package/mac80211/patches/300-pending_work.patch

   1 --- a/drivers/net/wireless/ath/ath5k/base.c
   2 +++ b/drivers/net/wireless/ath/ath5k/base.c
   3 @@ -325,6 +325,8 @@ ath5k_setup_channels(struct ath5k_hw *ah
   4                 if (!ath5k_is_standard_channel(ch, band))
   5                         continue;
   6
   7 +               channels[count].max_power = AR5K_TUNE_MAX_TXPOWER/2;
   8 +
   9                 count++;
  10         }
  11
  12 --- a/net/mac80211/agg-rx.c
  13 +++ b/net/mac80211/agg-rx.c
  14 @@ -203,6 +203,8 @@ static void ieee80211_send_addba_resp(st
  15                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  16         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
  17                 memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
  18 +       else if (sdata->vif.type == NL80211_IFTYPE_WDS)
  19 +               memcpy(mgmt->bssid, da, ETH_ALEN);
  20
  21         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  22                                           IEEE80211_STYPE_ACTION);
  23 --- a/net/mac80211/agg-tx.c
  24 +++ b/net/mac80211/agg-tx.c
  25 @@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
  26         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  27         if (sdata->vif.type == NL80211_IFTYPE_AP ||
  28             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
  29 -           sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
  30 +           sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
  31 +           sdata->vif.type == NL80211_IFTYPE_WDS)
  32                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
  33         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
  34                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  35 @@ -460,6 +461,7 @@ int ieee80211_start_tx_ba_session(struct
  36             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  37             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  38             sdata->vif.type != NL80211_IFTYPE_AP &&
  39 +           sdata->vif.type != NL80211_IFTYPE_WDS &&
  40             sdata->vif.type != NL80211_IFTYPE_ADHOC)
  41                 return -EINVAL;
  42
  43 @@ -869,7 +871,7 @@ void ieee80211_process_addba_resp(struct
  44
  45         } else {
  46                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
  47 -                                               true);
  48 +                                               false);
  49         }
  50
  51   out:
  52 --- a/net/mac80211/debugfs_sta.c
  53 +++ b/net/mac80211/debugfs_sta.c
  54 @@ -63,11 +63,11 @@ static ssize_t sta_flags_read(struct fil
  55         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  56
  57         int res = scnprintf(buf, sizeof(buf),
  58 -                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  59 +                           "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
  60                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
  61                             TEST(PS_DRIVER), TEST(AUTHORIZED),
  62                             TEST(SHORT_PREAMBLE),
  63 -                           TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
  64 +                           TEST(WME), TEST(CLEAR_PS_FILT),
  65                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  66                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  67                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
  68 --- a/net/mac80211/iface.c
  69 +++ b/net/mac80211/iface.c
  70 @@ -420,7 +420,6 @@ int ieee80211_do_open(struct wireless_de
  71         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  72         struct net_device *dev = wdev->netdev;
  73         struct ieee80211_local *local = sdata->local;
  74 -       struct sta_info *sta;
  75         u32 changed = 0;
  76         int res;
  77         u32 hw_reconf_flags = 0;
  78 @@ -575,30 +574,8 @@ int ieee80211_do_open(struct wireless_de
  79
  80         set_bit(SDATA_STATE_RUNNING, &sdata->state);
  81
  82 -       if (sdata->vif.type == NL80211_IFTYPE_WDS) {
  83 -               /* Create STA entry for the WDS peer */
  84 -               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
  85 -                                    GFP_KERNEL);
  86 -               if (!sta) {
  87 -                       res = -ENOMEM;
  88 -                       goto err_del_interface;
  89 -               }
  90 -
  91 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
  92 -               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
  93 -               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
  94 -
  95 -               res = sta_info_insert(sta);
  96 -               if (res) {
  97 -                       /* STA has been freed */
  98 -                       goto err_del_interface;
  99 -               }
 100 -
 101 -               rate_control_rate_init(sta);
 102 -               netif_carrier_on(dev);
 103 -       } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
 104 +       if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 105                 rcu_assign_pointer(local->p2p_sdata, sdata);
 106 -       }
 107
 108         /*
 109          * set_multicast_list will be invoked by the networking core
 110 @@ -849,7 +826,7 @@ static void ieee80211_do_stop(struct iee
 111                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 112                         if (info->control.vif == &sdata->vif) {
 113                                 __skb_unlink(skb, &local->pending[i]);
 114 -                               dev_kfree_skb_irq(skb);
 115 +                               ieee80211_free_txskb(&local->hw, skb);
 116                         }
 117                 }
 118         }
 119 @@ -997,6 +974,72 @@ static void ieee80211_if_setup(struct ne
 120         dev->destructor = free_netdev;
 121  }
 122
