sdata->wdev.mtx);
1692 +       sdata_assert_lock(sdata);
1693  
1694         if (!list_empty(&local->roc_list) || local->scanning)
1695                 return -EBUSY;
1696 --- a/net/mac80211/ht.c
1697 +++ b/net/mac80211/ht.c
1698 @@ -375,7 +375,7 @@ void ieee80211_send_delba(struct ieee802
1699         mgmt->u.action.u.delba.params = cpu_to_le16(params);
1700         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
1701  
1702 -       ieee80211_tx_skb_tid(sdata, skb, tid);
1703 +       ieee80211_tx_skb(sdata, skb);
1704  }
1705  
1706  void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
1707 @@ -466,7 +466,9 @@ void ieee80211_request_smps_ap_work(stru
1708                              u.ap.request_smps_work);
1709  
1710         sdata_lock(sdata);
1711 -       __ieee80211_request_smps_ap(sdata, sdata->u.ap.driver_smps_mode);
1712 +       if (sdata_dereference(sdata->u.ap.beacon, sdata))
1713 +               __ieee80211_request_smps_ap(sdata,
1714 +                                           sdata->u.ap.driver_smps_mode);
1715         sdata_unlock(sdata);
1716  }
1717  
1718 --- a/net/mac80211/iface.c
1719 +++ b/net/mac80211/iface.c
1720 @@ -770,12 +770,19 @@ static void ieee80211_do_stop(struct iee
1721  
1722         ieee80211_roc_purge(local, sdata);
1723  
1724 -       if (sdata->vif.type == NL80211_IFTYPE_STATION)
1725 +       switch (sdata->vif.type) {
1726 +       case NL80211_IFTYPE_STATION:
1727                 ieee80211_mgd_stop(sdata);
1728 -
1729 -       if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1730 +               break;
1731 +       case NL80211_IFTYPE_ADHOC:
1732                 ieee80211_ibss_stop(sdata);
1733 -
1734 +               break;
1735 +       case NL80211_IFTYPE_AP:
1736 +               cancel_work_sync(&sdata->u.ap.request_smps_work);
1737 +               break;
1738 +       default:
1739 +               break;
1740 +       }
1741  
1742         /*
1743          * Remove all stations associated with this interface.
1744 @@ -827,7 +834,9 @@ static void ieee80211_do_stop(struct iee
1745         cancel_work_sync(&local->dynamic_ps_enable_work);
1746  
1747         cancel_work_sync(&sdata->recalc_smps);
1748 +       sdata_lock(sdata);
1749         sdata->vif.csa_active = false;
1750 +       sdata_unlock(sdata);
1751         cancel_work_sync(&sdata->csa_finalize_work);
1752  
1753         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
1754 --- a/net/mac80211/rx.c
1755 +++ b/net/mac80211/rx.c
1756 @@ -599,10 +599,10 @@ static int ieee80211_is_unicast_robust_m
1757  {
1758         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1759  
1760 -       if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
1761 +       if (is_multicast_ether_addr(hdr->addr1))
1762                 return 0;
1763  
1764 -       return ieee80211_is_robust_mgmt_frame(hdr);
1765 +       return ieee80211_is_robust_mgmt_frame(skb);
1766  }
1767  
1768  
1769 @@ -610,10 +610,10 @@ static int ieee80211_is_multicast_robust
1770  {
1771         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1772  
1773 -       if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
1774 +       if (!is_multicast_ether_addr(hdr->addr1))
1775                 return 0;
1776  
1777 -       return ieee80211_is_robust_mgmt_frame(hdr);
1778 +       return ieee80211_is_robust_mgmt_frame(skb);
1779  }
1780  
1781  
1782 @@ -626,7 +626,7 @@ static int ieee80211_get_mmie_keyidx(str
1783         if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
1784                 return -1;
1785  
1786 -       if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
1787 +       if (!ieee80211_is_robust_mgmt_frame(skb))
1788                 return -1; /* not a robust management frame */
1789  
1790         mmie = (struct ieee80211_mmie *)
1791 @@ -1128,6 +1128,13 @@ static void sta_ps_end(struct sta_info *
1792                sta->sta.addr, sta->sta.aid);
1793  
1794         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1795 +               /*
1796 +                * Clear the flag only if the other one is still set
1797 +                * so that the TX path won't start TX'ing new frames
1798 +                * directly ... In the case that the driver flag isn't
1799 +                * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1800 +                */
1801 +               clear_sta_flag(sta, WLAN_STA_PS_STA);
1802                 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1803                        sta->sta.addr, sta->sta.aid);
1804                 return;
1805 @@ -1311,18 +1318,15 @@ ieee80211_rx_h_sta_process(struct ieee80
1806             !ieee80211_has_morefrags(hdr->frame_control) &&
1807             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1808             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1809 -            rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1810 +            rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1811 +           /* PM bit is only checked in frames where it isn't reserved,
1812 +            * in AP mode it's reserved in non-bufferable management frames
1813 +            * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
1814 +            */
1815 +           (!ieee80211_is_mgmt(hdr->frame_control) ||
1816 +            ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
1817                 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1818 -                       /*
1819 -                        * Ignore doze->wake transitions that are
1820 -                        * indicated by non-data frames, the standard
1821 -                        * is unclear here, but for example going to
1822 -                        * PS mode and then scanning would cause a
1823 -                        * doze->wake transition for the probe request,
1824 -                        * and that is clearly undesirable.
1825 -                        */
1826 -                       if (ieee80211_is_data(hdr->frame_control) &&
1827 -                           !ieee80211_has_pm(hdr->frame_control))
1828 +                       if (!ieee80211_has_pm(hdr->frame_control))
1829                                 sta_ps_end(sta);
1830                 } else {
1831                         if (ieee80211_has_pm(hdr->frame_control))
1832 @@ -1845,8 +1849,7 @@ static int ieee80211_drop_unencrypted_mg
1833                  * having configured keys.
1834                  */
1835                 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1836 -                            ieee80211_is_robust_mgmt_frame(
1837 -                                    (struct ieee80211_hdr *) rx->skb->data)))
1838 +                            ieee80211_is_robust_mgmt_frame(rx->skb)))
1839                         return -EACCES;
1840         }
1841  
1842 --- a/net/mac80211/tx.c
1843 +++ b/net/mac80211/tx.c
1844 @@ -452,8 +452,7 @@ static int ieee80211_use_mfp(__le16 fc, 
1845         if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
1846                 return 0;
1847  
1848 -       if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
1849 -                                           skb->data))
1850 +       if (!ieee80211_is_robust_mgmt_frame(skb))
1851                 return 0;
1852  
1853         return 1;
1854 @@ -478,6 +477,20 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
1855                        sta->sta.addr, sta->sta.aid, ac);
1856                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
1857                         purge_old_ps_buffers(tx->local);
1858 +
1859 +               /* sync with ieee80211_sta_ps_deliver_wakeup */
1860 +               spin_lock(&sta->ps_lock);
1861 +               /*
1862 +                * STA woke up the meantime and all the frames on ps_tx_buf have
1863 +                * been queued to pending queue. No reordering can happen, go
1864 +                * ahead and Tx the packet.
1865 +                */
1866 +               if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
1867 +                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1868 +                       spin_unlock(&sta->ps_lock);
1869 +                       return TX_CONTINUE;
1870 +               }
1871 +
1872                 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
1873                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
1874                         ps_dbg(tx->sdata,
1875 @@ -492,6 +505,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
1876                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1877                 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
1878                 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
1879 +               spin_unlock(&sta->ps_lock);
1880  
1881                 if (!timer_pending(&local->sta_cleanup))
1882                         mod_timer(&local->sta_cleanup,
1883 @@ -525,9 +539,7 @@ ieee80211_tx_h_ps_buf(struct ieee80211_t
1884  
1885         /* only deauth, disassoc and action are bufferable MMPDUs */
1886         if (ieee80211_is_mgmt(hdr->frame_control) &&
1887 -           !ieee80211_is_deauth(hdr->frame_control) &&
1888 -           !ieee80211_is_disassoc(hdr->frame_control) &&
1889 -           !ieee80211_is_action(hdr->frame_control)) {
1890 +           !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
1891                 if (tx->flags & IEEE80211_TX_UNICAST)
1892                         info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
1893                 return TX_CONTINUE;
1894 @@ -567,7 +579,7 @@ ieee80211_tx_h_select_key(struct ieee802
1895                 tx->key = key;
1896         else if (ieee80211_is_mgmt(hdr->frame_control) &&
1897                  is_multicast_ether_addr(hdr->addr1) &&
1898 -                ieee80211_is_robust_mgmt_frame(hdr) &&
1899 +                ieee80211_is_robust_mgmt_frame(tx->skb) &&
1900                  (key = rcu_dereference(tx->sdata->default_mgmt_key)))
1901                 tx->key = key;
1902         else if (is_multicast_ether_addr(hdr->addr1) &&
1903 @@ -582,12 +594,12 @@ ieee80211_tx_h_select_key(struct ieee802
1904                 tx->key = NULL;
1905         else if (tx->skb->protocol == tx->sdata->control_port_protocol)
1906                 tx->key = NULL;
1907 -       else if (ieee80211_is_robust_mgmt_frame(hdr) &&
1908 +       else if (ieee80211_is_robust_mgmt_frame(tx->skb) &&
1909                  !(ieee80211_is_action(hdr->frame_control) &&
1910                    tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))
1911                 tx->key = NULL;
1912         else if (ieee80211_is_mgmt(hdr->frame_control) &&
1913 -                !ieee80211_is_robust_mgmt_frame(hdr))
1914 +                !ieee80211_is_robust_mgmt_frame(tx->skb))
1915                 tx->key = NULL;
1916         else {
1917                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
1918 @@ -878,7 +890,7 @@ static int ieee80211_fragment(struct iee
1919         }
1920  
1921         /* adjust first fragment's length */
1922 -       skb->len = hdrlen + per_fragm;
1923 +       skb_trim(skb, hdrlen + per_fragm);
1924         return 0;
1925  }
1926  
1927 @@ -2900,7 +2912,7 @@ ieee80211_get_buffered_bc(struct ieee802
1928                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1929                 }
1930  
1931 -               if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1932 +               if (sdata->vif.type == NL80211_IFTYPE_AP)
1933                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
1934                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
1935                         break;
1936 --- a/net/mac80211/wpa.c
1937 +++ b/net/mac80211/wpa.c
1938 @@ -499,7 +499,7 @@ ieee80211_crypto_ccmp_decrypt(struct iee
1939         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1940  
1941         if (!ieee80211_is_data(hdr->frame_control) &&
1942 -           !ieee80211_is_robust_mgmt_frame(hdr))
1943 +           !ieee80211_is_robust_mgmt_frame(skb))
1944                 return RX_CONTINUE;
1945  
1946         data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN -
1947 --- a/net/wireless/ap.c
1948 +++ b/net/wireless/ap.c
1949 @@ -27,9 +27,10 @@ static int __cfg80211_stop_ap(struct cfg
1950         err = rdev_stop_ap(rdev, dev);
1951         if (!err) {
1952                 wdev->beacon_interval = 0;
1953 -               wdev->channel = NULL;
1954 +               memset(&wdev->chandef, 0, sizeof(wdev->chandef));
1955                 wdev->ssid_len = 0;
1956                 rdev_set_qos_map(rdev, dev, NULL);
1957 +               nl80211_send_ap_stopped(wdev);
1958         }
1959  
1960         return err;
1961 --- a/net/wireless/core.c
1962 +++ b/net/wireless/core.c
1963 @@ -203,8 +203,11 @@ void cfg80211_stop_p2p_device(struct cfg
1964  
1965         rdev->opencount--;
1966  
1967 -       WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
1968 -               !rdev->scan_req->notified);
1969 +       if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
1970 +               if (WARN_ON(!rdev->scan_req->notified))
1971 +                       rdev->scan_req->aborted = true;
1972 +               ___cfg80211_scan_done(rdev, false);
1973 +       }
1974  }
1975  
1976  static int cfg80211_rfkill_set_block(void *data, bool blocked)
1977 @@ -447,9 +450,6 @@ int wiphy_register(struct wiphy *wiphy)
1978         int i;
1979         u16 ifmodes = wiphy->interface_modes;
1980  
1981 -       /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
1982 -       wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
1983 -
1984         /*
1985          * There are major locking problems in nl80211/mac80211 for CSA,
1986          * disable for all drivers until this has been reworked.
