package/kernel/mac80211/patches/300-pending_work.patch

   1 --- a/net/mac80211/agg-rx.c
   2 +++ b/net/mac80211/agg-rx.c
   3 @@ -204,6 +204,8 @@ static void ieee80211_send_addba_resp(st
   4                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
   5         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
   6                 memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
   7 +       else if (sdata->vif.type == NL80211_IFTYPE_WDS)
   8 +               memcpy(mgmt->bssid, da, ETH_ALEN);
   9
  10         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  11                                           IEEE80211_STYPE_ACTION);
  12 --- a/net/mac80211/agg-tx.c
  13 +++ b/net/mac80211/agg-tx.c
  14 @@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
  15         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  16         if (sdata->vif.type == NL80211_IFTYPE_AP ||
  17             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  18 -           sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  19 +           sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
  20 +           sdata->vif.type == NL80211_IFTYPE_WDS)
  21                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  22         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  23                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  24 @@ -527,6 +528,7 @@ int ieee80211_start_tx_ba_session(struct
  25             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  26             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  27             sdata->vif.type != NL80211_IFTYPE_AP &&
  28 +           sdata->vif.type != NL80211_IFTYPE_WDS &&
  29             sdata->vif.type != NL80211_IFTYPE_ADHOC)
  30                 return -EINVAL;
  31
  32 --- a/net/mac80211/debugfs_sta.c
  33 +++ b/net/mac80211/debugfs_sta.c
  34 @@ -66,11 +66,11 @@ static ssize_t sta_flags_read(struct fil
  35         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  36
  37         int res = scnprintf(buf, sizeof(buf),
  38 -                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  39 +                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  40                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
  41                             TEST(PS_DRIVER), TEST(AUTHORIZED),
  42                             TEST(SHORT_PREAMBLE),
  43 -                           TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
  44 +                           TEST(WME), TEST(CLEAR_PS_FILT),
  45                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  46                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  47                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
  48 --- a/net/mac80211/iface.c
  49 +++ b/net/mac80211/iface.c
  50 @@ -463,7 +463,6 @@ int ieee80211_do_open(struct wireless_de
  51         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  52         struct net_device *dev = wdev->netdev;
  53         struct ieee80211_local *local = sdata->local;
  54 -       struct sta_info *sta;
  55         u32 changed = 0;
  56         int res;
  57         u32 hw_reconf_flags = 0;
  58 @@ -629,30 +628,8 @@ int ieee80211_do_open(struct wireless_de
  59
  60         set_bit(SDATA_STATE_RUNNING, &sdata->state);
  61
  62 -       if (sdata->vif.type == NL80211_IFTYPE_WDS) {
  63 -               /* Create STA entry for the WDS peer */
  64 -               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
  65 -                                    GFP_KERNEL);
  66 -               if (!sta) {
  67 -                       res = -ENOMEM;
  68 -                       goto err_del_interface;
  69 -               }
  70 -
  71 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
  72 -               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
  73 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
  74 -
  75 -               res = sta_info_insert(sta);
  76 -               if (res) {
  77 -                       /* STA has been freed */
  78 -                       goto err_del_interface;
  79 -               }
  80 -
  81 -               rate_control_rate_init(sta);
  82 -               netif_carrier_on(dev);
  83 -       } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
  84 +       if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
  85                 rcu_assign_pointer(local->p2p_sdata, sdata);
  86 -       }
  87
  88         /*
  89          * set_multicast_list will be invoked by the networking core
  90 @@ -1116,6 +1093,74 @@ static void ieee80211_if_setup(struct ne
  91         dev->destructor = free_netdev;
  92  }
  93
  94 +static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
  95 +                                        struct sk_buff *skb)
  96 +{
  97 +       struct ieee80211_local *local = sdata->local;
  98 +       struct ieee80211_rx_status *rx_status;
  99 +       struct ieee802_11_elems elems;
 100 +       struct ieee80211_mgmt *mgmt;
 101 +       struct sta_info *sta;
 102 +       size_t baselen;
 103 +       u32 rates = 0;
 104 +       u16 stype;
 105 +       bool new = false;
 106 +       enum ieee80211_band band;
 107 +       struct ieee80211_supported_band *sband;
 108 +
 109 +       rx_status = IEEE80211_SKB_RXCB(skb);
 110 +       band = rx_status->band;
 111 +       sband = local->hw.wiphy->bands[band];
 112 +       mgmt = (struct ieee80211_mgmt *) skb->data;
 113 +       stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 114 +
 115 +       if (stype != IEEE80211_STYPE_BEACON)
 116 +               return;
 117 +
 118 +       baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
 119 +       if (baselen > skb->len)
 120 +               return;
 121 +
 122 +       ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
 123 +                              skb->len - baselen, false, &elems);
 124 +
 125 +       rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 126 +
 127 +       rcu_read_lock();
 128 +
 129 +       sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
 130 +
 131 +       if (!sta) {
 132 +               rcu_read_unlock();
 133 +               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 134 +                                    GFP_KERNEL);
 135 +               if (!sta)
 136 +                       return;
 137 +
 138 +               new = true;
 139 +       }
 140 +
 141 +       sta->last_rx = jiffies;
 142 +       sta->sta.supp_rates[band] = rates;
 143 +
 144 +       if (elems.ht_cap_elem)
 145 +               ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
 146 +                               elems.ht_cap_elem, sta);
 147 +
 148 +       if (elems.wmm_param)
 149 +               set_sta_flag(sta, WLAN_STA_WME);
 150 +
 151 +       if (new) {
 152 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 153 +               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 154 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 155 +               rate_control_rate_init(sta);
 156 +               sta_info_insert_rcu(sta);
 157 +       }
 158 +
 159 +       rcu_read_unlock();
 160 +}
 161 +
 162  static void ieee80211_iface_work(struct work_struct *work)
 163  {
 164         struct ieee80211_sub_if_data *sdata =
 165 @@ -1220,6 +1265,9 @@ static void ieee80211_iface_work(struct
 166                                 break;
 167                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 168                         break;
 169 +               case NL80211_IFTYPE_WDS:
 170 +                       ieee80211_wds_rx_queued_mgmt(sdata, skb);
 171 +                       break;
 172                 default:
 173                         WARN(1, "frame for unexpected interface type");
 174                         break;
 175 --- a/net/mac80211/rc80211_minstrel_ht.c
 176 +++ b/net/mac80211/rc80211_minstrel_ht.c
 177 @@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct
 178
 179         sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
 180         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
 181 +       rate->count = 1;
 182 +
 183 +       if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
 184 +               int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
 185 +               rate->idx = mp->cck_rates[idx];
 186 +               rate->flags = 0;
 187 +               return;
 188 +       }
 189 +
 190         rate->idx = sample_idx % MCS_GROUP_RATES +
 191                     (sample_group->streams - 1) * MCS_GROUP_RATES;
 192         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
 193 -       rate->count = 1;
 194  }
 195
 196  static void
 197 @@ -820,6 +828,9 @@ minstrel_ht_update_cck(struct minstrel_p
 198         if (sband->band != IEEE80211_BAND_2GHZ)
 199                 return;
 200
 201 +       if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
 202 +               return;
 203 +
 204         mi->cck_supported = 0;
 205         mi->cck_supported_short = 0;
 206         for (i = 0; i < 4; i++) {
 207 --- a/net/mac80211/rx.c
 208 +++ b/net/mac80211/rx.c
 209 @@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx
 210         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 211         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 212
 213 -       /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
 214 -       if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
 215 +       /*
 216 +        * Drop duplicate 802.11 retransmissions
 217 +        * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
 218 +        */
 219 +       if (rx->skb->len >= 24 && rx->sta &&
 220 +           !ieee80211_is_ctl(hdr->frame_control) &&
 221 +           !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
 222 +           !is_multicast_ether_addr(hdr->addr1)) {
 223                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
 224                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
 225                              hdr->seq_ctrl)) {
 226 @@ -2369,6 +2375,7 @@ ieee80211_rx_h_action(struct ieee80211_r
 227                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
 228                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 229                     sdata->vif.type != NL80211_IFTYPE_AP &&
 230 +                   sdata->vif.type != NL80211_IFTYPE_WDS &&
 231                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
 232                         break;
 233
 234 @@ -2720,14 +2727,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
 235
 236         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
 237             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 238 -           sdata->vif.type != NL80211_IFTYPE_STATION)
 239 +           sdata->vif.type != NL80211_IFTYPE_STATION &&
 240 +           sdata->vif.type != NL80211_IFTYPE_WDS)
 241                 return RX_DROP_MONITOR;
 242
 243         switch (stype) {
 244         case cpu_to_le16(IEEE80211_STYPE_AUTH):
 245         case cpu_to_le16(IEEE80211_STYPE_BEACON):
 246         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 247 -               /* process for all: mesh, mlme, ibss */
 248 +               /* process for all: mesh, mlme, ibss, wds */
 249                 break;
 250         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 251         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
 252 @@ -3059,10 +3067,16 @@ static int prepare_for_handlers(struct i
 253                 }
 254                 break;
 255         case NL80211_IFTYPE_WDS:
 256 -               if (bssid || !ieee80211_is_data(hdr->frame_control))
 257 -                       return 0;
 258                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
 259                         return 0;
 260 +
 261 +               if (ieee80211_is_data(hdr->frame_control) ||
 262 +                   ieee80211_is_action(hdr->frame_control)) {
 263 +                       if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
 264 +                               return 0;
 265 +               } else if (!ieee80211_is_beacon(hdr->frame_control))
 266 +                       return 0;
 267 +
 268                 break;
 269         case NL80211_IFTYPE_P2P_DEVICE:
 270                 if (!ieee80211_is_public_action(hdr, skb->len) &&
 271 --- a/net/mac80211/sta_info.h
 272 +++ b/net/mac80211/sta_info.h
 273 @@ -32,7 +32,6 @@
 274   * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
 275   *     frames.
 276   * @WLAN_STA_WME: Station is a QoS-STA.
 277 - * @WLAN_STA_WDS: Station is one of our WDS peers.
 278   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
 279   *     IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
 280   *     frame to this station is transmitted.
 281 @@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
 282         WLAN_STA_AUTHORIZED,
 283         WLAN_STA_SHORT_PREAMBLE,
 284         WLAN_STA_WME,
 285 -       WLAN_STA_WDS,
 286         WLAN_STA_CLEAR_PS_FILT,
 287         WLAN_STA_MFP,
 288         WLAN_STA_BLOCK_BA,
 289 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 290 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
 291 @@ -135,6 +135,9 @@ static struct ath_frame_info *get_frame_
 292
 293  static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno)
 294  {
 295 +       if (!tid->an->sta)
 296 +               return;
 297 +
 298         ieee80211_send_bar(tid->an->vif, tid->an->sta->addr, tid->tidno,
 299                            seqno << IEEE80211_SEQ_SEQ_SHIFT);
 300  }
 301 @@ -146,6 +149,93 @@ static void ath_set_rates(struct ieee802
 302                                ARRAY_SIZE(bf->rates));
 303  }
 304
 305 +static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 306 +                            struct sk_buff *skb)
 307 +{
 308 +       int q;
 309 +
 310 +       q = skb_get_queue_mapping(skb);
 311 +       if (txq == sc->tx.uapsdq)
 312 +               txq = sc->tx.txq_map[q];
 313 +
 314 +       if (txq != sc->tx.txq_map[q])
 315 +               return;
 316 +
 317 +       if (WARN_ON(--txq->pending_frames < 0))
 318 +               txq->pending_frames = 0;
 319 +
 320 +       if (txq->stopped &&
 321 +           txq->pending_frames < sc->tx.txq_max_pending[q]) {
 322 +               ieee80211_wake_queue(sc->hw, q);
 323 +               txq->stopped = false;
 324 +       }
 325 +}
 326 +
 327 +static struct ath_atx_tid *
 328 +ath_get_skb_tid(struct ath_softc *sc, struct ath_node *an, struct sk_buff *skb)
 329 +{
 330 +       struct ieee80211_hdr *hdr;
 331 +       u8 tidno = 0;
 332 +
 333 +       hdr = (struct ieee80211_hdr *) skb->data;
 334 +       if (ieee80211_is_data_qos(hdr->frame_control))
 335 +               tidno = ieee80211_get_qos_ctl(hdr)[0];
 336 +
 337 +       tidno &= IEEE80211_QOS_CTL_TID_MASK;
 338 +       return ATH_AN_2_TID(an, tidno);
 339 +}
 340 +
 341 +static bool ath_tid_has_buffered(struct ath_atx_tid *tid)
 342 +{
 343 +       return !skb_queue_empty(&tid->buf_q) || !skb_queue_empty(&tid->retry_q);
 344 +}
 345 +
 346 +static struct sk_buff *ath_tid_dequeue(struct ath_atx_tid *tid)
 347 +{
 348 +       struct sk_buff *skb;
 349 +
 350 +       skb = __skb_dequeue(&tid->retry_q);
 351 +       if (!skb)
 352 +               skb = __skb_dequeue(&tid->buf_q);
 353 +
 354 +       return skb;
 355 +}
 356 +
 357 +/*
 358 + * ath_tx_tid_change_state:
 359 + * - clears a-mpdu flag of previous session
 360 + * - force sequence number allocation to fix next BlockAck Window
 361 + */
 362 +static void
 363 +ath_tx_tid_change_state(struct ath_softc *sc, struct ath_atx_tid *tid)
 364 +{
 365 +       struct ath_txq *txq = tid->ac->txq;
 366 +       struct ieee80211_tx_info *tx_info;
 367 +       struct sk_buff *skb, *tskb;
 368 +       struct ath_buf *bf;
 369 +       struct ath_frame_info *fi;
 370 +
 371 +       skb_queue_walk_safe(&tid->buf_q, skb, tskb) {
 372 +               fi = get_frame_info(skb);
 373 +               bf = fi->bf;
 374 +
 375 +               tx_info = IEEE80211_SKB_CB(skb);
 376 +               tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
 377 +
 378 +               if (bf)
 379 +                       continue;
 380 +
 381 +               bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 382 +               if (!bf) {
 383 +                       __skb_unlink(skb, &tid->buf_q);
 384 +                       ath_txq_skb_done(sc, txq, skb);
 385 +                       ieee80211_free_txskb(sc->hw, skb);
 386 +                       continue;
 387 +               }
 388 +       }
 389 +
 390 +}
 391 +
 392  static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 393  {
 394         struct ath_txq *txq = tid->ac->txq;
 395 @@ -160,27 +250,22 @@ static void ath_tx_flush_tid(struct ath_
 396
 397         memset(&ts, 0, sizeof(ts));
 398
 399 -       while ((skb = __skb_dequeue(&tid->buf_q))) {
 400 +       while ((skb = __skb_dequeue(&tid->retry_q))) {
 401                 fi = get_frame_info(skb);
 402                 bf = fi->bf;
 403 -
 404                 if (!bf) {
 405 -                       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 406 -                       if (!bf) {
 407 -                               ieee80211_free_txskb(sc->hw, skb);
 408 -                               continue;
 409 -                       }
 410 +                       ath_txq_skb_done(sc, txq, skb);
 411 +                       ieee80211_free_txskb(sc->hw, skb);
 412 +                       continue;
 413                 }
 414
 415 -               if (fi->retries) {
 416 -                       list_add_tail(&bf->list, &bf_head);
 417 +               if (fi->baw_tracked) {
 418                         ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
 419 -                       ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 420                         sendbar = true;
 421 -               } else {
 422 -                       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 423 -                       ath_tx_send_normal(sc, txq, NULL, skb);
 424                 }
 425 +
 426 +               list_add_tail(&bf->list, &bf_head);
 427 +               ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 428         }
 429
 430         if (sendbar) {
 431 @@ -209,13 +294,16 @@ static void ath_tx_update_baw(struct ath
 432  }
 433
 434  static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
 435 -                            u16 seqno)
 436 +                            struct ath_buf *bf)
 437  {
 438 +       struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
 439 +       u16 seqno = bf->bf_state.seqno;
 440         int index, cindex;
 441
 442         index  = ATH_BA_INDEX(tid->seq_start, seqno);
 443         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
 444         __set_bit(cindex, tid->tx_buf);
 445 +       fi->baw_tracked = 1;
 446
 447         if (index >= ((tid->baw_tail - tid->baw_head) &
 448                 (ATH_TID_MAX_BUFS - 1))) {
 449 @@ -224,12 +312,6 @@ static void ath_tx_addto_baw(struct ath_
 450         }
 451  }
 452
 453 -/*
 454 - * TODO: For frame(s) that are in the retry state, we will reuse the
 455 - * sequence number(s) without setting the retry bit. The
 456 - * alternative is to give up on these and BAR the receiver's window
 457 - * forward.