 123 +static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 124 +                                        struct sk_buff *skb)
 125 +{
 126 +       struct ieee80211_local *local = sdata->local;
 127 +       struct ieee80211_rx_status *rx_status;
 128 +       struct ieee802_11_elems elems;
 129 +       struct ieee80211_mgmt *mgmt;
 130 +       struct sta_info *sta;
 131 +       size_t baselen;
 132 +       u32 rates = 0;
 133 +       u16 stype;
 134 +       bool new = false;
 135 +       enum ieee80211_band band = local->hw.conf.channel->band;
 136 +       struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
 137 +
 138 +       rx_status = IEEE80211_SKB_RXCB(skb);
 139 +       mgmt = (struct ieee80211_mgmt *) skb->data;
 140 +       stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 141 +
 142 +       if (stype != IEEE80211_STYPE_BEACON)
 143 +               return;
 144 +
 145 +       baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
 146 +       if (baselen > skb->len)
 147 +               return;
 148 +
 149 +       ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
 150 +                              skb->len - baselen, &elems);
 151 +
 152 +       rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 153 +
 154 +       rcu_read_lock();
 155 +
 156 +       sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
 157 +
 158 +       if (!sta) {
 159 +               rcu_read_unlock();
 160 +               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 161 +                                    GFP_KERNEL);
 162 +               if (!sta)
 163 +                       return;
 164 +
 165 +               new = true;
 166 +       }
 167 +
 168 +       sta->last_rx = jiffies;
 169 +       sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
 170 +
 171 +       if (elems.ht_cap_elem)
 172 +               ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
 173 +                               elems.ht_cap_elem, &sta->sta.ht_cap);
 174 +
 175 +       if (elems.wmm_param)
 176 +               set_sta_flag(sta, WLAN_STA_WME);
 177 +
 178 +       if (new) {
 179 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 180 +               sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 181 +               sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 182 +               rate_control_rate_init(sta);
 183 +               sta_info_insert_rcu(sta);
 184 +       }
 185 +
 186 +       rcu_read_unlock();
 187 +}
 188 +
 189  static void ieee80211_iface_work(struct work_struct *work)
 190  {
 191         struct ieee80211_sub_if_data *sdata =
 192 @@ -1101,6 +1144,9 @@ static void ieee80211_iface_work(struct
 193                                 break;
 194                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 195                         break;
 196 +               case NL80211_IFTYPE_WDS:
 197 +                       ieee80211_wds_rx_queued_mgmt(sdata, skb);
 198 +                       break;
 199                 default:
 200                         WARN(1, "frame for unexpected interface type");
 201                         break;
 202 --- a/net/mac80211/rx.c
 203 +++ b/net/mac80211/rx.c
 204 @@ -2279,6 +2279,7 @@ ieee80211_rx_h_action(struct ieee80211_r
 205                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
 206                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 207                     sdata->vif.type != NL80211_IFTYPE_AP &&
 208 +                   sdata->vif.type != NL80211_IFTYPE_WDS &&
 209                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
 210                         break;
 211
 212 @@ -2496,14 +2497,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
 213
 214         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
 215             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 216 -           sdata->vif.type != NL80211_IFTYPE_STATION)
 217 +           sdata->vif.type != NL80211_IFTYPE_STATION &&
 218 +           sdata->vif.type != NL80211_IFTYPE_WDS)
 219                 return RX_DROP_MONITOR;
 220
 221         switch (stype) {
 222         case cpu_to_le16(IEEE80211_STYPE_AUTH):
 223         case cpu_to_le16(IEEE80211_STYPE_BEACON):
 224         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 225 -               /* process for all: mesh, mlme, ibss */
 226 +               /* process for all: mesh, mlme, ibss, wds */
 227                 break;
 228         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 229         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
 230 @@ -2827,10 +2829,16 @@ static int prepare_for_handlers(struct i
 231                 }
 232                 break;
 233         case NL80211_IFTYPE_WDS:
 234 -               if (bssid || !ieee80211_is_data(hdr->frame_control))
 235 -                       return 0;
 236                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
 237                         return 0;
 238 +
 239 +               if (ieee80211_is_data(hdr->frame_control) ||
 240 +                   ieee80211_is_action(hdr->frame_control)) {
 241 +                       if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
 242 +                               return 0;
 243 +               } else if (!ieee80211_is_beacon(hdr->frame_control))
 244 +                       return 0;
 245 +
 246                 break;
 247         case NL80211_IFTYPE_P2P_DEVICE:
 248                 if (!ieee80211_is_public_action(hdr, skb->len) &&
 249 --- a/net/mac80211/sta_info.h
 250 +++ b/net/mac80211/sta_info.h
 251 @@ -32,7 +32,6 @@
 252   * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
 253   *     frames.
 254   * @WLAN_STA_WME: Station is a QoS-STA.
 255 - * @WLAN_STA_WDS: Station is one of our WDS peers.
 256   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
 257   *     IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
 258   *     frame to this station is transmitted.