1987 @@ -795,8 +795,6 @@ void cfg80211_leave(struct cfg80211_regi
1988         default:
1989                 break;
1990         }
1991 -
1992 -       wdev->beacon_interval = 0;
1993  }
1994  
1995  static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
1996 @@ -875,8 +873,11 @@ static int cfg80211_netdev_notifier_call
1997                 break;
1998         case NETDEV_DOWN:
1999                 cfg80211_update_iface_num(rdev, wdev->iftype, -1);
2000 -               WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
2001 -                       !rdev->scan_req->notified);
2002 +               if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
2003 +                       if (WARN_ON(!rdev->scan_req->notified))
2004 +                               rdev->scan_req->aborted = true;
2005 +                       ___cfg80211_scan_done(rdev, false);
2006 +               }
2007  
2008                 if (WARN_ON(rdev->sched_scan_req &&
2009                             rdev->sched_scan_req->dev == wdev->netdev)) {
2010 --- a/net/wireless/core.h
2011 +++ b/net/wireless/core.h
2012 @@ -62,6 +62,7 @@ struct cfg80211_registered_device {
2013         struct rb_root bss_tree;
2014         u32 bss_generation;
2015         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
2016 +       struct sk_buff *scan_msg;
2017         struct cfg80211_sched_scan_request *sched_scan_req;
2018         unsigned long suspend_at;
2019         struct work_struct scan_done_wk;
2020 @@ -210,6 +211,7 @@ struct cfg80211_event {
2021                 } dc;
2022                 struct {
2023                         u8 bssid[ETH_ALEN];
2024 +                       struct ieee80211_channel *channel;
2025                 } ij;
2026         };
2027  };
2028 @@ -257,7 +259,8 @@ int __cfg80211_leave_ibss(struct cfg8021
2029                           struct net_device *dev, bool nowext);
2030  int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
2031                         struct net_device *dev, bool nowext);
2032 -void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid);
2033 +void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
2034 +                           struct ieee80211_channel *channel);
2035  int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
2036                             struct wireless_dev *wdev);
2037  
2038 @@ -361,7 +364,8 @@ int cfg80211_validate_key_settings(struc
2039                                    struct key_params *params, int key_idx,
2040                                    bool pairwise, const u8 *mac_addr);
2041  void __cfg80211_scan_done(struct work_struct *wk);
2042 -void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev);
2043 +void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
2044 +                          bool send_message);
2045  void __cfg80211_sched_scan_results(struct work_struct *wk);
2046  int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
2047                                bool driver_initiated);
2048 @@ -441,7 +445,8 @@ static inline unsigned int elapsed_jiffi
2049  void
2050  cfg80211_get_chan_state(struct wireless_dev *wdev,
2051                         struct ieee80211_channel **chan,
2052 -                       enum cfg80211_chan_mode *chanmode);
2053 +                       enum cfg80211_chan_mode *chanmode,
2054 +                       u8 *radar_detect);
2055  
2056  int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
2057                                  struct cfg80211_chan_def *chandef);
2058 --- a/net/wireless/nl80211.c
2059 +++ b/net/wireless/nl80211.c
2060 @@ -1723,9 +1723,10 @@ static int nl80211_dump_wiphy(struct sk_
2061                                  * We can then retry with the larger buffer.
2062                                  */
2063                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2064 -                                   !skb->len &&
2065 +                                   !skb->len && !state->split &&
2066                                     cb->min_dump_alloc < 4096) {
2067                                         cb->min_dump_alloc = 4096;
2068 +                                       state->split_start = 0;
2069                                         rtnl_unlock();
2070                                         return 1;
2071                                 }
2072 @@ -2047,10 +2048,12 @@ static int nl80211_set_wiphy(struct sk_b
2073                 nla_for_each_nested(nl_txq_params,
2074                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2075                                     rem_txq_params) {
2076 -                       nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2077 -                                 nla_data(nl_txq_params),
2078 -                                 nla_len(nl_txq_params),
2079 -                                 txq_params_policy);
2080 +                       result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2081 +                                          nla_data(nl_txq_params),
2082 +                                          nla_len(nl_txq_params),
2083 +                                          txq_params_policy);
2084 +                       if (result)
2085 +                               goto bad_res;
2086                         result = parse_txq_params(tb, &txq_params);
2087                         if (result)
2088                                 goto bad_res;
2089 @@ -3289,7 +3292,7 @@ static int nl80211_start_ap(struct sk_bu
2090         if (!err) {
2091                 wdev->preset_chandef = params.chandef;
2092                 wdev->beacon_interval = params.beacon_interval;
2093 -               wdev->channel = params.chandef.chan;
2094 +               wdev->chandef = params.chandef;
2095                 wdev->ssid_len = params.ssid_len;
2096                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2097         }
2098 @@ -5210,9 +5213,11 @@ static int nl80211_set_reg(struct sk_buf
2099  
2100         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2101                             rem_reg_rules) {
2102 -               nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2103 -                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2104 -                         reg_rule_policy);
2105 +               r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2106 +                             nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2107 +                             reg_rule_policy);
2108 +               if (r)
2109 +                       goto bad_reg;
2110                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2111                 if (r)
2112                         goto bad_reg;
2113 @@ -5277,7 +5282,7 @@ static int nl80211_trigger_scan(struct s
2114         if (!rdev->ops->scan)
2115                 return -EOPNOTSUPP;
2116  
2117 -       if (rdev->scan_req) {
2118 +       if (rdev->scan_req || rdev->scan_msg) {
2119                 err = -EBUSY;
2120                 goto unlock;
2121         }
2122 @@ -5475,6 +5480,7 @@ static int nl80211_start_sched_scan(stru
2123         enum ieee80211_band band;
2124         size_t ie_len;
2125         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
2126 +       s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
2127  
2128         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
2129             !rdev->ops->sched_scan_start)
2130 @@ -5509,11 +5515,40 @@ static int nl80211_start_sched_scan(stru
2131         if (n_ssids > wiphy->max_sched_scan_ssids)
2132                 return -EINVAL;
2133  
2134 -       if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
2135 +       /*
2136 +        * First, count the number of 'real' matchsets. Due to an issue with
2137 +        * the old implementation, matchsets containing only the RSSI attribute
2138 +        * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
2139 +        * RSSI for all matchsets, rather than their own matchset for reporting
2140 +        * all APs with a strong RSSI. This is needed to be compatible with
2141 +        * older userspace that treated a matchset with only the RSSI as the
2142 +        * global RSSI for all other matchsets - if there are other matchsets.