 458 - */
 459  static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
 460                           struct ath_atx_tid *tid)
 461
 462 @@ -243,7 +325,7 @@ static void ath_tid_drain(struct ath_sof
 463         memset(&ts, 0, sizeof(ts));
 464         INIT_LIST_HEAD(&bf_head);
 465
 466 -       while ((skb = __skb_dequeue(&tid->buf_q))) {
 467 +       while ((skb = ath_tid_dequeue(tid))) {
 468                 fi = get_frame_info(skb);
 469                 bf = fi->bf;
 470
 471 @@ -253,14 +335,8 @@ static void ath_tid_drain(struct ath_sof
 472                 }
 473
 474                 list_add_tail(&bf->list, &bf_head);
 475 -
 476 -               ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
 477                 ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 478         }
 479 -
 480 -       tid->seq_next = tid->seq_start;
 481 -       tid->baw_tail = tid->baw_head;
 482 -       tid->bar_index = -1;
 483  }
 484
 485  static void ath_tx_set_retry(struct ath_softc *sc, struct ath_txq *txq,
 486 @@ -380,7 +456,6 @@ static void ath_tx_complete_aggr(struct
 487         struct ieee80211_tx_rate rates[4];
 488         struct ath_frame_info *fi;
 489         int nframes;
 490 -       u8 tidno;
 491         bool flush = !!(ts->ts_status & ATH9K_TX_FLUSH);
 492         int i, retries;
 493         int bar_index = -1;
 494 @@ -406,7 +481,7 @@ static void ath_tx_complete_aggr(struct
 495                 while (bf) {
 496                         bf_next = bf->bf_next;
 497
 498 -                       if (!bf->bf_stale || bf_next != NULL)
 499 +                       if (!bf->bf_state.stale || bf_next != NULL)
 500                                 list_move_tail(&bf->list, &bf_head);
 501
 502                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts, 0);
 503 @@ -417,8 +492,7 @@ static void ath_tx_complete_aggr(struct
 504         }
 505
 506         an = (struct ath_node *)sta->drv_priv;
 507 -       tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
 508 -       tid = ATH_AN_2_TID(an, tidno);
 509 +       tid = ath_get_skb_tid(sc, an, skb);
 510         seq_first = tid->seq_start;
 511         isba = ts->ts_flags & ATH9K_TX_BA;
 512
 513 @@ -430,7 +504,7 @@ static void ath_tx_complete_aggr(struct
 514          * Only BlockAcks have a TID and therefore normal Acks cannot be
 515          * checked
 516          */
 517 -       if (isba && tidno != ts->tid)
 518 +       if (isba && tid->tidno != ts->tid)
 519                 txok = false;
 520
 521         isaggr = bf_isaggr(bf);
 522 @@ -466,7 +540,8 @@ static void ath_tx_complete_aggr(struct
 523                 tx_info = IEEE80211_SKB_CB(skb);
 524                 fi = get_frame_info(skb);
 525
 526 -               if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
 527 +               if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno) ||
 528 +                   !tid->active) {
 529                         /*
 530                          * Outside of the current BlockAck window,
 531                          * maybe part of a previous session
 532 @@ -499,7 +574,7 @@ static void ath_tx_complete_aggr(struct
 533                  * not a holding desc.
 534                  */
 535                 INIT_LIST_HEAD(&bf_head);
 536 -               if (bf_next != NULL || !bf_last->bf_stale)
 537 +               if (bf_next != NULL || !bf_last->bf_state.stale)
 538                         list_move_tail(&bf->list, &bf_head);
 539
 540                 if (!txpending) {
 541 @@ -523,7 +598,7 @@ static void ath_tx_complete_aggr(struct
 542                                 ieee80211_sta_eosp(sta);
 543                         }
 544                         /* retry the un-acked ones */
 545 -                       if (bf->bf_next == NULL && bf_last->bf_stale) {
 546 +                       if (bf->bf_next == NULL && bf_last->bf_state.stale) {
 547                                 struct ath_buf *tbf;
 548
 549                                 tbf = ath_clone_txbuf(sc, bf_last);
 550 @@ -560,7 +635,7 @@ static void ath_tx_complete_aggr(struct
 551                 if (an->sleeping)
 552                         ieee80211_sta_set_buffered(sta, tid->tidno, true);
 553
 554 -               skb_queue_splice(&bf_pending, &tid->buf_q);
 555 +               skb_queue_splice_tail(&bf_pending, &tid->retry_q);
 556                 if (!an->sleeping) {
 557                         ath_tx_queue_tid(txq, tid);
 558
 559 @@ -618,7 +693,7 @@ static void ath_tx_process_buffer(struct
 560         } else
 561                 ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok);
 562
 563 -       if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) && !flush)
 564 +       if (!flush)
 565                 ath_txq_schedule(sc, txq);
 566  }
 567
 568 @@ -792,15 +867,20 @@ static int ath_compute_num_delims(struct
 569
 570  static struct ath_buf *
 571  ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 572 -                       struct ath_atx_tid *tid)
 573 +                       struct ath_atx_tid *tid, struct sk_buff_head **q)
 574  {
 575 +       struct ieee80211_tx_info *tx_info;
 576         struct ath_frame_info *fi;
 577         struct sk_buff *skb;
 578         struct ath_buf *bf;
 579         u16 seqno;
 580
 581         while (1) {
 582 -               skb = skb_peek(&tid->buf_q);
 583 +               *q = &tid->retry_q;
 584 +               if (skb_queue_empty(*q))
 585 +                       *q = &tid->buf_q;
 586 +
 587 +               skb = skb_peek(*q);
 588                 if (!skb)
 589                         break;
 590
 591 @@ -808,13 +888,26 @@ ath_tx_get_tid_subframe(struct ath_softc
 592                 bf = fi->bf;
 593                 if (!fi->bf)
 594                         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
 595 +               else
 596 +                       bf->bf_state.stale = false;
 597
 598                 if (!bf) {
 599 -                       __skb_unlink(skb, &tid->buf_q);
 600 +                       __skb_unlink(skb, *q);
 601 +                       ath_txq_skb_done(sc, txq, skb);
 602                         ieee80211_free_txskb(sc->hw, skb);
 603                         continue;
 604                 }
 605
 606 +               bf->bf_next = NULL;
 607 +               bf->bf_lastbf = bf;
 608 +
 609 +               tx_info = IEEE80211_SKB_CB(skb);
 610 +               tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
 611 +               if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
 612 +                       bf->bf_state.bf_type = 0;
 613 +                       return bf;
 614 +               }
 615 +
 616                 bf->bf_state.bf_type = BUF_AMPDU | BUF_AGGR;
 617                 seqno = bf->bf_state.seqno;
 618
 619 @@ -828,73 +921,52 @@ ath_tx_get_tid_subframe(struct ath_softc
 620
 621                         INIT_LIST_HEAD(&bf_head);
 622                         list_add(&bf->list, &bf_head);
 623 -                       __skb_unlink(skb, &tid->buf_q);
 624 +                       __skb_unlink(skb, *q);
 625                         ath_tx_update_baw(sc, tid, seqno);
 626                         ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
 627                         continue;
 628                 }
 629
 630 -               bf->bf_next = NULL;
 631 -               bf->bf_lastbf = bf;
 632                 return bf;
 633         }
 634
 635         return NULL;
 636  }
 637
 638 -static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
 639 -                                            struct ath_txq *txq,
 640 -                                            struct ath_atx_tid *tid,
 641 -                                            struct list_head *bf_q,
 642 -                                            int *aggr_len)
 643 +static bool
 644 +ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
 645 +                struct ath_atx_tid *tid, struct list_head *bf_q,
 646 +                struct ath_buf *bf_first, struct sk_buff_head *tid_q,
 647 +                int *aggr_len)
 648  {
 649  #define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
 650 -       struct ath_buf *bf, *bf_first = NULL, *bf_prev = NULL;
 651 -       int rl = 0, nframes = 0, ndelim, prev_al = 0;
 652 +       struct ath_buf *bf = bf_first, *bf_prev = NULL;
 653 +       int nframes = 0, ndelim;
 654         u16 aggr_limit = 0, al = 0, bpad = 0,
 655 -               al_delta, h_baw = tid->baw_size / 2;
 656 -       enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
 657 +           al_delta, h_baw = tid->baw_size / 2;
 658         struct ieee80211_tx_info *tx_info;
 659         struct ath_frame_info *fi;
 660         struct sk_buff *skb;
 661 +       bool closed = false;
 662
 663 -       do {
 664 -               bf = ath_tx_get_tid_subframe(sc, txq, tid);
 665 -               if (!bf) {
 666 -                       status = ATH_AGGR_BAW_CLOSED;
 667 -                       break;
 668 -               }
 669 +       bf = bf_first;
 670 +       aggr_limit = ath_lookup_rate(sc, bf, tid);
 671
 672 +       do {
 673                 skb = bf->bf_mpdu;
 674                 fi = get_frame_info(skb);
 675
 676 -               if (!bf_first)
 677 -                       bf_first = bf;
 678 -
 679 -               if (!rl) {
 680 -                       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 681 -                       aggr_limit = ath_lookup_rate(sc, bf, tid);
 682 -                       rl = 1;
 683 -               }
 684 -
 685                 /* do not exceed aggregation limit */
 686                 al_delta = ATH_AGGR_DELIM_SZ + fi->framelen;
 687 +               if (nframes) {
 688 +                       if (aggr_limit < al + bpad + al_delta ||
 689 +                           ath_lookup_legacy(bf) || nframes >= h_baw)
 690 +                               break;
 691
 692 -               if (nframes &&
 693 -                   ((aggr_limit < (al + bpad + al_delta + prev_al)) ||
 694 -                    ath_lookup_legacy(bf))) {
 695 -                       status = ATH_AGGR_LIMITED;
 696 -                       break;
 697 -               }
 698 -
 699 -               tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 700 -               if (nframes && (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
 701 -                       break;
 702 -
 703 -               /* do not exceed subframe limit */
 704 -               if (nframes >= min((int)h_baw, ATH_AMPDU_SUBFRAME_DEFAULT)) {
 705 -                       status = ATH_AGGR_LIMITED;
 706 -                       break;
 707 +                       tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 708 +                       if ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
 709 +                           !(tx_info->flags & IEEE80211_TX_CTL_AMPDU))
 710 +                               break;
 711                 }
 712
 713                 /* add padding for previous frame to aggregation length */
 714 @@ -912,22 +984,37 @@ static enum ATH_AGGR_STATUS ath_tx_form_
 715                 bf->bf_next = NULL;
 716
 717                 /* link buffers of this frame to the aggregate */
 718 -               if (!fi->retries)
 719 -                       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
 720 +               if (!fi->baw_tracked)
 721 +                       ath_tx_addto_baw(sc, tid, bf);
 722                 bf->bf_state.ndelim = ndelim;
 723
 724 -               __skb_unlink(skb, &tid->buf_q);
 725 +               __skb_unlink(skb, tid_q);
 726                 list_add_tail(&bf->list, bf_q);
 727                 if (bf_prev)
 728                         bf_prev->bf_next = bf;
 729
 730                 bf_prev = bf;
 731
 732 -       } while (!skb_queue_empty(&tid->buf_q));
 733 +               bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 734 +               if (!bf) {
 735 +                       closed = true;
 736 +                       break;
 737 +               }
 738 +       } while (ath_tid_has_buffered(tid));
 739 +
 740 +       bf = bf_first;
 741 +       bf->bf_lastbf = bf_prev;
 742 +
 743 +       if (bf == bf_prev) {
 744 +               al = get_frame_info(bf->bf_mpdu)->framelen;
 745 +               bf->bf_state.bf_type = BUF_AMPDU;
 746 +       } else {
 747 +               TX_STAT_INC(txq->axq_qnum, a_aggr);
 748 +       }
 749
 750         *aggr_len = al;
 751
 752 -       return status;
 753 +       return closed;
 754  #undef PADBYTES
 755  }
 756
 757 @@ -1188,53 +1275,86 @@ static void ath_tx_fill_desc(struct ath_
 758         }
 759  }
 760
 761 -static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 762 -                             struct ath_atx_tid *tid)
 763 +static void
 764 +ath_tx_form_burst(struct ath_softc *sc, struct ath_txq *txq,
 765 +                 struct ath_atx_tid *tid, struct list_head *bf_q,
 766 +                 struct ath_buf *bf_first, struct sk_buff_head *tid_q)
 767  {
 768 -       struct ath_buf *bf;
 769 -       enum ATH_AGGR_STATUS status;
 770 -       struct ieee80211_tx_info *tx_info;
 771 -       struct list_head bf_q;
 772 -       int aggr_len;
 773 +       struct ath_buf *bf = bf_first, *bf_prev = NULL;
 774 +       struct sk_buff *skb;
 775 +       int nframes = 0;
 776
 777         do {
 778 -               if (skb_queue_empty(&tid->buf_q))
 779 -                       return;
 780 +               struct ieee80211_tx_info *tx_info;
 781 +               skb = bf->bf_mpdu;
 782
 783 -               INIT_LIST_HEAD(&bf_q);
 784 +               nframes++;
 785 +               __skb_unlink(skb, tid_q);
 786 +               list_add_tail(&bf->list, bf_q);
 787 +               if (bf_prev)
 788 +                       bf_prev->bf_next = bf;
 789 +               bf_prev = bf;
 790
 791 -               status = ath_tx_form_aggr(sc, txq, tid, &bf_q, &aggr_len);
 792 +               if (nframes >= 2)
 793 +                       break;
 794
 795 -               /*
 796 -                * no frames picked up to be aggregated;
 797 -                * block-ack window is not open.
