+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -674,6 +674,7 @@ int ieee80211_register_hw(struct ieee802
+ int channels, max_bitrates;
+ bool supp_ht, supp_vht;
+ netdev_features_t feature_whitelist;
++ struct cfg80211_chan_def dflt_chandef = {};
+ static const u32 cipher_suites[] = {
+ /* keep WEP first, it may be removed below */
+ WLAN_CIPHER_SUITE_WEP40,
+@@ -751,19 +752,19 @@ int ieee80211_register_hw(struct ieee802
+ sband = local->hw.wiphy->bands[band];
+ if (!sband)
+ continue;
+- if (!local->use_chanctx && !local->_oper_chandef.chan) {
++
++ if (!dflt_chandef.chan) {
++ cfg80211_chandef_create(&dflt_chandef,
++ &sband->channels[0],
++ NL80211_CHAN_NO_HT);
+ /* init channel we're on */
+- struct cfg80211_chan_def chandef = {
+- .chan = &sband->channels[0],
+- .width = NL80211_CHAN_NO_HT,
+- .center_freq1 = sband->channels[0].center_freq,
+- .center_freq2 = 0
+- };
+- local->hw.conf.chandef = local->_oper_chandef = chandef;
++ if (!local->use_chanctx && !local->_oper_chandef.chan) {
++ local->hw.conf.chandef = dflt_chandef;
++ local->_oper_chandef = dflt_chandef;
++ }
++ local->monitor_chandef = dflt_chandef;
+ }
+- cfg80211_chandef_create(&local->monitor_chandef,
+- &sband->channels[0],
+- NL80211_CHAN_NO_HT);
++
+ channels += sband->n_channels;
+
+ if (max_bitrates < sband->n_bitrates)
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -838,7 +838,7 @@ ieee80211_mesh_rx_probe_req(struct ieee8
+ if (baselen > len)
+ return;
+
+- ieee802_11_parse_elems(pos, len - baselen, &elems);
++ ieee802_11_parse_elems(pos, len - baselen, false, &elems);
+
+ /* 802.11-2012 10.1.4.3.2 */
+ if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
+@@ -899,7 +899,7 @@ static void ieee80211_mesh_rx_bcn_presp(
+ return;
+
+ ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+- &elems);
++ false, &elems);
+
+ /* ignore non-mesh or secure / unsecure mismatch */
+ if ((!elems.mesh_id || !elems.mesh_config) ||
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -880,7 +880,7 @@ void mesh_rx_path_sel_frame(struct ieee8
+
+ baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
+ ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
+- len - baselen, &elems);
++ len - baselen, false, &elems);
+
+ if (elems.preq) {
+ if (elems.preq_len != 37)
+--- a/net/mac80211/mesh_plink.c
++++ b/net/mac80211/mesh_plink.c
+@@ -544,8 +544,8 @@ static void mesh_plink_timer(unsigned lo
+ return;
+ }
+ mpl_dbg(sta->sdata,
+- "Mesh plink timer for %pM fired on state %d\n",
+- sta->sta.addr, sta->plink_state);
++ "Mesh plink timer for %pM fired on state %s\n",
++ sta->sta.addr, mplstates[sta->plink_state]);
+ reason = 0;
+ llid = sta->llid;
+ plid = sta->plid;
+@@ -687,7 +687,7 @@ void mesh_rx_plink_frame(struct ieee8021
+ baseaddr += 4;
+ baselen += 4;
+ }
+- ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
++ ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
+
+ if (!elems.peering) {
+ mpl_dbg(sdata,
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -289,6 +289,8 @@ ieee80211_determine_chantype(struct ieee
+ } else {
+ /* 40 MHz (and 80 MHz) must be supported for VHT */
+ ret = IEEE80211_STA_DISABLE_VHT;
++ /* also mark 40 MHz disabled */
++ ret |= IEEE80211_STA_DISABLE_40MHZ;
+ goto out;
+ }
+
+@@ -303,12 +305,6 @@ ieee80211_determine_chantype(struct ieee
+ channel->band);
+ vht_chandef.center_freq2 = 0;
+
+- if (vht_oper->center_freq_seg2_idx)
+- vht_chandef.center_freq2 =
+- ieee80211_channel_to_frequency(
+- vht_oper->center_freq_seg2_idx,
+- channel->band);
+-
+ switch (vht_oper->chan_width) {
+ case IEEE80211_VHT_CHANWIDTH_USE_HT:
+ vht_chandef.width = chandef->width;
+@@ -321,6 +317,10 @@ ieee80211_determine_chantype(struct ieee
+ break;
+ case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+ vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
++ vht_chandef.center_freq2 =
++ ieee80211_channel_to_frequency(
++ vht_oper->center_freq_seg2_idx,
++ channel->band);
+ break;
+ default:
+ if (verbose)
+@@ -604,7 +604,6 @@ static void ieee80211_add_vht_ie(struct
+ u8 *pos;
+ u32 cap;
+ struct ieee80211_sta_vht_cap vht_cap;
+- int i;
+
+ BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
+
+@@ -632,37 +631,6 @@ static void ieee80211_add_vht_ie(struct
+ cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
+ cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+
+- if (!(ap_vht_cap->vht_cap_info &
+- cpu_to_le32(IEEE80211_VHT_CAP_TXSTBC)))
+- cap &= ~(IEEE80211_VHT_CAP_RXSTBC_1 |
+- IEEE80211_VHT_CAP_RXSTBC_3 |
+- IEEE80211_VHT_CAP_RXSTBC_4);
+-
+- for (i = 0; i < 8; i++) {
+- int shift = i * 2;
+- u16 mask = IEEE80211_VHT_MCS_NOT_SUPPORTED << shift;
+- u16 ap_mcs, our_mcs;
+-
+- ap_mcs = (le16_to_cpu(ap_vht_cap->supp_mcs.tx_mcs_map) &
+- mask) >> shift;
+- our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
+- mask) >> shift;
+-
+- if (our_mcs == IEEE80211_VHT_MCS_NOT_SUPPORTED)
+- continue;
+-
+- switch (ap_mcs) {
+- default:
+- if (our_mcs <= ap_mcs)
+- break;
+- /* fall through */
+- case IEEE80211_VHT_MCS_NOT_SUPPORTED:
+- vht_cap.vht_mcs.rx_mcs_map &= cpu_to_le16(~mask);
+- vht_cap.vht_mcs.rx_mcs_map |=
+- cpu_to_le16(ap_mcs << shift);
+- }
+- }
+-
+ /* reserve and fill IE */
+ pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
+ ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
+@@ -998,16 +966,7 @@ static void ieee80211_chswitch_work(stru
+ if (!ifmgd->associated)
+ goto out;
+
+- /*
+- * FIXME: Here we are downgrading to NL80211_CHAN_WIDTH_20_NOHT
+- * and don't adjust our ht/vht settings
+- * This is wrong - we should behave according to the CSA params
+- */
+- local->_oper_chandef.chan = local->csa_channel;
+- local->_oper_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+- local->_oper_chandef.center_freq1 =
+- local->_oper_chandef.chan->center_freq;
+- local->_oper_chandef.center_freq2 = 0;
++ local->_oper_chandef = local->csa_chandef;
+
+ if (!local->ops->channel_switch) {
+ /* call "hw_config" only if doing sw channel switch */
+@@ -1054,56 +1013,208 @@ static void ieee80211_chswitch_timer(uns
+ ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
+ }
+
+-void
++static void
+ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+- const struct ieee80211_channel_sw_ie *sw_elem,
+- struct ieee80211_bss *bss, u64 timestamp)
++ u64 timestamp, struct ieee802_11_elems *elems,
++ bool beacon)
+ {
+- struct cfg80211_bss *cbss =
+- container_of((void *)bss, struct cfg80211_bss, priv);
+- struct ieee80211_channel *new_ch;
++ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+- int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
+- cbss->channel->band);
++ struct cfg80211_bss *cbss = ifmgd->associated;
++ struct ieee80211_bss *bss;
+ struct ieee80211_chanctx *chanctx;
++ enum ieee80211_band new_band;
++ int new_freq;
++ u8 new_chan_no;
++ u8 count;
++ u8 mode;
++ struct ieee80211_channel *new_chan;
++ struct cfg80211_chan_def new_chandef = {};
++ struct cfg80211_chan_def new_vht_chandef = {};
++ const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
++ const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
++ const struct ieee80211_ht_operation *ht_oper;
++ int secondary_channel_offset = -1;
+
+ ASSERT_MGD_MTX(ifmgd);
+
+- if (!ifmgd->associated)
++ if (!cbss)
++ return;
++
++ if (local->scanning)
+ return;
+
+- if (sdata->local->scanning)
++ /* disregard subsequent announcements if we are already processing */
++ if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
+ return;
+
+- /* Disregard subsequent beacons if we are already running a timer
+- processing a CSA */
++ sec_chan_offs = elems->sec_chan_offs;
++ wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
++ ht_oper = elems->ht_operation;
++
++ if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
++ IEEE80211_STA_DISABLE_40MHZ)) {
++ sec_chan_offs = NULL;
++ wide_bw_chansw_ie = NULL;
++ /* only used for bandwidth here */
++ ht_oper = NULL;
++ }
+
+- if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
++ if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
++ wide_bw_chansw_ie = NULL;
++
++ if (elems->ext_chansw_ie) {
++ if (!ieee80211_operating_class_to_band(
++ elems->ext_chansw_ie->new_operating_class,
++ &new_band)) {
++ sdata_info(sdata,
++ "cannot understand ECSA IE operating class %d, disconnecting\n",
++ elems->ext_chansw_ie->new_operating_class);
++ ieee80211_queue_work(&local->hw,
++ &ifmgd->csa_connection_drop_work);
++ }
++ new_chan_no = elems->ext_chansw_ie->new_ch_num;
++ count = elems->ext_chansw_ie->count;
++ mode = elems->ext_chansw_ie->mode;
++ } else if (elems->ch_switch_ie) {
++ new_band = cbss->channel->band;
++ new_chan_no = elems->ch_switch_ie->new_ch_num;
++ count = elems->ch_switch_ie->count;
++ mode = elems->ch_switch_ie->mode;
++ } else {
++ /* nothing here we understand */
+ return;
++ }
++
++ bss = (void *)cbss->priv;
+
+- new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+- if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) {
++ new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
++ new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
++ if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
+ sdata_info(sdata,
+ "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
+ ifmgd->associated->bssid, new_freq);
+- ieee80211_queue_work(&sdata->local->hw,
++ ieee80211_queue_work(&local->hw,
++ &ifmgd->csa_connection_drop_work);
++ return;
++ }
++
++ if (!beacon && sec_chan_offs) {
++ secondary_channel_offset = sec_chan_offs->sec_chan_offs;
++ } else if (beacon && ht_oper) {
++ secondary_channel_offset =
++ ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
++ } else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
++ /*
++ * If it's not a beacon, HT is enabled and the IE not present,
++ * it's 20 MHz, 802.11-2012 8.5.2.6:
++ * This element [the Secondary Channel Offset Element] is
++ * present when switching to a 40 MHz channel. It may be
++ * present when switching to a 20 MHz channel (in which
++ * case the secondary channel offset is set to SCN).
++ */
++ secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
++ }
++
++ switch (secondary_channel_offset) {
++ default:
++ /* secondary_channel_offset was present but is invalid */
++ case IEEE80211_HT_PARAM_CHA_SEC_NONE:
++ cfg80211_chandef_create(&new_chandef, new_chan,
++ NL80211_CHAN_HT20);
++ break;
++ case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
++ cfg80211_chandef_create(&new_chandef, new_chan,
++ NL80211_CHAN_HT40PLUS);
++ break;
++ case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
++ cfg80211_chandef_create(&new_chandef, new_chan,
++ NL80211_CHAN_HT40MINUS);
++ break;
++ case -1:
++ cfg80211_chandef_create(&new_chandef, new_chan,
++ NL80211_CHAN_NO_HT);
++ break;
++ }
++
++ if (wide_bw_chansw_ie) {
++ new_vht_chandef.chan = new_chan;
++ new_vht_chandef.center_freq1 =
++ ieee80211_channel_to_frequency(
++ wide_bw_chansw_ie->new_center_freq_seg0,
++ new_band);
++
++ switch (wide_bw_chansw_ie->new_channel_width) {
++ default:
++ /* hmmm, ignore VHT and use HT if present */
++ case IEEE80211_VHT_CHANWIDTH_USE_HT:
++ new_vht_chandef.chan = NULL;
++ break;
++ case IEEE80211_VHT_CHANWIDTH_80MHZ:
++ new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
++ break;
++ case IEEE80211_VHT_CHANWIDTH_160MHZ:
++ new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
++ break;
++ case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
++ /* field is otherwise reserved */
++ new_vht_chandef.center_freq2 =
++ ieee80211_channel_to_frequency(
++ wide_bw_chansw_ie->new_center_freq_seg1,
++ new_band);
++ new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
++ break;
++ }
++ if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
++ new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
++ chandef_downgrade(&new_vht_chandef);
++ if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
++ new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
++ chandef_downgrade(&new_vht_chandef);
++ if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
++ new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
++ chandef_downgrade(&new_vht_chandef);
++ }
++
++ /* if VHT data is there validate & use it */
++ if (new_vht_chandef.chan) {
++ if (!cfg80211_chandef_compatible(&new_vht_chandef,
++ &new_chandef)) {
++ sdata_info(sdata,
++ "AP %pM CSA has inconsistent channel data, disconnecting\n",
++ ifmgd->associated->bssid);
++ ieee80211_queue_work(&local->hw,
++ &ifmgd->csa_connection_drop_work);
++ return;
++ }
++ new_chandef = new_vht_chandef;
++ }
++
++ if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
++ IEEE80211_CHAN_DISABLED)) {
++ sdata_info(sdata,
++ "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
++ ifmgd->associated->bssid, new_freq,
++ new_chandef.width, new_chandef.center_freq1,
++ new_chandef.center_freq2);
++ ieee80211_queue_work(&local->hw,
+ &ifmgd->csa_connection_drop_work);
+ return;
+ }
+
+ ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+
+- if (sdata->local->use_chanctx) {
++ if (local->use_chanctx) {
+ sdata_info(sdata,
+ "not handling channel switch with channel contexts\n");
+- ieee80211_queue_work(&sdata->local->hw,
++ ieee80211_queue_work(&local->hw,
+ &ifmgd->csa_connection_drop_work);
+ return;
+ }
+
+- mutex_lock(&sdata->local->chanctx_mtx);
++ mutex_lock(&local->chanctx_mtx);
+ if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
+- mutex_unlock(&sdata->local->chanctx_mtx);
++ mutex_unlock(&local->chanctx_mtx);
+ return;
+ }
+ chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
+@@ -1111,40 +1222,39 @@ ieee80211_sta_process_chanswitch(struct
+ if (chanctx->refcount > 1) {
+ sdata_info(sdata,
+ "channel switch with multiple interfaces on the same channel, disconnecting\n");
+- ieee80211_queue_work(&sdata->local->hw,
++ ieee80211_queue_work(&local->hw,
+ &ifmgd->csa_connection_drop_work);
+- mutex_unlock(&sdata->local->chanctx_mtx);
++ mutex_unlock(&local->chanctx_mtx);
+ return;
+ }
+- mutex_unlock(&sdata->local->chanctx_mtx);
++ mutex_unlock(&local->chanctx_mtx);
+
+- sdata->local->csa_channel = new_ch;
++ local->csa_chandef = new_chandef;
+
+- if (sw_elem->mode)
+- ieee80211_stop_queues_by_reason(&sdata->local->hw,
++ if (mode)
++ ieee80211_stop_queues_by_reason(&local->hw,
+ IEEE80211_MAX_QUEUE_MAP,
+ IEEE80211_QUEUE_STOP_REASON_CSA);
+
+- if (sdata->local->ops->channel_switch) {
++ if (local->ops->channel_switch) {
+ /* use driver's channel switch callback */
+ struct ieee80211_channel_switch ch_switch = {
+ .timestamp = timestamp,
+- .block_tx = sw_elem->mode,
+- .channel = new_ch,
+- .count = sw_elem->count,
++ .block_tx = mode,
++ .chandef = new_chandef,
++ .count = count,
+ };
+
+- drv_channel_switch(sdata->local, &ch_switch);
++ drv_channel_switch(local, &ch_switch);
+ return;
+ }
+
+ /* channel switch handled in software */
+- if (sw_elem->count <= 1)
+- ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
++ if (count <= 1)
++ ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
+ else
+ mod_timer(&ifmgd->chswitch_timer,
+- TU_TO_EXP_TIME(sw_elem->count *
+- cbss->beacon_interval));
++ TU_TO_EXP_TIME(count * cbss->beacon_interval));
+ }
+
+ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+@@ -2120,7 +2230,6 @@ void ieee80211_beacon_loss(struct ieee80
+
+ trace_api_beacon_loss(sdata);
+
+- WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
+ sdata->u.mgd.connection_loss = false;
+ ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
+ }
+@@ -2170,7 +2279,7 @@ static void ieee80211_auth_challenge(str
+ u32 tx_flags = 0;
+
+ pos = mgmt->u.auth.variable;
+- ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++ ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
+ if (!elems.challenge)
+ return;
+ auth_data->expected_transaction = 4;
+@@ -2435,7 +2544,7 @@ static bool ieee80211_assoc_success(stru
+ }
+
+ pos = mgmt->u.assoc_resp.variable;
+- ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++ ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
+
+ if (!elems.supp_rates) {
+ sdata_info(sdata, "no SuppRates element in AssocResp\n");
+@@ -2604,7 +2713,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
+ capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
+
+ pos = mgmt->u.assoc_resp.variable;
+- ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++ ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
+
+ if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+ elems.timeout_int &&
+@@ -2659,6 +2768,8 @@ static void ieee80211_rx_bss_info(struct
+ struct ieee80211_channel *channel;
+ bool need_ps = false;
+
++ lockdep_assert_held(&sdata->u.mgd.mtx);
++
+ if ((sdata->u.mgd.associated &&
+ ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
+ (sdata->u.mgd.assoc_data &&
+@@ -2689,7 +2800,8 @@ static void ieee80211_rx_bss_info(struct
+ if (bss)
+ ieee80211_rx_bss_put(local, bss);
+
+- if (!sdata->u.mgd.associated)
++ if (!sdata->u.mgd.associated ||
++ !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
+ return;
+
+ if (need_ps) {
+@@ -2698,10 +2810,9 @@ static void ieee80211_rx_bss_info(struct
+ mutex_unlock(&local->iflist_mtx);
+ }
+
+- if (elems->ch_switch_ie &&
+- memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
+- ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
+- bss, rx_status->mactime);
++ ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
++ elems, true);
++
+ }
+
+
+@@ -2726,7 +2837,7 @@ static void ieee80211_rx_mgmt_probe_resp
+ return;
+
+ ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+- &elems);
++ false, &elems);
+
+ ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+
+@@ -2809,7 +2920,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
+ if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
+ ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
+ ieee802_11_parse_elems(mgmt->u.beacon.variable,
+- len - baselen, &elems);
++ len - baselen, false, &elems);
+
+ ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+ ifmgd->assoc_data->have_beacon = true;
+@@ -2919,7 +3030,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
+
+ ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+ ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
+- len - baselen, &elems,
++ len - baselen, false, &elems,
+ care_about_ies, ncrc);
+
+ if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
+@@ -3066,6 +3177,8 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ enum rx_mgmt_action rma = RX_MGMT_NONE;
+ u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
+ u16 fc;
++ struct ieee802_11_elems elems;
++ int ies_len;
+
+ rx_status = (struct ieee80211_rx_status *) skb->cb;
+ mgmt = (struct ieee80211_mgmt *) skb->data;
+@@ -3095,14 +3208,48 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
+ break;
+ case IEEE80211_STYPE_ACTION:
+- switch (mgmt->u.action.category) {
+- case WLAN_CATEGORY_SPECTRUM_MGMT:
++ if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
++ ies_len = skb->len -
++ offsetof(struct ieee80211_mgmt,
++ u.action.u.chan_switch.variable);
++
++ if (ies_len < 0)
++ break;
++
++ ieee802_11_parse_elems(
++ mgmt->u.action.u.chan_switch.variable,
++ ies_len, true, &elems);
++
++ if (elems.parse_error)
++ break;
++
+ ieee80211_sta_process_chanswitch(sdata,
+- &mgmt->u.action.u.chan_switch.sw_elem,
+- (void *)ifmgd->associated->priv,
+- rx_status->mactime);
+- break;
++ rx_status->mactime,
++ &elems, false);
++ } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