2143 +        */
2144 +       if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
2145                 nla_for_each_nested(attr,
2146                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
2147 -                                   tmp)
2148 -                       n_match_sets++;
2149 +                                   tmp) {
2150 +                       struct nlattr *rssi;
2151 +
2152 +                       err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
2153 +                                       nla_data(attr), nla_len(attr),
2154 +                                       nl80211_match_policy);
2155 +                       if (err)
2156 +                               return err;
2157 +                       /* add other standalone attributes here */
2158 +                       if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
2159 +                               n_match_sets++;
2160 +                               continue;
2161 +                       }
2162 +                       rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
2163 +                       if (rssi)
2164 +                               default_match_rssi = nla_get_s32(rssi);
2165 +               }
2166 +       }
2167 +
2168 +       /* However, if there's no other matchset, add the RSSI one */
2169 +       if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
2170 +               n_match_sets = 1;
2171  
2172         if (n_match_sets > wiphy->max_match_sets)
2173                 return -EINVAL;
2174 @@ -5634,11 +5669,22 @@ static int nl80211_start_sched_scan(stru
2175                                     tmp) {
2176                         struct nlattr *ssid, *rssi;
2177  
2178 -                       nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
2179 -                                 nla_data(attr), nla_len(attr),
2180 -                                 nl80211_match_policy);
2181 +                       err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
2182 +                                       nla_data(attr), nla_len(attr),
2183 +                                       nl80211_match_policy);
2184 +                       if (err)
2185 +                               goto out_free;
2186                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
2187                         if (ssid) {
2188 +                               if (WARN_ON(i >= n_match_sets)) {
2189 +                                       /* this indicates a programming error,
2190 +                                        * the loop above should have verified
2191 +                                        * things properly
2192 +                                        */
2193 +                                       err = -EINVAL;
2194 +                                       goto out_free;
2195 +                               }
2196 +
2197                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
2198                                         err = -EINVAL;
2199                                         goto out_free;
2200 @@ -5647,15 +5693,28 @@ static int nl80211_start_sched_scan(stru
2201                                        nla_data(ssid), nla_len(ssid));
2202                                 request->match_sets[i].ssid.ssid_len =
2203                                         nla_len(ssid);
2204 +                               /* special attribute - old implemenation w/a */
2205 +                               request->match_sets[i].rssi_thold =
2206 +                                       default_match_rssi;
2207 +                               rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
2208 +                               if (rssi)
2209 +                                       request->match_sets[i].rssi_thold =
2210 +                                               nla_get_s32(rssi);
2211                         }
2212 -                       rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
2213 -                       if (rssi)
2214 -                               request->rssi_thold = nla_get_u32(rssi);
2215 -                       else
2216 -                               request->rssi_thold =
2217 -                                                  NL80211_SCAN_RSSI_THOLD_OFF;
2218                         i++;
2219                 }
2220 +
2221 +               /* there was no other matchset, so the RSSI one is alone */
2222 +               if (i == 0)
2223 +                       request->match_sets[0].rssi_thold = default_match_rssi;
2224 +
2225 +               request->min_rssi_thold = INT_MAX;
2226 +               for (i = 0; i < n_match_sets; i++)
2227 +                       request->min_rssi_thold =
2228 +                               min(request->match_sets[i].rssi_thold,
2229 +                                   request->min_rssi_thold);
2230 +       } else {
2231 +               request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
2232         }
2233  
2234         if (info->attrs[NL80211_ATTR_IE]) {
2235 @@ -5751,7 +5810,7 @@ static int nl80211_start_radar_detection
2236  
2237         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
2238         if (!err) {
2239 -               wdev->channel = chandef.chan;
2240 +               wdev->chandef = chandef;
2241                 wdev->cac_started = true;
2242                 wdev->cac_start_time = jiffies;
2243         }
2244 @@ -7502,16 +7561,19 @@ static int nl80211_set_tx_bitrate_mask(s
2245          * directly to the enum ieee80211_band values used in cfg80211.
2246          */
2247         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
2248 -       nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
2249 -       {
2250 +       nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
2251                 enum ieee80211_band band = nla_type(tx_rates);
2252 +               int err;
2253 +
2254                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
2255                         return -EINVAL;
2256                 sband = rdev->wiphy.bands[band];
2257                 if (sband == NULL)
2258                         return -EINVAL;
2259 -               nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
2260 -                         nla_len(tx_rates), nl80211_txattr_policy);
2261 +               err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
2262 +                               nla_len(tx_rates), nl80211_txattr_policy);
2263 +               if (err)
2264 +                       return err;
2265                 if (tb[NL80211_TXRATE_LEGACY]) {
2266                         mask.control[band].legacy = rateset_to_mask(
2267                                 sband,
2268 @@ -10054,40 +10116,31 @@ void nl80211_send_scan_start(struct cfg8
2269                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
2270  }
2271  
2272 -void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2273 -                           struct wireless_dev *wdev)
2274 +struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
2275 +                                      struct wireless_dev *wdev, bool aborted)
2276  {
2277         struct sk_buff *msg;
2278  
2279         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2280         if (!msg)
2281 -               return;
2282 +               return NULL;
2283  
2284         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
2285 -                                 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2286 +                                 aborted ? NL80211_CMD_SCAN_ABORTED :
2287 +                                           NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2288                 nlmsg_free(msg);
2289 -               return;
2290 +               return NULL;
2291         }
2292  
2293 -       genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
2294 -                               NL80211_MCGRP_SCAN, GFP_KERNEL);
2295 +       return msg;
2296  }
2297  
2298 -void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2299 -                              struct wireless_dev *wdev)
2300 +void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
2301 +                             struct sk_buff *msg)
2302  {
2303 -       struct sk_buff *msg;
2304 -
2305 -       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2306         if (!msg)
2307                 return;
2308  
2309 -       if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
2310 -                                 NL80211_CMD_SCAN_ABORTED) < 0) {
2311 -               nlmsg_free(msg);
2312 -               return;
2313 -       }
2314 -
2315         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
2316                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
2317  }
2318 @@ -11158,7 +11211,8 @@ void cfg80211_ch_switch_notify(struct ne
2319                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
2320                 return;
2321  
2322 -       wdev->channel = chandef->chan;
2323 +       wdev->chandef = *chandef;
2324 +       wdev->preset_chandef = *chandef;
2325         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
2326  }
2327  EXPORT_SYMBOL(cfg80211_ch_switch_notify);
2328 @@ -11673,6 +11727,35 @@ void cfg80211_crit_proto_stopped(struct 
2329  }
2330  EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
2331  
2332 +void nl80211_send_ap_stopped(struct wireless_dev *wdev)
2333 +{
2334 +       struct wiphy *wiphy = wdev->wiphy;
2335 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
2336 +       struct sk_buff *msg;
2337 +       void *hdr;
2338 +
2339 +       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2340 +       if (!msg)
2341 +               return;
2342 +
2343 +       hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
2344 +       if (!hdr)
2345 +               goto out;
2346 +
2347 +       if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2348 +           nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
2349 +           nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
2350 +               goto out;
2351 +
2352 +       genlmsg_end(msg, hdr);
2353 +
2354 +       genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
2355 +                               NL80211_MCGRP_MLME, GFP_KERNEL);
2356 +       return;
2357 + out:
2358 +       nlmsg_free(msg);
2359 +}
2360 +
2361  /* initialisation/exit functions */
2362  
2363  int nl80211_init(void)