 259 @@ -64,7 +63,6 @@ enum ieee80211_sta_info_flags {
 260         WLAN_STA_AUTHORIZED,
 261         WLAN_STA_SHORT_PREAMBLE,
 262         WLAN_STA_WME,
 263 -       WLAN_STA_WDS,
 264         WLAN_STA_CLEAR_PS_FILT,
 265         WLAN_STA_MFP,
 266         WLAN_STA_BLOCK_BA,
 267 --- a/net/mac80211/status.c
 268 +++ b/net/mac80211/status.c
 269 @@ -34,7 +34,7 @@ void ieee80211_tx_status_irqsafe(struct
 270                 skb_queue_len(&local->skb_queue_unreliable);
 271         while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
 272                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
 273 -               dev_kfree_skb_irq(skb);
 274 +               ieee80211_free_txskb(hw, skb);
 275                 tmp--;
 276                 I802_DEBUG_INC(local->tx_status_drop);
 277         }
 278 @@ -159,7 +159,7 @@ static void ieee80211_handle_filtered_fr
 279                            "dropped TX filtered frame, queue_len=%d PS=%d @%lu\n",
 280                            skb_queue_len(&sta->tx_filtered[ac]),
 281                            !!test_sta_flag(sta, WLAN_STA_PS_STA), jiffies);
 282 -       dev_kfree_skb(skb);
 283 +       ieee80211_free_txskb(&local->hw, skb);
 284  }
 285
 286  static void ieee80211_check_pending_bar(struct sta_info *sta, u8 *addr, u8 tid)
 287 @@ -324,6 +324,75 @@ static void ieee80211_add_tx_radiotap_he
 288
 289  }
 290
 291 +static void ieee80211_report_used_skb(struct ieee80211_local *local,
 292 +                                     struct sk_buff *skb, bool dropped)
 293 +{
 294 +       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 295 +       struct ieee80211_hdr *hdr = (void *)skb->data;
 296 +       bool acked = info->flags & IEEE80211_TX_STAT_ACK;
 297 +
 298 +       if (dropped)
 299 +               acked = false;
 300 +
 301 +       if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
 302 +               struct ieee80211_sub_if_data *sdata = NULL;
 303 +               struct ieee80211_sub_if_data *iter_sdata;
 304 +               u64 cookie = (unsigned long)skb;
 305 +
 306 +               rcu_read_lock();
 307 +
 308 +               if (skb->dev) {
 309 +                       list_for_each_entry_rcu(iter_sdata, &local->interfaces,
 310 +                                               list) {
 311 +                               if (!iter_sdata->dev)
 312 +                                       continue;
 313 +
 314 +                               if (skb->dev == iter_sdata->dev) {
 315 +                                       sdata = iter_sdata;
 316 +                                       break;
 317 +                               }
 318 +                       }
 319 +               } else {
 320 +                       sdata = rcu_dereference(local->p2p_sdata);
 321 +               }
 322 +
 323 +               if (!sdata)
 324 +                       skb->dev = NULL;
 325 +               else if (ieee80211_is_nullfunc(hdr->frame_control) ||
 326 +                        ieee80211_is_qos_nullfunc(hdr->frame_control)) {
 327 +                       cfg80211_probe_status(sdata->dev, hdr->addr1,
 328 +                                             cookie, acked, GFP_ATOMIC);
 329 +               } else {
 330 +                       cfg80211_mgmt_tx_status(&sdata->wdev, cookie, skb->data,
 331 +                                               skb->len, acked, GFP_ATOMIC);
 332 +               }
 333 +
 334 +               rcu_read_unlock();
 335 +       }
 336 +
 337 +       if (unlikely(info->ack_frame_id)) {
 338 +               struct sk_buff *ack_skb;
 339 +               unsigned long flags;
 340 +
 341 +               spin_lock_irqsave(&local->ack_status_lock, flags);
 342 +               ack_skb = idr_find(&local->ack_status_frames,
 343 +                                  info->ack_frame_id);
 344 +               if (ack_skb)
 345 +                       idr_remove(&local->ack_status_frames,
 346 +                                  info->ack_frame_id);
 347 +               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 348 +
 349 +               if (ack_skb) {
 350 +                       if (!dropped) {
 351 +                               /* consumes ack_skb */
 352 +                               skb_complete_wifi_ack(ack_skb, acked);
 353 +                       } else {
 354 +                               dev_kfree_skb_any(ack_skb);
 355 +                       }
 356 +               }
 357 +       }
 358 +}
 359 +
 360  /*
 361   * Use a static threshold for now, best value to be determined
 362   * by testing ...