++ ies_len = skb->len -
++ offsetof(struct ieee80211_mgmt,
++ u.action.u.ext_chan_switch.variable);
++
++ if (ies_len < 0)
++ break;
++
++ ieee802_11_parse_elems(
++ mgmt->u.action.u.ext_chan_switch.variable,
++ ies_len, true, &elems);
++
++ if (elems.parse_error)
++ break;
++
++ /* for the handling code pretend this was also an IE */
++ elems.ext_chansw_ie =
++ &mgmt->u.action.u.ext_chan_switch.data;
++
++ ieee80211_sta_process_chanswitch(sdata,
++ rx_status->mactime,
++ &elems, false);
+ }
++ break;
+ }
+ mutex_unlock(&ifmgd->mtx);
+
+@@ -4197,7 +4344,7 @@ int ieee80211_mgd_deauth(struct ieee8021
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+ bool tx = !req->local_state_change;
+- bool sent_frame = false;
++ bool report_frame = false;
+
+ mutex_lock(&ifmgd->mtx);
+
+@@ -4214,7 +4361,7 @@ int ieee80211_mgd_deauth(struct ieee8021
+ ieee80211_destroy_auth_data(sdata, false);
+ mutex_unlock(&ifmgd->mtx);
+
+- sent_frame = tx;
++ report_frame = true;
+ goto out;
+ }
+
+@@ -4222,12 +4369,12 @@ int ieee80211_mgd_deauth(struct ieee8021
+ ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
+ ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+ req->reason_code, tx, frame_buf);
+- sent_frame = tx;
++ report_frame = true;
+ }
+ mutex_unlock(&ifmgd->mtx);
+
+ out:
+- if (sent_frame)
++ if (report_frame)
+ __cfg80211_send_deauth(sdata->dev, frame_buf,
+ IEEE80211_DEAUTH_FRAME_LEN);
+
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -38,8 +38,8 @@ int __ieee80211_suspend(struct ieee80211
+ IEEE80211_MAX_QUEUE_MAP,
+ IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+
+- /* flush out all packets */
+- synchronize_net();
++ /* flush out all packets and station cleanup call_rcu()s */
++ rcu_barrier();
+
+ ieee80211_flush_queues(local, NULL);
+
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -252,6 +252,25 @@ rate_lowest_non_cck_index(struct ieee802
+ return 0;
+ }
+
++static void __rate_control_send_low(struct ieee80211_hw *hw,
++ struct ieee80211_supported_band *sband,
++ struct ieee80211_sta *sta,
++ struct ieee80211_tx_info *info)
++{
++ if ((sband->band != IEEE80211_BAND_2GHZ) ||
++ !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
++ info->control.rates[0].idx = rate_lowest_index(sband, sta);
++ else
++ info->control.rates[0].idx =
++ rate_lowest_non_cck_index(sband, sta);
++
++ info->control.rates[0].count =
++ (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
++ 1 : hw->max_rate_tries;
++
++ info->control.skip_table = 1;
++}
++
+
+ bool rate_control_send_low(struct ieee80211_sta *sta,
+ void *priv_sta,
+@@ -262,16 +281,8 @@ bool rate_control_send_low(struct ieee80
+ int mcast_rate;
+
+ if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
+- if ((sband->band != IEEE80211_BAND_2GHZ) ||
+- !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
+- info->control.rates[0].idx =
+- rate_lowest_index(txrc->sband, sta);
+- else
+- info->control.rates[0].idx =
+- rate_lowest_non_cck_index(txrc->sband, sta);
+- info->control.rates[0].count =
+- (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+- 1 : txrc->hw->max_rate_tries;
++ __rate_control_send_low(txrc->hw, sband, sta, info);
++
+ if (!sta && txrc->bss) {
+ mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
+ if (mcast_rate > 0) {
+@@ -355,7 +366,8 @@ static bool rate_idx_match_mcs_mask(stru
+
+
+ static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
+- struct ieee80211_tx_rate_control *txrc,
++ struct ieee80211_supported_band *sband,
++ enum nl80211_chan_width chan_width,
+ u32 mask,
+ u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
+ {
+@@ -375,27 +387,17 @@ static void rate_idx_match_mask(struct i
+ IEEE80211_TX_RC_USE_SHORT_PREAMBLE);
+ alt_rate.count = rate->count;
+ if (rate_idx_match_legacy_mask(&alt_rate,
+- txrc->sband->n_bitrates,
+- mask)) {
++ sband->n_bitrates, mask)) {
+ *rate = alt_rate;
+ return;
+ }
+ } else {
+- struct sk_buff *skb = txrc->skb;
+- struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+- __le16 fc;
+-
+ /* handle legacy rates */
+- if (rate_idx_match_legacy_mask(rate, txrc->sband->n_bitrates,
+- mask))
++ if (rate_idx_match_legacy_mask(rate, sband->n_bitrates, mask))
+ return;
+
+ /* if HT BSS, and we handle a data frame, also try HT rates */
+- if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
+- return;
+-
+- fc = hdr->frame_control;
+- if (!ieee80211_is_data(fc))
++ if (chan_width == NL80211_CHAN_WIDTH_20_NOHT)
+ return;
+
+ alt_rate.idx = 0;
+@@ -408,7 +410,7 @@ static void rate_idx_match_mask(struct i
+
+ alt_rate.flags |= IEEE80211_TX_RC_MCS;
+
+- if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_40)
++ if (chan_width == NL80211_CHAN_WIDTH_40)
+ alt_rate.flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+
+ if (rate_idx_match_mcs_mask(&alt_rate, mcs_mask)) {
+@@ -426,6 +428,228 @@ static void rate_idx_match_mask(struct i
+ */
+ }
+
++static void rate_fixup_ratelist(struct ieee80211_vif *vif,
++ struct ieee80211_supported_band *sband,
++ struct ieee80211_tx_info *info,
++ struct ieee80211_tx_rate *rates,
++ int max_rates)
++{
++ struct ieee80211_rate *rate;
++ bool inval = false;
++ int i;
++
++ /*
++ * Set up the RTS/CTS rate as the fastest basic rate
++ * that is not faster than the data rate unless there
++ * is no basic rate slower than the data rate, in which
++ * case we pick the slowest basic rate
++ *
++ * XXX: Should this check all retry rates?
++ */
++ if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) {
++ u32 basic_rates = vif->bss_conf.basic_rates;
++ s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0;
++
++ rate = &sband->bitrates[rates[0].idx];
++
++ for (i = 0; i < sband->n_bitrates; i++) {
++ /* must be a basic rate */
++ if (!(basic_rates & BIT(i)))
++ continue;
++ /* must not be faster than the data rate */
++ if (sband->bitrates[i].bitrate > rate->bitrate)
++ continue;
++ /* maximum */
++ if (sband->bitrates[baserate].bitrate <
++ sband->bitrates[i].bitrate)
++ baserate = i;
++ }
++
++ info->control.rts_cts_rate_idx = baserate;
++ }
++
++ for (i = 0; i < max_rates; i++) {
++ /*
++ * make sure there's no valid rate following
++ * an invalid one, just in case drivers don't
++ * take the API seriously to stop at -1.
++ */
++ if (inval) {
++ rates[i].idx = -1;
++ continue;
++ }
++ if (rates[i].idx < 0) {
++ inval = true;
++ continue;
++ }
++
++ /*
++ * For now assume MCS is already set up correctly, this
++ * needs to be fixed.