2364 --- a/net/wireless/nl80211.h
2365 +++ b/net/wireless/nl80211.h
2366 @@ -8,10 +8,10 @@ void nl80211_exit(void);
2367  void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
2368  void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
2369                              struct wireless_dev *wdev);
2370 -void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2371 -                           struct wireless_dev *wdev);
2372 -void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2373 -                              struct wireless_dev *wdev);
2374 +struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
2375 +                                      struct wireless_dev *wdev, bool aborted);
2376 +void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
2377 +                             struct sk_buff *msg);
2378  void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
2379                              struct net_device *netdev, u32 cmd);
2380  void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
2381 @@ -74,6 +74,8 @@ nl80211_radar_notify(struct cfg80211_reg
2382                      enum nl80211_radar_event event,
2383                      struct net_device *netdev, gfp_t gfp);
2384  
2385 +void nl80211_send_ap_stopped(struct wireless_dev *wdev);
2386 +
2387  void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev);
2388  
2389  #endif /* __NET_WIRELESS_NL80211_H */
2390 --- a/net/wireless/scan.c
2391 +++ b/net/wireless/scan.c
2392 @@ -161,18 +161,25 @@ static void __cfg80211_bss_expire(struct
2393                 dev->bss_generation++;
2394  }
2395  
2396 -void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
2397 +void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
2398 +                          bool send_message)
2399  {
2400         struct cfg80211_scan_request *request;
2401         struct wireless_dev *wdev;
2402 +       struct sk_buff *msg;
2403  #ifdef CPTCFG_CFG80211_WEXT
2404         union iwreq_data wrqu;
2405  #endif
2406  
2407         ASSERT_RTNL();
2408  
2409 -       request = rdev->scan_req;
2410 +       if (rdev->scan_msg) {
2411 +               nl80211_send_scan_result(rdev, rdev->scan_msg);
2412 +               rdev->scan_msg = NULL;
2413 +               return;
2414 +       }
2415  
2416 +       request = rdev->scan_req;
2417         if (!request)
2418                 return;
2419  
2420 @@ -186,18 +193,16 @@ void ___cfg80211_scan_done(struct cfg802
2421         if (wdev->netdev)
2422                 cfg80211_sme_scan_done(wdev->netdev);
2423  
2424 -       if (request->aborted) {
2425 -               nl80211_send_scan_aborted(rdev, wdev);
2426 -       } else {
2427 -               if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
2428 -                       /* flush entries from previous scans */
2429 -                       spin_lock_bh(&rdev->bss_lock);
2430 -                       __cfg80211_bss_expire(rdev, request->scan_start);
2431 -                       spin_unlock_bh(&rdev->bss_lock);
2432 -               }
2433 -               nl80211_send_scan_done(rdev, wdev);
2434 +       if (!request->aborted &&
2435 +           request->flags & NL80211_SCAN_FLAG_FLUSH) {
2436 +               /* flush entries from previous scans */
2437 +               spin_lock_bh(&rdev->bss_lock);
2438 +               __cfg80211_bss_expire(rdev, request->scan_start);
2439 +               spin_unlock_bh(&rdev->bss_lock);
2440         }
2441  
2442 +       msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);
2443 +
2444  #ifdef CPTCFG_CFG80211_WEXT
2445         if (wdev->netdev && !request->aborted) {
2446                 memset(&wrqu, 0, sizeof(wrqu));
2447 @@ -211,6 +216,11 @@ void ___cfg80211_scan_done(struct cfg802
2448  
2449         rdev->scan_req = NULL;
2450         kfree(request);
2451 +
2452 +       if (!send_message)
2453 +               rdev->scan_msg = msg;
2454 +       else
2455 +               nl80211_send_scan_result(rdev, msg);
2456  }
2457  
2458  void __cfg80211_scan_done(struct work_struct *wk)
2459 @@ -221,7 +231,7 @@ void __cfg80211_scan_done(struct work_st
2460                             scan_done_wk);
2461  
2462         rtnl_lock();
2463 -       ___cfg80211_scan_done(rdev);
2464 +       ___cfg80211_scan_done(rdev, true);
2465         rtnl_unlock();
2466  }
2467  
2468 @@ -1079,7 +1089,7 @@ int cfg80211_wext_siwscan(struct net_dev
2469         if (IS_ERR(rdev))
2470                 return PTR_ERR(rdev);
2471  
2472 -       if (rdev->scan_req) {
2473 +       if (rdev->scan_req || rdev->scan_msg) {
2474                 err = -EBUSY;
2475                 goto out;
2476         }
2477 @@ -1481,7 +1491,7 @@ int cfg80211_wext_giwscan(struct net_dev
2478         if (IS_ERR(rdev))
2479                 return PTR_ERR(rdev);
2480  
2481 -       if (rdev->scan_req)
2482 +       if (rdev->scan_req || rdev->scan_msg)
2483                 return -EAGAIN;
2484  
2485         res = ieee80211_scan_results(rdev, info, extra, data->length);
2486 --- a/net/wireless/sme.c
2487 +++ b/net/wireless/sme.c
2488 @@ -67,7 +67,7 @@ static int cfg80211_conn_scan(struct wir
2489         ASSERT_RDEV_LOCK(rdev);
2490         ASSERT_WDEV_LOCK(wdev);
2491  
2492 -       if (rdev->scan_req)
2493 +       if (rdev->scan_req || rdev->scan_msg)
2494                 return -EBUSY;
2495  
2496         if (wdev->conn->params.channel)
2497 --- a/net/mac80211/mlme.c
2498 +++ b/net/mac80211/mlme.c
2499 @@ -1001,7 +1001,6 @@ ieee80211_sta_process_chanswitch(struct 
2500         }
2501  
2502         ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
2503 -       sdata->vif.csa_active = true;
2504  
2505         mutex_lock(&local->chanctx_mtx);
2506         if (local->use_chanctx) {
2507 @@ -1039,6 +1038,7 @@ ieee80211_sta_process_chanswitch(struct 
2508         mutex_unlock(&local->chanctx_mtx);
2509  
2510         sdata->csa_chandef = csa_ie.chandef;
2511 +       sdata->vif.csa_active = true;
2512  
2513         if (csa_ie.mode)
2514                 ieee80211_stop_queues_by_reason(&local->hw,
2515 --- a/net/mac80211/chan.c
2516 +++ b/net/mac80211/chan.c
2517 @@ -196,6 +196,8 @@ static bool ieee80211_is_radar_required(
2518  {
2519         struct ieee80211_sub_if_data *sdata;
2520  
2521 +       lockdep_assert_held(&local->mtx);
2522 +
2523         rcu_read_lock();
2524         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2525                 if (sdata->radar_required) {
2526 --- a/net/mac80211/ibss.c
2527 +++ b/net/mac80211/ibss.c
2528 @@ -294,7 +294,6 @@ static void __ieee80211_sta_join_ibss(st
2529         }
2530  
2531         mutex_lock(&local->mtx);
2532 -       ieee80211_vif_release_channel(sdata);
2533         if (ieee80211_vif_use_channel(sdata, &chandef,
2534                                       ifibss->fixed_channel ?
2535                                         IEEE80211_CHANCTX_SHARED :
2536 @@ -303,6 +302,7 @@ static void __ieee80211_sta_join_ibss(st
2537                 mutex_unlock(&local->mtx);
2538                 return;
2539         }
2540 +       sdata->radar_required = radar_required;
2541         mutex_unlock(&local->mtx);
2542  
2543         memcpy(ifibss->bssid, bssid, ETH_ALEN);
2544 @@ -318,7 +318,6 @@ static void __ieee80211_sta_join_ibss(st
2545         rcu_assign_pointer(ifibss->presp, presp);
2546         mgmt = (void *)presp->head;
2547  
2548 -       sdata->radar_required = radar_required;
2549         sdata->vif.bss_conf.enable_beacon = true;
2550         sdata->vif.bss_conf.beacon_int = beacon_int;
2551         sdata->vif.bss_conf.basic_rates = basic_rates;
2552 @@ -386,7 +385,7 @@ static void __ieee80211_sta_join_ibss(st
2553                                               presp->head_len, 0, GFP_KERNEL);
2554         cfg80211_put_bss(local->hw.wiphy, bss);
2555         netif_carrier_on(sdata->dev);
2556 -       cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
2557 +       cfg80211_ibss_joined(sdata->dev, ifibss->bssid, chan, GFP_KERNEL);
2558  }
2559  
2560  static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
2561 @@ -802,6 +801,8 @@ ieee80211_ibss_process_chanswitch(struct
2562         int err;
2563         u32 sta_flags;
2564  
2565 +       sdata_assert_lock(sdata);
2566 +
2567         sta_flags = IEEE80211_STA_DISABLE_VHT;
2568         switch (ifibss->chandef.width) {
2569         case NL80211_CHAN_WIDTH_5:
2570 @@ -1471,6 +1472,11 @@ static void ieee80211_rx_mgmt_probe_req(
2571         memcpy(((struct ieee80211_mgmt *) skb->data)->da, mgmt->sa, ETH_ALEN);
2572         ibss_dbg(sdata, "Sending ProbeResp to %pM\n", mgmt->sa);
2573         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2574 +
2575 +       /* avoid excessive retries for probe request to wildcard SSIDs */
2576 +       if (pos[1] == 0)
2577 +               IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_NO_ACK;
2578 +
2579         ieee80211_tx_skb(sdata, skb);
2580  }
2581  
2582 --- a/net/mac80211/mesh.c
2583 +++ b/net/mac80211/mesh.c
2584 @@ -872,6 +872,8 @@ ieee80211_mesh_process_chnswitch(struct 
2585         if (!ifmsh->mesh_id)
2586                 return false;
2587  
2588 +       sdata_assert_lock(sdata);
2589 +
2590         sta_flags = IEEE80211_STA_DISABLE_VHT;
2591         switch (sdata->vif.bss_conf.chandef.width) {
2592         case NL80211_CHAN_WIDTH_20_NOHT:
2593 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
2594 +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
2595 @@ -4658,6 +4658,7 @@ brcmf_notify_connect_status(struct brcmf
2596         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
2597         struct net_device *ndev = ifp->ndev;
2598         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2599 +       struct ieee80211_channel *chan;
2600         s32 err = 0;
2601  
2602         if (ifp->vif->mode == WL_MODE_AP) {
2603 @@ -4665,9 +4666,10 @@ brcmf_notify_connect_status(struct brcmf
2604         } else if (brcmf_is_linkup(e)) {
2605                 brcmf_dbg(CONN, "Linkup\n");
2606                 if (brcmf_is_ibssmode(ifp->vif)) {
2607 +                       chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
2608                         memcpy(profile->bssid, e->addr, ETH_ALEN);
2609                         wl_inform_ibss(cfg, ndev, e->addr);
2610 -                       cfg80211_ibss_joined(ndev, e->addr, GFP_KERNEL);
2611 +                       cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
2612                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