 798 -                */
 799 -               if (list_empty(&bf_q))
 800 +               bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 801 +               if (!bf)
 802                         break;
 803
 804 -               bf = list_first_entry(&bf_q, struct ath_buf, list);
 805 -               bf->bf_lastbf = list_entry(bf_q.prev, struct ath_buf, list);
 806                 tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 807 +               if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
 808 +                       break;
 809
 810 -               if (tid->ac->clear_ps_filter) {
 811 -                       tid->ac->clear_ps_filter = false;
 812 -                       tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 813 -               } else {
 814 -                       tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
 815 -               }
 816 +               ath_set_rates(tid->an->vif, tid->an->sta, bf);
 817 +       } while (1);
 818 +}
 819
 820 -               /* if only one frame, send as non-aggregate */
 821 -               if (bf == bf->bf_lastbf) {
 822 -                       aggr_len = get_frame_info(bf->bf_mpdu)->framelen;
 823 -                       bf->bf_state.bf_type = BUF_AMPDU;
 824 -               } else {
 825 -                       TX_STAT_INC(txq->axq_qnum, a_aggr);
 826 -               }
 827 +static bool ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 828 +                             struct ath_atx_tid *tid, bool *stop)
 829 +{
 830 +       struct ath_buf *bf;
 831 +       struct ieee80211_tx_info *tx_info;
 832 +       struct sk_buff_head *tid_q;
 833 +       struct list_head bf_q;
 834 +       int aggr_len = 0;
 835 +       bool aggr, last = true;
 836 +
 837 +       if (!ath_tid_has_buffered(tid))
 838 +               return false;
 839 +
 840 +       INIT_LIST_HEAD(&bf_q);
 841 +
 842 +       bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
 843 +       if (!bf)
 844 +               return false;
 845 +
 846 +       tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
 847 +       aggr = !!(tx_info->flags & IEEE80211_TX_CTL_AMPDU);
 848 +       if ((aggr && txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) ||
 849 +               (!aggr && txq->axq_depth >= ATH_NON_AGGR_MIN_QDEPTH)) {
 850 +               *stop = true;
 851 +               return false;
 852 +       }
 853 +
 854 +       ath_set_rates(tid->an->vif, tid->an->sta, bf);
 855 +       if (aggr)
 856 +               last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
 857 +                                       tid_q, &aggr_len);
 858 +       else
 859 +               ath_tx_form_burst(sc, txq, tid, &bf_q, bf, tid_q);
 860
 861 -               ath_tx_fill_desc(sc, bf, txq, aggr_len);
 862 -               ath_tx_txqaddbuf(sc, txq, &bf_q, false);
 863 -       } while (txq->axq_ampdu_depth < ATH_AGGR_MIN_QDEPTH &&
 864 -                status != ATH_AGGR_BAW_CLOSED);
 865 +       if (list_empty(&bf_q))
 866 +               return false;
 867 +
 868 +       if (tid->ac->clear_ps_filter || tid->an->no_ps_filter) {
 869 +               tid->ac->clear_ps_filter = false;
 870 +               tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 871 +       }
 872 +
 873 +       ath_tx_fill_desc(sc, bf, txq, aggr_len);
 874 +       ath_tx_txqaddbuf(sc, txq, &bf_q, false);
 875 +       return true;
 876  }
 877
 878  int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
 879 @@ -1258,6 +1378,9 @@ int ath_tx_aggr_start(struct ath_softc *
 880                 an->mpdudensity = density;
 881         }
 882
 883 +       /* force sequence number allocation for pending frames */
 884 +       ath_tx_tid_change_state(sc, txtid);
 885 +
 886         txtid->active = true;
 887         txtid->paused = true;
 888         *ssn = txtid->seq_start = txtid->seq_next;
 889 @@ -1277,8 +1400,9 @@ void ath_tx_aggr_stop(struct ath_softc *
 890
 891         ath_txq_lock(sc, txq);
 892         txtid->active = false;
 893 -       txtid->paused = true;
 894 +       txtid->paused = false;
 895         ath_tx_flush_tid(sc, txtid);
 896 +       ath_tx_tid_change_state(sc, txtid);
 897         ath_txq_unlock_complete(sc, txq);
 898  }
 899
 900 @@ -1302,7 +1426,7 @@ void ath_tx_aggr_sleep(struct ieee80211_
 901
 902                 ath_txq_lock(sc, txq);
 903
 904 -               buffered = !skb_queue_empty(&tid->buf_q);
 905 +               buffered = ath_tid_has_buffered(tid);
 906
 907                 tid->sched = false;
 908                 list_del(&tid->list);
 909 @@ -1334,7 +1458,7 @@ void ath_tx_aggr_wakeup(struct ath_softc
 910                 ath_txq_lock(sc, txq);
 911                 ac->clear_ps_filter = true;
 912
 913 -               if (!skb_queue_empty(&tid->buf_q) && !tid->paused) {
 914 +               if (!tid->paused && ath_tid_has_buffered(tid)) {
 915                         ath_tx_queue_tid(txq, tid);
 916                         ath_txq_schedule(sc, txq);
 917                 }
 918 @@ -1359,7 +1483,7 @@ void ath_tx_aggr_resume(struct ath_softc
 919         tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
 920         tid->paused = false;
 921
 922 -       if (!skb_queue_empty(&tid->buf_q)) {
 923 +       if (ath_tid_has_buffered(tid)) {
 924                 ath_tx_queue_tid(txq, tid);
 925                 ath_txq_schedule(sc, txq);
 926         }
 927 @@ -1379,6 +1503,7 @@ void ath9k_release_buffered_frames(struc
 928         struct ieee80211_tx_info *info;
 929         struct list_head bf_q;
 930         struct ath_buf *bf_tail = NULL, *bf;
 931 +       struct sk_buff_head *tid_q;
 932         int sent = 0;
 933         int i;
 934
 935 @@ -1394,15 +1519,15 @@ void ath9k_release_buffered_frames(struc
 936                         continue;
 937
 938                 ath_txq_lock(sc, tid->ac->txq);
 939 -               while (!skb_queue_empty(&tid->buf_q) && nframes > 0) {
 940 -                       bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid);
 941 +               while (nframes > 0) {
 942 +                       bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid, &tid_q);
 943                         if (!bf)
 944                                 break;
 945
 946 -                       __skb_unlink(bf->bf_mpdu, &tid->buf_q);
 947 +                       __skb_unlink(bf->bf_mpdu, tid_q);
 948                         list_add_tail(&bf->list, &bf_q);
 949                         ath_set_rates(tid->an->vif, tid->an->sta, bf);
 950 -                       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
 951 +                       ath_tx_addto_baw(sc, tid, bf);
 952                         bf->bf_state.bf_type &= ~BUF_AGGR;
 953                         if (bf_tail)
 954                                 bf_tail->bf_next = bf;
 955 @@ -1412,7 +1537,7 @@ void ath9k_release_buffered_frames(struc
 956                         sent++;
 957                         TX_STAT_INC(txq->axq_qnum, a_queued_hw);
 958
 959 -                       if (skb_queue_empty(&tid->buf_q))
 960 +                       if (an->sta && !ath_tid_has_buffered(tid))
 961                                 ieee80211_sta_set_buffered(an->sta, i, false);
 962                 }
 963                 ath_txq_unlock_complete(sc, tid->ac->txq);
 964 @@ -1571,7 +1696,7 @@ static void ath_drain_txq_list(struct at
 965         while (!list_empty(list)) {
 966                 bf = list_first_entry(list, struct ath_buf, list);
 967
 968 -               if (bf->bf_stale) {
 969 +               if (bf->bf_state.stale) {
 970                         list_del(&bf->list);
 971
 972                         ath_tx_return_buffer(sc, bf);
 973 @@ -1665,25 +1790,27 @@ void ath_tx_cleanupq(struct ath_softc *s
 974   */
 975  void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
 976  {
 977 -       struct ath_atx_ac *ac, *ac_tmp, *last_ac;
 978 +       struct ath_atx_ac *ac, *last_ac;
 979         struct ath_atx_tid *tid, *last_tid;
 980 +       bool sent = false;
 981
 982         if (test_bit(SC_OP_HW_RESET, &sc->sc_flags) ||
 983 -           list_empty(&txq->axq_acq) ||
 984 -           txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
 985 +           list_empty(&txq->axq_acq))
 986                 return;
 987
 988         rcu_read_lock();
 989
 990 -       ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
 991         last_ac = list_entry(txq->axq_acq.prev, struct ath_atx_ac, list);
 992 +       while (!list_empty(&txq->axq_acq)) {
 993 +               bool stop = false;
 994
 995 -       list_for_each_entry_safe(ac, ac_tmp, &txq->axq_acq, list) {
 996 +               ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
 997                 last_tid = list_entry(ac->tid_q.prev, struct ath_atx_tid, list);
 998                 list_del(&ac->list);
 999                 ac->sched = false;
1000
1001                 while (!list_empty(&ac->tid_q)) {
1002 +
1003                         tid = list_first_entry(&ac->tid_q, struct ath_atx_tid,
1004                                                list);
1005                         list_del(&tid->list);
1006 @@ -1692,17 +1819,17 @@ void ath_txq_schedule(struct ath_softc *
1007                         if (tid->paused)
1008                                 continue;
1009
1010 -                       ath_tx_sched_aggr(sc, txq, tid);
1011 +                       if (ath_tx_sched_aggr(sc, txq, tid, &stop))
1012 +                               sent = true;
1013
1014                         /*
1015                          * add tid to round-robin queue if more frames
1016                          * are pending for the tid
1017                          */
1018 -                       if (!skb_queue_empty(&tid->buf_q))
1019 +                       if (ath_tid_has_buffered(tid))
1020                                 ath_tx_queue_tid(txq, tid);
1021
1022 -                       if (tid == last_tid ||
1023 -                           txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
1024 +                       if (stop || tid == last_tid)
1025                                 break;
1026                 }
1027
1028 @@ -1711,9 +1838,17 @@ void ath_txq_schedule(struct ath_softc *
1029                         list_add_tail(&ac->list, &txq->axq_acq);
1030                 }
1031
1032 -               if (ac == last_ac ||
1033 -                   txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
1034 +               if (stop)
1035                         break;
1036 +
1037 +               if (ac == last_ac) {
1038 +                       if (!sent)
1039 +                               break;
1040 +
1041 +                       sent = false;
1042 +                       last_ac = list_entry(txq->axq_acq.prev,
1043 +                                            struct ath_atx_ac, list);
1044 +               }
1045         }
1046
1047         rcu_read_unlock();
1048 @@ -1792,57 +1927,6 @@ static void ath_tx_txqaddbuf(struct ath_
1049         }
1050  }
1051
1052 -static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
1053 -                             struct ath_atx_tid *tid, struct sk_buff *skb,
1054 -                             struct ath_tx_control *txctl)
1055 -{
1056 -       struct ath_frame_info *fi = get_frame_info(skb);
1057 -       struct list_head bf_head;
1058 -       struct ath_buf *bf;
1059 -
1060 -       /*
1061 -        * Do not queue to h/w when any of the following conditions is true:
1062 -        * - there are pending frames in software queue
1063 -        * - the TID is currently paused for ADDBA/BAR request
1064 -        * - seqno is not within block-ack window
1065 -        * - h/w queue depth exceeds low water mark
1066 -        */
1067 -       if ((!skb_queue_empty(&tid->buf_q) || tid->paused ||
1068 -            !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
1069 -            txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) &&
1070 -           txq != sc->tx.uapsdq) {
1071 -               /*
1072 -                * Add this frame to software queue for scheduling later
1073 -                * for aggregation.
1074 -                */
1075 -               TX_STAT_INC(txq->axq_qnum, a_queued_sw);
1076 -               __skb_queue_tail(&tid->buf_q, skb);
1077 -               if (!txctl->an || !txctl->an->sleeping)
1078 -                       ath_tx_queue_tid(txq, tid);
1079 -               return;
1080 -       }
1081 -
1082 -       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
1083 -       if (!bf) {
1084 -               ieee80211_free_txskb(sc->hw, skb);
1085 -               return;
1086 -       }
1087 -
1088 -       ath_set_rates(tid->an->vif, tid->an->sta, bf);
1089 -       bf->bf_state.bf_type = BUF_AMPDU;
1090 -       INIT_LIST_HEAD(&bf_head);
1091 -       list_add(&bf->list, &bf_head);
1092 -
1093 -       /* Add sub-frame to BAW */
1094 -       ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
1095 -
1096 -       /* Queue to h/w without aggregation */
1097 -       TX_STAT_INC(txq->axq_qnum, a_queued_hw);
1098 -       bf->bf_lastbf = bf;
1099 -       ath_tx_fill_desc(sc, bf, txq, fi->framelen);
1100 -       ath_tx_txqaddbuf(sc, txq, &bf_head, false);
1101 -}
1102 -
1103  static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
1104                                struct ath_atx_tid *tid, struct sk_buff *skb)
1105  {
1106 @@ -1985,6 +2069,7 @@ static int ath_tx_prepare(struct ieee802
1107         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1108         struct ieee80211_sta *sta = txctl->sta;
1109         struct ieee80211_vif *vif = info->control.vif;
1110 +       struct ath_vif *avp;
1111         struct ath_softc *sc = hw->priv;
1112         int frmlen = skb->len + FCS_LEN;
1113         int padpos, padsize;
1114 @@ -1992,6 +2077,10 @@ static int ath_tx_prepare(struct ieee802
1115         /* NOTE:  sta can be NULL according to net/mac80211.h */
1116         if (sta)
1117                 txctl->an = (struct ath_node *)sta->drv_priv;
1118 +       else if (vif && ieee80211_is_data(hdr->frame_control)) {
1119 +               avp = (void *)vif->drv_priv;
1120 +               txctl->an = &avp->mcast_node;
1121 +       }
1122
1123         if (info->control.hw_key)
1124                 frmlen += info->control.hw_key->icv_len;
1125 @@ -2041,7 +2130,6 @@ int ath_tx_start(struct ieee80211_hw *hw
1126         struct ath_txq *txq = txctl->txq;
1127         struct ath_atx_tid *tid = NULL;
1128         struct ath_buf *bf;
1129 -       u8 tidno;
1130         int q;
1131         int ret;
1132
1133 @@ -2069,27 +2157,31 @@ int ath_tx_start(struct ieee80211_hw *hw
1134                 ath_txq_unlock(sc, txq);
1135                 txq = sc->tx.uapsdq;
1136                 ath_txq_lock(sc, txq);
1137 -       }
1138 -
1139 -       if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
1140 -               tidno = ieee80211_get_qos_ctl(hdr)[0] &
1141 -                       IEEE80211_QOS_CTL_TID_MASK;
1142 -               tid = ATH_AN_2_TID(txctl->an, tidno);
1143 +       } else if (txctl->an &&
1144 +                  ieee80211_is_data_present(hdr->frame_control)) {
1145 +               tid = ath_get_skb_tid(sc, txctl->an, skb);
1146
1147                 WARN_ON(tid->ac->txq != txctl->txq);
1148 -       }
1149
1150 -       if ((info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
1151 +               if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
1152 +                       tid->ac->clear_ps_filter = true;
1153 +
1154                 /*
1155 -                * Try aggregation if it's a unicast data frame
1156 -                * and the destination is HT capable.