 363 @@ -515,50 +584,7 @@ void ieee80211_tx_status(struct ieee8021
 364                                         msecs_to_jiffies(10));
 365         }
 366
 367 -       if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
 368 -               u64 cookie = (unsigned long)skb;
 369 -               acked = info->flags & IEEE80211_TX_STAT_ACK;
 370 -
 371 -               if (ieee80211_is_nullfunc(hdr->frame_control) ||
 372 -                   ieee80211_is_qos_nullfunc(hdr->frame_control)) {
 373 -                       cfg80211_probe_status(skb->dev, hdr->addr1,
 374 -                                             cookie, acked, GFP_ATOMIC);
 375 -               } else if (skb->dev) {
 376 -                       cfg80211_mgmt_tx_status(
 377 -                               skb->dev->ieee80211_ptr, cookie, skb->data,
 378 -                               skb->len, acked, GFP_ATOMIC);
 379 -               } else {
 380 -                       struct ieee80211_sub_if_data *p2p_sdata;
 381 -
 382 -                       rcu_read_lock();
 383 -
 384 -                       p2p_sdata = rcu_dereference(local->p2p_sdata);
 385 -                       if (p2p_sdata) {
 386 -                               cfg80211_mgmt_tx_status(
 387 -                                       &p2p_sdata->wdev, cookie, skb->data,
 388 -                                       skb->len, acked, GFP_ATOMIC);
 389 -                       }
 390 -                       rcu_read_unlock();
 391 -               }
 392 -       }
 393 -
 394 -       if (unlikely(info->ack_frame_id)) {
 395 -               struct sk_buff *ack_skb;
 396 -               unsigned long flags;
 397 -
 398 -               spin_lock_irqsave(&local->ack_status_lock, flags);
 399 -               ack_skb = idr_find(&local->ack_status_frames,
 400 -                                  info->ack_frame_id);
 401 -               if (ack_skb)
 402 -                       idr_remove(&local->ack_status_frames,
 403 -                                  info->ack_frame_id);
 404 -               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 405 -
 406 -               /* consumes ack_skb */
 407 -               if (ack_skb)
 408 -                       skb_complete_wifi_ack(ack_skb,
 409 -                               info->flags & IEEE80211_TX_STAT_ACK);
 410 -       }
 411 +       ieee80211_report_used_skb(local, skb, false);
 412
 413         /* this was a transmitted frame, but now we want to reuse it */
 414         skb_orphan(skb);
 415 @@ -634,25 +660,17 @@ EXPORT_SYMBOL(ieee80211_report_low_ack);
 416  void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
 417  {
 418         struct ieee80211_local *local = hw_to_local(hw);
 419 -       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 420 -
 421 -       if (unlikely(info->ack_frame_id)) {
 422 -               struct sk_buff *ack_skb;
 423 -               unsigned long flags;
 424 -
 425 -               spin_lock_irqsave(&local->ack_status_lock, flags);
 426 -               ack_skb = idr_find(&local->ack_status_frames,
 427 -                                  info->ack_frame_id);
 428 -               if (ack_skb)
 429 -                       idr_remove(&local->ack_status_frames,
 430 -                                  info->ack_frame_id);
 431 -               spin_unlock_irqrestore(&local->ack_status_lock, flags);
 432 -
 433 -               /* consumes ack_skb */
 434 -               if (ack_skb)
 435 -                       dev_kfree_skb_any(ack_skb);
 436 -       }
 437
 438 +       ieee80211_report_used_skb(local, skb, true);
 439         dev_kfree_skb_any(skb);
 440  }
 441  EXPORT_SYMBOL(ieee80211_free_txskb);
 442 +
 443 +void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 444 +                             struct sk_buff_head *skbs)
 445 +{
 446 +       struct sk_buff *skb;
 447 +
 448 +       while ((skb = __skb_dequeue(skbs)))
 449 +               ieee80211_free_txskb(hw, skb);
 450 +}
 451 --- a/drivers/net/wireless/p54/main.c
 452 +++ b/drivers/net/wireless/p54/main.c
 453 @@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(stru
 454  static int p54_beacon_update(struct p54_common *priv,
 455                         struct ieee80211_vif *vif)
 456  {
 457 +       struct ieee80211_tx_control control = { };
 458         struct sk_buff *beacon;
 459         int ret;
 460
 461 @@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_
 462          * to cancel the old beacon template by hand, instead the firmware
 463          * will release the previous one through the feedback mechanism.
 464          */
 465 -       p54_tx_80211(priv->hw, NULL, beacon);
 466 +       p54_tx_80211(priv->hw, &control, beacon);
 467         priv->tsf_high32 = 0;
 468         priv->tsf_low32 = 0;
 469
 470 --- a/net/wireless/reg.c
 471 +++ b/net/wireless/reg.c
 472 @@ -352,6 +352,9 @@ static void reg_regdb_search(struct work
 473         struct reg_regdb_search_request *request;
 474         const struct ieee80211_regdomain *curdom, *regdom;
 475         int i, r;
 476 +       bool set_reg = false;
 477 +
 478 +       mutex_lock(&cfg80211_mutex);
 479
 480         mutex_lock(&reg_regdb_search_mutex);
 481         while (!list_empty(&reg_regdb_search_list)) {
 482 @@ -367,9 +370,7 @@ static void reg_regdb_search(struct work
 483                                 r = reg_copy_regd(&regdom, curdom);
 484                                 if (r)
 485                                         break;
 486 -                               mutex_lock(&cfg80211_mutex);
 487 -                               set_regdom(regdom);
 488 -                               mutex_unlock(&cfg80211_mutex);