2613                                   &ifp->vif->sme_state);
2614                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
2615 --- a/drivers/net/wireless/libertas/cfg.c
2616 +++ b/drivers/net/wireless/libertas/cfg.c
2617 @@ -1766,7 +1766,8 @@ static void lbs_join_post(struct lbs_pri
2618         memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
2619         priv->wdev->ssid_len = params->ssid_len;
2620  
2621 -       cfg80211_ibss_joined(priv->dev, bssid, GFP_KERNEL);
2622 +       cfg80211_ibss_joined(priv->dev, bssid, params->chandef.chan,
2623 +                            GFP_KERNEL);
2624  
2625         /* TODO: consider doing this at MACREG_INT_CODE_LINK_SENSED time */
2626         priv->connect_status = LBS_CONNECTED;
2627 --- a/drivers/net/wireless/mwifiex/cfg80211.c
2628 +++ b/drivers/net/wireless/mwifiex/cfg80211.c
2629 @@ -1881,7 +1881,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy 
2630                                      params->privacy);
2631  done:
2632         if (!ret) {
2633 -               cfg80211_ibss_joined(priv->netdev, priv->cfg_bssid, GFP_KERNEL);
2634 +               cfg80211_ibss_joined(priv->netdev, priv->cfg_bssid,
2635 +                                    params->chandef.chan, GFP_KERNEL);
2636                 dev_dbg(priv->adapter->dev,
2637                         "info: joined/created adhoc network with bssid"
2638                         " %pM successfully\n", priv->cfg_bssid);
2639 --- a/drivers/net/wireless/rndis_wlan.c
2640 +++ b/drivers/net/wireless/rndis_wlan.c
2641 @@ -2835,7 +2835,9 @@ static void rndis_wlan_do_link_up_work(s
2642                                         bssid, req_ie, req_ie_len,
2643                                         resp_ie, resp_ie_len, GFP_KERNEL);
2644         } else if (priv->infra_mode == NDIS_80211_INFRA_ADHOC)
2645 -               cfg80211_ibss_joined(usbdev->net, bssid, GFP_KERNEL);
2646 +               cfg80211_ibss_joined(usbdev->net, bssid,
2647 +                                    get_current_channel(usbdev, NULL),
2648 +                                    GFP_KERNEL);
2649  
2650         kfree(info);
2651  
2652 --- a/net/wireless/ibss.c
2653 +++ b/net/wireless/ibss.c
2654 @@ -14,7 +14,8 @@
2655  #include "rdev-ops.h"
2656  
2657  
2658 -void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
2659 +void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
2660 +                           struct ieee80211_channel *channel)
2661  {
2662         struct wireless_dev *wdev = dev->ieee80211_ptr;
2663         struct cfg80211_bss *bss;
2664 @@ -28,8 +29,7 @@ void __cfg80211_ibss_joined(struct net_d
2665         if (!wdev->ssid_len)
2666                 return;
2667  
2668 -       bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
2669 -                              wdev->ssid, wdev->ssid_len,
2670 +       bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0,
2671                                WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
2672  
2673         if (WARN_ON(!bss))
2674 @@ -54,21 +54,26 @@ void __cfg80211_ibss_joined(struct net_d
2675  #endif
2676  }
2677  
2678 -void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
2679 +void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
2680 +                         struct ieee80211_channel *channel, gfp_t gfp)
2681  {
2682         struct wireless_dev *wdev = dev->ieee80211_ptr;
2683         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
2684         struct cfg80211_event *ev;
2685         unsigned long flags;
2686  
2687 -       trace_cfg80211_ibss_joined(dev, bssid);
2688 +       trace_cfg80211_ibss_joined(dev, bssid, channel);
2689 +
2690 +       if (WARN_ON(!channel))
2691 +               return;
2692  
2693         ev = kzalloc(sizeof(*ev), gfp);
2694         if (!ev)
2695                 return;
2696  
2697         ev->type = EVENT_IBSS_JOINED;
2698 -       memcpy(ev->cr.bssid, bssid, ETH_ALEN);
2699 +       memcpy(ev->ij.bssid, bssid, ETH_ALEN);
2700 +       ev->ij.channel = channel;
2701  
2702         spin_lock_irqsave(&wdev->event_lock, flags);
2703         list_add_tail(&ev->list, &wdev->event_list);
2704 @@ -117,6 +122,7 @@ int __cfg80211_join_ibss(struct cfg80211
2705  
2706         wdev->ibss_fixed = params->channel_fixed;
2707         wdev->ibss_dfs_possible = params->userspace_handles_dfs;
2708 +       wdev->chandef = params->chandef;
2709  #ifdef CPTCFG_CFG80211_WEXT
2710         wdev->wext.ibss.chandef = params->chandef;
2711  #endif
2712 @@ -200,6 +206,7 @@ static void __cfg80211_clear_ibss(struct
2713  
2714         wdev->current_bss = NULL;
2715         wdev->ssid_len = 0;
2716 +       memset(&wdev->chandef, 0, sizeof(wdev->chandef));
2717  #ifdef CPTCFG_CFG80211_WEXT
2718         if (!nowext)
2719                 wdev->wext.ibss.ssid_len = 0;
2720 --- a/net/wireless/trace.h
2721 +++ b/net/wireless/trace.h
2722 @@ -2278,11 +2278,6 @@ DECLARE_EVENT_CLASS(cfg80211_rx_evt,
2723         TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT, NETDEV_PR_ARG, MAC_PR_ARG(addr))
2724  );
2725  
2726 -DEFINE_EVENT(cfg80211_rx_evt, cfg80211_ibss_joined,
2727 -       TP_PROTO(struct net_device *netdev, const u8 *addr),
2728 -       TP_ARGS(netdev, addr)
2729 -);
2730 -
2731  DEFINE_EVENT(cfg80211_rx_evt, cfg80211_rx_spurious_frame,
2732         TP_PROTO(struct net_device *netdev, const u8 *addr),
2733         TP_ARGS(netdev, addr)
2734 @@ -2293,6 +2288,24 @@ DEFINE_EVENT(cfg80211_rx_evt, cfg80211_r
2735         TP_ARGS(netdev, addr)
2736  );
2737  
2738 +TRACE_EVENT(cfg80211_ibss_joined,
2739 +       TP_PROTO(struct net_device *netdev, const u8 *bssid,
2740 +                struct ieee80211_channel *channel),
2741 +       TP_ARGS(netdev, bssid, channel),
2742 +       TP_STRUCT__entry(
2743 +               NETDEV_ENTRY
2744 +               MAC_ENTRY(bssid)
2745 +               CHAN_ENTRY
2746 +       ),
2747 +       TP_fast_assign(
2748 +               NETDEV_ASSIGN;
2749 +               MAC_ASSIGN(bssid, bssid);
2750 +               CHAN_ASSIGN(channel);
2751 +       ),
2752 +       TP_printk(NETDEV_PR_FMT ", bssid: " MAC_PR_FMT ", " CHAN_PR_FMT,
2753 +                 NETDEV_PR_ARG, MAC_PR_ARG(bssid), CHAN_PR_ARG)
2754 +);
2755 +
2756  TRACE_EVENT(cfg80211_probe_status,
2757         TP_PROTO(struct net_device *netdev, const u8 *addr, u64 cookie,
2758                  bool acked),
2759 --- a/net/wireless/util.c
2760 +++ b/net/wireless/util.c
2761 @@ -820,7 +820,8 @@ void cfg80211_process_wdev_events(struct
2762                                                 ev->dc.reason, true);
2763                         break;
2764                 case EVENT_IBSS_JOINED:
2765 -                       __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid);
2766 +                       __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
2767 +                                              ev->ij.channel);
2768                         break;
2769                 }
2770                 wdev_unlock(wdev);
2771 @@ -1356,7 +1357,7 @@ int cfg80211_can_use_iftype_chan(struct 
2772                  */
2773                 mutex_lock_nested(&wdev_iter->mtx, 1);
2774                 __acquire(wdev_iter->mtx);
2775 -               cfg80211_get_chan_state(wdev_iter, &ch, &chmode);
2776 +               cfg80211_get_chan_state(wdev_iter, &ch, &chmode, &radar_detect);
2777                 wdev_unlock(wdev_iter);
2778  
2779                 switch (chmode) {
2780 --- a/net/wireless/chan.c
2781 +++ b/net/wireless/chan.c
2782 @@ -642,7 +642,8 @@ int cfg80211_set_monitor_channel(struct 
2783  void
2784  cfg80211_get_chan_state(struct wireless_dev *wdev,
2785                         struct ieee80211_channel **chan,
2786 -                       enum cfg80211_chan_mode *chanmode)
2787 +                       enum cfg80211_chan_mode *chanmode,
2788 +                       u8 *radar_detect)
2789  {
2790         *chan = NULL;
2791         *chanmode = CHAN_MODE_UNDEFINED;
2792 @@ -660,6 +661,11 @@ cfg80211_get_chan_state(struct wireless_
2793                                      !wdev->ibss_dfs_possible)
2794                                   ? CHAN_MODE_SHARED
2795                                   : CHAN_MODE_EXCLUSIVE;
2796 +
2797 +                       /* consider worst-case - IBSS can try to return to the
2798 +                        * original user-specified channel as creator */
2799 +                       if (wdev->ibss_dfs_possible)
2800 +                               *radar_detect |= BIT(wdev->chandef.width);
2801                         return;
2802                 }
2803                 break;
2804 @@ -674,17 +680,26 @@ cfg80211_get_chan_state(struct wireless_
2805         case NL80211_IFTYPE_AP:
2806         case NL80211_IFTYPE_P2P_GO:
2807                 if (wdev->cac_started) {
2808 -                       *chan = wdev->channel;
2809 +                       *chan = wdev->chandef.chan;
2810                         *chanmode = CHAN_MODE_SHARED;
2811 +                       *radar_detect |= BIT(wdev->chandef.width);
2812                 } else if (wdev->beacon_interval) {
2813 -                       *chan = wdev->channel;
2814 +                       *chan = wdev->chandef.chan;
2815                         *chanmode = CHAN_MODE_SHARED;
2816 +
2817 +                       if (cfg80211_chandef_dfs_required(wdev->wiphy,
2818 +                                                         &wdev->chandef))
2819 +                               *radar_detect |= BIT(wdev->chandef.width);
2820                 }
2821                 return;
2822         case NL80211_IFTYPE_MESH_POINT:
2823                 if (wdev->mesh_id_len) {
2824 -                       *chan = wdev->channel;
2825 +                       *chan = wdev->chandef.chan;
2826                         *chanmode = CHAN_MODE_SHARED;
2827 +
2828 +                       if (cfg80211_chandef_dfs_required(wdev->wiphy,
2829 +                                                         &wdev->chandef))
2830 +                               *radar_detect |= BIT(wdev->chandef.width);
2831                 }
2832                 return;
2833         case NL80211_IFTYPE_MONITOR:
2834 --- a/net/wireless/mesh.c
2835 +++ b/net/wireless/mesh.c
2836 @@ -195,7 +195,7 @@ int __cfg80211_join_mesh(struct cfg80211
2837         if (!err) {
2838                 memcpy(wdev->ssid, setup->mesh_id, setup->mesh_id_len);
2839                 wdev->mesh_id_len = setup->mesh_id_len;