++ */
++ if (rates[i].flags & IEEE80211_TX_RC_MCS) {
++ WARN_ON(rates[i].idx > 76);
++
++ if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
++ info->control.use_cts_prot)
++ rates[i].flags |=
++ IEEE80211_TX_RC_USE_CTS_PROTECT;
++ continue;
++ }
++
++ if (rates[i].flags & IEEE80211_TX_RC_VHT_MCS) {
++ WARN_ON(ieee80211_rate_get_vht_mcs(&rates[i]) > 9);
++ continue;
++ }
++
++ /* set up RTS protection if desired */
++ if (info->control.use_rts) {
++ rates[i].flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++ info->control.use_cts_prot = false;
++ }
++
++ /* RC is busted */
++ if (WARN_ON_ONCE(rates[i].idx >= sband->n_bitrates)) {
++ rates[i].idx = -1;
++ continue;
++ }
++
++ rate = &sband->bitrates[rates[i].idx];
++
++ /* set up short preamble */
++ if (info->control.short_preamble &&
++ rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
++ rates[i].flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
++
++ /* set up G protection */
++ if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
++ info->control.use_cts_prot &&
++ rate->flags & IEEE80211_RATE_ERP_G)
++ rates[i].flags |= IEEE80211_TX_RC_USE_CTS_PROTECT;
++ }
++}
++
++
++static void rate_control_fill_sta_table(struct ieee80211_sta *sta,
++ struct ieee80211_tx_info *info,
++ struct ieee80211_tx_rate *rates,
++ int max_rates)
++{
++ struct ieee80211_sta_rates *ratetbl = NULL;
++ int i;
++
++ if (sta && !info->control.skip_table)
++ ratetbl = rcu_dereference(sta->rates);
++
++ /* Fill remaining rate slots with data from the sta rate table. */
++ max_rates = min_t(int, max_rates, IEEE80211_TX_RATE_TABLE_SIZE);
++ for (i = 0; i < max_rates; i++) {
++ if (i < ARRAY_SIZE(info->control.rates) &&
++ info->control.rates[i].idx >= 0 &&
++ info->control.rates[i].count) {
++ if (rates != info->control.rates)
++ rates[i] = info->control.rates[i];
++ } else if (ratetbl) {
++ rates[i].idx = ratetbl->rate[i].idx;
++ rates[i].flags = ratetbl->rate[i].flags;
++ if (info->control.use_rts)
++ rates[i].count = ratetbl->rate[i].count_rts;
++ else if (info->control.use_cts_prot)
++ rates[i].count = ratetbl->rate[i].count_cts;
++ else
++ rates[i].count = ratetbl->rate[i].count;
++ } else {
++ rates[i].idx = -1;
++ rates[i].count = 0;
++ }
++
++ if (rates[i].idx < 0 || !rates[i].count)
++ break;
++ }
++}
++
++static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
++ struct ieee80211_sta *sta,
++ struct ieee80211_supported_band *sband,
++ struct ieee80211_tx_info *info,
++ struct ieee80211_tx_rate *rates,
++ int max_rates)
++{
++ enum nl80211_chan_width chan_width;
++ u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
++ bool has_mcs_mask;
++ u32 mask;
++ int i;
++
++ /*
++ * Try to enforce the rateidx mask the user wanted. skip this if the
++ * default mask (allow all rates) is used to save some processing for
++ * the common case.
++ */
++ mask = sdata->rc_rateidx_mask[info->band];
++ has_mcs_mask = sdata->rc_has_mcs_mask[info->band];
++ if (mask == (1 << sband->n_bitrates) - 1 && !has_mcs_mask)
++ return;
++
++ if (has_mcs_mask)
++ memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
++ sizeof(mcs_mask));
++ else
++ memset(mcs_mask, 0xff, sizeof(mcs_mask));
++
++ if (sta) {
++ /* Filter out rates that the STA does not support */
++ mask &= sta->supp_rates[info->band];
++ for (i = 0; i < sizeof(mcs_mask); i++)
++ mcs_mask[i] &= sta->ht_cap.mcs.rx_mask[i];
++ }
++
++ /*
++ * Make sure the rate index selected for each TX rate is
++ * included in the configured mask and change the rate indexes
++ * if needed.
++ */
++ chan_width = sdata->vif.bss_conf.chandef.width;
++ for (i = 0; i < max_rates; i++) {
++ /* Skip invalid rates */
++ if (rates[i].idx < 0)
++ break;
++
++ rate_idx_match_mask(&rates[i], sband, chan_width, mask,
++ mcs_mask);
++ }
++}
++
++void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta,
++ struct sk_buff *skb,
++ struct ieee80211_tx_rate *dest,
++ int max_rates)
++{
++ struct ieee80211_sub_if_data *sdata;
++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
++ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_supported_band *sband;
++
++ rate_control_fill_sta_table(sta, info, dest, max_rates);
++
++ if (!vif)
++ return;
++
++ sdata = vif_to_sdata(vif);
++ sband = sdata->local->hw.wiphy->bands[info->band];
++
++ if (ieee80211_is_data(hdr->frame_control))
++ rate_control_apply_mask(sdata, sta, sband, info, dest, max_rates);
++
++ if (dest[0].idx < 0)
++ __rate_control_send_low(&sdata->local->hw, sband, sta, info);
++
++ if (sta)
++ rate_fixup_ratelist(vif, sband, info, dest, max_rates);
++}
++EXPORT_SYMBOL(ieee80211_get_tx_rates);
++
+ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
+ struct sta_info *sta,
+ struct ieee80211_tx_rate_control *txrc)
+@@ -435,8 +659,6 @@ void rate_control_get_rate(struct ieee80
+ struct ieee80211_sta *ista = NULL;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+ int i;
+- u32 mask;
+- u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
+
+ if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
+ ista = &sta->sta;
+@@ -454,37 +676,27 @@ void rate_control_get_rate(struct ieee80
+
+ ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
+
+- /*
+- * Try to enforce the rateidx mask the user wanted. skip this if the
+- * default mask (allow all rates) is used to save some processing for
+- * the common case.
+- */
+- mask = sdata->rc_rateidx_mask[info->band];
+- memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
+- sizeof(mcs_mask));
+- if (mask != (1 << txrc->sband->n_bitrates) - 1) {
+- if (sta) {
+- /* Filter out rates that the STA does not support */
+- mask &= sta->sta.supp_rates[info->band];
+- for (i = 0; i < sizeof(mcs_mask); i++)
+- mcs_mask[i] &= sta->sta.ht_cap.mcs.rx_mask[i];
+- }
+- /*
+- * Make sure the rate index selected for each TX rate is
+- * included in the configured mask and change the rate indexes
+- * if needed.