 489 +                               set_reg = true;
 490                                 break;
 491                         }
 492                 }
 493 @@ -377,6 +378,11 @@ static void reg_regdb_search(struct work
 494                 kfree(request);
 495         }
 496         mutex_unlock(&reg_regdb_search_mutex);
 497 +
 498 +       if (set_reg)
 499 +               set_regdom(regdom);
 500 +
 501 +       mutex_unlock(&cfg80211_mutex);
 502  }
 503
 504  static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
 505 --- a/drivers/net/wireless/ath/ath9k/recv.c
 506 +++ b/drivers/net/wireless/ath/ath9k/recv.c
 507 @@ -424,8 +424,8 @@ u32 ath_calcrxfilter(struct ath_softc *s
 508                 rfilt |= ATH9K_RX_FILTER_COMP_BAR;
 509
 510         if (sc->nvifs > 1 || (sc->rx.rxfilter & FIF_OTHER_BSS)) {
 511 -               /* The following may also be needed for other older chips */
 512 -               if (sc->sc_ah->hw_version.macVersion == AR_SREV_VERSION_9160)
 513 +               /* This is needed for older chips */
 514 +               if (sc->sc_ah->hw_version.macVersion <= AR_SREV_VERSION_9160)
 515                         rfilt |= ATH9K_RX_FILTER_PROM;
 516                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
 517         }
 518 --- a/net/mac80211/mlme.c
 519 +++ b/net/mac80211/mlme.c
 520 @@ -818,23 +818,71 @@ void ieee80211_sta_process_chanswitch(st
 521  }
 522
 523  static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
 524 -                                       u16 capab_info, u8 *pwr_constr_elem,
 525 -                                       u8 pwr_constr_elem_len)
 526 +                                       struct ieee80211_channel *channel,
 527 +                                       const u8 *country_ie, u8 country_ie_len,
 528 +                                       const u8 *pwr_constr_elem)
 529  {
 530 -       struct ieee80211_conf *conf = &sdata->local->hw.conf;
 531 +       struct ieee80211_country_ie_triplet *triplet;
 532 +       int chan = ieee80211_frequency_to_channel(channel->center_freq);
 533 +       int i, chan_pwr, chan_increment, new_ap_level;
 534 +       bool have_chan_pwr = false;
 535
 536 -       if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
 537 +       /* Invalid IE */
 538 +       if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
 539                 return;
 540
 541 -       /* Power constraint IE length should be 1 octet */
 542 -       if (pwr_constr_elem_len != 1)
 543 -               return;
 544 +       triplet = (void *)(country_ie + 3);
 545 +       country_ie_len -= 3;
 546
 547 -       if ((*pwr_constr_elem <= conf->channel->max_reg_power) &&
 548 -           (*pwr_constr_elem != sdata->local->power_constr_level)) {
 549 -               sdata->local->power_constr_level = *pwr_constr_elem;
 550 -               ieee80211_hw_config(sdata->local, 0);
 551 +       switch (channel->band) {
 552 +       default:
 553 +               WARN_ON_ONCE(1);
 554 +               /* fall through */
 555 +       case IEEE80211_BAND_2GHZ:
 556 +       case IEEE80211_BAND_60GHZ:
 557 +               chan_increment = 1;
 558 +               break;
 559 +       case IEEE80211_BAND_5GHZ:
 560 +               chan_increment = 4;
 561 +               break;
 562         }
 563 +
 564 +       /* find channel */
 565 +       while (country_ie_len >= 3) {
 566 +               u8 first_channel = triplet->chans.first_channel;
 567 +
 568 +               if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
 569 +                       goto next;
 570 +
 571 +               for (i = 0; i < triplet->chans.num_channels; i++) {
 572 +                       if (first_channel + i * chan_increment == chan) {
 573 +                               have_chan_pwr = true;
 574 +                               chan_pwr = triplet->chans.max_power;
 575 +                               break;
 576 +                       }
 577 +               }
 578 +               if (have_chan_pwr)
 579 +                       break;
 580 +
 581 + next:
 582 +               triplet++;
 583 +               country_ie_len -= 3;
 584 +       }
 585 +
 586 +       if (!have_chan_pwr)
 587 +               return;
 588 +
 589 +       new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
 590 +
 591 +       if (sdata->local->ap_power_level == new_ap_level)
 592 +               return;
 593 +
 594 +       sdata_info(sdata,
 595 +                  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
 596 +                  new_ap_level, chan_pwr, *pwr_constr_elem,
 597 +                  sdata->u.mgd.bssid);
 598 +       sdata->local->ap_power_level = new_ap_level;
 599 +       ieee80211_hw_config(sdata->local, 0);
 600  }
 601
 602  void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
 603 @@ -1390,7 +1438,7 @@ static void ieee80211_set_disassoc(struc
 604         sta = sta_info_get(sdata, ifmgd->bssid);
 605         if (sta) {
 606                 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
 607 -               ieee80211_sta_tear_down_BA_sessions(sta, tx);
 608 +               ieee80211_sta_tear_down_BA_sessions(sta, false);
 609         }
 610         mutex_unlock(&local->sta_mtx);
 611
 612 @@ -1438,7 +1486,7 @@ static void ieee80211_set_disassoc(struc
 613         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
 614         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
 615
 616 -       local->power_constr_level = 0;
 617 +       local->ap_power_level = 0;
 618
 619         del_timer_sync(&local->dynamic_ps_timer);