2840 -               wdev->channel = setup->chandef.chan;
2841 +               wdev->chandef = setup->chandef;
2842         }
2843  
2844         return err;
2845 @@ -244,7 +244,7 @@ int cfg80211_set_mesh_channel(struct cfg
2846                 err = rdev_libertas_set_mesh_channel(rdev, wdev->netdev,
2847                                                      chandef->chan);
2848                 if (!err)
2849 -                       wdev->channel = chandef->chan;
2850 +                       wdev->chandef = *chandef;
2851  
2852                 return err;
2853         }
2854 @@ -276,7 +276,7 @@ static int __cfg80211_leave_mesh(struct 
2855         err = rdev_leave_mesh(rdev, dev);
2856         if (!err) {
2857                 wdev->mesh_id_len = 0;
2858 -               wdev->channel = NULL;
2859 +               memset(&wdev->chandef, 0, sizeof(wdev->chandef));
2860                 rdev_set_qos_map(rdev, dev, NULL);
2861         }
2862  
2863 --- a/net/wireless/mlme.c
2864 +++ b/net/wireless/mlme.c
2865 @@ -772,7 +772,7 @@ void cfg80211_cac_event(struct net_devic
2866         if (WARN_ON(!wdev->cac_started))
2867                 return;
2868  
2869 -       if (WARN_ON(!wdev->channel))
2870 +       if (WARN_ON(!wdev->chandef.chan))
2871                 return;
2872  
2873         switch (event) {
2874 --- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
2875 +++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
2876 @@ -5065,6 +5065,10 @@ static u16 ar9003_hw_get_max_edge_power(
2877                         break;
2878                 }
2879         }
2880 +
2881 +       if (is2GHz && !twiceMaxEdgePower)
2882 +               twiceMaxEdgePower = 60;
2883 +
2884         return twiceMaxEdgePower;
2885  }
2886  
2887 --- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
2888 +++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
2889 @@ -23,10 +23,11 @@
2890  #define MAX_MEASUREMENT        MAX_IQCAL_MEASUREMENT
2891  #define MAX_MAG_DELTA  11
2892  #define MAX_PHS_DELTA  10
2893 +#define MAXIQCAL        3
2894  
2895  struct coeff {
2896 -       int mag_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT];
2897 -       int phs_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT];
2898 +       int mag_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT][MAXIQCAL];
2899 +       int phs_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT][MAXIQCAL];
2900         int iqc_coeff[2];
2901  };
2902  
2903 @@ -800,7 +801,7 @@ static bool ar9003_hw_calc_iq_corr(struc
2904         if (q_q_coff > 63)
2905                 q_q_coff = 63;
2906  
2907 -       iqc_coeff[0] = (q_q_coff * 128) + q_i_coff;
2908 +       iqc_coeff[0] = (q_q_coff * 128) + (0x7f & q_i_coff);
2909  
2910         ath_dbg(common, CALIBRATE, "tx chain %d: iq corr coeff=%x\n",
2911                 chain_idx, iqc_coeff[0]);
2912 @@ -831,7 +832,7 @@ static bool ar9003_hw_calc_iq_corr(struc
2913         if (q_q_coff > 63)
2914                 q_q_coff = 63;
2915  
2916 -       iqc_coeff[1] = (q_q_coff * 128) + q_i_coff;
2917 +       iqc_coeff[1] = (q_q_coff * 128) + (0x7f & q_i_coff);
2918  
2919         ath_dbg(common, CALIBRATE, "rx chain %d: iq corr coeff=%x\n",
2920                 chain_idx, iqc_coeff[1]);
2921 @@ -839,7 +840,8 @@ static bool ar9003_hw_calc_iq_corr(struc
2922         return true;
2923  }
2924  
2925 -static void ar9003_hw_detect_outlier(int *mp_coeff, int nmeasurement,
2926 +static void ar9003_hw_detect_outlier(int mp_coeff[][MAXIQCAL],
2927 +                                    int nmeasurement,
2928                                      int max_delta)
2929  {
2930         int mp_max = -64, max_idx = 0;
2931 @@ -848,20 +850,20 @@ static void ar9003_hw_detect_outlier(int
2932  
2933         /* find min/max mismatch across all calibrated gains */
2934         for (i = 0; i < nmeasurement; i++) {
2935 -               if (mp_coeff[i] > mp_max) {
2936 -                       mp_max = mp_coeff[i];
2937 +               if (mp_coeff[i][0] > mp_max) {
2938 +                       mp_max = mp_coeff[i][0];
2939                         max_idx = i;
2940 -               } else if (mp_coeff[i] < mp_min) {
2941 -                       mp_min = mp_coeff[i];
2942 +               } else if (mp_coeff[i][0] < mp_min) {
2943 +                       mp_min = mp_coeff[i][0];
2944                         min_idx = i;
2945                 }
2946         }
2947  
2948         /* find average (exclude max abs value) */
2949         for (i = 0; i < nmeasurement; i++) {
2950 -               if ((abs(mp_coeff[i]) < abs(mp_max)) ||
2951 -                   (abs(mp_coeff[i]) < abs(mp_min))) {
2952 -                       mp_avg += mp_coeff[i];
2953 +               if ((abs(mp_coeff[i][0]) < abs(mp_max)) ||
2954 +                   (abs(mp_coeff[i][0]) < abs(mp_min))) {
2955 +                       mp_avg += mp_coeff[i][0];
2956                         mp_count++;
2957                 }
2958         }
2959 @@ -873,7 +875,7 @@ static void ar9003_hw_detect_outlier(int
2960         if (mp_count)
2961                 mp_avg /= mp_count;
2962         else
2963 -               mp_avg = mp_coeff[nmeasurement - 1];
2964 +               mp_avg = mp_coeff[nmeasurement - 1][0];
2965  
2966         /* detect outlier */
2967         if (abs(mp_max - mp_min) > max_delta) {
2968 @@ -882,15 +884,16 @@ static void ar9003_hw_detect_outlier(int
2969                 else
2970                         outlier_idx = min_idx;
2971  
2972 -               mp_coeff[outlier_idx] = mp_avg;
2973 +               mp_coeff[outlier_idx][0] = mp_avg;
2974         }
2975  }
2976  
2977 -static void ar9003_hw_tx_iqcal_load_avg_2_passes(struct ath_hw *ah,
2978 -                                                struct coeff *coeff,
2979 -                                                bool is_reusable)
2980 +static void ar9003_hw_tx_iq_cal_outlier_detection(struct ath_hw *ah,
2981 +                                                 struct coeff *coeff,
2982 +                                                 bool is_reusable)
2983  {
2984         int i, im, nmeasurement;
2985 +       int magnitude, phase;
2986         u32 tx_corr_coeff[MAX_MEASUREMENT][AR9300_MAX_CHAINS];
2987         struct ath9k_hw_cal_data *caldata = ah->caldata;
2988  
2989 @@ -920,21 +923,30 @@ static void ar9003_hw_tx_iqcal_load_avg_
2990                 if (nmeasurement > MAX_MEASUREMENT)
2991                         nmeasurement = MAX_MEASUREMENT;
2992  
2993 -               /* detect outlier only if nmeasurement > 1 */
2994 -               if (nmeasurement > 1) {
2995 -                       /* Detect magnitude outlier */
2996 -                       ar9003_hw_detect_outlier(coeff->mag_coeff[i],
2997 -                                       nmeasurement, MAX_MAG_DELTA);
2998 -
2999 -                       /* Detect phase outlier */
3000 -                       ar9003_hw_detect_outlier(coeff->phs_coeff[i],
3001 -                                       nmeasurement, MAX_PHS_DELTA);
3002 +               /*
3003 +                * Skip normal outlier detection for AR9550.
3004 +                */
3005 +               if (!AR_SREV_9550(ah)) {
3006 +                       /* detect outlier only if nmeasurement > 1 */
3007 +                       if (nmeasurement > 1) {
3008 +                               /* Detect magnitude outlier */
3009 +                               ar9003_hw_detect_outlier(coeff->mag_coeff[i],
3010 +                                                        nmeasurement,
3011 +                                                        MAX_MAG_DELTA);
3012 +
3013 +                               /* Detect phase outlier */
3014 +                               ar9003_hw_detect_outlier(coeff->phs_coeff[i],
3015 +                                                        nmeasurement,
3016 +                                                        MAX_PHS_DELTA);
3017 +                       }
3018                 }
3019  
3020                 for (im = 0; im < nmeasurement; im++) {
3021 +                       magnitude = coeff->mag_coeff[i][im][0];
3022 +                       phase = coeff->phs_coeff[i][im][0];
3023  
3024 -                       coeff->iqc_coeff[0] = (coeff->mag_coeff[i][im] & 0x7f) |
3025 -                               ((coeff->phs_coeff[i][im] & 0x7f) << 7);
3026 +                       coeff->iqc_coeff[0] =
3027 +                               (phase & 0x7f) | ((magnitude & 0x7f) << 7);
3028  
3029                         if ((im % 2) == 0)
3030                                 REG_RMW_FIELD(ah, tx_corr_coeff[im][i],
3031 @@ -991,7 +1003,63 @@ static bool ar9003_hw_tx_iq_cal_run(stru
3032         return true;
3033  }
3034  
3035 -static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah, bool is_reusable)
3036 +static void __ar955x_tx_iq_cal_sort(struct ath_hw *ah,
3037 +                                   struct coeff *coeff,
3038 +                                   int i, int nmeasurement)
3039 +{
3040 +       struct ath_common *common = ath9k_hw_common(ah);
3041 +       int im, ix, iy, temp;
3042 +
3043 +       for (im = 0; im < nmeasurement; im++) {
3044 +               for (ix = 0; ix < MAXIQCAL - 1; ix++) {
3045 +                       for (iy = ix + 1; iy <= MAXIQCAL - 1; iy++) {
3046 +                               if (coeff->mag_coeff[i][im][iy] <
3047 +                                   coeff->mag_coeff[i][im][ix]) {
3048 +                                       temp = coeff->mag_coeff[i][im][ix];
3049 +                                       coeff->mag_coeff[i][im][ix] =
3050 +                                               coeff->mag_coeff[i][im][iy];
3051 +                                       coeff->mag_coeff[i][im][iy] = temp;
3052 +                               }
3053 +                               if (coeff->phs_coeff[i][im][iy] <
3054 +                                   coeff->phs_coeff[i][im][ix]) {
3055 +                                       temp = coeff->phs_coeff[i][im][ix];
3056 +                                       coeff->phs_coeff[i][im][ix] =
3057 +                                               coeff->phs_coeff[i][im][iy];
3058 +                                       coeff->phs_coeff[i][im][iy] = temp;
3059 +                               }
3060 +                       }
3061 +               }
3062 +               coeff->mag_coeff[i][im][0] = coeff->mag_coeff[i][im][MAXIQCAL / 2];