1157 +                * Add this frame to software queue for scheduling later
1158 +                * for aggregation.
1159                  */
1160 -               ath_tx_send_ampdu(sc, txq, tid, skb, txctl);
1161 +               TX_STAT_INC(txq->axq_qnum, a_queued_sw);
1162 +               __skb_queue_tail(&tid->buf_q, skb);
1163 +               if (!txctl->an->sleeping)
1164 +                       ath_tx_queue_tid(txq, tid);
1165 +
1166 +               ath_txq_schedule(sc, txq);
1167                 goto out;
1168         }
1169
1170         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
1171         if (!bf) {
1172 +               ath_txq_skb_done(sc, txq, skb);
1173                 if (txctl->paprd)
1174                         dev_kfree_skb_any(skb);
1175                 else
1176 @@ -2189,7 +2281,7 @@ static void ath_tx_complete(struct ath_s
1177         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
1178         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
1179         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
1180 -       int q, padpos, padsize;
1181 +       int padpos, padsize;
1182         unsigned long flags;
1183
1184         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
1185 @@ -2225,21 +2317,7 @@ static void ath_tx_complete(struct ath_s
1186         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1187
1188         __skb_queue_tail(&txq->complete_q, skb);
1189 -
1190 -       q = skb_get_queue_mapping(skb);
1191 -       if (txq == sc->tx.uapsdq)
1192 -               txq = sc->tx.txq_map[q];
1193 -
1194 -       if (txq == sc->tx.txq_map[q]) {
1195 -               if (WARN_ON(--txq->pending_frames < 0))
1196 -                       txq->pending_frames = 0;
1197 -
1198 -               if (txq->stopped &&
1199 -                   txq->pending_frames < sc->tx.txq_max_pending[q]) {
1200 -                       ieee80211_wake_queue(sc->hw, q);
1201 -                       txq->stopped = false;
1202 -               }
1203 -       }
1204 +       ath_txq_skb_done(sc, txq, skb);
1205  }
1206
1207  static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
1208 @@ -2360,8 +2438,7 @@ static void ath_tx_processq(struct ath_s
1209
1210                 if (list_empty(&txq->axq_q)) {
1211                         txq->axq_link = NULL;
1212 -                       if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
1213 -                               ath_txq_schedule(sc, txq);
1214 +                       ath_txq_schedule(sc, txq);
1215                         break;
1216                 }
1217                 bf = list_first_entry(&txq->axq_q, struct ath_buf, list);
1218 @@ -2375,7 +2452,7 @@ static void ath_tx_processq(struct ath_s
1219                  * it with the STALE flag.
1220                  */
1221                 bf_held = NULL;
1222 -               if (bf->bf_stale) {
1223 +               if (bf->bf_state.stale) {
1224                         bf_held = bf;
1225                         if (list_is_last(&bf_held->list, &txq->axq_q))
1226                                 break;
1227 @@ -2399,7 +2476,7 @@ static void ath_tx_processq(struct ath_s
1228                  * however leave the last descriptor back as the holding
1229                  * descriptor for hw.
1230                  */
1231 -               lastbf->bf_stale = true;
1232 +               lastbf->bf_state.stale = true;
1233                 INIT_LIST_HEAD(&bf_head);
1234                 if (!list_is_singular(&lastbf->list))
1235                         list_cut_position(&bf_head,
1236 @@ -2470,7 +2547,7 @@ void ath_tx_edma_tasklet(struct ath_soft
1237                 }
1238
1239                 bf = list_first_entry(fifo_list, struct ath_buf, list);
1240 -               if (bf->bf_stale) {
1241 +               if (bf->bf_state.stale) {
1242                         list_del(&bf->list);
1243                         ath_tx_return_buffer(sc, bf);
1244                         bf = list_first_entry(fifo_list, struct ath_buf, list);
1245 @@ -2492,7 +2569,7 @@ void ath_tx_edma_tasklet(struct ath_soft
1246                                 ath_tx_txqaddbuf(sc, txq, &bf_q, true);
1247                         }
1248                 } else {
1249 -                       lastbf->bf_stale = true;
1250 +                       lastbf->bf_state.stale = true;
1251                         if (bf != lastbf)
1252                                 list_cut_position(&bf_head, fifo_list,
1253                                                   lastbf->list.prev);
1254 @@ -2583,6 +2660,7 @@ void ath_tx_node_init(struct ath_softc *
1255                 tid->paused    = false;
1256                 tid->active        = false;
1257                 __skb_queue_head_init(&tid->buf_q);
1258 +               __skb_queue_head_init(&tid->retry_q);
1259                 acno = TID_TO_WME_AC(tidno);
1260                 tid->ac = &an->ac[acno];
1261         }
1262 @@ -2590,6 +2668,7 @@ void ath_tx_node_init(struct ath_softc *
1263         for (acno = 0, ac = &an->ac[acno];
1264              acno < IEEE80211_NUM_ACS; acno++, ac++) {
1265                 ac->sched    = false;
1266 +               ac->clear_ps_filter = true;
1267                 ac->txq = sc->tx.txq_map[acno];
1268                 INIT_LIST_HEAD(&ac->tid_q);
1269         }
1270 --- a/drivers/net/wireless/ath/ath9k/main.c
1271 +++ b/drivers/net/wireless/ath/ath9k/main.c
1272 @@ -966,6 +966,8 @@ static int ath9k_add_interface(struct ie
1273         struct ath_softc *sc = hw->priv;
1274         struct ath_hw *ah = sc->sc_ah;
1275         struct ath_common *common = ath9k_hw_common(ah);
1276 +       struct ath_vif *avp = (void *)vif->drv_priv;
1277 +       struct ath_node *an = &avp->mcast_node;
1278
1279         mutex_lock(&sc->mutex);
1280
1281 @@ -979,6 +981,12 @@ static int ath9k_add_interface(struct ie
1282         if (ath9k_uses_beacons(vif->type))
1283                 ath9k_beacon_assign_slot(sc, vif);
1284
1285 +       an->sc = sc;
1286 +       an->sta = NULL;
1287 +       an->vif = vif;
1288 +       an->no_ps_filter = true;
1289 +       ath_tx_node_init(sc, an);
1290 +
1291         mutex_unlock(&sc->mutex);
1292         return 0;
1293  }
1294 @@ -1016,6 +1024,7 @@ static void ath9k_remove_interface(struc
1295  {
1296         struct ath_softc *sc = hw->priv;
1297         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
1298 +       struct ath_vif *avp = (void *)vif->drv_priv;
1299
1300         ath_dbg(common, CONFIG, "Detach Interface\n");
1301
1302 @@ -1030,6 +1039,8 @@ static void ath9k_remove_interface(struc
1303         ath9k_calculate_summary_state(hw, NULL);
1304         ath9k_ps_restore(sc);
1305
1306 +       ath_tx_node_cleanup(sc, &avp->mcast_node);
1307 +
1308         mutex_unlock(&sc->mutex);
1309  }
1310
1311 @@ -1374,9 +1385,6 @@ static void ath9k_sta_notify(struct ieee
1312         struct ath_softc *sc = hw->priv;
1313         struct ath_node *an = (struct ath_node *) sta->drv_priv;
1314
1315 -       if (!sta->ht_cap.ht_supported)
1316 -               return;
1317 -
1318         switch (cmd) {
1319         case STA_NOTIFY_SLEEP:
1320                 an->sleeping = true;
1321 @@ -2094,7 +2102,7 @@ static void ath9k_wow_add_pattern(struct
1322  {
1323         struct ath_hw *ah = sc->sc_ah;
1324         struct ath9k_wow_pattern *wow_pattern = NULL;
1325 -       struct cfg80211_wowlan_trig_pkt_pattern *patterns = wowlan->patterns;
1326 +       struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
1327         int mask_len;
1328         s8 i = 0;
1329
1330 --- a/drivers/net/wireless/mwifiex/cfg80211.c
1331 +++ b/drivers/net/wireless/mwifiex/cfg80211.c
1332 @@ -2298,8 +2298,7 @@ EXPORT_SYMBOL_GPL(mwifiex_del_virtual_in
1333
1334  #ifdef CONFIG_PM
1335  static bool
1336 -mwifiex_is_pattern_supported(struct cfg80211_wowlan_trig_pkt_pattern *pat,
1337 -                            s8 *byte_seq)
1338 +mwifiex_is_pattern_supported(struct cfg80211_pkt_pattern *pat, s8 *byte_seq)
1339  {
1340         int j, k, valid_byte_cnt = 0;
1341         bool dont_care_byte = false;
1342 --- a/drivers/net/wireless/ti/wlcore/main.c
1343 +++ b/drivers/net/wireless/ti/wlcore/main.c
1344 @@ -1315,7 +1315,7 @@ static struct sk_buff *wl12xx_alloc_dumm
1345
1346  #ifdef CONFIG_PM
1347  static int
1348 -wl1271_validate_wowlan_pattern(struct cfg80211_wowlan_trig_pkt_pattern *p)
1349 +wl1271_validate_wowlan_pattern(struct cfg80211_pkt_pattern *p)
1350  {
1351         int num_fields = 0, in_field = 0, fields_size = 0;
1352         int i, pattern_len = 0;
1353 @@ -1458,9 +1458,9 @@ void wl1271_rx_filter_flatten_fields(str
1354   * Allocates an RX filter returned through f
1355   * which needs to be freed using rx_filter_free()
1356   */
1357 -static int wl1271_convert_wowlan_pattern_to_rx_filter(
1358 -       struct cfg80211_wowlan_trig_pkt_pattern *p,
1359 -       struct wl12xx_rx_filter **f)
1360 +static int
1361 +wl1271_convert_wowlan_pattern_to_rx_filter(struct cfg80211_pkt_pattern *p,
1362 +                                          struct wl12xx_rx_filter **f)
1363  {
1364         int i, j, ret = 0;
1365         struct wl12xx_rx_filter *filter;
1366 @@ -1562,7 +1562,7 @@ static int wl1271_configure_wowlan(struc
1367
1368         /* Translate WoWLAN patterns into filters */
1369         for (i = 0; i < wow->n_patterns; i++) {
1370 -               struct cfg80211_wowlan_trig_pkt_pattern *p;
1371 +               struct cfg80211_pkt_pattern *p;
1372                 struct wl12xx_rx_filter *filter = NULL;
1373
1374                 p = &wow->patterns[i];
1375 --- a/include/net/cfg80211.h
1376 +++ b/include/net/cfg80211.h
1377 @@ -1698,7 +1698,7 @@ struct cfg80211_pmksa {
1378  };
1379
1380  /**
1381 - * struct cfg80211_wowlan_trig_pkt_pattern - packet pattern
1382 + * struct cfg80211_pkt_pattern - packet pattern
1383   * @mask: bitmask where to match pattern and where to ignore bytes,
1384   *     one bit per byte, in same format as nl80211
1385   * @pattern: bytes to match where bitmask is 1
1386 @@ -1708,7 +1708,7 @@ struct cfg80211_pmksa {
1387   * Internal note: @mask and @pattern are allocated in one chunk of
1388   * memory, free @mask only!
1389   */
1390 -struct cfg80211_wowlan_trig_pkt_pattern {
1391 +struct cfg80211_pkt_pattern {
1392         u8 *mask, *pattern;
1393         int pattern_len;
1394         int pkt_offset;
1395 @@ -1770,7 +1770,7 @@ struct cfg80211_wowlan {
1396         bool any, disconnect, magic_pkt, gtk_rekey_failure,
1397              eap_identity_req, four_way_handshake,
1398              rfkill_release;
1399 -       struct cfg80211_wowlan_trig_pkt_pattern *patterns;
1400 +       struct cfg80211_pkt_pattern *patterns;
1401         struct cfg80211_wowlan_tcp *tcp;
1402         int n_patterns;
1403  };
1404 --- a/include/uapi/linux/nl80211.h
1405 +++ b/include/uapi/linux/nl80211.h
1406 @@ -3060,11 +3060,11 @@ enum nl80211_tx_power_setting {
1407  };
1408
1409  /**
1410 - * enum nl80211_wowlan_packet_pattern_attr - WoWLAN packet pattern attribute
1411 - * @__NL80211_WOWLAN_PKTPAT_INVALID: invalid number for nested attribute
1412 - * @NL80211_WOWLAN_PKTPAT_PATTERN: the pattern, values where the mask has
1413 + * enum nl80211_packet_pattern_attr - packet pattern attribute
1414 + * @__NL80211_PKTPAT_INVALID: invalid number for nested attribute
1415 + * @NL80211_PKTPAT_PATTERN: the pattern, values where the mask has
1416   *     a zero bit are ignored
1417 - * @NL80211_WOWLAN_PKTPAT_MASK: pattern mask, must be long enough to have
1418 + * @NL80211_PKTPAT_MASK: pattern mask, must be long enough to have
1419   *     a bit for each byte in the pattern. The lowest-order bit corresponds
1420   *     to the first byte of the pattern, but the bytes of the pattern are
1421   *     in a little-endian-like format, i.e. the 9th byte of the pattern
1422 @@ -3075,23 +3075,23 @@ enum nl80211_tx_power_setting {
1423   *     Note that the pattern matching is done as though frames were not
1424   *     802.11 frames but 802.3 frames, i.e. the frame is fully unpacked
1425   *     first (including SNAP header unpacking) and then matched.