+- */
+- for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+- /* Skip invalid rates */
+- if (info->control.rates[i].idx < 0)
+- break;
+- rate_idx_match_mask(&info->control.rates[i], txrc,
+- mask, mcs_mask);
+- }
+- }
++ if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
++ return;
+
+- BUG_ON(info->control.rates[0].idx < 0);
++ ieee80211_get_tx_rates(&sdata->vif, ista, txrc->skb,
++ info->control.rates,
++ ARRAY_SIZE(info->control.rates));
++}
++
++int rate_control_set_rates(struct ieee80211_hw *hw,
++ struct ieee80211_sta *pubsta,
++ struct ieee80211_sta_rates *rates)
++{
++ struct ieee80211_sta_rates *old = rcu_dereference(pubsta->rates);
++
++ rcu_assign_pointer(pubsta->rates, rates);
++ if (old)
++ kfree_rcu(old, rcu_head);
++
++ return 0;
+ }
++EXPORT_SYMBOL(rate_control_set_rates);
+
+ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
+ const char *name)
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -84,6 +84,50 @@ minstrel_sort_best_tp_rates(struct minst
+ }
+
+ static void
++minstrel_set_rate(struct minstrel_sta_info *mi, struct ieee80211_sta_rates *ratetbl,
++ int offset, int idx)
++{
++ struct minstrel_rate *r = &mi->r[idx];
++
++ ratetbl->rate[offset].idx = r->rix;
++ ratetbl->rate[offset].count = r->adjusted_retry_count;
++ ratetbl->rate[offset].count_cts = r->retry_count_cts;
++ ratetbl->rate[offset].count_rts = r->retry_count_rtscts;
++}
++
++static void
++minstrel_update_rates(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
++{
++ struct ieee80211_sta_rates *ratetbl;
++ int i = 0;
++
++ ratetbl = kzalloc(sizeof(*ratetbl), GFP_ATOMIC);
++ if (!ratetbl)
++ return;
++
++ /* Start with max_tp_rate */
++ minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[0]);
++
++ if (mp->hw->max_rates >= 3) {
++ /* At least 3 tx rates supported, use max_tp_rate2 next */
++ minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[1]);
++ }
++
++ if (mp->hw->max_rates >= 2) {
++ /* At least 2 tx rates supported, use max_prob_rate next */
++ minstrel_set_rate(mi, ratetbl, i++, mi->max_prob_rate);
++ }
++
++ /* Use lowest rate last */
++ ratetbl->rate[i].idx = mi->lowest_rix;
++ ratetbl->rate[i].count = mp->max_retry;
++ ratetbl->rate[i].count_cts = mp->max_retry;
++ ratetbl->rate[i].count_rts = mp->max_retry;
++
++ rate_control_set_rates(mp->hw, mi->sta, ratetbl);
++}
++
++static void
+ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
+ {
+ u8 tmp_tp_rate[MAX_THR_RATES];
+@@ -161,6 +205,8 @@ minstrel_update_stats(struct minstrel_pr
+
+ /* Reset update timer */
+ mi->stats_update = jiffies;
++
++ minstrel_update_rates(mp, mi);
+ }
+
+ static void
+@@ -209,9 +255,9 @@ minstrel_get_retry_count(struct minstrel
+ {
+ unsigned int retry = mr->adjusted_retry_count;
+
+- if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
++ if (info->control.use_rts)
+ retry = max(2U, min(mr->retry_count_rtscts, retry));
+- else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
++ else if (info->control.use_cts_prot)
+ retry = max(2U, min(mr->retry_count_cts, retry));
+ return retry;
+ }
+@@ -240,13 +286,12 @@ minstrel_get_rate(void *priv, struct iee
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ struct minstrel_sta_info *mi = priv_sta;
+ struct minstrel_priv *mp = priv;
+- struct ieee80211_tx_rate *ar = info->control.rates;
+- unsigned int ndx, sample_ndx = 0;
++ struct ieee80211_tx_rate *rate = &info->control.rates[0];
++ struct minstrel_rate *msr, *mr;
++ unsigned int ndx;
+ bool mrr_capable;
+- bool indirect_rate_sampling = false;
+- bool rate_sampling = false;
+- int i, delta;
+- int mrr_ndx[3];
++ bool prev_sample = mi->prev_sample;
++ int delta;
+ int sampling_ratio;
+
+ /* management/no-ack frames do not use rate control */
+@@ -262,107 +307,75 @@ minstrel_get_rate(void *priv, struct iee
+ else
+ sampling_ratio = mp->lookaround_rate;
+
+- /* init rateindex [ndx] with max throughput rate */
+- ndx = mi->max_tp_rate[0];
+-
+ /* increase sum packet counter */
+ mi->packet_count++;
+
+ delta = (mi->packet_count * sampling_ratio / 100) -
+ (mi->sample_count + mi->sample_deferred / 2);
+
+- /* delta > 0: sampling required */
+- if ((delta > 0) && (mrr_capable || !mi->prev_sample)) {
+- struct minstrel_rate *msr;
+- if (mi->packet_count >= 10000) {
+- mi->sample_deferred = 0;
+- mi->sample_count = 0;
+- mi->packet_count = 0;
+- } else if (delta > mi->n_rates * 2) {
+- /* With multi-rate retry, not every planned sample
+- * attempt actually gets used, due to the way the retry
+- * chain is set up - [max_tp,sample,prob,lowest] for
+- * sample_rate < max_tp.
+- *
+- * If there's too much sampling backlog and the link
+- * starts getting worse, minstrel would start bursting
+- * out lots of sampling frames, which would result
+- * in a large throughput loss. */
+- mi->sample_count += (delta - mi->n_rates * 2);
+- }
++ /* delta < 0: no sampling required */
++ mi->prev_sample = false;
++ if (delta < 0 || (!mrr_capable && prev_sample))
++ return;
+
+- /* get next random rate sample */
+- sample_ndx = minstrel_get_next_sample(mi);
+- msr = &mi->r[sample_ndx];
+- rate_sampling = true;
+-
+- /* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
+- * rate sampling method should be used.
+- * Respect such rates that are not sampled for 20 interations.
+- */
+- if (mrr_capable &&
+- msr->perfect_tx_time > mi->r[ndx].perfect_tx_time &&
+- msr->sample_skipped < 20)
+- indirect_rate_sampling = true;
+-
+- if (!indirect_rate_sampling) {
+- if (msr->sample_limit != 0) {
+- ndx = sample_ndx;
+- mi->sample_count++;
+- if (msr->sample_limit > 0)
+- msr->sample_limit--;
+- } else
+- rate_sampling = false;
+- } else {
+- /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
+- * packets that have the sampling rate deferred to the
+- * second MRR stage. Increase the sample counter only
+- * if the deferred sample rate was actually used.
+- * Use the sample_deferred counter to make sure that
+- * the sampling is not done in large bursts */
+- info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+- mi->sample_deferred++;
+- }
++ if (mi->packet_count >= 10000) {
++ mi->sample_deferred = 0;
++ mi->sample_count = 0;
++ mi->packet_count = 0;
++ } else if (delta > mi->n_rates * 2) {
++ /* With multi-rate retry, not every planned sample
++ * attempt actually gets used, due to the way the retry
++ * chain is set up - [max_tp,sample,prob,lowest] for
++ * sample_rate < max_tp.
++ *
++ * If there's too much sampling backlog and the link
++ * starts getting worse, minstrel would start bursting
++ * out lots of sampling frames, which would result
++ * in a large throughput loss. */
++ mi->sample_count += (delta - mi->n_rates * 2);
++ }
++
++ /* get next random rate sample */
++ ndx = minstrel_get_next_sample(mi);
++ msr = &mi->r[ndx];
++ mr = &mi->r[mi->max_tp_rate[0]];
++
++ /* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
++ * rate sampling method should be used.
++ * Respect such rates that are not sampled for 20 interations.
++ */
++ if (mrr_capable &&
++ msr->perfect_tx_time > mr->perfect_tx_time &&
++ msr->sample_skipped < 20) {
++ /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
++ * packets that have the sampling rate deferred to the
++ * second MRR stage. Increase the sample counter only
++ * if the deferred sample rate was actually used.