3063 +               coeff->phs_coeff[i][im][0] = coeff->phs_coeff[i][im][MAXIQCAL / 2];
3064 +
3065 +               ath_dbg(common, CALIBRATE,
3066 +                       "IQCAL: Median [ch%d][gain%d]: mag = %d phase = %d\n",
3067 +                       i, im,
3068 +                       coeff->mag_coeff[i][im][0],
3069 +                       coeff->phs_coeff[i][im][0]);
3070 +       }
3071 +}
3072 +
3073 +static bool ar955x_tx_iq_cal_median(struct ath_hw *ah,
3074 +                                   struct coeff *coeff,
3075 +                                   int iqcal_idx,
3076 +                                   int nmeasurement)
3077 +{
3078 +       int i;
3079 +
3080 +       if ((iqcal_idx + 1) != MAXIQCAL)
3081 +               return false;
3082 +
3083 +       for (i = 0; i < AR9300_MAX_CHAINS; i++) {
3084 +               __ar955x_tx_iq_cal_sort(ah, coeff, i, nmeasurement);
3085 +       }
3086 +
3087 +       return true;
3088 +}
3089 +
3090 +static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah,
3091 +                                         int iqcal_idx,
3092 +                                         bool is_reusable)
3093  {
3094         struct ath_common *common = ath9k_hw_common(ah);
3095         const u32 txiqcal_status[AR9300_MAX_CHAINS] = {
3096 @@ -1004,10 +1072,11 @@ static void ar9003_hw_tx_iq_cal_post_pro
3097                 AR_PHY_CHAN_INFO_TAB_1,
3098                 AR_PHY_CHAN_INFO_TAB_2,
3099         };
3100 -       struct coeff coeff;
3101 +       static struct coeff coeff;
3102         s32 iq_res[6];
3103         int i, im, j;
3104 -       int nmeasurement;
3105 +       int nmeasurement = 0;
3106 +       bool outlier_detect = true;
3107  
3108         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
3109                 if (!(ah->txchainmask & (1 << i)))
3110 @@ -1065,17 +1134,23 @@ static void ar9003_hw_tx_iq_cal_post_pro
3111                                 goto tx_iqcal_fail;
3112                         }
3113  
3114 -                       coeff.mag_coeff[i][im] = coeff.iqc_coeff[0] & 0x7f;
3115 -                       coeff.phs_coeff[i][im] =
3116 +                       coeff.phs_coeff[i][im][iqcal_idx] =
3117 +                               coeff.iqc_coeff[0] & 0x7f;
3118 +                       coeff.mag_coeff[i][im][iqcal_idx] =
3119                                 (coeff.iqc_coeff[0] >> 7) & 0x7f;
3120  
3121 -                       if (coeff.mag_coeff[i][im] > 63)
3122 -                               coeff.mag_coeff[i][im] -= 128;
3123 -                       if (coeff.phs_coeff[i][im] > 63)
3124 -                               coeff.phs_coeff[i][im] -= 128;
3125 +                       if (coeff.mag_coeff[i][im][iqcal_idx] > 63)
3126 +                               coeff.mag_coeff[i][im][iqcal_idx] -= 128;
3127 +                       if (coeff.phs_coeff[i][im][iqcal_idx] > 63)
3128 +                               coeff.phs_coeff[i][im][iqcal_idx] -= 128;
3129                 }
3130         }
3131 -       ar9003_hw_tx_iqcal_load_avg_2_passes(ah, &coeff, is_reusable);
3132 +
3133 +       if (AR_SREV_9550(ah))
3134 +               outlier_detect = ar955x_tx_iq_cal_median(ah, &coeff,
3135 +                                                        iqcal_idx, nmeasurement);
3136 +       if (outlier_detect)
3137 +               ar9003_hw_tx_iq_cal_outlier_detection(ah, &coeff, is_reusable);
3138  
3139         return;
3140  
3141 @@ -1409,7 +1484,7 @@ skip_tx_iqcal:
3142         }
3143  
3144         if (txiqcal_done)
3145 -               ar9003_hw_tx_iq_cal_post_proc(ah, is_reusable);
3146 +               ar9003_hw_tx_iq_cal_post_proc(ah, 0, is_reusable);
3147         else if (caldata && test_bit(TXIQCAL_DONE, &caldata->cal_flags))
3148                 ar9003_hw_tx_iq_cal_reload(ah);
3149  
3150 @@ -1455,14 +1530,38 @@ skip_tx_iqcal:
3151         return true;
3152  }
3153  
3154 +static bool do_ar9003_agc_cal(struct ath_hw *ah)
3155 +{
3156 +       struct ath_common *common = ath9k_hw_common(ah);
3157 +       bool status;
3158 +
3159 +       REG_WRITE(ah, AR_PHY_AGC_CONTROL,
3160 +                 REG_READ(ah, AR_PHY_AGC_CONTROL) |
3161 +                 AR_PHY_AGC_CONTROL_CAL);
3162 +
3163 +       status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
3164 +                              AR_PHY_AGC_CONTROL_CAL,
3165 +                              0, AH_WAIT_TIMEOUT);
3166 +       if (!status) {
3167 +               ath_dbg(common, CALIBRATE,
3168 +                       "offset calibration failed to complete in %d ms,"
3169 +                       "noisy environment?\n",
3170 +                       AH_WAIT_TIMEOUT / 1000);
3171 +               return false;
3172 +       }
3173 +
3174 +       return true;
3175 +}
3176 +
3177  static bool ar9003_hw_init_cal_soc(struct ath_hw *ah,
3178                                    struct ath9k_channel *chan)
3179  {
3180         struct ath_common *common = ath9k_hw_common(ah);
3181         struct ath9k_hw_cal_data *caldata = ah->caldata;
3182         bool txiqcal_done = false;
3183 -       bool is_reusable = true, status = true;
3184 +       bool status = true;
3185         bool run_agc_cal = false, sep_iq_cal = false;
3186 +       int i = 0;
3187  
3188         /* Use chip chainmask only for calibration */
3189         ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
3190 @@ -1485,7 +1584,12 @@ static bool ar9003_hw_init_cal_soc(struc
3191          * AGC calibration. Specifically, AR9550 in SoC chips.
3192          */
3193         if (ah->enabled_cals & TX_IQ_ON_AGC_CAL) {
3194 -               txiqcal_done = true;
3195 +               if (REG_READ_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_0,
3196 +                                  AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL)) {
3197 +                               txiqcal_done = true;
3198 +               } else {
3199 +                       txiqcal_done = false;
3200 +               }
3201                 run_agc_cal = true;
3202         } else {
3203                 sep_iq_cal = true;
3204 @@ -1512,27 +1616,37 @@ skip_tx_iqcal:
3205                 if (AR_SREV_9330_11(ah))
3206                         ar9003_hw_manual_peak_cal(ah, 0, IS_CHAN_2GHZ(chan));
3207  
3208 -               /* Calibrate the AGC */
3209 -               REG_WRITE(ah, AR_PHY_AGC_CONTROL,
3210 -                         REG_READ(ah, AR_PHY_AGC_CONTROL) |
3211 -                         AR_PHY_AGC_CONTROL_CAL);
3212 -
3213 -               /* Poll for offset calibration complete */
3214 -               status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
3215 -                                      AR_PHY_AGC_CONTROL_CAL,
3216 -                                      0, AH_WAIT_TIMEOUT);
3217 -       }
3218 +               /*
3219 +                * For non-AR9550 chips, we just trigger AGC calibration
3220 +                * in the HW, poll for completion and then process
3221 +                * the results.
3222 +                *
3223 +                * For AR955x, we run it multiple times and use
3224 +                * median IQ correction.
3225 +                */
3226 +               if (!AR_SREV_9550(ah)) {
3227 +                       status = do_ar9003_agc_cal(ah);
3228 +                       if (!status)
3229 +                               return false;
3230  
3231 -       if (!status) {
3232 -               ath_dbg(common, CALIBRATE,
3233 -                       "offset calibration failed to complete in %d ms; noisy environment?\n",
3234 -                       AH_WAIT_TIMEOUT / 1000);
3235 -               return false;
3236 +                       if (txiqcal_done)
3237 +                               ar9003_hw_tx_iq_cal_post_proc(ah, 0, false);
3238 +               } else {
3239 +                       if (!txiqcal_done) {
3240 +                               status = do_ar9003_agc_cal(ah);
3241 +                               if (!status)
3242 +                                       return false;
3243 +                       } else {
3244 +                               for (i = 0; i < MAXIQCAL; i++) {
3245 +                                       status = do_ar9003_agc_cal(ah);
3246 +                                       if (!status)
3247 +                                               return false;
3248 +                                       ar9003_hw_tx_iq_cal_post_proc(ah, i, false);
3249 +                               }
3250 +                       }
3251 +               }
3252         }
3253  
3254 -       if (txiqcal_done)
3255 -               ar9003_hw_tx_iq_cal_post_proc(ah, is_reusable);
3256 -
3257         /* Revert chainmask to runtime parameters */
3258         ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
3259  
3260 --- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
3261 +++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
3262 @@ -15,6 +15,8 @@
3263  #ifndef RTL8187_H
3264  #define RTL8187_H
3265  
3266 +#include <linux/cache.h>
3267 +
3268  #include "rtl818x.h"
3269  #include "leds.h"
3270  
3271 @@ -139,7 +141,10 @@ struct rtl8187_priv {
3272         u8 aifsn[4];
3273         u8 rfkill_mask;
3274         struct {
3275 -               __le64 buf;
3276 +               union {
3277 +                       __le64 buf;
3278 +                       u8 dummy1[L1_CACHE_BYTES];
3279 +               } ____cacheline_aligned;
3280                 struct sk_buff_head queue;
3281         } b_tx_status; /* This queue is used by both -b and non-b devices */
3282         struct mutex io_mutex;
3283 @@ -147,7 +152,8 @@ struct rtl8187_priv {
3284                 u8 bits8;
3285                 __le16 bits16;
3286                 __le32 bits32;
3287 -       } *io_dmabuf;
3288 +               u8 dummy2[L1_CACHE_BYTES];
3289 +       } *io_dmabuf ____cacheline_aligned;
3290         bool rfkill_off;
3291         u16 seqno;
3292  };
3293 --- a/net/mac80211/wme.c
3294 +++ b/net/mac80211/wme.c
3295 @@ -154,6 +154,11 @@ u16 ieee80211_select_queue(struct ieee80
3296                 return IEEE80211_AC_BE;
3297         }
3298  
3299 +       if (skb->protocol == sdata->control_port_protocol) {
3300 +               skb->priority = 7;
3301 +               return ieee80211_downgrade_queue(sdata, skb);
3302 +       }
3303 +
3304         /* use the data classifier to determine what 802.1d tag the
3305          * data frame has */
3306         rcu_read_lock();
3307 --- a/drivers/net/wireless/ath/ath9k/xmit.c
3308 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