1426 - * @NL80211_WOWLAN_PKTPAT_OFFSET: packet offset, pattern is matched after
1427 + * @NL80211_PKTPAT_OFFSET: packet offset, pattern is matched after
1428   *     these fixed number of bytes of received packet
1429 - * @NUM_NL80211_WOWLAN_PKTPAT: number of attributes
1430 - * @MAX_NL80211_WOWLAN_PKTPAT: max attribute number
1431 + * @NUM_NL80211_PKTPAT: number of attributes
1432 + * @MAX_NL80211_PKTPAT: max attribute number
1433   */
1434 -enum nl80211_wowlan_packet_pattern_attr {
1435 -       __NL80211_WOWLAN_PKTPAT_INVALID,
1436 -       NL80211_WOWLAN_PKTPAT_MASK,
1437 -       NL80211_WOWLAN_PKTPAT_PATTERN,
1438 -       NL80211_WOWLAN_PKTPAT_OFFSET,
1439 +enum nl80211_packet_pattern_attr {
1440 +       __NL80211_PKTPAT_INVALID,
1441 +       NL80211_PKTPAT_MASK,
1442 +       NL80211_PKTPAT_PATTERN,
1443 +       NL80211_PKTPAT_OFFSET,
1444
1445 -       NUM_NL80211_WOWLAN_PKTPAT,
1446 -       MAX_NL80211_WOWLAN_PKTPAT = NUM_NL80211_WOWLAN_PKTPAT - 1,
1447 +       NUM_NL80211_PKTPAT,
1448 +       MAX_NL80211_PKTPAT = NUM_NL80211_PKTPAT - 1,
1449  };
1450
1451  /**
1452 - * struct nl80211_wowlan_pattern_support - pattern support information
1453 + * struct nl80211_pattern_support - packet pattern support information
1454   * @max_patterns: maximum number of patterns supported
1455   * @min_pattern_len: minimum length of each pattern
1456   * @max_pattern_len: maximum length of each pattern
1457 @@ -3101,13 +3101,22 @@ enum nl80211_wowlan_packet_pattern_attr
1458   * that is part of %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED in the
1459   * capability information given by the kernel to userspace.
1460   */
1461 -struct nl80211_wowlan_pattern_support {
1462 +struct nl80211_pattern_support {
1463         __u32 max_patterns;
1464         __u32 min_pattern_len;
1465         __u32 max_pattern_len;
1466         __u32 max_pkt_offset;
1467  } __attribute__((packed));
1468
1469 +/* only for backward compatibility */
1470 +#define __NL80211_WOWLAN_PKTPAT_INVALID __NL80211_PKTPAT_INVALID
1471 +#define NL80211_WOWLAN_PKTPAT_MASK NL80211_PKTPAT_MASK
1472 +#define NL80211_WOWLAN_PKTPAT_PATTERN NL80211_PKTPAT_PATTERN
1473 +#define NL80211_WOWLAN_PKTPAT_OFFSET NL80211_PKTPAT_OFFSET
1474 +#define NUM_NL80211_WOWLAN_PKTPAT NUM_NL80211_PKTPAT
1475 +#define MAX_NL80211_WOWLAN_PKTPAT MAX_NL80211_PKTPAT
1476 +#define nl80211_wowlan_pattern_support nl80211_pattern_support
1477 +
1478  /**
1479   * enum nl80211_wowlan_triggers - WoWLAN trigger definitions
1480   * @__NL80211_WOWLAN_TRIG_INVALID: invalid number for nested attributes
1481 @@ -3127,7 +3136,7 @@ struct nl80211_wowlan_pattern_support {
1482   *     pattern matching is done after the packet is converted to the MSDU.
1483   *
1484   *     In %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED, it is a binary attribute
1485 - *     carrying a &struct nl80211_wowlan_pattern_support.
1486 + *     carrying a &struct nl80211_pattern_support.
1487   *
1488   *     When reporting wakeup. it is a u32 attribute containing the 0-based
1489   *     index of the pattern that caused the wakeup, in the patterns passed
1490 @@ -3284,7 +3293,7 @@ struct nl80211_wowlan_tcp_data_token_fea
1491   * @NL80211_WOWLAN_TCP_WAKE_PAYLOAD: wake packet payload, for advertising a
1492   *     u32 attribute holding the maximum length
1493   * @NL80211_WOWLAN_TCP_WAKE_MASK: Wake packet payload mask, not used for
1494 - *     feature advertising. The mask works like @NL80211_WOWLAN_PKTPAT_MASK
1495 + *     feature advertising. The mask works like @NL80211_PKTPAT_MASK
1496   *     but on the TCP payload only.
1497   * @NUM_NL80211_WOWLAN_TCP: number of TCP attributes
1498   * @MAX_NL80211_WOWLAN_TCP: highest attribute number
1499 --- a/net/mac80211/mesh_ps.c
1500 +++ b/net/mac80211/mesh_ps.c
1501 @@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(str
1502         enum nl80211_mesh_power_mode pm;
1503         bool do_buffer;
1504
1505 +       /* For non-assoc STA, prevent buffering or frame transmission */
1506 +       if (sta->sta_state < IEEE80211_STA_ASSOC)
1507 +               return;
1508 +
1509         /*
1510          * use peer-specific power mode if peering is established and the
1511          * peer's power mode is known
1512 --- a/net/wireless/nl80211.c
1513 +++ b/net/wireless/nl80211.c
1514 @@ -441,10 +441,12 @@ static int nl80211_prepare_wdev_dump(str
1515                         goto out_unlock;
1516                 }
1517                 *rdev = wiphy_to_dev((*wdev)->wiphy);
1518 -               cb->args[0] = (*rdev)->wiphy_idx;
1519 +               /* 0 is the first index - add 1 to parse only once */
1520 +               cb->args[0] = (*rdev)->wiphy_idx + 1;
1521                 cb->args[1] = (*wdev)->identifier;
1522         } else {
1523 -               struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
1524 +               /* subtract the 1 again here */
1525 +               struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1526                 struct wireless_dev *tmp;
1527
1528                 if (!wiphy) {
1529 @@ -974,7 +976,7 @@ static int nl80211_send_wowlan(struct sk
1530                 return -ENOBUFS;
1531
1532         if (dev->wiphy.wowlan->n_patterns) {
1533 -               struct nl80211_wowlan_pattern_support pat = {
1534 +               struct nl80211_pattern_support pat = {
1535                         .max_patterns = dev->wiphy.wowlan->n_patterns,
1536                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
1537                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
1538 @@ -1568,8 +1570,10 @@ static int nl80211_dump_wiphy(struct sk_
1539         rtnl_lock();
1540         if (!state) {
1541                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1542 -               if (!state)
1543 +               if (!state) {
1544 +                       rtnl_unlock();
1545                         return -ENOMEM;
1546 +               }
1547                 state->filter_wiphy = -1;
1548                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1549                 if (ret) {
1550 @@ -4770,9 +4774,9 @@ do {                                                                          \
1551         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
1552                                   mask, NL80211_MESHCONF_FORWARDING,
1553                                   nla_get_u8);
1554 -       FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
1555 +       FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
1556                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
1557 -                                 nla_get_u32);
1558 +                                 nla_get_s32);
1559         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
1560                                   mask, NL80211_MESHCONF_HT_OPMODE,
1561                                   nla_get_u16);
1562 @@ -6615,12 +6619,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_ev
1563
1564  void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
1565  {
1566 +       struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
1567         void *hdr = ((void **)skb->cb)[1];
1568         struct nlattr *data = ((void **)skb->cb)[2];
1569
1570         nla_nest_end(skb, data);
1571         genlmsg_end(skb, hdr);
1572 -       genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
1573 +       genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
1574 +                               nl80211_testmode_mcgrp.id, gfp);
1575  }
1576  EXPORT_SYMBOL(cfg80211_testmode_event);
1577  #endif
1578 @@ -7593,12 +7599,11 @@ static int nl80211_send_wowlan_patterns(
1579                 if (!nl_pat)
1580                         return -ENOBUFS;
1581                 pat_len = wowlan->patterns[i].pattern_len;
1582 -               if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
1583 -                           DIV_ROUND_UP(pat_len, 8),
1584 +               if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
1585                             wowlan->patterns[i].mask) ||
1586 -                   nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
1587 -                           pat_len, wowlan->patterns[i].pattern) ||
1588 -                   nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
1589 +                   nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
1590 +                           wowlan->patterns[i].pattern) ||
1591 +                   nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
1592                                 wowlan->patterns[i].pkt_offset))
1593                         return -ENOBUFS;
1594                 nla_nest_end(msg, nl_pat);
1595 @@ -7939,7 +7944,7 @@ static int nl80211_set_wowlan(struct sk_
1596                 struct nlattr *pat;
1597                 int n_patterns = 0;
1598                 int rem, pat_len, mask_len, pkt_offset;
1599 -               struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
1600 +               struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
1601
1602                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
1603                                     rem)
1604 @@ -7958,26 +7963,25 @@ static int nl80211_set_wowlan(struct sk_
1605
1606                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
1607                                     rem) {
1608 -                       nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
1609 -                                 nla_data(pat), nla_len(pat), NULL);
1610 +                       nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
1611 +                                 nla_len(pat), NULL);
1612                         err = -EINVAL;
1613 -                       if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
1614 -                           !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
1615 +                       if (!pat_tb[NL80211_PKTPAT_MASK] ||
1616 +                           !pat_tb[NL80211_PKTPAT_PATTERN])
1617                                 goto error;
1618 -                       pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
1619 +                       pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
1620                         mask_len = DIV_ROUND_UP(pat_len, 8);
1621 -                       if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
1622 -                           mask_len)
1623 +                       if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
1624                                 goto error;
1625                         if (pat_len > wowlan->pattern_max_len ||
1626                             pat_len < wowlan->pattern_min_len)
1627                                 goto error;
1628
1629 -                       if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
1630 +                       if (!pat_tb[NL80211_PKTPAT_OFFSET])
1631                                 pkt_offset = 0;
1632                         else
1633                                 pkt_offset = nla_get_u32(
1634 -                                       pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
1635 +                                       pat_tb[NL80211_PKTPAT_OFFSET]);
1636                         if (pkt_offset > wowlan->max_pkt_offset)
1637                                 goto error;
1638                         new_triggers.patterns[i].pkt_offset = pkt_offset;
1639 @@ -7991,11 +7995,11 @@ static int nl80211_set_wowlan(struct sk_
1640                         new_triggers.patterns[i].pattern =
1641                                 new_triggers.patterns[i].mask + mask_len;
1642                         memcpy(new_triggers.patterns[i].mask,
1643 -                              nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
1644 +                              nla_data(pat_tb[NL80211_PKTPAT_MASK]),
1645                                mask_len);
1646                         new_triggers.patterns[i].pattern_len = pat_len;
1647                         memcpy(new_triggers.patterns[i].pattern,
1648 -                              nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
1649 +                              nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
1650                                pat_len);
1651                         i++;
1652                 }
1653 @@ -10066,7 +10070,8 @@ void cfg80211_mgmt_tx_status(struct wire
1654
1655         genlmsg_end(msg, hdr);
1656
1657 -       genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
1658 +       genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
1659 +                               nl80211_mlme_mcgrp.id, gfp);
1660         return;
1661
1662   nla_put_failure:
1663 --- a/net/wireless/reg.c
1664 +++ b/net/wireless/reg.c
1665 @@ -2247,10 +2247,13 @@ int reg_device_uevent(struct device *dev
1666
1667  void wiphy_regulatory_register(struct wiphy *wiphy)
1668  {
1669 +       struct regulatory_request *lr;
1670 +
1671         if (!reg_dev_ignore_cell_hint(wiphy))
1672                 reg_num_devs_support_basehint++;
1673
1674 -       wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
1675 +       lr = get_last_request();
1676 +       wiphy_update_regulatory(wiphy, lr->initiator);
1677  }
1678
1679  void wiphy_regulatory_deregister(struct wiphy *wiphy)
1680 @@ -2279,7 +2282,9 @@ void wiphy_regulatory_deregister(struct
1681  static void reg_timeout_work(struct work_struct *work)
1682  {
1683         REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
1684 +       rtnl_lock();
1685         restore_regulatory_settings(true);
1686 +       rtnl_unlock();
1687  }
1688
1689  int __init regulatory_init(void)
1690 --- a/net/wireless/sme.c
1691 +++ b/net/wireless/sme.c
1692 @@ -34,8 +34,10 @@ struct cfg80211_conn {
1693                 CFG80211_CONN_SCAN_AGAIN,
1694                 CFG80211_CONN_AUTHENTICATE_NEXT,
1695                 CFG80211_CONN_AUTHENTICATING,
1696 +               CFG80211_CONN_AUTH_FAILED,
1697                 CFG80211_CONN_ASSOCIATE_NEXT,
1698                 CFG80211_CONN_ASSOCIATING,
1699 +               CFG80211_CONN_ASSOC_FAILED,
1700                 CFG80211_CONN_DEAUTH,
1701                 CFG80211_CONN_CONNECTED,
1702         } state;
1703 @@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct
1704                                           NULL, 0,
1705                                           params->key, params->key_len,
1706                                           params->key_idx, NULL, 0);
1707 +       case CFG80211_CONN_AUTH_FAILED:
1708 +               return -ENOTCONN;
1709         case CFG80211_CONN_ASSOCIATE_NEXT:
1710                 BUG_ON(!rdev->ops->assoc);
1711                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
1712 @@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct
1713                                              WLAN_REASON_DEAUTH_LEAVING,
1714                                              false);
1715                 return err;
1716 +       case CFG80211_CONN_ASSOC_FAILED:
1717 +               cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
1718 +                                    NULL, 0,
1719 +                                    WLAN_REASON_DEAUTH_LEAVING, false);
1720 +               return -ENOTCONN;
1721         case CFG80211_CONN_DEAUTH:
1722                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
1723                                      NULL, 0,
1724                                      WLAN_REASON_DEAUTH_LEAVING, false);
1725 +               /* free directly, disconnected event already sent */
1726 +               cfg80211_sme_free(wdev);
1727                 return 0;
1728         default:
1729                 return 0;
1730 @@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct w
1731                 return true;
1732         }
1733
1734 -       wdev->conn->state = CFG80211_CONN_DEAUTH;
1735 +       wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
1736         schedule_work(&rdev->conn_work);
1737         return false;
1738  }
1739 @@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless
1740
1741  void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
1742  {
1743 -       cfg80211_sme_free(wdev);
1744 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
1745 +
1746 +       if (!wdev->conn)
1747 +               return;
1748 +
1749 +       wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
1750 +       schedule_work(&rdev->conn_work);
1751  }
1752
1753  void cfg80211_sme_disassoc(struct wireless_dev *wdev)
1754 @@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wirele
1755
1756  void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
1757  {
1758 -       cfg80211_sme_disassoc(wdev);
1759 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
1760 +
1761 +       if (!wdev->conn)
1762 +               return;
1763 +
1764 +       wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
1765 +       schedule_work(&rdev->conn_work);
1766  }
1767
1768  static int cfg80211_sme_connect(struct wireless_dev *wdev,
1769 --- a/net/mac80211/rc80211_minstrel.c
1770 +++ b/net/mac80211/rc80211_minstrel.c
1771 @@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct iee
1772         struct minstrel_rate *msr, *mr;
1773         unsigned int ndx;
1774         bool mrr_capable;
1775 -       bool prev_sample = mi->prev_sample;
1776 +       bool prev_sample;
1777         int delta;
1778         int sampling_ratio;
1779
1780 @@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct iee
1781                         (mi->sample_count + mi->sample_deferred / 2);
1782
1783         /* delta < 0: no sampling required */
1784 +       prev_sample = mi->prev_sample;
1785         mi->prev_sample = false;
1786         if (delta < 0 || (!mrr_capable && prev_sample))
1787                 return;
1788 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
1789 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
1790 @@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_
1791         spin_unlock_irqrestore(&queue->index_lock, irqflags);
1792  }
1793
1794 -void rt2x00queue_pause_queue(struct data_queue *queue)
1795 +void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
1796  {
1797 -       if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
1798 -           !test_bit(QUEUE_STARTED, &queue->flags) ||
1799 -           test_and_set_bit(QUEUE_PAUSED, &queue->flags))
1800 -               return;
1801 -
1802         switch (queue->qid) {
1803         case QID_AC_VO:
1804         case QID_AC_VI:
1805 @@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data
1806                 break;
1807         }
1808  }
1809 +void rt2x00queue_pause_queue(struct data_queue *queue)
1810 +{
1811 +       if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
1812 +           !test_bit(QUEUE_STARTED, &queue->flags) ||
1813 +           test_and_set_bit(QUEUE_PAUSED, &queue->flags))
1814 +               return;
1815 +
1816 +       rt2x00queue_pause_queue_nocheck(queue);
1817 +}
1818  EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
1819
1820  void rt2x00queue_unpause_queue(struct data_queue *queue)
1821 @@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_
1822                 return;
1823         }
1824
1825 -       rt2x00queue_pause_queue(queue);
1826 +       rt2x00queue_pause_queue_nocheck(queue);
1827
1828         queue->rt2x00dev->ops->lib->stop_queue(queue);
1829
1830 --- a/net/mac80211/mlme.c
1831 +++ b/net/mac80211/mlme.c
1832 @@ -31,10 +31,12 @@
1833  #include "led.h"
1834
1835  #define IEEE80211_AUTH_TIMEOUT         (HZ / 5)
1836 +#define IEEE80211_AUTH_TIMEOUT_LONG    (HZ / 2)
1837  #define IEEE80211_AUTH_TIMEOUT_SHORT   (HZ / 10)
1838  #define IEEE80211_AUTH_MAX_TRIES       3
1839  #define IEEE80211_AUTH_WAIT_ASSOC      (HZ * 5)
1840  #define IEEE80211_ASSOC_TIMEOUT                (HZ / 5)
1841 +#define IEEE80211_ASSOC_TIMEOUT_LONG   (HZ / 2)
1842  #define IEEE80211_ASSOC_TIMEOUT_SHORT  (HZ / 10)
1843  #define IEEE80211_ASSOC_MAX_TRIES      3
1844
1845 @@ -209,8 +211,9 @@ ieee80211_determine_chantype(struct ieee
1846                              struct ieee80211_channel *channel,
1847                              const struct ieee80211_ht_operation *ht_oper,
1848                              const struct ieee80211_vht_operation *vht_oper,
1849 -                            struct cfg80211_chan_def *chandef, bool verbose)
1850 +                            struct cfg80211_chan_def *chandef, bool tracking)
1851  {
1852 +       struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1853         struct cfg80211_chan_def vht_chandef;
1854         u32 ht_cfreq, ret;
1855
1856 @@ -229,7 +232,7 @@ ieee80211_determine_chantype(struct ieee
1857         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
1858                                                   channel->band);
1859         /* check that channel matches the right operating channel */
1860 -       if (channel->center_freq != ht_cfreq) {
1861 +       if (!tracking && channel->center_freq != ht_cfreq) {
1862                 /*
1863                  * It's possible that some APs are confused here;
1864                  * Netgear WNDR3700 sometimes reports 4 higher than
1865 @@ -237,11 +240,10 @@ ieee80211_determine_chantype(struct ieee
1866                  * since we look at probe response/beacon data here
1867                  * it should be OK.