++ * Use the sample_deferred counter to make sure that
++ * the sampling is not done in large bursts */
++ info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++ rate++;
++ mi->sample_deferred++;
++ } else {
++ if (!msr->sample_limit != 0)
++ return;
++
++ mi->sample_count++;
++ if (msr->sample_limit > 0)
++ msr->sample_limit--;
+ }
+- mi->prev_sample = rate_sampling;
+
+ /* If we're not using MRR and the sampling rate already
+ * has a probability of >95%, we shouldn't be attempting
+ * to use it, as this only wastes precious airtime */
+- if (!mrr_capable && rate_sampling &&
++ if (!mrr_capable &&
+ (mi->r[ndx].probability > MINSTREL_FRAC(95, 100)))
+- ndx = mi->max_tp_rate[0];
+-
+- /* mrr setup for 1st stage */
+- ar[0].idx = mi->r[ndx].rix;
+- ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
+-
+- /* non mrr setup for 2nd stage */
+- if (!mrr_capable) {
+- if (!rate_sampling)
+- ar[0].count = mp->max_retry;
+- ar[1].idx = mi->lowest_rix;
+- ar[1].count = mp->max_retry;
+ return;
+- }
+
+- /* mrr setup for 2nd stage */
+- if (rate_sampling) {
+- if (indirect_rate_sampling)
+- mrr_ndx[0] = sample_ndx;
+- else
+- mrr_ndx[0] = mi->max_tp_rate[0];
+- } else {
+- mrr_ndx[0] = mi->max_tp_rate[1];
+- }
++ mi->prev_sample = true;
+
+- /* mrr setup for 3rd & 4th stage */
+- mrr_ndx[1] = mi->max_prob_rate;
+- mrr_ndx[2] = 0;
+- for (i = 1; i < 4; i++) {
+- ar[i].idx = mi->r[mrr_ndx[i - 1]].rix;
+- ar[i].count = mi->r[mrr_ndx[i - 1]].adjusted_retry_count;
+- }
++ rate->idx = mi->r[ndx].rix;
++ rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
+ }
+
+
+@@ -412,12 +425,16 @@ minstrel_rate_init(void *priv, struct ie
+ unsigned int i, n = 0;
+ unsigned int t_slot = 9; /* FIXME: get real slot time */
+
++ mi->sta = sta;
+ mi->lowest_rix = rate_lowest_index(sband, sta);
+ ctl_rate = &sband->bitrates[mi->lowest_rix];
+ mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
+ ctl_rate->bitrate,
+ !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
+
++ memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
++ mi->max_prob_rate = 0;
++
+ for (i = 0; i < sband->n_bitrates; i++) {
+ struct minstrel_rate *mr = &mi->r[n];
+ unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
+@@ -460,6 +477,8 @@ minstrel_rate_init(void *priv, struct ie
+ } while ((tx_time < mp->segment_size) &&
+ (++mr->retry_count < mp->max_retry));
+ mr->adjusted_retry_count = mr->retry_count;
++ if (!(sband->bitrates[i].flags & IEEE80211_RATE_ERP_G))
++ mr->retry_count_cts = mr->retry_count;
+ }
+
+ for (i = n; i < sband->n_bitrates; i++) {
+@@ -471,6 +490,7 @@ minstrel_rate_init(void *priv, struct ie
+ mi->stats_update = jiffies;
+
+ init_sample_table(mi);
++ minstrel_update_rates(mp, mi);
+ }
+
+ static void *
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -9,7 +9,8 @@
+ #ifndef __RC_MINSTREL_H
+ #define __RC_MINSTREL_H
+
+-#define EWMA_LEVEL 75 /* ewma weighting factor [%] */
++#define EWMA_LEVEL 96 /* ewma weighting factor [/EWMA_DIV] */
++#define EWMA_DIV 128
+ #define SAMPLE_COLUMNS 10 /* number of columns in sample table */
+
+
+@@ -27,7 +28,7 @@
+ static inline int
+ minstrel_ewma(int old, int new, int weight)
+ {
+- return (new * (100 - weight) + old * weight) / 100;
++ return (new * (EWMA_DIV - weight) + old * weight) / EWMA_DIV;
+ }
+
+
+@@ -62,6 +63,8 @@ struct minstrel_rate {
+ };
+
+ struct minstrel_sta_info {
++ struct ieee80211_sta *sta;
++
+ unsigned long stats_update;
+ unsigned int sp_ack_dur;
+ unsigned int rate_avg;
+--- a/net/mac80211/rc80211_minstrel_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -68,7 +68,7 @@ minstrel_stats_open(struct inode *inode,
+
+ file->private_data = ms;
+ p = ms->buf;
+- p += sprintf(p, "rate throughput ewma prob this prob "
++ p += sprintf(p, "rate throughput ewma prob this prob "
+ "this succ/attempt success attempts\n");
+ for (i = 0; i < mi->n_rates; i++) {
+ struct minstrel_rate *mr = &mi->r[i];
+@@ -86,7 +86,7 @@ minstrel_stats_open(struct inode *inode,
+ eprob = MINSTREL_TRUNC(mr->probability * 1000);
+
+ p += sprintf(p, " %6u.%1u %6u.%1u %6u.%1u "
+- "%3u(%3u) %8llu %8llu\n",
++ " %3u(%3u) %8llu %8llu\n",
+ tp / 10, tp % 10,
+ eprob / 10, eprob % 10,
+ prob / 10, prob % 10,
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -126,6 +126,9 @@ const struct mcs_group minstrel_mcs_grou
+
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
+
++static void
++minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
++
+ /*
+ * Look up an MCS group index based on mac80211 rate information
+ */
+@@ -244,6 +247,7 @@ minstrel_ht_update_stats(struct minstrel
+ struct minstrel_rate_stats *mr;
+ int cur_prob, cur_prob_tp, cur_tp, cur_tp2;
+ int group, i, index;
++ bool mi_rates_valid = false;
+
+ if (mi->ampdu_packets > 0) {
+ mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
+@@ -254,11 +258,10 @@ minstrel_ht_update_stats(struct minstrel
+
+ mi->sample_slow = 0;
+ mi->sample_count = 0;
+- mi->max_tp_rate = 0;
+- mi->max_tp_rate2 = 0;
+- mi->max_prob_rate = 0;
+
+ for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
++ bool mg_rates_valid = false;
++
+ cur_prob = 0;
+ cur_prob_tp = 0;
+ cur_tp = 0;
+@@ -268,15 +271,24 @@ minstrel_ht_update_stats(struct minstrel
+ if (!mg->supported)
+ continue;
+
+- mg->max_tp_rate = 0;
+- mg->max_tp_rate2 = 0;
+- mg->max_prob_rate = 0;
+ mi->sample_count++;
+
+ for (i = 0; i < MCS_GROUP_RATES; i++) {
+ if (!(mg->supported & BIT(i)))
+ continue;
+
++ /* initialize rates selections starting indexes */
++ if (!mg_rates_valid) {
++ mg->max_tp_rate = mg->max_tp_rate2 =
++ mg->max_prob_rate = i;
++ if (!mi_rates_valid) {
++ mi->max_tp_rate = mi->max_tp_rate2 =
++ mi->max_prob_rate = i;
++ mi_rates_valid = true;
++ }
++ mg_rates_valid = true;
++ }
++
+ mr = &mg->rates[i];
+ mr->retry_updated = false;
+ index = MCS_GROUP_RATES * group + i;
+@@ -456,7 +468,7 @@ minstrel_ht_tx_status(void *priv, struct
+ struct ieee80211_tx_rate *ar = info->status.rates;
+ struct minstrel_rate_stats *rate, *rate2;
+ struct minstrel_priv *mp = priv;
+- bool last;
++ bool last, update = false;
+ int i;
+
+ if (!msp->is_ht)
+@@ -505,21 +517,29 @@ minstrel_ht_tx_status(void *priv, struct
+ rate = minstrel_get_ratestats(mi, mi->max_tp_rate);
+ if (rate->attempts > 30 &&
+ MINSTREL_FRAC(rate->success, rate->attempts) <
+- MINSTREL_FRAC(20, 100))
++ MINSTREL_FRAC(20, 100)) {
+ minstrel_downgrade_rate(mi, &mi->max_tp_rate, true);
++ update = true;
++ }
+
+ rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate2);
+ if (rate2->attempts > 30 &&
+ MINSTREL_FRAC(rate2->success, rate2->attempts) <
+- MINSTREL_FRAC(20, 100))
++ MINSTREL_FRAC(20, 100)) {
+ minstrel_downgrade_rate(mi, &mi->max_tp_rate2, false);
++ update = true;
++ }
+
+ if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
++ update = true;
+ minstrel_ht_update_stats(mp, mi);
+ if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
+ mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
+ minstrel_aggr_check(sta, skb);
+ }
++
++ if (update)