3309 @@ -1444,14 +1444,16 @@ void ath_tx_aggr_sleep(struct ieee80211_
3310         for (tidno = 0, tid = &an->tid[tidno];
3311              tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
3312  
3313 -               if (!tid->sched)
3314 -                       continue;
3315 -
3316                 ac = tid->ac;
3317                 txq = ac->txq;
3318  
3319                 ath_txq_lock(sc, txq);
3320  
3321 +               if (!tid->sched) {
3322 +                       ath_txq_unlock(sc, txq);
3323 +                       continue;
3324 +               }
3325 +
3326                 buffered = ath_tid_has_buffered(tid);
3327  
3328                 tid->sched = false;
3329 @@ -1696,7 +1698,7 @@ int ath_cabq_update(struct ath_softc *sc
3330  
3331         ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
3332  
3333 -       qi.tqi_readyTime = (cur_conf->beacon_interval *
3334 +       qi.tqi_readyTime = (TU_TO_USEC(cur_conf->beacon_interval) *
3335                             ATH_CABQ_READY_TIME) / 100;
3336         ath_txq_update(sc, qnum, &qi);
3337  
3338 @@ -2184,14 +2186,15 @@ int ath_tx_start(struct ieee80211_hw *hw
3339                 txq->stopped = true;
3340         }
3341  
3342 +       if (txctl->an)
3343 +               tid = ath_get_skb_tid(sc, txctl->an, skb);
3344 +
3345         if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
3346                 ath_txq_unlock(sc, txq);
3347                 txq = sc->tx.uapsdq;
3348                 ath_txq_lock(sc, txq);
3349         } else if (txctl->an &&
3350                    ieee80211_is_data_present(hdr->frame_control)) {
3351 -               tid = ath_get_skb_tid(sc, txctl->an, skb);
3352 -
3353                 WARN_ON(tid->ac->txq != txctl->txq);
3354  
3355                 if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
3356 --- a/drivers/net/wireless/ath/ath9k/init.c
3357 +++ b/drivers/net/wireless/ath/ath9k/init.c
3358 @@ -943,6 +943,7 @@ static void ath9k_set_hw_capab(struct at
3359         hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
3360         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
3361         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
3362 +       hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
3363  
3364         hw->queues = 4;
3365         hw->max_rates = 4;
3366 --- a/net/mac80211/ieee80211_i.h
3367 +++ b/net/mac80211/ieee80211_i.h
3368 @@ -1700,14 +1700,8 @@ void ieee80211_stop_queue_by_reason(stru
3369  void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
3370  void ieee80211_add_pending_skb(struct ieee80211_local *local,
3371                                struct sk_buff *skb);
3372 -void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
3373 -                                  struct sk_buff_head *skbs,
3374 -                                  void (*fn)(void *data), void *data);
3375 -static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
3376 -                                             struct sk_buff_head *skbs)
3377 -{
3378 -       ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
3379 -}
3380 +void ieee80211_add_pending_skbs(struct ieee80211_local *local,
3381 +                               struct sk_buff_head *skbs);
3382  void ieee80211_flush_queues(struct ieee80211_local *local,
3383                             struct ieee80211_sub_if_data *sdata);
3384  
3385 --- a/net/mac80211/sta_info.c
3386 +++ b/net/mac80211/sta_info.c
3387 @@ -91,7 +91,7 @@ static int sta_info_hash_del(struct ieee
3388         return -ENOENT;
3389  }
3390  
3391 -static void cleanup_single_sta(struct sta_info *sta)
3392 +static void __cleanup_single_sta(struct sta_info *sta)
3393  {
3394         int ac, i;
3395         struct tid_ampdu_tx *tid_tx;
3396 @@ -99,7 +99,8 @@ static void cleanup_single_sta(struct st
3397         struct ieee80211_local *local = sdata->local;
3398         struct ps_data *ps;
3399  
3400 -       if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
3401 +       if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
3402 +           test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
3403                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
3404                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3405                         ps = &sdata->bss->ps;
3406 @@ -109,6 +110,7 @@ static void cleanup_single_sta(struct st
3407                         return;
3408  
3409                 clear_sta_flag(sta, WLAN_STA_PS_STA);
3410 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
3411  
3412                 atomic_dec(&ps->num_sta_ps);
3413                 sta_info_recalc_tim(sta);
3414 @@ -139,7 +141,14 @@ static void cleanup_single_sta(struct st
3415                 ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
3416                 kfree(tid_tx);
3417         }
3418 +}
3419  
3420 +static void cleanup_single_sta(struct sta_info *sta)
3421 +{
3422 +       struct ieee80211_sub_if_data *sdata = sta->sdata;
3423 +       struct ieee80211_local *local = sdata->local;
3424 +
3425 +       __cleanup_single_sta(sta);
3426         sta_info_free(local, sta);
3427  }
3428  
3429 @@ -330,6 +339,7 @@ struct sta_info *sta_info_alloc(struct i
3430         rcu_read_unlock();
3431  
3432         spin_lock_init(&sta->lock);
3433 +       spin_lock_init(&sta->ps_lock);
3434         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
3435         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
3436         mutex_init(&sta->ampdu_mlme.mtx);
3437 @@ -487,21 +497,26 @@ static int sta_info_insert_finish(struct
3438                 goto out_err;
3439         }
3440  
3441 -       /* notify driver */
3442 -       err = sta_info_insert_drv_state(local, sdata, sta);
3443 -       if (err)
3444 -               goto out_err;
3445 -
3446         local->num_sta++;
3447         local->sta_generation++;
3448         smp_mb();
3449  
3450 +       /* simplify things and don't accept BA sessions yet */
3451 +       set_sta_flag(sta, WLAN_STA_BLOCK_BA);
3452 +
3453         /* make the station visible */
3454         sta_info_hash_add(local, sta);
3455  
3456         list_add_rcu(&sta->list, &local->sta_list);
3457  
3458 +       /* notify driver */
3459 +       err = sta_info_insert_drv_state(local, sdata, sta);
3460 +       if (err)
3461 +               goto out_remove;
3462 +
3463         set_sta_flag(sta, WLAN_STA_INSERTED);
3464 +       /* accept BA sessions now */
3465 +       clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
3466  
3467         ieee80211_recalc_min_chandef(sdata);
3468         ieee80211_sta_debugfs_add(sta);
3469 @@ -522,6 +537,12 @@ static int sta_info_insert_finish(struct
3470                 mesh_accept_plinks_update(sdata);
3471  
3472         return 0;
3473 + out_remove:
3474 +       sta_info_hash_del(local, sta);
3475 +       list_del_rcu(&sta->list);
3476 +       local->num_sta--;
3477 +       synchronize_net();
3478 +       __cleanup_single_sta(sta);
3479   out_err:
3480         mutex_unlock(&local->sta_mtx);
3481         rcu_read_lock();
3482 @@ -1071,10 +1092,14 @@ struct ieee80211_sta *ieee80211_find_sta
3483  }
3484  EXPORT_SYMBOL(ieee80211_find_sta);
3485  
3486 -static void clear_sta_ps_flags(void *_sta)
3487 +/* powersave support code */
3488 +void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
3489  {
3490 -       struct sta_info *sta = _sta;
3491         struct ieee80211_sub_if_data *sdata = sta->sdata;
3492 +       struct ieee80211_local *local = sdata->local;
3493 +       struct sk_buff_head pending;
3494 +       int filtered = 0, buffered = 0, ac;
3495 +       unsigned long flags;
3496         struct ps_data *ps;
3497  
3498         if (sdata->vif.type == NL80211_IFTYPE_AP ||
3499 @@ -1085,20 +1110,6 @@ static void clear_sta_ps_flags(void *_st
3500         else
3501                 return;
3502  
3503 -       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
3504 -       if (test_and_clear_sta_flag(sta, WLAN_STA_PS_STA))
3505 -               atomic_dec(&ps->num_sta_ps);
3506 -}
3507 -
3508 -/* powersave support code */
3509 -void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
3510 -{
3511 -       struct ieee80211_sub_if_data *sdata = sta->sdata;
3512 -       struct ieee80211_local *local = sdata->local;
3513 -       struct sk_buff_head pending;
3514 -       int filtered = 0, buffered = 0, ac;
3515 -       unsigned long flags;
3516 -
3517         clear_sta_flag(sta, WLAN_STA_SP);
3518  
3519         BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
3520 @@ -1109,6 +1120,8 @@ void ieee80211_sta_ps_deliver_wakeup(str
3521  
3522         skb_queue_head_init(&pending);
3523  
3524 +       /* sync with ieee80211_tx_h_unicast_ps_buf */
3525 +       spin_lock(&sta->ps_lock);
3526         /* Send all buffered frames to the station */
3527         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3528                 int count = skb_queue_len(&pending), tmp;
3529 @@ -1127,7 +1140,12 @@ void ieee80211_sta_ps_deliver_wakeup(str
3530                 buffered += tmp - count;
3531         }
3532  
3533 -       ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
3534 +       ieee80211_add_pending_skbs(local, &pending);
3535 +       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
3536 +       clear_sta_flag(sta, WLAN_STA_PS_STA);
3537 +       spin_unlock(&sta->ps_lock);
3538 +
3539 +       atomic_dec(&ps->num_sta_ps);
3540  
3541         /* This station just woke up and isn't aware of our SMPS state */
3542         if (!ieee80211_smps_is_restrictive(sta->known_smps_mode,
3543 --- a/net/mac80211/sta_info.h
3544 +++ b/net/mac80211/sta_info.h
3545 @@ -267,6 +267,7 @@ struct ieee80211_tx_latency_stat {
3546   * @drv_unblock_wk: used for driver PS unblocking
3547   * @listen_interval: listen interval of this station, when we're acting as AP
3548   * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
3549 + * @ps_lock: used for powersave (when mac80211 is the AP) related locking
3550   * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
3551   *     when it leaves power saving state or polls
3552   * @tx_filtered: buffers (per AC) of frames we already tried to
3553 @@ -356,10 +357,8 @@ struct sta_info {
3554         /* use the accessors defined below */
3555         unsigned long _flags;
3556  
3557 -       /*
3558 -        * STA powersave frame queues, no more than the internal
3559 -        * locking required.