 620         cancel_work_sync(&local->dynamic_ps_enable_work);
 621 @@ -2530,15 +2578,13 @@ static void ieee80211_rx_mgmt_beacon(str
 622                                                   bssid, true);
 623         }
 624
 625 -       /* Note: country IE parsing is done for us by cfg80211 */
 626 -       if (elems.country_elem) {
 627 -               /* TODO: IBSS also needs this */
 628 -               if (elems.pwr_constr_elem)
 629 -                       ieee80211_handle_pwr_constr(sdata,
 630 -                               le16_to_cpu(mgmt->u.probe_resp.capab_info),
 631 -                               elems.pwr_constr_elem,
 632 -                               elems.pwr_constr_elem_len);
 633 -       }
 634 +       if (elems.country_elem && elems.pwr_constr_elem &&
 635 +           mgmt->u.probe_resp.capab_info &
 636 +                               cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
 637 +               ieee80211_handle_pwr_constr(sdata, local->oper_channel,
 638 +                                           elems.country_elem,
 639 +                                           elems.country_elem_len,
 640 +                                           elems.pwr_constr_elem);
 641
 642         ieee80211_bss_info_change_notify(sdata, changed);
 643  }
 644 @@ -3526,6 +3572,7 @@ int ieee80211_mgd_deauth(struct ieee8021
 645  {
 646         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 647         u8 frame_buf[DEAUTH_DISASSOC_LEN];
 648 +       bool tx = !req->local_state_change;
 649
 650         mutex_lock(&ifmgd->mtx);
 651
 652 @@ -3542,12 +3589,12 @@ int ieee80211_mgd_deauth(struct ieee8021
 653         if (ifmgd->associated &&
 654             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
 655                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
 656 -                                      req->reason_code, true, frame_buf);
 657 +                                      req->reason_code, tx, frame_buf);
 658         } else {
 659                 drv_mgd_prepare_tx(sdata->local, sdata);
 660                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
 661                                                IEEE80211_STYPE_DEAUTH,
 662 -                                              req->reason_code, true,
 663 +                                              req->reason_code, tx,
 664                                                frame_buf);
 665         }
 666
 667 --- a/net/mac80211/sta_info.c
 668 +++ b/net/mac80211/sta_info.c
 669 @@ -585,7 +585,7 @@ static bool sta_info_cleanup_expire_buff
 670                  */
 671                 if (!skb)
 672                         break;
 673 -               dev_kfree_skb(skb);
 674 +               ieee80211_free_txskb(&local->hw, skb);
 675         }
 676
 677         /*
 678 @@ -614,7 +614,7 @@ static bool sta_info_cleanup_expire_buff
 679                 local->total_ps_buffered--;
 680                 ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
 681                        sta->sta.addr);
 682 -               dev_kfree_skb(skb);
 683 +               ieee80211_free_txskb(&local->hw, skb);
 684         }
 685
 686         /*
 687 @@ -674,7 +674,7 @@ int __must_check __sta_info_destroy(stru
 688          * will be sufficient.
 689          */
 690         set_sta_flag(sta, WLAN_STA_BLOCK_BA);
 691 -       ieee80211_sta_tear_down_BA_sessions(sta, true);
 692 +       ieee80211_sta_tear_down_BA_sessions(sta, false);
 693
 694         ret = sta_info_hash_del(local, sta);
 695         if (ret)
 696 @@ -730,8 +730,8 @@ int __must_check __sta_info_destroy(stru
 697
 698         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 699                 local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
 700 -               __skb_queue_purge(&sta->ps_tx_buf[ac]);
 701 -               __skb_queue_purge(&sta->tx_filtered[ac]);
 702 +               ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
 703 +               ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
 704         }
 705
 706  #ifdef CONFIG_MAC80211_MESH
 707 @@ -765,7 +765,7 @@ int __must_check __sta_info_destroy(stru
 708                 tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
 709                 if (!tid_tx)
 710                         continue;
 711 -               __skb_queue_purge(&tid_tx->pending);
 712 +               ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
 713                 kfree(tid_tx);
 714         }
 715
 716 --- a/drivers/net/wireless/ath/ath5k/phy.c
 717 +++ b/drivers/net/wireless/ath/ath5k/phy.c
 718 @@ -1977,11 +1977,13 @@ ath5k_hw_set_spur_mitigation_filter(stru
 719                         spur_delta_phase = (spur_offset << 18) / 25;
 720                         spur_freq_sigma_delta = (spur_delta_phase >> 10);
 721                         symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 2;
 722 +                       break;
 723                 case AR5K_BWMODE_5MHZ:
 724                         /* Both sample_freq and chip_freq are 10MHz (?) */
 725                         spur_delta_phase = (spur_offset << 19) / 25;
 726                         spur_freq_sigma_delta = (spur_delta_phase >> 10);
 727                         symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 4;
 728 +                       break;
 729                 default:
 730                         if (channel->band == IEEE80211_BAND_5GHZ) {
 731                                 /* Both sample_freq and chip_freq are 40MHz */
 732 --- a/net/mac80211/ieee80211_i.h
 733 +++ b/net/mac80211/ieee80211_i.h
 734 @@ -1062,7 +1062,7 @@ struct ieee80211_local {