++ minstrel_ht_update_rates(mp, mi);
+ }
+
+ static void
+@@ -580,39 +600,73 @@ minstrel_calc_retransmit(struct minstrel
+ (++mr->retry_count < mp->max_retry));
+ }
+
+-
+ static void
+ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+- struct ieee80211_tx_rate *rate, int index,
+- bool sample, bool rtscts)
++ struct ieee80211_sta_rates *ratetbl, int offset, int index)
+ {
+ const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+ struct minstrel_rate_stats *mr;
++ u8 idx;
++ u16 flags;
+
+ mr = minstrel_get_ratestats(mi, index);
+ if (!mr->retry_updated)
+ minstrel_calc_retransmit(mp, mi, index);
+
+- if (sample)
+- rate->count = 1;
+- else if (mr->probability < MINSTREL_FRAC(20, 100))
+- rate->count = 2;
+- else if (rtscts)
+- rate->count = mr->retry_count_rtscts;
+- else
+- rate->count = mr->retry_count;
+-
+- rate->flags = 0;
+- if (rtscts)
+- rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++ if (mr->probability < MINSTREL_FRAC(20, 100) || !mr->retry_count) {
++ ratetbl->rate[offset].count = 2;
++ ratetbl->rate[offset].count_rts = 2;
++ ratetbl->rate[offset].count_cts = 2;
++ } else {
++ ratetbl->rate[offset].count = mr->retry_count;
++ ratetbl->rate[offset].count_cts = mr->retry_count;
++ ratetbl->rate[offset].count_rts = mr->retry_count_rtscts;
++ }
+
+ if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+- rate->idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
++ idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
++ flags = 0;
++ } else {
++ idx = index % MCS_GROUP_RATES +
++ (group->streams - 1) * MCS_GROUP_RATES;
++ flags = IEEE80211_TX_RC_MCS | group->flags;
++ }
++
++ if (offset > 0) {
++ ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
++ flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++ }
++
++ ratetbl->rate[offset].idx = idx;
++ ratetbl->rate[offset].flags = flags;
++}
++
++static void
++minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
++{
++ struct ieee80211_sta_rates *rates;
++ int i = 0;
++
++ rates = kzalloc(sizeof(*rates), GFP_ATOMIC);
++ if (!rates)
+ return;
++
++ /* Start with max_tp_rate */
++ minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate);
++
++ if (mp->hw->max_rates >= 3) {
++ /* At least 3 tx rates supported, use max_tp_rate2 next */
++ minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate2);
++ }
++
++ if (mp->hw->max_rates >= 2) {
++ /*
++ * At least 2 tx rates supported, use max_prob_rate next */
++ minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_prob_rate);
+ }
+
+- rate->flags |= IEEE80211_TX_RC_MCS | group->flags;
+- rate->idx = index % MCS_GROUP_RATES + (group->streams - 1) * MCS_GROUP_RATES;
++ rates->rate[i].idx = -1;
++ rate_control_set_rates(mp->hw, mi->sta, rates);
+ }
+
+ static inline int
+@@ -702,13 +756,13 @@ static void
+ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
+ struct ieee80211_tx_rate_control *txrc)
+ {
++ const struct mcs_group *sample_group;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+- struct ieee80211_tx_rate *ar = info->status.rates;
++ struct ieee80211_tx_rate *rate = &info->status.rates[0];
+ struct minstrel_ht_sta_priv *msp = priv_sta;
+ struct minstrel_ht_sta *mi = &msp->ht;
+ struct minstrel_priv *mp = priv;
+ int sample_idx;
+- bool sample = false;
+
+ if (rate_control_send_low(sta, priv_sta, txrc))
+ return;
+@@ -736,51 +790,6 @@ minstrel_ht_get_rate(void *priv, struct
+ }
+ #endif
+
+- if (sample_idx >= 0) {
+- sample = true;
+- minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
+- true, false);
+- info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+- } else {
+- minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
+- false, false);
+- }
+-
+- if (mp->hw->max_rates >= 3) {
+- /*
+- * At least 3 tx rates supported, use
+- * sample_rate -> max_tp_rate -> max_prob_rate for sampling and
+- * max_tp_rate -> max_tp_rate2 -> max_prob_rate by default.
+- */
+- if (sample_idx >= 0)
+- minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
+- false, false);
+- else
+- minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
+- false, true);
+-
+- minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate,
+- false, !sample);
+-
+- ar[3].count = 0;
+- ar[3].idx = -1;
+- } else if (mp->hw->max_rates == 2) {
+- /*
+- * Only 2 tx rates supported, use
+- * sample_rate -> max_prob_rate for sampling and
+- * max_tp_rate -> max_prob_rate by default.
+- */
+- minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_prob_rate,
+- false, !sample);
+-
+- ar[2].count = 0;
+- ar[2].idx = -1;
+- } else {
+- /* Not using MRR, only use the first rate */
+- ar[1].count = 0;
+- ar[1].idx = -1;
+- }
+-
+ mi->total_packets++;
+
+ /* wraparound */
+@@ -788,6 +797,16 @@ minstrel_ht_get_rate(void *priv, struct
+ mi->total_packets = 0;
+ mi->sample_packets = 0;
+ }
++
++ if (sample_idx < 0)
++ return;
++
++ sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
++ info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++ rate->idx = sample_idx % MCS_GROUP_RATES +
++ (sample_group->streams - 1) * MCS_GROUP_RATES;
++ rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
++ rate->count = 1;
+ }
+
+ static void
+@@ -837,6 +856,8 @@ minstrel_ht_update_caps(void *priv, stru
+
+ msp->is_ht = true;
+ memset(mi, 0, sizeof(*mi));
++
++ mi->sta = sta;
+ mi->stats_update = jiffies;
+
+ ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1);
+@@ -898,6 +919,9 @@ minstrel_ht_update_caps(void *priv, stru
+ if (!n_supported)
+ goto use_legacy;
+
++ minstrel_ht_update_stats(mp, mi);
++ minstrel_ht_update_rates(mp, mi);
++
+ return;
+
+ use_legacy:
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -65,6 +65,8 @@ struct minstrel_mcs_group_data {
+ };
+
+ struct minstrel_ht_sta {
++ struct ieee80211_sta *sta;
++
+ /* ampdu length (average, per sampling interval) */
+ unsigned int ampdu_len;
+ unsigned int ampdu_packets;
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1372,6 +1372,7 @@ ieee80211_rx_h_sta_process(struct ieee80
+ struct sk_buff *skb = rx->skb;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++ int i;
+
+ if (!sta)
+ return RX_CONTINUE;
+@@ -1422,6 +1423,19 @@ ieee80211_rx_h_sta_process(struct ieee80
+ ewma_add(&sta->avg_signal, -status->signal);
+ }
+
++ if (status->chains) {
++ sta->chains = status->chains;
++ for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
++ int signal = status->chain_signal[i];
++
++ if (!(status->chains & BIT(i)))
++ continue;
++
++ sta->chain_signal_last[i] = signal;
++ ewma_add(&sta->chain_signal_avg[i], -signal);
++ }
++ }
++
+ /*
+ * Change STA power saving mode only at the end of a frame
+ * exchange sequence.
+@@ -2085,6 +2099,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ }
+
+ fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
++ fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+ info = IEEE80211_SKB_CB(fwd_skb);
+ memset(info, 0, sizeof(*info));
+ info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+@@ -2356,6 +2371,7 @@ ieee80211_rx_h_action(struct ieee80211_r