1868                  */
1869 -               if (verbose)
1870 -                       sdata_info(sdata,
1871 -                                  "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
1872 -                                  channel->center_freq, ht_cfreq,
1873 -                                  ht_oper->primary_chan, channel->band);
1874 +               sdata_info(sdata,
1875 +                          "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
1876 +                          channel->center_freq, ht_cfreq,
1877 +                          ht_oper->primary_chan, channel->band);
1878                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
1879                 goto out;
1880         }
1881 @@ -295,7 +297,7 @@ ieee80211_determine_chantype(struct ieee
1882                                 channel->band);
1883                 break;
1884         default:
1885 -               if (verbose)
1886 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
1887                         sdata_info(sdata,
1888                                    "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
1889                                    vht_oper->chan_width);
1890 @@ -304,7 +306,7 @@ ieee80211_determine_chantype(struct ieee
1891         }
1892
1893         if (!cfg80211_chandef_valid(&vht_chandef)) {
1894 -               if (verbose)
1895 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
1896                         sdata_info(sdata,
1897                                    "AP VHT information is invalid, disable VHT\n");
1898                 ret = IEEE80211_STA_DISABLE_VHT;
1899 @@ -317,7 +319,7 @@ ieee80211_determine_chantype(struct ieee
1900         }
1901
1902         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
1903 -               if (verbose)
1904 +               if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
1905                         sdata_info(sdata,
1906                                    "AP VHT information doesn't match HT, disable VHT\n");
1907                 ret = IEEE80211_STA_DISABLE_VHT;
1908 @@ -333,18 +335,27 @@ out:
1909         if (ret & IEEE80211_STA_DISABLE_VHT)
1910                 vht_chandef = *chandef;
1911
1912 +       /*
1913 +        * Ignore the DISABLED flag when we're already connected and only
1914 +        * tracking the APs beacon for bandwidth changes - otherwise we
1915 +        * might get disconnected here if we connect to an AP, update our
1916 +        * regulatory information based on the AP's country IE and the
1917 +        * information we have is wrong/outdated and disables the channel
1918 +        * that we're actually using for the connection to the AP.
1919 +        */
1920         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
1921 -                                       IEEE80211_CHAN_DISABLED)) {
1922 +                                       tracking ? 0 :
1923 +                                                  IEEE80211_CHAN_DISABLED)) {
1924                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
1925                         ret = IEEE80211_STA_DISABLE_HT |
1926                               IEEE80211_STA_DISABLE_VHT;
1927 -                       goto out;
1928 +                       break;
1929                 }
1930
1931                 ret |= chandef_downgrade(chandef);
1932         }
1933
1934 -       if (chandef->width != vht_chandef.width && verbose)
1935 +       if (chandef->width != vht_chandef.width && !tracking)
1936                 sdata_info(sdata,
1937                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
1938
1939 @@ -384,7 +395,7 @@ static int ieee80211_config_bw(struct ie
1940
1941         /* calculate new channel (type) based on HT/VHT operation IEs */
1942         flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
1943 -                                            vht_oper, &chandef, false);
1944 +                                            vht_oper, &chandef, true);
1945
1946         /*
1947          * Downgrade the new channel if we associated with restricted
1948 @@ -1043,6 +1054,13 @@ ieee80211_sta_process_chanswitch(struct
1949                 if (!ieee80211_operating_class_to_band(
1950                                 elems->ext_chansw_ie->new_operating_class,
1951                                 &new_band)) {
1952 +                       /*
1953 +                        * Some APs send invalid ECSA IEs in probe response
1954 +                        * frames, so check for these and ignore them.
1955 +                        */
1956 +                       if (beacon && elems->ext_chansw_ie->new_ch_num == 0 &&
1957 +                           elems->ext_chansw_ie->new_operating_class == 0)
1958 +                               return;
1959                         sdata_info(sdata,
1960                                    "cannot understand ECSA IE operating class %d, disconnecting\n",
1961                                    elems->ext_chansw_ie->new_operating_class);
1962 @@ -3394,10 +3412,13 @@ static int ieee80211_probe_auth(struct i
1963
1964         if (tx_flags == 0) {
1965                 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
1966 -               ifmgd->auth_data->timeout_started = true;
1967 +               auth_data->timeout_started = true;
1968                 run_again(sdata, auth_data->timeout);
1969         } else {
1970 -               auth_data->timeout_started = false;
1971 +               auth_data->timeout =
1972 +                       round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
1973 +               auth_data->timeout_started = true;
1974 +               run_again(sdata, auth_data->timeout);
1975         }
1976
1977         return 0;
1978 @@ -3434,7 +3455,11 @@ static int ieee80211_do_assoc(struct iee
1979                 assoc_data->timeout_started = true;
1980                 run_again(sdata, assoc_data->timeout);
1981         } else {
1982 -               assoc_data->timeout_started = false;
1983 +               assoc_data->timeout =
1984 +                       round_jiffies_up(jiffies +
1985 +                                        IEEE80211_ASSOC_TIMEOUT_LONG);
1986 +               assoc_data->timeout_started = true;
1987 +               run_again(sdata, assoc_data->timeout);
1988         }
1989
1990         return 0;
1991 @@ -3829,7 +3854,7 @@ static int ieee80211_prep_channel(struct
1992         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
1993                                                      cbss->channel,
1994                                                      ht_oper, vht_oper,
1995 -                                                    &chandef, true);
1996 +                                                    &chandef, false);
1997
1998         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
1999                                       local->rx_chains);
2000 --- a/net/wireless/core.c
2001 +++ b/net/wireless/core.c
2002 @@ -772,6 +772,7 @@ void cfg80211_leave(struct cfg80211_regi
2003                 cfg80211_leave_mesh(rdev, dev);
2004                 break;
2005         case NL80211_IFTYPE_AP:
2006 +       case NL80211_IFTYPE_P2P_GO:
2007                 cfg80211_stop_ap(rdev, dev);
2008                 break;
2009         default:
2010 --- a/drivers/net/wireless/rtlwifi/Kconfig
2011 +++ b/drivers/net/wireless/rtlwifi/Kconfig
2012 @@ -1,29 +1,22 @@
2013 -config RTLWIFI
2014 -       tristate "Realtek wireless card support"
2015 +menuconfig RTL_CARDS
2016 +       tristate "Realtek rtlwifi family of devices"
2017         depends on m
2018 -       depends on MAC80211
2019 -       select BACKPORT_FW_LOADER
2020 -       ---help---
2021 -         This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
2022 -         drivers.  This module does nothing by itself - the various front-end
2023 -         drivers need to be enabled to support any desired devices.
2024 -
2025 -         If you choose to build as a module, it'll be called rtlwifi.
2026 -
2027 -config RTLWIFI_DEBUG
2028 -       bool "Debugging output for rtlwifi driver family"
2029 -       depends on RTLWIFI
2030 +       depends on MAC80211 && (PCI || USB)
2031         default y
2032         ---help---
2033 -       To use the module option that sets the dynamic-debugging level for,
2034 -       the front-end driver, this parameter must be "Y". For memory-limited
2035 -       systems, choose "N". If in doubt, choose "Y".
2036 +         This option will enable support for the Realtek mac80211-based
2037 +         wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
2038 +         rtl8723eu, and rtl8188eu share some common code.
2039 +
2040 +if RTL_CARDS
2041
2042  config RTL8192CE
2043         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
2044         depends on m
2045 -       depends on RTLWIFI && PCI
2046 +       depends on PCI
2047         select RTL8192C_COMMON
2048 +       select RTLWIFI
2049 +       select RTLWIFI_PCI
2050         ---help---
2051         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
2052         wireless network adapters.
2053 @@ -33,7 +26,9 @@ config RTL8192CE
2054  config RTL8192SE
2055         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
2056         depends on m
2057 -       depends on RTLWIFI && PCI
2058 +       depends on PCI
2059 +       select RTLWIFI
2060 +       select RTLWIFI_PCI
2061         ---help---
2062         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
2063         wireless network adapters.
2064 @@ -43,7 +38,9 @@ config RTL8192SE
2065  config RTL8192DE
2066         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
2067         depends on m
2068 -       depends on RTLWIFI && PCI
2069 +       depends on PCI
2070 +       select RTLWIFI
2071 +       select RTLWIFI_PCI
2072         ---help---
2073         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
2074         wireless network adapters.
2075 @@ -53,7 +50,9 @@ config RTL8192DE
2076  config RTL8723AE
2077         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
2078         depends on m
2079 -       depends on RTLWIFI && PCI
2080 +       depends on PCI
2081 +       select RTLWIFI
2082 +       select RTLWIFI_PCI
2083         ---help---
2084         This is the driver for Realtek RTL8723AE 802.11n PCIe
2085         wireless network adapters.
2086 @@ -63,7 +62,9 @@ config RTL8723AE
2087  config RTL8188EE
2088         tristate "Realtek RTL8188EE Wireless Network Adapter"
2089         depends on m
2090 -       depends on RTLWIFI && PCI
2091 +       depends on PCI
2092 +       select RTLWIFI
2093 +       select RTLWIFI_PCI
2094         ---help---
2095         This is the driver for Realtek RTL8188EE 802.11n PCIe
2096         wireless network adapters.
2097 @@ -73,7 +74,9 @@ config RTL8188EE
2098  config RTL8192CU
2099         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
2100         depends on m
2101 -       depends on RTLWIFI && USB
2102 +       depends on USB
2103 +       select RTLWIFI
2104 +       select RTLWIFI_USB
2105         select RTL8192C_COMMON
2106         ---help---
2107         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
2108 @@ -81,8 +84,32 @@ config RTL8192CU
2109
2110         If you choose to build it as a module, it will be called rtl8192cu
2111
2112 +config RTLWIFI
2113 +       tristate
2114 +       depends on m
2115 +       select BACKPORT_FW_LOADER
2116 +
2117 +config RTLWIFI_PCI
2118 +       tristate
2119 +       depends on m
2120 +
2121 +config RTLWIFI_USB
2122 +       tristate
2123 +       depends on m
2124 +
2125 +config RTLWIFI_DEBUG
2126 +       bool "Debugging output for rtlwifi driver family"
2127 +       depends on RTLWIFI
2128 +       default y
2129 +       ---help---
2130 +       To use the module option that sets the dynamic-debugging level for,
2131 +       the front-end driver, this parameter must be "Y". For memory-limited
2132 +       systems, choose "N". If in doubt, choose "Y".