 735         bool disable_dynamic_ps;
 736
 737         int user_power_level; /* in dBm */
 738 -       int power_constr_level; /* in dBm */
 739 +       int ap_power_level; /* in dBm */
 740
 741         enum ieee80211_smps_mode smps_mode;
 742
 743 @@ -1170,7 +1170,6 @@ struct ieee802_11_elems {
 744         u8 prep_len;
 745         u8 perr_len;
 746         u8 country_elem_len;
 747 -       u8 pwr_constr_elem_len;
 748         u8 quiet_elem_len;
 749         u8 num_of_quiet_elem;   /* can be more the one */
 750         u8 timeout_int_len;
 751 @@ -1318,6 +1317,8 @@ netdev_tx_t ieee80211_monitor_start_xmit
 752                                          struct net_device *dev);
 753  netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 754                                        struct net_device *dev);
 755 +void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 756 +                             struct sk_buff_head *skbs);
 757
 758  /* HT */
 759  void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
 760 --- a/net/mac80211/util.c
 761 +++ b/net/mac80211/util.c
 762 @@ -406,7 +406,7 @@ void ieee80211_add_pending_skb(struct ie
 763         int queue = info->hw_queue;
 764
 765         if (WARN_ON(!info->control.vif)) {
 766 -               kfree_skb(skb);
 767 +               ieee80211_free_txskb(&local->hw, skb);
 768                 return;
 769         }
 770
 771 @@ -431,7 +431,7 @@ void ieee80211_add_pending_skbs_fn(struc
 772                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 773
 774                 if (WARN_ON(!info->control.vif)) {
 775 -                       kfree_skb(skb);
 776 +                       ieee80211_free_txskb(&local->hw, skb);
 777                         continue;
 778                 }
 779
 780 @@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start
 781                         elems->country_elem_len = elen;
 782                         break;
 783                 case WLAN_EID_PWR_CONSTRAINT:
 784 +                       if (elen != 1) {
 785 +                               elem_parse_failed = true;
 786 +                               break;
 787 +                       }
 788                         elems->pwr_constr_elem = pos;
 789 -                       elems->pwr_constr_elem_len = elen;
 790                         break;
 791                 case WLAN_EID_TIMEOUT_INTERVAL:
 792                         elems->timeout_int = pos;
 793 --- a/net/mac80211/main.c
 794 +++ b/net/mac80211/main.c
 795 @@ -154,13 +154,11 @@ int ieee80211_hw_config(struct ieee80211
 796
 797         if (test_bit(SCAN_SW_SCANNING, &local->scanning) ||
 798             test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
 799 -           test_bit(SCAN_HW_SCANNING, &local->scanning))
 800 +           test_bit(SCAN_HW_SCANNING, &local->scanning) ||
 801 +           !local->ap_power_level)
 802                 power = chan->max_power;
 803         else
 804 -               power = local->power_constr_level ?
 805 -                       min(chan->max_power,
 806 -                               (chan->max_reg_power  - local->power_constr_level)) :
 807 -                       chan->max_power;
 808 +               power = min(chan->max_power, local->ap_power_level);
 809
 810         if (local->user_power_level >= 0)
 811                 power = min(power, local->user_power_level);
 812 --- a/include/net/cfg80211.h
 813 +++ b/include/net/cfg80211.h
 814 @@ -1218,6 +1218,7 @@ struct cfg80211_deauth_request {
 815         const u8 *ie;
 816         size_t ie_len;
 817         u16 reason_code;
 818 +       bool local_state_change;
 819  };
 820
 821  /**
 822 --- a/net/wireless/mlme.c
 823 +++ b/net/wireless/mlme.c
 824 @@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg802
 825                 .reason_code = reason,
 826                 .ie = ie,
 827                 .ie_len = ie_len,
 828 +               .local_state_change = local_state_change,
 829         };
 830
 831         ASSERT_WDEV_LOCK(wdev);
 832
 833 -       if (local_state_change) {
 834 -               if (wdev->current_bss &&
 835 -                   ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
 836 -                       cfg80211_unhold_bss(wdev->current_bss);
 837 -                       cfg80211_put_bss(&wdev->current_bss->pub);
 838 -                       wdev->current_bss = NULL;
 839 -               }
 840 -
 841 +       if (local_state_change && (!wdev->current_bss ||
 842 +           !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
 843                 return 0;
 844 -       }
 845
 846         return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 847  }
 848 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 849 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
 850 @@ -386,7 +386,7 @@ static void ath_tx_complete_aggr(struct
 851         u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0, seq_first;
 852         u32 ba[WME_BA_BMP_SIZE >> 5];
 853         int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
 854 -       bool rc_update = true;
 855 +       bool rc_update = true, isba;
 856         struct ieee80211_tx_rate rates[4];
 857         struct ath_frame_info *fi;
 858         int nframes;
 859 @@ -430,13 +430,17 @@ static void ath_tx_complete_aggr(struct
 860         tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
 861         tid = ATH_AN_2_TID(an, tidno);
 862         seq_first = tid->seq_start;
 863 +       isba = ts->ts_flags & ATH9K_TX_BA;
 864
 865         /*
 866          * The hardware occasionally sends a tx status for the wrong TID.