2133 +
2134  config RTL8192C_COMMON
2135         tristate
2136         depends on m
2137         depends on RTL8192CE || RTL8192CU
2138 -       default m
2139 +       default y
2140 +
2141 +endif
2142 --- a/drivers/net/wireless/rtlwifi/Makefile
2143 +++ b/drivers/net/wireless/rtlwifi/Makefile
2144 @@ -12,13 +12,11 @@ rtlwifi-objs        :=              \
2145
2146  rtl8192c_common-objs +=                \
2147
2148 -ifneq ($(CONFIG_PCI),)
2149 -rtlwifi-objs   += pci.o
2150 -endif
2151 +obj-$(CPTCFG_RTLWIFI_PCI)      += rtl_pci.o
2152 +rtl_pci-objs   :=              pci.o
2153
2154 -ifneq ($(CONFIG_USB),)
2155 -rtlwifi-objs   += usb.o
2156 -endif
2157 +obj-$(CPTCFG_RTLWIFI_USB)      += rtl_usb.o
2158 +rtl_usb-objs   :=              usb.o
2159
2160  obj-$(CPTCFG_RTL8192C_COMMON)  += rtl8192c/
2161  obj-$(CPTCFG_RTL8192CE)                += rtl8192ce/
2162 --- a/drivers/net/wireless/rtlwifi/ps.h
2163 +++ b/drivers/net/wireless/rtlwifi/ps.h
2164 @@ -49,5 +49,6 @@ void rtl_swlps_rf_awake(struct ieee80211
2165  void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
2166  void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
2167  void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
2168 +void rtl_lps_change_work_callback(struct work_struct *work);
2169
2170  #endif
2171 --- a/drivers/net/wireless/rtlwifi/base.c
2172 +++ b/drivers/net/wireless/rtlwifi/base.c
2173 @@ -173,6 +173,7 @@ u8 rtl_tid_to_ac(u8 tid)
2174  {
2175         return tid_to_ac[tid];
2176  }
2177 +EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
2178
2179  static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
2180                                   struct ieee80211_sta_ht_cap *ht_cap)
2181 @@ -407,6 +408,7 @@ void rtl_deinit_deferred_work(struct iee
2182         cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
2183         cancel_delayed_work(&rtlpriv->works.fwevt_wq);
2184  }
2185 +EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
2186
2187  void rtl_init_rfkill(struct ieee80211_hw *hw)
2188  {
2189 @@ -440,6 +442,7 @@ void rtl_deinit_rfkill(struct ieee80211_
2190  {
2191         wiphy_rfkill_stop_polling(hw->wiphy);
2192  }
2193 +EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
2194
2195  int rtl_init_core(struct ieee80211_hw *hw)
2196  {
2197 @@ -490,10 +493,12 @@ int rtl_init_core(struct ieee80211_hw *h
2198
2199         return 0;
2200  }
2201 +EXPORT_SYMBOL_GPL(rtl_init_core);
2202
2203  void rtl_deinit_core(struct ieee80211_hw *hw)
2204  {
2205  }
2206 +EXPORT_SYMBOL_GPL(rtl_deinit_core);
2207
2208  void rtl_init_rx_config(struct ieee80211_hw *hw)
2209  {
2210 @@ -502,6 +507,7 @@ void rtl_init_rx_config(struct ieee80211
2211
2212         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
2213  }
2214 +EXPORT_SYMBOL_GPL(rtl_init_rx_config);
2215
2216  /*********************************************************
2217   *
2218 @@ -880,6 +886,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_h
2219
2220         return true;
2221  }
2222 +EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
2223
2224  void rtl_get_tcb_desc(struct ieee80211_hw *hw,
2225                       struct ieee80211_tx_info *info,
2226 @@ -1053,6 +1060,7 @@ bool rtl_action_proc(struct ieee80211_hw
2227
2228         return true;
2229  }
2230 +EXPORT_SYMBOL_GPL(rtl_action_proc);
2231
2232  /*should call before software enc*/
2233  u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
2234 @@ -1126,6 +1134,7 @@ u8 rtl_is_special_data(struct ieee80211_
2235
2236         return false;
2237  }
2238 +EXPORT_SYMBOL_GPL(rtl_is_special_data);
2239
2240  /*********************************************************
2241   *
2242 @@ -1301,6 +1310,7 @@ void rtl_beacon_statistic(struct ieee802
2243
2244         rtlpriv->link_info.bcn_rx_inperiod++;
2245  }
2246 +EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
2247
2248  void rtl_watchdog_wq_callback(void *data)
2249  {
2250 @@ -1794,6 +1804,7 @@ void rtl_recognize_peer(struct ieee80211
2251
2252         mac->vendor = vendor;
2253  }
2254 +EXPORT_SYMBOL_GPL(rtl_recognize_peer);
2255
2256  /*********************************************************
2257   *
2258 @@ -1850,6 +1861,7 @@ struct attribute_group rtl_attribute_gro
2259         .name = "rtlsysfs",
2260         .attrs = rtl_sysfs_entries,
2261  };
2262 +EXPORT_SYMBOL_GPL(rtl_attribute_group);
2263
2264  MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
2265  MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
2266 @@ -1857,7 +1869,8 @@ MODULE_AUTHOR("Larry Finger       <Larry.FInge
2267  MODULE_LICENSE("GPL");
2268  MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
2269
2270 -struct rtl_global_var global_var = {};
2271 +struct rtl_global_var rtl_global_var = {};
2272 +EXPORT_SYMBOL_GPL(rtl_global_var);
2273
2274  static int __init rtl_core_module_init(void)
2275  {
2276 @@ -1865,8 +1878,8 @@ static int __init rtl_core_module_init(v
2277                 pr_err("Unable to register rtl_rc, use default RC !!\n");
2278
2279         /* init some global vars */
2280 -       INIT_LIST_HEAD(&global_var.glb_priv_list);
2281 -       spin_lock_init(&global_var.glb_list_lock);
2282 +       INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
2283 +       spin_lock_init(&rtl_global_var.glb_list_lock);
2284
2285         return 0;
2286  }
2287 --- a/drivers/net/wireless/rtlwifi/base.h
2288 +++ b/drivers/net/wireless/rtlwifi/base.h
2289 @@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211
2290  u8 rtl_tid_to_ac(u8 tid);
2291  extern struct attribute_group rtl_attribute_group;
2292  void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
2293 -extern struct rtl_global_var global_var;
2294 +extern struct rtl_global_var rtl_global_var;
2295  int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
2296                          bool isht, u8 desc_rate, bool first_ampdu);
2297  bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
2298 --- a/drivers/net/wireless/rtlwifi/core.c
2299 +++ b/drivers/net/wireless/rtlwifi/core.c
2300 @@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
2301         .rfkill_poll = rtl_op_rfkill_poll,
2302         .flush = rtl_op_flush,
2303  };
2304 +EXPORT_SYMBOL_GPL(rtl_ops);
2305 --- a/drivers/net/wireless/rtlwifi/debug.c
2306 +++ b/drivers/net/wireless/rtlwifi/debug.c
2307 @@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211
2308
2309         /*Init Debug flag enable condition */
2310  }
2311 +EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
2312 --- a/drivers/net/wireless/rtlwifi/efuse.c
2313 +++ b/drivers/net/wireless/rtlwifi/efuse.c
2314 @@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw
2315
2316         *pbuf = (u8) (value32 & 0xff);
2317  }
2318 +EXPORT_SYMBOL_GPL(read_efuse_byte);
2319
2320  void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
2321  {
2322 --- a/drivers/net/wireless/rtlwifi/pci.c
2323 +++ b/drivers/net/wireless/rtlwifi/pci.c
2324 @@ -35,6 +35,13 @@
2325  #include "efuse.h"
2326  #include <linux/export.h>
2327  #include <linux/kmemleak.h>
2328 +#include <linux/module.h>
2329 +
2330 +MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
2331 +MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
2332 +MODULE_AUTHOR("Larry Finger    <Larry.FInger@lwfinger.net>");
2333 +MODULE_LICENSE("GPL");
2334 +MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
2335
2336  static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
2337         PCI_VENDOR_ID_INTEL,
2338 @@ -1008,19 +1015,6 @@ static void _rtl_pci_prepare_bcn_tasklet
2339         return;
2340  }
2341
2342 -static void rtl_lps_change_work_callback(struct work_struct *work)
2343 -{
2344 -       struct rtl_works *rtlworks =
2345 -           container_of(work, struct rtl_works, lps_change_work);
2346 -       struct ieee80211_hw *hw = rtlworks->hw;
2347 -       struct rtl_priv *rtlpriv = rtl_priv(hw);
2348 -
2349 -       if (rtlpriv->enter_ps)
2350 -               rtl_lps_enter(hw);
2351 -       else
2352 -               rtl_lps_leave(hw);
2353 -}
2354 -
2355  static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
2356  {
2357         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
2358 @@ -1899,7 +1893,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
2359         rtlpriv->rtlhal.interface = INTF_PCI;
2360         rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
2361         rtlpriv->intf_ops = &rtl_pci_ops;
2362 -       rtlpriv->glb_var = &global_var;
2363 +       rtlpriv->glb_var = &rtl_global_var;
2364
2365         /*
2366          *init dbgp flags before all
2367 --- a/drivers/net/wireless/rtlwifi/ps.c
2368 +++ b/drivers/net/wireless/rtlwifi/ps.c
2369 @@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw
2370
2371         spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
2372  }
2373 +EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
2374
2375  /*for FW LPS*/
2376
2377 @@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_h
2378                          "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
2379         }
2380  }
2381 +EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
2382
2383  void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
2384  {
2385 @@ -611,6 +613,19 @@ void rtl_swlps_rf_sleep(struct ieee80211
2386                         MSECS(sleep_intv * mac->vif->bss_conf.beacon_int - 40));
2387  }
2388
2389 +void rtl_lps_change_work_callback(struct work_struct *work)
2390 +{
2391 +       struct rtl_works *rtlworks =
2392 +           container_of(work, struct rtl_works, lps_change_work);
2393 +       struct ieee80211_hw *hw = rtlworks->hw;
2394 +       struct rtl_priv *rtlpriv = rtl_priv(hw);
2395 +
2396 +       if (rtlpriv->enter_ps)
2397 +               rtl_lps_enter(hw);
2398 +       else
2399 +               rtl_lps_leave(hw);
2400 +}
2401 +EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
2402
2403  void rtl_swlps_wq_callback(void *data)
2404  {
2405 @@ -922,3 +937,4 @@ void rtl_p2p_info(struct ieee80211_hw *h
2406         else
2407                 rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
2408  }
2409 +EXPORT_SYMBOL_GPL(rtl_p2p_info);
2410 --- a/drivers/net/wireless/rtlwifi/usb.c
2411 +++ b/drivers/net/wireless/rtlwifi/usb.c
2412 @@ -32,6 +32,13 @@
2413  #include "ps.h"
2414  #include "rtl8192c/fw_common.h"
2415  #include <linux/export.h>
2416 +#include <linux/module.h>
2417 +
2418 +MODULE_AUTHOR("lizhaoming      <chaoming_li@realsil.com.cn>");
2419 +MODULE_AUTHOR("Realtek WlanFAE <wlanfae@realtek.com>");
2420 +MODULE_AUTHOR("Larry Finger    <Larry.FInger@lwfinger.net>");
2421 +MODULE_LICENSE("GPL");
2422 +MODULE_DESCRIPTION("USB basic driver for rtlwifi");
2423
2424  #define        REALTEK_USB_VENQT_READ                  0xC0
2425  #define        REALTEK_USB_VENQT_WRITE                 0x40
2426 @@ -1070,6 +1077,8 @@ int rtl_usb_probe(struct usb_interface *
2427         spin_lock_init(&rtlpriv->locks.usb_lock);
2428         INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
2429                   rtl_fill_h2c_cmd_work_callback);
2430 +       INIT_WORK(&rtlpriv->works.lps_change_work,
2431 +                 rtl_lps_change_work_callback);
2432
2433         rtlpriv->usb_data_index = 0;
2434         init_completion(&rtlpriv->firmware_loading_complete);
2435 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
2436 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
2437 @@ -72,17 +72,12 @@ struct ath_config {
2438  /*************************/
2439
2440  #define ATH_TXBUF_RESET(_bf) do {                              \
2441 -               (_bf)->bf_stale = false;                        \
2442                 (_bf)->bf_lastbf = NULL;                        \
2443                 (_bf)->bf_next = NULL;                          \
2444                 memset(&((_bf)->bf_state), 0,                   \
2445                        sizeof(struct ath_buf_state));           \
2446         } while (0)
2447
2448 -#define ATH_RXBUF_RESET(_bf) do {              \
2449 -               (_bf)->bf_stale = false;        \
2450 -       } while (0)
2451 -
2452  /**
2453   * enum buffer_type - Buffer type flags
2454   *
2455 @@ -137,7 +132,8 @@ int ath_descdma_setup(struct ath_softc *
2456  #define ATH_AGGR_ENCRYPTDELIM      10
2457  /* minimum h/w qdepth to be sustained to maximize aggregation */
2458  #define ATH_AGGR_MIN_QDEPTH        2
2459 -#define ATH_AMPDU_SUBFRAME_DEFAULT 32
2460 +/* minimum h/w qdepth for non-aggregated traffic */
2461 +#define ATH_NON_AGGR_MIN_QDEPTH    8
2462
2463  #define IEEE80211_SEQ_SEQ_SHIFT    4
2464  #define IEEE80211_SEQ_MAX          4096
2465 @@ -174,12 +170,6 @@ int ath_descdma_setup(struct ath_softc *
2466
2467  #define ATH_TX_COMPLETE_POLL_INT       1000
2468
2469 -enum ATH_AGGR_STATUS {
2470 -       ATH_AGGR_DONE,
2471 -       ATH_AGGR_BAW_CLOSED,
2472 -       ATH_AGGR_LIMITED,
2473 -};
2474 -
2475  #define ATH_TXFIFO_DEPTH 8
2476  struct ath_txq {
2477         int mac80211_qnum; /* mac80211 queue number, -1 means not mac80211 Q */
2478 @@ -201,10 +191,10 @@ struct ath_txq {
2479
2480  struct ath_atx_ac {
2481         struct ath_txq *txq;
2482 -       int sched;
2483         struct list_head list;
2484         struct list_head tid_q;
2485         bool clear_ps_filter;
2486 +       bool sched;
2487  };
2488
2489  struct ath_frame_info {
2490 @@ -212,14 +202,16 @@ struct ath_frame_info {
2491         int framelen;
2492         enum ath9k_key_type keytype;
2493         u8 keyix;
2494 -       u8 retries;
2495         u8 rtscts_rate;
2496 +       u8 retries : 7;
2497 +       u8 baw_tracked : 1;
2498  };
2499
2500  struct ath_buf_state {
2501         u8 bf_type;
2502         u8 bfs_paprd;
2503         u8 ndelim;
2504 +       bool stale;
2505         u16 seqno;
2506         unsigned long bfs_paprd_timestamp;
2507  };
2508 @@ -233,7 +225,6 @@ struct ath_buf {
2509         void *bf_desc;                  /* virtual addr of desc */
2510         dma_addr_t bf_daddr;            /* physical addr of desc */
2511         dma_addr_t bf_buf_addr; /* physical addr of data buffer, for DMA */
2512 -       bool bf_stale;
2513         struct ieee80211_tx_rate rates[4];
2514         struct ath_buf_state bf_state;
2515  };
2516 @@ -241,16 +232,18 @@ struct ath_buf {
2517  struct ath_atx_tid {
2518         struct list_head list;
2519         struct sk_buff_head buf_q;
2520 +       struct sk_buff_head retry_q;
2521         struct ath_node *an;
2522         struct ath_atx_ac *ac;
2523         unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
2524 -       int bar_index;
2525         u16 seq_start;
2526         u16 seq_next;
2527         u16 baw_size;
2528 -       int tidno;
2529 +       u8 tidno;
2530         int baw_head;   /* first un-acked tx buffer */
2531         int baw_tail;   /* next unused tx buffer slot */
2532 +
2533 +       s8 bar_index;
2534         bool sched;
2535         bool paused;
2536         bool active;
2537 @@ -262,12 +255,13 @@ struct ath_node {
2538         struct ieee80211_vif *vif; /* interface with which we're associated */
2539         struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
2540         struct ath_atx_ac ac[IEEE80211_NUM_ACS];
2541 -       int ps_key;
2542
2543         u16 maxampdu;
2544         u8 mpdudensity;
2545 +       s8 ps_key;
2546
2547         bool sleeping;
2548 +       bool no_ps_filter;
2549
2550  #if defined(CPTCFG_MAC80211_DEBUGFS) && defined(CPTCFG_ATH9K_DEBUGFS)
2551         struct dentry *node_stat;
2552 @@ -317,6 +311,7 @@ struct ath_rx {
2553         struct ath_descdma rxdma;
2554         struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
2555
2556 +       struct ath_buf *buf_hold;
2557         struct sk_buff *frag;
2558
2559         u32 ampdu_ref;
2560 @@ -367,6 +362,7 @@ void ath9k_release_buffered_frames(struc
2561  /********/
2562
2563  struct ath_vif {
2564 +       struct ath_node mcast_node;
2565         int av_bslot;
2566         bool primary_sta_vif;
2567         __le64 tsf_adjust; /* TSF adjustment for staggered beacons */
2568 --- a/drivers/net/wireless/ath/ath9k/debug.c
2569 +++ b/drivers/net/wireless/ath/ath9k/debug.c
2570 @@ -607,6 +607,28 @@ static ssize_t read_file_xmit(struct fil
2571         return retval;
2572  }
2573
2574 +static ssize_t print_queue(struct ath_softc *sc, struct ath_txq *txq,
2575 +                          char *buf, ssize_t size)
2576 +{
2577 +       ssize_t len = 0;
2578 +
2579 +       ath_txq_lock(sc, txq);
2580 +
2581 +       len += snprintf(buf + len, size - len, "%s: %d ",
2582 +                       "qnum", txq->axq_qnum);
2583 +       len += snprintf(buf + len, size - len, "%s: %2d ",
2584 +                       "qdepth", txq->axq_depth);
2585 +       len += snprintf(buf + len, size - len, "%s: %2d ",
2586 +                       "ampdu-depth", txq->axq_ampdu_depth);
2587 +       len += snprintf(buf + len, size - len, "%s: %3d ",
2588 +                       "pending", txq->pending_frames);
2589 +       len += snprintf(buf + len, size - len, "%s: %d\n",
2590 +                       "stopped", txq->stopped);
2591 +
2592 +       ath_txq_unlock(sc, txq);
2593 +       return len;
2594 +}
2595 +
2596  static ssize_t read_file_queues(struct file *file, char __user *user_buf,
2597                                 size_t count, loff_t *ppos)
2598  {
2599 @@ -624,24 +646,13 @@ static ssize_t read_file_queues(struct f
2600
2601         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2602                 txq = sc->tx.txq_map[i];
2603 -               len += snprintf(buf + len, size - len, "(%s): ", qname[i]);
2604 -
2605 -               ath_txq_lock(sc, txq);
2606 -
2607 -               len += snprintf(buf + len, size - len, "%s: %d ",
2608 -                               "qnum", txq->axq_qnum);
2609 -               len += snprintf(buf + len, size - len, "%s: %2d ",
2610 -                               "qdepth", txq->axq_depth);
2611 -               len += snprintf(buf + len, size - len, "%s: %2d ",
2612 -                               "ampdu-depth", txq->axq_ampdu_depth);
2613 -               len += snprintf(buf + len, size - len, "%s: %3d ",
2614 -                               "pending", txq->pending_frames);
2615 -               len += snprintf(buf + len, size - len, "%s: %d\n",
2616 -                               "stopped", txq->stopped);
2617 -
2618 -               ath_txq_unlock(sc, txq);
2619 +               len += snprintf(buf + len, size - len, "(%s):  ", qname[i]);
2620 +               len += print_queue(sc, txq, buf + len, size - len);
2621         }
2622
2623 +       len += snprintf(buf + len, size - len, "(CAB): ");
2624 +       len += print_queue(sc, sc->beacon.cabq, buf + len, size - len);
2625 +
2626         if (len > size)
2627                 len = size;
2628
2629 --- a/net/mac80211/ibss.c
2630 +++ b/net/mac80211/ibss.c
2631 @@ -36,7 +36,7 @@
2632
2633  static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
2634                                       const u8 *bssid, const int beacon_int,
2635 -                                     struct ieee80211_channel *chan,
2636 +                                     struct cfg80211_chan_def *req_chandef,
2637                                       const u32 basic_rates,
2638                                       const u16 capability, u64 tsf,
2639                                       bool creator)
2640 @@ -51,6 +51,7 @@ static void __ieee80211_sta_join_ibss(st
2641         u32 bss_change;
2642         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
2643         struct cfg80211_chan_def chandef;
2644 +       struct ieee80211_channel *chan;
2645         struct beacon_data *presp;
2646         int frame_len;
2647
2648 @@ -81,7 +82,9 @@ static void __ieee80211_sta_join_ibss(st
2649
2650         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2651
2652 -       chandef = ifibss->chandef;
2653 +       /* make a copy of the chandef, it could be modified below. */
2654 +       chandef = *req_chandef;
2655 +       chan = chandef.chan;
2656         if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
2657                 chandef.width = NL80211_CHAN_WIDTH_20;
2658                 chandef.center_freq1 = chan->center_freq;
2659 @@ -259,10 +262,12 @@ static void ieee80211_sta_join_ibss(stru
2660         struct cfg80211_bss *cbss =
2661                 container_of((void *)bss, struct cfg80211_bss, priv);
2662         struct ieee80211_supported_band *sband;
2663 +       struct cfg80211_chan_def chandef;
2664         u32 basic_rates;
2665         int i, j;
2666         u16 beacon_int = cbss->beacon_interval;
2667         const struct cfg80211_bss_ies *ies;
2668 +       enum nl80211_channel_type chan_type;
2669         u64 tsf;
2670
2671         sdata_assert_lock(sdata);
2672 @@ -270,6 +275,26 @@ static void ieee80211_sta_join_ibss(stru
2673         if (beacon_int < 10)
2674                 beacon_int = 10;
2675
2676 +       switch (sdata->u.ibss.chandef.width) {
2677 +       case NL80211_CHAN_WIDTH_20_NOHT:
2678 +       case NL80211_CHAN_WIDTH_20:
2679 +       case NL80211_CHAN_WIDTH_40:
2680 +               chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
2681 +               cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
2682 +               break;
2683 +       case NL80211_CHAN_WIDTH_5:
2684 +       case NL80211_CHAN_WIDTH_10:
2685 +               cfg80211_chandef_create(&chandef, cbss->channel,
2686 +                                       NL80211_CHAN_WIDTH_20_NOHT);
2687 +               chandef.width = sdata->u.ibss.chandef.width;
2688 +               break;
2689 +       default:
2690 +               /* fall back to 20 MHz for unsupported modes */
2691 +               cfg80211_chandef_create(&chandef, cbss->channel,
2692 +                                       NL80211_CHAN_WIDTH_20_NOHT);
2693 +               break;
2694 +       }
2695 +
2696         sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
2697
2698         basic_rates = 0;
2699 @@ -294,7 +319,7 @@ static void ieee80211_sta_join_ibss(stru
2700
2701         __ieee80211_sta_join_ibss(sdata, cbss->bssid,
2702                                   beacon_int,
2703 -                                 cbss->channel,
2704 +                                 &chandef,
2705                                   basic_rates,
2706                                   cbss->capability,
2707                                   tsf, false);
2708 @@ -736,7 +761,7 @@ static void ieee80211_sta_create_ibss(st
2709                 sdata->drop_unencrypted = 0;
2710
2711         __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
2712 -                                 ifibss->chandef.chan, ifibss->basic_rates,
2713 +                                 &ifibss->chandef, ifibss->basic_rates,
2714                                   capability, 0, true);
2715  }
2716
2717 @@ -792,6 +817,17 @@ static void ieee80211_sta_find_ibss(stru
2718                 return;
2719         }
2720
2721 +       /* if a fixed bssid and a fixed freq have been provided create the IBSS
2722 +        * directly and do not waste time scanning
2723 +        */
2724 +       if (ifibss->fixed_bssid && ifibss->fixed_channel) {
2725 +               sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
2726 +                          bssid);
2727 +               ieee80211_sta_create_ibss(sdata);
2728 +               return;
2729 +       }
2730 +
2731 +
2732         ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
2733
2734         /* Selected IBSS not found in current scan results - try to scan */
2735 @@ -1138,6 +1174,7 @@ int ieee80211_ibss_leave(struct ieee8021
2736         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
2737         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
2738                                                 BSS_CHANGED_IBSS);
2739 +       ieee80211_vif_release_channel(sdata);
2740         synchronize_rcu();
2741         kfree(presp);
2742
2743 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
2744 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
2745 @@ -1173,6 +1173,10 @@ skip_ws_det:
2746                  * is_on == 0 means MRC CCK is OFF (more noise imm)
2747                  */
2748                 bool is_on = param ? 1 : 0;
2749 +
2750 +               if (ah->caps.rx_chainmask == 1)
2751 +                       break;
2752 +
2753                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
2754                               AR_PHY_MRC_CCK_ENABLE, is_on);
2755                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
2756 --- a/drivers/net/wireless/ath/ath9k/recv.c
2757 +++ b/drivers/net/wireless/ath/ath9k/recv.c
2758 @@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_s
2759         struct ath_desc *ds;
2760         struct sk_buff *skb;
2761
2762 -       ATH_RXBUF_RESET(bf);
2763 -
2764         ds = bf->bf_desc;
2765         ds->ds_link = 0; /* link to null */
2766         ds->ds_data = bf->bf_buf_addr;
2767 @@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_s
2768         sc->rx.rxlink = &ds->ds_link;
2769  }
2770
2771 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
2772 +{
2773 +       if (sc->rx.buf_hold)
2774 +               ath_rx_buf_link(sc, sc->rx.buf_hold);
2775 +
2776 +       sc->rx.buf_hold = bf;
2777 +}
2778 +
2779  static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
2780  {
2781         /* XXX block beacon interrupts */
2782 @@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct
2783
2784         skb = bf->bf_mpdu;
2785
2786 -       ATH_RXBUF_RESET(bf);
2787         memset(skb->data, 0, ah->caps.rx_status_len);
2788         dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
2789                                 ah->caps.rx_status_len, DMA_TO_DEVICE);
2790 @@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
2791         if (list_empty(&sc->rx.rxbuf))
2792                 goto start_recv;
2793
2794 +       sc->rx.buf_hold = NULL;
2795         sc->rx.rxlink = NULL;
2796         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
2797                 ath_rx_buf_link(sc, bf);
2798 @@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_b
2799         }
2800
2801         bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
2802 +       if (bf == sc->rx.buf_hold)
2803 +               return NULL;
2804 +
2805         ds = bf->bf_desc;
2806
2807         /*
2808 @@ -1375,7 +1384,7 @@ requeue:
2809                 if (edma) {
2810                         ath_rx_edma_buf_link(sc, qtype);
2811                 } else {
2812 -                       ath_rx_buf_link(sc, bf);
2813 +                       ath_rx_buf_relink(sc, bf);
2814                         ath9k_hw_rxena(ah);
2815                 }
2816         } while (1);
2817 --- a/drivers/net/wireless/ath/ath9k/init.c
2818 +++ b/drivers/net/wireless/ath/ath9k/init.c
2819 @@ -802,7 +802,8 @@ void ath9k_set_hw_capab(struct ath_softc
2820                 IEEE80211_HW_PS_NULLFUNC_STACK |
2821                 IEEE80211_HW_SPECTRUM_MGMT |
2822                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
2823 -               IEEE80211_HW_SUPPORTS_RC_TABLE;
2824 +               IEEE80211_HW_SUPPORTS_RC_TABLE |
2825 +               IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
2826
2827         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
2828                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
2829 --- a/drivers/net/wireless/ath/carl9170/main.c
2830 +++ b/drivers/net/wireless/ath/carl9170/main.c
2831 @@ -1878,7 +1878,8 @@ void *carl9170_alloc(size_t priv_size)
2832                      IEEE80211_HW_PS_NULLFUNC_STACK |
2833                      IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
2834                      IEEE80211_HW_SUPPORTS_RC_TABLE |
2835 -                    IEEE80211_HW_SIGNAL_DBM;
2836 +                    IEEE80211_HW_SIGNAL_DBM |
2837 +                    IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
2838
2839         if (!modparam_noht) {
2840                 /*
2841 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
2842 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
2843 @@ -6133,7 +6133,8 @@ static int rt2800_probe_hw_mode(struct r
2844             IEEE80211_HW_SUPPORTS_PS |
2845             IEEE80211_HW_PS_NULLFUNC_STACK |
2846             IEEE80211_HW_AMPDU_AGGREGATION |
2847 -           IEEE80211_HW_REPORTS_TX_ACK_STATUS;
2848 +           IEEE80211_HW_REPORTS_TX_ACK_STATUS |
2849 +           IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
2850
2851         /*
2852          * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
2853 --- a/include/net/mac80211.h
2854 +++ b/include/net/mac80211.h
2855 @@ -1499,6 +1499,7 @@ enum ieee80211_hw_flags {
2856         IEEE80211_HW_SUPPORTS_RC_TABLE                  = 1<<24,
2857         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
2858         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
2859 +       IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
2860  };
2861
2862  /**