 867          * In this case, the BA status cannot be considered valid and all
 868          * subframes need to be retransmitted
 869 +        *
 870 +        * Only BlockAcks have a TID and therefore normal Acks cannot be
 871 +        * checked
 872          */
 873 -       if (tidno != ts->tid)
 874 +       if (isba && tidno != ts->tid)
 875                 txok = false;
 876
 877         isaggr = bf_isaggr(bf);
 878 --- a/net/mac80211/cfg.c
 879 +++ b/net/mac80211/cfg.c
 880 @@ -2563,6 +2563,9 @@ static void ieee80211_mgmt_frame_registe
 881                 else
 882                         local->probe_req_reg--;
 883
 884 +               if (!local->open_count)
 885 +                       break;
 886 +
 887                 ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 888                 break;
 889         default:
 890 --- a/net/mac80211/tx.c
 891 +++ b/net/mac80211/tx.c
 892 @@ -354,7 +354,7 @@ static void purge_old_ps_buffers(struct
 893                         total += skb_queue_len(&sta->ps_tx_buf[ac]);
 894                         if (skb) {
 895                                 purged++;
 896 -                               dev_kfree_skb(skb);
 897 +                               ieee80211_free_txskb(&local->hw, skb);
 898                                 break;
 899                         }
 900                 }
 901 @@ -466,7 +466,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
 902                         ps_dbg(tx->sdata,
 903                                "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
 904                                sta->sta.addr, ac);
 905 -                       dev_kfree_skb(old);
 906 +                       ieee80211_free_txskb(&local->hw, old);
 907                 } else
 908                         tx->local->total_ps_buffered++;
 909
 910 @@ -1103,7 +1103,7 @@ static bool ieee80211_tx_prep_agg(struct
 911                 spin_unlock(&tx->sta->lock);
 912
 913                 if (purge_skb)
 914 -                       dev_kfree_skb(purge_skb);
 915 +                       ieee80211_free_txskb(&tx->local->hw, purge_skb);
 916         }
 917
 918         /* reset session timer */
 919 @@ -1214,7 +1214,7 @@ static bool ieee80211_tx_frags(struct ie
 920  #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 921                 if (WARN_ON_ONCE(q >= local->hw.queues)) {
 922                         __skb_unlink(skb, skbs);
 923 -                       dev_kfree_skb(skb);
 924 +                       ieee80211_free_txskb(&local->hw, skb);
 925                         continue;
 926                 }
 927  #endif
 928 @@ -1356,9 +1356,9 @@ static int invoke_tx_handlers(struct iee
 929         if (unlikely(res == TX_DROP)) {
 930                 I802_DEBUG_INC(tx->local->tx_handlers_drop);
 931                 if (tx->skb)
 932 -                       dev_kfree_skb(tx->skb);
 933 +                       ieee80211_free_txskb(&tx->local->hw, tx->skb);
 934                 else
 935 -                       __skb_queue_purge(&tx->skbs);
 936 +                       ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
 937                 return -1;
 938         } else if (unlikely(res == TX_QUEUED)) {
 939                 I802_DEBUG_INC(tx->local->tx_handlers_queued);
 940 @@ -1393,7 +1393,7 @@ static bool ieee80211_tx(struct ieee8021
 941         res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
 942
 943         if (unlikely(res_prepare == TX_DROP)) {
 944 -               dev_kfree_skb(skb);
 945 +               ieee80211_free_txskb(&local->hw, skb);
 946                 goto out;
 947         } else if (unlikely(res_prepare == TX_QUEUED)) {
 948                 goto out;
 949 @@ -1465,7 +1465,7 @@ void ieee80211_xmit(struct ieee80211_sub
 950         headroom = max_t(int, 0, headroom);
 951
 952         if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
 953 -               dev_kfree_skb(skb);
 954 +               ieee80211_free_txskb(&local->hw, skb);
 955                 rcu_read_unlock();
 956                 return;
 957         }
 958 @@ -2056,8 +2056,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
 959                 head_need += IEEE80211_ENCRYPT_HEADROOM;
 960                 head_need += local->tx_headroom;
 961                 head_need = max_t(int, 0, head_need);
 962 -               if (ieee80211_skb_resize(sdata, skb, head_need, true))
 963 -                       goto fail;
 964 +               if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
 965 +                       ieee80211_free_txskb(&local->hw, skb);
 966 +                       return NETDEV_TX_OK;
 967 +               }
 968         }
 969
 970         if (encaps_data) {
 971 @@ -2124,10 +2126,13 @@ netdev_tx_t ieee80211_subif_start_xmit(s
 972   */
 973  void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 974  {
 975 +       struct sk_buff *skb;
 976         int i;
 977
 978 -       for (i = 0; i < local->hw.queues; i++)
 979 -               skb_queue_purge(&local->pending[i]);
 980 +       for (i = 0; i < local->hw.queues; i++) {
 981 +               while ((skb = skb_dequeue(&local->pending[i])) != NULL)
 982 +                       ieee80211_free_txskb(&local->hw, skb);
 983 +       }
 984  }
 985
 986  /*
 987 @@ -2190,7 +2195,7 @@ void ieee80211_tx_pending(unsigned long
 988                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 989
 990                         if (WARN_ON(!info->control.vif)) {
 991 -                               kfree_skb(skb);
 992 +                               ieee80211_free_txskb(&local->hw, skb);
 993                                 continue;
 994                         }
 995